Security Confidential S7 E8 Brian Haugli

Manoj Tandon: This is your host, Manoj Tandon, on another episode of Dark Rhino Security Confidential. And today, we are honored to have one of our guests come back. He’s an alum of Security Confidential and he’s got his own podcast, “The CISO Life.” It’s Brian Haugli. He’s a great guy. We will link to his past show here, but for those of you that don’t know him, he’s the CEO of SideChannel. He is a professor at Boston College teaching cybersecurity, and he’s the creator and host of CISO Life, to name a few things. And he is an expert in the field of cybersecurity—all things risk—and we’re glad to continue the conversation with him. Thank you for being here, Brian.

Brian Haugli: Thanks for having me back, Manoj. It’s great.

Manoj Tandon: Yeah, it was a great show last time. One interesting thing was when we talked last time, you really did a focus on SMBs, which I know is the focus of what you do, as it is for us. A lot of people that listen, that kind of hits home with them. They’re like, “Finally we’ve got someone that’s not talking Enterprise, say by Tanium, 5,000-seat minimum, million dollars.”

Brian Haugli: Yeah, that’s not everybody. Actually, Enterprise is fewer organizations than small businesses. If you look at the NAICS codes, it’s something up in the millions of companies in the United States that identify and are structured in the mid-tier. And if you add in small business, it goes even higher. It’s a significant amount. Like I always said, there’s only 2,000 companies inside the Fortune 2000.

Manoj Tandon: That’s right. So there’s everybody else.

Brian Haugli: Exactly. And a lot of folks don’t realize that small businesses can have monster revenues. We’ve had small regional banks that might only have 1,175 employees but they have $4 billion in assets sitting with them, or clearinghouses of credit card transactions that have 12 employees but are knocking out a billion dollars a year in clearings. Small business is not just revenue. We really look at it by the number of employees and the number of resources you’re really going to have to devote to an infosec program.

Manoj Tandon: Yeah, I usually start with, “What’s your employee count?” and then I move to how much you’re responsible for.

Brian Haugli: Exactly. That just gives me a sense of, “Okay, how big are you? How big is the team? What are we working with? Who’s been involved?” And then, what does responsibility actually look like for that team? I had this discussion this morning with somebody who asked, “How do you define mid-market?” I said, “I don’t. I let everybody else define mid-market.” If the client comes to me and says, “We’re a mid-market company,” I’m like, “Great, we’re probably going to work together.” If they’re like, “Yeah, we’re an Enterprise,” we’re probably not a good fit.

Manoj Tandon: Speaking of Enterprise, you were actually in the process of going public last time we talked and things were in a rapid mode of change. Please tell us what’s happened.

Brian Haugli: Yeah, so as of today, we signed and completed our merger in the beginning of July. SideChannel is now a publicly traded company. The company I merged with—I named the new board and became the new CEO—we changed the name of that company and it is now SideChannel, so the brand will continue to be SideChannel Incorporated. We just recently finished with the SEC to change the stock ticker to SDCH.

Manoj Tandon: So you’re on NASDAQ then?

Brian Haugli: No, we’re currently traded on the OTC. It was an OTC company that we merged with, but we have ideas and plans. We’re looking at what an uplist would look like, and that uplist would land us on either the New York Stock Exchange or NASDAQ.

Manoj Tandon: That’s fantastic. Congratulations. I know what a heavy lift that is, Brian.

Brian Haugli: It was not easy. I’m glad we did it and glad we are where we are today. I had a really great discussion this morning with my father. I said, “I’m really happy and very confident in the role that I’m in now with the company where it is.” I feel like I’ve stepped so far away from being that practitioner, being a CISO, and now being the CEO of a company and building a team. I feel so much more comfortable leading an organization and building a team. We jokingly went back to my days in Boy Scouts and being a leader as a young man. He ribbed me and said, “Well, you’re doing it well then.” So yeah, it’s a very exciting time. I’m really excited about what we’re doing and what we’re building for our clients.

Manoj Tandon: You’re still the number one sales guy, which is what the CEO should be. You’re out there, tangible, people know who you are, and that’s a good thing. But I do have to ask one hard question. In terms of being an entrepreneur, I would imagine at some point you’ve done the thing and there might be some other ideas. Is there anything else on the horizon that you’re thinking about that might cause you to repeat this cycle?

