Tribe of Hackers Security Leaders: Tribal Knowledge from the Best in Cybersecurity Leadership - podcast episode cover

Tribe of Hackers Security Leaders: Tribal Knowledge from the Best in Cybersecurity Leadership

Mar 27, 202537 min
--:--
--:--
Download Metacast podcast app
Listen to this episode in Metacast mobile app
Don't just listen to podcasts. Learn from them with transcripts, summaries, and chapters for every episode. Skim, search, and bookmark insights. Learn more

Episode description

This Book is an excerpt from Tribe of Hackers: Security Leaders, a book offering cybersecurity leadership strategies. The excerpt features interviews with numerous cybersecurity professionals, who share their experiences, decision-making processes, and advice on leading teams. The contributors discuss challenges like collaborating with other departments, managing difficult decisions, and building effective teams. Many also offer book recommendations for aspiring cybersecurity leaders, covering topics such as leadership, risk management, and technical skills. The overall theme emphasizes the importance of strategic thinking, strong communication, and building collaborative relationships to succeed in cybersecurity leadership.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cyber_security_summary

Get the Book now from Amazon:
https://www.amazon.com/Tribe-Hackers-Security-Leaders-Cybersecurity/dp/1119643775?&linkCode=ll1&tag=cvthunderx-20&linkId=d8af4f7341873775532622bd65b4ab4e&language=en_US&ref_=as_li_ss_tl




Discover our free courses in tech and cybersecurity, Start learning today:
https://linktr.ee/cybercode_academy

Transcript

Speaker 1

Hey, everyone, welcome back for another deep dive.

Speaker 2

Yes, welcome back.

Speaker 1

This time we're digging into tribe of hackers security leaders. Oooh yes, you know, I think everyone kind of gets by on the technical skills, but like actually leaving a team, yeah, and you know, making the tough calls.

Speaker 2

It's a different beast.

Speaker 1

Yeah.

Speaker 2

In this cybersecurity world is like a whole other.

Speaker 1

Absolutely, a whole other level.

Speaker 2

Yeah.

Speaker 1

And what I think is so interesting about this book in particular is that, you know, it's not just a technical how to manual r you know, it's really a collection of interviews with a whole bunch of different cybersecurity leaders and they share their strategic thinking and their war stories, you know, kind of their lessons learned along the way.

Speaker 2

I love it because it's like we're getting a peak behind the curtain exactly to see how their minds work. Yes, and you know, it makes this deep dive so valuable. And it's not just theory. It's like real world oil world wisdom from these people who've been in the trench, been they've done that exactly. So let's jump into that first big takeaway that really stood out to me. This

idea of the evolving cybersecurity landscape. I mean, we hear all the time about how things are changing so rapidly constantly, but what does that mean, Like, what does that actually mean for security leaders?

Speaker 1

Yeah, it's a great question. And you know, one of the most thought provoking ideas I think comes from James Arln, who leads salesforce for Roku's production engineering team. Okay, and he argues that cybersecurity should be everybody's responsibility, okay, woven into every role, not just siloed within the security team.

Speaker 2

Yeah. That's a big shift from how most companies operate today.

Speaker 1

Huge And he even compares it to this idea of a chief electrification officer, which you know, that role essentially disappeared as electricity became commonplace. He's asking like, is cybersecurity headed in the same direction.

Speaker 2

So he's saying, like, could we get to a point where you don't need a specialist.

Speaker 1

Potentially yeah, to like, you know, handle every single security issue.

Speaker 2

Imagine if you didn't need, you know, a specialized electrician to change a light bulb. Could we reach a point where you don't need a dedicated team yeah, to handle every security issue.

Speaker 1

It's a really compelling idea. But it's also a little daunting, Yeah, a little bit like how do you even implement that? Like distributed responsibility?

Speaker 2

Well, and he suggests that this model could lead to greater accountability. Okay, if everyone has skin in the game, so to speak, when it comes to security, then they're more likely to take it seriously.

Speaker 1

Right, But it also means like a huge cultural shift. Oh absolutely, because right now most companies have these dedicated security teams. Would those just become obsolete.

Speaker 2

You know, not necessarily obsolete, but their roles might evolve. Okay, they could become more focused on oversight and compliance, ensuring that everyone's meeting their security responsibilities right, rather than handling all the technical tasks themselves.

Speaker 1

So it's almost like they become a coach instead of a player.

Speaker 2

Yeah. Think of it as a coach who empowers their team to succeed, rather than a player who does everything themselves.

