Think Outside the Job: How to Shift Your Career Mindset

Brought to you by ExoBeam, I'm Steve Moore, and this is the new CISO. Gideon, thank you so much for being here with us today for the uninitiated as I often say. Who are you and what do you do? Well, first Steve, thanks for inviting me. My name is Gideon Knocke, I'm the CIS of a healthcare IT provider, which means protecting 10th of millions of patient data, and I'm also active in the risk-quantification community, and I do occasional considing as well. So I definitely want to talk about what's unique in healthcare. I think there's several things in risk-quant, actually, when we spoke last time, I don't think we even got into that, so that'll be a fun one to kind of pick your brain on. I think humans in general are bad at that in general, right? So then take something that's a little bit abstract, and I think we get worse. So I'm always curious to hear how we can be better at that. Before we get into that, how'd you get your start? You started studying cyber security kind of at an early age at university. Tell us about that. Well, I started with that topic in 2009. It was the bachelor's, that was just entirely cyber security already, and back then this was a quite novel thing to do. We were just a bunch of nerds trying to break things, and yeah, it sort of just started there. I was just lucky that this topic became huge in the end, so after I finished studies, I went into consulting, and yeah, from there it took a few twists and turns, was mostly in finance and healthcare, but then ended up dropping all of that and working in IT startup, and now I'm back to healthcare and sort of all the different things start to tie against. So you talked about back when you were in university in a little bit after you made a statement that you were not as good at breaking things. Why did you think you weren't good at that? You also said that you were more on the social side, and that's why I think when you, one of the reasons that may have led you to going into consulting, but why weren't you good at breaking things? Well, I tried to certainly, but it tend to take me much longer time than my friends and university, and I also just, it was just, it didn't feel really like this is where my, my skills are, or this is not what I want to do in the long run. And I found that consulting will be the right thing for me to sort of bridge what I know from a technical standpoint, but having a job that requires me to talk to people and be in a social environment. In your opinion, going into consulting, what's the most important skill to have? If there's the one, the very first skill, what should you master? The thing with consulting is it's a kind of job that requires you to have the least skills when you start with it, because it is so broad that in these organizations, you will learn so much on the job that you can start from basically wherever you are and get into consulting and sort of figure out what's required there and how to, how you work from there. And I think in a first position when starting and when starting and consulting really is to understand what not just your superiors want to see, but also what the superiors of your superiors want to see that you maintain visibility, because you're an approach and of course what matters most is that you do a good job and what you do and that you get to learn the basics. And really just doing a good job is not enough, it has to be seen and it has to be relevant and it has to be relevant for those that have your future in mind. That's an excellent point. Honestly, that's true for consulting, but it's I think a lot of security programs fail this as well, maintaining visibility, being seen and being relevant to the people that are multiple levels above. I used to say that running an analytics department, so cybersecurity analytics was the last group that I helped build and create and ultimately led that we, more than anything else, this was controversial, we were a media company, we were a media organization, we were content creation and we were storytellers and so you had to be seen, which is sort of a maintain visibility, remind people that you're still there and find a story, find a story to send out. What was the most interesting thing we found this week and then let's create an email or a message around that, which seems to be what you're referencing here, different as a consultant, but maybe not that different. Not that different and this, I came up with this because I had a story in mind of a colleague who was working for years in the same job, aiming for promotion, he worked really, really hard and he was just not making it, after three years he left frustrated and later on I learned that he just lost a very early in these three years, like he got, he didn't make the right friends and that caused essentially him to just never be promoted, he didn't have it transparent and he didn't see that. So he kept doing a good job but he lost already, he didn't have the credibility at those who would have it in hand to promote him. So when you work, you need that transparency that your work is not just good but it's seen and it's not just seen but it is relevant and it's not just relevant to your, the company you're consolidating or to your immediate superior but also higher above. So you sort of become a part that extends beyond the scope of your day to day. But this person, this colleague of yours was a good employee, correct? Yes. You know, I've encountered a couple of times in my professional career where especially in leadership circles where you might inherit a team or you're having people apply for jobs and you hear whispers, oh, this person is no good, you know, they're a problem. And sometimes this is true but other times I'm surprised at how the perspective of that leader is wrong about the person in question, there's been more than one occasion in my career in, as a director