Sign Banking PPT New Jersey Secure

Industry sign banking new jersey ppt secure

so I'm Dan ready as John said you've got the BIOS but I'll just go over the basics basic titles I'm a consultant in software assurance and supply chain risk management for the Institute of Defense analyses and I also teach at Thomas Edison in the Graduate cyber cyber security certificate program and had the opportunity to meet one of my former students this morning which is it's great I have a pressing question that I want us all to address and that is should cyber security be one word or two so I'm delighted that everyone is talking about cyber security for a long time we talked about information security and then cyber security started catching on but I find book titles with two words programs with one word and I want us as professionals to go with the one word all the time in every case all right so that that's right that's your mission to go and spread that that word so on my left here Mikael Malkovich is the director of information security for Consolidated Edison of New York came all the way across the river to be with us today I mean can you beat this view it's spectacular next is Ernest warning senior vice president for innovation how cool is it to have innovation in your title innovation and growth and commercial practice partner for systems I word systems one system one system one ink and then next Monisha and MacArthur senior manager at Boston Consulting Group plan tinium where she is focused on large cybers transformations among other things and last but not least Kyle Foley service area manager for IBM services public sector cyber and biometrics service area which i think is also very cool title so I'll start with Mikael our government is paying more attention to supply chain risk in fact last week at a meeting it was described as the shiny new rock now it's the shiny new rock that we are still pushing uphill but everyone wants to touch it everyone wants to be part of it and to me it's a long time coming I remember when I was at EMC and people internally would say so when cyber security going to become a big thing and I would always say in the next six months and of course six months later and then six months later and then it was going to be 2015 well its 2018 and it's starting to get a little more attention so my question for Mikael is how do you approach the problem especially from an industry point of view you've got a zillion vendors and I know the world of Industry is to ask a whole bunch of questions and a questionnaire of every vendor but then how do you deal with that how do your peers deal with it so can you enlighten us on how you approach supply chain sure thing so first and foremost one word I vote for one word cybersecurity so to give a little bit of background supply chain risk has been a part of our day-to-day life for a long while even though it's getting publicity right now and it's becoming the hot thing we've been involved in protecting the grid for a while and we always understand that one of the easiest ways for an attacker or malicious code or malicious functions to get into us is through our vendors right and there are four attack vectors that I'll just kind of speak to and you probably have seen a lot of this already on on the news and in the public space but how can our supply chain risk be manifested against us right vulnerabilities Hardware embedded malware software and better now we're and compromise of trusted vendors right so we've see a lot of that in the news right now and as we recognize that we build our internal programs to mitigate that risk so in general right so defense in depth and defense in breadth is a strategy that I utilize whenever I talk about cyber security right so that's multiple layers of Defense and multiple tools and practices and capabilities across each layer then the risk assessments right so whenever we deal with vendors that hold our data or that we interface with we perform vendor risk assessments on them cyber season sees right make sure that their legal departments are familiar with cyber in impacts and actually collaborate with a cyber team to make sure that s procurement and supply chain actually buys things that both the legal and the cyber team is involved to assess the risk no silos right so a lot of larger organizations you have one department and another department they don't talk to each other well from a cybersecurity perspective that's that's not a positive environment all right you want to make sure that whenever anyone talks about utilizing a new technology or a new system that they're building where they're utilizing vendors or even if they're building in themselves that those functions are brought to IT or to information security to evaluate wholesale so there's a catch-all to make sure that cyber risk is addressed and just in general technology risk is addressed so you mentioned what are we doing as an industry so we cannot solve all these problems by ourselves so we have to partner right we have to partner not only with the other peers which we do within the energy industry but also with the government right so and other institutions right so there are many partners both peers partners that provide us information and government to to come together to solve this problem it's not enough to do what to do it just by ourselves we have to reach out and communicate so who's familiar that they're near supply chain standards drafting team has finished their work and under the Newark zip regulations a new standard is almost ready to come out so Newark has drafted a the supply chain standards said thirteen and that has been now proposed to FERC and FERC is evaluating it right now so hopefully in a couple of months we'll have additional regulation for supply chain risk and it's more of a plan and some terms and conditions language but there are some technical requirements there as well so it's it's a very very good step forward so if I could just pick up on that point some people in the industry have said that the Newark Ship requirements are primarily a compliance regime