Episode 11 · · 35 min
Yaron Levi Entrepreneur to Security Architect to CISO and Security Champion
CISO at Blue Cross and Blue Shield of Kansas City
Episode summary
Yaron Levi is the CISO for Blue Cross and Blue Shield of Kansas City. We talk about what he looks for in people when hiring in Infosec and a time when he took a chance on someone (against the opinion of his peers), and his chance was a big success. We also discuss a breach he had to deal with only 3 months into his job!
BIO
Yaron Levi is the CISO for Blue Cross and Blue Shield of Kansas City (Blue KC). In this role, he manages a team responsible for information risk management, cyber defense, regulatory and compliance, architecture and engineering, and identity and access management for an organization that provides health insurance for about 1 million members and has over $2B in annual revenue.
Prior to joining Blue KC, Yaron was a Director of Information Security for Cerner Corporation, an Information Security Business Partner for Intuit, an Information Security Architect and Product Manager for eBay, and a Director of Cloud Security for ANX.
Yaron is a Research Fellow for the Cloud Security Alliance (CSA). The Research Fellow designation is the highest honor and distinction given to a CSA research volunteer who has demonstrated significant contributions to CSA research. Yaron is a co-chair and lead architect of the Cloud Enterprise Architecture. Contributor to the Consensus Assessments Initiative Questionnaire (CAIQ), Cloud Controls Matrix and promoted the CSA as best practice in various cloud projects with various Fortune 500 companies.
Yaron is the co-founder of the Kansas City CISO forum, B-Sides Kansas City, and is a frequent speaker on Cyber Security Architecture, DevSecOps, and Cyber Defense.
Yaron holds a B.A. in Social Sciences and Management and is a graduate from the FBI CISO Academy.
Notes:
Created his own IT company to pay his way through college
A SOX Compliance project was his first exp
His first computer was a Sinclair ZX81
Had to save up to buy his own Commodore 64!
Yaron's discussion with youth whether a laptop is more dangerous than a gun? What about the 2nd Amendment?
3-months into his job, he experienced a breach!
Quotes:
"Security is one of those areas that you can be part of something that is bigger than yourself."
"Having a real calling for something... that can make a difference."
"It's one of those communities [where] people really want to help each other."
"I think, for many people, there isn't a prescription, if you will, of how and where to start."
"Are you the type of person who likes to crack codes and puzzles and bang your head against the wall for 16 hours...that may lead you to a dead-end or nothing? Oh no, I like to talk to people."
"First and foremost, we are educators."
"Sometimes, when we look for people, we tend to look for people based on a very specific mold or template [unfortunately]"
"Usually, I hire for character first, then skill."
"At the end of that record is a person... a human being."
"I think people need to realize that it can be a very thankless job, not just hoodies and hackers all day long. If you google a "Hacker" today... it's kind of depressing to everyone with hoodies like that... that's not the reality."
"It's all about defense... protection... enablement of the business securely. When everything goes well, nobody really thinks of you, nobody thanks you for that. But when something bad happens, everybody looks for a head to chop."
"It's, in my opinion, one of the more rewarding careers one could have and being part of something bigger than just themselves."
Before infosec: Entrepreneur, IT trainer, software developer and telecom project manager
Chapters
- 0:00
Intro: who Yaron Levi is
Ayman introduces Yaron, the CISO of Blue Cross and Blue Shield of Kansas City, with a few teaser clips of the conversation.
- 1:23
From military and his own IT company to security
Yaron lists his employers and explains how training, software development and a Sarbanes-Oxley project led him into security.
- 4:23
Why security is a calling, not just a paycheck
He argues that people entering for money or glamour burn out, while those driven to help keep going.
- 7:45
Childhood: Sinclair ZX81 and a Commodore 64
Yaron recalls growing up around his father's aircraft industry job and writing his first BASIC programs.
- 10:30
Mentoring youth: is a laptop more dangerous than a gun?
He describes talking to high school students and community work with Women in Security, BSides KC and SecKC.
- 15:17
Challenges for newcomers and misconceptions about security
He explains why there is no clear path in, and why everyone says they want to do forensics.
- 18:26
War story: a third-party breach three months in
A card-printing vendor was breached over the July 4th weekend, which tested the incident response process Yaron had just built.
- 23:14
Taking a chance on a hire from outside security
Yaron recruits a process-minded colleague into his AppSec program, faces pushback, and watches her grow into a CISO.
- 32:10
Parting advice: more people, every background
He urges newcomers to see the human behind every record and to expect a thankless but rewarding career.
- 34:42
Closing plug for Ayman's new community
Ayman thanks listeners and invites them to join the new community linked in the show notes.
