[Music]
welcome back joining us to discuss the
privacy and security professional of
tomorrow please welcome to the stage
moderator Ruby Zeppo trevor hughes and
matt Loeb I'm just gonna dive right into
it because we've got a short session so
I EPP worked with Ohio State to release
a recent research study the topic of
which was the convergence of the privacy
security and to some extent IT
professional roles so my question right
out of the gate is why is this happening
and why is it happening now is it
technology is it culture is it politics
is it you know what what's causing it
sure so I'd be happy to start I'm at
it's great to see you hi Ruby great to
be here so we worked with Ohio State to
create this paper because we were seeing
something happening in the marketplace
we were seeing that the skills of the
privacy professional born largely of
long compliance traditionally we're
bleeding into engineering and IT were
bleeding into IT risk were bleeding into
information security and vice versa and
that solutions that were being created
in those siloed domains we're no longer
sufficient to fully answer the risks the
challenges that were being faced across
an organization and looking at that the
board the senior leadership at the IEP P
said we should start talking about how
do we talk to those other professional
domains how do we talk to IT risk how do
we talk to information security
professionals and what are the skills
that we need clearly we cannot be
masters of all domains we have to have
fluency conversational skills across
those spaces that led to some
conversations between Matt and myself
aisaka of course one of the leading
organization
in the world for certifying
professionals in information security
and IT risk and Matt can definitely tell
us a bit more about that but the minute
that I raised the idea with Matt that we
were seeing something that immediately
sprung back to me the idea that he was
seeing something to that I Sokka was
seeing something and that there was a
hybridized future for us where
professionals did again not need to be
experts in every single domain but they
needed to know enough so that they could
maintain a conversation so now what do
you think is causing it like what's what
lies behind this sudden you know these
fields have been around for a long time
why is it suddenly seem at least to me
that this has been a huge uptick in the
need to have more collaborative
solutions well I think there there's
just two things that it really comes
down to number one is the continuing
pace of change it's getting faster
around technology so technology is now
embedded in everything that everybody
every company every government every
Enterprise is is involved in fact it's
affecting our personal lives as well
from the enterprise standpoint though
what's also happening simultaneously is
this increase in complexity around the
the legal compliance and regulatory
aspects of things and part of this is
really being driven by the fact that
technology is generally for good in fact
at aisaka we we our purpose statement is
to help you realize the positive
potential of technology but with that
comes the requirement of looking at the
risk aspects that technology bring to
the table and as a result the the focus
on mitigating that risk is actually I
think driving the issues around security
and privacy and it's really on one big
bundle and I think that puts a spotlight
on what Trevor was talking about about
the need for this cross-pollination of
knowledge and and actually goes beyond
privacy security and risk I mean our
professionals also need to be I would
say everybody in this room needs to
start
having a grasp of what are the
technologies that are affecting us today
and more importantly also being
anticipating anticipating those new
things that are going to come in and
impact us
let me just carry on from that I think
in terms of causes it's the digital
economy it's the rise of our digital
lives and the technologies that are
challenging us they bring with them
traditional IT engineering InfoSec
concerns and we are using tools from the
legal and compliance world privacy laws
many of which were really conceived of
at least the frameworks 50 years ago are
Fair Information practices that were
applying to these new standards were
really designed 40-plus almost 50 years
ago in fact it is the 50th anniversary
of the writing and privacy and freedom
by ellen weston and that is I think a
notable anniversary for us this year
because that really was the first time
we thought of this idea of control we're
seeing some tension there and we need
better and new solutions and part of
that is people who have worked in public
policy people have worked in long
compliance understanding how these new
technologies are creating new issues you
said you don't have to be an expert and
everything and we can't do everything so
what's enough like how do we figure out
how much is enough let's put a pin in
today and put the future aside for a
moment what should people be doing right
now that's enough to give them the
background they need to do a good job so
I mean it is a tough challenge because
generally we've come up through our
educational backgrounds and our
experience is focused on things that
we've become really good at and and now
what's happening is we're being in fact
this is kind of a phenomenon that that
has really plagued and the engineering
