Good afternoon everyone.
Thank you.
What are your expectations from this session?
It's called From the Cyber Trenches.
Any one or two guys?
I asked earlier also.
What are toughest questions you're going to ask them?
Come on.
Well, I'll tell you one thing.
Today's session is all about failures and how you can learn from them.
And how having that I have been hacked on my resume is actually a plus thing.
Right?
That's the whole lesson for today.
So, next slide.
That's the esteemed panel.
And each and every one of the panel members, including myself, have been through attacks.
Some successful against us, some have not been.
But the session today is what does a CISO learn from an unsuccessful attack and from a correct one.
And if you are a CEO or a board member, would you hire a CISO who has never been attacked?
Or would you hire a CISO who has been attacked, who may have survived or may have not, but at least he's been through war.
Just like you'd hire a general who has been through war, won or lost.
Because he at least has been there versus a paper general who's been on theory.
Similarly, all the gentlemen out here will today share very, very intricate secrets without mentioning the company's names.
In their previous lifetime or the current one, of what one learns from an attack.
What happens when you call your CEO at 2 in the morning and say, Sir, sorry, my website's hacked.
Believe me, you start memorizing that line 5 times.
I have done that.
In that 5 days of firefighting or 2 days, you grow 5 years.
The white hair here and the white hair here sometimes shows that and shows yours.
So let's begin.
It's going to be a fun session.
Please ask them toughest questions and we'll learn from this.
So I just captured that.
But the time has come to...
There's one line which sums up all this.
The time has come to view a breach on your resume as a strength rather than a weakness.
And that's the very essence of this session.
The panel is now getting more curious.
Okay, next one.
So, Abraham Lincoln has been through multiple failures and each failure, as he mentioned, has taught him something.
Similarly, all of us, whether you call it a failure or not failure, I'm not sure.
But each failure has taught something and the lesson is, are you too afraid to fail or do you want to fail and learn fast?
And similarly, our cyber security industry must evolve its attitude and cultural outlook to learn from attacks.
There'll be no CISO who has not been attacked badly or not.
CISO worth his salt would have gone through battles.
Some are on the panel, let's share your stories.
Some stats, but the main thing is, the more experienced you are, the more less you're worried about stress.
If there are two candidates, one who's been through attack and who can manage stress and one who's never been through attack, who would you hire as a board?
Who would you give a million dollar job to?
Assuming these guys have that salary.
Next.
So, let's go on the main questions.
The main... yeah.
So that's your panel, gentlemen, ladies.
And we start off with the first question.
Okay, that's it.
So, open to anyone who wants to answer and some of them have been checked.
Panel, what...
and Manish is all geared up, I like that.
What are toughest incidents in your life and what have you learnt from them?
And what's your knowledge and lessons to the panel?
We'll do a live mind mapping like before.
The year is 2003.
The year is 2003, capture that.
This is a long time ago, right?
Ek din tha ho.
Hello, can you hear me?
He's so passionate he can talk without the mic.
The memory comes alive.
So the year is 2003 and I don't want to go into too many details but the fact is that there was a very very serious breach of incidents at the Ministry of Defence.
Now, you all understand the importance of the armed forces in protecting the nation.
The core difference between information loss in the corporate environment and that in the strategic parts of the government is that you have a financial loss to a certain extent and in the corporate world and you can still recover from that.
In the case of the armed forces or in the strategic environment, information lost is lost.
There is nothing called... I mean that's gone.
There is no... it's not a financial impact.
There is no tangible financial impact that you can calculate and it can have very very serious consequences.
And if this happens on account, we had an interesting session just in the morning where we talked about the human factor.
I don't know how many of you attended that but you know, insider threat continues to be a very very major factor and where there is a motive, where there is a reason for doing that, right?
Where you want to benefit and hence this is something that one can't afford to ever forget in strategizing.
Life is at stake for you.
Absolutely.
What you are saying, other gentleman for them, job is important, so is data, some OT.
But in your case, lives of people who are at stake because national security agents, counter agents, espionage that information if it leaks imagine our spies in another country.
Because some people make the mistake, have made a...
done the cardinal sin of transacting information for financial benefits, right?
But it has very very large...
What is your lesson from that?
