Security Confidential S2 E8 Warner Moore

Manoj Tandon: Hello everyone, welcome to another episode of Security Confidential. Today we are honored to have Warner Moore join us. Warner is very well known in our local region in the Columbus market, but he is an international speaker. He’s the founder of Gamma Force, a company dedicated to helping organizations with technology and information security strategy. He has focused his career on working with entrepreneurial growth organizations like CoverMyMeds and Bold Penguin. As an international speaker, he has spoken with Startup Week, CloudDevelop, Path to Agility, InfoSec Summit, CodeMash, B-Sides, DevOpsDays, and Abstractions. Thank you for joining us, Warner.

Warner Moore: Oh, glad to be here, Manoj. Thanks so much for having me, as well as for the kind introduction.

Manoj Tandon: I want to kick this discussion off. You’ve worked with a lot of these high-growth companies. I remember CoverMyMeds was a very small operation and it ballooned into this mega-corporation. Bold Penguin, again, was very, very successful. When you’re looking at these startup companies, what do you look at as the foundations of their cybersecurity program? How do you go about assessing them? Cyber is such a broad arena, how do you decide?

Warner Moore: That’s an interesting thought. For many of the organizations I’ve worked with, even the big organizations, global organizations, I often join to build the security program and often there’s very little in place, or if there is anything in place, it’s very tactical. I think I’ve built over six security and privacy programs, and about half of them include privacy. The thing is, so many organizations, and what I find in startups and growth companies, usually what drives the conversation is either a compliance factor or a customer factor where a business-to-business company who has enterprise or large customers is asking the company to be more mature from a security and privacy or technology operations perspective, usually a combination of all three of those things. Often they want a SOC 2 report, or they want to be HIPAA compliant, or something similar. They just want it. And it’s never really that simple. Somebody can say they want SOC 2, but it’s more than that; it’s a couple years of work and a massive amount of effort. I’ve known organizations that just got HITRUST because someone told them to, and HITRUST is one of the biggest undertakings in organizations. It costs a lot of money and an incredible amount of time. Especially for a startup, that can slow an organization down. They spend a lot of money in areas that don’t provide value because they’re low-risk areas. So when I go into an organization with a new security program, I look at two things: first, what are the business drivers, be it compliance or customers? There are usually meaningful business needs driving security. Second, I look at the risk. Those two things drive everything, which is the way it should be.

Manoj Tandon: You’re familiar with the SANS sliding scale of cybersecurity where they say you should make your investments from left to right, going from architecture all the way to offense. You’re not following a formulaic approach; you’re very much looking at the drivers and the risk first, and then determining what areas matter.

Warner Moore: Absolutely. So many security professionals like to take a formulaic approach. They’ll walk in and say NIST CSF, 800-53 security controls, ISO 27001, or whatever their preferred framework is, and they try to implement that as the standard. Now, I like frameworks, and CIS 20 and NIST 800-53 are great frameworks. However, those frameworks by themselves don’t necessarily take the strategic view, and it’s easy to get lost in an implementation plan and get so far along that you forget about things like risk and business needs. I wouldn’t get anywhere near even talking about a framework or a compliance initiative without first exploring what the business needs are, what data’s involved, and the risk. Those assets, threats, and vulnerabilities—the risk formula. Without taking that view, it’s really easy to spend a lot of money in ways that don’t provide meaningful security or business value.

Manoj Tandon: Warner, I am ecstatic to hear you say that because I agree with you completely. We have seen in our business a lot of companies that do tend toward that formulaic or very technology-centric approach, when the very first questions that should be asked are: Is my risk being mitigated? To what level? Am I protecting the assets that genuinely need protection, or am I patching vulnerabilities that really aren’t that material to what we’re doing in the first place? It’s refreshing that you would take that view. So, how do you assess the risk in these organizations?

Warner Moore: I look at what the organization does. I look at the data. Those two things usually quickly drive the conversation. If it’s an organization that’s handling Protected Health Information, HIPAA is very quickly going to become a focus, and in HIPAA some things are non-negotiable. So if it’s a HIPAA organization, you focus there. The same is true of other data types. First looking at the data that’s involved and the assets, and then driving the conversation from there. I think for a lot of the organizations I work with, there are themes. It might just be because of the types of organizations that I tend to work with; a lot of them are tech companies and they’re building software and products. If a company’s business is building technology or software, the SDLC is going to be an obvious risk. In the Software Development Life Cycle, if somebody doesn’t have secure coding practices embedded into the way they build software, and that’s their business, they’re probably missing something. If nothing else, that’s a risk that should be talked about and explored.

