The 10 Most Influential CISOs to Watch in 2021

ISSN 2582-127X

September 2021

T H E

MOST INFLUENTIAL

CISOs TO WATCH IN

2021

Key Focus Areas for CISOs to Watch Out for 2021

New Roles and Opportunities for CISOs

CISO of Boston Consulting Group

MARK CONNELLY Leading Teams to Assist Transformations on a Global Scale

EDITORIAL Protection of Information Security Paints the Future of Modern Organizations

T

he pandemic has emphasized the need for cloud readiness and digital modernization among the

business leaders of today. This new normal post-

pandemic is driving organizations to make decisions

digital transformation CISO who will be responsible for driving cybersecurity by integrating into DX initiatives in all aspects of IT technology especially when coming to public cloud computing.

faster while maintaining business continuity and ensuring data security. The growing remote work and cloud adoption now bring the Chief Information Security Officer's (CISOs) to ensure protection against the drastic change supporting the digital transformation (DX) and c l o u d c o m p u t i n g i n i t i a t i v e s . Te c h n o l o g i c a l advancements are providing new opportunities for collaboration between IT and business. As businesses start to grow after the pandemic it is up to the CISO's to make sure that a strong business foundation is built for the markets and companies to sail across these shifts.

CISO's Role in Combating Cyber Risks There is a need for CISO's to work continuously along with the LoB leaders to align business processes to cloud computing, explaining and identifying the shadow IT applications. And because of the high demand most of the companies have hired and are planning to hire a CISO with greater cloud computing skills and another 53% have employed or are planning to hire a business information security officer (BISO) to work with LoB managers ensuring the safe business processes.

The CISO's are responsible for selecting, deploying, and

Cloud Adoption to Meet Demands Most of the businesses are shifting towards digitalization and this, in turn, created a demand for cloud adoption thereby raising the cloud spending by 37% to $29 billion in the first half of 2020. And these technological shifts are going to stay in the market expanding new opportunities. But as work becomes more decentralized there also increases the diligence to maintain cyber hygiene by monitoring the threats since organizations are reporting a 47% increase in cyberattacks.

The increase in cloud services demands a cybersecurityfilled culture that can be beneficial in terms of taking care of the risks. This is why most of the CISO's are moving towards a business focus to ensure the execution of new digital initiatives. The new normal has paved a way for a

operating the necessary security controls that can enable the business while noting the cyber risks. The main challenge here is to enable an integrated and cohesive security strategy across the technology portfolio. These executives need to rationalize and transform the cloud ecosystems into an integrated and scalable security stack at the same time meeting divergent business requirements. And this requires a high-performance data pipeline for stream and batch data processing, API integration between tools, and to process automation for immediate incident response and risk mitigation. Businesses need to inculcate a culture of security first to find the right balance between enabling the use of cloud services and safeguarding sensitive transactions and data.

CREDITS Ashish Sukhadeve

Adilin Beatrice

Editor-in-Chief

Senior Analyst

Apoorva Komarraju

Priya Dialani

Senior Analyst

Senior Editor

Disha Sinha

Satavisa Pati

Content Analyst

Content Analyst

Sayantani Sanyal

Aratrika Dutta

Content Analyst

Content Analyst

Shivani Muthyala

Nikita Das

Content Analyst

Marke ng Manager

Soniya Raghav

Dharmendar Passi

Research Analyst

Sales Manager

Kushagra Gupta

Anusha Polneni

Crea ve Head

Marke ng Analyst

Jyothi Pandey

Pravallika Thammana

SEO Analyst

Web Developer

September 2021

540/6, 3rd Floor, Geetanjali Towers KPHB, Phase-6, Hyderabad 500072 Telangana, India Tel: +91 40 23055215

177 Park Avenue Suite 200, San Jose, CA 95131, USA Tel : +1-408-380-2566

Copyright @2021 Analy cs Insights. All Rights Reserved.

The content and images used in the publica on should not be reproduced or transmi ed in any form or by any means without the prior permission of Analy cs Insights.

08 COVER STORY

Mark Connelly Boston Consulting Group

ARTICLES

24

52

Key Focus Areas for CISOs

New Roles and Opportunities

to Watch Out for 2021

for CISOs

CONTENTS 18 Dave McKenna Upland Capital Group

28 Jason Halls The Institute of Cancer Research

34 Saeed Valian Transaction Data System

40 Sergey Tairyan Digitain

46 Tony Lau Sequent Software, Inc.

54 Fal Ghancha DSP Mutual Fund

58 Bruce Carlos SXIQ Information Technology

MARK CONNELLY Leading Teams to Assist Transformations on a Global Scale

COVER STORY 08

CISO of Boston Consulting Group

09

D

igital transformation has become a core part of business across industries. But

for successful transformation, organizations need an empowering approach that

will grow and build and sustain competitive advantage and drive positive societal

impact. This resonates with Boston Consulting Group as the company's diverse global teams unlock a company's potential with strategic transformations and make change happen by integrating solutions with cutting-edge technology and consulting.

Approaching Digital Transformation, the Right Way Boston Consulting Group (BCG) partners with leaders in

BCG's global teams have unrivaled industry and

business and society to tackle their most important

functional expertise and a range of perspectives that

challenges and capture their greatest opportunities.

question the status quo and spark change. BCG delivers

BCG was a pioneer in business strategy when it was

solutions through leading-edge management consulting,

founded in 1963. Today, the company works closely with

technology and design, and corporate and digital

clients to embrace a transformational approach aimed at

ventures. The company works in a uniquely collaborative

benefiting all stakeholders, empowering organizations

model across the firm and through all levels of the client

to grow, build sustainable competitive advantage, and to

organization, fueled by the goal of helping its clients

drive a positive societal impact.

thrive, enabling them to make the world a better place.

Climbing the Ladder of Success Mark Connelly has been immersed in the technology and

become their first-ever CISO.

computing industry for more than 30 years in a range of

During the financial crisis, Mark moved to NYC to

roles, from sales and support to IT operations and

become the Managing Director for infrastructure risk

information security.

and security at Credit Suisse, before becoming the first

After graduate school, where he studied electrical

global CISO for ITT, and then for Thompson Reuters.

engineering, Mark joined the storied AT&T Bell Labs,

He became CISO at BCG in 2016 and since then he and

where such luminaries as Arno Penzias, William

his team have fostered a culture where security is

Shockley, and his technology hero Claude Shannon were

designed into everything the company does. To Mark,

working. Sun Microsystems (SMI) gave Mark the

this was the hard part, but also one of his proudest

opportunity to grow through the ranks in IT leadership to

moments.

10

Experiences that Build the Future Becoming the first CISO at SMI (now Oracle) more than

before.

15 years ago presented Mark with some leadership

Crisis management has also taught Mark to stick to his

challenges, but also great opportunities to learn. He

beliefs. One example that stands out to him was when a

progressed from district systems engineering manager

CEO strongly challenged him on a recommendation he'd

to global leader of 2,000+ staff, before moving to run IT

made to the executive committee. These experiences

operations for sales and services, and then becoming

have taught him to be confident and back himself.

CISO.

For Mark, clear and effective communication has also

During those 20 years, Mark sharpened his knowledge of

been key, particularly with executive managers and

technology, business, operations, and information

boards of directors as they're the most important

security in a way that serves him extremely well today,

audience. He has learned to tell them what they need to

giving him a strong compass to see the whole picture.

hear, not what they want to hear, to never hold back or

Mark asserts that having a breadth of experience at

bow to direct or indirect pressure to soften the blow.

different levels is unique but also extremely valuable for

But he also makes sure to tell them about all the positive

a CISO. He strongly believes CISOs are business

work being done to protect the firm because they need to

executives as much as risk managers.

hear both sides.

His experience includes crisis management, which is

Mark believes it works both ways. “You need to listen to

thankfully not called on everyday, but has helped him

your team. Draw out the best ideas from them and

cultivate disciplined and strong leadership. Mark was

encourage strong discussion. I've found hiring people

once asked to lead a multi-company effort to bring back a

smarter than me and putting them in roles they can

major customer. It required a steady, methodical, and

stretch in really builds the team,” he said.

coordinated effort, managing communication,

Experience has also taught Mark not to look for

engineering, data center operations, and more—he slept

perfection in a solution as 80% of risk improvement is

on a cot in the office for a month. The pressure was

better than 0% of nothing!

significant: he directed tasks that had never been done 11

“ “Leaders need to establish strong ethical guidelines to make sure these tools are used for good. CISOs need to help shepherd policies in their firms and in governments to make sure they're used properly.”