So, again, one of the major lessons, I mean, let's remember this is 2000, this is 2003 to 2003 2004, where not much awareness around cyber security was there, particularly amongst the leadership and I think one of the biggest lessons for that was that go back to basics,
have a layered approach to security, have multiple controls internally, you have to evolve, you have to exploit the people, process, technology part to the hill, the same basic fundamentals which we talked, you know left, right and center.
Go back to basics, yeah.
From your experience, what's the toughest experience and how do you learn from that?
I think, I mean, since this is a CISO group of people, I'm sure a lot of technical aspects will come out.
What I want to add is the optics matter of a cyber incident.
Yeah.
You have to learn how to manage the optics of an incident.
Because it's not just you as a CISO who's involved in an incident.
It's you, your company, your CXOs, your employees of that company.
I mean, if a cyber incident brings a whole organization down, those people, however much, thousand, five thousand, ten thousand might be out of a job in a few months time.
The optics of how you manage a cyber security incident is very important.
We would like to say that I will do everything by the book.
Whatever is right, I will do that and I'll disclose Is there really a book for CISOs?
Is there really a book for CISOs how to respond?
There isn't.
That's why we are learning.
I think life experiences are the book that we write for it.
Go ahead, Venkatesh.
So, I think, without getting into specifics of any incident as such, I think two things, of course, echoing what you said...
Do you have a year for your incident?
Do you have a year for your incident, like Manish?
Even if I'm like, I don't want this to be a career limiting kind of statement.
So, I would say two things are very important.
And many of us have gone through it.
In 2017, there were incidents.
And there were incidents also in the past.
So, I've gone through a few of them.
But , I would say two things in addition to what both the gentlemen said.
One is not to panic.
So, at that time, we are stressed out.
Your team is stressed out also.
So , at that time, you want to build a crack team.
We can always say, I will open my incident response book and you will follow all that.
But, it's most important that you get your best guys.
The guys who will walk on water.
Basically, you got to get those two guys into that room, into that war room and they will be the guys leading this entire analysis process for you.
That's one thing.
And you cannot panic because if you panic, the entire team will panic.
The other important thing which I learnt is communication.
And we will again talk about external communication.
I am not talking about that.
Communication with your senior management because they are wanting to know almost hour by hour what's happening.
So, you got to do two things at the same time.
You got to keep upper management at bay.
And you got to let your technical guys do the job.
Because you cannot let both of these guys come together.
Otherwise, it's going to be chaos.
So, you got to still manage up and you got to also manage down where you are getting into the specifics.
So, these two things are extremely critical.
Make sure that you don't panic.
Get your best team to be working on this.
And make sure that you are communicating continuously to upper management so that the actual guys who are doing the work can really continue doing the work.
And ensure your guys don't get the heat.
So, you be the buffer.
Ramesh.
So, when I see in an incident scenario, one, you will be in the middle of some functions.
So, the quick response which you need to be ready without like Venkatesh said, without panic, you respond to the incident immediately and then do the basics.
Understanding the basics of that and keep learning from the basics and implement further into the next sessions which is coming in.
So, mainly to have a quick short-term approach, response to it and then creating a long-term planning, how you manage the crisis when it comes in.
You got the best, most attacked exchange in the country.
Now, what's your learnings?
Even in previous life.
So, like, first I will talk about something, you know, what we are doing it.
But I will also talk about something on some breaches also.
So, if you talk about the cyber security, it's a part of our BCP and cyber crisis management plan.
And not only in IT and operation, but we involve legal, corporate communication, external entities like regulators and because we are very media sensitive activities, most of the department is involved and we segregate between internal and external.
We do the simulation testing on every quarters to check the effectiveness of, you know, not only the process let down, but the effectiveness of our cyber security operations center also.
So, that process is very important and whom going to be talk what?
Because one wrong statement in media and you're gone.
Some of the learning on the actual incident, I don't want to take when it was, you know, done and how but some of thing is like law enforcement agency.
When you are going then, regulator understanding is totally different.
Law enforcement understanding is totally different.
In that same incident they are saying, it's a technical glitch.
Regulator is saying.
They are saying, boss, we have to put this in cyber incident.
