[Music]
probably not talking about boardex these
are my hardcore guys here at 10 o'clock
at night on a Thursday to talk about
corporate boards exciting stuff see if I
can keep you away for waake for the next
30 minutes I have never done this talk
in 30 minutes this is an hour long talk
so we're going to speedrun this talk too
so that's going to be extra awesome so
we're going to see how that goes um
we'll see where we end up in 30
minutes so bottom line purpose of this
is to uh understand how to more
effectively communicate your program uh
to the value of your business and speak
in the terms of business uh so that you
can earn budget and buy in by uh
communicating more clearly to Boards of
directors uh we're going to take a look
look at how to design propelling
narratives to do that uh how to uh
provide directors with uh actionable
information that can actually drive
their decision- making uh we're going to
take a look at their role uh some of the
things that they that are their care
about some legal presidents and stuff uh
we'll take a look at uh some ways that
you can build some metrics and some
good-look slides we'll enjoy some shut
and frea and make fun of some other
people's slides and then we'll take a
look at uh some what some good slides
look like so the first most important
thing is to understand the assignment so
frequently I have people say to me hey
I'm a ciso and I'm really excited to go
talk to the board and my first question
is always why and that is not just to be
sarch but it's two purposes so the first
one being really why like watch what
your wish for because you just might get
it um if you're not speaking to the
board then ask yourself does that
something that I really want to be doing
and if so why do I want to be doing that
what do I have to tell them what's the
purpose of me talking to them a lot of
the time this is just a thing that guys
want to do because like that's the next
step of my career that's what good SOS
do or whatever um that's not necessarily
the case um the second is literally why
like what is we're telling them what is
the story that we want to tell what is
it that we want to convey so when we're
talking to boards the big things that
we're trying to do when we're talking to
a board is to educate to inform to
update them most importantly is to
instill confidence because their job is
to determine if you are the right person
to lead this part of the organization
going forward and so every time you're
in front of them they're judging whether
or not you are the right person to be
leading this and so every time you step
up there you are putting yourself in the
this probably isn't our guy seat right
so when I ask people why do you want to
do this that's part of why I'm asking
why do you want to do this because every
time you walk in there you're putting
yourself in the firing line you better
be ready to instill that confidence in a
way that is uh cool and not cocky um and
demonstrate fiduciary duty which we'll
talk about so when we talk about what is
that you're trying to do you're trying
to tell a story when you're in here what
you need to do is you need need to tell
a story and there's an art to story
andell telling um so the first thing you
got to do is make sure you understand
your audience that you're telling the
right story to the Right audience and
that you're using good engaging
storytelling methods through uh data
storytelling and visual storytelling
that we'll talk about here in a little
bit so the first part being
understanding your audience we have to
understand the boards and what the
board's role is and what it is they're
trying to get out of this so that we can
message to them appropriately um because
the board has a little bit different
role than executive leadership and some
of the other people that we might talk
to so there's a set of legal precedents
that kind of set the stage for what is
important to boards and what boards care
about so back in the 90s there was this
company called KARK and the KARK lawsuit
uh laid out that boards owe a fiduciary
duty to shareholders and that duty is a
duty of
care that says you have to have the
company's best interest at heart you
have to have the shareholders best
interest at heart as part of your
fiduciary Duty that's known as carar um
later on a little bit later uh blue belt
ice cream had these problems in their
plants where they had all these like
food safety issues like repetitive food
safety issues and uh it ran the stock
value into the ground and the
shareholders actually sued the company
and said hey you were not good stewards
of our money like we're suing you and
they won because there's a duty of
loyalty and they said that uh things
that are
uh that are operationally like Mission
critical you should as a director
understand be able to monitor have your
finger on the pulse up but that was for
a company that had like one product line
they made ice cream so if you make ice
cream you should know the things that
are mission critical to making ice cream
and should not fail at monitoring that
well the Boeing case so the Boeing
planes that were crashing because of the
autom made it thing right um the case
behind that extended that duty to a
company that had lots of product lines
and so now where we are is a world where
your board owes a fiduciary duty to
monitor anything that's considered
Mission critical so what is Mission
critical and is cyber insurance or is
cyber security considered Mission
critical and maybe we'll get to that um
just recently just like this month uh
Delaware Court extended that fiduciary
duty from board directors to all
