CrowdStrike Fal.Con 2024 | John B. Sapp | Texas Mutual Insurance

theCUBE.net

Clips
More from CrowdStrike Fal.Con 2024

John B. Sapp

VP, Information Security & CISO

Texas Mutual Insurance

play_circle_outline Quantifying risk in financial terms for executives and the board

play_circle_outline Human behavior risk and insider threats in cybersecurity

play_circle_outline Budget allocation for technology solutions, staff, and security awareness training

Info
Transcript

John B. Sapp | Texas Mutual Insurance

John B. Sapp

VP, Information Security & CISO Texas Mutual Insurance

John Sapp, CISO at Texas Mutual Insurance, discusses protecting stakeholders' data and managing risks in the cyber landscape. He emphasizes resilience and effective incident response. John stresses the need for technology and cyber risk governance over just cybersecurity. He quantifies risk in financial terms to communicate with executives and the board. John addresses human behavior risks from employees and potential insiders. The conversation includes the threat of ransomware and the importance of a security culture. John discusses budget allocation for tec... Read more

explore Keep Exploring

What is the importance of quantifying risk in financial terms when it comes to technology and cyber security incidents in order to create effective resiliency planning? add

What are some considerations regarding human behavior risk in organizations? add

What does the budget allocation for a company's security program look like, and what specific initiatives are being taken to promote a culture of security within the organization? add

bolt Powered by CUBE AI

John B. Sapp | Texas Mutual Insurance

search

Rebecca Knight

>> Good morning everyone, and welcome back to day two of theCUBE's live coverage of Fal.Con 2024 here in Las Vegas. The room is buzzing around me. The keynote speakers have just left the stage. I'm Rebecca Knight alongside my co-host, co-analyst, co-founder of theCUBE, Dave.

Dave Vellante

>> Just call me Nemesis Kitten.

Rebecca Knight

>> I know, we all should have, if you were a virus, what would your virus need be? That's funny. I'd like to welcome, first time ever on theCUBE, John Sapp. He is the CISO at Texas Mutual Insurance. Thank you so much. Direct from Austin, Texas coming on theCUBE.

>> Yeah, thank you so much. I'm glad to be here, and excited about the opportunity to talk with you today.

Rebecca Knight

>> Awesome. John, why don't you start by telling our viewers a little bit about Texas Mutual and about your role, your day-to-day role?

>> Absolutely. I'm the VP of Information Security and CISO at Texas Mutual Insurance Company, as you said, based in Austin, Texas. We are a workers' compensation only insurance company, so that's the only line of business we have. Although we did recently launch a health insurance line that will sell policies coming up real soon, but we focus on helping injured workers get back to work. We have a motto of being a stable force for good in Texas, and so we really care about our policyholders and our injured workers.

Rebecca Knight

>> And in your role as a CISO in terms of the sensitive information that you're guarding over.

>> In that regard, so I'm responsible for protecting our stakeholders' data. That is whether you're a policyholder, an agent, an injured worker, an employee. It is really about protecting our systems and our data from the adversaries that seek to gain from accessing it.

Dave Vellante

>> Those adversaries are increasingly capable, you know this, they're very clever. And the concept of risk is one that's constantly evolving. I tend to think of it as, okay, what's the probability of some kind of event, and what's the impact of that?

>> Right.

Dave Vellante

>> And your job is to reduce the impact. You really can't affect, well, I guess you can affect in a way the probability. I wonder how you think about risk, the changing nature of risk, how it's evolved, and how you're approaching the problem.

>> I like you used the word probability because probability is based on data. We use data to determine when, where, and how an attack is likely to occur, and basically the means by which the attacker could get into the environment. Being able to identify, mitigate, and manage risk is very important because at the end of the day, we have to understand what our risks are. Just from the use of technology, the risk is, it's an inherent thing and it could lead to cascading risks of different types, whether it's operational, financial, or otherwise.

Rebecca Knight

>> We're hearing so much, the theme of this show is resilient by design, and we hearing a lot of that. We're talking a lot about it here on theCUBE as well as on the keynote stage and in conversations over lunch. What does that mean to you and how do you think about this great scary interconnected world that we live in whereas Dave said, our adversaries are just becoming more powerful?