Speaker 1

Right. It's empowering every single person to be a security advocate, absolutely relying on just this small group.

Speaker 2

Yeah, and this actually brings up another challenge that these leaders discuss, this idea of decision making under pressure. You know, you're constantly facing these high stake situations where you need to balance risk and business needs in human factors. So how do they approach that?

Speaker 1

Yeah, any practical advice we can get from their experience.

Speaker 2

There's some really great advice, and you can apply this to your own work. Andrew Bagrin, the founder of omninet. He gives you a framework for making those tough calls, but the business and your team's needs first, especially when it comes to personnel decisions.

Speaker 1

So that's interesting because it's saying, sometimes the technically right answer yeah, might not be the best for the organize.

Speaker 2

It might not be or even the people. Exactly. And you know Christopher Caruso who has extensive experience in both IT and OT cybersecurity. Now, what's ot OT is operational technology and it refers to the systems that control physical processes. Okay, so he adds another crucial element, understanding your audience.

Speaker 1

So it's not just about being right, it's about being persuasive.

Speaker 2

Yes, exactly. So when you're presenting security recommendations to leadership, you need to be factual, confident, and most importantly, understand the board's perspective.

Speaker 1

Okay, So you're saying, like you've got align your recommendations online with their priorities that makes a lot of sense, but it's not always black and white. Sometimes you have to make these judgment calls where there's no easy answer.

Speaker 2

Absolutely, and another leader, Rafel Loss Okay, talks about this delicate balance between data driven analysis and gut feeling.

Speaker 1

So you're saying, it's not just the hold hard data, not just the data, it's also like trusting your instincts.

Speaker 2

Yes, he emphasizes combining data with your intuition.

Speaker 1

Okay, and your passion. That makes sense because cybersecurity you're always dealing with the unknown you are and making decisions when you're not really sure what's going to happen next. So you've got this framework for decision making, but then you need.

Speaker 2

The right team absolutely.

Speaker 1

To help you execute those decisions for sure. What insights does the book offer on building and leading these high performing security teams.

Speaker 2

There's a lot of great advice, but Leslie Carhart, principal threat analyst at Dragos, really hit the nail on the head with her emphasis on team well being. She says that good leaders shield their teams from negativity and create a supportive environment where everyone can thrive.

Speaker 1

You know, that's so important, especially in cybersecurity, because burnout is such a real issue. It is how do you actually do that? How do you create this positive environment without ignoring the real concerns.

Speaker 2

It's a tough one. It is a delicate balance. You don't want to create this culture of toxic positivity where people are afraid to speak up, but at the same time, you don't want to overwhelm your team with negativity. It's about finding that balance, acknowledging the challenges but also focusing on the solutions and celebrating the successes.

Speaker 1

So it's that psychological safety where people feel like they can speak up exactly without being you know, or shut down exactly.

Speaker 2

Yeah. And there's another leader, David Evenden, founder of Standard User Cybersecurity okay, and he talks about evolving from a more assertive leadership style okay, to a more empathetic approach okay, really focused on teen growth and satting clear expectations.

Speaker 1

So it's about adapting, adapting your leadership style to fit the needs of your team and this ever changing security landscape.

Speaker 2

So not being stuck in your waist right.

Speaker 1

Not just doing it because that's how you've always done it. And Charles Mowatu, an engineering manager at Netflix, adds that transparency and vulnerability and creating a supportive environment for growth are really crucial for building that trust for sure, and empowering your team.

Speaker 2

Absolutely. I love that he emphasizes vulnerability. Yeah, it's so important for leaders to show that they're human too, and that they're not afraid to ask for help or admit when they don't have all the answers.

Speaker 1

Right. It creates a culture where everyone feels safe to take risks and learn from mistakes.

Speaker 2

Absolutely, And speaking of learning, the book also delves into the cybersecurity skills gap. Oh yeah, which is a huge topic.

Speaker 1

Yeah, that's a big one. It is what concrete solutions did these leaders offer.

Speaker 2

There's a little bit of debate, okay about the nature of the gap.

Speaker 1

Okay.

Speaker 2

Andrew Bagrin argues that there's no shortage of you and your talent, but a lack of experience senior professionals.

Speaker 1

So it's not just about getting people in. Not just getting them in, it's about helping them move up.

Speaker 2

Helping them get to that senior level.

Speaker 1

Yeah, and that seems to be a common theme, is that development and mentorship are really key to addressing this.