Brian Haugli: Well, now the focus for me is obviously bringing value to our shareholders. That’s new for us. I want to make sure they see what we’re doing so they continue to invest in the company. Entrepreneurially, now I just have a new vehicle to focus that energy. I have access now to capital markets. I have access to equity in a company to bring on talent and potentially do mergers and acquisitions. I have all these new tools available to me. I don’t think my entrepreneurial spirit is going away. I’m just going to apply the same thing with more scale. We’ve got a micro-segmentation, zero-trust product that we’ll be launching in September. Development is going into that, so we want to see that through while continuing to grow our services. The SideChannel model has always been that we have these really top-level former CISOs who are experts. We have a great and trusting client base. We can look into our client base and determine not only what’s wrong inside one client, but what’s a systemic gap across many clients. Then we ask, “Can we build something to service that?” That’s what we’ve been doing and that’s what we’ll continue doing, focusing on the mid-market.

Manoj Tandon: Mid-market products and services can scale up to Enterprise needs.

Brian Haugli: Exactly. But your sales don’t go the other way. You have a much more receptive market because you can get in touch with decision-makers at the highest level.

Manoj Tandon: Anything new at CISO Life you want to bring up before we get into the core SMB discussion?

Brian Haugli: Yeah, we’ve started the daily discussion. There was a lot of talk from people saying, “Hey, I saw this in the news. Does that seem scary or important?” I hear a lot from clients and peers asking how to decipher all these news stories. So I had this idea: do a live show a couple times a week where I pick out some of these things and give my view on them. It’s basically, “Yes, this is a scary news cycle. You should worry about it if you’re in the Fortune 50, but if you’re not, don’t.” It’s been a fun way to cut through the noise and level-set people. You’re a 50-person company; if you’re not using that technology, it probably doesn’t matter to you. We also started another conversational show with David Chasteen, former CIA cyber warfare officer, and our head of marketing. We’re tackling bigger and broader topics. Yesterday we discussed privacy concerns post-Roe v. Wade and the breakdown of privacy expectations as consumers using apps.

Manoj Tandon: Explain to the audience what the implications are beyond women’s reproductive rights when it comes to Roe v. Wade and individual privacy.

Brian Haugli: Our view is that providers of technology and data are going to be in a much freer position to share information with people who request it, whether that’s law enforcement or private companies with an agenda. Take period-tracking applications. You download that app and agree to a EULA or terms of service. Do you know what data they’re gathering? Most people don’t read that. In some states post-Roe v. Wade, there is an opportunity for that data to be shared with law enforcement. If states criminalize abortions or traveling out of state for one, now there’s a mechanism to obtain data from these apps to potentially prosecute people.

Manoj Tandon: But how does that materially change from the paradigm before? If you were using the Apple Health app and your data was stored in iCloud, law enforcement could subpoena Apple for it.

Brian Haugli: They need a warrant and reasonable cause. The concern now is that there may be a new basis for establishing that cause. Law enforcement could say, “We believe this person illegally obtained an abortion,” and subpoena data from a tracking app to support prosecution. That wasn’t an existing scenario before.

Manoj Tandon: Wow.

Brian Haugli: Exactly. We also discussed a story from Gizmodo about a 13 or 14-year-old girl who had purchased items at Target. Target then sent her promotional material for a crib because their analytics inferred she was pregnant. Her father saw it before she did. The larger issue is that consumers expect Amazon to analyze their data, but what about when you walk into Walgreens or another brick-and-mortar store? Did you knowingly agree to let them profile your purchases? Companies are synthesizing and analyzing your purchase history to make assumptions about your life. One woman reportedly received a care package with baby formula after she had a miscarriage. Those situations have real-world ramifications. Companies aren’t intentionally trying to hurt people, but their responsibility is often to shareholders, not necessarily consumers.

Manoj Tandon: What is one to do short of paying cash and avoiding loyalty programs?

Brian Haugli: This is where reasonable regulation comes in. When companies aren’t doing the right thing by consumers, governments should step in and define rules. The only other option is not participating, but everyone’s so used to these conveniences. When something is free, you are the product.

Manoj Tandon: So let’s talk about SMBs. A lot of them don’t believe they are targets.

Brian Haugli: That’s fundamental. I literally push those people aside because I’m not here to sell cybersecurity. You either believe it’s a risk or you don’t. But if you are concerned and don’t know why you should be concerned, that’s different. In a small-to-medium business, you might have one or two IT people saying, “Buy CrowdStrike and we’re good.” That’s the extent of their knowledge. The first step is acknowledging it’s a problem. Cyber is a business risk that can impact you. You could get hacked or not, but what are you putting in place to either stop it or reduce the pain if it happens?