community for a long time because now
it's not just about electrical or
mechanical or civil engineering now it's
about engineering and you know we've
added biologists to the mix and
chemist to the mix and all of us and you
know bring it back to our space we've
all learned a language and one of the
hardest challenges first is
communications which is trying to
understand the perspectives of others
and the reason that this is important is
that the problems were child or the
challenges we're trying to address today
are systems problems so they all fit
together and part of our our challenge
is to understand how changing one
variable is going to affect the other
and so in that it comes to the fact that
you may have your core area of expertise
but you're gonna have to be a voracious
reader studier listener to other people
too and to capture that knowledge and
make it part of fitting into your think
thought process and and it means that we
have to be broader we can have our
specialty but we really have to think
more broadly across all of the aspects
of the things that are that we're being
asked to deal with I think Matt's
exactly right and I want to restate one
of the points he made I think the
privacy probe today the InfoSec probe
today and the cyber probe the future
need the cyber pro of the future needs
to be a perennial student you always
have to be learning more because
technology and innovation is moving so
quickly it's really difficult to keep up
with Ruby your question though was when
what what is enough and what is the
amount of knowledge that you need to
learn as you cross pollinate across
these different domains and I think the
answer is like so many things in our
field it depends it depends on the role
you're in the organization in your in
the type of risks that you're facing you
know I came up through a privacy role in
an online advertising company back in 99
2000 and I had to know as a lawyer how
cookies worked back then I would argue
that anyone that works in an online
space today needs to understand how the
technology of state management the
technology of things like cookies work
in order for them to understand the
privacy controls that sit inside
browsers the things that are coming in
the e privacy directive in Europe but
that's just one small slice whatever
it is for your organization maybe you're
in life sciences working on the human
genome or DNA and you need to understand
some of the privacy implications that
may emerge from using the human genome
and that is going to require a
sophistication around what DNA can tell
us and what providing results to someone
might de close about someone else so it
is role based and it's situational its
contextual but the thing that I know is
that it is it is multi-denominational it
reaches across other domains so a law
student graduating today not for one
second should think that their education
is sufficient for them to be a fully
functioning and successful privacy
lawyer going forward they got to learn a
lot more so what's interesting about
what you were just saying too is that
when you know aisaka spends a lot more
time working with the information
security community and the the people
who are on the operational side and what
we're finding is that the traditional
paths of Education are becoming not
irrelevant but less and less important
to some of these roles because for
instance our lead in security at aisaka
was an English major it just happened to
fall into the technology side worked for
NSA and a few other government agencies
on things he can't talk about and he
went back and got a master's in
international business the thing that's
interesting when you talk to him though
is that what you realize is that he has
technology aptitude so there is that
thirst for learning but the the other
aspect that brings into it is that
whether it's security or privacy when
you're looking at your enterprise
there's this question of do you
understand the business that you're in
right because even if you're an
operational security person when a
breach happens if you don't understand
the construct of how your business works
if you don't understand the architecture
of the technology system that's in place
it makes it very difficult to actually
take the correct
actions so this is just it's really
complementary to the story you were you
were talking about the privacy of route
that you type and and it does raise the
point that academic institutions around
the world really are still teaching in
those silo domains I came up through
political science and you know we did
not venture into the science buildings
if we have if we had any power not to
except for like the one or two mandatory
science credits that we had to get in
order to graduate we've got to change
that dynamic you know we need humanities
graduates to understand that they need
to understand how technology affects
Society and in order to do that they
under have to understand a little bit
about technology and vice versa I think
exactly exactly and so computer science
graduates need to understand a little
bit about ethics and a little bit about
privacy right we can pick any of those
disciplines I mean you know in biology
and there's probably people here in this
audience who are working for pharma
companies and they probably know more
about what I'm going to mention but I
mean there's this system called CRISPR
which actually allows you to look at