officers so CEO CFO everybody else now
Court made that judgment later on that
case got dismissed there's going to be
an appeal still kind of a jump ball
about that but for the most part they
have set the precedent that executive
officers now owe a similar Duty that the
board owes right so the question is is
is cyber Insurance Mission or cyber uh
security Mission critical well the solar
winds
case kind of made us think no because
what could be more critical than solar
winds right like that's their hold
that's the core what could be more
Mission critical than for them to have
basic application security and they
didn't and it didn't hold up k Mark
didn't hold up so that case got
dismissed um so everybody was like oh
well that means that
cyber security does not fall into
Mission criticality well there's a
couple of things there the first one was
that the court said uh that didn't apply
in a very kind of narrow way but also uh
because they didn't break the law well
the SEC is about to roll out a whole new
set of things that will be law that's
going to change all of this and we'll
talk about that in a second um
additionally um they kind of steer away
from straight out saying cyber is not
Mission critical in this case so we're
living in this world that's kind of on
the cusp right now where we definitely
owe a duty we definitely have to be
paying attention to these things and so
we need to be able to demonstrate a duty
of loyalty um and the SEC is uh rolling
out these new uh so not only are they
doing kind of a ton of enforcement and
have or who responsible for the giant
multi-billion dollar fine against uh
Facebook they're also who are rolling
out now these new incident
response uh uh guidance and whatnot the
FTC also has uh behind a bunch of cases
kind of laid out guidance So currently
the way that this works today is uh we
as C Level employees owe oversite and
owe a duty to our directors so that they
can monitor and we have to report risks
to them they owe a duty of oversight uh
to demonstrate loyalty to the
shareholders um and so that's what we
have to demonstrate and what we have to
explain when we're talking to boards and
what boards care about right so um in
these uh consent orders where uh like
CVS and uh Home Depot and Target and
info tracks and all these folks ended up
having these settlements um in the
settlements they started to spell out
specific mediation so it becomes very
easy for us to start to see like okay if
this is what's going to be in the
settlement then we can start to aim
toward that and know what's going to uh
be what we're going to jump ahead
because we're short on time um so what
we have to ask is what provides value to
our business and that's going to be
different depending on our business
right and so often times when I talk to
SOS and I ask them like
hey what do what is your CFO and what
are your CEO consider your targets and
what your financial statements look like
and which financial statements do they
read I have no idea frequently right
like are we chasing Revenue growth are
we chasing uh earnings are we chasing uh
cost of goods are we chasing gross
profit and it kind of depends on who
owns you so like for instance if you are
owned by a venture capital company it's
going to be a different thing than if
you're owned by a private Equity Firm or
if you're public right so if you're
public you're probably trying to figure
out how to maximize your price per share
if you're owned by a private Equity Firm
a private Equity Firm is going to have a
really short Runway they're probably
looking for growth targets they're
looking to flip their money they're
probably looking for uh year-over-year
Revenue growth right so as we start to
figure out like what are the targets
that our business cares about we can
start to figure out like what are our
value drivers and where is that value
created and how do we plug into that and
once we start speaking that language you
can start to think how your program your
security program can make a big
difference here so let's use as the
example that we're owned by a PE and the
p is looking for a quick exit and
they're going to spin us and they're
trying to cut cost and spin out right so
what they're going to do is they're
going to look to cut all of the kind of
General administrative expenses which
you're going to fall into right because
you're a cost center as security so
that's going to be everything capex so
is it possible for me to move things to
Opex or is it possible for me to bake my
Capital expenditures into growth
programs so that I can show growth as
part of what I'm building as opposed to
the way that I'm doing it today and when
I'm looking at the targets the way that
the business is looking at the targets
then it becomes a lot easier for me to
start saying hey I'm playing ball on
your ball field right um if what I care
about is debt to equity ratio or
something like that right well how am I
carrying debt how am I buying my my
tools I can through the way that I
procure the stuff in my cyber security
program move those numbers for them if
what they care about is evida right and
I'm out there just buying tools like
it's going out of control like I'm
they're going to hate me and think I'm
an idiot right it's very easy for me to
ask you like hey what's your Target and
then adjust my procurement to meet their
targets and look like a hero right so we
got to figure out how is that value
determined and who cares about that
value so that we can communicate in the
way that they're commun unting and so
what our big job is as cesos is to be a
translator basically your job is to