We don't have such option, technical glitch.
And cyber insurance, for them, you treat them in different way.
Because their understanding, because you wanted 100% money to be back.
So, how to handle them?
So, all three party involved, where you know my stakes is there.
So, you need to handle all these three parties and it's a good learning, you know.
Finally, we got from all the three parties, you know, complete money but...
I'm sure it's a learning after you've been through it.
But when you are going through it, I'm sure you were going through a... What does it feel?
When you are going through an incident, what is the feeling?
Describe to these guys, what it takes to wake up your CEO at 2 in the morning and saying, sir, sorry website hacked.
So, prime motto is from that, you know, law enforcement agency that the culprit has to be, you know, behind the bar immediately.
And, we have logged the complaint, we have done within a two days.
And that was the extreme part of next state and they bring the guy within a two days, you know, law enforcement agency and we got the culprit and he behind the bar.
So, within a two days, you know, we have done from the law enforcement, we have informed the regulator also and similarly, you know, for the cyber insurance also, we have done the... but that was not the motto, you know, getting the cyber insurance and the penalty for the same.
It's not that important.
Someone is laughing here.
So, Burjess, I mean, a lot of that what you are going through at the point of time is also dependent on the maturity of your senior management.
Oh, I like that.
How mature is my CEO?
Yeah , it could be the CEO, it could be immediately a reporting person because there could be two kinds of pressure.
One is like, you know, if your senior management does understand, like, you know, if you have done some amount of adjustments, you have made, you have kind of explained a few things to him and they are okay, then it's fine.
But suppose, like, you know, you are, like, you know, actually having a hyper senior management, right?
And then every half an hour, this update, that update, etc.
Like, if they are continuously asking, then you may start feeling that, you know, am I going to have a job tomorrow, right?
I mean, is the updates that I am providing, is this good enough, like, you know, for them?
So, sometimes at least I would say I have been fortunate, like, you know, at least in my scenarios like, you know, to have top management who are reasonably understanding, but that may not always be the case.
So, would you think of will I have a job tomorrow comes to the mind?
I'd just like to comment on what he said.
I would say that in most of the cases, the senior management is fairly mature in their outlook, provided and they have a fairly mature response.
I think where many organizations, the internal components fail, is where you do not brief the senior management.
Companies, top of the line, yes, you have done the research.
The smaller companies, who may not have done this drill every quarter, do you think their management is well...
So, as far as the smaller companies, if you talk about this perspective, this is a fairly large, large organizational perspective, including from where I come and where I am.
If you are talking about small companies, well, small companies, senior guys are reasonably grounded.
If they are an IT, ITS company, then they are fairly tech savvy.
Even if they are in a non-IT, ITS kind of a thing, they are fairly savvy.
And they are more grounded.
They really know what's happening and they are more connected with the...
because it's a small team, so there's less likely to be a lack of communication.
The problem is largely in bigger organizations, where if...
Yes, it could be in a bigger organization, if you do not take the trouble of informing and briefing the senior management in time in a manner and in a way that they understand.
So I think the biggest mistake that the community does is use technical jargon, make it overly complicated.
What is... and that drives the stress level of senior management who have absolutely no idea about IT security.
And you need to simplify it.
Vaksim, one question.
But you know, to that point, like on senior management, it's not...
let's not say senior management of big or smaller companies.
That's true, Manish.
It's also about...
It's also about the personality of the person.
So it's like your immediate boss or that person, they are like, you know, what kind of background is he?
Has he seen Breach?
Has he heard about it?
All these are an important factor.
It's a combination of both the culture of the organization as well as the individual person.
So we discussed the what to do.
But Jackson, what is the fabric of a true CISO who has been through attack?
What qualities should he or she have?
So we all said what he has to do, the right things, you know, shield them, protect them and all that.
But what's the true fabric of a CISO?
Unfortunate to say, technicals play a lot of role in this.
You have to get down to the technical nitty-gritty.
Because see, the optics of the matter, I said optics are important.
Everybody else says don't panic about it, don't.
But all of this confidence and all of this can be given to everybody, whether it's upstream, downstream.
It's only if you are fairly, I'm saying 99.9% sure of what you are talking.
When you are sure of it, you exclude that confidence.