that's right and and then when you think
about the potential of first of all
you're cataloging this you're comparing
it to two other individuals and then you
think about customized medicine but now
you start layering on top of that the
people who are doing that work if
they're not thinking about privacy if
they're not thinking about security if
they're not thinking about social
implications and ethical implications of
the innovations that are happening so I
think all of these things are it's kind
of like this big massive stuff that's
coming and you have to just kind of
figure out how do you cut through all of
it to make sense out of it all so let's
talk about that pre with you that things
are contextual and by the way a lot of
us just fell fell right into our careers
right so but now we're talking about
particular fields where it may be more
important
is there a particular business type or
field where this you know convergence is
most important that we get right now and
should be prioritized over others
industries I mean when when you've got a
change you try to go after the lowest
hanging fruit and if it works you use
that as a model as it trickles down
right so I'm looking what's the lowest
hanging fruit here for us to start
saying that needs the convergence now
yeah yeah and that's my answer to is is
that the the ubiquity of technological
innovation is so complete so many
organizations are data-driven
organizations today so many
organizations are technology driven
organizations when I think of just the
small ia pp and we are a very small
organization the number of technologies
that we use is dizzying and our need to
understand how our members data is being
used I mean that's it that's a tall task
for a small organization so I don't
think Ruby that there is sort of the
early adopter of this convergence idea
the cyber pro of the future is not going
to emerge in one place first I actually
would think we are seeing that
development across the global
marketplace in many many organizations
and I can tell you I shared yesterday
we're just about at 33,000 members we
started the year 25,000 members we've
added 8,000 members this year there is a
real resource strain in the marketplace
privacy professionals people with these
hybridized skills they are in absolute
hot and high demand it is a tough market
to find those kinds of people and it
really raises the importance of
cross-functional training you know so
for all of the traditional privacy pros
in the audience going out and getting
some InfoSec experience getting maybe
not experience but training doing
programs from groups like I saw that's
only gonna make you a much more valuable
asset inside your organization and
improve the value of your contributions
to your organization and conversely
information security professionals IT
risk
um even business management
professionals understanding enough about
privacy so that you've got that spidey
sense when a really dumb privacy
decision gets put up on a whiteboard you
can say hey guys that doesn't seem right
why don't we run that past Ruby in the
privacy team or let's let's run that up
to the privacy group and see what
happens we need that kind of
sophistication inside organizations so I
mean two things you were really hitting
on there working in reverse order I mean
the last thing again comes back to this
whole notion of systems thinking right
so that when you're doing your work
being able to say okay what else is this
going to impact right so if you're if
you're an information security you have
to be thinking about the privacy
implications that's actually becoming
more of a second nature now but but the
other point that you were talking about
was you know we don't know none of my
crystal ball with me here but we don't
know how the markets are going to evolve
in terms of how the work that we're all
engaged in today and how that's going to
change so I suck as a community of a
hundred and sixty thousand business
technology professionals a large number
of the people who have been been engaged
in our organization started in the area
of information systems audit you know
just assurance that the systems that
we're using are going to work properly
that the data in is the data out I mean
I'm oversimplifying it but but what
we're seeing now is that if you look at
the makeup of information security
departments now most of them have
already come with a nice acha credential
and information systems audio and now
we're also seeing as some of the people
who have started out and information
systems audit are looking at operational
security because that's a place where
there's a huge gap you know who are the
people that we're trusting to monitor
the perimeters of our systems and more
importantly who are the people that we
will want to count on when the breach
happens because none of us are our
bullet-proof from from that regard so
we're seeing migration already there and
and I think it's worth mentioning that
maybe if we're having trouble finding
the right people that we also need to
think about our expectations of what
we're of who we're hiring in the
security space in particular every
company wants somebody with credentials
and five years of experience it doesn't
exist and so one of the positions that
we've taken is that we need to think
about apprenticeship and the fact that
anybody with technical technical with
technology aptitude can actually learn