and they don't really improve security so you've seen both sides of that what do you say all right so I believe that the Newark sub standards even though they do bring on a significant burden of compliance they kind of draw the line in the sand and provide a minimal requirement for all of the industry that supports bulk electric transmission assets or that has local transmission assets to actually implement them you must meet this minimal level of security controls I don't think it's just compliance I really do believe that there is a security benefit to the standards and it also makes everybody play the same game right so that means that anyone can be audited to the requirements and that means that everyone has to have the same controls or the a similar type of controls implemented the standards are they provide some flexibility as to how to implement controls but yet they draw that line in the sand that you must have a program you must secure I see two other benefits one it helps with awareness throughout the utility that there's this entity that we have to pay attention to and also senior executives realize that there's a cost to ignoring it and therefore you have a way to go after improvements correct so unlike in many other industry and many other sectors the utility industry has mandated standards so they're not voluntary so if we actually fail the implications can be significant from a monetary perspective okay Ernest you have innovation in your title so what is the essential impact of the recent and upcoming innovations in technology Larry mentioned IOT obviously cloud it's been here for a while everyone's talking about AI being a new part of our cyber risk so how do you put all of those new innovations together in terms of risk and and how they impact our sector and how do we prepare to maximize the value that we get from these technologies but minimize the risk and now to find the size of universe at the same time great ok so first of all I need to apologize to Mikhail because I'm gonna I'm gonna say something that kind of I have I've less faith in the Newark ships in some regards SIP stands for critical information protection if you're not familiar with the electric industry so one of the things in regards to because I I was the deputy system before he the system one I was the deputies sisal and board adviser for AES corporation so none of this goes day yes by the way so but I just give that reference because I've worked for a large energy company which is why which is where this comes my reference comes from sure the the fact is that you know we have a problem in regards to how we're managing cybersecurity we have number of problems but the big one for me is that especially when you look at infrastructure whether it be energy water even business operations manufacturing in a lot of cases we are trying to manage 21st century problems with fifty-year-old management processes or in some cases hundred-year-old infrastructures that breeds a lot of issues electric sectors one primary I mean one example that if you look at how Newark sip progressed in the timeframes involved in regards to getting Newark sip from one version to another to another we're talking about yours in some cases and well in a lot of cases and those came in when we talk about years regards to managing technology problems and management problems new business structures problems basically it doesn't work what we've seen is we continue to fall farther and farther behind in how we manage things like risk in the business environment in particular we call it cyber risk but in my mind it's it's risk I have the privilege of developing and when we could have finished teaching the risk course for the integrator for the grad program at Thomas Edison and I think Larry brought up some very interesting points in regards to how we are going to incentivize part of the issue we have right now is that we don't incentivize we don't know how to incentivize because we haven't done a good job in regards to looking and finding the problem and we aren't doing that with the problem we have at hand right now which is basically a current infrastructure again in some cases is 100 years old if you look at the telecom infrastructure you're still talking thirty to forty years old if you're talking about then we're talking about layering on cloud on top of that then we talk about how we're going to plug everything into the Internet of Things in the IOD and now in the last couple of years we're saying okay well we're going to make it all work with AI so the the balls we are now going to be throwing up in the air regards to how we are going to manage cyber security and a risk structure within a operating environment both whether it's a utility or whether it's a retail organization or whether it is a manufacturer we have a lot of work ahead of us in regards to how we are going to have to solve these problems I don't have a lot of issues a lot of the problem solved but we at least have identified some of the issues what we haven't done is actually figure out how we're gonna work those issues so workforce for example Thomas Edison solving part of that problem I was happy to hear the CISO for New Jersey talking about that issue as well as acting sort of as a feeder organization part of the solution for that also is going to be we have to let go as businesses we're gonna have to let go of the cyber operations activities and say you know what we can't do that in-house we're a utility we pump electrons we're a you know we're a Internet company we you know we're Amazon we don't do cyber security there's a company over there they do cyber security great that's their job we need to go is to go to them and say ok do our cyber security figure out how we are going to through third-party management through distributed contract partnerships shared services however we need to figure out how we can basically concentrate those capabilities and then leverage them instead of saying oh no we're going to spear this thin layer of cyber professionals which we don't have enough of across all of our industries