>> First of all, I love the theme: resilient by design. It's a take-off secure by design, privacy by design, all those other things that we've dealt with over the years. The time is now to become resilient by design, and resiliency is not redundancy and I think sometimes people confuse the two. Resiliency is about your ability to respond and recover because it's not if, but when something is going to occur, whether it's some type of software defect or whether it is an attack itself, we have to be able to respond and recover so it's not if, but when, and we have to be able to do that effectively and efficiently.

Dave Vellante

>> The probability you basically just said is virtually 100%.

>> Absolutely.

Dave Vellante

>> Of some kind of incident. And then there are cyber incidents which are threats that exfiltration of your data or ransomware. But also, there's IT risks where technology breaks. Remember the Flash crash?

Rebecca Knight

>> Oh, boy.

>> What happened? Oh, it was a glitch.

Rebecca Knight

>> Right.

Dave Vellante

>> A glitch, AKA we have no idea what happened.

>> Right.

Rebecca Knight

>> We still don't know.

Dave Vellante

>> So how do you think about those two dimensions of risk?

>> Yeah, I'll tell you. Y2K taught us something years ago, and that is that software development is more of an art than it is a science sometimes, and there are things that the human doesn't think about. We take shortcuts sometimes, and back then we used two digit years versus four, and that became a problem. But fast-forward to today, technology's at the center of everything we do in every part of our lives. We depend on it so much and our world is so interconnected, something is going to happen. We use our phones and updates happen and things go wrong and then we find ourselves struggling. It's being able to plan and prepare for those things because they are going to happen. We can't predict what they're going to be. We can say typically what types of things they're going to be, but being able to respond and recover from that is key.

Dave Vellante

>> What role do you think public policy plays here? Because we have executive orders, we have a lot of finger-wagging from the US government about better cyber resilience from they're talking to you and saying, "Oh, you got to do a better job." They're talking to George Kurtz, "You got to do a better job."

>> Right.

Dave Vellante

>> But they're not attacking that side of the equation that you just mentioned on the technology side. Do you see that changing?

>> I do, and that's one of my addictions is that just like the regulations that went into place last July became effective this year around cyber security incidents and reporting and all of those things, they thought they talked about cyber security incidents, but what about technology incidents? Because the materiality of those types of incidents can also impact a stakeholder, a shareholder. It is going to become, we can't just isolate on cyber security, but we also have to look at technology risk as something that we have to make sure that we're effectively managing. And I like to say it's time for us to turn GRC around. We've talked about governance, risk, and compliance for years, right? Now it's time to turn it around to CRG, cyber risk governance, and that encompasses both technology and cyber security risk.

Rebecca Knight

>> So how as a leader in an organization do you try to make sure that you are cultivating this culture of resilience? Not only within your team who gets it and truly understands the risks, but also within the greater organization, which may be, I don't want to say oblivious, but they've got other functions that are doing other things in their jobs?

Rebecca Knight

>> Yeah, it's a great question, and part of our job as a security leader is to both educate and inform the executives and the board. The way we do that is through a level of reporting that's in a language that they can understand. One of the things that I do is I quantify risk in financial terms because if I can give them at least a range of what the probable losses will be, whether it's a technology incident or a cyber security incident, then they have an understanding of what our resiliency planning needs to be from an operational standpoint. Because now we're talking about business continuity management. Business continuity is people in processes, disaster recovery is the technology side of things, you put those together and that's what that topic's all about. But being able to put that in terms that are understood, and you can say if we're down for four hours, our losses are probably going to be this, but it's all based on data that I collect from our financial statements or from numbers that are provided by the organization itself. They are not numbers that I create out of thin air.

Dave Vellante

>> I was going to ask you, you're really sticking your neck on the line there because 10 to 15 years ago in cyber, failure meant you got fired, and that's not the case anymore.

>> Right.

Dave Vellante

>> And it was not a board-level topic, it clearly is today. But I always ask these, how do you communicate to the board? What you just said is you basically have a probability of event, which is 100%, you have an impact of that event, which is an expected loss.