Key takeaways
- Go into security because you want to help and be part of something bigger, not only for the pay or because it sounds cool.
- Learn what the different security domains actually involve before choosing one, since many people want forensics without liking long, tedious investigations.
- Expect a lot of the work to be tedious and thankless, because success means nobody notices you.
- Hiring managers should hire for character first and teach technical skills, instead of demanding a fixed template of years and certifications.
- Build an incident response process before you need it, because a breach can arrive within weeks.
- Get involved in local communities such as BSides, SecKC or Women in Security to meet people and ask questions.
Notable quotes
Security is one of those areas that you can be part of something that is bigger than yourself.
usually I hire for character first, then skill.
at the end of each of those records, there's actually a person. There's a human being.
Questions answered in this episode
- How did Yaron Levi get into cybersecurity?
- Yaron started with military service in technology, then ran his own IT training and software company to pay for college. A Sarbanes-Oxley driven identity and access management project at a telecom software company pulled him back toward security, and joining ANX made it his full-time focus.
- What does a CISO look for when hiring for security teams?
- Yaron hires for character first and skills second, because technical skills can be taught while character is very hard to teach. He also keeps his team diverse and is willing to hire people from outside security, such as a process and risk professional he turned into a CISO.
- Do you need a technology background to start a career in infosec?
- No. Yaron says security needs people of all skills, ages and experiences and that people from other backgrounds bring valuable perspective. What matters is a genuine drive to protect people and willingness to put up with frustrating, sometimes thankless work.
Show notes and links
Show the original episode notes
Yaron Levi is the CISO for Blue Cross and Blue Shield of Kansas City. We talk about what he looks for in people when hiring in Infosec and a time when he took a chance on someone (against the opinion of his peers), and his chance was a big success. We also discuss a breach he had to deal with only 3 months into his job!
BIO
Yaron Levi is the CISO for Blue Cross and Blue Shield of Kansas City (Blue KC). In this role, he manages a team responsible for information risk management, cyber defense, regulatory and compliance, architecture and engineering, and identity and access management for an organization that provides health insurance for about 1 million members and has over $2B in annual revenue.
Prior to joining Blue KC, Yaron was a Director of Information Security for Cerner Corporation, an Information Security Business Partner for Intuit, an Information Security Architect and Product Manager for eBay, and a Director of Cloud Security for ANX.
Yaron is a Research Fellow for the Cloud Security Alliance (CSA). The Research Fellow designation is the highest honor and distinction given to a CSA research volunteer who has demonstrated significant contributions to CSA research. Yaron is a co-chair and lead architect of the Cloud Enterprise Architecture. Contributor to the Consensus Assessments Initiative Questionnaire (CAIQ), Cloud Controls Matrix and promoted the CSA as best practice in various cloud projects with various Fortune 500 companies.
Yaron is the co-founder of the Kansas City CISO forum, B-Sides Kansas City, and is a frequent speaker on Cyber Security Architecture, DevSecOps, and Cyber Defense.
Yaron holds a B.A. in Social Sciences and Management and is a graduate from the FBI CISO Academy.
Notes:
-
Created his own IT company to pay his way through college
-
A SOX Compliance project was his first exp
-
His first computer was a Sinclair ZX81
-
Had to save up to buy his own Commodore 64!
-
Yaron's discussion with youth whether a laptop is more dangerous than a gun? What about the 2nd Amendment?
-
3-months into his job, he experienced a breach!
Quotes:
-
"Security is one of those areas that you can be part of something that is bigger than yourself."
-
"Having a real calling for something... that can make a difference."
-
"It's one of those communities [where] people really want to help each other."
-
"I think, for many people, there isn't a prescription, if you will, of how and where to start."
-
"Are you the type of person who likes to crack codes and puzzles and bang your head against the wall for 16 hours...that may lead you to a dead-end or nothing? Oh no, I like to talk to people."
-
"First and foremost, we are educators."
-
"Sometimes, when we look for people, we tend to look for people based on a very specific mold or template [unfortunately]"
-
"Usually, I hire for character first, then skill."
-
"At the end of that record is a person... a human being."
-
"I think people need to realize that it can be a very thankless job, not just hoodies and hackers all day long. If you google a "Hacker" today... it's kind of depressing to everyone with hoodies like that... that's not the reality."
-
"It's all about defense... protection... enablement of the business securely. When everything goes well, nobody really thinks of you, nobody thanks you for that. But when something bad happens, everybody looks for a head to chop."
-
"It's, in my opinion, one of the more rewarding careers one could have and being part of something bigger than just themselves."