Manoj Tandon: What about in their applications themselves? Following good development practices is one thing, but following good security practices within their own product—is that something that you examine as part of your work?

Warner Moore: It’s a great perspective. It’s something I’ve been thinking about a lot over the past year. The reason why is I was attending a CISO forum and a topic came up about a product-centric CISO. I’d never really thought about it from that perspective using those words before, but I’ve always worn that hat because many of the organizations I work with are building technology products. If you’re building a product, especially a business-to-business product, security features are going to be a part of that. For example, so many organizations are going to want to have single sign-on integrations or similar ways to tie identity management together. If it’s a SaaS product, we’re probably going to have APIs. If we’re not building security features into our APIs, we’re probably missing something pretty big. That is very much part of the conversation. If you are a CEO or a security person working in an organization who is building products that people use, and you’re not considering security from a product perspective, that might be a gap. It is something I’d encourage all organizations to consider.

Manoj Tandon: You mentioned recurring themes. Besides the SDLC, are there other recurring themes that you see coming up in talking to leadership?

Warner Moore: A lot of organizations have trouble engaging on the topic of cybersecurity strategy. Like our conversation began, many organizations now are exploring building a security program because their customers ask them to. It’s very easy to have a conversation with the customer and say yes to whatever they’re asking for because the customer is always right. But often the customers aren’t necessarily taking a risk-based approach either. It’s very important to be able to have a high-level strategic conversation even in the sales cycle. The executives sitting around a boardroom talking about a product and a potential deal—if that deal doesn’t involve high-risk data, and that vendor is put through a very robust risk management or security due diligence process, it often isn’t grounded in risk. It can slow down a deal, impact the deal, or make it prohibitive to do business because it costs too much overhead. I’ve yet to encounter an organization that’s truly deft at navigating a conversation like that at the right stages. If we get too far along in that process, it turns very tactical and it’s very difficult to reset. On the flip side, as security practitioners and leaders, if we’re putting every vendor through a robust process that doesn’t need that level of scrutiny, we are not spending time where we’d be managing higher-risk activities. In security circles, we like to talk about being risk-based, but it’s not happening. There’s a disconnect there, and I think we absolutely need to solve that as security professionals because if we don’t, we will slow down and obstruct business in ways that reduce the value we bring to the table, and we will lose that seat at the table.

Manoj Tandon: I personally feel exactly the same way. Experientially, all of us at Dark Rhino would have a hard time arguing with anything you just stated because we see the same things happening. So it’s definitely out there in the market space that, for some reason, risk is not truly being addressed the way it needs to be addressed in these organizations. I have a personal opinion about it. I think in a lot of instances, the executives that we meet have not yet connected the dots from cybersecurity to revenue threats or revenue improvements. I don’t know why that is, because it seems like you can open up the news and find cases from major banks to major retailers to online retailers who’ve all been breached. If you were to talk to any of their CISOs, they would say they know what they’re doing. But at a fundamental level, if that connection happened between revenue and risk and cyber threats, I think a lot more attention would have been paid to the areas of pertinent interest that need defending.

Warner Moore: Yeah, I like that. I was in an advisory board meeting with a nonprofit about a month ago, and the conversation was about implementing tactical controls. This organization had a bunch of unstructured healthcare data all over the environment, and they kept implementing tactical controls but hadn’t considered something as simple as a risk assessment, which is required under HIPAA. When we started talking about the fines—potentially 1.5 million dollars for a category of HIPAA violations if the risk assessment was not followed—the conversation shifted quickly. I think we have the opportunity to change the dialogue. Ultimately, it’s the language of business finance. If we’re spending a million dollars to mitigate a risk that is only a hundred thousand dollar risk with a low annual rate of occurrence, maybe we’re not spending our money very responsibly.

Manoj Tandon: Is there a methodology that you prefer? I believe you work with RiskLens and that team over there in some capacity. We’ve worked with them and it is a methodology for evaluating risk, albeit a little expensive for a lot of startups. Besides RiskLens or other techniques, are there formal methodologies that you would suggest a company follow to take the bias and subjectiveness out of the exercise?

Warner Moore: The example I just provided was a quantitative risk assessment or a way of looking at it quantitatively. Not all organizations are ready to do that. Most of the organizations I work with tend to take a qualitative approach. I do think the thought process is universal, though. In an organization that’s more mature or bigger, it can be easier to take that quantitative approach because the business maturity will have the sophistication on the finance side to enable those conversations. I don’t have a go-to risk assessment framework. There’s plenty out there and a whole lot of value in them. Some organizations already have one in place, so why take it out? Most of them have similar perspectives. I just like to take that perspective with everything that’s done from the security and privacy standpoint. I think we still have a lot of work to do. More of the challenges tend to be around not necessarily the lack of risk perspective, because most security professionals have some handle on risk management. It’s also a really good way to talk to business leaders because more business leaders understand risk than they do the nuances of security and privacy. However, if security leadership isn’t represented well in an organizational structure, if there’s not board visibility, if they’re a level or two down and managed like a cost center, those are things that make it difficult for a security organization to be effective.

