Security Confidential S8 E1 Boyd Clewis

Manoj Tandony: Hello everyone and welcome to another episode of Dark Rhino Security’s Security Confidential. This is your host, Manoj Tandon. Today, we are honored to have Boyd Clewis join us. Boyd is a very driven person. We’re going to learn a little bit about him today, but to give you a little bit of his background, he’s a self-taught cybersecurity consultant who started off in an entry-level position and now today is helping people earn six-figure incomes in the world of cybersecurity. He was formerly a security architect at American Airlines. He is also the co-founder of Baxter Clewis Cybersecurity. Boyd is the author of “Corporate Security: Proven Ways to Reduce Cybersecurity Breaches” and a highly respected international expert and speaker on cybersecurity. He’s been featured on Forbes, NBC, ABC, FOX, and CBS. Welcome to the show, Boyd. Thank you so much for being here today.

Boyd Clewis: Manoj, thanks for having me. I’m excited about the opportunity to be here. It’s not often that I get to take time out of my schedule just to talk about cybersecurity and my passion. It’s fun for me.

Manoj Tandon: And you know what? Passion is a word that we’re going to underline a couple times in this because, just listening to some of your talks and listening to some of the podcasts you’ve been on, it’s abundantly clear that you have a lot of passion about what you’re doing. So from what I understand, your first gig was somewhere in accounts receivable, and somehow you ended up as a security architect, no less, at American Airlines. And then you started your own company. Kind of walk us through this. How does this happen? It can’t be accidental.

Boyd Clewis: No, no. Nothing is accidental, especially with me. Everything is intentional. I’ll make this brief. When I was working in accounts receivable, I was actually working for one of the biggest copier manufacturers in the world; it was Ricoh Corporation. And we were working in the Dallas area, but IT support and desktop support were actually officed out of the corporate office, which was in New Jersey.

Manoj Tandon: Okay.

Boyd Clewis: So believe it or not, my knack for understanding IT actually came from laziness. What would happen is, when somebody’s computer would break on the accounts receivable team, they would have to ship their laptops to New Jersey. And so what happens when you have five people’s laptops down? I have to do their work. We’re not going to ship those laptops back anymore. I’m going to figure out how to fix these things myself.

Manoj Tandon: You went out of your way to provide better service. Of your own volition, let’s say that.

Boyd Clewis: Hey, I reduced company—looking back, it was a significant value-add because I reduced time and increased productivity. But ultimately, what I was doing was trying not to do other people’s work.

Manoj Tandon: So what happened there then with Ricoh? You started off on the help desk?

Boyd Clewis: No, no, no. So that was all accounts receivable.

Manoj Tandon: Oh, that was accounts receivable? Oh, I’m sorry.

Boyd Clewis: Yeah, so I was doing the tech support in my accounts receivable role. So I wasn’t getting paid as an IT guy; I was getting paid as an accounts receivable person. It wasn’t a lot of money, but what eventually happened is I did that for about three years and I was interested in making the shift into IT. But I was at a place where I was comfortable, so I was afraid to make the shift. But sometimes your comfort zone—you’ll get pushed out of it. What happened is the bigwigs from Japan flew in and essentially fired all of us. They moved operations from Dallas to Orange County, California.

Manoj Tandon: Wow. See, that’s something very non-Japanese to do given their illustrious history of maintaining a workforce. Right?

Boyd Clewis: Yeah, we didn’t expect it, man. It was like, “Oh man, they’re coming in from Japan, we’re going to throw a party, they’re coming to congratulate us on a job well done.” It did not work out like that.

Manoj Tandon: Okay, so you guys became redundant?

Boyd Clewis: Exactly.

Manoj Tandon: So what happened was Ricoh merged with a company called IKON. And IKON had better internal processes, so they decided to go the IKON way and eliminate several of the Ricoh offices.

Boyd Clewis: Got it.

Manoj Tandon: And how did that impact you? I mean, that couldn’t have been a good time, I gotta believe.

Boyd Clewis: No, I was newly married. I had now two kids at that time. And I was kind of panicked, man, because my wife wasn’t working outside of the house. So I’m like, we’ve got one income and now I am unemployed. So it was pretty stressful, but the best thing actually happened from the situation. Number one, even though Ricoh canned us all, they took really good care of us. Number one, they set up our unemployment benefits that started on day one of the end of our jobs, so I didn’t miss a paycheck. Number two, they brought in a career consulting firm to help us recraft our resumes and be able to speak to the experience that we had at Ricoh to make the transition. Okay, so they gave us career consulting, updated resumes, and then a buddy of mine found this place called Creative Ventures. Creative Ventures at that time were offering free CompTIA training for people that were either veterans or laid off from jobs. So they gave me free CompTIA training and certification vouchers.