Links:
- Yaron Levi on Linked IN
- Yaron on Twitter
- Women in Security KC
- BSides KC
- Sec KC
- Intro Music: Cascadia by Trash80
- Outro: A Rising Wave - Jeremy Blake
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
Welcome, everyone, to another episode of Getting Into Infosec. I'm your host, Eamon Elsua. Today, our guest is Jeroen Levy.
In my mind, first and foremost, or what we're trying to do, we're educators.
Jeroen is a CISO for Blue Cross and Blue Shield of Kansas City.
So three months into my job, we had a breach.
We had a great conversation ranging from his mentorship with the youth and philosophical discussions he had with them, as well as what he looks for when hiring people and things that are important to him when building a team.
When I hire people, first and foremost, yeah, I need some experience here and there, but it depends. But I'm trying to keep my team very, very diverse. And usually I hire for character first and skill.
Yaron also has a wonderful success story of when he took a chance on someone in his organization. That's actually how he came to me. It's when I put out a call on LinkedIn asking for folks if they are hiring managers, they took a chance on someone and if they could share the story. So I really applaud Yaron for coming and taking time to share his story. All right, on to the show.
Hi, Yaron. Thanks for coming on the show. Good morning. Glad to be here.
Great, great. Yeah, thank you for taking the time. So maybe we could just hop into it. Tell us about what you do today and maybe how you got into infosec.
So Yaron Levy, I'm the CISO for Blue Cross Blue Shield of Kansas City today. I've been here in my role for almost three years now. And prior to that, I was director of information security for a company called Cerner. Cerner is a company in the healthcare IT business, engineering. Before that, security business partner at Intuit, security architect at eBay. Then prior to that, I was a director of cloud security for a company called ANX. In addition to that, I'm also a research fellow for the Cloud Security Alliance. I've been volunteering with the Cloud Security Alliance since 2010 and was part of the team that created the Cloud Controls Matrix, CSCM, the Cloud Consensus Assessment, the CAIQ, and also the Trusted Cloud Initiative, which later became the Cloud Enterprise Architecture
Through that, I made a lot of friends in the industry. I learned a lot and it's been fun so far.
That's awesome. And how did you start off in infosec? Did you start right away into infosec or were you in a different field in the beginning of your career?
Yeah, so my career, I guess like many others, right, had like different twists and turns. So my military service was in technology. And after my military service, I decided that I wanted to go to school. And I had to pay for school because, you know, my friends could not afford to pay for school for me. So, in order for me to be able to pay for my school, I started my own company. Initially, it was in information technology. I did some training. I was training people how to use computers. I was training people how to use Office, Internet, email, and things like that. Over time, from there, we got to software development because people were asking, well, you know how to use computers, so can you develop this application for me or what not?
So I started from that, and that was the beginning of my career in information technology. I did everything from system design, analysis, programming, databases, networking, the whole nine yards. And then back in 2000, I joined a company in the telecom space, and I joined them as a project manager. And they provided solutions for telecom companies to manage their networks. So again, technology, everything else. And then around our timeframe, we were contracted by one of our clients back then to develop an identity access management system to sit between everything who touches their network and the network devices themselves. And the reason for that was some of the requirements back then from Simons and Oxley.
So I was part of the team who designed that system. And then I was a pre-sales engineer for that system. So that was my kind of initial back to security, if you will, because I did some security like in my past, kind of in the military and some other places. That was kind of the more formal back into security. And then, you know, when I joined the NX, that was my focus was mostly or only actually, I should say, on security and pretty much took off from there.
Nice. And what was appealing to security infosec field for you?
You know, it's interesting. Security is one of those areas that you can be part of something that is bigger than yourself. And when you look for something in your career, it's not about, okay, I'm just making a living. I mean, you can make a good living in IT, you can make a good living in security, but having like a real calling, if you will, for something that can Really help and make a difference. I found that within security. And I enjoy that very much because what I came to realize as I was going throughout my career is it's one of those communities that people really want to help each other. And you can always have somebody you can learn from. There's a lot to learn. And you should always keep yourself up to date and learn something new and read and research.
And it's moving very, very fast. So there's no doubt moment there. So that's part of it, especially for me, who've been in technology for so long and like to learn new things. That was one side of it. And then the other side, I know people that, you know, trying to get into security or got into security really for the wrong reasons. I mean, you know, they think it's a cool job. I mean, they think it's, you know, good money. I mean, and that's the reason for getting into it. And they don't realize it's a grind. They don't realize that it can be very, very frustrating. And sometimes it's really kind of banging your head against the wall in order to get somewhere. Whether it's a security executive that can be very difficult and frustrating at times to try to sell security within your organization and to your executives and everything.