So technicals play a lot of part in this.
If not, if not, and I'm not suggesting that, please don't get me wrong, I'm not suggesting that the CISO has to be like in-depth with every aspect of the landscape.
No.
But this is where the team matters.
I just would like to add it that one thing is that how quickly you can respond after knowing internally or externally, how quickly you can respond and find out the RCA that also has become very important for any CISO.
Just to add, the response I get , I think, as a CISO for me, I've felt like the sense of time goes out the window.
Everybody who has to give me an update cannot do it soon enough and everybody who I have to give a report to cannot shut their mouth.
Enough.
I like that.
I mean, if I have to update the senior management, I don't get it.
What happened?
So, for me, Fabric of a CISO, first of all when you say fear for failure Sorry?
Fear of failure.
So, you need to be that in the current industry or current the age which you are working in the security scenarios you need a fearless mind to conduct or run your business.
Second thing when you said you need to be a translator when you are communicating because like Manisha said how will you communicate in the technical jargon to them in the way which they understand and give them a comfort the moment when they are in comfort situation for any leadership communications So,
the questions of the time, everything which will come down.
So, that is the second aspect which we need to see.
How you give a comfort to the senior leadership in your organization saying that how you are managing the scenario how you are coping up the scenario.
The CISO in that time of pressure and heat has to exude calmness.
Exude calmness, yeah.
Very easy to say.
It has to be composed.
You know, the technical Absolutely.
That's the basic fundamental.
He has to know his nuts and bolts.
He has to have good communication skills.
But he has to be calm.
That's a joke.
And more importantly One thing the CISO doesn't have to do in that time.
One thing the CISO should not do in times of an attack.
He shouldn't simply fly off the handle.
Take off like a rocket.
Should not fly off the handle.
He needs to stay calm.
Because if the CISO were to show nervousness were to show a sense of unease it transmits immediately to the team.
And as far as the management is concerned, their sense of assurance goes.
What the management needs is a sense of assurance that alright, something has gone wrong.
It's not a question of if something will go wrong.
It's a question of when something will go wrong, then things will go wrong.
That's the fundamental truth of today's...
So, when something does go wrong, management needs an assurance.
They need that calming factor.
For yourself.
So, one thing Bajaj says, what he should not do is, without with half knowledge, because during an attack, we would not know the full information.
One thing we should not do is, we should not just go about telling everybody what's happening.
So, the information should be kept fairly to people.
It's on a need-to-know basis.
And that would be need-to-know.
It could be certain high-level, some technical people possibly.
Possibly because you may need to do a breach notification.
You may have to give a heads-up to legal.
Possibly, of course, to the CEO and management.
But if you cannot just go around telling everybody, because it will create panic in the organization itself.
Hiding also won't help you, right?
But this is true in case of internal finding.
But this is not true in case of external finding.
So , there your corporate communication, your legal will come into the pictures and whenever external talking is required, it should... The CEO should not directly talking with the media and other stuff.
In that case, it should go with the proper channel.
Corporate communication with the management.
Because that is required a financial input also.
Because some of the time, this bigger organization is very media sensitive and critical.
Ramesh, you want to add something?
Both of these gentlemen whatever is mentioned is correct.
One thing which we shouldn't do is not panic, not sit on the team's head.
So, give them a comfort.
First of all, you need a team to work on.
So, the war room which you are in, you should give the comfort.
The second aspect when you are saying, like we said, you need to know where you need to communicate and what you need to communicate.
Where you need to communicate and what you need to communicate.
And you may need to have a different script for different communication which you need to do.
I am making my notes.
I can sell in the market after that.
That's a very good point.
And that's typically what organizations do for an external incident because now you need to also respond.
You do not have the luxury of waiting indefinitely from a branding and from a company perspective.
So, you need to have stakeholders within the company who you immediately reach out to.
Corporate communications team, legal team, regulatory team.
So, sparks from that there should be a sort of loose organization saying, okay, these are the people to reach out to.
Tough questions.
Mic's not working, gentlemen.
A CISO's worst two questions.
One is, the CEO calls them and says, I got an email from somebody, somebody who's saying your website has hacked.
I have stolen data.
How do you respond to that?