and as a, as a VP, where people were presented as problems and they were maybe a little bit of a misfit but they were actually excellent workers and they were trustworthy and they could do great things. They just, they didn't have an advocate and these are people sometimes were 10 years at a company, right, and sort of struggling. I think, I don't know how to best say this, but having a knack for finding those people, I've seen the greatest turnaround. I mean, these, sometimes these folks that are seen as misfits as the term I'll use are some of the best employee, like you can get the most work done and especially when they see that they have an advocate, they will run through walls. Now, you still have to kind of help smooth out the rough edges sometimes, but I love looking for those people, especially when other leaders told me, oh, they're no good. Because I like being a contrarian anyway. So from a leadership perspective, not as an individual contributor, but now as a leader Gideon, how does that make you feel? Like what perspective do you have now? There's so many to unpack there. Now, it is sometimes out here of excellent working people, but they're not the kind of person that need to take credibility for everything they're doing. So they might be actually those who take the most responsibility and just do things because it's there. It has to be done. And these are excellent people to work with and they might run until exactly what you just described. They might not be seen or they just might not be having the right or built right connections to the right people. And they might miss out on that person that stands in front of them and actually protect them so they can excel in the way they are good with. So it depends a bit on which, which role you are as a leader. You got to find those people because you need a broad range of skill side. And then if you have just people all trying to say the right things, then this would just not work. You need these people that do an excellent job and drive pleasure from being good in that one thing. So you have to have them. But at the same time, they might just need a little bit of understanding from other people that they might have, that might see them as misfits and just see what's driving them. What are they afraid of? And this might help because if you ultimately understand you work with human beings and leaderships, also just human beings, and they might report to someone else like, who's what's driving what's driving them? And do I see that as well when I went on prison at Topicalwood? It's interesting and this just occurred to me. I'm usually better at seeing patterns than this next statement might indicate, but one of the things I just realized, wherever there was these good misfits, so people who were good employees, and I say misfit in a not in a bad way, but sort of misunderstood, you know, good workers, typically, as in you said this just a moment ago, they weren't looking to receive credit for their work. They just wanted to master their work, right? They just wanted to get the work done. But these misfits, almost in every case, there was someone who was near them, who was either slightly malignant or malicious, slightly, or somebody who was also often sort of taking the credit, so the standing out in front, meaning they were sort of malicious visibility. Or parasitic visibility, so they were visible. They did a lot of speaking, and often would represent the good work of others. Those things were often, it was almost like you have parasitic animals in nature. You have a lampry that'll hook onto the edge of a shark, as an example, as you know. It's this sort of, it's interesting how these things form, and in three examples I'm aware of that they're coming to mind right now, that condition was true. Now, it doesn't mean it's always going to be that way, but it's a strange coincidence that just sort of dawned on me that there was, said simply, there was someone else getting credit in many cases for this hard working, but maybe misunderstood individual. Let me ask you that, have these people that took credit also take credit for if something went bad? Well, yeah, yeah, no, typically not. Usually those same people, speaking in general terms, from what I can recall, what memory serves, no, it's usually accountability was very low as well, right? There was, yeah, so that's the trend at least among, you know, it's n equals three in this example, but yeah. Exactly. If you have someone who is taking accountability, there are no problems in taking a debitability to say, well, let's say I'm doing whether it's wrong or right, but they would do it. If someone that is selectively exposing only good things, that's not someone that takes accountability, that's how you can spot it. You know, that's actually a really good interview question I was just thinking about. So what's the last time, and I'm just asking in general, not directly to you, but tell me the last time you took responsibility for a failure, because that's the product of if this individual is going to take credit for success or someone else's success in this example, but I want to know then, well, when did you take credit responsibility for a failure? I may adopt that question for my bank of questions I ask. I think that's a great question. Yeah. I think that's relevant. I know it's such a sea. Like what do you learn from doing that? Is it how do people react when you, when you said, well, I screwed up there? Or even better, if you have someone in your team, and that person might have misperformed or did something wrong, well, if that person's lead standing there and take the bullet, what does it tell you about that person? And you might have, then, in turn, a few discussions after that, but when it comes to the outside world, we had to put a position themselves. So I will share this and those that have listened might have heard me mention this before, but