Speaker 2

Absolutely. Steve Christy Coley principal INFOSEC engineer at my tr Okay, he stresses the need for the industry to invest in training okay, and support for less experienced individuals, basically saying, we can't just expect these season pros to magically appear. We need to create opportunities for mentorship, training, and career advancement.

Speaker 1

You Know, it's interesting because sometimes these job descriptions for cybersecurity roles want people to be unicorns, they do. They want them to have all this experiences of experience in every single technology.

Speaker 2

Right, and that's something that Steven A. Ridley, a cybersecurity consultant Okay, he criticizes this.

Speaker 1

Okay.

Speaker 2

He highlights the importance of giving young professionals a chance and challenging those unrealistic expectations and requirements often found in those job.

Speaker 1

Descriptions because it can be really discouraging, I bet very discouraging for someone new.

Speaker 2

Yes, so there needs to be a mindset shift, Okay, not just focusing on years of experience, but looking at potential and aptitude.

Speaker 1

So focusing on those qualities and recognizing that raw talent can be nurtured.

Speaker 2

Absolutely, and they also emphasize the importance of providing opportunities for mentorship where experience professionals can guide and support those who are just starting out.

Speaker 1

Mentorship is so crucial, it is. It's passing on knowledge, building confidence, creating a sense of community.

Speaker 2

Absolutely, But it's not just about developing individual skills. There's also a strong emphasis on collaboration and communication.

Speaker 1

Because cybersecurity can't operate in a silo, no, it can't. Leaders need to break down these barriers, build relationships with other teams, from executives to developers.

Speaker 2

Absolutely, and that starts with communication.

Speaker 1

So how do they suggest we go about building these bridges?

Speaker 2

You know? Edward Prevostky, staff security engineer at Squarespace, has a great reframing. He suggests that infosec should transition from a no team oh to a collaborative partner.

Speaker 1

So instead of shutting down ideas, security teams should be offering solutions, offering solutions, working together, working together to achieve those shared goals exactly.

Speaker 2

He talks about clearly defining risk, appetite and offering options rather than just saying no outright.

Speaker 1

That's so important. It is because if security is seen as a roadblock, people are going to find ways to go around it. They will, but if they see it as a partner, then they can work together.

Speaker 2

To find secure solutions.

Speaker 1

But that requires a high level of communication and trust.

Speaker 2

It does, absolutely, and Christopher Adneck, founder of Social engine Near LLC, really hits on this point. He emphasizes transparency, frequent communication, and creating a culture of trust okay. He believes that when everyone's on the same page right and feels comfortable sharing information, that's when it's easiest to identify right and address security risks.

Speaker 1

So it's building those relationships, creating that environment where people feel safe speaking up exactly.

Speaker 2

And Charles Watu, who we mentioned earlier, adds that top down security awareness okay, embedded in the company culture is essential. He also stresses the importance of building relationships with engineering teams working collaboratively to integrate security into the development process.

Speaker 1

It makes sense when you put it that way.

Speaker 2

It does.

Speaker 1

Security is just an afterthought. It's always going to be playing catch up, absolutely, but if it's baked into the culture from the top down, it becomes part of everyone's mindset.

Speaker 2

Exactly.

Speaker 1

So we've covered a lot here, But did these leaders offer any reading recommendations?

Speaker 2

Oh? Yeah, they did. For aspiring cybersecurity pros who want to level up their leadership skills, Yeah, they did. They offered a really diverse range of bucks, catering to different leadership styles and interests.

Speaker 1

So like, what kind of stuff? Well?

Speaker 2

Some were business and leadership classics Good to Great by Jim Collins. Okay, yeah, what got you here? Won't Get You There by Marshall Goldsmith, and The Hard Thing About Hard Things by Ben Horowitz.

Speaker 1

Those are all fantastic books. They are with timeless advice on building strong teams, making tough decisions, navigating the challenges of leadership.

Speaker 2

Yeah, regardless of your industry.

Speaker 1

What about books specifically focused on cybersecurity?

Speaker 2

Of course?

Speaker 1

What did they say?

Speaker 2

Some popular choices were Tribe of Hackers, Naturally, Security Metrics Replacing Fear, Uncertainty, and Doubt by Andrew Jackwith, and Applied Cryptography by Bruce Schneier.

Speaker 1

Those are must reads for anyone serious about cybersecurity for sure. What about books on communication, teamwork, and decision making skills that are essential for any good leader?

Speaker 2

They covered those two Team of Teams by General Stanley McCrystal, Death by Meeting by Patrick Lincioni, Radical Candor by Kim Scott.

