Resilience Against Global Risks with Juliette Kayyem at QSC24

This is Textron tv. Hey everyone. We're live here in San Diego at the Qualys QSC Americas.

We're thrilled to be here once again. It's always a great conference, and we're actually thrilled to have this woman with us joining us as our first interview this morning. Her name is Juliet Kayam.

Yes, Juliet was the keynote speaker here this morning talking about resiliency, and we're gonna jump into that in a second. But Juliet, first of all, welcome and thanks for being. Thank You.

Thank you for having me. So if you wouldn't mind, people in our audience may pro, I'm gonna assume a lot of them may not know you. Yeah.

Might be some who do. But give us a little bit of your background and what brought you here today. Oh, well, I am a professor at Harvard's Kennedy School, but I've spent a career in disaster and crisis management.

Started off in counter-terrorism, tell you how the risk environment has changed, although it's still there. It's still There. Uh, but changes, you know, as, as a risk environment changed with cybersecurity, obviously pandemic and, and, and climate, which we're experiencing every day.

And I really think about, uh, on the company side or the sort of, you know, why am I at a place like this is really thinking about preparing subject matter experts, in particular cybersecurity, uh, for what we call the boom. Right. The bad thing happening.

And it could be anything. And, and how in the, in the short, the, you know, the short, um, bumper sticker, you know, how to fail safer. In other words, if you anticipate the bad thing happening, how can you minimize the harms?

Because in some ways we we're talking about it earlier, that is resiliency. That is resiliency. That's a great, that's a great definition of resiliency.

Yeah. So I should tell you up front, you're talking to three Florida refugees. Oh my gosh, right now.

Yes. Like, you literally aren't going back. We're Oh my God.

Yeah. So, you know, We know all you're waiting For Milton, Right? Yes.

Well, we're, so we're on the southeast side near Boca Raton area, so it's not really hitting us head on, but I'm sure the dirty side of that storm will bring us some, some storm, uh, damage. But that being said, certainly this is kind of crystallized on everyone's mind. What can we do?

I mean, the world, the world's a crazy place these days. Yeah. Between climate change Yeah.

Wars and terrorist activities and, and everything else. And like never before, we depend so much on our IT infrastructure. Yeah.

Keep the light, literally keep the lights on and keep things moving. What can we do? Yeah.

At a high level. Yeah. From a resiliency point of View.

I mean, so if, if your definition of resiliency, or my definition is, is sort of, you're gonna fail safer, right? Right. So you're gonna anticipate the harm.

And what I kept saying in the keynote is like, your runway is short right. Between bad and really, really bad. Right?

And you can make those investments now. Um, and, uh, and what those investments sort of, you know, look like. So one is, is, and I believe this to be true, true, is are you confident in your situational awareness?

I mean, in other words, do you do the systems of which you're finding out things in real time and then relating them to higher ups who are gonna have to make the right, the different decisions based on the company. Um, uh, are you relating them in ways that are effective? Are you, you know, do you think about products like, you know, Qualis and others?

Like, you know, are you, do you have single points of failure? And if you do, uh, one, don't. Uh, but if you do, we try not to.

I know. We try not to. If you do, you know, what are those systems that are gonna support it?

And it's time of stress. I think a lot about, you know, sort of in, I just, the way I conceptualize stuff is just really in terms of your run the runway. What do I wish I had at the moment of the crash landing, uh, to extend out?

And a part of this is just, I mean, you know, your field, like lots of people are invested in like, you know, everyone talks differently, but like in zero breach, right? Lots of people, lots of companies are selling stuff, lots of whatever. And in some ways, you know, that's not true.

So how are you gonna think about, you Know, what happens? Well, that, that was a fallacy in the, in our industry for a very long time, right? We put all of our eggs into the prevention basket and very few eggs into the response basket And disclosure.

That's exactly right. And the other thing about it is, and and we had this conversation this morning with the new Qualys, uh, product they had released. Yeah, yeah.

The Risk, yeah. Risk operation center. We historically have an issue in our cyber, I'm in IT before we called it cyber in our InfoSec industry between doing security and managing risk.

They're not necessarily, they're the same. They're not, they're not. Um, and, and so, you know, managing risk for, for a lot of organizations is not even part of the it Yeah.

It's, yeah. It falls under CFOs Exactly. That kind of thing.

Right? So it it, it's hard to do that. But what, No, I mean that's, I mean, uh, this is what I talked a little bit about is like you, we really have to get a handle on our architecture, you know, whether, you know, we, we talk about secure by design, but some of the times it's just like, do any of these structures make sense anymore?

You have risk. You have you, as I joked about on, on, on stage. You know, you, you have risk going to one person.

You have cyber going to another, you have physical going to another. But you know what, when something bad happens, the CEO is calling their lawyer. Right?

I mean that's, And their insurance company, that's the other thing though. And the PR team, right? And the crisis, they're calling you.