one of my old leadership philosophies, and I have a slide that mentions this, I used to talk about leadership and career management during a breach, and there's a, I still have, I still speak on a variety of this, or a version of this today, that's a culmination of a lot of different experiences, but one of them is, and it sounds a little corny. But it's, my rule was, when I lived this, the team owns all the successes, and I own every one of the failures, I own every damn last one of those failures. So I took the heat for anything we messed up. Now, you got to have a team that, that understands both the good and the bad with that, right? And my team did, but that was something that, and it can be expensive to live by that rule. I will tell you, but more often than not, it was a very good way to work and live and try to really live my type of leadership, the one that, the type of, to become, or try to become the type of leader I wanted to be, and one, and still want to be, and it's, it can be a little dangerous, and a lot of people are uncomfortable signing up for that, for good reason. But my reason is, and I'd like to know your thoughts on this, the reason is, is I needed the entire team to take risks, and I didn't need them to be afraid of failure. I need them to innovate and take risks. I need them to attempt to match the energy and the velocity of the adversary. And so I need them to know that they're ultimately safe, that there was this giant crazy guy, 15% insane was always what I say, I'm 15% crazy, that will take the heat. So that's the lineage of this. But I never thought of the question of the sort of taking credit for failure. So thoughts on that. Well, if you take the failure on your own shoulders, now how does it look to those that you're brought to, well, what do they need, do they need a perfect person to the perfect team, or do they need someone that stands there and says, I do these things here, I, I control it. That would be good thing, that would be bad thing, not everything works perfect, especially not in a, in a brief scenario. And while everybody is thing appointing, you stand there and say, well, that's how it is deal with it. Like we, we have a problem here, I'm here, I'm taking the responsibility, we're looking forward, let's go through that, everything else is not helping. If you have such a person in the role, then this gives me much, much more confidence and that this is better handled than if you have someone there that says, well, that person there did that, that he said that she said and, and you're just not having anything that you can grab and you're not never talking about the actual issues or the issues are not even brought up. So it's actually by doing that, you might take the heat, but the only other option that you have is to bring the heat further down and by that you're just even elevating it, it even gets worse. That being said, a friend of mine actually challenged that and said, if you're providing a super secure environment for you onto experiment, there will be a lot of entropy. Like people work in different directions and where do I get the honest feedback that what they're doing is wrong cause of action. So if you do that, at the same time, you've got to be transparent and you've got to actually show people that direction they have to had to so they can develop to become the person that can take the heat by themselves. You do need a high degree of internal team candor and to share all of this for the exact reason that you mentioned. Otherwise what will happen is as you will be overly hardened to all of this and they will not be exposed enough and so they will be frail if directly exposed to these conditions, especially in a large politically charged company. Each company has its own personality, but especially big company culture can be quite treacherous, I'll say at times, depending on the culture of the company for sure. That's actually one of the reasons why I stepped on from a very large organization or just working in general in large organizations to smaller ones because that changes how people communicate. If you talk to, in a large organization, the one that you talk to might not even have the same interest and the organization to be successful or they have three, four more reporting lines going upwards, they're so far away from each other. This might be a challenging environment to actually speak what you have in mind and how would you do security if you don't have, if you're in a political environment and you cannot say the things that they are? Yeah, yeah. If you have to self edit, you have to get very creative on the way you communicate, that's for sure. I want to spend a second on when we spoke before shifting gears a little bit, kind of related actually, but you talked about sort of earlier in your career, you weren't networking enough and you said your words were you failed to make more friends, I assume work friends and you made the comment along this that you didn't, you said you didn't understand your superiors. You kind of mentioned this earlier and the end thing was that you were very content focused. You kind of hinted at this, but maybe go back to a little bit, you know, the idea of being seen as an asset and not a person, I think that's an important concept. We hit on this a little bit, but I want to put a pen in that because then that caused you kind of changed roles into a more strategic position. But how do you avoid being seen as an asset or just an asset and not as a human as well? Talk to us a little bit about that. Well, what I did was or in hindsight, I would say, I was very content focused and I was under the belief that by just doing the good thing that I'm doing on a daily basis as well, this will get me anywhere. And I wasn't seeing the broader context of my work. I wasn't understanding what it actually required and I didn't build a communication channel to even figure out. So my