>> Right.

Dave Vellante

>> And you through technology and people and process can reduce that expected loss. You're actually putting a number on that for the board based on other data with a little asterisk that says-

>> Absolutely.

Dave Vellante

>> "Caveat, this is not my data, this is the organizational data. Here's my methodology, how I did it."

Rebecca Knight

>> Exactly.

Dave Vellante

>> That must be an interesting conversation. They probably really poke holes in your assumptions.

>> They really do.

Dave Vellante

>> And partner with you, right?

Dave Vellante

>> But I'll say this, they take the approach that they want to learn and understand.

Dave Vellante

>> Sure.

>> Because the first question is always, "How did you get that number? How did you calculate that?"

Rebecca Knight

>> Because humans are the ones who create the data, we can't overlook that.

Dave Vellante

>> You're absolutely right. You're absolutely right. And so when you think about it is the controls that you have in place because that's one of the things that we first do as CISOs is we have a strategy, we have a plan, we understand what our controls are, what our frameworks are that we're going to use, all those good things, but it is helping the organization understand where's the open window, where's the open door, and what could occur if we don't close that window or door? It becomes how I justify the investments or my budget for protecting the organization.

Dave Vellante

>> Sure, because you're asking for a dollar amount and they're saying, "Okay, your reduction in expected losses, the value that we're going to get out of it."

>> Where'd that come from?

Dave Vellante

>> But the outcome is what I think in terms of ROI, benefit over cost, what you're doing to the adversaries is increasing the denominator so that their cost goes up.

>> Correct.

Dave Vellante

>> So they go somewhere else because their benefit will go down. Let's not attack this company because they're more cyber resilient. Let's go somewhere else where I knock on the door, it's open and we can just walk in.

Dave Vellante

>> You're exactly right, and that's the thing is that part of what that education process also is helping the board and the executives understand the trends and why we are now looking at, I take a capability mapping and say, "These are our capabilities today. These are the areas where we're most mature. These are the areas where we need to improve." And now they can understand why I want to spend $5 over here versus $2 over there, because that reduction in risk and the value associated with that, that's how we calculate the return on investment.

Dave Vellante

>> If I put my board hat on, the hardest part I think is it's not a static environment, it's constantly changing. That's why the threat hunters at places-

>> Absolutely.

Dave Vellante

>> Like CrowdStrike and the government and other firms, not just CrowdStrike, is vital for you being able to stay on top of things, which must be extremely difficult. How do you do that?

Rebecca Knight

>> Yeah, and there's one thing that I think rings very true in this industry, both technology and cyber, is that we have to not only, we have to collaborate and we have to work together both technology and cyber security because the challenge is that the attackers are using technology to carry out their attacks. They are absolutely interconnected, intertwined, we can't separate them. What we do is we look at things from a more holistic standpoint so that we understand from a risk standpoint where we're most at risk and what is the inherent risk of the way we do business, the use of technology in business, and how do we reduce that to an acceptable level of residual risk?

Dave Vellante

>> What's your number one challenge as a CISO today?

Dave Vellante

>> I will say it is more about human behavior risk. It's the people who are well-intentioned, the employee, the contractor, whoever it may be. But it's also, you think about it and there have been insiders placed into organizations. And so it's also thinking about that because understanding human behavior risk in those well-intentioned employees, but also if I have an insider, whether it is someone who's planted or found their way in to infiltrate or whether it was someone who becomes disgruntled and becomes that insider that I have to worry about.

Dave Vellante

>> There's a couple dimensions of that. One is bad human behavior beats good security every time.

>> Right.

Dave Vellante

>> There's a cultural aspect of that. The other is the talent you have in your organization and the tools, the people that process and technologies to thwart, to find things like insider threats. So that's, again-

Rebecca Knight

>> Because a lot of those employees are unwittingly making their companies vulnerable to attack.

>> Absolutely. Clicking on links.

Rebecca Knight

>> It's not. Right, exactly.