Your CEO got an email from someone, maybe a regulator, maybe a hacker who wants money or whatever else and says, I have your company's information.
Either it's a disclosure of voluntary or for money.
How does one respond to that?
No, first we need to check and let me check, you know, whether it is true or not.
No, no, no.
We'll not call the hacker.
We call.
We have our internal, you know, 24 into 7 next gen cybersecurity operation team is there.
On-premises team is there.
We immediately call them.
We'll check them.
First of all, 24 into 7 monitoring is there in our case.
If it is...
First, it is the worst thing that CEO is talking to me and saying that your website is hacked.
It should be come from my internal team.
That boss, your site is hacked.
So, that first failure itself is there for the CSO itself only.
So, but if you have a 24 into 7 team, so first reply, let me check.
Let me check internally and validate that incident is done or not.
Once incident is done, we have created, you know, the button for cybercrisis management and we'll keep you on updating on that.
And we have activated all, you know, stakeholders on the same.
So, instead of panic it, you know, you need to go with the process.
I just got one word.
First investigate.
Investigate the whole thing.
I mean, there are multiple things to do, depending upon what the situation is, but I think the whole thing is to investigate.
Yeah, and if it's confirmed, I mean, like after you do the initial triage and all, see, I mean, many times we feel that, you know, we cannot talk, like, you know, to whoever is the party.
You got to talk.
You got to talk, like, you know, in established communication with the party.
Absolutely there.
I've done it.
So, Srikumar, you said don't talk.
He's saying talk.
What's the right thing?
So, after the triage, like, you know, if you know that, you know, he has got, you got to talk to the party.
After confirmation, yes.
How do you talk to him?
Phone him?
Email?
So, that channel can be anything, you know, mostly in this kind of scenario, crisis scenario, best channel is a phone, you know, not email, that you start drafting an email.
Only the guy will give his phone number?
See, you know, I think all the key personnel in the organization, phone number is available with all the CISOs.
No, no, the attacker, the attacker will give his phone number.
The attacker will not give the phone numbers, you know.
So, Virjit, I think one thing that you would do is first investigate, as I said, and figure out whether it is a yes or it is a no, and you said, okay, what if it's a yes?
The next thing you would do, you would do an impact assessment.
And it's not that impact assessment is going to take 10 light years.
An immediate impact assessment is that, is there something that I can do to kill, I mean, to simply disconnect this guy or do some damage control or is it really, you know, worthy of going in that particular direction?
Can I take some immediate countermeasures?
So, I am assuming that there is some mechanism internally for 24 into 7 monitoring and there is a crack team.
Would you also call up your peer in, let's say, one telco to other telco, one bank to one other bank on one exchange, saying, this guy has called me, has he called you also?
Does that happen?
In our case, yes.
Informally?
So, Virjit, good question.
The point is, there are two things in this.
The first is that, yes, it could be a possibility because, you know, peer in the... But there is a second aspect to it, is that when you are talking to somebody, even on a personal level, you are not speaking on a personal level.
Eventually, you are representing a company .
Yes.
You may speak personally, but you are still speaking as somebody responsible for a company.
The trust factor is very, very important out there.
I think everybody has added good points.
You know, if the CEO is calling you and telling you something as public as your website is hacked, and you as a CISO don't know it, first go back with answers, who when, where , what, how.
Second thing, update your LinkedIn resume.
Because I don't think you would stick around in that job for too long.
So, what's the full form of CISO, Virjit?
What is the full form of CISO ?
Career is so over.
Anybody still want to be a CISO after this?
I think it's a very common adage for at least anybody in the security.
I'm not going to say just CISOs.
You know, but especially for CISOs, you could do, you know, 99 times things right.
Defend against every attack that comes your way.
You miss one.
That defines your professional career for some time.
You have to learn that it's not a career ender.
You need to be 100% perfect and attackers, only one time.
They keep on attacking it and one success, you're gone.
I can feel that.
Okay.
I'll come back to the audience.
What do you expect from the battle-hardened CISOs?
What's your expectation?
What's your advice to them?
What's your challenge to them?
Mic's here, please.
I've got a few questions back.
Mic's here, please.
Lots of mic's, please.
Fast.
