Entrust’s Jordan Avnaim Simplifies Board Communication

This is Textron tv. Hey guys, thanks for the throw. We're here with Jordan Abdom, who's CSO for Entrust, and we're talking about, well, how do cybersecurity folks talk to the board of directors?

There's clearly been a lot more interest and, um, I think that's a good thing, but it's not clear to me that the board is actually here and everything that they're being told. We'll soon find out. Jordan, welcome to the show.

Thanks, Mike. It's good to be here in the, uh, in the CISO community boards get a bad rap, and, uh, they're often seen as mythical in nature and, and, uh, often not well understood. So that can make a relationship.

That is a very important one. A little strange sometimes. Yeah.

I've talked to some folks recently about this issue and they tell me that after fighting for years to get in front of the board, they're frustrated with their experience. 'cause it's not clear to them that the folks on the board really understand cybersecurity any better than anybody else. So what is the problem with the tenor of the conversation we're trying to have and how do we improve it?

Yeah, good question. What we need to do is first establish trust with the board. We need to get to know them and demonstrate that we understand a bit of about what their priorities really are.

To get to know them, we gotta understand, uh, their background, what's made them successful, uh, perhaps in their current career. And w why are they on this board to begin with? Are they members of, of other boards?

Oftentimes I will add context into the things that they're concerned with, and we need to know a little bit about their cybersecurity and, and technical skill level as well. And really getting to know them doesn't just happen on paper by looking at their resume, uh, or even inside the boardroom. It really, we need to understand them outside the boardroom as well.

If we can. We should be scheduling one-on-ones with key members and, uh, or maybe even just the board chair if possible. This is, is specifically important if you are newer to the board relationship at the end of the day, this is really like relationship building one-on-one, right?

And after we understand a bit about them, one, understand what their priorities are, what's important to them, what are their hot buttons or topics. Some are hyper focused on regulatory compliance and some are trying to just stay out of the press and opposite of the schedule. Uh, some are trying to stay in the press.

So the more we understand about them personally and professionally, uh, have quality time with them outside the boardroom, and they're able to demonstrate that we understand their priorities we'll, we'll be able to build some trust through a really focused delivery of a message. It seems to me at least that a lot of them are not cybersecurity professionals or IT professionals, but they are business people. A lot of them have a finance background and they understand the concept of risk.

Everyone of them went to some sort of business school and had this drummed into them as they're constantly evaluating the notion of risks. So can we talk to them in the context of risk in a way that they might understand? Yeah.

And to do that, I do what's called focusing the message and delivering the goal is really to deliver the message to the board. And we need to be succinct in our communication without sacrificing too many vital details. And it sounds like, it sounds like a bit of a catch 22, and honestly it is.

And so I've coined a bit of a term called kicks. KICS keep it cybersecurity simple. Really, this is a level of detail above simple with focusing the message, uh, to help us articulate our point and tying it really to business outcomes, which is what you're referring to.

So really let, let's break this down a little bit. First and foremost, when possible, we've gotta use visuals and, and graphs, uh, to articulate our point. Any written words in the page that those should be the main, main takeaways.

Everyone's eyes always go straight to the words on the page and to keep the message simple. We shouldn't be cluttering with, with technical jargon, a give of thumb if we're finding, if we're finding ourselves, uh, explaining or finding the terms we're using, we're at the wrong level of detail. And the second thing is we need to use real examples here, business examples, and where possible tie it to industry trends, uh, with and alignment with benchmarks.

Boards love benchmarks. It's, it is a great way of measuring the adequacy of our plans to our performance. And lastly, maybe it's, it's tailoring the message to the board's interest in business outcomes and objectives.

We already know a lot about the board members. We just talked a little bit about that. Let's use that information to deliver a message that we know will resonate with 'em, whether it's risk, business outcomes focused on, on, uh, perhaps, uh, drivers in the industry right now.

When we join our message and relate it to these business outcomes or objectives, it makes our message much more relatable. What kinds of benchmarks should we be tracking? 'cause a lot of the times we're trying to prove a negative when it comes to cybersecurity, right?

If something didn't happen, and then it's hard to ascribe a value to the investment for something that didn't happen. So what are we gonna measure in a way that the board cares? Yeah, there's several different measurements here that we could think about.

One is of course, uh, size of our organization to our peers. Uh, oftentimes we look at perhaps our resources, both physical and labor, uh, as well as resources from a financial perspective. We can, uh, align that a little bit with our peers and say, this is what we're doing in comparison.