You know, you see sometimes where they bring a CISO or they bring somebody in charge of security. And pretty much, I mean, they ask him or her, yeah, you know, make sure that we're secure, but don't bother us too much.
No, it's part of the fabric. I mean, it's part of the company. I mean, it's, you know, you don't just kind of bring your own security and you just stop them in a corner somewhere and okay, I just kind of wave it and say, oh yeah, we have a CISO, but you don't really know anything about it. And people who are getting to, you know, to the field and people who are getting into Security and really trying I mean to or doing it like I said not for the right reasons not realizing like you know why they're doing it and then what is the reason they're doing it and you know not wired to help if you will yeah right do the minimum right yeah just do the minimum frustrated and I see them leave I mean I see there's pretty high burnout hmm
You know, with this security space. But on the other side, I mean, if you have people who are wired kind of the right way, and they're really doing it because it's a calling, only because, I mean, they're trying to do the right thing. I've seen them going from one challenge to another and keep charging forward because every step that you take, I mean, every progress you make, I mean, make a big difference for somebody or someone. Again, it's a calling. So we know how security can be challenging. You know, we know how the security industry or I would say the impact because of lack of security around the world.
We can do to try and help that.
That's really good. You know, the altruistic side of security just scratches that itch for you, right? Absolutely. Yeah.
Absolutely. It's like being back in my military days, you know? I think that's one of the reasons I'm seeing a lot of veterans that going into the security space because I think you are wired a certain way and I think a lot of veterans kind of resonate with that.
Yeah, I had a previous guest that was from the Marine Corps and, you know, it seems like a really good field for veterans to get into, you know?
Yeah.
Yeah. And tell us about your childhood. Like, you know, did you have early access to technology or how did you get into technology before your adult life?
Oh, wow. Now I'm really going to dig myself. So I think my first exposure to technology in general, my dad used to work for the Israeli aircraft industry. So pretty much, I mean, I think since I was like two or three years old, I was fascinated with airplanes. And because my dad worked for that company, many times I went to his work and I was a lot around airplanes. So as a young kid, I mean, I started to read about airplanes and that exposed me to a lot of different things and different aspects around technology because You know, airplanes and the systems on airplanes and radar systems and weapon systems, you know, some other things that are pretty cool and pretty interesting. I mean, if you kind of read through them.
And then I got exposed to, I think the first computer I ever saw was a friend of mine. And I don't know if they were very popular in the US at that time, but a Sinclair ZX81.
Nice.
And it was a tiny little computer that had one kilobyte of RAM and it was operating in basics. And almost on every button on the computer, there was a basic command. And that was my first programming experience if you will and i sat there and he showed me how to use it and i think i created this program that pretty much typed my name over and over and over again it was super simple it was like print your own the first line was like 10 because it basically had to kind of numerate the line yeah my number 10 was like 10 print your own and then line number 20 was go to 10 and it was printing my name all over the Thing ever so that was really early days and then i realized okay i can actually create something i can build something i can do different things so i went and took a class i started to learn basics and with that i started to program some you know simple games for myself and it was great because i didn't have to necessarily buy a video game machine i could create my own game now not much graphic or anything else i mean i wasn't that sophisticated at that time
But it was pretty interesting and, you know, solving some problems and doing those different things. And then I wanted to buy like a more sophisticated computer. So I took some summer jobs as a kid and did a bunch of different things from working my grandma at her work or, you know, helping other people or whatnot and collecting some money and And finally, I bought my first Commodore 64.
Oh, so you bought it on your own with your own money.
Oh, my own money.
Absolutely.
Nice.
Okay.
So a Commodore 64 in those days was like a supercomputer. I mean, with all the capabilities it had and, you know, a huge 64K RAM and, you know, an awesome sound system and everything. So that's where I started. And I think I never looked back ever since.
Nice. That's great. So, you know, looking back and then fast forwarding to today, you know, the opportunity that kids have today to learn STEM and, you know, technology. Do you do anything to empower your kids in technology? You know, it's so ubiquitous and so available today. Can you talk about what you do today to maybe help instill technology in your kids or younger folks out there?
But in the community, I had a couple of opportunities to participate through the companies I worked for. So when I worked at Cerner a few years ago, Cerner was sponsoring the CAPS program here with one of the high schools. And as part of the CAPS program, they bring high school kids. I think it's like once a week or once every other week. And they actually learn something, you know, at Cerner around technology. And I got a call one day from a gentleman who was running that program, and he said, hey, do you mind coming and talking to the kids about security? And I said, sure. And I went there, and there were like kids, I think most of them were sophomores and juniors in high school.
Okay.