Manoj Tandon: Wow.

Boyd Clewis: Yep.

Manoj Tandon: You got the golden package of being let go. Most Americans who go through that unfortunate experience—and many people do—they’re just kind of escorted out the door and told, “So long, farewell.” You know, that’s… So I take it you went through CompTIA, and that was your first intro to the world of cyber?

Boyd Clewis: Yeah, it was. It was.

Manoj Tandon: It’s like, man, there’s a whole new world out there. So before I ask you the next question, one thing that I want to understand: how did you avoid playing the role of the victim in a very unfortunate circumstance? Because we see that a lot of times bad things happen—you lose your job or somebody gets ill—and there’s this natural human tendency to say, “Why always me?” Right? Oh yeah, you’re down on your luck. How did you overcome that? What was your drive? I see that smile; I’m curious.

Boyd Clewis: It actually comes from my upbringing. I have very, very strong parents. One of the things that we were led to believe, because I grew up pretty poor, is nothing happens to you; everything happens for you. And so you can either choose to focus on the bad part of things or choose to focus on the positive parts. When you choose to focus on the negative parts, that’s where suffering comes in. So you can have things happen and you can roll with it, or you can… suffering is a choice. Like, “Why me? Woe is me. All this bad stuff is happening.” Or you can look at the brighter side. It’s like… I wholeheartedly believe that every situation has duality, right? Because some people think that becoming rich and successful is cool, then you have some people that think, “Now you’re evil.” Right? Yes, it depends on who’s looking at the situation. But if you try to find the good, then it’ll work. I realized that I had unemployment and I had the opportunity to make a career transition. So to me, I was like, “I’m going to get paid to learn right now.” That was my focus.

Manoj Tandon: Oh my. That’s a great story. But how do you go from CompTIA to being a security architect at American Airlines? Because that is not an entry-level job by any stretch of the imagination.

Boyd Clewis: No, it’s not. So what I did—this wasn’t a thing that happened overnight. It took about… so when I landed that first job, that was 2010. I became the architect around 2015. So it was around five years. Okay. But what I did was—oftentimes, people get into the IT space and they want to go work for the biggest company possible, thinking they’re going to get this huge paycheck. Well, I had a different philosophy. I wasn’t motivated by money; I was motivated by opportunity. So what I did was I went and worked at some small MSP companies—which are Managed Service Providers—that were providing services to 30 or 40 different clients. I did that for a few years, and it was like getting 20 years’ worth of experience in like three.

Manoj Tandon: Yeah, and that’s going to be deep experience.

Boyd Clewis: Exactly, because I was in the trenches. So there was healthcare, legal, accounting companies, auto dealers. I saw so many different verticals, it was ridiculous. And I was learning new stuff again and again. I’m getting paid to learn. That’s the way I looked at it. Like, my entire career, I’m getting paid to learn.

Manoj Tandon: But you—again, it gets back to being motivated. I mean, I think there’s a lot of people—and you know, we work with some groups that serve disadvantaged people—and even though the availability is there for the resources, they have to turn the door handle and kind of walk through that door, right? No one’s going to give it to you. And that is the psychological part of the equation that often is not addressed. There’s this thought that if I just do a cert, now I’ll have a job. Or if I just do… I’m serious.

Boyd Clewis: I know, right? Yeah, it drives me nuts, man. That’s just the stuff I have to contend with online. So what we do is really impactful and I’m so passionate about it.

Manoj Tandon: Please tell us about it.

Boyd Clewis: You have people creating Reddit threads about me or making comments on my Facebook posts or Instagram. “You can’t get into it without a cert” or “All you need is a cert to get a job.” I’m like, “Dude, how many people do you know that have taken foreign languages, aced the class, but can’t speak the language?”

Manoj Tandon: The overwhelming majority of people who did that. But yeah, I’m sorry, keep going.

Boyd Clewis: Exactly. How many people do you know that have driver’s licenses but you would not get in a car with them because they can’t drive? The certification doesn’t mean anything. It’s: can you do the work?

Manoj Tandon: And do you want to do the work, right? You know, that’s the other part of this. You get people and they’re like, “Well, yeah, I just want to check some boxes and that should result in a paycheck.” I think there’s a little bit of effort involved with this, right? Just a little bit.