They're not calling you. No. The last people they want to talk to is Exactly.

But you know, we discussed this on a, on an episode couple of weeks ago and someone did an interesting study. Yeah. You know, the old saying when it go, when it rains of pos right?

You have let's say a climate or some sort of neutral Yeah. Disaster happen or vent. Yeah.

The guy, the bad guys in the world, right? The cybersecurity, from a cybersecurity point of view, the hackers, the nation states who seek to exploit this, they live for those moments. Yeah.

'cause now you're, you're susceptible, right? Yeah. And so the, the incidents of a sort of natural or neutral disaster coinciding them with a cyber attack.

Yeah, that's exactly right. Yeah. Is it's pretty high.

Yeah. And our, and then we're seeing like our, you know, these things that we relied on, like our capacity to distribute information. And then of course, in this world of disinformation, you know, that that information was reliable.

This is where AI comes in. Yeah. But this is also where, you know, just the, the the sort of, you know, the, the, the, the, the, the rumors and the lies we're seeing with direct empathy, this is where our expectations of how communications of which InfoSec is a part of it are related, are just, are going to have to change, right?

I mean, how are you getting information? And is, is it relating? Is it, I mean, this is not a cyber example, but the example I give in my hurricane, it's like, what does, you all are from Florida, right?

I mean, what does category, what is the category five five mean anymore? They're All category they five. And what matters is the consequence, right?

Is it's the storm surge. And maybe our numbering doesn't Make sense. One can did do a lot of damage too.

I've been, And Katrina was a category three, right? But it just hits in a certain way. So like, maybe the way that we think about risk and whatever isn't, isn't correct anymore.

I'll give you a real world example. I, um, right before you got on Paul, our cameraman showed me a picture of what appears to be a funnel. Yeah.

Spout tornado west in the Everglades. Uh, but down on our end of the Yeah. State where we're not supposed to be getting too much.

My first thought was, oh, that's not real. Yeah. That's an AI picture.

Yeah. Generated, right? Who Knows, who knows, right?

I mean, there's ways, I mean, but now we have to get people more educated on, I mean, in the end It just makes the job harder. The Mission. Yeah.

I, for George, I mean, this is what, and I I think you'll agree with this 'cause you're on the, you're on the storytelling side, you know, the people in the room are not, you know, they don't think about storytelling. Right? They, you, you suspiciously the way, but what the storytelling is to actually get people ready, right?

I mean, to think about ways that we can tell this story of, of safety and security that is manageable and and understandable to people. Absolutely. Yeah.

Look, I know you're pressed for time, but I'm going to ask you one favor. Yeah. If you could look into this camera and tell our audience your best advice Yeah.

For what they can do to improve their organization's resiliency. I think I, I Loaded question from my Book. I have eight, but I, I think, I think everything tends to be the same.

This is part of the theme of it. Nothing, nothing changes. All of these disasters begin to look the same.

And I think what's incumbent on leadership is, uh, is that you create a culture of anticipating the crash landing. Uh, there are, there are reasons why you don't wanna do that. Reasons why lawyers and insurers and pr people will tell you not to do that.

But your responsibility is to think through the consequences of that disruption for your teams, for your leadership, and for your clients and customers. Absolutely. You mentioned a book, The Devil Never Sleeps, learning to Live in an Age of Disasters.

And it's, it's, it's risk agnostic. I just talked generically about the boom. Um, cyber, public health, you know, pandemic, yeah.

Terrorism, whatever else. There's always something It all at the same time, right. Or at the same time, there everywhere.

All at once. 20, 24, I have to say 2024 is like all of all of the above. And yeah, let's hope it comes down in 2025, though.

I suspect it won't. Yeah, yeah. Anyway.

Thank you. Good Luck of Will we guys? Good luck in Florida.

My fingers are crossed. We are too. We're just debating.

Should we stay here or try to go home on Thursday night? We'll, we'll see what happens. But anyway, Do you want my advice Stay in San Diego?

Yeah, I mean, why? I mean, what do you like, what's a, what's a day talking? Whatcha you gonna do?

Either it's either it ha either it's in in okay shape or it's not. Look at me. I'm like giving personal advice.

Yeah, No, that's a, like I Said, are you standing there isn't gonna help. Can you tell my wife that? So she left her alone home.

Okay. I Didn't know that. I didn't know that.

But no, no. I told her to come with me. She Didn't want to there.

There's almost all you might be is a burden on the system. That's what we think. And yeah.

Yeah. So I agree. Stay put plus paddle boarding and jet skiing right off the pier.

It is not a bad thing though. We do that at home too. I know, I know.

In better times. I know. Exactly.

Anyway, thank you so much. Well thank you so much. Thank you.

Thank you. Bye. Alright, we're gonna take a break here at Qualis.

Oh, QSC. I'm so ready to get more coffee. We'll be back in just a second.