- Mark Connelly CISO Boston Consulting Group

“ “Three basic principles that business leaders should be focusing on right now to ensure a smooth, safe, and secure tomorrow. Embed cybersecurity in design, Champion cybersecurity from the top, Be ready with a robust and tested response plan. By implementing a best-in-class security strategy and ensuring everyone at BCG plays their part, we continue to earn our clients' trust and our future.”

- Rich Lesser CEO Boston Consulting Group

12

Bracing Challenges with Innovation When Mark began his CISO journey, information

Another challenge was understanding the scope of the

security had a narrowly focused scope, primarily

risks and challenges in a fast-moving, global dot com and

concentrating on network security and building strong

building strategy and tactics to address them, as well as

walls, which the company later realized was insufficient.

those that could surface in the future. Many of the

To be successful, it was important for Mark to have a

previous challenges Mark faced translated to working in

broad understanding of the industry, the business, and

banking and multi-industry and are now valid at BCG. Yet

the risks. As innovation in technology and tools exploded,

he says that each industry has unique challenges, which

so did the opportunities for attackers. Learning and

can be altered by the risks they face, so he always focuses

growth were exponential in the face of data loss and the

on building a team of professionals, innovating with the

impact of that escalated rapidly. Mark used his skills

available resources, and validating BCG's performance

gained in dealing with businesses, clients, and operations

in risk metrics.

to build effective programs.

The Making of a Good Leader He believes the most essential quality of a leader is to

their job, you will achieve extraordinary things.

have a “firm grip on any crisis”. “If you waver, the team will

A leader also needs confidence, credibility, and the ability

too,” he added. Guiding a team through tough

to remain calm in high-pressure situations. He or she

experiences will help leaders learn how to do things

can't lose their head. Mark once said to a CEO, “if I lose my

better and develop a steady hand.

head, you've got a bigger problem”.

Being a good listener and decisive is also crucial as people

These attributes, paired with experience in different

hate indecision. Mark says it's important to build

areas of the business, will help leaders build a program

relationships with team-mates and create a bridge of

that can be shared with key stakeholders to meet risk

trust between leadership and colleagues. By supporting

objectives, and support desired goals.

and trusting them, and removing obstacles so they can do

Carrying Innovation for Good Mark believes in using what the company already has, as

get new ideas flowing.

he has often seen assets being underused. He anticipates

He also budgets for R&D in terms of technology process

business direction change and technology evolution, and

and training, so colleagues are empowered with new

participates in industry groups supporting innovation.

skills. He says this will yield innovation that would have

He is not afraid of challenging teams to be bold, even if it

otherwise been undiscovered.

has never been tried before—often the challenges will

13

The Role of Technology in Building a Company According to Mark, AI is transforming the threat

integrity, and availability. This brings up important

landscape and risk, while also offering tremendous

questions, like will these tools be used by attackers to

opportunities for good. BCG now has massive datasets

deny access to critical services?

and network connections processing power that was

Mark asserts that leaders need to establish strong

never available before, and that provides rapid analysis

ethical guidelines to make sure these tools are used for

and insights to improve decisions.

good. CISOs need to help shepherd policies in their firms

There is also an inherent risk around confidentiality,

and in governments to make sure they're used properly.

Where Will the Future Lead?

BCG is leading in many areas of AI and data science. The

This means applying grey matter (the people) and

firm is constantly working across all industries to support

technologies with clients to build insights and strategies

their transformation in a bionic manner—achieving the

to improve their performance, while helping to shape the

full potential of technology by combining it with the

future in terms of sustainability, cybersecurity, and

flexibility, adaptability, and comprehensive experience

business growth.

of humans.

Carrying Innovation for Good Mark believes that we are at a true inflection point in

“Call it like you see it and don't bend in the face of

terms of opportunities to shape a secure future, and

resistance—you will be tested,” says Mark. “Recognize

there's a lot for CISOs to get involved with. All

progress at each step of the journey. Build your

technology should have security built-in, so he feels it's

succession plan and watch for single points of failure and

important to get people to support your programs by

prioritize, then act.”

starting with the 'why'.

www.bcg.com

14

15

Mark Connelly

Jason Halls

CISO

CISO

Boston Consul ng Group

The Ins tute of Cancer Research

Mark Connelly is the CISO of Boston Consul ng Group. He has been immersed in the technology and compu ng industry for more than 30 years in a range of roles from sales and support to IT opera ons and informa on security. Becoming the first CISO at SMI (now Oracle) more than 15 years ago presented Mark with some leadership challenges, but also great opportuni es to learn.

Jason Halls, the Chief Informa on Security Officer (CISO) at The Ins tute of Cancer Research is a qualified so ware engineer and holds several security cer fica ons. He is a fellow of the Chartered Management Ins tute and the Ins tute of Analysts and Programmers. Jason has been entrenched in secure environments since the mid-90s where he worked on so ware to detect submarines.

www.bcg.com

www.icr.ac.uk

Sergey Tairyan

Dave McKenna

Saeed Valian

Fal Ghancha

CISO

VP of Informa on Technology & CISO

CISO

CISO

Digitain

Upland Capital Group

Transac on Data System

Fal Ghancha is the CISO of DSP Mutual Fund. He is an Informa on Security professional with rich experience in the IT & Cyber Security field focusing mainly on Informa on and Cyber Security Policies, IT/IS Projects, Compliance, Risk and Audit Management, Corporate Inves ga ons, and Forensics. Fal has headed many projects in the field of IT vis-a-vis Informa on Security like Dashboards, Iden ty and Access Management solu on, etc.

Sergey Tairyan is the CISO of Digitain. He holds a Ph.D. in Technical Sciences, who is also an author of more than ten interna onal publica ons and tutorials on informa on security. He is an Informa on Security Lecturer in Russian-Armenina University for more than a decade now.

During his professional ac vity, Sergey has conducted Informa on Security and Social Engineering trainings and consul ng different direc on public, private sector as well as the NGO.

As the VP of Informa on Technology and Chief Informa on Security Officer of Upland Capital Group, Dave McKenna has full accountability for building the insurance technology, opera onal, and regulatory from the ground up. He has spent me in both government and private companies. Prior to Upland, Dave was the CTO for the Massachuse s Cannabis Control Commission with full accountability of all systems and security.

T H E

MOST INFLUENTIAL

CISOs TO WATCH IN

2021

As the CISO for Transac on Data Systems (TDS), Saeed Valian is responsible for consolida ng and establishing a world-class informa on security prac ce based on the right balance of effec ve security measures and meaningful compliance controls. He is a highly regarded informa on security leader who is known for proac vely confron ng and resolving cybersecurity, compliance, and business risk challenges.

www.uplandcapgroup.com

www.tdsclinical.com

www.dspim.com

Bruce Carlos

Tony Lau

Bret Arsenault

Jerry Geisler

CISO

CISO & Head of Cloud Opera ons

CVP & CISO

SVP & Global CISO

Microso

Walmart

As CVP and CISO of Microso , Bret Arsenault is responsible for informa on security and risk management; se ng the company’s security incidence response strategy. He leads a global team of security professionals focused on protec ng the company’s assets through programs that span educa on and awareness, governance, iden ty and access management, enterprise business con nuity management, and security assessments.

Jerry Geisler is the Senior Vice President and CISO of Walmart’s global Informa on Security department. In his role, he is responsible for encompassing data security to the company's customers and associates. In addi on, Jerry oversees the informa on security strategy, engineering, opera ons, services, tes ng and assessment, risk, governance and compliance for the global enterprise. He serves the larger Informa on Security industry through speaking engagements and lectures.

www.microso .com

www.walmart.com

www.digitain.com

SXiQ

Sequent So ware

As a recognized global business technology leader with a successful CIO background and twenty-years of hands-on experience, Bruce Carlos holds the role of the Chief Informa on Security Officer (CISO) at SxiQ. At the company, he is leading mul ple fronts of building and delivering strong cyber resilience programs and lead protec on of core informa on assets to deliver world-class fit for purpose cyber security leadership.