translate that security language into
business language you need to take that
performance data and turn it into
business risk data so oftentimes what I
see folks do is try and walk in and
explain their program to the business in
the program's terms but you have to
think of yourself as an interpreter you
need to interpret that information and
turn it into the language of business
business and the core language of
business is risk the way that your board
thinks about the business is risk and we
often times use the term risk wrong and
we're going to take a look at some
examples where people did exactly that
from the board's point of view risk is a
something that is the potential to cause
a harm or a loss something that is
probability times impact right um
something that uh we can make an
informed decision off of and uh the way
that you get rid of it is to a void it
to mitigate it to transfer it we talked
about transfer in the Cyber Insurance
session we can accept it right we can
reduce it the opposite the other end of
that is threat right that is the thing
that is the actor that causes the harm
and a lot of times when we're talking to
the business what we end up doing is
telling them about threats instead of
telling them about risks and so we're
telling them about the actors we're
telling them about the problems we're
telling them about the vulnerabilities
we walk in and tell them how many
vulnerable machines we have or our
patching Cadence or are our old machines
or whatever it is those are all threats
or vulnerabilities those are not risks
the way that our business sees risks so
when your business is thinking about
risk oftentimes when we think about risk
especially it or cyber risk we're
thinking about the direct causes the
things that happen when the bad thing
happens to us and we have to pay for
incident response or whatever but that's
not even the risk that the business
cares about if you go talk to the a
board member the risk that they're
worried about are these risks over here
right so if have a breach situation like
how's that going to impact my reputation
that's going to impact my share price
which is going to change my market value
and that might suck on a Tuesday but
like if I'm in the middle of m&a
activity it might completely destroy
that m&a or it might undercut my value
or it might undercut my evaluation for
an acquisition or it might Pro create a
situation where the regulatory body
won't allow me to make that acquisition
um any number of crazy things or the
hotel company that ended up having to
pay the gdpr fine for the company they
acquired because the company they
acquired had the breach pre-acquisition
right like that's the stuff they care
about and opportunity cost right so if
what they breached and took was
intellectual property and it kept me
from being able to launch my product on
time or I lost my competitive advantage
or I didn't get to roll out my new
feature or whatever that is the business
killer and that's the stuff that the
board cares about that's the stuff
that's hard to Define that's the stuff
that's hard to measure that's stuff
that's like hey we have a risk of losing
a million dollar to a ransom that's easy
to understand that's operational cost
that's the same as any other loss that's
the same as product shrink or whatever
else right this stuff is the stuff that
going to keep them up at night so when
we think of risk if you're writing a
risk in your report and it doesn't fall
into one of these categories it's
probably not a business risk so business
risks are going to be Financial
reputational strategic uh uh competitive
legal uh health and safety would be life
people's life and stuff
operational um we're going to skip past
this pretty fast uh we did some mapping
where we mapped like what are the
board's challenges what are the be
versus what are the cisos challenges so
we talked about the difference between
risk and threat so let's take a look at
a uh oh I thought this was a real world
example we're going to take a look at
this first so risk is uh probability
plus impact and the difference between
probability and likelihood is the
difference between uh the likelihood of
flipping a coin is 50/50 heads or tails
the probability would be if I flipped a
coin 100 times if I going to
get one heads and 99 tails the
probability of that would be very low so
what I'm start talking about then is how
does it actually impact me and how do
the circumstances of my situation impact
uh the likelihood that this is going to
happen to me so there's a difference
between likelihood and probability and
we should be talking about probability
but the most important part here is you
will notice that threat and
vulnerability are a subconstituent of
risk so when you're talking about risk
you're talking about threats and
vulnerabilities rolled up together so
when you are showing your board
operational metrics you are not showing
them risk you are showing them some
portion of RIS threats vulnerabilities
so I can't say this strongly enough stop
showing your board operational metrics
do not show them performance stuff do
not show them the number of systems that
you have vulnerabilities on your
patching Cadence the 10,000 emails you
block to whatever it is sometimes
they'll even ask for that stop showing
it to them well you can do instead is
turn those into compliance metrics so
you'll notice same information basically
all we did was take and we added uh a
goal so instead of saying hey we blocked
5 million emails well we blocked 5
million emails we had a goal of blocking
10 million emails so we block 50% of