how to do this work as long as you've
teamed them with somebody who is really
good at it so there are sources in the
security space we talk about people who
are of who are completing their armed
services careers people who might be
looking to do something different in
fact our friends in the UK spent a
million dollars doing a test they put 55
people from non-traditional experiences
in a room in a 10-week program
bartenders barbers mortician
psychiatrists and taught them how to do
security work 27 of them were employed
literally within a month after the
program great so ask the more difficult
question convergence isn't a hundred
percent I can tell you I've worked with
difficult professionals on both sides
who get entrenched one example I think I
still see a lot I'm just by way of
example is employee monitoring why
wouldn't the CEO have a giant pissy fit
about protecting the IP right its job
one like don't let the IP out I don't
care if it's a negligent employee a
reckless one or a you know angry
intentional one do what you have to to
you know make sure the employees aren't
losing our IP and then you know the
privacy professional comes along and
says well we probably shouldn't put CCTV
cameras behind every potted plant just
because Harvey Weinstein entered the
building so
come on it's not too soon and and so I
have these kinds of comment I I do both
so I'm in the middle of these
conversations a lot and I understand
both sides how and and then they get
polarized it's an us or them right right
how do you create a stake for each side
now in the game so that they're
collaborating on a solution that isn't
the loudest one wins that isn't the
biggest budget wins but the company wins
sure so it's a great question and it is
a classic tension and I think the answer
is the answer and that is those two
sides need to understand more about the
interests and the positions of the other
side and we only get that point we get
to that understanding when they have a
bit of fluency and a bit of experience
on the other side of the fence so for a
privacy professional who may be driven
by a strong interest in protecting
employee privacy understanding that
competing interest in IP security within
the organization or just even physical
security within the organization that
demands that there are CCTV cameras in
certain places the privacy Pro needs to
put into their algorithm of what is an
appropriate response in terms of privacy
for that situation those interests as
well so too does the security Pro need
to understand that yeah there probably
doesn't need to be a camera behind every
potted plant where are your interests
how can we focus on them how can we
resolve them in the least privacy
intrusive way possible when we do have
to implement things like CCTV cameras or
email monitoring or whatever whatever it
is from an employee monitoring
perspective how can we make sure that
employees are aware of it that they are
recognising when it's being used that
they have the ability to raise concerns
about it how do you engage a dialogue
between the privacy and security
functions when we have both of those
sides we're recognizing the legitimacy
of each other's interests then you have
a powerful dialogue and I don't know
what the ultimate answer ever will be I
think that's something that needs to be
worked through for every organization
and sometimes the CEO may say you know
what I
P that's the crown jewels for our shop
and every potted plant gets a CCTV
camera . that might be the answer might
not be the right answer for other
organizations and it's a dialogue that
has to happen between the privacy and
security presence so Matt do you have
any privacy and security whisperer
techniques where you are able to plant
the bug successfully in a gentle way you
know I think Trevor makes one point
that's really important again and we're
coming back to you know how do we all
communicate we all get along and I think
we really need to be thinking about
walking in the other shoes and I'll come
back to your original question you know
when you start thinking about this right
we can talk today about security and
privacy professionals talking more
together but security and privacy
professionals also have to talk to a
whole lot of other people in the
organization and it all to me is coming
up too and this may be reflective of my
sociology background but I mean it's all
about culture the cultures of
organizations are changing and and a lot
of what we're dealing with today is it
is new because when we talk about
security and privacy and risk the the
biggest vulnerability and all of that is
people and so in order for us to be
effective as security and privacy
professionals we have to understand the
people side and we have to be thinking
about the implications of the things
that we're doing in the stands that were
taking and being able to articulate that
to people who may not be as close to
what we're doing but we have to do it
with a lot of empathy and understanding
to what their situation is I also think
back to that how do you create that
stake for everybody
I will take a risk myself and say first
of all how many people in this room were
affected by the equifax if I can't
believe every hand in this audience
doesn't go up because 143 million I mean
that
you know probably 75% of the adults in
the United States that could have been
avoided by a simple patch a simple patch