Tony Lau is the CISO and Head of Cloud Opera ons at Sequent So ware. Previously, he served bank customers with serviceoriented professional solu ons at HP and VeriFone. Also, Tony has managed, integrated, and deployed secure electronic payment transac on systems at major banks in the world. He has extensive system architecture and opera ons experience in mee ng payments and security requirements.

www.sxiq.com

www.sequent.com

Dave McKenna VP, IT & CISO Upland Capital Group.

18

A Successful Technologist Developing and Enforcing Security Solutions

U

pland Capital Group offers a diversified

government and private companies. Prior to Upland

portfolio of excess and surplus lines (E&S)

Capital Group, he was the Chief Technology Officer for

casualty, property, and specialty insurance

the Massachusetts Cannabis Control Commission with

products, with an initial focus on excess casualty

full accountability of all systems and security for the

products distributed through select wholesale brokers.

Commission. He has a Ph.D. in Information Technology

The company was established in 2020 and initially

with research focused on the security of IoT devices, MS

announced its launch in January 2021. It is funded

in IT Management, and BS in Computer Info-Systems.

through an equity investment of up to $200 million from

Dave has various certifications, including Certified

Newlight Partners LP (Newlight), a growth equity

Information Security Manager (CISM), Certified Data

investor, and an additional investment from the

Privacy Solutions Engineer (CDPSE), and Project

company's executive management team. The company is

Management Professional (PMP).

rated A-VIII by AM Best. It has taken a cloud-first approach, with a focus on being secure, nimble but

Trust is The Key to Business Success

disciplined, and avoiding the “IT Shuffle.”

As a technology leader, Dave knows when to listen and provide advice where appropriate. He believes that

A Certified and Proactive Leader

having complete alignment with an organization is

Dave McKenna is the VP of Information Technology and

essential, and asking questions is a way to get there.

Chief Information Security Officer with Upland Capital

Cyber security demands a delicate balance between

Group. With this role, he has full accountability for

defending the network and allowing employees

building the insurance technology, operational and

flexibility with technology to do their jobs. One

regulatory, from the ground up. He has spent time in both

achievement Dave had was building a government

19

“ While cybersecurity has full support from the leadership and the board, security issues are colliding. Products have far too much crossover, and CISO's need to shift their focus to AI and machine learning to defend against malicious behaviours instead of binary threats.

“ Dave McKenna VP, IT & CISO Upland Capital Group.

20

technology stack from nothing. This build required

are separated. By aligning these practices, he was able to

secretary-level approval, a conscious view of the security

be more successful.

of information from medical (HIPAA), criminal (CJIS),

“There is a lot of focus on Zero Trust, which enables

employee, licensee, etc. The subject areas were endless,

trusting but verifying to gain authentication. However,

and the implementation was quick (less than six months),

once the user is in, we need to analyze, learn, and assess

and there was an immediate benefit when the COVID-19

(ALA) their activity to strengthen cyber defense. To trust

pandemic hit.

a user now extends beyond authentication.” he adds.

This implementation allowed all employees to leave work on Friday and start work the following Monday

Essential Leadership Qualities for Tech Leaders

with no impact on operations (including the call center).

Dave said that balance, confidence, education, and

Traveling through the past experiences, Dave learned to

persistence are the key traits of a strong, successful

trust expertise, to trust people, decide and implement

leader. A leader needs to balance the needs of the

quickly with purpose.

organization, provide solutions in which he or she is confident, stay educated on ubiquitous security topics,

Stepping Up Against the Challenges

and be persistent in his or her decisions. He also

M u c h o f D av e' s c a r e e r w a s s u r r o u n d e d b y

mentioned that a leader must have a purpose to proceed.

understanding how to influence the right people, make the right decisions, and being confident in the result. In

Implementation of Cloud-Based Operations

many organizations, there are challenges and differing

I n n ov a t i o n r e q u i r e s c o m m i t m e n t a n d a d e e p

opinions around whether technology is suitable for the

understanding of the organization's appetite for risk,

organization. Dave says, “Early on, there will be many

especially concerning technology and security.

ideas, and they all will seem easy.” On that note, he had to

Introducing something new is not a complex topic.

learn that there is a balance between easy

Aligning the innovative topic with practicality is another.

implementation, data, and security. Often these areas

Dave said that at Upland Capital Group, he and his team

21

had a healthy respect for innovation. They have set the

information to drive the deployment of security

foundation for innovation by implementing a fully cloud-

solutions rapidly.

based operation, which allows for quick adjustments to our overall technology strategy. By enabling this type of

A Sneak Peek- Adoption of Industry-Leading

environment, everyone can implement solutions with

Technology and Tools

advanced security considerations quickly and gain

Upland Capital Group has a promising future with its use

adoption almost immediately, says Dave. This also allows

of technology. The team has an intense focus on data,

more proof-of-concept design quickly, which gains

analytics, and decisions. Upland Capital Group is a cloud-

traction for innovative ideas—being innovative means

based organization in a position to adopt industry-

constantly evaluating the processes and challenging the

leading technology and tools in near real-time. Cyber

teams to do better. This can be with a blend of technology

security in the finance sector has evolved into an

and process. Staying innovative means one is no longer

executive seat at the table for the CISO.

debating technologies that make sense.

Embracing New Technology An Expanded View on Disruptive Technologies

Dave advises the emerging CISOs to keep an open mind,

Dave believes that an IT leader or a CISO is expected to

entertain new technologies, and focus more on enabling

know far more about technology solutions than five

a rapid deployment environment that supports

years ago. Disruptive technology solutions are

innovation quicker while keeping threats at bay. Start by

increasing cloud adoption, streaming data, IoT,

asking how (e.g., how will this solution impact the posture

automation, and AI. A CISO has to understand all the

against threats), as opposed to jumping to solutions. The

potential vulnerabilities each technology might

future of cyber security is human and behavioral at the

introduce. In addition, leadership expects quick risk

core. Be a partner, learn new things, be more than a CISO,

mitigation solutions. Essentially, the CISO (and team) has

be a utility person that brings technology solutions that

to be embedded in the majority of projects that involve

consider security, says Dave.

22

CISOs KEY FOCUS AREAS FOR

TO WATCH OUT FOR 2021

I

n today's world, every company has a CISO. The role

As every company is undergoing a digital transformation,

of CISO has become important for carrying out the

security has become the main concern for all. The role of

organization's operations. The world has witnessed

a CISO has remarkably expanded from being focused on

the greatest pandemic that has necessitated all types of

technology alone to considering business risks as well.

businesses to allow remote workforces without

They should interact with their colleagues across

preparation. This requires CISOs to ensure digital

business units, describing the importance of having a

security with new evolving threats.

strong cybersecurity agenda. The management level

The year 2020 and ongoing 2021 is witnessing an

councils and forums shall serve as a critical medium to

increased number of cyberattacks catering to the

interact with stakeholders to operate strategic

demand for CISOs.

initiatives.

What are the aspects that every CISOs should focus on

Invest in Cloud Security

for 2021?

Today every business is moving towards the cloud, thus

Make Cybersecurity a Boardroom Agenda

CISOs must prepare against more threats and attacks,

24

data breaches, account hacking, etc. more the amount of

to-day duties according to the organization's

information in the cloud, the more will be the number of

cybersecurity policies. Business leaders need to raise an

cybercrimes. Though most cloud service suppliers

organizational-wide mindset that designates

include in-build security services for data protection,

cybersecurity as the most important thing by giving

regulatory compliance, and privacy, ensure access

employees sufficient training to recognize and report

control capabilities for effective security risk

threats, develop communities and conduct

management and protection in the public cloud, still, it is

cybersecurity awareness sessions in creative, fun ways,

difficult for organizations to develop a strong strategy

and reward and recognize employees who contribute to

for risk management framework, protect cloud design,

a secure organization.

security governance and skills expertise in the cloud as most attacks arise due to lack of a robust security

Modernize Enterprise Security Architecture

strategy in the company.