Which was pretty cool, because they're almost adults, but they're not really adults yet, you know, so it's kind of very kids-like, so it's kind of in the middle, right?
Yeah.
And really kind of providing them the perspective and seeing the questions that they were asking and everything else, that was really, really cool, and We got into really cool conversations and discussions about computers and the power of computers and security and lack of security and what can you do with computer. And I remember one of the things that, and I can't even remember how we got to that conversation, but we've talked about the danger and we've talked about, you know, security and the importance of security. And because now everything in the world is connected and how bad things can happen. And we got into this argument about, more kind of a discussion, I should say, not an argument.
About whether a laptop is more dangerous than a gun.
Interesting.
And they're like, well, of course it's, I mean, the gun is more dangerous. And I said, okay, so let's talk through that, right? And we realized that actually you can do much more damage, you know, with the laptop.
Right.
So then we got into another conversation, which was really, really fascinating, is whether a laptop is considered an arm. And we got into conversation about like the Second Amendment and, you know, is your right to carry a laptop is protected under the Second Amendment. It was fascinating conversation.
Very interesting. Yeah. I made them think, right? Oh, yeah. That's cool.
It was cool because, you know, I mean, they can recite, I mean, you know, like the whole Bill of Rights kind of word to word. And, you know, we got into all the conversations around that. So it was pretty interesting. Very interesting.
Yeah. Eye-opening. That's cool. And are there opportunities at work, given your leadership role, where you've taken a chance on someone or maybe participated in programs with third parties like Europe or anything like that, as far as helping those Getting Into Infosec?
Yes, absolutely. There are several ways that we're doing that. So one of them, partnering with local universities and pretty often speaking with students to the local universities, providing them perspective about our field and about our profession, the opportunities, the needs, and everything else there, and give them the opportunity to ask questions and talk about that. So that was one thing. There's another thing, maybe not very much for younger folks, but one of my colleagues, about four years Kansas City, which is called Women in Security. And as part of Women in Security, also, they encourage women to get more into the STEM field and really to help, you know, support and mentor and grow, you know, people that would like to go into the field.
I mean, predominantly women, but not just women. And, you know, people who aspire to do that, have them that connection and allow them to connect with people, you know, from the industry and kind of help them get there. And as part of that program, they also partnered with Girl Scouts of America.
Oh, nice.
So now they're also helping Girl Scouts to get into that. So with that setting, I had several opportunities to kind of speak with them and talk to people and share our knowledge with people and so on. Another area is I joined a group of people here about three years ago also, and we've started B-Sides Kansas City. Cool. With B-Sides Kansas City, again, you're bringing more and more people into the fold of security. So that's been pretty cool and pretty interesting. And just in general, I mean, different activities, I mean, within the community, you know, whether it's speaking, whether it's there's a local group that is called SecKC. Also bring together once a month, you know, people from the security field or people who wants to be in the security field.
And you go there and you meet people and you ask questions and they ask you questions and you collaborate on different things. So a lot of different, all of these things are happening and being involved in a lot of those. So that's been fun. That's awesome.
What are some of the challenges you're seeing out there for those trying to get into the field?
I think for many people, there isn't really like a prescription, if you will, of how and where to start. I think that's one challenge. And there's a lot of information out there. I mean, if you go and you're looking online, you can look online and you can find a lot of information, but it's kind of confusing. I mean, how exactly to start and how to get into that and really how to get the first chance, if you will, or first opportunity to connect with all that. So I think that's one challenge. I think the second challenge is that because security is so broad and there's so much you can do in security, there isn't like a one path that will lead you there. So I've seen people who started more on the policy side.
I've seen people who started kind of more, you know, on the networking side, on the programming side, I mean, you know, many different places. So how you get from one place to another, I mean, that's another sometimes kind of a bit of maze that it's not easy to solve.
Yeah, a bit of an ocean.
Yeah, pretty much.
And kind of, you know, many different directions.
And there are also a lot of misconceptions about security, right? I mean, I've talked to a lot of people and usually when I interview people and I ask them like, okay, so like, you know, why did you go to security or why did you get into security? And they, you know, give me different reasons or whatnot. And then one of the answers I get from a lot of people and when I ask them like, okay, so where do you see your career goals in security and what do you want to do in security? Almost everybody tell me the same thing. I want to get to forensics. And I'm like, okay, so why do you want to get into forensics? Well, because I think it's cool. And let me give you some perspective and i said you know things like you know it can be very difficult but are you the type of person who likes to crack codes and puzzles and maybe bang your head against the wall for like 16 hours just to find you know a lead for something small that will lead you to bang your head against the wall for another eight hours i mean and that may lead you to like a dead end with nothing oh no i don't like to do that i like to talk to people
So I think there's a lot of lack of understanding of the different fields and domains within security and where you should go with each one of those things.
