Security Confidential S7 E3 Joshua Brown

Manoj Tandon: Hello everyone, welcome to another episode of Dark Rhino Security’s Security Confidential. Today we are honored to have another great guest join us; Joshua Brown is with us. Joshua is the CISO at H&R Block, a company that is very well known. I’m sure all of you have probably associated with them at one time or another. He has deep experience in designing and building information security programs. He is an expert on Zero Trust, which we’re going to talk about. His approach to information security I find somewhat unique, and I really want to get into this because he says it is to transparently support and drive business initiatives, leveraging security capabilities to differentiate companies. That’s something that is sorely missing in the industry, if you will, from a lot of people. Joshua has spoken at InfoSec World, at InfraGard, and at ISSA. He’s a SANS mentor. In short, he is an expert in helping companies reduce risk. Welcome to the show.

Joshua Brown: Thanks for having me.

Manoj Tandon: Joshua, there are so many questions here, but I found your background fascinating. By your education, you have a great liberal arts education. You’ve studied philosophy in great depth, and somehow you ended up here. Was this a lot of bad decisions, good luck, or what?

Joshua Brown: Well, when I started undergrad, I was convinced that I wanted to be an MD. I was a biology and chemistry double major, which was a huge mistake. But I got to the point of shadowing physicians at Duke University Med Center. I was all in on this. We have lots of doctors in my family; my brother’s a surgeon, my brother-in-law and sister-in-law are both doctors, my uncle was a flight surgeon for the Navy. We have a history there. What I realized as I was studying that is that I was miserable. I didn’t enjoy it. Intellectually I’m fascinated with biology and chemistry and all those things, but it turns out I wasn’t excellent at doing them. I realized the only classes I was really enjoying were the philosophy classes I was taking. So I ended up pursuing a PhD in philosophy. I got pretty far down the road on that; I spent about five years. I didn’t finish my dissertation, but I finished everything else. I got really burned out after that, so I decided to take a sabbatical. I went to The Motley Fool and got a job on the help desk, and the rest is kind of history. I was sitting right next to the security team and I think I absorbed a fair bit through osmosis. I found what they did fascinating because it touched every single aspect of the IT infrastructure as well as the people part. This was embarrassingly long ago. I feel like I date myself whenever I talk about it, but InfoSec was still a very young practice springing off as a sub-practice out of IT. It was natural for me to go from a help desk job to a server job to a fiber networking job to eventually InfoSec. I’ve been doing InfoSec now for about 18 years and IT for about 25, and it’s been a pretty crazy journey.

Manoj Tandon: Fascinating. The Motley Fool brings back memories. Those guys, the Gardner brothers, wrote a couple of fantastic books and they’re genuinely fantastic guys.

Joshua Brown: Oh yeah, it was very much a startup environment. We had about 400 people at the company at that point. They came into the office regularly; we worked with them all the time. Super approachable and just really great guys. It’s still a great company. I think they have the best domain ever: fool.com. I think it’s just brilliant.

Manoj Tandon: That’s awesome. Prior to the show we were talking just a little bit about your eclectic background and how you got into cyber. We’re seeing companies and institutions put in place programs for cybersecurity professionals. Do you think we’re going to be better served having just straight Computer Science or CyberSec people, or is that background of diversity essential to the success of an information security program?

Joshua Brown: It’s a great question, and I wrestle with this one a lot philosophically. I believe that having as much diversity of background, thought, and experience in your InfoSec program as possible gives you a better chance of solving tough problems. I don’t want everybody looking like me, coming from my same background, trying to solve a problem because you’re going to approach it with a very specific set of lenses determined by your experience as a person. I want lots of lenses. I worry about this push toward pre-professional programs at schools now where most schools have InfoSec programs. You’re not going to be studying philosophy, art history, music appreciation, or physics; you’re going to be doing Computer Science. Now, I think there’s great value in every InfoSec professional learning a programming language. If I could right now only hire people that had a development background, I would do it. But the key is that ultimately I’m focused on finding the right people for my program, not necessarily the right skills. Skills can be taught, and tech is changing so fast that I think we have to do a better job of not being gatekeepers about who can join an InfoSec team. If you find the right person with the right passion and intellect, you can help mold and mentor them into the kind of InfoSec professional you need, and they’re going to be highly successful and fulfilled doing it. We have hundreds of thousands of open positions in the US and millions globally. If we’re looking for entry-level people and saying they’ve got to have their CISSP, which isn’t even an entry-level cert, we’re shooting ourselves in the foot. I think as security leaders it is incumbent on us, and more than that, it’s our duty, to train the next generation of security professionals. That means being open to investing your time and your people’s time in grooming and building a cadre of skilled professionals with as diverse a set of backgrounds as possible. I have tons of people on my team now that have no InfoSec background; they came in and they’re just kicking ass. I’ve got second-career people like ex-cops, ex-military, and ex-healthcare professionals. Giving people the right opportunity and resources to fulfill those roles is our job.