The existing circumstances in most organizations are steered by the following themes:

Execute Basic IT Hygiene

Ÿ

The expectation of having access to company

Cybersecurity is no longer the sole responsibility of IT

resources from anywhere, any device, and ensuring

teams and security teams. Security is as strong as the

remote infrastructure security and IP security.

weakest link. Therefore, it is important to confirm that

Ÿ

every individual is acquainted with the security strategies and agrees to be an integral part of the

password-less authorization Ÿ

ecosystem, thereby understanding and practicing IT hygiene, which will serve a healthy security structure. IT hygiene is the first line of protection that an organization

The capability to support cloud solutions and The demand for automated and continuous compliance and zero trust-based network models

Ÿ

There is a move to security as a code and adherence to data privacy directives.

can embrace by discovering what they want to protect, where these entities are located, and who controls them.

These themes are highlighting the changes that are needed to be made to ensure the enterprise security

Develop Borderless Security

architecture.

The remote and distributed workforce functions by retrieving resources on the cloud, from using

Leverage Innovations

collaborative platforms to critical work-related

There is a rising tendency in the number of cyberattacks

applications. The workflows are mostly occurring on the

using advanced technology in the areas of malware,

public network or from untrusted devices, thereby

phishing, crypto-jacking, SQL injection, zero-day

extending the enterprise circumference beyond the

vulnerability exploits, watering hole attacks, social

traditional boundaries of an organization. Therefore,

media disinformation, and spoof accounts. Hackers with

borderless security is highly needed to confirm the

minor technical skills turn to easily available and ready-

safety of the businesses.

to-use hacking equipment. As the hacker uses innovative technologies, organizations need to invest more in the

Create a Culture of Cybersecurity

latest technology solutions like AI, ML, and deep

A security culture is an important part of the

learning, blockchain, next-generation breach detection,

comprehensive corporate culture that motivates

and zero-trust networking solutions to fight back

employees to make decisions and accomplish their day-

attacks.

25

Jason Halls CISO The Institute of Cancer Research

28

Empowering Security Ecosystem to Safeguard Critical Data

T

he Institute of Cancer Research.(ICR) is a public

environments since the mid-90s where he worked on

research institute and a member institution of

software to detect submarines. After completing his

the University of London, specializing in

Master's in Artificial Intelligence he joined one of the UK

oncology. The ICR is a leading academic institutions in

Intelligence Services to develop messaging systems that

the UK and has been carrying out world-leading research

were critical to the UK's national security. Here his

into the causes of cancer, and how it might be treated or

endeavours not only opened up new ways of working but

prevented, for more than 100 years. The ICR was the

also accelerated the dissemination of crucial information

first to provide evidence that DNA damage causes

from days to minutes. This was achieved whilst meeting

cancer and have discovered more new cancer drugs than

and surpassing some of the World's strictest security

any other academic centre in the world. In partnership

requirements. Almost 2 decades later he left to broaden

with The Royal Marsden hospital, the ICR provides a

his experience outside of the rigid confines of the

unique bench-to-bedside approach to making the

intelligence community. Moving to the private sector

discoveries that defeat cancer.

made him appreciate that security is a negotiation, not an edict.

Leadership with Unparalleled Expertise

Joining the ICR gave Jason an opportunity to contribute

Jason Halls, the Chief Information Security Officer

to a great cause and to own information security at a

(CISO) at The Institute of Cancer Research is a qualified

world-class organisation that is a charity, a research

software engineer and holds several security

institute and a university with PHD and MSC students.

cerfications. He is a fellow of the Chartered

This provides unique challenges where information

Management Institute and the Institute of Analysts and

security must be appropriate to the company, its staff,

Programmers. He has been entrenched in secure

and the data it handles. It must secure medical data and

29

“ We are entering a new epoch where information is at the heart of modern life. Good cyber hygiene should be expected in every digital interaction.

“ Jason Halls Chief Information Security Officer The Institute of Cancer Research

30

intellectual property whilst giving staff the flexibility and

what workarounds could be implemented, or to

freedom to carry out their research with the minimum of

obtain the opinion of other researchers.

distraction. Getting this balance right whilst providing a

Ÿ

strong foundation of security is at the heart of his work.

There was a distrust of IT and a perception that they were hindering research rather than supporting it.

Ÿ

A heavy-handed approach to security would not

Commitment from the Executive Board and the Board

work, therefore Jason needed to win hearts and

of Trustees

minds to improve the security posture.

Jason has seen how poor leadership and slavish

Ÿ

His goal would be to promote security as something

adherence to security can paralyze a company – where it

to enable collaboration and promote good data

cannot perform its main function due to the restrictions

governance.

security puts in place. He was determined that this would not happen at the ICR and that security would be

In 2019, Adrian Cottrell joined the ICR as Chief

seen as an enabler not a hinderance. On the day he joined

Information Officer (CIO) and tackled the IT issues head-

the ICR he attended a forum for IT and researchers to

on. Jason designed a million dollar improvement

discuss new initiatives. One of these was a set of

programme involving the onboarding of an MSSP

screensavers commissioned by IT that would display

(SmartTech247), implementation of new security

basic infosec awareness messages (such as “don't share

controls (VMS, EDR & PAM), and a commitment from the

your passwords) when the screen locked. One

Executive Board and the Board of Trustees to adopt a

researcher objected to its introduction as it could

more security-aware culture.

distract their train of thought and potentially lose something that could defeat cancer. This exchange gave

Keeping Organization Safe and Staying Focused

Jason valuable insight into the company.

Jason believes that the biggest challenge a CISO faces is framing security in terms that everyone in the company

Ÿ

Ÿ

The institute exists to defeat cancer and its

understands. Researchers by their very nature are

researchers are key to this.

inquisitive; they want to use data in novel and

The relationship between the IT department and the

challenging ways. Information security needs to be agile

researchers was broken. There had been no attempt

enough to step in when required and to sink into the

to explain why the screen savers were necessary,

shadows when not. As the only dedicated InfoSec

31

resource, one of the biggest challenges Jason faced on

minimal security controls as “cyber-hygine” gives people

joining the ICR were keeping the organization safe;

a human frame of reference. They are less likely to

deciding which battles to fight and which to avoid, and

develop workarounds and more willing to accept

staying focused on what was important strategically and

necessary controls. Terms such as confidentiality,

operationally.

integrity and availability are still useful but need to be backed up with clear examples. A hacker stealing data is

Key Hallmarks for Every Technology Leader

easy for researchers to understand but they may not see

According to Jason some of the key attributes of the

the danger if they are intending to share the data anyway.

technology leader includes:

Explaining that a hacker could corrupt their data without them knowing, and subsequently publishing their

Ÿ

Willingness to listen more than they talk. To ask the

research based on this data, is much more impactful.

right questions and listen to the answers. Ÿ

Ÿ

Ÿ

Ÿ

Breadth and depth of knowledge, experience in

Cloud-based Malware Protection with AI and

several areas allow one to see a problem from several

Behaviour Analytics

viewpoints. This is especially important in security

With security breaches hitting the headlines so often and

which has such a wide remit.

cybersecurity being discussed at the board level, leaders

Making decisions based on the information given at

are finally grasping just how crucial it is to get security

the time but be prepared to pivot when new

right. AI, automation, cloud computing, and big data are

information comes to light.

coming together to tackle information security.

Having all the answers is not necessary but one must

Solutions such as CrowdStrike Falcon provide cloud-

know where to find them.

based malware protection with AI and behaviour

Trust your team and their experience.

analytics. Basically, it is like stopping malware based on its bad behaviour rather than what it look like.

Embedding Good Cyber Hygiene

The board finds it harder to assess risk due to the variety

Jason believes we are entering a new epoch where

of ways its staff may interact with data. Using

information is at the heart of modern life. Good cyber

measurements such as impact and likelihood becomes

hygiene should be expected in every digital interaction.

almost meaningless. It's accepted that any company will

This is especially true at the ICR where information is

be subject to a data breach at some point in time. This

crucial everything the company does. Embedding good

could damage the company's reputation to the degree

cyber hygiene, not just at work but through-out their

that it cannot recover or it may just be nothing. So what is

digital life, is Jason's current goal. The challenge here

the level of cyber risk if a breach is definitely going to

isn't so much technological as human nature. Citing

happen and it could conceivably critically disrupt the

cyber security as the “health and safety of data” and

organization's ability to function? This is the challenge

32

the CISO faces; to articulate the risk and present

Word of Wisdom to Emerging Security Leaders

actionable ways to reduce it to acceptable levels.