what we intended to block or whatever it
is um and so now you have a compliance
piece now that doesn't tell the whole
story but it gets you closer to talking
about something that a business would
care about so let's take a look at a Oh
Real World example here so this is a
real slide that someone put in front of
their board what do we think about it do
we like it is it good is it pretty would
you put this in front of your
board what don't we like about
it well yeah I don't know how I feel
about how it looks but even beyond that
when we look at the column that is risk
none of the things in the column that is
risk are a risk none of those things are
a risk to the board they don't care
about that we'll talk about some of the
other things they got wrong with the
very very first thing that they got
wrong is that none of those things are
at risk not from the way that the board
considers them um so they think that
they're telling the board like here are
the risks you should care about but if
I'm a board member and my very top risk
is data exfiltration at malware my
question is so what what does that mean
to me what is the exposure to my
business like malware means what to me
what does that do to me is there a
Financial Risk is there an operational
risk like what is the actual risk what
you describ is not risk this another
another real world example that actually
happened so the company came to us and
said hey we have we're trying to tune up
our kis we're trying to tune up our key
performance indicators um what we have
today are like real not very good per uh
performance indicators and uh what they
actually had was kpis so they had this
thing that was like number of outgoing
emails that contain unprotected highly
sensitive data and they turned it into
number of outgoing automated emails that
had highly protected data number of
outgoing manifest and number of outgoing
guest Communications and they were like
look we fixed it now they're Kris and I
was like no you totally missed you made
you made them more granular and you can
report on them but this is still not
what you've created here is a kpi and
not a kri let's take a look at how you
could have made this an actual risk
indicator so the first thing you do is
what we talked about before is you apply
a Target to it and turn it into
compliance right so we have had a Target
that we were measuring against right and
so instead of reporting that crazy
number that was we blocked I don't
remember how many it was to
150,000 emails or whatever crazy number
that still sounds crazy as a board
members like that's a high number sounds
bad I don't what does that mean to me we
turned it into a percentage so hey we
made a 40% reduction wow that's a story
that somebody cares about then we took
it a step further and we Quantified that
with some ual dollars and cents numbers
and it was real easy to do we took the
basic breach exposure number and we said
hey if we reduced 150 emails or if we
reduce 60,000 emails and the cost per
breach uh record is 160 bucks we reduce
your risk exposure by $9.6 million is
that a much better story than we block
whatever the last one was where we
blocked a 150,000 emails or whatever
that for guests and manifests or
whatever like as a board member hey we
made a 40% reduction this quarter that
brought my risk down by $9 million is a
story that makes sense that someone
cares about now we talked about this in
the last talk if you're here for that
like Risk quantification people were
like oh my god well risk quantification
is hard how would I add these dollars
it's really hard well that was an
example where it was super easy to do
also you don't have to do fair you don't
have to go out and get a
statistical doctorate to do risk
quantification the stuff is productized
now you can go buy it X analytics cover
Co VV r r you go buy it it's like ready
to go you put your n CSF assessment in
it you put your critical 18 assessment
in it it will kick dollar amounts out to
you you can tune it up with risk
appetite you tune it up with your cyber
Insurance it will give you dollar
amounts for you see you can see them
boom done and then it will tell you
based on like here's your exposure to
ransomware here's your exposure to
whatever so it is much much simpler
today so the other thing that we need to
talk about when we're talking about
boards is tell telling the right story
to the Right audience right so often
times what we run into is when people
tell me what they're going to go talk to
their board about the message that
they're trying to tell is a message that
would be better told to Senior
Management or executive leadership so
the board is not who you go ask for
stuff you don't go to them with hat and
hand and ask them for Budget they're not
who's going to give you budget they are
in charge of setting the overall mission
they set the vision they set the
corporate strategy uh they set the
performance targets that then Senior
leadership is going to be responsible
for hitting uh they have one employee
that employee is the CEO usually they
hire that person uh they set corporate
governance they represent the
shareholder they report back to the
shareholder all the things that we
talked about before about duty of care
and whatnot that's the stuff that they
care about and that they're into
executive leadership on the other hand
is who implements all that stuff they're
who manage the day-to- day they're who
you're going to get your budget from
they're who report to the board they're
who hit departmental goals have
relationships with the stakeholders in
the individual departments Etc so when