You can get up and speak louder.
It's okay.
We can share, right?
Yeah, we can share.
Yeah, loud and fast.
My name is Kamal Gurnani.
I have a question for the panel.
Anybody can pick it up.
I'm from IndusInd Bank.
So, one is that as he's asking us what to expect from CISOs, so because it's public money which is in the form of information which you are protecting.
So , public money won't make a difference to them.
For them, it's a job.
Let me tell you, public money or private money, CISO doesn't care.
It's that his job is more important to protect the assets.
Do you think it matters?
It's public money or private money?
So, well, all stakeholders are there.
Whether CEO is expecting or the customers are expecting, we continue to expect that you protect the information.
That expectation always remains.
Now, the question is, in case of a crisis actually happening, do you have crisis communication templates ready?
And do you use those templates by moderating those templates and you yourself sign off and then those communication is sent to the customers?
So, do you...
Are you expecting a no answer from anybody on the panel?
No, no.
But it's a good question.
So, what happened, you know, crisis management, you know, the plan and procedure are ready but nobody is looking into the same for the at the time of the crisis because we are so bad and we know, we have only built it, we are involved in that process so many times and we are doing the quarterly drill also.
So, we know whom to contact in this kind of scenario.
It should be bad or you know, process throughout your team also.
But I have a slight contrarian view.
See, if incidents of the same nature are coming again and again, somebody is not doing their job.
Next question.
My second point is that you have to treat every incident.
First of all, if there is an incident coming, then we need to do something so that the similar incident is not repeated.
Now, if that is true then every incident is unique and you cannot templatize something beyond a certain point.
You will end up making a mistake.
So , our expectation is that you have ten different templates for ten different scenarios.
Ransomware is one.
As you said, no one is going to say no.
I am sure they all have.
They have multiple divisions.
Thank you.
So, a good question here.
You have been through ATT &CK.
Your CEOs told you.
You somehow managed.
Like my friend said, LinkedIn was updated but not required.
Now, the board asks you.
Son, tell me.
I am 65 years old.
I am an independent member.
Tell me it won't happen again.
Tell me the incident, embarrassment happened.
Won't happen again.
What's your response to him?
Question number 9.
Are we prepared for the next wave of ATT&CK if it happens?
If the board member asks you...
The question is something which is saying same or cyber attack.
He says, my name has come, my company's name on whom our board has come in for the wrong reasons.
Tell me, for your job's sake, this won't happen again.
What have you done to ensure it won't happen again?
You get the question like that?
It's a fair question.
Everybody, because all of us are sitting as cyber security practitioners.
We are sure that we cannot give that assurance in the current scenarios.
Then you are definitely gone.
LinkedIn is definitely on.
That is what I said.
You shouldn't be fearful.
No fear for failures.
Fear for failures.
Good one.
No fear for failures.
Second scenario when you said, you can only assure the board saying that whatever you are doing, basic things or the measures which you are taking, is at least give them a comfort saying that 99% or 95% which you are giving them a comfort.
He said, what assurance is that?
It just comes to attack.
So, it's not like an...
Like the full panel is waiting to go.
We can give the assurance that our locks are very tight and nobody is 100% today.
But how... The locks just got broken.
No, no.
See, in the world, you know, anything is broken.
And all the top leaders are today, we know that, you know, in the incident, they are gone.
But how, you know, security can be tightened, you know, that assurance we can give it.
And repetitive is, incident should not be happened.
You know, the same kind of incident should not be happened.
Full incident.
Same should not happen.
Right ?
It's a zero-day attack.
The new man...
What is it they are looking for?
They are looking for assurance.
So, what...
Without promising a pot of gold at the rainbow's end, which would not be the correct thing to do, is to give them an assurance by listing out the... at a very high level of what are the corrective actions.
So, what is the root cause?
Very simplistically, why it happened?
What could have been done?
What is now being done?
What are the proactive measures being taken?
How things are being tightened up further?
I am sure there are process lapses somewhere, vulnerability assessments, gap analysis have not worked.
Something has got missed out.
Right?
So, the aim is, how do you tighten the process and that is something to be articulated.
Give them a sense of assurance.
Transparency is key here.