It is advisable for everyone to always own mistakes, learn

People don't appreciate how IoT opens them up to

from them and move on, and encourage others to do the

additional risk. It's very easy, perhaps too easy, to add a

same.

new web-aware appliance to your home network. As a CISO one should think about the consequences. It is not

Ÿ

take over life.

that one shouldn't use a shiny internet webcam to monitor their house when they are away. Just that people

Be prepared to eat, sleep, and work security. It will

Ÿ

Get a range of security-related experiences such as

should consider whether others could access the feed

governance, training, risk management, audit,

when they are at home.

networking, and operations. A position on a service desk could be a good foot-in-the-door.

Framing Security into Every-Day Life

Ÿ

Fill in knowledge gaps with training, the BCS

Jason opines that AI and behaviour analytics together

Foundation Certificate in Information Security

with the MITRE ATT&CK framework is capable of

Management Principles is a good start. There are also

blocking a large number of threats. However, hackers

good free resources available online.

have a knack for getting around security controls thanks

Ÿ

Study for the CISSP exam and work towards full

to the human factor and their inherent laziness. Humans

membership of the ISC2. It gives a good indication of

will always gravitate to the path of least resistance

the width and depth of knowledge required.

whether it's writing their password on a post-it or using a

Ÿ

Contribute to one of the many infosec forums.

4-digit PIN on their phone. Security in the future needs to

Ÿ

Volonteer to be a security champion at your company.

be simple to the degree that it's more effort to bypass.

Ÿ

Propose new security initiatives and show how they

This means baking security into everyday life so it

can reduce cyber risk and ultimately save money.

becomes second nature.

The level of protection or security will be raised across

Covid-19 Crisis

the board with the number of systems that are

The ICR, like many research organizations, has been hit

connected and sensitivity of data stored, no other choice

by cuts to its fundraising income and grants from other

but to give it the strongest protections that it can.

charities. The ICR had to pause much of its work during

Advances in quantum computing raises some interesting

the initial lockdown and is now running a major

challenges for security in the not-too-distant future.

fundraising appeal to help kick-start its research and make up for the estimated 17 months lost time.

33

Saeed Valian CISSP, PMP, CISO Transaction Data System

34

Transforming the Healthcare Industry with Innovative Pharmacy Management Solutions

T

ransaction Data Systems (TDS) is the leader in

improve robust security practices by increasing business

independent pharmacy services and solutions.

performance, integrity, and scalability.

TDS provides innovative pharmacy

Saeed's proven record of defining customized strategies

management solutions and clinical applications that

and establishing cross-functional teams demonstrate

adapt to the workflow needs of the largest network of

innovative solutions and services, resulting in increased

independent and community pharmacists. For over 40

productivity and competitiveness by providing security

years, TDS has supported the needs of single, multi-site,

at the speed of business! Considering himself an

assisted living, and hospital pharmacies through its

advocate for the security industry fighting the good fight,

portfolio of software and services including Rx30,

he promotes building effective security culture

Computer-Rx, KloudScript, Enhanced Medication

customized for each business, reducing gaps by building

Services, and PharmAssess.

relationships through collaboration and investing in security-minded Business Unit (BU) experts to become

Distinguished Cybersecurity Leader Providing Security

the organization's security advocates (BISO's) in order to

at the Speed of Business!

establish a dynamic approach to security and

As the CISO for TDS, Saeed Valian has been responsible

compliance.

for consolidating and establishing a world-class information security practice based on the right balance

Grasping Opportunities by Executing Strategies

of effective security measures and meaningful

The opportunities to build and/or improve information

compliance controls. Saeed is a highly regarded

security practices for several organizations in different

information security leader who is known for proactively

industries, including but not limited to the healthcare,

confronting and resolving cybersecurity, compliance,

technology, and manufacturing for medium and large

and business risk challenges. Leveraging over 15 years of

enterprises, as well as the unique experiences of being on

comprehensive information security and information

the client and vendor sides, have provided him with

technology experiences enables him to build and/or

unique skills to prepare and deploy innovative, yet 35

“ Successful cybersecurity program is a dynamic practice based on the right balance (unique to each organization) of compliance requirements and effective security controls founded on trust and transparency, and its future success relies on the controlled balance of artificial intelligence and security professionals.

“ Saeed Valian CISSP, PMP, CISO Transaction Data System

36

practical and scalable security strategies.

machine learning, and artificial intelligence will be significant to a reliable security practice. It is imperative

Seeking Roadmap to Success

for a solid cybersecurity practice to be able to predict

According to Saeed, being able to understand the

potential malicious behaviour as cybercriminals are

business requirements and offerings, thoroughly

always one step ahead! To do so, the ability to

assessing the organization, and preparing a meaningful

consolidate data from different platforms and layers,

security strategy are only the beginning. It is part of the

analyzing for anomalies and communicating results in

challenge to digest the findings into meaningful actions

form of actions in a matter of seconds rely significantly

and lay a measurable roadmap, translating it into the

on automation, machine learning, and artificial

business and finance language, and effectively

intelligence. Traditional SIEMs with limited (and/or

communicating it to the business executives for their

costly) space for logs will be replaced with Cloud-based

buy-ins. Additionally, building diverse teams, creating

offerings built on big techs' data centres with access to

innovative user awareness programs, promoting the

data and patterns in near-real-time. That being said, it is

importance of cybersecurity via fun activities, including

imperative for such efforts to be controlled and human-

and not limiting to security shows, internal programs to

led for best results.

recognize and celebrate security advocates across the organization, and interactive security intranet will

Versatile Approach for Reliability

significantly improve the security culture.

While healthcare technology companies play a critical role in providing essential solutions to healthcare

Adaptability to Reshape Security

providers to deliver meaningful services to their

From the personal experience of Saeed, taking the

patients, they are placed in a challenging position to find

consultative approach to security has significantly

the right balance of functionality and creativity against

improved the business's willingness to consider and

imperative compliance requirements and security

adapt to security recommendations. As part of this

controls to keep patient data safe. “An increasing number

approach, it is critical for security leaders to truly design

of regulations, an ever-growing number of cyberattacks,

and promote security as a business enabler that will

and unique clients' requirements add to the complexity

result in security being integrated into the core of the

to be addressed by healthcare technology vendors;

company. It's imperative to reshape security from being

“transparency” is key to the future of said vendors from a

the “bottleneck” to being part of the process by providing

security and compliance perspective,” said Saeed.

security at the speed of business.

A Road to Procure Expertise Leveraging Disruptive Technologies: Minimizing

While leadership skills and security expertise are

Cyberattacks

essential, Saeed feels that it's imperative to recognize

Saeed believes that like many areas of a business, data

that an effective security practice is not a cookie-cutter

and visibility to it are keys to a successful security

solution, but a customized approach unique to each

practice. It is not feasible for companies to hire an

business. Understanding the business to promote a

unlimited number of security professionals to manually

security culture demanding for a transparent security

monitor and analyze a large amount of system logs,

practice based on the right balance of compliance

malware, and potential cyberattacks to protect their

controls and effective security measures is the key to

data.

one's success--- to prepare a culture to demand for

Utilizing emerging technologies such as automation,

transparent security versus forcing it.

37

Sergey Tairyan CISO Digitain

40

Empowering the Society with Innovative Cybersecurity Strategies

D

igitain is known as an award-winning and

Digitain has projected its more than two decades of

leading sports betting software provider

experience into building DigiTown tech hub to support

servicing in the global online betting and

innovation and boost the talent pool. DigiTown aims to

gaming industry. It offers customer-first approach with a

set a new benchmark with Armenian IT startups and

wide range of supporting services such as guidance on

scale the Armenian ecosystem.

licencing, customer care and so on. The platform offers products like iGaming platform, sportsbook software,

A n E m p o w e r i n g Le a d e r w i t h a n E x p e r t i s e i n

casino games aggregator, DGbuilder, table football,

Cybersecurity

virtual sports, live casinos, and many more.