we're talking about like what is our
actual plan what is it we're trying to
get across the Finish Line I want to
talk about do I want to do strategy a or
strategy B and here's the cost
difference that's an executive
leadership conversation that's not a
board conversation so um when we go into
message to the board we talked about
what's the goal in the very beginning
goal is inform educate instill
confidence GTFO right so so same
situation here right what you're trying
to do is you're trying to get Buy in
you're trying to instill confidence what
we're going to go in here and we're
going to tell them is uh hey this is how
I spent the stakeholders the
shareholders money since the last time I
saw you this is what you got in business
terms right in the terms that you care
about whether that is one of the metrics
we talked about or risk or whatever it
is um here's how that meets the
expectations that I set the last time I
was in here uh this is what I'm planning
to do with your money for the next go
around here's what you can expect in
return this is why I made that decision
thanks and I'm out do that in 15 minutes
without getting sidetracked that's your
whole goal that's in out that's the
story um that's always the story and the
more you can repeat that story the
better off you are executive leadership
is where you're going to go into to
Senior Management and talk about like
hey I want to do this versus that and
like what if we do a or b or can I get
this money or can I get the budget to do
this those those are where you have
those conversations and not in the Board
Room other things that your board May
want to know they may want to know uh
the threat landscape for your particular
industry so threat briefings they love
that kind of stuff uh how do we compare
to our peers this is a thing they ask
for that is not actually what they want
what they really want is to know your
risk exposure and if you can get good at
telling them that then the story of
where do we match to our peers is who
cares right like if our peers suck and
we're awesome and understanding our risk
great that's a competitive Advantage a
race to the Middle with the other guy
guy helps no one but sometimes they want
to know that sometimes we got to tell
them that what are the emerging emerging
Trends how does that affect us are we
compliant with whatever framework
especially stuff that like they're all
on other boards and they're always going
to come to you and be like at our other
company we did ISO why aren't you doing
ISO or whatever be ready to answer those
questions and then they're also going to
come to you with like my buddies on the
board is such and such you sell such and
such a tool why don't we use that tool
or I saw it in the airport or whatever
it is thing to you got to be ready to
explain why you're not using whatever
thing that they love there are two
things that are going to happen when you
do your board presentation there's going
to be the deck and then there's going to
be a packet of stuff that you're going
to give them in advance it's going to be
a whole bunch of documents that you're
going to give them in advance and the
documents is where the detail stuff goes
documents is where you're going to put
all of the nuts and bolts if you're
going to get into those kind of
performance indicator type of stuff that
all goes in the deck the deck is where
all the the wonky information goes the
or the packet is where all the wonky
information goes the deck super clean
super fast like 15 minutes in and out
like you're talking three four slides
tops like executive summary uh your
decision points your financial results
like the things that we talked about
like the here's my story here's what I
did with your money here's what I'm
going to do with your money dude I'm out
um and then all the rest of the stuff
goes in here for them to read in advance
they may or may not read it but all that
stuff that you're tempted to put all the
dashboards and stuff like save that for
the
D so it's a story that you're telling
some said hey we're telling a story it's
like any other story when you're telling
a story you got to be good at telling
the story right um Andrew Stanton who is
the guy who uh created Wall-E and a
bunch of other Disney stuff uh gave us
two tips start at the end and work
backwards so I always suggest that like
what is your goal what that you're
trying to tell them figure out out what
is your message and then start backwards
as you build your deck like here's the
key takeaway if I could only if I was in
my in the elevator with the board member
for five minutes what are the things
that I would want them to know that I
could write in five bullets start with
those five bullets and then work
backwards and fill it in and make sure
that you make them
care we're going to go fast through
story stuff because uh we don't have a
lot of time uh we'll go through this
real fast too so this has been debunked
a little bit but back in the 70s there
was this guy who said you got three
kinds of you got your lizard brain
that's like your primordial like run
away from Tigers you got your monkey
brain that's like your social like hey
do I like you do you seem cool do I
trust you do you seem trustworthy and
then you got your human brain that uh is
hey I'm smart and I understand how
complex things work turns out that's not
exactly how it works it's a little more
complicated than that turns out it's
actually way more complicated than that
and the theory of constructed emotion
actually says now that like it's vastly
more complicated than that and they now
called that basic stuff course effect