work was confined to whatever I got essentially into my mailbox in that day, in that I was working on and then I left the office and I wasn't getting anywhere. So what did I do wrong and I didn't really understand that and that changed over time. But I think there was this one thing that really made me realize that I was when I started to work in risk quantification. So there was a very niche topic, I was not finding much resource on it and I was nodding all about it and I really just needed help. And what I did then was I was writing to every single human being in Europe that would have touched the topic. So I wrote more than 100 people I wrote on LinkedIn approached them and just like, hey, like financial institutions and insurance companies and like, what do they know about this topic? Only to figure out like people, they had different ideas and concepts and they're almost contributing but like nobody really know the truth about it. But that was the first time I actually started to look for people outside my own organization and which then ultimately led to me writing an article. And I had a, I was having a talk about it on a conference which led to another talk. And by the time people wrote already know me and I would know people, so I was going there and something changed about my job, something changed, it was not stopping at where, when I leave the office, it was not stopping at the end of my list of things in my mailbox. But it was a much broader scope. I would know people, I would make friends in the industry and we're all talking about the same problems and that made me realize how, how important it is to get that perspective, that network that made me feel like I'm on a track now. And the same happened down in Tong only, I was, I was not afraid anymore to approach people higher up in hierarchy and I was also not afraid to speak my mind because I would know what they need, so I know what I can say. And before that, I was saying thing that I believe was right, but I was just, I was by that, I was doing something wrong. I was most likely stepping on the worker from someone else, like someone put a lot of work in there and I come and I come with best practices or whatnot and say this is all shit. Like the feeling of like understanding, appreciation, networking, and also your organization that changed for me. So what came first, I mean, there was an action that you took that then gave you many benefits and then along the way you recognize the change and you recognize the benefits there. There's a trigger there. So you became interested in the topic that is maybe to some misunderstood risk quant, risk quantification for information security. You reach out to a bunch of people on LinkedIn trying to get some help. But why did you decide to reach out to people on link? It's like, you got interested in that task or in that concept. Why did you decide, you just, you were, you felt like you weren't getting ahead, I'm trying to figure out the trigger that led to these many other benefits. So is this, is this an, I think you told me once that you've had, you had a career of accidents. Is this just a positive accident? Yes, this is an accident, but what preceded that is trying to do it in different ways for many times and just sort of not being successful is it? So it's just like you, you try something, you learn from it and then eventually you try, to try to go into a different direction and suddenly something is working. And only then after, after sometimes I noticed the different flavors that made me successful them, which were not making me successful before. And I think, I think the second point there is, it's an accident, but there's different kinds of accidents or a lack. So let's say when I started studying security, how could I know that this topic is becoming so big? Like I couldn't, right? This was a very positive accident, but I had nothing to contribute there. It was just, just random, it was just chance. Now, getting into that point where I noticed I need to be driving things, there has to be a change on it, the change is an opportunity I need to have exposure. And that exposure just led to so much more opportunities, like holding a talk on a conference, for example. Like these were not doors, they were just not open before and they came because I was having more exposure and I was actively pursuing exposure. And just with a tiny little reward that came out of that that made me realize that's working. And over time, your exposure becomes so much that you can become better in strategically picking what's right, what's working for you and dropping other opportunities that might not work as well. And lastly, it's about the skills that you develop along the way that make you very unique. So take you as an example, your security to ship, you're very well spoken and you have a fantastic voice, so who's going to take a job? Nobody can take your job, right? It's the combination of skills that are very hard to come by. It made you excel in your current role. And these are the different layers of things that give you new opportunities. And it's all accidents, right? But it's the flavor of accident changes by the things that you put into the game. Yeah, that's an interesting way of phrasing this. I think, you know, activity tends to be get other activity and other opportunity, right? Had you not reached out? Had you not, you know, the folks on LinkedIn, had you not decided to do a presentation? I'm going to guess that before then, when you started to do these articles and then conference talks, had you done a lot of public speaking before, like outside of work? Oh, no, not at all. Yeah, so I mean, that, I will tell you, it's a side story. I can remember going, well, two things, I can remember reading security magazines when they were still in print. I'm old enough for that. Used to get them. You could sign up for them and get them and reading them and thinking, I