Speaker 1

Wow, that is quite the list, the reading list. This could keep me busy for a while. You know, it's inspiring to see how these leaders are not just experts in their field, but also well rounded individuals. Yes, who value continuous learning and personal growth, for sure. But I'm also curious what keeps them up at night?

Speaker 2

Oh, good question.

Speaker 1

What are their biggest concerns? Yeah, when it comes to cybersecurity.

Speaker 2

Well, you're right, these leaders are incredibly knowledgeable and passionate. Yeah, but they're also realistic about the challenges we face in cybersecurity.

Speaker 1

Yeah.

Speaker 2

One recurring theme is this constantly evolving threat landscape. They're keenly aware of new vulnerabilities, sophisticated attack techniques. It's relentless, relentless pressure to stay ahead of the bad guys.

Speaker 1

Like these sentinels, always on watch, yes, for the next big attack.

Speaker 2

That's a good way to put it. It's a lot of responsibility, it is, and that actually ties into another major concern they share, the talent shortage we talked about earlier. You know, it's a constant struggle to find and keep skilled cybersecurity professionals, especially those with experience and leadership potential. Yeah. The competition for talent is fierce and it's only getting tougher.

Speaker 1

And then on top of that you add the rapid pace of technological change. Absolutely new technologies emerging constantly, which brings opportunities, yes, but also new security risks so many it's like this never ending game of cat and mouse.

Speaker 2

I like that analogy. Yeah, that's a good way to put it. You're constantly trying to secure new systems and applications while also dealing with legacy technologies that might be riddled with vulnerabilities.

Speaker 1

Yeah, and let's not forget the growing complexity of IT environments. As organizations adopt cloud computing, right, mobile devices, the Internet of Things, It's expanded tack surface is just.

Speaker 2

It's getting bigger and bigger. It's like trying to build a fortress with walls that are constantly shifting and expand how do.

Speaker 1

You even begin to defend something like that?

Speaker 2

That is the million dollar question. Yeah, that's the challenge these leaders grapple with every day.

Speaker 1

Yeah, and of course you can't forget about the human element, the human elament. Even with the best technologies and processes in place, human error is.

Speaker 2

Still it's still a major risk.

Speaker 1

Yeah, A single phishing email, or a weak password, or just a careless mistake.

Speaker 2

One wrong click can open the door to a devastating attack.

Speaker 1

It's like, you can have all the fancy tools and technologies in the world, but ultimately security comes down to people.

Speaker 2

It really does.

Speaker 1

Yeah, leaders understand that.

Speaker 2

They do.

Speaker 1

They worry about the impact of a successful attack on their organization's reputation, romance's customer trust.

Speaker 2

It's a heavy burden to carry, it is, for sure.

Speaker 1

So given all of these challenges, the book also asked these leaders what they would change about cybersecurity leadership if they had a magic.

Speaker 2

Wand a magic wand I love it.

Speaker 1

What did they say?

Speaker 2

What are their big dreams for the future For the future of cybersecurity leadership? Well, one common theme was this desire for greater alignment between security and business goals. You know, they want to move away from security being seen as a roadblock and instead be viewed as a strategic partner that helps enable business growth and innovation.

Speaker 1

Which makes sense because if it's just seen as a cost center or like a compliance burden, it's always going to be an uphill battle.

Speaker 2

It is, But if it's viewed as a key enabler it becomes a real competitive advantage exactly. Leaders also expressed a desire for a more proactive and preventative approach okay to cybersecurity.

Speaker 1

So instead of always putting out fires, yes.

Speaker 2

Moving away from that reactive firefighting mentality that's so prevalent in the.

Speaker 1

Industry, They want to prevent the fires from starting in.

Speaker 2

The first place, absolutely, and they recognize that this requires a different mindset, different skills, different investment. Another wish was for greater investment in security awareness and training. They envision a world where everyone in the organization, from the CEO to the newest intern, understands their role in protecting the organization.

Speaker 1

So creating a culture of security.

Speaker 2

Yes, where it's not just the security team's job, but everyone's responsibility.

Speaker 1

To be vigilant absolutely, and to understand.

Speaker 2

The risks yes, and how to mitigate them.

Speaker 1

There is also a strong desire for greater diversity and inclusion in the workforce.

Speaker 2

Yes. Many leaders recognize that we need to attract and reat talent from a wider range of backgrounds and experiences.

Speaker 1

Diversity of thought is so crucial.

Speaker 2

Yes, especially in cybersecurity, where you're constantly facing new threats, new challenges.