and somehow that's going to solve the problem you know we're sticking fingers and dikes and going don't thought that duh what we need to do is basically figure out who's gonna build a better wall and actually that's not that of analogy I ever want to give because walls are not the right thing but who's going to actually kill Walter controversial but what's a controversial exactly thinking about I think about it in terms of cavalry you know the Roman Empire fell apart towards the end of their period because they couldn't defend all the borders the last couple hundred years the only way they survived was basically that they got this right idea and said oh well we're gonna have this group here and this group here and we'll respond we've got to that point it's now about understand there's gonna be a breach what little wall we have is going to be hit and we're going to come over so the question is how do we respond how do we prepare to respond how do we ensure that those resources are at revolt and adequately put in place how do we manage that there's so many incidents in regards to Ukrainian incident from two years ago the target incident of you know all the cases where things have been handled badly because they didn't have an incident response plan they didn't follow the incident response plan they did they didn't think through what it actually meant if they were actually going to fail we have to understand we are going to fail that's hard to say basically especially you especially the consultant it's hard to go in and say you're gonna fail but in the end you're better for it because what you what that means is you have the ability to respond in and you do those things we've talked about in regards to preparing the board responding making sure they're prepared making sure they're doing their due diligence all that falls into the how do we deal with the problem so what do you think of Larry's comment that your attacker knows your response plan and they use that against you your attacker knows well first of all yeah I mean that is probably true somewhere true in some places not true another's but that doesn't mean you don't plan right now if I'm gonna say see say oh I will give you a prime example I actually had a CIO of a major company informed me at one point as I was advising her that about encrypting the database for the financial system example the response I got back was well we don't even know what's in there ourselves why do i why am i worried about someone else being able to get in there I'm like okay obviously my words are wasted here at this point because that's the kind of mentality that you had that they have that some people have in regards to this and that's unacceptable and the board then needs to basically take control and say no no that is unacceptable that is bad for shareholder value that thinking that's a cultural issue so the fact is we can't just go oh we're going to be attacked they might know what we're doing therefore we can't plan no plan because even if they know what you're doing for example they may know that okay your response in this case is this okay fine but guess what you still have to plan about okay if they brick all the assets in my datacenter then what do I do who do I talk to how do i order who actually is responsible where's the data when I have to respond I still have to know what data I've lost and what needs to be replaced or what I need to report based on that all of that still doesn't play whether they and whether they've got a hold my contingency plan or not okay Venetia as the pace of attacks increase how should we best position ourselves and if you have time how do you measure cyber resilience yeah sure I'm gonna pull this a little bit closer yes good can't really project today so most of my experience has been in the consulting area for the past 11 years so my background is primarily in financial services so that's what I will be talking about today but outside of having the best cyber tools or the most sophisticated security operations center I do think there is a significant amount of value in organizations understanding what their key risks and vulnerabilities are a very good baseline foundation is using the NIST framework ISO C is top 20 they're all fantastic to get you to that 8020 rule but where I have seen financial services in particular go above and beyond is when they start focusing and actually going beyond parameters of a methodology or a framework so I can talk to you about what I've seen from the top five or the top ten banks who have really good hygiene and then they start to expand their boundaries with the budget that they have so first of all it's understanding their top key assets risk a lot of companies tend to focus on taking out one-size-fits-all approach and with the top bangs I've seen them go above and beyond here they'll have very robust inventories of what they consider to be their most critical assets and have a very interesting program to actually protect those what I haven't seen done so well is taking a layered approach to that type of security so understanding the vulnerabilities at the network layer the server's all the to llege that would tie up to a payment system for example and the IOT I still think that's still a little too new for financial services they're working on it but I haven't seen a good fit for it yet so something that I'm doing with BCG is actually doing research with MIT labs they have a systems based theory that Nancy Leveson a professor at MIT came out with and she focused on industrial systems and understanding why with the controls in place today do accidents and hazards still happen so we're trying to use that same approach and apply it to cyber to erase the kind of the 20% negative after you hit the 80/20 rule so a good example of this the NASA space Challenger accident that happened several years ago now when they went through traditional analysis what they found was it was in a ring that was faulty that's that's exactly what they found but when they used this new approach than my MIT they found that the NASA s management