Yeah, a big focus on the sexy stuff. But if you don't have the tenacity or the big picture, you might get discouraged, right?
Oh, very much so. Very much.
You know, there's some parts in every part of security that just involves a little bit of maybe drudgery or the not sexy stuff, you know?
Absolutely. And that's, you know, it's interesting because when you talk to people and they say, okay, so what is security all about? In my mind, First and foremost, or what we're trying to do, we're educators. Because we're trying to shape a culture and we're trying to build a culture. And we're trying to build a culture of more secure mindset and people being more vigilant and looking around and paying attention and doing the right things. And that's how I think ultimately we can improve and advance the profession and also advance and improve the resiliency of the organization that we're working in. And yes, there is all the other stuff. And all the other stuff, not all of it is very sexy.
Not all of it is very interesting. A lot of it is very, very tedious and sometimes even boring and sometimes very, very ungrateful.
Yeah, that's well said. So do you have any interesting war stories?
Interesting war stories.
That you can share at least.
Well, there are several war stories. So three months into my job, we had a breach.
Oh, boy.
And it wasn't a breach directly against us. And it was published and everything else. So that's public knowledge.
Okay.
But it was a breach against one of our third parties. And it was a company that was producing and printing membership cards that we gave to our members. Wow. And the way we found out about it was kind of by accident because their website was down. Somebody reached out to them and said, hey, we're trying to send you some information because we need to print new cards. And we noticed your site is down. What's going on? And they said they had a problem. And then come to follow up a day later, the website was breached. And that was right after 4th of July weekend. And from there, we've started to work. A full data bridge. It was kind of a perfect storm scenario, if you will, because it was fairly early during my time there.
Our program was not as mature back then. But the good thing was that The one thing I noticed when I joined is that we didn't have like a formal incident response process at that time. So we built one. And like about a month after we built one, I mean, we got this bridge on our hand and we actually got to practice it. So that was a good way to practice it, if you will.
Oh, great. Yeah, great. You had that before the breach. Yeah.
But we learned a lot from it. And then we had to make some updates and changes. A lot of that actually was not very much a technology breach against us. A lot of it ended up kind of more of a privacy breach. But it had all the elements of everything that we had to do in terms of forensics, in terms of understanding what's going on, what could be the impact, who was impacted, how are we dealing with our members, how are we dealing with the third parties. Went to meet with the third party and did all the assessments and everything there. So it was kind of baptizing by fire, if you will.
But it was bad because it was a bridge, but it was good in the sense of like, you know, you got to live through one, if you will, and work through one and learn from it.
Yeah. Can you walk us through, you know, how long it took for a person to, for it to come to your desk, for it to come to your office and find out, hey, we have a security problem? You know, at first it's not really apparent that it's a security problem, right? Right.
Yeah, in that specific case, it probably took us almost a day, almost 24 hours to realize what's going on. Mostly because of the fact that we had no visibility to the system. In other words, it wasn't our system, it was our third party. You know, for all intents and purposes, I mean, they had an outage on their server, if you will, so we could not connect to it. But then after we talked to them and, you know, we started to dig a little bit deeper and started to ask questions, then the information started to come out. Even then, initially, it wasn't very clear because it started with, well, our website got defaced.
Oh, I see.
Okay, digging even further. Okay, so by who or what or what did it look like and how it got defaced? What was the vulnerability? And as we started to get deeper and deeper and deeper, we found other things where the same server was also hosting the site that they used to collect all the information.
Right.
And they also found out that according to the process that they had, they were supposed to delete the files once they received those. There was a breakdown in the process. They didn't.
Okay.
So there was a collection of data there that lasted more than it's supposed to. And, you know, because of that, I mean, the information kind of got out and everything. So that's the body of the bridge, right? Yeah.
Wow, that must have been intense.
Yeah, it took some time. I think working through the entire breach, I mean, beginning to end and after we cleaned up everything, if you will, and resumed the service, you know, whatever they need on their end. And, you know, getting like all the privacy notices, legal things in joint place, everything else. See people's months and months and months of work. Yeah. A lot of people. Wow. And that was a relatively small bridge, if you will.
Wow. Yeah. Yeah. Just name and addresses, right? And ID numbers. So not even social.
Yep. Not even social. It was not anything like that, no. I mean, it fell under the HIPAA definition of a bridge. And we had to work and comply with that. So it was a lot of work.
Yeah, the adrenaline rush that happens when you discover that. I can't imagine that.