Manoj Tandon: So how do you practically assess yourself?

Brian Haugli: First, select a framework or standard. In the U.S., I like the NIST Cybersecurity Framework. Healthcare might use HIPAA. Europe might use ISO. DOD uses CMMC or NIST 800-171. The important thing is to pick something you can actually implement and see through. Most people skip this and jump straight to strategy or tools. First select a framework. Second, assess your current state against it. If you don’t know what your current state is, how can you build toward a target state? Once you assess your current state, you do a gap analysis and determine your target state. Maybe not all 108 controls are applicable, but perhaps 80 are. If you meet 40, then you have 40 to work toward.

Manoj Tandon: If there were a top three things to do at minimum, what would they be?

Brian Haugli: Implement MFA everywhere. In the NIST framework, PR.AC-3 is about managing remote access. That means MFA on admins, users, VPNs, and email. Cyber insurance companies are increasingly requiring privileged access management before they’ll even issue a policy. I also like to see strong email security because email is a huge attack vector. And then incident response. That means having 24/7 monitoring—preferably endpoint detection—and having an actual incident response plan. So many organizations do not have a “what do we do if something bad happens?” plan.

Manoj Tandon: These are table stakes now. So once we know our gaps, the next step is strategy before buying tools.

Brian Haugli: Exactly. It’s people, process, and technology. Do I need to hire people? Improve processes? Then you build a roadmap from your current state to your target state. Prioritization is critical because if you’re deficient on 30 controls, you can’t fix them all at once. You’ll likely tackle one or two at a time while accepting risk on the others.

Manoj Tandon: That’s where insurance is supposed to come in.

Brian Haugli: Right, though people need to read those policies carefully. We actually help clients improve their security posture so they can demonstrate lower risk to insurers and obtain better coverage and lower premiums. Insurance carriers want to understand your risk posture, and standards-based programs make that easier.

Manoj Tandon: There’s often a conflict of interest with salespeople trying to push products before organizations understand their needs.

Brian Haugli: Exactly. One thing that frustrated me as a former buyer was that vendors couldn’t tell me which controls their products actually satisfied. We built the Real CISO platform to map vendor capabilities against NIST and CIS controls. My advice to salespeople is: know what your product actually does against frameworks and standards. Don’t just repeat marketing messaging. Smart CISOs are trying to meet control gaps and build programs to standards because regulators, customers, and boards are asking about that—not mean time to response metrics.

Manoj Tandon: We’ve always said good compliance doesn’t necessarily equal good cybersecurity, but good cybersecurity should naturally lead to compliance.

Brian Haugli: Exactly. Compliance is just one aspect. This exercise helps organizations understand overlap, avoid duplicate tooling, and build comprehensive programs instead of simply checking boxes.

Manoj Tandon: Talk a little about risk engineering. How do you objectively or subjectively score things like lost brand value or lost revenue?

Brian Haugli: Probability multiplied by impact. What are the chances of this happening, and what would the impact be? Maybe Russian APTs are low probability for a mid-market company, but if they did target you, the impact would be enormous. Malware might be much higher probability but lower impact if you have controls in place. Then you ask what actually matters most. If one system generates $1 million a month and another generates $5 million a month, where should you focus your defenses? That becomes a business discussion. The controls become the answer to how you reduce risk for the most critical systems.

Manoj Tandon: Technology groups also need to understand how the business actually operates.

Brian Haugli: Absolutely. This doesn’t just apply to corporations. Nonprofits, governments, counties—all of them need to think in terms of mission impact. If one outreach program impacts seven million people and another impacts a small community, you prioritize accordingly. This model works everywhere.

Manoj Tandon: Brian, we’re coming up on the end here. As always, fascinating conversation. Anything you want to plug before we wrap?

Brian Haugli: You can follow us at SideChannel.com and follow the content I put out on LinkedIn and YouTube. I love doing these talks and I’ll keep doing them as long as people keep finding value in them. I’m just excited to be part of this industry and work on something that’s truly my passion.

Manoj Tandon: Sounds like you’re not working for a living anymore—you’re having fun.

Brian Haugli: It is a good time, and we’re solving real problems for people who need it.

Manoj Tandon: I can’t disagree with you at all. The market space you’ve picked represents one of the largest risks to supply chains in the country. Brian, again, thanks for being here, and anytime you have a major update, just shoot us a note.

Brian Haugli: Perfect. All right, take care.

Manoj Tandon: Thanks.