team was actually under severe political and financial pressure to reduce cost so they went with a low-cost provider that had a known flaw in the o-ring and there's tons of studies on this there's books and articles written about it but what we're trying to do is bridge the gap between not just focusing on technology and financial services but branching out understanding the human element understanding the process breakdowns that might occur that would actually result in an attack a lot of the stuff that happens today not petty I wanna cry it's all very hygiene related right and it could have been prevented by proper training or improvement in process controls so that's really what I'm trying to focus on right now in terms of the industry and I see the more sophisticated corporations going in that direction so the question about cyber resilience then I'm measuring it yeah measuring cyber resilience I have seen tons of KPIs and metrics programs some that work some that don't work so well I even had an organization that had 300 metrics that they were trying to risk measure from a cyber resilience perspective and only ten of them were something they could actually calculate but what I found the best measure of resilience to be is actually conducting tabletop exercises so actually going and putting yourself through a real live simulation of threats that might be posed to your organization and learning from that so something my my MD says really well is that you can't learn golf by reading a PowerPoint deck right and in the same way you can't really be prepared for an incident or a business continuity type of situation by reading a 50 page document on what to do when it actually occurs I think it's about consistent organized action planning to actually simulate those exercises not at the leadership team but also at the board level so they can deal with the media and deal with their customers and know how to respond adequately and taking measures from that how do they actually improve setting KPIs to that level so we have bill Newhouse who's going to speak in the next panel and I have the opportunity to hear bill talk about the nice framework last week when we had a session in DC on workforce so I couldn't stop thinking about it so I was very impressed that the nice framework outlines 52 work roles but how do they translate into the jobs that people need the most so the idea is that 52 work roles are not necessarily single job descriptions for an individual one individual may have three roles and you advertise for it it seems to me that one of the things that's missing in our industry is some standardization as to what the the titles are that people are interested in so how what do you think the industry needs most are they network skills - defense countermeasures analyses supply chain risk understanding the business aspects forensics how do you see the work rolls all of those but first cybersecurity is one word spread the word and and fix your spellcheck so it's I'm all for that I've actually accomplished something today this is great today so now I think all of those really cyber security what I love about it it's a very broad field and and so I all of those areas that you mentioned need to be part of your cybersecurity program and linking business to cyber is very important now in IBM we solve business problems for our clients I think everybody here would agree that cybersecurity is a business problem so I think first and foremost everybody has to have strong business skills I think you have to be able to understand risk you have to understand the business that you're supporting and and as important you need to understand the sector that you are supporting as well of sorry thank you you do need to sub understand the sector that you're working in as well I think that that really helps your cybersecurity program if you're in a healthcare industry you're doing so you're running a cybersecurity program for a hospital I think it's very helpful that you have somebody with experience in the healthcare industry as an example same with financial services same with defense same with you know the federal government has used some unique requirements so that's something I think that is fundamental I think is you know risk management and business skill so your cybersecurity curriculum I think should include you know basic business classes as well as the technology classes as well I'm sure your program addresses that but in addition to business skills there are there are various technical skills that that we find that our that our clients and our solutions require and so I thought I would just go through the solutions that we have in my practice at IBM where the cyber and biometrics cybersecurity and biometrics practice in the public sector in global business services at IBM and so we have a we have a governance and regulatory compliance solution and of course you you you need to know what regulations that your client has to comply with when you work in that area and that is a broad solution so you need a strong tech general technology background as well to work in that space GDP are that the general data protection regulation is a hot topic right now it's not as much so in in the public sector is certainly in the federal space as it is in the commercial sector but May 25th is a drop-dead date for GDP our so that is a hot topic and I know at IBM we are doing what we can to make sure that all of our all of our contracts and all of our businesses comply with GDP are so we're working towards that we have an application and data security solution so you know they're we're looking for people with with knowledge of of development with coding and vulnerability scanning of source codes the things things like using IBM app scan is a tool or fortify and then on the database side database monitoring we're looking for people with those skills as well you know IBM IBM has a full Guardium and Imperva is is another another product so we're looking for for people with skills like that as well you can learn the tools so you need to be able to learn the tools