Boyd Clewis: Effort—it brings me back to another…

Manoj Tandon: I’m sorry, I’m going back to some of these personal questions because you’re such an interesting person. We just want to get our listeners to know you a little bit better here. But being a father of four, did that have an impact on your effort? Has that… is that how you came to say, “I’m going to start my own company. I want to give them something bigger and better”?

Boyd Clewis: Exactly. A guy told me one time, “Power comes from being able to put the ones that you love in a position to earn.” He’s like, “Okay, so you care about that company that you’re working for, right?” “Yeah.” “Can you get your son a job there?” And I was like, “No. I’d have to go ask some people, ‘Hey, can we put something together for my kid?'” I thought about my upbringing. From the age of 13, I’ve been working. I started in sales, so I’d be outside selling books, vacuum cleaners… if it could be sold, I was out there selling it. And so I was like, “I don’t want that life for my kids. That was hard; that was stressful.” What I want them to do is be able to have the option of either going to college or coming to work for me and knowing that life is going to be okay. So, number one: providing for my family, but leaving a legacy that they could join in and eventually take over has been the motivating factor. And that’s why we named the company Baxter Clewis. My wife’s name… her maiden name is Baxter.

Manoj Tandon: Ah. That’s where that comes from. So your wife is literally your partner in the business.

Boyd Clewis: Yep. She’s the president.

Manoj Tandon: Oh, so you just kind of work there then?

Boyd Clewis: Exactly. I’m just a pretty face.

Manoj Tandon: So you guys have set up a pretty extensive training program and you’re trying to help people. When you look at the ads that our industry has, when you look at the wanted ads for cybersecurity, a lot of them… some of them are really interesting. They’re asking for five years or ten years of experience in technologies that have only existed for three years.

Boyd Clewis: Exactly.

Manoj Tandon: Okay, how did this happen? But alright, we’ll go with it. How should people make that transition to an entry-level role if they’re wanting to make a career change? If they’re working at X and want to get into cybersecurity, how do they make that jump when they have no experience? I want to do a little myth-busting on this with you and let’s just do it.

Boyd Clewis: Let’s do it. In my experience, first of all, what I’ve noticed is these job postings that are asking for these 10 years of experience for technology that has only existed for three… number one, someone in HR wrote this job description and has no idea what is really needed for the position.

Manoj Tandon: No idea.

Boyd Clewis: And that actually discourages people from applying. But if people would just toughen up a little bit and not be concerned about the requirements, and be confident in your abilities to have a conversation with somebody, you could actually win some of these positions even though you don’t qualify for them. I am four years removed from my position at American Airlines. On paper, I still don’t qualify for it, but I excelled at the position. And so what people have got to realize is cybersecurity is beyond coding and it’s beyond hacking. There are several positions that only require soft skills and the ability to learn frameworks. And if you come with the willingness to learn, to be a student of the occupation, then you can get a job. Because these soft-skill positions like risk management and auditing… most people don’t really want to do these. So when you can show up eager to do something that adds value that people don’t want to do, how could they not hire you?

Manoj Tandon: Those positions—and it’s interesting you mentioned auditing or risk analysis—they do require you to have some understanding of how a business works. How do you analyze the risk of a business where you don’t even understand the business?

Boyd Clewis: Right, right.

Manoj Tandon: So again, if you don’t have any experience, how would you get into that? Or how would you get past the robots that are blocking your resume? Because a lot of the bigger companies have those.

Boyd Clewis: Exactly.

Manoj Tandon: A lot of robots.

Boyd Clewis: Yeah, I’m ready for this.

Manoj Tandon: Please tell me.

Boyd Clewis: Cyber Hero Rule Number 25: People hire people, not robots. If you want to get a job, you need to connect with the people that are actually making decisions. LinkedIn is a perfect place to have a conversation with hiring managers, because people are looking for entry-level positions they can mold. Why? Because IT people are naturally lazy; that’s why we have shared accounts when we have all these breaches. But if they can find someone who is eager and new and ready to join, then the company can mold you into the professional that they want instead of trying to teach an old dog new tricks.

Manoj Tandon: Now that is going to generate some comments. I love it. That’s Number 25. What’s Rule Number 24? I’m curious. Cyber Hero Rule Number 24—what is that?

Boyd Clewis: We have a whole mantra and set of beliefs inside of the organization. Cyber Hero Rule Number 24: before you go to the point of talking to the hiring people, you need to make sure that you remove low-income skills from your resume. That’s Number 24.