Even with the board, if you want to get their trust, they should be... even if you are hacked, like you know, if you are able to articulate very clearly, I mean, in a simplistic term, not like in very technical terms, but you should not lose out on critical facts.
You should not hide things.
So, that's important.
And after that, of course, as the other panelists said, you have to come up with a corrective action.
What is it that... So, here is what went wrong.
So, you can explain to them in two or three bullet points, here is why this happened and here is why it will not happen.
That you can always come back with.
But I am saying, many times, we always try to hide things , even not from the board, even from senior management, right, because we don't want to look bad.
But I think that is something that we should avoid.
I think the cardinal mistake that anybody could do at that point in time is be unnecessarily defensive.
Don't be defensive.
Yeah.
So, it...
I am telling you, the moment you go into an unnecessarily defensive mode, you can actually smell it.
It does... instead of pushing confidence, it actually instills a sense of stress or this thing amongst the management.
See, it's all about trust, I mean, like it's either with management... See, people are standing, guys , that means you are really doing good job.
I hope so.
I just want to add, if the board has opened their checkbook to you and is seeking an assurance, you have no option.
I like that.
This is the best time to ask for a checkbook.
This is the best time to ask for a blank check.
You agree?
And if they have given that, Burgess, there is no other answer other than yes, it will not happen again.
Ask for a fat check, not a fat paycheck.
Absolutely.
So, there is no other option.
Commissioner of both, he wants to make money on that.
Give me money or I'll resign right now.
Yeah, you are asking a question there.
The guy in the blue shirt.
Gentleman, what's your question?
Here...
Yeah, please go ahead.
My question is extension to Burgess' question.
Louder, sir.
Louder.
My question is extension to his question that if CEO has informed that something has gone wrong and immediately it is identified that this has happened due to some human error or a process failure and the person is identified, what treatment CSO will take?
Because other point, you told that not to panic.
But here, you know that something has failed, like human error or negligence has happened.
I'm sorry, if it is identified as a human error, I think HR takes over at that point.
CSO will not be doing any consequences.
But even if it is a human error, you call it out, right?
What is a human error?
Why hide that?
You are not trying to defend anybody.
You got to tell what is a human error.
See, there is a difference between mistake and negligence.
Is there anybody, I'm saying anybody in this audience who can say that you have never made mistakes.
I think the right thing to do is to analyze what went wrong, why it went wrong, why could it have gone wrong, whose mistake, if at all, let's say, if somebody made some mistake and was it a mistake , was it negligence, what's the impact on the company?
Is there a sense of acceptance or unnecessary defense?
Did you have to dig it out through some alternate channel through logs or did the person come out voluntarily and say, hey, look, I did a boo -boo?
I mean, all these things, you know, go into account.
So, there is no straight cut, cookie cutter kind of answer to your solution.
And that's extremely...
The expectation was just shown by the panelist by sharing their mic.
That is what is really needed.
Is that slowly?
The expectation from the CISOs was just shown by the panelist by sharing their mic.
Sharing?
Sharing their mic.
Sharing the mic.
That is what is required.
Are you satisfied?
There are further two more to it.
Would you hire them if you were a board member?
Million dollar salaries?
Depends upon what is my requirement.
CFO, CMO, my department, your department, OT, IT...
So, you know what?
As he said, open a bigger checkbook.
Sir, Manoj, my point is that irrespective of whether it is because of any senior management flaw, etc.
I strongly, and this is my personal belief, is that as CISOs, we should not be playing politics at that particular point of time.
It's highly important that we remain straight.
We be like those straight shooters.
We'll have to give the answer as it is and let other people play.
Even if it costs your job, at least you'll have the peace of mind that you did what is right for the organization.
So, never play politics.
You should never play politics at any point of time and certainly not in this case.
So, my three points are... it is basically your trust, transparency...
No, no, but see, managing the politics is a different thing, right?
But I'm saying that as individuals, we have to make sure... and it's all personalities also.
Some other CISO may say that, you know, I know the power game and I will play it accordingly.
But at least, I mean, if you ask my personal opinion, I will not play it.
So, I will just play it, I will just tell what is the fact which is here and let management take the decision accordingly.