Manoj Tandon: Joshua, I’m smiling because our listeners have heard this quite a few times from me, but now they’re hearing it from a CISO at a major company. Some of the best engineers we’ve ever hired didn’t even have Computer Science degrees. One of them came straight out of high school and just had a passion. More than half our company is out of the military. As long as you have the work ethic and the passion, what you’re saying is so right. You can teach the skill, but you can’t teach somebody how to be a strong person or a good person.

Joshua Brown: I used to joke that my only two criteria for hiring were “smarter than me and not a sociopath.” It always got a laugh, but it’s really true. I want people to care about their coworkers and the job they’re doing. As far as technical skills, if you’re lacking something, we’ll get you there. That’s the approach we have to take in terms of building highly successful teams. We have to have skin in the game. You can’t just say, “I’m going to hire the absolute most skilled people I can.” We need to get people fresh out of college and get people excited. There are so many people out there who still have no idea that this is a career path. One of the most successful people on my team right now had a nursing background, had no IT experience, and came out of an accelerator program that H&R Block has, which is largely designed for software engineers. We’ve gotten amazing engineers out of it for InfoSec. Watching those talents progress and watching their minds click and get it is so rewarding. It goes back to my love of teaching.

Manoj Tandon: That’s fantastic. One of the problems I’ve seen with people who have a pure math or Computer Science background is that cybersecurity is really a business problem, not a technology problem.

Joshua Brown: Exactly right. Businesses are starting to realize that security risk is business risk. If we can all speak the same language, we can start moving forward in terms of how we prioritize efforts inside and outside of information security. If we try to force non-IT and non-InfoSec people to speak our language, it’s going to be a miserable failure. One of the things people misunderstand about the role of a CISO is they focus on the ISO part and not the C part. Most C-level executives are not IT professionals, so it’s incumbent on us to meet them where they are, not drag them to where we are and beat them over the head with technology terms.

Manoj Tandon: You also mentioned understanding the adversary. That’s something I think people overlook.

Joshua Brown: Absolutely. That’s why diversity of background matters so much. We joined the FS-ISAC a couple of years ago and were the first non-bank entity to do so. Seeing what your peers and even competitors are facing is incredibly valuable. We really are all in this together. I think having a great security program can be a competitive differentiator for a business, but that doesn’t mean you shouldn’t share indicators of compromise and threat intelligence with your peers. If we wall off our information, we’re all just going to get creamed by attackers.

Manoj Tandon: There’s still a stigma in sharing because it means admitting there was a problem.

Joshua Brown: Absolutely, but growth comes through struggle. Why wouldn’t we share lessons learned when the good guys finally beat the bad guys for a change? We have to approach this as though we’re all in it together, otherwise we’ll get picked off one at a time.

Manoj Tandon: Let’s talk about using cybersecurity as a competitive advantage. How does a company do that?

Joshua Brown: There are a few ways. There’s the obvious marketing angle where companies tout “military-grade encryption” because customers are anxious about data protection. At H&R Block, our reputation is built around taking care of customers’ data. We have some of the most sensitive data imaginable because of the nature of our business, so we take that responsibility very seriously. From a services perspective, offering things like free credit monitoring or Dark Web monitoring creates a halo effect for customers. Then there’s the fact that if your competitors are constantly showing up in the news for breaches and you’re not, that becomes a differentiator by itself.

Manoj Tandon: Have you seen companies use IAM technologies to drive brand loyalty?

Joshua Brown: Anything you can do to reduce customer friction is valuable. If someone has six different accounts across brands they probably use the same password everywhere. One breach can compromise everything. If we can create a single sign-on experience and reduce the number of times customers have to provide information, that’s a better user experience and potentially more secure. But companies often take shortcuts there, avoiding things like password complexity or proper verification because they’re trying to reduce friction. The challenge is balancing convenience with security.

Manoj Tandon: Getting back to threat surfaces, what do you think is facing professional service firms today?

Joshua Brown: A lot of people talk about insider threats or third-party risk, and those are real, but I think the biggest threat is not having a holistic view of information security. I used to frame things as Visibility, Intelligence, and Response. Visibility helps you understand the threats specific to your company. Intelligence helps you apply business logic to those threats. Response is about how well situated you are to contain and recover from incidents. The reality is everybody has a plan until they get punched in the mouth. You can have a great incident response plan, but if you’re not drilling it with Corporate Communications, Legal, HR, and executives, you’re going to stumble when an incident happens.

Manoj Tandon: That really tees up the question of risk. How do you actually measure and define it?

Joshua Brown: If there were one perfect answer, we’d have solved this already. I’ve been talking with peers about the FAIR model because it directly links impact to real dollar impact and speaks the language of non-InfoSec professionals. Risk isn’t just an information security concept. Security risk is business risk. We could spend our entire revenue stream on InfoSec and still get breached. At some point, buying down additional risk doesn’t make financial sense. We need to have honest conversations about prevention, detection, and recovery costs and understand that mitigation isn’t removing risk; it’s reducing it.