but it but it sometimes our clients will specifically tell us we want somebody who knows the tool that they have so we can we can we can sometimes get people in because we tell them we can learn they can learn that tool quickly but but that is a direction that that we find for for certain of our solutions we have an infrastructure and endpoint security solution and iBM has a endpoint security product bigfix and and we're also looking for people with firewall experience we're looking at infrastructure and endpoint security our security intelligence an Operations Center we solution that we run a sock for several different federal agencies and we look for people who know how to you know do deep I know Larry was talking about analytical skills that's really important you know we have tools like Splunk for security intelligence we have IBM qradar we use some of our clients use use that tool we use necess for scanning networks that seems to be very prominent in the federal space Nessus is a very very very popular network security network scanning tool so we're looking for people with those skills but in that area and when you're working in a sock I think in addition to knowing the technology you have to have good analytical skills and the business sense of what's a risk because there's so many risks you got to know what's most important for your business so to how I would say that how would you answer the question that someone raised earlier for Michael in terms of entry-level positions we've described a lot of things of where you're looking for existing skills are there avenues for entry-level positions there are and we do hire some students right out of college so they're not only are they are they new to cybersecurity but they're pretty new to the workforce we do struggle with with finding projects in some cases where the clients will accept them because then we're in the services business so we you know clients pay for our services and they do often want to see people that have have experience now certifications is something that they ask for a lot too but certifications a lot of them you have to pass the test but you also have to have a certain number of years of experience in order to get this certification so that's another thing so we hope we do hire we do hire people if they have the right if they have the right education and the right background we do hire people so I do believe there are opportunities out there just keep looking for them because it's a great it's a great feel but it is a challenge and I don't totally understand where they're coming from there so if someone knows that cybersecurity is one word they get a leg in the door there you go okay you go capital see okay so we have a mic up here I'd like to I have a few more questions for them but I want to make sure that you folks have an opportunity to ask our distinguished panel some questions so raise your hand and we'll get a mic to you if you've got a question first of all I've got Jojo synopsis I have to commend panelists who are talking about where industries stepping forward as self regulating as opposed to waiting for bad things to happen and the government will come in and regulate because government really doesn't want to regulate unless bad things continue to happen it's viewed that industry is not self regulating so that's very good but going into the issue of when people bring up issues you use the Challenger Act actually that was a case where NASA chose to make it a management decision as opposed to safety because it used to be with NASA a safety engineer could raise but the safety flag and stop things but NASA turned it around said you must prove that the accident is gonna occur otherwise we're gonna go ahead and let it go now in cybersecurity that's even more challenging proving that a bad thing is going to happen to say you should take preventative things it's harder to prove I did that with cap risky labs challenging DHS you shouldn't be acquiring that for years later they put out a binding operational directive oh that was bad you can't install that it's just like they were warned but acquisition said it's cheap you know what they would have given it away but so how do we address that given the fact that you can't typically prove that a security incidents going to occur but you can talk about what the preventative type of the stuff is so anyone want to take that just grab the mic and get it close to you I can go first but in terms of so that's exactly what we're doing right now we're doing this research with MIT labs we're putting a use case together to explore the management and the human and the process related aspect of it I don't have a good answer for you yet but to be honest I think that we will eventually because a large component of why we're doing this is to justify spend write a lot of a lot of boards they get a ton of money to say you know X millions of dollars go do something with it but show me show me the return on investment and that's not an easy thing to prove so this is one of the reasons why we're actually going down this route of exploring things outside technology so I'll maybe put out three things so one is leadership at the top right so just but just as with safety right so the leadership at the top needs to set the example saying safety above else so now I think there's a recognition that cyber is one of the top risks that any organization has but everybody is so embedded now with technology that you can't really run any business without reliance on technology and with technology comes the risk of cyber so that should be one of the top risks for any organization the other thing that I'll say is I think proving the negative of saying hey it's not gonna happen to us is actually much easier now I'm gonna take a different perspective right so there's two ways to do it and if you're gonna do your risk management exercise and you're gonna say how many times does this happen in the past right now let's say that you in the organization hasn't happened to right but the idea is that you can now look outside and and I'm almost in