Cool. So tell us about a story, if you have one, of when you maybe took a chance on someone, you know, because a little background, I think sometimes we as infosec industry set the bar a little high. You know, we're complaining that there's a shortage, but at the same time, we might not be doing a good job as far as identifying those with the aptitude and the skills, at least the aptitude, right? Because you can train people.
Yeah.
So do you have a story of when you possibly took a chance on someone and they succeeded and just kind of blew it out of the park?
Sure. Actually, I have somebody I'm really, really proud of. But going back to the days when I worked at Cerner, when I joined Cerner, I asked, you know, my VP at the time, or the gentleman who hired me, and I said, hey, what do you need me to work on? What policy do you want me to do? And he said, well, given your background and experience, the first thing I want you to do is to run our security architecture team. But in addition to that, I want you to build vulnerability management program for us, as well as an application security program. I said, okay. And, you know, I started to focus on different things. And when I started to work on the application security program, I was trying to identify and trying to figure out what problems we're trying to solve.
And what I realized is we have a huge culture or we had a huge culture problem there. To make a long story short, about 2,500 developers who didn't really know much about security, but they didn't really want to do much about security. Not our job. We don't have time for this. Somebody else will take care of that. I mean, that's not us. And really, how do you change the culture of an organization to move from, hey, you have to think about security at the beginning. You have to threat model. You have to do risk assessments. You have to build security in because it's extremely difficult to bolt it all at the end. And if your mindset was, well, everything is in our data center and our network is protecting everything, so we don't need to worry about it.
No, now the world has changed and everything is like online, you know, exposed to the web, mobile and so on. So, you know, it's no longer that we have a parameter that we can protect. So I realized that was a challenge and, you know, had to figure out how to go about it. So just beyond technology and beyond the policies and procedures, but also how we're going to educate the organization together.
Yeah.
And it was very difficult, you know, to try and find people and, you know, for that team.
Okay.
Because two reasons. One, you know, the Kansas City market here, it's not like, you know, the San Francisco Bay Area or like the East Coast where you have a little talent pool, there's a big talent pool for security. Here it was much, much smaller. We don't have a lot of big companies or big technology companies here that have a lot of those experiences. So that was one problem. The second problem was, even if we found some people, when it came to compensation, that was something the company... Couldn't really afford for different reasons.
It's a new mindset for them. You know, a lot of times when you're building security, management doesn't understand how much, you know, you have to actually pay them, right?
Exactly. And, you know, all of a sudden, I mean, you see it's an individual contributor role for, you know, let's say an AppSec engineer, but it may cost as much as, you know, a vice president, you know, and they're like, well, you know, we can't really do that. So, you know, there were a lot of challenges that, you know, we kind of had to focus and work on there. So that was six years ago. And what I needed to start with, I needed a partner. I needed somebody who was going to work with me, who understands, you know, where I'm coming from, mindset and everything else. But more importantly, somebody who can help me charge, if you will, on that hill and not going to get discouraged because I knew we were going to get a lot of pushback from people, especially from the development team or development community at Cerna.
So there was a lady that I worked with on another project, and she was tasked with building another process for the company that was a pretty complicated one because it required to bring together a lot of different groups and organizations between engineering, between operations, between security, processes and stuff like that. And it was a very thankless job. And she did it beautifully. It was thankless job because, you know, people have like conflicting incentives and interests and, you know, different groups and they don't have time or whatever. And she did an amazing job just bringing this group together and people together and keeping on task and everything else and creating this solution that basically documented and managed the entire architecture and operations of all the solutions that we had at Cerner.
So I approached her and I said, hey, I know that you are kind of looking to do something a little bit different. I mean, after you're almost done with this project, how about you join me and help me get security? And she's like, well, I don't know much about security. I'm like, don't worry about it. I mean, you know, I can teach you everything I know. But what I need from you is, you know, what you bring to the table is that process, organization, you know, evangelism, if you will, connection, the ability to connect with people and really help kind of solve these really, really difficult problems that are, like I said, very, very thankless job.
Yeah.
And when I brought her to the team, you know, some people kind of raised their eyebrow and like, she doesn't know anything about security or whatever. No, she does. Because she's coming from a background of risk management and some other things and IT background and networking, but she's kind of more in her past. But she has qualities that I need for this role. And people were skeptical. Fast forward two years, not only we built the program, but we had a great adoption, you know, within the company. We took the program also to India. And then she's the one that, I mean, she made a lot of progress. I mean, you know, within the security space. She was the one who founded Women in Security.
Nice. Okay.
And then she was running the application security for us at Cerner. And then when I left Cerner and became the CISO here at Blue Cross, I had a position open and she applied for that position. So we hired her and she was my right-hand person at Blue Cross and she was running security operations for me and helped us build the SOC and business partnership and then some other things.