Sergey Tairyan holds a Ph.D. in Technical Sciences, who is also an author of more than ten international

Innovating Solutions for Talent Pools

publications and tutorials on information security. He is

Digitain is one of the largest IT companies in Armenia

an Information Security Lecturer in Armenian-Russian

that offers turnkey and white-label innovative solutions

University for more than a decade now.

at a global scale. With its international partners from

During his professional activity, Sergey has conducted

across all continents and offices in the UK, Malta, and

Information Security and Social Engineering trainings for

Cyprus. Digitain has more than 1700 talented experts.

RA Ministry of Finance, employees and members of the

I t s aw a r d - w i n n i n g o m n i c h a n n e l p l a t f o r m a n d

National Assembly, different direction public, private

sportsbook with integrated payment gateway, bonus

sector as well as the NGO. He was the Information

engine and CRM system are comprised of 100 sports in

Security Consultant in the RA State Revenue Committee

7500 leagues on 70.000 live events per month.

for more than seven years till now consulting Yerevan Municipality on Information Security and Blockchain.

41

“ Digitain will continue to significantly enhance our information security processes and invest in the teams who safeguard our platform. Innovation, flexibility and trust are our primary company values and we are confident that, with this approach, we will continue to flourish in our industry.

“ Sergey Tairyan CISO Digitain

42

Sergey Tairyan is the CISO (Chief Information Security

security risks for the head owner of the company (Julius

Officer) of Digitain with main responsibilities such as the

Caesar is a great example of a leader who was “pretty well” in

description of the structure and behavior for the

information security). Especially in SMEs and startups,

company's security processes, information security

security risks are often underestimated. This almost

systems, personnel, and organizational sub-units,

always leads to irreversible consequences for the

showing the alignment with Digitain's mission and

information system.

strategic plans; and threat hunting--- proactive security search through networks, endpoints, and datasets to

Insights from a Successful Tech Leader

hunt malicious, suspicious, or risky activities that have

A lot of people buying “well-known” brand's devices and

evaded detection by existing tools.

services, usually think that “big brand” made the device “secure and private by design”. But actually, in the era of

A Certified Professional with Superior Knowledge

business, tech companies creating something new, are in

Sergey has received deep theoretical and mathematical

a hurry to enter the market with brand new device or

knowledge at the Armenian-Russian University and at

service. In practice, these companies spend a lot of time

home. He has participated in multiple trainings such as IT

on developing a new product but spend much less

audit in Slovenia, Russia; ethical hacking and penetration

resources on its security. This is confirmed by the daily

testing in Russia; SOC analyst in the Netherlands. Sergey

hacking news. Therefore, everyone needs to take care of

is also known as the certified BS ISO/IEC 27001/2013

their own cybersecurity and privacy. He mentions two

ISMS lead auditor as well as the certified blockchain

vital attributes that comprises a technology leader i.e.,

expert (by the Blockchain Council).

tech security expertise and psychology skills.

Confronting Challenges with a Deep Understanding

Identifying Secure Environments in the Pandemic

Sergey has started his career as a Systems Administrator

Last year, when the pandemic began, almost all

in an insurance company, and this helped him to dive

companies switched to remote work. As ordinary users

deeper into technical and practical issues of information

are the weakest link in the cybersecurity chain, a wave of

security. Much has changed over the years, but the main

phishing attacks with references to the pandemic broke

thing remains--- the deep understanding of information

out. Many have started using their own devices for work

43

and new information security risks have emerged.

that the ever-present, and growing, cyber security

Digitain has developed an innovative strategy to ensure

threats will lead to ongoing greater investments in

the cyber security of its employees, not only while

enhanced security systems. Mobile platform security

working on a corporate device, but also to ensure their

could be an area of particular focus, given the importance

personal cyber security. Everyone in Digitain can install a

of this channel to the iGaming industry, with up to 70% of

corporate antivirus on personal devices and can ask for

bets now taken via this method.

help any time with their own device problems.

At Digitain, the team continues to invest in the security and stability of the platform, developing both security

Disruptive Technologies for Better Outcomes

systems and security teams, in order to ensure the

In the case of AI, people who use machine learning and

company continues to out-innovate any potential cyber

developing artificial intelligence should always keep in

threats. The team will also continue to enhance AI-

mind if the machine does the right thing when it learns.

driven, self-healing security solutions, which will become

How many errors are acceptable? To verify the validity of

even more important moving forward, to deal quickly

the actions of artificial intelligence, AI auditors will be

and efficiently with increased volumes of cyberattacks.

needed who will supervise and re-teach AI.

As a company, trust is part of the DNA and the team will

In the case of blockchain, it is currently at that stage of

continue to work tirelessly and effectively to protect

evolution just like the Internet in the early 2000s. Sergey

partner network and their data from cybersecurity

thinks that in a few years the use of blockchain

threats.

technology will be more widespread in industries such as iGaming, healthcare, supply chain, land ownership,

Essential Approach for Budding CISOs

digital marketing, finance and cybersecurity.

Julius Caesar is a great example of a leader who was

Last but not least, in the case of quantum computing and

“pretty well” in information security. "Caesar Cipher," is

steganography, the problem of the stability of

one of the earliest known ciphers, being developed

cryptosystems arose with the advent of quantum

around 100 BC, it was used by Julius Caesar to send (and

computers. Over time, cryptosystems will give way to

receive) secret messages. Caesar shifted each letter of

stegosystems based on post-quantum algorithms with

his message three letters to the right to produce what

stegochannels for data transmission.

could be called the ciphertext.

The main thing is to approach the solution of the problem

Predicting a Protected Journey to Success From an iGaming industry perspective, it seems clear

44

as Caesar advised--- Veni, Vidi, Vici.

Tony Lau CISO & Head of Cloud Operations Sequent Software, Inc.

46

Mitigating Cybersecurity Issues with Disruptive Technologies and Continuous Effort

T

ony Lau is the Cloud Services and Information

oriented professional service at HP and VeriFone. Also,

Security Executive at Sequent Software who has

he managed, integrated, and deployed secure electronic

an extensive system architecture and operations

payment transaction systems to major banks in the

experience in meeting payments and security

world. Being the head of IT and cloud operations at

requirements.

Vivotech he contributed to providing 7x24 mobile

Based in Silicon Valley, Sequent Software was founded in

payment and loyalty card provisioning service. As the

2010. Since its founding, Sequent has been at the

CISO at Sequent, he works to ensure that companies and

forefront of digital transformation and mobile security. It

customers are protected from continuously mutated

aims to secure the world of shared personal information

security threats and minimized operational risks. He is

with confidence, privacy and simplicity. The company

also a Certified Information Systems Security

delivers its patented technology to enable and secure

Professional (CISSP) with track records of establishing

mobile experiences in payments, financial services,

security policies, procedures, and auditable

loyalty, and digital access to hard and soft assets.

administrative, technical, and operational controls that

Sequent Platform fully secures account data, personal

passed payment security compliance requirements.

data, PII, electronic health records, and other credentials

Tony has very strong hands-on technical competency as

on mobile, wearable, and IoT devices. Its technology is

well as the ability to articulate ideas and directives to a

engineered to reside in the cloud or on-premise. It

variety of technical and non-technical audiences.

enables shielding or redacting critical consumer data.

Sequent technology is protected by numerous US and

Security Awareness that Plays a Pivotal Role

international patents.

According to Tony, security awareness among management and employees was relatively low a few

An Experienced Leader with Strong Hands in Technical

years ago. He said, “We spent a few good cycles of

Competency

training and education to pervade security consideration

Tony Lau has served the bank customers with service-

in all software development lifecycle and company 47

“ If we look at our status today from a bird's eye view, we have achieved a lot, however Information Security is a journey and not the destination, our battle towards fighting with the latest cyber security challenges will continue to be top priority.

“ Tony Lau CISO & Head of Cloud Operations Sequent Software, Inc.

48

operations. Now, we have many internal advocates from

architecting and managing payment card industry

management to engineers knowing that successful

governed hosting services that naturally trained me to

business can only exist if we know how to protect

weigh and consider all factors about information

ourselves and our customers”.

security”.