Manoj Tandon: We try and take the focus out of technology to a degree. A lot of times when we’re talking to a client, it becomes about technology: “Can you do this for my firewall?” “Can you do this with a CASB?” “Can you connect our IAM to this?” Very tactical, operational things. I’m not saying those are not important, but we try and steer them more toward a discussion about process. It’s a very difficult thing to do. Some organizations are receptive to it, but by and large, most are not. They think their risks are minimal. I’m struggling to think of a case in the last 24 months where we had the CFO be part of the conversation, which I think is absolutely critical. Understanding not just fines that can be incurred, but losses to reputation, ransoms, and the legal costs of defending yourself against lawsuits if sensitive data is lost. You really have to look at it in that totality, and that’s more a discussion about process than technology.

Warner Moore: I think it depends on the client, their role, and who your stakeholders are. A lot of technology organizations have trouble stepping away from tool chains. It’s just how many of us have been used to working. We buy tools, implement them, and manage the tools and vendors. But I could say similar things about technology as I could about security. If an organization isn’t being strategic with technology in the 21st century, they’re probably at a competitive disadvantage. I like your philosophy around process. I usually use slightly different words, but I think our philosophies are aligned. Tools are often the last step or a much later step. In fact, if we look at the things that protect organizations the most—the CIS Top 20 controls, for example—it’s things like knowing what you have and paying attention to it. If you’re not paying attention to it, let’s fix that first before implementing the latest fancy tool. Most organizations have an opportunity to improve the fundamentals before focusing on implementing the latest and greatest technologies. Tools are honestly one of the last things I focus on when it comes to security. If the access control process isn’t working effectively and consistently, that’s a burning fire that needs to be put out first.

Manoj Tandon: I couldn’t agree with you more. You work with a lot of very innovative companies, but do you see any innovation in cyber defense programs in these organizations? Or in any organization? It seems to me like a lot of the innovation is being done by the bad guys. They’re always coming up with new ways to get inside your organization and extract money.

Warner Moore: If I built the team, probably. It’s tricky because it requires investment. No organization is going to be driving innovation without investment, and it doesn’t matter what part of the business it is, security included. In organizations where I built more innovative security capabilities, we had the best security engineers who actually built stuff, not just set up other people’s products. Those engineers were embedded in and working with leading technology teams: software engineers, test engineers, and other cross-functional teams. They were incredibly innovative. That approach is not common in cybersecurity, though. I do think that a lot of the more innovative engineering teams I work with are more open to doing smart things with security if somebody is able to talk their language. However, if somebody goes in insisting on rigid separation of duties for software deployment without understanding how modern engineering teams work, they’re not going to be successful. I think where we tend to see the more innovative security teams is in organizations that are investing in security. More commonly, that’s going to be organizations where security is their business.

Manoj Tandon: Given that, how do you see setting up an organization to defend against targeted attacks? Defending against unknown unknowns, new TTPs, or abstractions on existing TTPs is a very difficult thing to do.

Warner Moore: I was digging through public financial reports. The Equifax breach cost over two billion dollars over two years. Target publicly stated in their annual report that they spent around 300 million dollars in cash because of their breach. Equifax had insurance that paid over 100 million dollars, but it didn’t even cover ten percent of the breach costs. So relying on insurance is a bad strategy. I’m not sure we can transfer those risks very well at scale. Thinking about being innovative with our defense against innovative attacks, I always think of scope. The assets we want to protect the most—are we focusing our controls there? If we have those assets well locked down, the risk is just going to be lower. I don’t think any organization is truly secure. Even the most secure organizations are at risk of a breach. FireEye announced they were breached by a nation-state. That’s a leading security organization. I don’t think anyone can practically expect to be perfectly secure. But what organizations can do is protect the things they want to protect the most. Organizations that have been around for decades or over a hundred years are at a disadvantage, but they’ve got to start looking at it strategically and executing against that problem. Otherwise, we’ll keep seeing multi-billion dollar breaches.

Manoj Tandon: There was a quote from someone at the NSA who basically said they’re using standard techniques in most cases to penetrate organizations, so their biggest fear is a sysadmin who is actually paying attention. He alluded to good security hygiene as a fundamental. If more sysadmins or organizations paid attention to that, it would make companies incredibly hardened to begin with.