Speaker 1

Having those different perspectives can only make you stronger.

Speaker 2

Absolutely. And finally, some leaders expressed a desire for a future where cybersecurity is simply baked in to every aspect of technology.

Speaker 1

So you're saying like they envision a world where security.

Speaker 2

Is just an integral yeah, of the design and development process.

Speaker 1

Not just an afterthought, but a bold on solution. So making security a fundamental principle, yes, that guides every aspect of our digital lives, just like.

Speaker 2

Safety is a fundamental principle right in the physical world.

Speaker 1

So these magic wand wishes, Yeah, they really paint a picture, they do, of where these leaders see cybersecurity heading. Absolutely, But what about concrete advice? Yeah, for these aspiring leader what do they suggest for those who are looking to step into leadership roles in cybersecurity?

Speaker 2

Will they emphasize a lot of the themes we've already discussed, continuous learning, staying ahead of the curve in this rapidly evolving field, developing both technical skills and leadership qualities.

Speaker 1

So it's not enough to be the tech expert. You also have to be able to lead people, communicate effectively, and make those strategic decisions.

Speaker 2

And they highlight the importance of building relationships, networking with other professionals, seeking out mentors who can guide and support you.

Speaker 1

Mentorship is so valuable, absolutely, especially in a field like this.

Speaker 2

Or experience is often hard one. Having someone to bounce ideas off of, ask for advice, Yeah, learn from their mistakes.

Speaker 1

It's invaluable, it is. Yeah. They encourage these aspiring leaders to develop their communication skills sure, learning to explain those complex technical concepts in a way that resonates with different audiences executtives to developers.

Speaker 2

Absolutely, that's crucial. And as a leader, you're always going to be communicating, whether it's presenting to the board, explaining a security incident to your team, advocating for resources.

Speaker 1

It's a big part of the job.

Speaker 2

It is. And finally, these leaders urge you to embrace the challenge of cybersecurity, to see it not just as a job, but as a mission to protect organizations, communities, our digital lives.

Speaker 1

To find meaning and purpose in your work, knowing that you're making a real difference.

Speaker 2

And inspiring others to join you in that mission to build a more secure and resilient digital future for everyone.

Speaker 1

I love that.

Speaker 2

It's a great mission.

Speaker 1

This has been a fantastic deep dive. I feel like I've learned so much from hearing these leaders insights and perspectives. It's really inspiring to see their passion and their commitment to excellence, and just their unwavering belief in the importance of their work.

Speaker 2

And what's so great about Tribe of Hackers Security Leaders is that it goes beyond those technical aspects of cybersecurity and it really explores that human side of leadership. It gives you a glimpse into the challenges I triumphs, the wisdom these leaders have gained from years of experience.

Speaker 1

It reminds you that behind every successful cybersecurity program, Yeah, there's this team of dedicated and passionate individuals committed to protecting their organizations and the people they serve.

Speaker 2

And this deep dive has been a call to action. Embrace the challenge, develop your skills, build relationships, strive to become the leaders the world needs in this ever evolving field.

Speaker 1

Well said, So, if you're ready to dive deeper into these ideas and learn from the best, yeah, I highly recommend checking out Tribe of Hackers Security Leaders.

Speaker 2

It's a treasure trove of insights and inspiration it is for anyone who aspires to a leadership role right in this exciting and challenging field.

Speaker 1

Yeah, and as you continue on your own leadership journey, remember the advice of these incredible leaders. Stay curious, stay adaptable, say connected, and never stop learning.

Speaker 2

The future of cybersecurity depends on it.

Speaker 1

Well said, Thanks for joining us on this deep dive. Yes, thank Until next time, stay safe, stay secure, keep on learning.

Speaker 2

Absolutely. Yeah, it's cuff. You don't want to, you know, create that culture of toxic positivity where people are afraid to raise concerns, but you also don't want to overwhelm people with negativity. It's finding that balance, acknowledging those challenges, focusing on the solutions, and celebrating the successes.

Speaker 1

That makes a lot of sense. It's about creating that sense of psychological safety where they feel like they can speak up absolutely without fear of being.

Speaker 2

Punished, punished or shut down.

Speaker 1

Yeah, exactly. And there's another fascinating leadership journey shared by David Evenden, founder of Standard User's Cybersecurity, and he talks about, you know, evolving from a more assertive leadership style to a more empathetic approach, you know, focused on team growth and clear expectations. So adapting, adapting your leadership style, yes, to fit the needs of the team.