Adding to this Tony also asserted that general data

Data Prevention: An Innovation Beyond Excellence

protection was in his DNA. He mentioned that the first

The greatest innovation in the market of data protection

PCI DSS service provider level 1 audit took a few months

is to prevent data from being stolen. Tony said, “To bring

of patience and persistence to remediate all the gaps

in such innovation Sequent's approach is to make stolen

found but the second-year onwards it became much

data useless to the perpetrator. The original data at rest

smoother and easier. This way each experience that was

is tokenized and replaced by a blob of undecipherable

a nightmare taught him an experience. Sequent now has

string thus making the data worthless. The data can be

PCI DSS certification on both AWS environment and own

detokenized on the fly for use after a genuine authorized

data centres six years in a row.

user is authenticated. “We provide bank graded security to the payment and healthcare industry to protect PII

Going Forth and Expanding the Systems

(Personal Identifiable Information) and PHI (Protected

High-profile ransomware attacks and data heists got

Health Information),” he added.

everybody's attention frequently. Such cyber-attacks occur daily to organizations of all sizes worldwide.

Injecting Efficiency and Transparency with Disruptive

Appropriate security policies and awareness training

Technologies

control implementation and tokenizing invaluable data

“It is a norm that organizations do not have inadequate

are all critical arsenals for data protection. By

staff to handle all security tasks needed. Resources

implementing tokenization technology together with

should be focused on running core business, thus

identity authentication in providing trust and privacy to

outsource tasks to external trustable cloud vendors who

protected data, Sequent will continue to replicate

have the skills, AI capability and scalability are the

success from payment to healthcare to other industry

trends,” Tony said.

verticals, is what the CISO of the company believes.

“With defense in layers and zero-trust in mind, evergrowing controls and monitors are deployed everywhere

Enlightening Upcoming Executives

at perimeter firewalls, internal application servers, and

In his advice for the upcoming CISOs and executives,

end-user computing equipment. These endless critical

Tony enlightens the starters by telling them that they

but tedious anomaly detection and responses should be

must understand their own business before starting to

outsourced if local governance is allowed. I expect in a

implement cybersecurity solutions. It is better to pick an

few short years that all corporate internet-facing attack

appropriate cybersecurity framework and use it to drive

surfaces can be handled by external network

strategies, identify gaps, and most importantly to gain

aggregators; only filtered and clean traffic should reach

internal support and acceptance. He believes, “For small

corporate networks,” Tony further added.

to midsize organizations, NIST cybersecurity framework is a good start. For the more established organizations,

Experience that Trained and Shaped the Leader

there are probably contractual and legal compliance

Talking about his experience, Tony mentioned “Previous

requirements like PCI DSS, HITRUST, NIST 800-53 or

bank systems integration and deployment with

FedRAMP”.

49

new Roles and Opportunities for CISOs 52

T

he pandemic has emphasized the need for cloud readiness and digital modernization among the

business leaders of today. This new normal post-

pandemic is driving organizations to make decisions faster while maintaining business continuity and ensuring data security. The growing remote work and cloud adoption now bring the Chief Information Security Officer's (CISOs) to ensure protection against the drastic change supporting the digital transformation (DX) and c l o u d c o m p u t i n g i n i t i a t i v e s . Te c h n o l o g i c a l advancements are providing new opportunities for collaboration between IT and business. As businesses start to grow after the pandemic it is up to the CISO's to make sure that a strong business foundation is built for the markets and companies to sail across these shifts.

Cloud Adoption to Meet Demands Most of the businesses are shifting towards

computing, explaining and identifying the shadow IT

digitalization and this, in turn, created a demand for

applications. And because of the high demand most of

cloud adoption thereby raising the cloud spending by

the companies have hired and are planning to hire a CISO

37% to $29 billion in the first half of 2020. And these

with greater cloud computing skills and another 53%

technological shifts are going to stay in the market

have employed or are planning to hire a business

expanding new opportunities. But as work becomes

information security officer (BISO) to work with LoB

more decentralized there also increases the diligence to

managers ensuring the safe business processes.

maintain cyber hygiene by monitoring the threats since organizations are reporting a 47% increase in

The CISO's are responsible for selecting, deploying, and

cyberattacks.

operating the necessary security controls that can enable the business while noting the cyber risks. The

The increase in cloud services demands a cybersecurity-

main challenge here is to enable an integrated and

filled culture that can be beneficial in terms of taking care

cohesive security strategy across the technology

of the risks. This is why most of the CISO's are moving

portfolio. These executives need to rationalize and

towards a business focus to ensure the execution of new

transform the cloud ecosystems into an integrated and

digital initiatives. The new normal has paved a way for a

scalable security stack at the same time meeting

digital transformation CISO who will be responsible for

divergent business requirements. And this requires a

driving cybersecurity by integrating into DX initiatives in

high-performance data pipeline for stream and batch

all aspects of IT technology especially when coming to

data processing, API integration between tools, and to

public cloud computing.

process automation for immediate incident response

CISO's Role in Combating Cyber Risks

and risk mitigation. Businesses need to inculcate a culture of security first to find the right balance between

There is a need for CISO's to work continuously along

enabling the use of cloud services and safeguarding

with the LoB leaders to align business processes to cloud

sensitive transactions and data.

53

Fal Ghancha CISO DSP Mutual Fund

54

Mitigating Cybersecurity Issues with Disruptive Technologies and Continuous Effort

D

SP Investments is helping investors make

The Making of a Successful CISO

responsible money-related decisions on the

Fal's journey started with the manufacturing sector,

bedrock of two simple values- honesty and

where he initially worked in IT infrastructure, networks,

integrity. This has helped the company gain the trust of

and further evolved in IT security. He has conceptualized

lakhs of investors and thousands of MF distributors and

and headed many projects in the field of IT vis-a-vis

investment advisors from across India.

information security like dashboards, identity and access management solution, single sign on, password less

The Leader of the Foundation

authentication, DLP, VPN solutions, firewalls, antivirus,

Fal Ghancha is an Information Security professional with

VA-PT, enterprise security management, policy gap

rich experience in the information technology and cyber

analysis, large scale multimedia projects, etc. Ghancha

security field, focusing mainly on information and cyber

received appreciations and awards from multiple

security policies, IT/IS projects, compliance, risk and

reputed organizations globally. After working in the

audit management, corporate investigations and

manufacturing sector for a decade, Fal moved to the BFSI

forensics.

sphere where cyber security is very important.

Fal currently works with DSP Investments as the Vice President and Chief Information Security Officer. He is

Conquering the Hurdles on the Way to Success

an integral part of the InfoSec team and is solely

The organization's goal has always been to delight

responsible for Information and cyber security

customers by providing the experiences they need using

governance, policies and processes, information security

the interaction channel that they prefer. Digitalization is

audits, business continuity planning and disaster

booming and the demand is increasing day by day. The

recovery drills, management reporting and many more.

aim was to create a more flexible and agile business can

55

“ If we look at our status today from a bird's eye view, we have achieved a lot, however Information Security is a journey and not the destination, our battle towards fighting with the latest cyber security challenges will continue to be top priority.

“ Fal Ghancha CISO DSP Mutual Fund

56

respond to the evolving expectations of customers and

human intelligence. It has an immense potential in cyber

cope up with the pace at which the company could

security. With the help of AI and ML, identification of new

change, adapt, and meet those expectations. So, we

types of malwares, simplifying complex algorithms,

decided to embark upon a journey to strengthen the

running pattern recognitions, and even detecting

information and cyber security framework. Unlike

minutest behaviors of ransomware attacks before it

earlier days, where the company used to work in silos, it

enters the organization are all made easier.

had decided to take an overall approach for the information and cyber security framework.

Anticipating a Higher Demand for Cybersecurity in Future

Overcoming Challenges with Proper Plan and

Fal claims that cyber security is in demand currently,

Framework

thanks to the emerging need of digitalization. He

Fal opines that connecting the dots were made possible

highlights that Covid and the entire WFH scenario, has

by taking the most important security decisions to

resulted in a huge scarcity for cybersecurity

streamline information and cyber security framework

professionals. Data breaches, ransomware, and phishing

and align priorities through it.

attacks have added fuel to fire. Fal believes that the

The SIEM solution was integrated with an entire

demand will further increase when the company would

ecosystem including firewalls, IDS/IPs, infrastructure

see data and privacy as primary concerns, especially, at

and applications. The framework included initiatives like

an individual level.

adoption of identity and access management solutions

“Infosec professionals, IT people and even layman's who

with automated provisioning and deprovisioning

do not understand privacy or cyber security concepts

features, streamlining governance

have shown their rebuke against the new WhatsApp's

framework.Reporting on the other hand included key

privacy policy. This shows that people are becoming

performance and key risk indicators. The end objective

more vigilant and hence new policies, cyber security

was achieved through providing a complete visibility

controls, data privacy act will definitely add more

through cyber security dashboard to the senior

demand in the field of cyber security,” Fal asserts.

management. This created visibility around information security initiatives.

