The Lawyer's View: Strategic Lessons in Cybersecurity and Incident Response

[00:00:00] Josh: in order to address an incident, you cannot, , keep the team so small that information won't leak out.

[00:00:07] Josh: If you are telling more than a handful of people. You might as well be telling it publicly, you might as well put it on your website because if you're telling more than five or 10 people, it's going to get out. And the more interesting it is, the faster it's gonna get out.

[00:00:21] Josh: So, be honest, be straightforward, be transparent. , But just recognize that, you know, this information's coming out one way or another. You can control the narrative or you can let the narrative control you.

[00:01:02] Craig: Hi, my name is Craig Duckworth, and today we have the distinguished guest, Josh Cook, who is a seasoned attorney and founder of Left of Boom Consulting. Josh, welcome to the show. How about you give our listeners a little bit of background?

[00:01:18] Josh: Sure. Thanks so much, Craig. I appreciate, , the opportunity to be here and, and talk to your listeners. , So I, an attorney of, been practicing for, , more than 20 years at this point. And, about a dozen years or or so, I was in-house at Manulife Financial. , And one of the, the things that I was responsible for there for, , several years was incident command.

[00:01:40] Josh: So, , managing incidents wherever they were happening in the world, , particularly with cybersecurity. And so I've, seen a whole lot. I've experienced a whole lot. And then, you know, when I left Manulife, I set up my own, shop, , Left of Boom Consulting. And the idea was to bring that, , you know, multi-billion dollar multinational experience that I had accumulated to smaller companies.

[00:02:03] Josh: , You know, the, the Main Street companies. In the US that don't have the resources to, , hire someone like me full-time to have someone like me on staff all the time. But definitely need my expertise and my experience to help them defend, against cyber incidents and, importantly to get ready to defend against cyber incidents.

[00:02:21] Josh: Because a lot of that, the left of boom refers to the, time before the incident on the incident timeline. A lot of times, the incident itself can be made smaller, more manageable, and less impactful if you put in the effort on the left side of that timeline.

[00:02:38] Craig: Yeah, no, great perspective. And it's, that's important. You know, I look at, as a child growing up in school, we practiced fire drills and we practice tornado drills and we practice earthquake drills or you know, 'cause we live kind of, a smaller fault line. And to this day I still remember that was a, a monthly deal for almost K through five or six or whatever it is, it was, and it should be the same thing with instant response with organizations. You don't ever want to, let's call it, create the manual in the middle of an incident. That's a horrible idea for anyone that thinks let's just not do it now. We'll do it later when we have some time, because right now is important.

[00:03:22] Josh: You're absolutely right. And I, I've seen that attitude in some organizations where, the folks that are handling cybersecurity response, they're understaffed. They're overworked, right? And so they're not practicing. They're just, you know, running from one fire to another.

[00:03:37] Josh: And the challenge with that is that when you're only dealing with incident after incident, it's all very reactionary, right? And so even if you do start practicing, if you're running tabletops and, even if you do start thinking about, you know, , how do we handle these incidents?

[00:03:54] Josh: At that point, you're really only preparing for the last incident, you're not preparing for the next one, right? And so that's a really, an important philosophy to adopt is to just say, you know what? We've had all these experiences. What have we not gone through yet? What has not hit us? And, how do we get ready for the next thing, not just, you know, practice handling The last thing.

[00:04:17] Craig: Couple things I wanna kind of talk on today. , I wanna kind of walk through every organization. If you don't say AI in every other sentence, you're not not really in business. So, I wanna figure out how do organizations, we, as an industry, the industrial play, how is AI helping, supporting, hurting that initiative on both sides?

[00:04:40] Craig: Also, I wanna kind of touch a little bit on s ome legal implications and some ethics of, of the AI aspect of it, along with some, some compliance and regulatory. But first as I wanna kind of go back to a little bit to what you said about the training, and I wanna dive a little bit deeper from an incident response.