don't know half of what the hell's in this magazine, like I don't know these topics. I'm not, you know, I'm confused. So first off, feeling that way and then going to conferences and really one day, really wanting to present, but believing in my mind that I would have nothing to present on, like not being able to think, I have no skill to present on, I will, I don't have the ability to present, not only from a content perspective, but also then from a delivery perspective. So I don't know what the hell to say and I don't even know how to say it. And crossing over that line and getting to the point where, you know, getting published in that magazine I used to once read was pretty crazy for me. It was, you know, kind of almost an emotional moment. And then getting up and not only giving presentations, but then giving keynotes and then getting paid, getting paid to deliver a fair amount of money to deliver keynotes. I can remember telling my father when he was still alive, you know, what I was going to get paid and, you know, his response, his response immediately was, oh, bullshit. You're not going to get paid this, right? And so I share all of that, not as a humble brag, like many will sometimes do, but maybe as a weird source of inspiration for those listening that feel the same way and feel the way that you used to feel. And it's kind of fun to look back and kind of smile at those moments. Just don't stay in that mindset, you know, force yourself to give a talk. I used to use a sweaty, nervous mess. I still have to be honest, is that the one that would change? Even if it's a subject that you're really passionate about and excited about and you feel like you have good information and good slides and you still get this way. And how in the beginning, like, during these things for the first time, I mean, you've got to start with what you have, right? And I knew there's content that other people can't put there. So I was really focusing on that and I really tried to lay down the content and the delivery was just, okay, it's, it's the first time. What should I do? It has to be the first time at some point, right? And it sort of worked, well, you know, it was, I can't say it was overwhelming that I was proud. I did that. You know, it's, I'm not the kind of person that likes to stand there and just, just wings it. I have other people that that noticed the day before they hold a speak on a talking conference, they owe shit tomorrow. I have to do that. And then they put something together and they deliver an amazing talk. I can't do that. You know, I was, I was eating it up with plenty of prep work and really, really trying to, to focus on, on making my key points. I was talking so much and then half of it, I wanted to say, I couldn't even say, there was so much more, I wanted to say, but there was, there was the first and then there was a second, it got, it got easier that way and then delivery became, became more important than it was before. So, okay, content has to become a bit less, like I can't just put it all out there. People would just lose me their head, like 10 presentations before that. How much do you remember from all of these? So that changed a bit and yeah, I mean, I mean, I think it's just to get started. I think that's like the one thing, you just got to do it and it will not like become comfortable the next 10 times or so, but it, it just, you like, you develop by doing that and ultimately, you can be the moment that you've done it and then people talk to you about it or have questions or just see you or just see you again because you've been on a conference before that. And this is so rewarding that I think it's really worth it. It is a funny thing. What ends up happening when you start getting noticed for your work, outside of work. People begin to develop ideas about who you are in a very strange way. It can be, it can be a little strange, I've talked before about even this podcast as a kind of a passion project of mine and the effect that it's had on parts of my career. Even getting noticed, I had someone stop me in an airport once and they were, they said, I know you and I have, like, I don't know you and they recognize my voice because like, I listen to your podcast and what a strange, but magnificent thing. What an interesting opportunity to connect with a person that I would have not otherwise had the chance to meet, right? And so the other thing that I'll state that's incredibly important, when I first started presenting, I would have these very dense slides and dense ideas and it took me a long time to realize a couple of things. First, I now have very minimalist slides and I attempt to be a great simplifier. The other thing is, is early days. Being a former technician and engineer and intrusion analyst and architect, I would speak very, very quickly and as I would get more excited, I would speak faster and you are speaking about dense topics quickly, you will lose the audience and so one of the things I've worked on greatly in the past five years is, actually even longer than that, I'll say, is delivery of not only what I'm saying but how I'm presenting it, so actually the rhythm of my voice and utilizing negative space, so utilizing I pause like right there to make a point and working on these finer points is probably the most difficult thing but strangely the most rewarding to how do you maintain the attention of a room utilizing how you speak and if there's a point you really want to make, raising volume, changing gestures, these things, these small subtleties, getting into that and thinking about that on the fly is reading room, watching you know body language, all these little things is incredibly fun to me, so you said the same thing in a different way but figuring out the best way to present and getting better that is is the next chapter of this fun sort of self-test and journey. 