Why Security Debt May Be a Bigger Risk Than Security Spend

Hi, I'm Joan Goodchild with CSO and welcome to another episode of Cyber Sessions. We are here at the Cso Cyber Security Awards and Conference here in Nashville and we are joined today by Salem Icy.

He is a veteran CISO or CISO I should say with companies like Visa, Ellie May, Blackhawk Network just to name a few and he is also a hall of fame inductee this year at the cyber security awards and conference. So we are thrilled to have a conversation. Welcome.

Thank you. Thank you. Glad to be here. Yeah. So, let's let's start by talking about you're going to be presenting and you're going to be talking about security debt. So, the session kind of reframes the conversation from security spend to security debt. So, let's talk about that.

What do you mean by security debt and why do you think it's becoming a more important indicator of organizational risk as opposed to the cyber security budget itself? Yeah. Uh that's a really good question. And I think uh let's stay let's set the stage first.

Uh yeah my definition of security debt is the accumulation of risk because of uh investment in areas where um complexity is added. um you know lack of automation is is is you know exaggerated and also um you know overcompensating some controls that are not needed.

So, so that means that you know if an organization um you know keeps spending money um you know without the focus on um simplifying um you know the security controls um automating what needs to be automated and most importantly adding resiliency you know to the organization to me that's tech debt I want to also tell about the common definition of of technical debt.

Um most commonly technical debt in ter in the area of security is defined as uh the accumulation of vulnerabilities that are not patched. The uh over complexity of of you know um uh the lack of understanding of the of where the data is.

So you know most significant organizations especially in fintech uh they have a huge volume you know also velocity of PII and health tech it's PHI and um security debt in that area is really not knowing where all the data is in addition to the fact potentially that it's not protected in in some areas um uh so in addition to data I am Overlaying of overlayering of security tools is another tech debt, right?

Lack of automation is another tech debt. So I wanted to give you two kind of orthogonal definition of tech debt. Yeah. To me tech debt is more um risk.

I think the general definition is you know overlaying of tools and you know lack of knowledge of what the environment looks like. Mhm. I think the two kind of get together, you know, kind of, you know, you know, in agreement, but they're slightly different.

And I think over the conversation, we'll talk more about risk and resiliency and all that. So, you you talk about, you know, um adding tools too, as you just mentioned that.

So, you know, a lot of organizations they add tools and, you know, they add more platforms, more controls in response to new threats. um but it doesn't necessarily reduce underlying complexity when they do that.

So at what point does security investment actually increase more operational and strategic risk instead of less? I think there's a tipping point where the once a a reasonable defense in depth is in place.

I think also once any reasonable level of automation of you know the majority of the uh you know security controls once a reasonable level of cross integration of the security tools anything beyond that could potentially be you know overspending and could potentially add risk to the organization you know to the entire company.

Um so how do we how do we know when you know we have an environment that doesn't necessarily need you know 50% increase in budget. Mhm.

I think all of the KIS and the KPIs that are in place should be able to indicate you know the the level of resiliency in addition to the other controls such as making sure that um there there are processes in place that would allow for um you know detection of let's say u you know API abuse cloud type level abuse and and these days AI you AI is adding yet another vector you know a threat vector you know to the entire you know um you know organizations.

Now you've worked across industries you know financial tech tech industries you know we we named several right up at the top there.

What patterns do you think that you've seen among organizations that make them truly and genuinely resilient as opposed that uh to those that just seem sort of mature on paper? Yeah. Um let's let's perhaps start with the um latter part of the question. Yeah.

I think a organization that is you know paper mature is the organization that you know mainly focuses on policies fine-tuning the policies over time. an organization that mainly focuses on compliance and checklists upon checklists um frameworks upon frameworks and there's an abundance of those across the industry.

It's an organization that focuses on you know audit you know and governance uh which are all important but they should not be you know the the main focus.

I think an organization that's mature, you know, and I've seen many of those and I've built, you know, several of those is an organization that is a security organization that is architecturally designed to be resilient and resiliency means you know different things to many different people. Yeah.

Um to me resiliency means that um you know recoverability is tested often you know making sure that in in in case of a event in case of a you know breach case of lateral movement you know the the the company can react you know according to a very uh clear playbook that's been tested over and over again.

Mhm.

Um and two, I think a resilient organization is is one that you know has the right controls of the right places that have been tested over and over again and that also have metrics around them that indicate you know if you know in case there is an event and also how well the the tools are are working.

Uh so let me give you an example. You know an area which I'm I'm really passionate about over time because I've been in fintech for over a decade is data protection. But how do you know that the data is protected?