We are above the line or below the line. The second thing is, of course, aligning to any sort of external report, like a, a SOC two and, and a SOC two is a report that's provided by an external auditor that provides a level of assurance to clients or to customers that are security program or sometimes portions of it are in alignment with, in this case, it's A-I-C-P-A guidelines. Um, and that report requires investments.

And, and, you know, when talking to the board, we have to make sure that they understand why we want it. Talk about the benefits to that report. A lot of the times the board member doesn't wanna admit what they don't know, and you kinda have a an odd interaction.

So how do you kinda bring them along in a way that they'll understand and you're not making them feel like you're talking down on them per se. I mean, how do you kind of juggle that? It's a little touchy sometimes and awkward.

Yeah, and that goes back to my, one of my first points earlier on, understanding people's technical attitude and understanding their experiences. That'll help us fine tune our message, uh, to them. And, and really we shouldn't be saying anything in a board presentation or even a discussion with our board that is controversial in nature.

Uh, if we've done our due diligence ahead of time, we've talked about the controversial topics ahead of time with perhaps the chair of the board or other members, those conversations are gonna go much easier, uh, in nature. And we always wanna lead them through the conversation and not talk at them, but talk with them. And that's, that's one of the keys here.

If we dial down on this a little bit, um, does somebody on the board need to be a cybersecurity expert, or is that a requirement? Because that's been kicked around in some of these SEC rules and yeah, I'm sure people are exactly clear what they're supposed to be doing on those boards these days as a result, but it seems like there's a, a drum banging for more expertise in the board, but is it necessary? Yeah, I, I, I do believe it is necessary and, uh, that helps understand some of the cybersecurity risks and aptitudes that we're facing on a daily basis from a cybersecurity function perspective.

It makes these conversations back to your, your question earlier, it makes, it makes it much easier, uh, if there's the, that technical aptitude already at the board level. To your question on, uh, the SEC cyber rule, what we saw was the initial rule, actually, uh, the draft of it required, or was gonna say it was going to require that there actually be cybersecurity expertise on the board. Thankfully, I'll say that, uh, that after the rule was finalized, they removed that requirement.

There was a lot of discussion around it, and you can, you can read about it online and some of it's quite interesting. Uh, but at the end of the day, it's, it's no longer required Is our appetite for risk too. Great.

And I asked the question because we are expanding new platforms, adding new digital services, trying to do everything we can to increase revenue and profitability, but maybe not taking into account what the actual level of risk is from a cybersecurity perspective, and then waking up one morning to discover we are, uh, being covered in the Wall Street Journal in a way that stockholders don't appreciate. Yeah. Security is, is, uh, never a game of absolutes.

I think that's, that's something that we, we all know and understand in the security world. There's never anything such as a hundred percent secure. And that's why we use our metrics.

We align with benchmarks, we do our risk assessments to focus our, our efforts and the most important things so that, uh, at the end of the day we've essentially said, this is what we're gonna focus on. This is why it's important and, and, uh, nothing's absolute nothing's for sure. So we very well could end up in the end of the wall, the front page of the Wall Street Journal, but we should be feeling good that we've done everything possible to avoid that scenario.

I feel like there's a little bit of a conundrum these days. Cybersecurity professionals are being held accountable and threatened with jail time for issues. And the, I think the problem is, is the security people I know don't have control or authority to fix those issues.

They can highlight them, but ultimately it's the responsibility of some other executive, whether it's the CIO or a business unit head to go fix those things. So how do we navigate this kind of tension that exists between various members of the executive committee and the board over who ultimately is gonna be held accountable for what, Yeah, it, it actually, it is accountability 1 0 1. You said it yourself, Mike, and we do this through, it's, it's essentially risk management 1 0 1 as well.

And we help folks understand that in, in the event we need to do certain things, and in the event that they don't want to, they can't do a business reason, uh, we have a process for tracking that through an exception management process. And at the end of the day, there needs to be some level of executive approval, uh, for the high risk ones or ones that we say are high risk, and that the people who sign off on that are the ones assuming accountability and responsibility for that decision. So do I create some sort of formal document and bring it to the board and say, sign here because there's the level of risk associated with this, or how do I kind of tactfully negotiate that conversation?

Yeah, the, that, those conversations actually happen at a level below the board, one level below the board. What the board should be interested in are actually that those conversations are happening and that there is accountability for the decisions being made from a risk acceptance perspective. That's what we're talking about is risk acceptance.

And in order to have risk acceptance, we have to have a line in the sand of our risk appetite. And above that risk appetite needs to be remediated or mitigated. Anything below that risk appetite level we can accept.