none of that really matters what's
really important is when you're writing
this you're writing this with your
cognitive brain and you think that
you're giving it to someone to receive
with their cognitive brain but you are
not you are writing it with your
cognitive brain and they are receiving
it with their lizard brain and so you
have to get past the lizard brain
gatekeeper and then the monkey brain
gatekeeper so right out of the gate they
want to ignore you and uh they want to
also determine whether or not you're an
idiot and whether or not you're
trustworthy and you got to get past
those Gates before you can ever get here
spend more time on that in the longer
version of this uh do a little science
learning stuff too um we'll do the short
version of this quote uh it was Mark
Twain who said if I had more time I'd
have written a shorter letter editing is
everything spend your time and make it
short make it clean go fast as you can
um speaking of three minutes be close uh
make sure that you're using your data to
make beautiful visual compelling
storytelling right we need good data
storytelling
um your brain processes stuff visually
uh much better than it does auditorally
or any of that other stuff so you can
make nice big pretty graphs make it easy
for people to consume few words I added
this so that when you get the deck after
the fact you can follow the decision
tree about which graphs are best for
which scenarios um and here's some part
where we're going to make fun of people
all right so let's look at some of these
slides and uh let's tear them apart so
this one I have a redacted all of these
and uh changed the names to protect the
innocent so you'll notice they say stuff
like Stark Industries instead of who
this really is but every one of these is
a real honest to God slide that came
from a real honest to God company that I
real honest to God consulted with so how
do we feel about this
one yeah so they did right out of the
gate all performance metrics all up here
terrible ha their performance metrics uh
their wrists uh right out of the gate
not really
um also just kind of very crowded and
confusing um this is a thing everybody
loves this is the risk Matrix you might
have also seen the risk Matrix look like
this uh we call these matrixes ordinal
and what an ordinal Matrix is means in
order high low medium Etc right it tells
you nothing about the risk right you
can't do any kind of math against
ordinal matrices so if I say that I have
10 let's see I have one here somewhere
where it says this I have 10 highs and I
have 37 mediums and 14
lows what's what do I do first right do
I do 10 mediums is 10 medium worth one
high or is one high worth three mediums
or how would I possibly know that I
can't and when I start looking at stuff
it's all very subjective too so like
you'll have two things that are high
that are like wildly on opposite ends of
the spectrum and that's what we'll see
in some of these other ones like um like
this one I loved this one I was like how
the heck hell am I even supposed to read
this thing I'm not even sure what this
thing is supposed to be telling me um
like their wrists are moving I think at
least most of these are kind of sort of
risks that someone would consider or
risk um but it's still all it's ordinal
and I don't know how to consume this
this one I liked because at least they
put the tolerance part in so it's like
at least here's our cars right like this
is what we care about so this is outside
of carab so at least that gives me some
kind of jumping off point but again what
what do I how do I consume that so back
to this one that we talked about before
this was the first one I showed and I
beat them up on wrist well now I'm going
to beat them up because not only did
they do risk they did all ordinal risk
stuff so like you look at this you say
okay the very first thing is uh data
exfiltration is the highest risk and
then malware is the next highest risk
and then virus outbreak is the next
highest risk like how are those things
different and why are they all the same
score and I don't understand this at all
it doesn't make any sense to me right um
oh here's one this one's extra cool um
so uh the very first risk
uh is not a risk and the very first risk
is we don't know our risks that's
awesome um and then they have a bunch of
management issues that would make me
fire you so uh let's see here uh users
don't perform their security
responsibilities us don't understand
their security responsibilities the
information security program is not
aligned with business requirements it
operations are not performing their
information secur responsibility you are
fired like dude get out rge all day
um oh here's one so people have a
tendency to want to trade a Ford for a
five and not explain why they're doing
that so incident uh or I am needs
Improvement uh we have existing controls
in place but we need to standardize the
process and Implement a new system why
am I implementing a new system if I
already have a thing in place and why is
it my number three thing like you better
explain to me like why am I training a
four for a five why am I putting a thing
in place this one this one came from a
consultant this one came from an honest
and goodness consultant who was sharing
this with other people about like here's
an example of a good board slide um
never show this to anyone ever no board
person understands what any of these
logos are this is a nightmare I don't
need to tell you why from same guy
uh this one kind of makes sense if you
spend a lot of time paying attention to
it but oh my God we're not even we we'll