Manoj Tandon: Wow. So your job at McDonald’s—take it off the list?

Boyd Clewis: It’s not the job. A title doesn’t mean anything. It’s all in how you position what you did there.

Manoj Tandon: If you were in IT at McDonald’s, that’s a whole different ball game. But if you were mopping the floors, that’s a totally different ball game. No, is it? I’m asking.

Boyd Clewis: No, absolutely not. It’s all in how you sell your experience. Here’s what you’ve got to understand. When I made my transition from accounts receivable into IT, on my resume I didn’t talk about any of the accounts receivable stuff that I did because it wasn’t relevant to my new position. What I talked about was the tech support—setting up the copiers, the printers, etc.—because that was what was driving me to my new position. What happens is people only talk about experience that they’re paid for or that goes in line with their general title, and then they look unqualified on their resume because it’s like, “Who’s this guy?” But if I’m mopping floors during the day but I’m also plugging up and managing the cash register system, and helping maybe when they’re overworked with processing credit card transactions, then I’ve got something to talk about.

Manoj Tandon: You do. But you know what’s very interesting? I’m going to generalize this for our listeners here a little bit, and you can correct me if I’m wrong. But you are very much contextualizing your story and presenting it within the context of the job that you are seeking.

Boyd Clewis: Exactly.

Manoj Tandon: Which is something that most people do not do. And I guess if you do that, you’ve already automatically differentiated yourself quite a bit from the field.

Boyd Clewis: Exactly. It only makes sense. You’ve got to think about it like this: how many times have you been grocery shopping, or you had some door-to-door salesperson come try to sell you something that you’re not interested in at all?

Manoj Tandon: A whole bunch of times.

Boyd Clewis: Exactly. You know. But if they knew you and they knew the things that you were actually interested in, they came and provided a solution to a problem that you were having, then you would probably be interested in having that conversation. And so that’s what the resume is going to do. It’s a conversation starter to the challenges that the company is having. And then you go to Cyber Hero Rule Number 26: when you start off with the interview question, “Tell me about yourself,” well, you flip that to take control of the conversation. “Well, look, I’ve done a lot of things. Would you tell me specifically what challenges you’re looking to solve right now? Then I’ll tell you about my experience that’s relevant to that.” So I’m saying everything specifically toward the problem and the position that we want. We don’t waste time.

Manoj Tandon: I love it. So let’s back up the bus here a little bit and go to Rules 1 through 5. Let’s do the top five.

Boyd Clewis: Rule Number 1: Don’t be weird, bro. Don’t be weird.

Manoj Tandon: Well, I guess I’m kind of screwed on that one. Okay. Let’s say you’re not capable of doing Rule Number 1, and you’re like me. Then what’s two?

Boyd Clewis: No, no. You’ve passed the test. See, Rule Number 1 is designed for the people—and I love you guys, no offense to any coders out there—it’s the coders that should be in the basement. They’re not people-facing. [Laughter] Because we put people in public-facing positions and you can’t be weird trying to command the attention of execs, explaining risk and things. It just doesn’t work out. Rule Number 2 is to manage your career like it’s a business. Because we don’t look at the traditional model of “I’m an employee.” It’s like, “No, I’m a service provider and the person that I work for is a client.” I’m a service provider.

Manoj Tandon: You know what that does, though? Inherent to that statement is the fact that you have to be comfortable with being uncomfortable. You’ve gotta… if you’re… a lot of people… so I’m going to turn back the clock to my parents’ generation. For them, a job was about getting a job at IBM and you could retire from it. It’s something that you can do every day. It’s reliable; you go do your thing, don’t make a lot of noise, and you’re going to have a good life. You’re going to have the house with the pool. Life’s good; move it along. Rule Number 2 here… if you’re going to take that attitude, I would imagine—in fact, I don’t know how—you can’t be in your comfort zone all the time. You have to be okay with getting out of it.

Boyd Clewis: Absolutely. You have to. And then Rule Number 3: Do not show up to an interview without knowing the salary range. It wastes your time.

Manoj Tandon: Is there a resource you can point people to where they can get that background information?

Boyd Clewis: No, I’m going to tell them right now how to do it. When a recruiter comes to you and they tell you they have this position and, “Hey, we want you to interview,” that’s cool. “Could you do me a favor and let me know what the budget is for the position?” If the budget is outside of your range, you never show up. It’s like, “Hey, you know, thank you. That’s a little bit under the range I’m looking for, but let me know if you have an opportunity that has XYZ range.” Because too many times, people will go through three or four rounds of interviews only to get low-balled at the end of the interview process, and that’s time that you’ve wasted and you never get that time back.