Manoj Tandon: And that’s where defense in depth comes in.

Joshua Brown: Exactly. We never solve a security problem by buying one piece of technology. It’s always people, process, technology—in that order. Technology is just the enforcement mechanism for your policies. We have to think holistically.

Manoj Tandon: How do you establish a culture of cybersecurity within an organization?

Joshua Brown: I go back and forth on security awareness training. I think it’s table stakes, but I don’t have illusions about how effective it is by itself. If you have 100,000 employees and only one person needs to click a phishing link for you to get breached, you can’t rely solely on awareness training. You have to think about what happens if somebody clicks. What are your other layers of defense? The other important thing is that if you want to be a partner to the business, you have to see yourself as part of the business. People on my team need to understand business imperatives and how the company operates. If we don’t understand the business deeply, we’re only going to be accidentally successful.

Manoj Tandon: There’s definitely a perception in some companies that IT is the “Department of No.”

Joshua Brown: If your InfoSec program has that reputation, you’ve got a serious problem. I like to tell the story that the first cars didn’t have brakes because they didn’t go fast enough to need them. Brakes were added later so cars could go faster safely. That’s how I view InfoSec. We put guardrails in place to create a safe space for people to try dangerous things. Our role isn’t to tell people no; it’s to help the business make well-informed, risk-based decisions.

Manoj Tandon: That’s brilliant because it introduces the “why” into the equation.

Joshua Brown: The “why” is critical. It’s critical for team building, execution, and creating shared understanding. My job as a leader is to align everyone on a common purpose that resonates with them. Once people understand the “why,” they can figure out the “how.”

Manoj Tandon: Let’s bust another myth: people think that because they’re using cloud providers like Amazon or Microsoft, cybersecurity is automatically taken care of.

Joshua Brown: That’s one of the most dangerous myths. The major cloud providers all publish documents showing where their responsibility stops and yours begins. They’re responsible for the security of their platforms, not the security of how you use those platforms. You can absolutely misconfigure an S3 bucket and expose it to the world. The providers have great security teams, but you’re still responsible for how you configure and secure your applications and data.

Manoj Tandon: Sticking with cloud, what’s your opinion on SASE versus Zero Trust?

Joshua Brown: Like everything else, marketing gets hold of these concepts and suddenly every product claims to be “Zero Trust.” The reality is these aren’t new ideas. Zero Trust is about giving people access only to what they need, only when they need it, and continuously evaluating risk. It’s about identity, visibility, and understanding behavior. If you don’t have a clean identity house or good visibility into your environment, you’re not ready for Zero Trust. Those fundamentals have been around a long time.

Manoj Tandon: This is going to put pressure on smaller businesses that are resource-limited. How do they deal with the shift from prevention into detection and response?

Joshua Brown: The money issue is very real. A $30 million company can’t spend what H&R Block spends on security. That’s where managed security service providers can help because they offer predictable costs and access to trained professionals. At some point, though, companies reach a scale where it makes more sense to bring those capabilities in-house. A managed security service provider will never care about your company as much as you do, but they may still provide better outcomes than what you can achieve internally with limited resources.

Manoj Tandon: What about managing third-party risk?

Joshua Brown: You need a standardized process through the entire lifecycle of the relationship. Before onboarding a vendor, you need to assess things like whether they have a SOC 2 or can complete a SIG Lite. The level of scrutiny depends on the risk they introduce. If they don’t touch customer data, the risk is lower. But if they do, the bar needs to be much higher. If a critical vendor doesn’t have a mature security posture, you have to think creatively about mitigating the risk through controls like managed assets, restricted access, encryption, or segmented environments.

Manoj Tandon: I know we’re coming up on the hour, so I wanted to give you a chance to let our listeners know about any events or things you’re doing.

Joshua Brown: I am speaking at B-Sides and giving a talk called “So You Want to Be a CISO,” helping people understand what the “C” part means and what the role actually looks like. I’m also speaking at the KC IT Summit on building a high-functioning team and helping organizations gain momentum. I also want to call out Women in Security KC, which we support heavily. They’ve been doing amazing things to elevate female voices in the InfoSec community. H&R Block also has an Accelerate program focused on application development security and software engineering where we bring in new talent and help them grow together as a cohort. That information is available on H&R Block’s careers page. Finally, I encourage people to read broadly. I’m currently reading Anam Cara by John O’Donohue and Atomic Habits by James Clear, both of which have been fantastic.

Manoj Tandon: That’s fantastic. We’ll get the links to the organizations and books into the show notes. Joshua, this has been fantastic. Really appreciate you taking an hour out of your day to enlighten all of us on information security. Please keep up the educational effort because I think our industry is severely short in that area.

Joshua Brown: It’s been my pleasure. Great conversation, and thanks for the platform to express my thoughts. I really appreciate it.