A Piece of Advice to the Emerging CISO

Fal stated, "If we look at our status today from a bird's eye

Fal states, "My advice to emerging CISOs would be to

view, we have achieved a lot, however information

focus on the ground realities." He adds that only talking

security is a journey and not the destination, our battle

big for any CISOs will not give a place to the senior most

towards fighting with the latest cyber security

committee. Focusing more on small issues, reading

challenges will continue to be our top priority."

meaning between words, and finding ways to take direct / indirect feedback will help to succeed in the long run.

Extraordinary Use of Disruptive Technology

Fal concludes by saying that focusing on articulating is an

Fal remarks that in today's world, the attack surface has

easy way. Understanding and accepting the problem is

increased exponentially. Organization's infrastructure is

the first step to solve it. If the CISOs can elaborate

virtually open, specifically, post covid, that resulted in the

complex cyber security challenges in layman language,

WFH scenario and perimeter is blur now. Hence

they can get support from senior management to solve it.

disruptive technologies here have a key role to play.

He adds that artificial intelligence endeavors to simulate

57

Bruce Carlos

CISO Practice Lead—SXiQ Information Technology and Cyber Security Services

58

Steering Cyber Security Solutions to Great Heights with Remarkable Leadership Qualities

S

XiQ offers world-class services specialized in

customers where there is scope to practice end to end

cloud, application migrations and modernization

business strategy skills to deliver world-class fit for

services, supported by a full spectrum of cyber

purpose cyber security leadership. His role at SXiQ

security offerings with low-cost high-impact outcomes

doubles as a practice lead for cyber security for several

for the customer. The company is run by a team of deeply

key customers of the company including Thryv Australia

experienced technology experts, who deliver innovative,

(formerly Sensis). This gives him deep and a balanced

high-quality solutions rapidly.

cyber-business experience, great opportunities, and the

The purpose of the company is to create a lasting digital

latest hands-on exposure to current and emerging

change for all its customers, through the power of its

trends and threat profiles across the cyber security

people, its ideas, and its energy.

landscape that affect businesses, corporations, governments, NGOs, and individuals.

A Visionary Leadership for Cyber Security for the Digital Age

A Passionate Cyber Leader

As a recognized global business technology leader with a

Bruce had a true passion for flying aircraft, space science

successful CIO background with twenty-years of hands-

and technologies and this inspired him to be a successful

on experience, the role of Bruce as the Chief Information

CIO within the global defense and Australian

Security Officer (CISO) involves leading the company on

government sectors. Bruce's is one of the foundational

multiple fronts of building and delivering strong cyber

members of the Australian Space Agency and an

resilience programs and lead protection of core

active/avid member of the Australian space program,

information assets for the company as well as for the

having worked with NASA/JPL contract opportunities in

59

“ Cyber Security is one of the core pillars of our offerings to protect our customers from low-cost bases but is highly effective, - CEO

“ Bruce Carlos Chief Information Security Officer (CISO) Practice Lead—SXiQ Information Technology and Cyber Security Services

60

the mid 2000s including during on the Mars

early days was a major challenge as most of the solutions

Rover/Opportunity and Orbiter missions. Bruce's

did not make it clear on the extent of automation of what

recent roles as the hands-on tech leader leading a global

secure cloud migration could offer. It was difficult to

cyber security program also contributed to his current

relay the message to make infrastructure and related

role as a successful CISO. As such, he has helped shape

security controls someone else's problem, which was

the cyber security posture and the capabilities of global

largely hampered by the cultural change needed within

brands, providing a “step-change”, in preventing and

the business”.

protecting the business from advanced global cyber

According to Bruce the key message is that --Cyber

threats. “This knowledge combined with mitigating risks

security is everyone's responsibility within the business,

through the business lens, and formulating a fit-for-

and not just by a handful who carry the title. “After all, our

purpose cyber program that has low-cost and high

people are our first line of defense, so awareness along

impact, is considered to be my achievement. My my

with governance is vital to ensure security is practiced by

combined role as a Practice Lead which brought together

every single one in the business,” he added.

strong, clear, and engaging leadership abilities supported

So, the biggest challenge he faced both as a CIO and as a

by the latest technological knowledge, trends, and

CISO, is on how to bring all of the people on the journey,

threats, has made a well-rounded cyber leader that I

and that's why “I always start every cyber program with

enjoy,” he mentioned.

people, rather than just technology or process,” he said.

[Also, I am currently writing a couple of articles on Cyber

[somewhere I would like add…as part of what I stand

Security that are final drafts for publications into the

for…”My focus remains on doing “good cyber security

Australina and US Space Journals. These are titled as

with the lowest total cost of ownership” to build and

follows:

maintain Cyber Resilience for complex business

Ÿ

Cyber Security for 2022 and beyond – Space and

environments].

Satellite Systems Ÿ

Ÿ

Cyber Security 2.0 – The New Frontier (talks about

Getting IT and Cybersecurity on the Same Line

global threats, State-sponsored programs, Cyber

Bruce believes that every technology leader should

Defence in Space)

possess the following attributes-

The Burning Platform: Reforming Australia's Cyber

Ÿ

A true understanding of the business landscape and

Security Strategy (talks about security our Critical

vision, strategy, and culture that stands as the basis

Infrastructure and how data and Cloud plays a vital

for a successful cyber program

role in this. Also include references to Industry 4.0

Ÿ

and EVs – controlled by a central grid etc)

Strong clear engaging leadership, with 360 collaboration skills

Ÿ

Up to date knowledge and skills on the depth of cyber

Whilst the articles themselves are not yet ready - can we

security threats, technologies, and the perspective of

make a one-sentence or one-para reference somewhere

looking at the solution rather than just a software

in this article to add this flavour ? ]

application

Mitigating Challenges with Proper Planning and

Ÿ

Being authentic

Ÿ

Ability to assess what is fit-for-purpose for a given

Strategy

business environment taking into consideration the

Speaking about the challenges Bruce said, “The business

products and services it offers to its customers.

case for secure cloud migration and automation in the

61

Industry Trend Analysis is Crucial

Know Thy Customer, Know Thyself

Bruce believes it is important to always stay connected

Bruce says, “It is important for every CISO to ensure that

with industry trends, threats, and solutions for

they understand the basics and develop a template for

leveraging product innovation. And this is what makes

their approach so there is consistency. We know we

his product innovative and extraordinary while

cannot protect everything all the time, so every

protecting information and data security across

executive must start with understanding what their

organizations.

crown jewels are and how to protect them as a core, and then work around ancillary requirements”.

AI: The Primary Disruptive Technology

“They must always take a strategic view before refining

Bruce says, “In the past, security was largely confined to

their approach to tactical or purely operational and

infrastructure and some aspects of the network. Today,

recognize and start with their people as people are their

this is very different and complex. In addition to these

first line of defense. Also, culture is often one of the

two, there are eight other core domains that every

greatest challenges,” he added.

business and leadership team or board should

Bruce asserts that every CISO should make sure that

understand. These are- cloud, identity, endpoint,

they have a good mentor who is a full spectrum leader. He

applications including PaaS/SaaS, data security, security

believes that transparency goes a long way in ensuring

operations, DevSecOps, governance, risk and

that all the decisions are risk-based and that the

compliance and the often-missed third party/vendor

responsibilities shared on risks are hence not mitigated.

security”. “AI is one of the primary disruptive concepts

This shows how Bruce is totally aligned with ethics and

that is applied across this entire spectrum, in both

workforce that makes him a leader who everyone should

creating threats and the protection and prevention of

look up to.

cyber-attacks” Bruce added.

62