You know a resilient organization doesn't look at whether the data is encrypted at rest or not. A resilient organization is the one that looks at the entire life cycle of that data PI. Meaning that the organization has very clear discovery mechanism to know exactly where the data is.

The data could be on laptops, on servers, in public cloud. It could be many different places. Data can be structured, can be unstructured as in documents.

So that first step is knowing where the data is you know part of knowing all of the company you know the critical assets right and then the data in transit you know it needs to be protected with the right you know protocols that are always updated make sure that you know we're using the latest and greatest of TLS you know protocol not older ones and then also data in use you know data could be stored in memory for processing.

But how is that protected? There have been breaches in the past where data in memory has been stolen. Um and then data at rest.

Okay, again I think many organization that I've seen, you know, only focus on protecting data at rest but the whole life life cycle of data.

And then you know lastly you know protecting the data in in in storage you know means that we need to monitor any data leakage okay so how do we monitor how do we make sure the data doesn't fly out of the organization so that's what I call resiliency versus a point solution right when it comes to paper mature organizations they have probably hundreds of policies and standards around that and they could be complying to nest you know frameworks but they don't have the resiliency that I mentioned.

Yeah. Okay. So it's just paper maturity. Yeah. Yeah. Interesting. It's an interesting perspective. So boards and um executives they're demanding sort of a clearer justification now for cyber security investment especially you know in this difficult economic climate.

Although I I I can't remember a time in my 20 years of covering security when you didn't mean to justify what you were buying.

So, how should security leaders communicate tech debt uh operational fragil fragility and long-term cyber risk in business terms that the board can actually act on? Yeah, really good question.

Um I think the the board and being a board member, you know, today um I think the the board really wants to understand the risk. Yeah. And anything else could could potentially be perceived as noise. So let me give you an example so that we're clear on this.

I see many CISOs out there taking metrics upon metrics and dashboards upon dashboards of all sorts of variations of know vulnerability management for example you know uh you know probably 10 20 metrics just around vulnerability management. Mhm.

But at the end of the day, you know, what the board really cares about is what is the risk to the business if the most critical systems are not patched or perhaps the most critical system that are externally facing are not patched.

Anything anything else could potentially be perceived you know as noise. So at the end of the day as far as the board is concerned what is the business risk?

I think CISOs should speak in terms of impact of any real or perceived threat on the business and be specific.

So for example, you know, going back to vulnerability management, you know, let's say there is a zero day, you know, that was patched or maybe multiple ones that were patched. How do you explain that to the board?

You know, you know, you tell the board, well, we patch five zero day vulnerabilities. And to be honest with you, the reaction is probably is like, who cares? Thank you very much. Who cares?

Yeah, I think the story should should sound like, you know, these five vulnerabilities if unpatched.

Okay, we you know the the uh systems XYZ could have been down for 3 days or it would have been much easier to an adversary right to um you know to attack this revenue generating system and at the end of the day what's the what that's what the board cares about it's it's the impact on the on the revenue right and and that's really how we CESO needs to speak to them now I'd like probably talk about a slightly different but related question which is you mentioned AI.

Um AI in in in my mind is perhaps the only technology that I've known about and probably that have ever existed that you know where the innovation came before the policy and the governance and security. Yeah. Security didn't get a seat. Yeah.

You know from the beginning when it comes to AI. So how do we explain to the board that potentially um if developers start sharing the company's source code with claude could potentially leak or public version of cloud could potentially leak.

I think this is something that we are all trying to figure out as we speak. Uh there have not been significant breaches because of AI that I know of. So there is no precedence here.

But I think we should start speaking to the board from business perspective about the benefit of AI to the security organization to the security tooling to um um you know security operations, how it could be more efficient, how could be more effective and at the same time highlighting some of the some of the risks to the organization.

not theoretical risks but risk related to the organization you know specific example if it's u you know financial institution and AI agents are deployed you know in some transactional application I think this is should should be able should should speak to the board about the business risk of not deploying you know the necessary security tools you know to ensure that those EI agents don't go rogue that you know um the LLMs are private potentially are protected.

Uh so those are the the the business terms we need to speak to be speaking to the board. Yeah. Okay. Well, Salem Icy, thank you so much for joining us today. Very welcome. Thank you. Glad to be here. Yes. And uh thanks to you for joining us.

We've got lots of other videos from here at the Cso Cyber Security Conference and Awards, so please check those out, too. For now, I'm Joan Goodchild with CSO. We'll see you next time.