Great.
And then a month and a half ago, she was recruited to be a CISO for a company.
Oh, nice.
So now she's a CISO for another organization, software development organization. And she's doing pretty well. So, you know, very, very proud to see somebody that, you know, in six years went from early stages beginning, if you will, in security. And, you know, she was successful and she did a lot of things, great things. And now she's her own CISO. So it kind of really makes me proud.
Yeah, that's a great story. That's a wonderful story.
Thank you.
That's really good. Can you tell us more about the criticisms you faced when you brought it on?
Yeah, I think, you know, to the point you made earlier, sometimes when we look for people, we tend to look for people based on a very specific mold or very specific template. And unless they can check all the boxes, you know, of so many years of experience or so many, you know, different certifications or whatnot, I mean, we don't want to take a chance on them. And for me, when I hire people, first and foremost, yeah, I need some experience here and there, but it depends. But I'm trying to keep my team very, very diverse. And usually I hire for character first, then skill. Because the skills, technical skills and everything else, I mean, we can teach that. And usually, I mean, these are things that, you know, we're trying to invest in people for long term.
But characters or specific, you know, attributes that you have as a person and experience are You know, that's very difficult, if not impossible to teach. So that's what I'm looking for people when I hire people. And, you know, for people who were there on the team at that time, when I brought her in, some people really like look at that and felt, well, you know, you bring somebody from the outside. I mean, outside of the security team, you know, we should have been promoted perhaps and take that role. You know, she doesn't know anything about communications security. You know, she's supposedly not technical. I mean, whatever, you know, whatever the case may be. And I had to sit with people on the team and actually, you know, not necessarily justify it, but we had to talk through that.
And we had conversations and there was some pushback, actually.
Yeah, defending your position, basically, your decision.
And, you know, at the end of it, we agreed on some things and didn't agree on others. And at the end of it, what I told them, I said, look, guys, you know, at the end of the day, it's okay to question. It's okay to disagree. We can have a conversation, which we did. And, you know, I don't mind having being very open and honest about a conversation. And if we agree, great. If we disagree, that's fine too. But a decision has to be made. And the nature of my role is that I'm going to make that decision. So I did. And, you know, the beauty about it is that I'm also the one who is responsible and accountable for that decision. So you guys don't have to worry about it. And, you know, I took full accountability and full responsibility.
And, you know, at the end of the day, the results spoke for themselves. I mean, she was highly successful. I mean, our program was highly successful. Our partnership was great. I mean, we've worked very closely, I mean, since then. And what about the proof that she went on to do better and greater things?
Yeah, I think the industry can learn from your experience. That's really good. Cool. So any parting advice that you have for folks out there looking to get into the field?
Personally, I think that security is one of the more fascinating fields that we have. And I think we need more and more people in security. People in all skills, all ages, all experiences. You don't have to start in technology. You can have people who are coming from other different backgrounds because we need that skill and information, skill and experiences. It's really something that is important for us because if we think about, we read about data breaches and we read about so many records and those types of records and social security numbers or whatever. But at the end of the day, if you really think about it, at the end of each of those records, there's actually a person. There's a human being.
And the life of that human being can be impacted severely or dramatically because of that record.
Right.
So when you think about security and why are we doing security, it's because it's personal. And for us, it's for protecting people. And the more people we have that can help us protect and defend, the better we are. And I think that's how we need to encourage people to get into that, as well as helping people and educate them on what are the security practices or the foundations of security practices they need to keep at home, at school, at work, wherever they are. So I want to see more and more people coming into the security profession. I think people need to realize that it can be a very thankless job, not just hoodies and hackers all day long. And I think we're kind of doing ourselves a disservice that if you Google a hacker today and you look at images on Google, it's kind of depressing to see everybody with hoodies like that.
That's not the reality, right? I mean, that's really not the case. It's all about defense and it's all about protection, all about enablement of the business securely. And when everything goes well, nobody really think of you and nobody really thank you for that.
Yeah.
But when something bad happens, everybody are looking for a head, you know, to chop and they're starting to come out and it's like, okay, why this and why that, you know? So.
Yeah.
But that should not discourage, I mean, in my opinion, anybody. I think, you know, the importance of what we're doing is extremely critical. It's, in my opinion, one of the more rewarding careers that one can have and being part of something bigger than just themselves. That's awesome.
Yeah. I think you hit on the head right there. So. Great. Jeroen, thank you so much for coming on the show. I really appreciate your time and wisdom. It was really a treat. Sounds good.
Thank you very much. All right. Thank you.
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.