100% and what adds to it is you get the instant feedback that otherwise is solved missing from our daily work because you just sit there and you see the people and you see how attentive they are and afterwards you eventually get together and you talk about it right and you see what kind of messages stick to them. Now this is also a good point where you can get some feedback, one person won't set to me well, when I talk it's like wee wee wee wee wee wee, it's like I cannot find the end and as you just perfectly demonstrated like was down, put a pause because you just made the point instead of going from one point to the next point by just increasing the voice at the end of a sentence, I'm not an native speaker so there's so much more I can improve that it's just not natural for me when I talk in English but this is one point where I really thought okay I got down even for just for myself to to pace myself I gotta drop the voice and make the stop yeah yeah and I mean your your English is exceptional having it is your you know third you know second or third or whatever language and then working on the tonality within English I would think and I don't know I'm my Spanish is is bad and every other language I speak is worse than bad but I think though that the the method of speaking and adding and I pause and slowing down and simplifying I would think would be universal but especially adding a pause I think that translates I think and I think we all could do more of this the simplification and then understanding when do I need to pause for emphasis or when do I need to raise you know raise my voice a little bit or maybe maybe lower it you know if I'm one thing I've talked about on the show too that you might find interesting I used to have a little bit of an I don't maybe I've never talked about this I used to have an accent and I worked to remove it because it it sounded to me to country to maybe a little bit southern or maybe a slightly appellation is what we would call it and I remember watching the national news of an evening as a young person and thinking that the person on the news didn't sound like me so this is a whole nother weird element of communication right so word choice and removing some of the southern accent was another kind of strange thing but your communication is fantastic it's always a journey to work on tonality and the the pace of presenting as you get older and more comfortable that will get I have found for me it has gotten better now there's a risk when you start off speaking to think of all these things in parallel like how do you stand how do you look is this if the content okay is your accent fine is your tonality fine there's so much thing that I can I think it could the risk is that you make the barrier too high to get started so so to start really I think it's totally fine to talk fast to talk high to to deliver plenty content because there will be people that are very appreciative of the content that you deliver and most people are not present in the first place so but what you just said is that you derive joy from actually improving not necessarily on the things that you want to say because that you already have cleared it's in your head but to have it communicated in a way that people will remember and I think this is the second step that you that you can take to say what content I know and now how do I need to say it so other people will say it so other people can remember it it may also mean adding a story or an example you said something very important there though and it's for anyone listening you hasn't gotten started yet ignore everything I just said ignore it as Gideon said effectively just get started you can be very clumsy especially when doing things outside of work and just getting started and saying hey I'm trying to get better I'm going to contact 100 people on LinkedIn about risk quantification and I'm and I don't even know the right way to ask I'm just going to see what they're doing right so that that is the way you do it you can be sloppy you can be you can make mistakes I think that the first lesson is just get going just just move action will will bring opportunity almost always especially in the field that we're in especially in a field where activity is rewarded and we are working with our minds and that is enhanced by being social and working together and and you know being in a community right I think that's the piece and honestly I was just listening to a completely unrelated show we seemingly are losing the idea of community globally so we became much more connected online as we are right now but the sense of belonging in community is dwindling in most areas of the world and so when you're in a position where you are doing things like this you are forcing yourself to you're creating your own little group and that's a extremely healthy thing so there's probably some I'm guessing Gideon doing all this stuff you probably feel better about yourself that you have achieved these things there's probably some pride and some some excitement and some energy that is greater in your mind because of these things there's some resiliency that comes out of it because you see how people were to like what does that work even mean it should be people that you actually like to talk to not just people that are just they are working in the same area maybe so so having people that you you like to talk to that you can talk about things just gives you such a much broader basis for and and also security in terms of what you're doing in your day-to-day in within your job I want you to tell all the people so it gives you some it gives you a good baseline so so that's the first thing the second thing is if your work becomes the one the context of your own organization then there will be opportunity not necessary for it could be a change but let's say for like a podcast or holding holding a conference talk or taking a side gig or just or just to meet interesting people you know this is