Manoj Tandon: Well, because there’s a golden rule that everyone’s been taught, which is that you don’t talk salary upfront until it’s brought up to you as a topic.

Boyd Clewis: Old, old. Yeah, that’s old stuff.

Manoj Tandon: It is old stuff, Boyd. It’s very much old stuff. But it’s there, and we would be remiss if we didn’t acknowledge it. That’s how people… but that’s also coming from a paradigm where Rule Number 2 doesn’t apply, where you are trying to run your career as a business, right?

Boyd Clewis: Right.

Manoj Tandon: So Rule Number 3 only works if Rule Number 2 is something that you take point on. So what’s Number 4?

Boyd Clewis: Do not accept a job without an annual training budget.

Manoj Tandon: Okay. That’s an interesting one; one that I haven’t heard before. Why?

Boyd Clewis: If you are willing to give the company something that you can never get back, which is your time, and the only thing they’re going to give you is dollars, then you’re trading dollars for hours and you’re only going to go so far. What we believe in is trading value for dollars. And so in order to get more value, they should put something in you so they can get more value out of you, which is training. That’s going to show that they’re willing to make an investment in your future, not just the hours that you worked. All of my jobs and all of my certifications have been paid for by the companies I worked with.

Manoj Tandon: You mentioned that, and I think what you’re asking for is somewhat powerful, at least in cybersecurity. Most of the companies I know do invest and want their employees to maintain certain accreditations and certifications. Stay current; be masters of their craft, whatever they’ve chosen that to be.

Boyd Clewis: Exactly.

Manoj Tandon: What’s Number 5?

Boyd Clewis: Number 5—it’s funny you mentioned that—is mastery of the craft. Mastery. So there’s that saying that goes, “Jack of all trades, master of none.” If you want to be successful and have long-term growth and stand out, you need to have mastery. And specifically, what you want to do is you want to master something at the company that is high value, and people don’t want to do it. Imagine being the go-to guy for things that people don’t want to do. You’re seen completely differently, and that is one way to catapult yourself to success.

Manoj Tandon: Well, if you’re going to start a company like some of us have done, you have to be willing to do that. You have to be willing to go where no one else is willing to go.

Boyd Clewis: Yep.

Manoj Tandon: In our case, I’ll tell you, in Dark Rhino’s case, we service the small and medium business market. We do some work opportunistically in bigger companies, but it’s not like we’re seeking it. That was a conscious choice. Most of our competition wants to work with MegaCorp.

Boyd Clewis: Yep.

Manoj Tandon: And that’s a choice. You know, to work with SMBs anyway, I think you can build an empire on the shoulders of that market.

Boyd Clewis: Exactly.

Manoj Tandon: They’re good people. They’re good people, and they have the same cybersecurity needs as a much larger company, but I think you can affect them much more. But that’s a whole other topic. We’ll get into that in a second. This is fascinating. You mentioned that you—I think I read somewhere that you guys have helped more than 300-plus people make this transition?

Boyd Clewis: 500 now.

Manoj Tandon: 500. Between the people who were successful in doing it and those who were not successful, are there any gaps that you can alert the audience to?

Boyd Clewis: Absolutely. I am a data guy. When I was younger in my career, I used to make what are called emotional decisions. Now that I’m an executive in the company, I don’t make emotional decisions; I make decisions based on the data that I have. And so all of our students are assigned success coaches, and our success coaches have KPIs that move our students through the process of the program. We realized that there are certain triggers and certain what we call activation points that if a student doesn’t hit, they’re unlikely to accomplish their goal. Because graduation from our school means that you landed a job; it’s not “You finished a course, congratulations.” We’re results-oriented. But it comes down to people hitting at least 70% of our program. When they get to that level, they’ve put themselves in a position where success is pretty much guaranteed. But those that don’t hit that 70% mark, they’re unlikely to make it happen. So it comes down to… we pulled our top students who got crazy results, right? They all have something in common. Their “why” was strong—why they’re doing this—and they had a commitment to getting it done. And they took ownership—ownership of their own results. Because I can teach you, I can talk to you until I’m blue in the face, but I can’t go to the interview for you. I can’t make you learn this stuff. You’ve got to be willing to do it. I’m going to make it as simple as possible, but you’ve got to grab the bull by the horns, learn the things I’m teaching you, and then implement.