the position where there's a daily breach going on right so if you're not seeing a breach notification in the in the newspaper then you're not reading the newspaper so whether it's your boards or your senior leadership you should be able to point to the Ukraine example that was mentioned earlier you're able to point to other companies that have been breached that had significant impacts their bottom lines based on cybersecurity and at that point I mean we're there right it's no longer if it's when yeah and now the question is it's not I don't have to prove that it happened to me I have to just show that it's happening all over the place and it's a much easier conversation but I would I would say that getting that tone at the top is very very crucial just add real quick on that I think it's an excellent point in regards to up until now and you look at it for example cyber insurance the idea has basically a great idea but you know insurance is based on actuary tables all this data that we've had over hundred years in regards to you know how long I'm gonna live based on these characteristics how much you're going to live for this we're finally getting the point where we're getting the data points that we need in order to make those some of those discussion point have some of those discussions from a risk standpoint when it comes to cybersecurity which goes to McKell is pointing about the the fact that you can look outside now because yeah it used to be I remember the the I'm sure you got this as well talking to anyone in operations on an electric company well give me an example where that ever really happened and Ukraine happened and suddenly it was like this the suddenly I had the the European subsidiary CEO was ear like you wouldn't believe so the fact is that we're finally getting to a point where and this goes to the whole thing in talking about innovation earlier we're finally i OT advancement of Texas today I all those together are finally good at getting us to the point where we can do the statistical analysis that we couldn't do before we're able to sort of pull tha data points in do they run through the algorithms if you will and actually come up with some fairly decent answers in regards to yeah this is an issue and importantly stop thinking about it a cybersecurity start thinking about it this is the business risk to you this is how much it's gonna cost us the bottom line because that's what the CEO wants to know what do you mean my plants can be down for three days or a week or whatever suddenly that's real numbers damn or you know we're gonna be in violation of Newark for sip rule regulations for you know for a month my god that's twenty five thousand dollars a day I mean two hundred fifty thousand dollars a day what are we gonna do we got to fix that so suddenly risks prevention looks a lot more inviting yeah if you could set up a risk culture or develop a risk culture in your enterprise I think that goes a long way for addressing you know getting the attention of the senior leaders understanding the risks incidentally because you mentioned cyber insurance Larry Clinton and I did a presentation at the RSA Conference on cyber insurance and assurance so if you look for both of our names and search for it you can see the PowerPoint so another question over here Dave Kristensen a TPM with their software and your engineering group so I just got involved with the IT security last five years and I noticed doing some mentoring with some universities on cyber and I there's a huge challenge on cyber education in New Jersey and and then hiring how do we attack that and solve that problem together so I'll I'll take a shot of that so universities right now are developing multiple cybersecurity programs so Thomas Edison is one of Rutgers is another they've just started a cybersecurity program so as long as we as industry participants and experts take part and and support these organizations and these programs I think we will go a long way I think a good a good approach could be given if there's a way to have incentives for companies to train people who know the business in cybersecurity so that that creates a career path from within so you because because it's it's expensive and it's hard to get the right people from the outside look inside and looking to develop work with your human resources and developing a program you know within your organization to train to train people and I think also that we need to start looking at the the European model in regards to getting away from you have to have a degree you know or at least you have to have a four-year degree in order to be to work in cyber security okay let's talk about the whole concept of internships let's talk about the concept of a job training let's talk about the concept of you know Thomas Edison for example is a graduate program we're doing is basically greening operate yeah the graduate program actually allows to take operational guys and put them in the cyber environment saying okay you already know the business you're already three-quarters of the way there let's talk about the other side of the problem which is you know the technical in the process risk issues the other thing in regards to that is that veterans for example I was mentioned earlier former veteran myself well technically I guess I say we shouldn't say former I am a veteran myself you know I actually the the Air Force trained me an information warfare so I mean I got a great job out of my my seven years so you know we need to be looking more in regards to that and then also we need to be looking at as we transitions the innovation B's NOx and Sox are beginning to fight fade away companies are going to own less and less of those guess what all those system administrators all of those network operators administrators those guys already know half the problem so we need to start turning them from not guys or not people to sock people or security people so there are ways to do this we just might be a little creative and we have to think outside the box of no no we're going to stamp and print you know an