Speaker 2

To fit the needs and the ever changing landscape.

Speaker 1

Right, and not just being stuck in your ways because that's how it's always been.

Speaker 2

Done, exactly. And Charles and Watouka, an engineering manager at Netflix, adds that transparency, vulnerability, and creating that supportive environment for growth are crucial for building trust and empowering the team.

Speaker 1

You know, I love that he emphasizes vulnerability. Yes, it's so important for leaders to show that they're human, it is, and that they don't have all the answers.

Speaker 2

Yeah, and that it's okay to ask for help, right.

Speaker 1

And it creates that culture where everyone feels safe to take risks exactly and learn from mistakes.

Speaker 2

And learn from their stakes. Absolutely. And speaking of learning, the book also delves into the cybersecurity skills gap.

Speaker 1

Oh, the skills gap, Yeah.

Speaker 2

Which is a topic that's hey top of mind for a lot of these leaders.

Speaker 1

It feels like everybody's talking about the skills gap. But what concrete solutions did these leaders offer.

Speaker 2

Well, there's a little bit of a debate, I would say, about the nature of the gap. Andrew Bagrin argues that there's no shortage of junior talent, okay, but a lack of experienced senior professionals.

Speaker 1

Right. So it's not just about getting people in, not just getting them in, it's about providing those pathways for them to move up exactly.

Speaker 2

Moving up to those senior roles.

Speaker 1

And that seems to be a common theme. It is this idea that development and mentorship are key to addressing this.

Speaker 2

Yes, absolutely. Steve Christy Coley, principle INFOSEC engineer at ITIRE, he stresses the need for the industry to invest in training and support, okay for less experienced individuals. Right. He's saying, you know, we can't expect season pros to just magically appear. We need to create those opportunities for mentorship, training, career advancement.

Speaker 1

You know, sometimes it feels like these job descriptions for cybersecurity roles, they want people to be unicorns. They want them to have all of this experience in every single technology, years and years of experience, and it can be really discouraging, oh yeah, for newcomers, very discouraging for someone new to even try to get into the field exactly.

Speaker 2

And that's something that Stephen A. Ridley, a cybersecurity consultant, criticizes. He highlights the importance of giving young professionals a chance and challenging those unrealistic expectations that are often found in those job descriptions. You know, those expectations can really discourage newcomers from even entering the field.

Speaker 1

So it sounds like there needs to be this mindset shift. Yes, not just focusing on years of experience, but really looking at potential.

Speaker 2

Pidental and aptitude.

Speaker 1

Aptitude and recognizing that raw talent can be developed.

Speaker 2

Absolutely, and many of the leaders advocate for changes in hiring practices, Okay, focusing more of those qualities, recognizing that raw talent can be nurtured and developed into cybersecurity expertise. They also emphasize the importance of providing opportunities for mentorship where experienced professionals can guide and support.

Speaker 1

It's so important.

Speaker 2

It's about passing on that knowledge, right, building confidence, creating a sense of community, And it's not.

Speaker 1

Just about developing those individual skills right. There's also this emphasis on collaboration and communication.

Speaker 2

Yes, cybersecurity can operate an asylum.

Speaker 1

Leaders need to break down those barriers and build relationships with all the different teams from executives, executives, developers, legal, everybody, everyone, and that all starts with communication.

Speaker 2

It does.

Speaker 1

So how do they suggest we build these bridges?

Speaker 2

Well. Edward Prevost, a staff security engineer at Squarespace, has a great reframing. He suggests that infosec should transition from a no team to a collaborative partner.

Speaker 1

I like that.

Speaker 2

Yeah. Instead of just shutting down ideas, security team should be offering solutions, working with other teams to achieve those shared goals.

Speaker 1

So they're not just a roadblock exactly, They're a partner in the process.

Speaker 2

They are a partner. He talks about clearly defining risk, appetite and offering options rather than just saying no outright.

Speaker 1

Which is so important because if they are seen as a roadblock, yes, people are going to find ways to go around they wis security.

Speaker 2

Yeah, you can't stop progress, you can't.

Speaker 1

And if they see security as a partner, then they can work together to find those secure solutions.

Speaker 2

To find secure solutions exactly.

Speaker 1

But that requires a high level of communication and trust.

Speaker 2

It does, absolutely, and Christopher Hadnaggi, the founder of Social Engineer LLC, really hits on this point Okay. He emphasizes transperncy, frequent communication, and creating that culture of trust okay, he believes it. You know, when everyone's on the same page right and feels comfortable sharing information, that's when it's easiest to identify and address those security risks to.