so I don't want to dwell on that issue
but I think it is illustrative of
creating the stake that we're all in it
together and the state to create in
terms of how we build this culture of
not only sharing our expertise but also
having an understanding of what our
fellow colleagues are doing and
understanding the nature of the business
it's a system if there's a hole in the
system we can lose and so I think that
just puts you know means that we all
have to double down on building more
empathy into what we do making sure
we're taking time to explain I know the
world's moving very fast but we have to
find ways to do this in a way that we
understand what others are challenged
with so that we are all working together
to make sure that we help our
enterprises achieve the outcomes that
they're trying to get to okay I think we
have time for one more question and I
like to kind of go back to the keynote
last night the one we're gonna see in a
few minutes because I think the
juxtaposition of their books brings up a
very nice representation of how people
feel about their privacy and security
rights as individuals so you have last
night how we need to belong to tribes
and when people have their tribe taken
away they suffer greatly and you know
the community's gone and then we'll hear
in a few minutes about a man who
probably valued his privacy and
aloneness more than anything else and
was willing to potentially die for it
and I think that's really the continuum
we face in terms of how each individual
views their privacy and security right
so how can privacy and security
individuals collaborate better to
provide a more flexible and a custom you
know sort of customized privacy and data
security for people knowing people have
such vast differences of opinion on what
that means you first Wow
so I
let me tell you what I hear when I think
of the two key notes that we haven't we
haven't heard Michael Finkel and and
we're expecting a lot from him I know
he's backstage listening right now poor
guy but between these two keynotes what
I see for privacy and security
professionals is job security because it
turns out I know I think it turns out
that this idea of privacy is a human
constant this idea of a desire for a
sense of security is a human constant
and so we need to share information with
each other in order to stitch ourselves
together within society but we also
concurrently need identity autonomy
repose a little bit of seclusion so that
we can protect ourselves and and find
space to think different thoughts and
those two ideas are not perfectly
aligned all the time
and when you intersect governments and
other institutions of control like
corporations and others you create a
very complex environment then throw
technology in the mix what it adds up to
is we are going to be renegotiating the
terms of privacy and security forever
forever and so when I think of what are
these two keynotes mean and and how can
we be engaging it it's don't look for
the answer because the answer is never
going to be found what you have to do is
engage in the ongoing negotiation the
ongoing fight for us to be finding
better answers over time because privacy
and security are eternal negotiations of
humanity and we as privacy and security
professionals collectively we have this
amazingly awesome responsibility to try
to defend that within society that's a
ridiculously cool job that we get to do
but it's also an incredibly complex and
challenging job every day go mad and I
think that the spotlight is on us Trevor
but the lessons are the fact that what
you're describing going forward is
actually demonstrated throughout history
I mean
for long before technology came into
play there were issues around
information security and privacy I mean
the military was has been notorious over
time about you know the need to know and
so the notion of trying to keep that
information you know secure and private
dates way back you can actually look at
security if you go back to if anybody
here saw the imitation game the story
about Alan Turing and him cracking the
enigma code what a great example of
cyber security and its earliest
demonstration and at least that time it
was for the good guys wait that's right
that's right but I the this notion of
continuing to redefinition I would say
there's two things I mean number one is
some of it is being created by the the
fact that technology which you know 80
years ago wasn't as much a part of our
life is now embedded in every aspect and
as a result you know most most of us
that are they're old geezers like myself
you know we grew up with air land sea
space but now it's air land sea space
cyber cyber meaning that technology
space and that is actually helping us as
security and privacy professionals it's
actually calling us to come really help
try to solve issues that are being
created by this new domain new domain
and I'm sure we're going to figure it
out
maybe it's 15 years from now and guess
what then there's gonna be something
else on our doorstep and we're gonna
have to be called in to do it again I
want to thank you both I thought it was
a very thought-provoking beginning of a
very long conversation which according
to you will be infinite but we all have
job security so thanks for that and we
have two organizations ready and willing
to help us all learn and get out of our
silos and do a better job so thank you
and really looking forward to our next
keynote
you