stop making fun of them because I we
don't have time to make fun of them more
because we're overtime what should they
look like so clean simple on brand NE
slides few words like keep them super
clean think uh Ted Talk think uh like
apple right like minimalist slides you
saw this at the beginning of my day it's
a thing I like to call Bluff bottom line
up front tell them what you're going to
tell them like instead of doing an
agenda give them what are the bullet
points right like what are the key
takeaways what are the key teabout what
is the purpose what is the outcome right
on the very first slide so if you only
paid attention to me for 30 seconds I
told you the thing so that's the point
of the agenda right whenever you hear
public speaking tell them what you're
going to tell them tell them tell them
what you told them right well just pump
it all up front executive summary right
up front then that way when they start
ignoring you uh they still get the point
um we're not going to spend a bunch of
time on this lost tolerance curve
because it's a cool idea but it's not a
great way to explain this so what this
is showing is this risk quantification
data that the pink line is what your
inherent risk is in the purple line is
what your tolerance is and you can see
there's Gap here and the idea here is to
illustrate how when you make your
remediation that you bring it down below
the
uh below the appetite so that you're not
exceeding it's called a loss exceedence
curve which is a cool idea but like
Executives and stuff don't consume that
very well you can take that same data
and stick it in something like this that
tells the story a whole lot better right
so when you read if you go out and you
read the old uh uh how to measure
everything book they spend a lot of time
on those L exceedence curves but you can
take the data that the Los curve gave
you and stick it into a very highly
readable format that Executives can
understand and tell a story that makes a
lot of sense right my current risk
exposure is $34 million I have a minimum
exposure of 10 and a maximum of 100 so
we have a pretty wide range but we think
with 90% certainty that it's going to be
about $34 million a year right we're 53%
implemented on critical 18 at tier 2 our
tolerance is $20 million so we're $14
million over our tolerance so we need to
make some adjustments to fix that here's
what we're going to make uh we project
to get it down to our tolerance of $20
million uh with within that range when
we get to 75% compliance uh we have 14
initiatives in flight to do that that
are going to cost us $4 million so we're
going to buy down our Risk by $10
million for $4 million that is a $14
million decrease for $4 million what a
great return on investment you can do
the same kind of thing for uh individual
types of attacks or individual types of
products uh this came from a company
called axio who does the same kind of
thing um same thing for individualized
uh like I want to compare stuff so this
isn't one I would show to a board this
is one I would show to an executive
committee or whatever but like uh my
choices are I can take on data security
or I take on an project which one makes
more sense right same metrics here was
my exposure here's what I expect uh my
reduction to be here are my costs right
here's what my tool cost break out to
here's how much it's going to buy down
my risk different categories
consequently here's what my return ratio
is and here's what my dollar reduction
like every dollar I spend buys down my
Risk by this so then it becomes really
easy which one of these should I do
first the one that buys down my risk 38
dollar or the one that $33 a dollar like
it starts making real obvious sense
which one to do first and I can start to
build a program off of that instead of
pulling it out of my ear
right um simple clean dashboards right
that explain my current risk
Exposure My risk reduction over the last
quarter my actual business goals and how
they align up to the things that you
care about as far as your uh Revenue
growth targets my we had been doing but
here's one based on CSF right and my
current initiatives what they cost what
my risk reduction targets are uh all in
one clean dashboard like one slide boom
a bluff slide that slide a threat
landscape and I'm out like that's it I'm
done balance scorecard is one if you
ever do your uh NBA they love their old
balance scorecard falls into four
categories Financial perspective
customer perspective growth and
operational and so you can take your
ideas and stick them into the balance
score card and do the same thing right
like so we lined up what we were doing
against balance scorecard this is great
for those companies that love their NBA
balance scorecard stuff you're now
speaking the language of business and
all you did was take your program and
jam it into their language right and now
all of a sudden like you're a hero
because you're demonstrating how
security is moving the customer
experience and moving the financial
perspective here's the executive version
of that dashboard you'll notice we made
some tweaks here when we went to the
executive version this is where we might
give you some different remediation
options and where we might sort to show
you like benchmarking against uh our
peers or against uh Frameworks that
we're trying to hit or whatever uh
you'll also notice this is where we
start to show you current threats so we
didn't show threats to the board when
only show brisks to the board we'll show
threats to Executive
leadership um this balance scorecard map
uh is how do I build a balance scorecard