Speaker 1

Building those relationships, creating that environment where people feel safe speaking up exactly.

Speaker 2

And Charles Nawatu, who we mentioned earlier, yea as that top down security awareness embedded in the company culture is essential.

Speaker 1

Okay.

Speaker 2

He also stresses the importance of building relationships with engineering teams working collaboratively to integrate security into that development process.

Speaker 1

It makes so much sense, he does, when you put it that way. If security is just an afterthought, it's always going to be playing catch up. Absolutely, But if it's baked into the culture from the top down, it becomes part of everybody's mindset.

Speaker 2

Exactly.

Speaker 1

So we've covered a lot, but I'm curious, did these leaders offer any reading recommendation.

Speaker 2

They did okay for aspiring cybersecurity pros who want to level up their leadership skills. Yeah. They offered a really diverse range of books, okay, catering to different leadership styles and interests.

Speaker 1

Okay, like what kind of stuff?

Speaker 2

Well, some were business and leadership classics. Okay, you know, like Good to Great by Jim Collins, What Got You Here, Won't Get You There by Marshall Goldsmith, The Hard Thing About Hard Things by Ben Horowitz.

Speaker 1

Those are amazing books.

Speaker 2

They are.

Speaker 1

They really offer timeless wisdom on building strong teams, making those tough decisions, navigating the challenges of leadership.

Speaker 2

Regardless of your industry.

Speaker 1

Yeah. What about books specifically focused on cybersecurity?

Speaker 2

Of course did they recommend Some of the popular choices were Tribe of Packers, Naturally, Security Metrics Replacing Fear, Uncertainty, and Doubt by Andrew Jaquith. Okay, Applied Cryptography by Bruce Schneier.

Speaker 1

Those are must reads for anyone serious about cybersecurity.

Speaker 2

Absolutely.

Speaker 1

What about books on communication, teamwork, decision making, you know, skills that are essential for effective leadership?

Speaker 2

Oh, they covered those two?

Speaker 1

Okay, what did they say?

Speaker 2

So? Some of their recommendations included Team of Teams by General Stanley McCrystal. Okay, Death by Meeting by Patrick LENCIONI. Yeah, Radical Candor by Kim Scott.

Speaker 1

Wow. What a treasure trove of reading material.

Speaker 2

It is quite the list.

Speaker 1

It's going to keep me busy for a while, it will. You know. It's inspiring to see how these leaders are not just experts in their field, but they're also really well rounded individuals. Yes, who value continuous learning and personal growth.

Speaker 2

You do.

Speaker 1

But I'm also curious what keeps them up at night?

Speaker 2

Oh that's a great question.

Speaker 1

What are their biggest concerns when it comes to cybersecurity?

Speaker 2

Yeah they are, and they worry about the potential impact of a successful attack, you know, on their organization's reputation, finances, and customer trust.

Speaker 1

Yeah. It's a heavy burden.

Speaker 2

It is very yeah, for sure. So given all these challenges, the book also asked these leaders what they would change about cybersecurity leadership. Oh. Interesting, if they had a magic wand a magic wand what would they change? I like it. What are their big dreams for the future of cybersecurity leadership? Yeah?

Speaker 1

What did they say?

Speaker 2

Well, a common theme was this desire for greater alignment, okay, between security and business goals. You know, they want to move away from security being seen as just a roadblock and instead be viewed as a strategic partner. Yeah, that helps enable business growth and innovation.

Speaker 1

Makes sense because if security is just seen as a cost center or a compliance burden, it's always going to be an uphill battle.

Speaker 2

It's always going to be a struggle.

Speaker 1

To get the resources and the buy in that you need exactly.

Speaker 2

But if it's viewed as a key enablers, then it becomes a competitive advantage. Several leaders also expressed a desire for a more proactive and preventative approach to cybersecurity.

Speaker 1

So instead of all always putting out those fires.

Speaker 2

Moving away from that reactive firefighting mentality that we see so much of in the industry.

Speaker 1

So they want to prevent the fires from even starting.

Speaker 2

Absolutely, and they recognize that this requires a different mindset, different skills, and different investments.

Speaker 1

Makes sense.

Speaker 2

Another wish was for a greater investment in security awareness and training. You know, they envision a world where everyone in the organization, from the CEO to the newest intern, understands their role in protecting the organization.

Speaker 1

Wow. So it's really about creating that culture of security.