>> I mean, if you look back at some of the breaches that occurred last year where there were cyber adversaries who basically reached out to people in organizations who were not making necessarily the greatest wage and they offer them a lump sum of money. "Hey, if you provide me with this access, here's your payout." And so the insider, the employee who was well-intentioned, but who has some financial troubles of their own all of a sudden now $25,000, that becomes a lot of money, and so now they provide access. So that's how the whole, I call it the e-crime ecosystem is being fueled, and how they're being provided information that access brokers sell on the dark web. It literally is an entire e-crime ecosystem that goes on, and so that's how they're getting information and opening the doors to our organizations.

Dave Vellante

>> I often say any knucklehead can be in ransomware as to go on the dark web, but don't do it because AI is going to catch you. You're going to get in big trouble. But it's true.

>> It's true.

Dave Vellante

>> Ransomware is a service is a thing, and it has been for a while.

>> It really is. I'll tell you, I educated the board on that two years ago about ransomware as a service, and they didn't realize that it's an entire business that rivals our own economy, and it continues to grow. You look at some of the surveys out there, I think it's estimated to be about 10 and a half trillion dollars business by 2026.

Dave Vellante

>> Right, so you got ransomware, you're defending against that. You also have the internal cultural piece. I'm curious from a board's standpoint, how easy or difficult it is to get that sort of spending on cultural awareness and things like that. Is that part of the value vector that you, I mean, you have a limited budget even though it's the most important thing in IT. You can't spend it all on technology, you can't spend it all on people, you can't spend it all on internal cultural awareness. How do you divvy the pie?

>> I'll tell you, I'm glad you asked that question because one thing I report to the board is how I spend the budget. There's a pie chart that shows that about 59% gets spent on technology solutions, 33% is spent on staff, whether it's employees or contractors, another 5% on professional services, another 3% on managed services. They can see what are the resources I use to protect the organization, but you've touched on something that's very important to us, and it's having a culture of security, and that's where all those things come into play. Category is training and awareness for the employee. We transformed our security awareness program two years ago into a security awareness education and training program because now there are different aspects to it. So based on human behavior, we now can pinpoint where a specific employee may need to be developed so that they have a better culture of security so that we have security embedded throughout our organization. It's not just a one-time training content that they take or a one-time phishing test. It's a continuous process, and we do it more as a development approach as opposed to having some type of punitive thing attached to it.

Dave Vellante

>> Will AI change the mix in that pie chart over time?

>> I don't think it will very much because we are, I think very efficiently staffed, if you will. We're a billion-dollar company with a little over a thousand employees, but we leverage managed services to do that. I think AI will assist the managed services that we use to become more efficient, because I look at it in terms of what's the FTE equivalent that I get out of that managed service and how much money is it saving me? And they'll look at it as if they deploy AI, they can further reduce their cost to provide me the service that I need.

Dave Vellante

>> You said internal staff, I recall about a third, and then you've got managed services. So if you add those two up, it's still lower than industry averages. I mean, I would think it's closer to two-thirds for most companies.

>> I like to think we are very good at strategic planning.

Dave Vellante

>> Seriously, and that's pretty good. But I would think for companies that are in the two-thirds or even 65, 70% even, that AI may help attack that problem. Maybe, I don't know.

>> Yeah, no, I agree because certainly we can't discount the attackers are using AI to create their attacks, so we certainly have to use it whether it's in, and we're going to use it during our business to optimize processes or to improve customer service and all these things, but we also have to utilize it in cybersecurity to be able to protect ourselves against the attacks. Machine learning is going to help us learn how those attacks are morphing and changing. It's all the same tactics and techniques, but they're morphing into different ways to carry them out.

Rebecca Knight

>> John, a pleasure having you on. You're now a CUBE alum, so welcome to the crew.

Dave Vellante

>> Awesome. Great conversation, thank you.

Rebecca Knight

>> Yeah, great conversation.

>> Thank you so much. I greatly appreciate you all and enjoy the experience. Thank you for that.

Rebecca Knight

>> I'm Rebecca Knight, for Dave Vellante, keep it right here on theCUBE, we'll be back with more from Fal.Con 2024. You're watching theCUBE, the leader in technology enterprise coverage and analysis.