The only way that you can manage politics is that even if... the only way you can manage politics is that even if you happen...
if required, you should be ready to play the role of the only adult in the room.
The only adult in the room.
Wow, I like that.
Be prepared for it.
Can I put an analogy over there?
The gentleman asked about this...
No, no, I'm saying the difference about playing politics, if I can use an analogy, if somebody has died in the house, are you going to talk about the division and inheritance while the dead body is there or probably after 10-15 days?
In some cases it may happen.
Exactly.
So, look at how tacky it looks.
But, you know, yes, at times a lot is expected of the CSO, you have to rise above all that stuff, but something that really comes to my mind, and I don't know how many of you have heard that, is the last two stanzas, the last stanza from a lovely poem by Rudyard Kipling,
that's if.
If in an unforgiving minute you can cover 60 seconds worth of distance run, the earth is yours and all's that in it, which is more, you'll be a man my son.
So, you have to be the adult in the room.
And as this guy said, Alexander, in the end, ultimately matters what work you have done.
So, 30 seconds panel, quick summary from your side before I capture some of the mind maps.
Ramesh, you can start and end with...
I just call it as a CSO to a business CSO, in the event of any emergency.
So, obviously the business need or the organization need is to business back to normal.
See, you be that point in time, would be the business guy, more than a security guy, back to the business normal, and then investigate, and then take corrective action.
30 seconds of summing up?
No, I don't think there's much I can add, but thank you very much, Burgess, for this opportunity.
Also, guys, what you're seeing collectively sit on the stage while it is experienced, like I said, CSO's playbook is your own experiences.
You will handle an incident tomorrow that none of us has handled.
So, you will be writing your own playbooks also.
Playbook, right?
Just one piece of maybe advice, or just my personal thoughts around this is in any such incident, always keep the organization's best interest in mind.
Not yours, or of your colleagues or senior management.
If you keep the organization's interest, think about it as your own company.
This is your own money on the line which is getting lost.
So, I think if you keep that in mind, whatever actions you will take will always be right.
Thank you, well said.
Manish?
Be calm, be focused, have clear communications, and always do the right thing.
I think I just want to like to add, be transparent and trusty to the management.
Okay?
With this, I'll just show the mind map.
Look how crazy the mind map has gone.
And I'll capture some of the good bytes.
Be calm, be fearless, be transparent.
Write your own playbook.
Jackson mentioned that.
Keep the company's best interest in mind, Venkatesh.
Lovely words, sir.
Play the role of the only adult in the room.
Difference between mistake and negligence.
Okay?
What does the board really want?
They really want assurance.
It's a cardinal mistake to keep unnecessarily defensive.
Don't make that.
Are you expecting a no answer?
Jackson, well said to that question.
You would never get one from this panel guys.
Ultimately, the technical stuff matters to show, okay?
Optics is more important.
What are you to report?
You mentioned regular tasks, one thing.
Somebody else has something else.
The fear of failure, Venkatesh, you mentioned that.
Ramesh mentioned, be a translator.
CISO has to exclude calmness.
Should not fly off the handle.
Everything should not do.
Should show assurance.
Where and how to communicate.
It's the worst thing the CEO tells you, you've been hacked.
CISO is, career is so over.
Two things more.
Wo ek din tha, 2003.
Okay?
Go back to business.
Learn how to manage the optics.
You can't open your playbook then.
It should be well ingrained.
Make your own playbook.
Okay?
Got to do two things.
Keep the upper management at bay.
Tun tumhara kaam karo.
Get the lower guys to do the work.
Test every quarter.
Decide who will talk what.
Understand your regulator.
Okay?
What to talk to senior management.
How mature is my CEO?
I love that, Venkatesh.
How mature is my CEO?
Kya understanding hai?
Do I make my update, my resume on LinkedIn?
And ultimately, as this guy said, Alexander, what difference have I made is the ultimate difference for my company.
And put your company's, as lightly said in the end, put the company's interest first.
Forget the logo.
Forget the politics.
You might survive, you might not.
Somebody else will hire you.
But you have been a battle-hardened CISO and that's what matters in the end.
With this, we conclude a great sort of discussion.
Thank you so much panel.
Thanks a lovely audience.
Thank you, Bajesh.