Manoj Tandon: Very true. Again, it gets back to that: they have to walk through the door.

Boyd Clewis: Yep.

Manoj Tandon: You can show them where it’s at, and you can tell them what’s going to happen on the other side of it, but they’ve got to walk through that darn door.

Boyd Clewis: Exactly.

Manoj Tandon: Give us some of those activation points. Are you able to share any of that?

Boyd Clewis: We’ve got different KPIs and activation points. We have “Onboarding Complete.” Our program is actually broken up into different stages. You’ve got Freshman, Sophomore, Junior, Senior, and then Intern. So when people get to the point of doing the intern stage—and after they’ve had this process we call the Resume Supercharge, after they have their resume supercharged and they’ve gone through the internship and they’ve done interview prep with me—if they got to that part, success is pretty much guaranteed. But for the people that don’t hit those points right there, I’m like, “Dude, what are you doing?” Because the investment in my program is expensive, and I don’t understand how you can invest that type of money and not do the work.

But because of that… I don’t understand it because I’m different. We are doing something that no other company is doing and I hope to give a TED talk about this one day. I believe that mindfulness should be a part of every educational system. Because of things that go on in our day-to-day lives—our upbringing and just past experiences—we carry this trauma with us that literally keeps us in this fight-or-flight situation. And when you’re in that mode, it’s hard to receive and learn anything new. So we have a mindset coach—which happens to be my brother—where he helps people get past those mental blocks and actually puts them in the mental state where they can learn and get past their own issues that are holding them back.

Manoj Tandon: See, this is why early on I asked that question about “Why always me?” There’s that victim survival instinct. You have to rise above that if you’re going to accomplish anything. I don’t care what you’re doing. It’s not even cybersecurity. I don’t care if you’re a piano player, some artist, an athlete… you’ve got to get past that or it’s not going to happen.

Boyd Clewis: Exactly. It’s foundational.

Manoj Tandon: And often… I’ll put this out there for our listeners: when I’m personally looking to hire someone, a lot of the skills—depending on the role—there are some skills where we do need someone out of the box who can do it on day one, but a lot of the skills we’re willing to teach. We’re looking for the personality. Does this person have the ability to deal with the pressure? Are they positive? Are they going to work well with the team? Are they going to be a “Debbie Downer”? Those things matter a lot. Because there’s enough negativity in the world of cybersecurity. You’re dealing with situations that inherently can be problematic, so you don’t want a problematic team member.

Boyd Clewis: Not at all.

Manoj Tandon: Right. Not at all. So, since we are a cybersecurity podcast, let’s go into something a little bit hardcore here. You mentioned in some of the talks you’ve done, PCI DSS quite a bit. Why is that? I know what that is, but for our listeners here, tell us why that is so important to you and your career in cyber, and it might be relevant to other people.

Boyd Clewis: It was so important to my career because that was… when I first went through my first assessment in 2012, after I fell asleep, of course, this is when I realized the value that I could bring to a company. At first, it was just collecting data and talking to these auditors. But I wasn’t seeing the big picture. I wasn’t looking at this like a business technology professional. But as I started sitting in the meetings with the execs and understanding the risk, and hearing these conversations they’re having with the bank and the potential fines and the penalties, I was like, “What I’m doing is really impactful.” It’s really impactful. And being able to explain those controls and really understanding the requirements, and being able to lead different business units to hit compliance standards, I realized that I had something special there.

Manoj Tandon: So, let me ask you a pet question here about compliance. If you’re compliant, does that mean that you have great cybersecurity?

Boyd Clewis: Absolutely not.

Manoj Tandon: There—you heard it from someone who’s a master of their craft on this topic and not from me.

Boyd Clewis: One of the first modules in our program is “Security versus Compliance.” Because in PCI DSS Requirement 8, it says that passwords need to be at least seven characters and have a unique character and some password complexities. Well, “PasswordNumber1” with a capital P is compliant, but it’s not secure.

Manoj Tandon: Absolutely. So it doesn’t matter how compliant you are.

Boyd Clewis: Security and compliance are completely different things.

Manoj Tandon: I love it. And I’m glad it came from you and not from me on this. On that topic, when you look at all the breaches that have happened, if you look at the consequences for the companies when it comes to losing your Social Security number, your credit card data, your home address… these things… there have been so many breaches we can’t even talk about them in the time remaining. But other than fines and bad press, there haven’t been life-altering consequences for companies, whereas the people whose data has been lost, there have been life-altering consequences for them.