undergraduate every year to solve each of these problems we're not gonna produce two million of them I think the last number is what we need so the time you know in order to do that we're gonna have to take some repackage we have to take some will create new will take some that you know basically oh well you already understand this okay we'll get basically give you on-the-job training it's gonna be sort of this all the above type of selection I was just gonna follow up really quickly on something that are said about how the European model for workforce is really different and I spent about two years there and we had a lot of people that came in a lot of young people come in after high school graduation they didn't necessarily know what they wanted to do in college and it was a mutually beneficial relationship for the organizations that hired them because they got them cheaper and and the individuals were actually happy you know they learned and they grew and we spent more time to actually coach and train them and they grew into the cyber security space that model to my knowledge does not exist in America and I think that would be an interesting thing to see if we couldn't move to that model but that is that is one option and that's gonna mean a major change in how we credential yes do you have the microphone where is it Mike he's next yeah so I guess larger enterprise do understand the risk but the SMB space is really low hanging fruit and somehow there's not much awareness in the small and mid-sized businesses have you guys seen any kind of wellness or what could be done from the government side or from you know just somebody else I'm gonna I'm gonna talk from financial services really quick I know you guys will have a conference in other industries but in the financial services industry we're working with the the bits roundtable the Financial Services Roundtable to harmonize all the different regulations from from a US and well I would say North American perspective and this is tiered so that it focuses not just on the the sector nine organizations are the top largest it goes down to mid tier and the small banks and it goes through all layers so it is applicable to all of them it is public it's going to help organizations ultimately understand what they should protect it doesn't have to be everything based on the size of their organization but at least in FS they are moving in that direction to help SMB orgs okay I think you were next but he stole the microphone so make it quick and I didn't steal my question is really for earnest from what you had said I got the sense that you're advocating that larger enterprise organizations outsource their cybersecurity to other companies that are specifically in that arena you're saying yes you're correct and you know I'm happy to have the discussion with anyone in regards to counter points that you know like everything there's plus and minuses my major point regards to the my major advocacy of that in is both for large business and for small businesses because if you think about this okay most companies their business is not operation sitting not network operations not security it is you know whether it's pumping electricity you know pumping electrons whether it is selling products whether it's manufactured the manufacturing floor building building things widgets whatever the corpus the core of their business is that their core business is not finance for example most businesses especially large businesses they don't do their own data networks they hire someone from that they don't run their own you know they hire Oracle they hire sa P in regards to the financial systems they for the most part we've gotten away from the model of we are going to have everything in-house we're gonna run it in-house and there's a reason for that basically it's not their core competency and for large businesses it makes economic sense to do this because again when I was at AES for example we understood we're an energy company we're not gonna attract the best and brightest in regard to cyber security because guess what those guys are gonna go off and do something else for someone else who actually focus on cyber security on cyber security they're not gonna want to sit around and do you know a lot of stuff so what you have is basically in most cases with larger businesses you should in my mind again again we can talk about this is that you want to have a core capability from a management process standpoint of understanding these are the core issues in regards to our business these are how we handle contracts this is how we manage operations overall this is a cyber management process issues involved but for the most part when it comes to ok what are we going to run a sock ourselves know let's do let's have a company X do that cuz guess what they do it for and I know that the nurse if has issues with us so relieved the utility will leave the utilities yet out front but the fact of the matter is it's all about control we need to understand that control can be managed through contract if managed through business processes we've been doing it for years cybersecurity is a business risk we manage business risks every day through internal processes through our chief risk officers through our chief supply officers the fact that we keep saying and I've been in cybersecurity for 22 less years so it's hard for me to say we're not special but we're not special in reality we need one second to finish yeah so that's for a large business now let's talk about the small businesses small businesses in some cases they have one guy how can you have one guy who's an expert in your network security and guards to your supply security in regards to your network your Incident Response capability there's no way so what you're doing there is just setting yourself up for failure saying oh no we're gonna have one guy guess what share hire in by the way also that guys you know who break him up into different pieces to do these different things well guess what I can hire a company like a fire I can hire a company that or another company that does