And once we have, once the board understands that we have risk appetite to find, and we have a process to evaluate and accept that risk, they wanna make sure that anything above that line I just spoke of is being, is being mitigated or remediated appropriately from a time perspective, uh, in alignment with the risk. Do we have the actual resources to go fix those issues, even if they agree? Because every time I turn around, there's a shortage of skills.

There's people leaving and new people coming on board. It takes a long time to train them. Uh, the bad guys are getting smarter and the attack surface is getting wider.

So, um, what do we do once we have the board's approval? Yeah. It, it is truly, uh, an exercise in prioritization.

We know that, uh, one month we may be focusing our prioritization efforts, uh, our resources because as you said, they are scarce. Uh, and there is, uh, what appears to be a growing skill gap talk with those resources, uh, to the next month, we have to focus on something complete different, uh, because of, uh, there's a new threat, a new vulnerability, uh, or maybe even different, a new business venture that we have to support. And so we have to be nimble in cybersecurity.

We have to be able to move quickly, uh, and align with the business and the changing threat environment landscape are all around us. Do you think there might be an opportunity in the future for CISOs themselves to become members of various boards because those boards will be looking for that expertise, so there's a silver lining in everything, but maybe there's an opportunity for the average CISO to kind of broaden their perspective in their horizons? Yeah, absolutely.

And the, the good thing here is that when, when the SEC cyber rule started out and, and, uh, it was open for a draft and commentary, that was, that was actually some of the conversations that were I saw happening. Where are we gonna find someone with cybersecurity expertise? Oh, wait, uh, I know the CISO at this other company, uh, let's bring him or her in and bring them on our board.

So those conversations were in fact happening and that is act absolutely. What I think is necessary is, is that, uh, our cybersecurity professionals, uh, maybe even below the ci, the CISO level and need to be involved in overall governance, uh, at other companies, and that absolutely will, will generate and give back to the, their current role or perhaps their current engagement with the current company. It is a, a bit of a, a cyclical cycle, if you will.

Do CISOs need to get better at injecting themselves into these conversations earlier? And exhibit one would be, every board right now is talking about ai, but are they considering the cybersecurity implications of those initiatives, or is this gonna be yet another example of where, you know, we're proverbially chasing after the horse after the barn door has been opened and we'll never find them again and it might be too late? Yeah, absolutely.

Organization should be involved in those major type of tech adoption of technologies or decisions from a business perspective. Not only does a secured organization need to understand the impacts to the organization from the infrastructure or process application level, uh, the, the impacts are endless really. But also from, um, uh, an external perspective, how we're engaging with our client's customers, and from a regulatory perspective too, anything like you mentioned ai, Mike, that's obviously, it's a big one now, but that has impacts sweeping across everything we do.

And as a result, uh, the, this discrete professionals in our organization, uh, and your point earlier outside of organization, need to be included in those decisions. Those, so ultimately, what's your best advice to CISOs? I mean, do they go out and buy a copy of, you know, how to make friends and influence people, or they just started getting a bigger expense account and start taking all these folks to dinner?

How's this gonna work? Yeah, it really is. Uh, we talked about building the trust model.

Uh, we talked about focusing the message. And then maybe the last thing I'll add really is around incorporating a feedback loop. As we continue to learn about the board members and, and the business evolves around us, we need to make sure that, uh, we understand how that's changing and that our engagement with the board continues to adjust as well.

It's very similar to our cybersecurity strategy. Uh, our, our board engagement has to continue to evolve as well. Another way, one way the day, one of the ways we do this is we listen to the questions they ask during the conversation discussions.

Could we have added another sentence in there to make it more clear, something to think about, uh, and really, uh, we really should be meeting with them anyways. Uh, on a one-on-one basis, we should be talking about, Hey, that last conversation we had in the meeting last month, did it go well? Uh, what, what could I have done differently or what could we talk about differently to resonate with you?

So, um, you know, it, it, it is a consistent feedback loop and, and, uh, with our messaging and, and engagement with our boards, it gets refined over time. And, and we really are able to focus on the most important topics that, to deliver the most value. All right, folks, I might argue that rule number one is don't make the board look bad.

Any other issues come up? C rule number one. Jordan, thanks for being on the show.

Thank you. And, and I'll say real quick, Mike. Uh, the CSO being able to effectively communicate with the board is not only vital for the business of the cybersecurity organization, but also it's vital for the success of the enterprise overall.

Thanks for having me. All right. Back to you guys in the.