Boyd Clewis: Yes, okay, yes.

Manoj Tandon: So that’s a little asymmetrical. What should companies be doing to better safeguard the privacy of that information that you don’t think they’re doing now?

Boyd Clewis: Number one: they need to do the hard things, which is setting a standard of not only compliance, but security. As a security consultant myself, I’ve seen entirely too many companies where the security department is trying to lead instead of the executive setting the standard. We developed this whole “Cyber Hero” mantra for our students and even myself. It’s not about us making money and saving the company, but it’s really about the end user. Because I’ve been a victim of credit card fraud myself. Especially when using a debit card, you never know when or if the bank is ever going to even give you your money back. So having your funds in limbo, dealing with the financial aspects of missed payments… I don’t want anybody to deal with that. That’s why we’re hardcore on making sure that systems, people, processes, and technology are in place to make sure that companies are protecting their clients’ data—their payment data, personal data, and everything—because it’s just entirely too much that could happen. But the tone has to be set at the top. When I’m consulting with companies and I hear all this complaining and I see all these controls that are not in place, I usually look at the leadership and have a conversation with them. “What are the standards? Have you communicated what the standards are?” That’s where it has to start—at the top—and often that’s where it’s missing.

Manoj Tandon: And then there’s the whole issue of cybersecurity professionals being able to enlighten the executives who should be leading about what the problem set is. Because a lot of times someone is talking zeros and ones, and those guys are talking about the operations of the business, and the two worlds are a little separated.

Boyd Clewis: Yeah, that’s one of the challenges that I try to teach the people that I mentor. That’s why my podcast is called “Don’t Be an IT Guy,” because an IT guy is not going to influence a CEO, but a business technology professional is. I could tell the CEO, “Hey, we need to get this compliance thing done or else we’re going to be fined.” Or I could tell the CEO, “Hey, these vulnerabilities are going to end up costing us 3.5 million dollars because we have the potential to lose 500,000 cards in this database if it’s breached. So we’re going to need an annual budget of $250,000 to bring in some consultants to help us through this. Do I have your support on this?” They need the numbers, man. They don’t care about the technology.

Manoj Tandon: For all you professionals listening out there, that kind of conversation will make a huge difference. People want to hear it, and if you’re that proactive and that confident in the way that Boyd just said it, you’re going to get noticed. I can tell you that for sure. In terms of something actionable for our audience, I was curious—you know PCI DSS inside out. What do you think of switching to something like PayPal, Apple Pay, or the Android equivalent instead of using your credit card? Is that a much more secure environment per se than handing your card at the terminal or storing that data?

Boyd Clewis: Yeah, the whole PayPal thing… when it comes to Android and Apple Pay, those are great alternative solutions to putting your card in places. Number one: with Apple Pay, you can actually rotate your CVV number on demand, which is really cool. But they also create a virtual token of your card. So it’s not really your card, which is great. I would recommend using any type of virtual technology as much as possible versus just your static card.

Manoj Tandon: You wrote a book that talks about proven ways that companies can reduce cybersecurity breaches.

Boyd Clewis: Yep.

Manoj Tandon: Enlighten us on what some of those ways are. What should companies be doing? I think you talked about the executive side of it—the leadership setting standards—but what else should they be doing?

Boyd Clewis: You should be spending a minimum of five million dollars a year on firewalls. Joking. [Laughter]

Manoj Tandon: Well, you know what? I know what you’re about to say on this, but a lot of people want to solve the cybersecurity problem with pure technology, and it’s a people issue.

Boyd Clewis: Exactly. And that’s where I’m getting at. The book is actually focused around the insider threat. I could go to all the big players and buy the best firewalls on the market, but for that little person in marketing or my receptionist, all it takes is one link that they click and it’s game over. So it really comes down to training your staff. Cybersecurity is everybody’s responsibility, not just the security department. Everybody needs to be conscious of phishing emails, clicking links, making sure that computers are locked down, and strong passwords. That’s what it comes down to. And when you have the right governance program in place, you can monitor those things. Oftentimes, companies end up in the position to get breached because they set these standards but they don’t have anybody policing these standards with KPIs. How often are we rotating passwords? How often have we pen-tested our network? How many vulnerabilities do we have open for the past two years that people said they would fix and they never fixed? So it comes down, again, to knowing the numbers.