Warner Moore: Do the basics that you haven’t paid attention to, and once those problems are solved, we can talk about tackling the hard stuff. You see how many of these breaches are just from lack of basic hygiene. There are unpatched systems out there that people don’t even know are connected. At Equifax, it was a patch management challenge with Apache Struts that was over 90 days out of date. A patch had been released, and that was the root cause. Target involved an HVAC contractor. Again, hygiene. That’s the ABCs of security: do the basics.

Manoj Tandon: Do you think there is a stage where proactive threat hunting becomes relevant, or do you think it’s relevant to a company at any stage?

Warner Moore: I’ve been thinking about that more recently. My past position has been not to invest as much in that in a security program. It’s expensive enough to build a strong security operations capability, have security engineers on the team, and have mature blue team capabilities. Red team gets even more expensive, and I’ve traditionally looked at it from a business case perspective. If I’m spending fifty thousand dollars a year on penetration tests, it’s going to cost more to hire a full-time person to do that. Now I’ve been seeing a lot more smaller mid-market organizations start to invest in personnel in that space, so it’s got me thinking about it more. I think it’s difficult to create a reasonable business case for red team capabilities in organizations that aren’t very large. However, there’s a lot of value in taking the perspective and empathizing with an attacker. I think there’s a lot of value in having that expertise in the team. I like the concept of purple teams a lot, and after a certain maturity in an organization, it’s worth considering. Once the table stakes are done—if you know what you have and you’re paying attention to it—that can definitely add more security value.

Manoj Tandon: Have you seen companies actually use cybersecurity to increase revenue in the organization?

Warner Moore: Yes. One of the companies for which I built their security program did it because a customer was asking for it. This was a young company with no security program. They were in startup mode, and building a security organization and program in a one-to-two-year-old company that wasn’t working with high-risk data probably would have been on the five-year roadmap, not the one-to-three-year roadmap. But a customer insisted on it, and without us building it, they wouldn’t have become a customer—and a very valuable customer at that. I ended up helping negotiate the deal and got them to pay for us building our first security program. So we did it a couple years sooner than we otherwise would have. It matured our technology operations at the same time. Modern Infrastructure as a Service platforms allow us to build much higher-capability platforms with relatively low cost. Long story short, that customer wouldn’t have become a customer had we not built a security program. There are also many products out there where if they don’t have security features, they can’t address meaningful parts of the market. Most enterprise companies want SAML, identity management, or single sign-on capabilities. If you’re not doing that, you can’t address that market, so investing in security directly ties to business.

Manoj Tandon: I want our listeners to know that we’re not talking about just a cost center here. Cybersecurity has a very meaningful place in revenue generation. It’s a topic I’d love to get you back on to discuss further because there are several examples we could talk about where it was leveraged to create great customer loyalty programs, cross-selling opportunities, or specialized pricing models for certain sets of clients. There are technologies in cyber that weren’t designed for that, but they give you access to information that enables those kinds of things.

Warner Moore: Yeah, I love it. Those are topics I spend a lot of time thinking about. Anyone who has thoughts on it, I’d love to hear their experience.

Manoj Tandon: We’ll definitely set that up. I’m being cautious of time because I know you’re on the clock here, Warner, but I do have one last question for you: How do you see the role of the CISO changing in the future?

Warner Moore: I think it ties very directly to most of our conversation today. If the CISO cannot be strategic, if they cannot operate at the executive team level, they have no place being there. For us to continue to evolve our profession and truly help organizations manage their security risks, we need to not only have a seat at the executive table, we need to communicate effectively to the board and ensure that the board is helping support our initiatives. If a CISO is unable to act as a peer in those circles and have those strategic conversations, we will be less effective as security professionals, less effective as security capabilities within an organization, and we will not make progress on helping our companies become more secure.

Manoj Tandon: Very well stated. And with that, let me ask you: is there anything that you would like to plug? Any new projects or anything you’d like our listeners to know about as we come to the end of this?

Warner Moore: I didn’t come here with any plugs. We’re doing a tech community holiday party, a nonprofit party coming up, but that won’t be relevant much longer after next week. I’m always open to conversation with folks about the topics we discussed today and welcome collaborations, so don’t hesitate to reach out. No plugs, but always welcome a conversation.

Manoj Tandon: We’ll put your contact info or email into the show notes so everyone will know how to reach out to you.

Warner Moore: Thanks so much, Manoj. Thanks for having me. It’s always a pleasure spending time with you and Dark Rhino Security.

Manoj Tandon: Thank you so much, Warner.