this adds complexity in a in a very wanting way that I think makes makes it much more enjoyable as opposed to the mindset of okay I start my laptop now and I work and then I stop and and it's been done with in terms of mindset even if you do the same but but the mindset is a different one so we are almost a time I've got two more questions and one is very simple and one is our closing question but in two or three sentences what's the most important thing to remember about risk quantification we didn't even really define it but I need your like the shortest definition as it relates to information security what's the most important thing to remember about risk quantification since you are no more about it than I do I'm sure and in terms of the way that it to do it correctly so first thing would be we quantify risk all the time let's say you stand on top of a of on on water and you want to jump down and if it's like 50 meters you won't jump right if it's one meter you will jump but then you know but if it's like if you're maybe on 10 meter then or 30 inch sorry it would be that's when you quantify and that's when you think okay how deep the water be and I see everything have have people been jumping down there before so whenever you are on a point of uncertainty then you quantify you don't quantify for the sake of it but it is really just the process of finding data because you have a decision to make and you don't need to come up with a final final number or something like that it's just whatever you say if you have a critical decision to make you just want to have enough data to be comfortable in taking that decision so that's one thing the second thing is insecurity we are very focused on reducing the security likelihood of things like we don't want incidents to happen but by doing this by centralizing everything we're lowering our risk but we are completely neglecting the security impact of those high risk scenarios those ones and 100 year scenarios we're not really looking at them we actually facilitating them by introducing systems that just control everything including the ability to make widespread ransomware attacks and that sort of thing even possible so having a quantified mindset really helps in decision making and but it does not have in communication whatever you communicate you have to communicate in qualitative terms you got to have an opinion about the numbers you can't tell someone your security risk is that much million in the next year you've got to say something like we have more resentment shoot and we know that because we looked at the numbers but you've got to convey that in a message interesting I think that's a good I mean it's more than two sentences but it was an excellent breakdown and I absolutely appreciate it and I know our listeners will as well we should have spent more time on this actually because it's it's I think we're bad at this analysis I think many organizations are bad at the decision-making you know of they they don't even know there's lots there's too many unknowns and into they struggle with that and then when they communicate attempt to communicate risk the way that they choose to communicate it they begin incorrectly but then the organization gets used to they get they get accustomed to this bad data bad you know bad methods bad measurements and then they're kind of addicted to these bad measurements and they keep wanting the same method so if you go to try to correct it and actually make it better you get resistance I see it all the time so they expect to see something like the number of viruses right or number of port scans on the perimeter that's nonsense information it's a waste of time it is what are the number of you know how many waves hit the beach each day well right this this doesn't allow us to make a decision it doesn't allow us to identify a problem these kinds of things right so I appreciate the the idea there the information shared is there anything else you any other comment before we get to our final question I think if we dive into that topic then we've got to be here for another show and then maybe that's something we'll do maybe we'll do that in the future yeah so as we end every show on and as I almost always say pursuant to the name of our show the new CISO what is being a new CISO mean to you Gideon so let's say you're joined a company and the company doesn't care about security they don't believe in security so let's say they do believe about customer service now as a CISO what do you do now you can try try to drive culture change to get the company to believe in security but this would likely not work what you might do in status just appreciating what there which is let's say good customer service so how can you make that even better you can provide documentation for for customers about security so they're better informed and customer service will be even happier so what you want to do is to actually look at what people believe in what drives the company what's what's the beliefs what's the values what's the opinions of that of your peers and your superiors and you'd adopt them and you work with them and you build your security on it because then you can whatever discussion you have you can always bring it back to that very same basis to that commonality the common understanding of the organization and I believe a security function a security leader should be able to really start with that start with what people believe in and start there to put your security excellent advice start with beliefs Gideon thank you so much for your time today thank you for being a part of this virtual mentorship experiment that we have here this has been an absolute joy oh fantastic thanks so much for inviting me it was a pleasure that is it for this episode of the new CISO thank you for listening check out more episodes on xbeam.com/podcast remember to rate, review and subscribe to get brand new episodes first