Speaker 2

Yes, where it's not just the security team's job, but everyone's responsibility to be vigilant and aware.

Speaker 1

And to understand the risks and how to mitigate them.

Speaker 2

Absolutely. Yeah, there was also a strong desire for greater diversity and inclusion in the cybersecurity workforce. Yeah, many leaders recognize that we need to attract and retain talent from a wider range of backgrounds and experiences.

Speaker 1

Diversity of thought is so important.

Speaker 2

It is especially in cybersecurity.

Speaker 1

Especially in this field where.

Speaker 2

You're constantly facing new threats and new challenges.

Speaker 1

Right, having those different perspectives and different approaches can only.

Speaker 2

Make you stronger, exactly. And finally, some leaders expressed a desire for a future where cybersecurity is simply baked in, okay, to every aspect of technology.

Speaker 1

So you're saying they envision a world where security is just an integral part, a fundamental part of the design and development process.

Speaker 2

Yes, not an afterthought, not a bolt on solution.

Speaker 1

Right, making it a fundamental principle that guides every aspect of our digital.

Speaker 2

Lives, just like safety is a fundamental principle in the physical world.

Speaker 1

So these magic wand wishes, they really paint a picture, they do, of where these leaders see cybersecurity. Heading they do, But what about concrete advice for aspiring leaders?

Speaker 2

That's a good question.

Speaker 1

What do they suggest for those who are looking to step into leadership roles in cybersecurity.

Speaker 2

Well, they emphasize a lot of the things that we've already talked about, continuous learning, staying ahead of the curve in this rapidly evolving field, developing both technical skills and leadership qualities.

Speaker 1

So you're saying it's not enough to just be a technical expert, No, you also need to be able to lead people, communicate effectively, and make those strategic decisions.

Speaker 2

They also highlight the importance of building relationships, networking with other professionals, and seeking out mentors who can guide and support you.

Speaker 1

Mentorship is so valuable. It is especially in a field like cybersecurity, where that experience is so hard.

Speaker 2

One exactly having someone to bounce ideas off of, to ask for advice, to learn from their mistakes, it's invaluable.

Speaker 1

And they encourage aspiring leaders to develop those strong communication skills, yes, you know, learning to explain those complex technical concepts in a way that resonates with different audiences from executives to developers.

Speaker 2

Absolutely, you know, as a leader, you're always going to be communicating in some way, whether it's presenting to the board, explaining a security incident your team, or advocating for resources.

Speaker 1

It's a big part of the job, it is.

Speaker 2

And finally, these leaders urge you to embrace the challenge of cybersecurity, okay, to see it not just as a job, but as a mission. Okay, to protect organizations, communities, our digital lives.

Speaker 1

To find meaning and purpose in the work that you do.

Speaker 2

Yes, knowing that you're making a real difference in a world that's increasingly reliant on technology.

Speaker 1

And inspiring others to join you in that mission.

Speaker 2

Absolutely, to build a more secure and resilient digital future for everyone.

Speaker 1

Wow, this has been a fantastic deep dive.

Speaker 2

It has.

Speaker 1

I feel like I've gained so much from hearing these leaders insights and perspectives. It's really inspiring to see their passion, their commitment to excellence, and their unwavering belief in the importance of their work.

Speaker 2

And what's so great about Tribe of Hackers Security Leaders is that it goes beyond just the technical aspects of cybersecurity, and it really explores that human side of leadership. You know, it gives you a glimpse into the challenges, the triumphs, and the wisdom these leaders have gained from year's experience.

Speaker 1

It really reminds you that behind every successful cybersecurity program, there's a team of dedicated and passionate individuals absolutely who are committed to protecting their organizations and the people they serve.

Speaker 2

And this deep dive has been a call to action, Yes, it has. Embrace the challenge, develop your skills, build relationships, and strive to become the leaders the world needs in this critical and ever evolving field.

Speaker 1

Well said, So, if you're ready to dive deeper into these ideas and learn from the best, I highly recommend checking out tribe of hackers security leaders. It's a treasure trove of insights and inspiration for anyone who aspires to a leadership role in this exciting and challenging field.

Speaker 2

And as you continue on your own leadership journey, remember the advice of these incredible leaders. Stay curious, stay adaptable, stay connected, and never stop learning. The future of cybersecurity depends on it.

Speaker 1

Well said, Thanks for joining us for this deep dive. Until next time, stay safe, stay secure, and keep on learning.

Transcript source: Provided by creator in RSS feed: download file
For the best experience, listen in Metacast app for iOS or Android