Manoj Tandon: You know, it’s such a firefight. What you’re talking about is having a longer-term focused vision and sticking to that discipline. But the day-to-day often interferes with the execution of that in many ways. I mean, you look at the CIS Top 18, right? How many companies even get the top three of the CIS components right? We’re not even going to get to four and five. Let’s just do the top three, right? Patching your systems—that’s fundamental, right?

Boyd Clewis: Oh my goodness, right.

Manoj Tandon: It’s hard. They often don’t do it right. But if you have the KPIs—which, if you were to track them, would tie back to risk—and if that risk is not acceptable, now you can make a non-emotional decision about what to do about it, I guess.

Boyd Clewis: Exactly. I hear that all the time during an assessment: “Well, it’s hard.” I don’t care if it’s hard; it’s not impossible. It can be done. But the problem is, from the top down, there’s no accountability. That’s why the KPIs are important, because when you tie those KPIs to somebody’s job, then there’s going to be some action that gets done. “You need to have 80% of systems patched in X amount of time.” KPI against them. They’re at 50% and then next thing you know, they’re in the performance improvement plan. I hate to be that type of guy, but if you want a high-performance culture, you have to manage people to the KPI so that they can improve their performance to hit the goals. Everything else is just a “nice to have” instead of the standard.

Manoj Tandon: Right. And that kind of mentality to instantiate… you’re getting into a culture change there. Especially the mentality of bringing the people of your organization, regardless of their position, into being aware that cybersecurity is their job. That’s definitely a cultural change. That’s what you’re instantiating in most organizations, right?

Boyd Clewis: Yep, it has to be.

Manoj Tandon: It has to be, but you get a lot of resistance on that. “Oh, we’ve always done it this way.”

Boyd Clewis: Oh man, that answer right there drives me nuts.

Manoj Tandon: We get it a lot.

Boyd Clewis: “It was okay last year when the other QSA looked at it. Why is it not okay this year? Why do you want me to do this?” Well, do you want to be on the front page of a newspaper and be another statistic? I don’t think a lot of companies understand the value of the loss that’s going to occur if they get breached.

Manoj Tandon: They don’t. And it’s only after it happens that the reality actually ends up hitting them. And that’s unfortunate. I remember a well-known retailer got breached several years ago. They were kind of light with the security thing, but after that breach was made public and I went to PCI training, they had like 15 people in that class. Yeah, let’s close the barn doors after the horse left the stable. Right. See what you guys are doing now, buddy. [Laughter] Let’s see how this goes. So we’re down to the last couple minutes here. We wanted to give you a platform to talk about anything that you’d like. Is there anything you’d like to plug? Any new books you’re working on, any shows you’re going to be doing, any appearances? TED talks—you mentioned you want to do some of those. The floor is yours, Boyd. Whatever you want.

Boyd Clewis: Sweet. I’ve got a couple things coming up. Number one: I’m going to be speaking at the PCI Community Meeting in Toronto next month. This is pretty cool; this will be the first time that my wife has joined me on the big stage. I’m excited about it. We’re going to be talking about “Training for Gold”—how training your staff and employees can actually be used to increase security and compliance. It’s something I’m passionate about. I’m going to give the leaders out there some really good ideas on how they can shift the culture. The other thing that I’m working on, in the final stages, is finalizing my book right now that I’m writing with Forbes. It’s called “Through the Firewall.” It’s about my story and how we started from the bottom and now we run a pretty successful consulting firm. That’s going to be a really, really good book that should inspire some people.

Manoj Tandon: That’s a great title, I can tell you that. [Laughter] And has anybody from the TED circuit contacted you?

Boyd Clewis: No, hopefully somebody’s listening. Pick me up. I’m waiting. I’m waiting.

Manoj Tandon: Be careful what you wish for, Boyd, because once you get on that, it’s going to be hard to get off that treadmill. Just know that.

Boyd Clewis: I want it. I want it.

Manoj Tandon: Well, Boyd, thank you so much. It’s been an honor and a privilege to have you here. Thanks for your story. Thanks for giving us some sage advice. And when your book is out, “Through the Firewall,” come back and tell us about it. Give our listeners a little bit, even if it’s a 10-minute short. We would love to give people the lowdown on what’s happening with that.

Boyd Clewis: I’d be honored to do that. That would be awesome. It’s been fantastic. I appreciate the time; it’s been fun.

Manoj Tandon: Yeah. Hey, keep up the good work and keep up the cause. You’re making a difference.

Boyd Clewis: Thank you.

Manoj Tandon: Well, take care.