and how can I uh use this to map my
stuff to businesses careabout right so
uh we won't spend a ton of time on this
but uh if you look at it after when you
get the deck you can take a look and see
how you might map from what a CIO or CF
is to how you get there through your
metrics you can also flip that on its
head so if you report to a CIO for
instance or a CFO for instance where
money is not the thing and maybe you uh
care more about iil and you're an iil
organization where you were trying to
hit our uh operational efficiency
targets I you notice that I flipped the
I started off develop work my way up
toel I started atel and work my way up
to operational excellence so that I can
figure out like if I report to the CFO
right so all I'm doing is taking my
program and jamming it into their
language anguage uh threat information
for the elt team we won't dig into that
because uh we are out of time uh and if
you have not uh seen the old cyber
defense Matrix it is a spectacular tool
as well you can use it for all kinds of
goodies um for the most part I don't use
it for board stuff but I do use it for
elt stuff kind of a lot you can use it
for any number of things you can dream
of um it takes like a couple
of so it takes the N identify protect
detect respond cover against devices
applications networ data users Etc but
then you can break that out however you
want so you can map it against your
framework you can map it against your uh
your program what your coverage is you
can map it against your responsibility
areas what we've done with it here is
map it to people process technology so
you can start to see what your actual
resource allocation is so resource
allocation is one use where I might
actually show it to someone who was uh
kind of high ranking but this is great
for figuring out the story of how do I
do the translation because so much of
this is like hey how did I take my
security information and translate it
into that business well cyber defense
metrics and all of these use cases are
super great for helping you build that
story
internally all right we are over we are
way over all right uh so dos and don'ts
do you know what you're walking into
when you get a chance meet with these
board members in advance sit down with
them have lunch with them ask them
questions you need to vet this with your
sea level first sometimes this is the
non-starter sometimes your CEO will be
like don't do that that's not allowed um
make sure that you've okayed that but
whenever possible you should meet with
them in advance you should understand
them you should understand their
individual needs and wants and desires
and understand where they are because
some of them are going to be smart some
of them are going to be stupid some of
them are going to understand cyber and
some of them are not um and you need to
know that so do your homework understand
in advance know what you're walking into
make make sure you send your documents
in advance with plenty of time uh know
in advance how much time you're going to
have keep it tight don't overstay you're
welcome make sure you're in and out uh
stay calm when they ask you questions
and try and derail you like answer the
question if you
can make sure you never lie but don't
let them take you down a rabbit hole
like if they ask you a crazy question
it's going to take you down a rabbit
hole it is totally fine to say things
like that's in the documentation we can
follow up after the fact if you want to
Dive Dive deeper on that blah blah blah
blah blah um and be clear and concise
about what you're trying to do things
not to do they may keep you waiting out
in the hall for a long time it's going
to run late you had a 15minute window
and it ran way over your 15-minute
window and you're supposed to be
somewhere else it doesn't matter you
show up when they tell you to show up
with a smile on your face and you don't
complain or anything don't exaggerate
don't lie don't seetch the truth don't
hide the metrics or whatever those are
all the things that will get you in duty
of care trouble right they have have a
duty of care they have to monitor and
you not telling them the truth is one of
the things that can get everyone sued
and in trouble so you have to be as
straightforward as you can be um don't
be boring keep them awake um don't ask
for stuff don't go there with your hat
in hand asking for money begging
pitching lobbying um a they don't want
to hear it that's going to make them
hate you that's not going to insal
confidence it's also going to make your
sea levels hate you because they're
going to feel like you're going over
your head uh try and avoid all the
jargon all of that acronyms all the
initialisms like have some have your I
like to have my wife do it because she's
not in the industry and i' be like I
need you to look at this and see if
there's anything here you don't know
what it means and if she's like I don't
know what this means I take it out and
fix it because that's who you're dealing
with um make sure you're being careful
with your biases and stuff like not
everybody has the same political bents
and the same humor and the same all of
that so keep all of that out it's really
easy to end up down that rabbit hole and
find yourself out on your can
um don't be extra so like people have a
tendency to come in and like give all
the ladies flowers or do some don't do
that [ __ ] um and don't overstay your
welcome get in get out they don't want
you there get out questions concerns
we're way over time you want to go drink
you want to go play in the arcade you
want to go do anything but this let's do
that all
right
[Music]