Incident Response capabilities I can hire those and they will manage it for me as long as I hold them to the line as long as I'm telling them these are your requirements this is how it has to be said this is what has to be done and basically you have I have to answer to a board we do that all the time even in for example in the utility industry we don't run pipelines we're supplied by someone else so you can't tell me that oh well we can't manage it from a security standpoint because it'll cause a failure to the business well then why aren't you managing your supply Ryne are all the way back to an oil field or to a coal field in West Virginia it doesn't make sense from that perspective and yeah so I'm sorry yes so I just want to chime in a little bit so I agree with Ernest that there are opportunities for outsourcing and if you're the small guy and you don't have the resources and you don't consider that that is a core business function for you to absolutely consider outsourcing there is opportunities for both outsourcing the whole thing and also augmenting your staff with others right that being said I believe it is to the businesses benefit to determine what is and what is not a core function so as I mentioned earlier right PI T and technology is becoming more and more crucial to the core business function of the utility of Finance of any any business out there so if you were choosing to think of your IT as not your core business I would cause you to reconsider ask you to reconsider and where the IT as being your core business you now have to make a determination is my knock my operation center my core business is my cybersecurity my core business if it is one of my top risks should I be outsourcing at wholesale or should I have more of a you know my thumb on the pulse so I agree there are instances where outsourcing is appropriate and I'm sure Kyle will agree with me on that yes big chunk of corporate America and across the globe do outsource cybersecurity as a service to IBM and and we do different things for different people whether it's a sock or we're monitoring their their entire network or we're just doing endpoint security or we're just doing application security but yes it is successfully outsourced by as a service similarly you know it's a collision just like a cloud service if you look at infrastructure so it is done successfully and there are real economies of scale there and I think that's an important driver is cost yeah but once again I believe it's up to the business to determine what is core to your business and what you choose to use outside help for yes going back to the European model of hiring job candidates for cybersecurity roles what would you recommend for people looking for these jobs to display I know you mentioned that they don't necessarily we need a college education and a good example this would be Marcus Hutchins also known as malar tech who created the sinkhole that stopped the wanna cry from infecting other hosts what would you recommend that job candidates do to portray their skills and knowledge if they don't necessarily have certifications or an educational background I mean at least when I was in Europe there wasn't a secretary was having some level of IT background if he had summer internships that's great but it was really because they're young because they're at a high school it was just about having the desire to learn and and work hard I mean I don't you know after college yes there there are probably some stricter guidelines around what a candidate should display from a qualities perspective but right out of high school it was just you know this is the salary we're offering they were on banned levels in Europe and if you can come in and help support this function at an analyst level will train you and then you would upscale they've learned and they'd evolved and then take on more senior roles in cybersecurity department yeah and just just add a little bit in regards to that most schools today offer some sort of programming you know at the high school level even or online I think if someone's really wants to do this and the interested in this I would build a portfolio based on look you know I understand I'm a high school graduate but you know what I took this online class that's you know to taught me about these aspects of programming so I understand the concept that we're dealing with here in regards to an application application for example or at least understand how an application works or the other thing as we talked about is and this is not on the individuals own offices its corporate America is that we've got to do a better job and interns how do we build interns yeah how do we train interns I guess I think earlier was common about you know taking them to coffee or having them do coffee in paperwork well no no that we need to do a better job about giving real valuable skills to people as they come on board this is one area where I think government actually has a bigger part to play actually because if you look in Germany that's been a year in Germany just recently and they do a very good job in regards to I'm generally not big athlete of government involvement but this is one case where I think government incentives actually work okay a quick story I've got a student not at Thomas Edison but at my Community College it's taking a course that prepares for security plus and part of my feedback to him has been you're not writing clearly in terms of what you're doing he wants to dive in do all these practice exploits and everything else and I give him feedback on his writing and presentation of his results and he sort of surfaced this notion of what is this an English course but not to pick on a student but I think it shows especially if you start going back into high school where people may have the inclination and the skills to do the technical side but they may not appreciate what's necessary from a presentation and a packaging point of view and developing some of their their business skills as well so I just want to thank our panel so we can move on with the program [Applause]