[00:05:00] Craig: As organizations are kind of navigating this journey as they're going down this cyber resilience, this. how do we better prepare our organizations and our teams? For the listeners that are out there that are on that journey and trying to understand it, what would you say would be a key factor in determining who should be on that team?

[00:05:23] Craig: What should the team be made of? You've got your IT, you've got your OT, you've got your InfoSec, you've got C-suite, you've got legal. What comprises a quality team that would be, let's call it the incident response command post or the, organizational head.

[00:05:41] Josh: I did write a book about, 18 months ago or so. It's the cyber resilience by design, the executive's guide to managing a cyber attack. Right. And one of the chapters in that book is really focused on this, this exact question, right?

[00:05:54] Josh: Who should be on the team and specifically, , because I'm, a lawyer and I'm approaching it from a legal mind. You know, one of the things that I always wonder is, you know, what sort of personality traits do you need between the incident commander and counsel, right? So whether it's in-house counsel or outside counsel, , what sort of attitude do you need to bring and.

[00:06:18] Josh: By far the thing that, you absolutely need in incident command and when you're building your incident team is you need calm, right? You need people that are not going to overreact. You need people that are going to take the information, , digest it, understand what they're missing, and find those missing pieces.

[00:06:40] Josh: And then make informed decisions. And so, if you are the kind of person, , if you're an executive that is, quick at the trigger and, , you know, very, , emotional or reactive, you know, you wanna find qualities in your team that will balance those things out, right? but it is that, ability to just stay calm because it, it, every incident is gonna feel like a fire.

[00:07:05] Josh: It's gonna feel like, you know, the sky's falling. You've got, a threat actor who's yelling at you that you know, you, you gotta pay this ransom. , You've got a board. That really needs to know what's going on right now. You've got, , maybe the public is asking questions, the media is asking questions, right?

[00:07:22] Josh: So it is a high stress environment and you have to remain calm. You've got to keep your wits about you. That's by far the, single most important trait that you need on your team is folks that are going to just stay in the moment and keep it all calm.

[00:07:39] Craig: I can definitely see that as, you know, we look at the SEC ruling a year or so back that, you know, now dictates, publicly held firms to basically disclose, you know, and then there's a, difference in a disclosure for an incident versus a situation or a breach or whatever the, the legal terminologies are that, I guess t rigger when we report, when we don't report. And if you rush or you hastily say something that might not be material, then, and it things can kind of go a different direction. So I totally get that. Become, keep your wits about you do it methodically, do it correct and legally, but don't jump to conclusions that may or may not be factual.

[00:08:27] Josh: That's absolutely right and, it really is, you have to be quick, but you have to be correct. And, you know, you cannot sacrifice accuracy for speed.

[00:08:37] Josh: and that that's something that, you know, , I've seen quite a bit where, you know, folks are, they're in a panic. They're rushing, they're saying things that are maybe true, but it doesn't convey the full story.

[00:08:50] Josh: And so it's misleading. And you don't want to ever be in that position where you're telling a regulator something, , and then, a couple of days later, you have to go back and say, well, okay, sorry, that wasn't the full picture. Right. That is a terrible position to put yourself into.

[00:09:05] Craig: Oh yeah, I I can only imagine. So let's take a look at the way that AI's playing into cybersecurity, and I'll, I'll just kinda leave it open at that, you know, you've got AI and the ethics piece of it, you know, is AI doing everything for you. You know, AI is obviously helping the adversaries write code to deliver malicious malware.

[00:09:30] Craig: AI is helping automate part of the processes, you know, digest some of the threats and responses. I mean, there's all kinds of w ays this could be looked at. what are you seeing? How do you think it's helping and or hurting the industry and organizations that maybe are relying too much on it and ones that aren't relying at all on it.

[00:09:55] Josh: AI is, , first of all, it, it's everywhere, right? you can't get away from it. It can be an amazing tool, but that cuts both ways, right? And so, what we've absolutely seen is, , AI being leveraged by threat actors. . particularly with phishing, for example, right?

[00:10:11] Josh: The phishing, is so pervasive because it works. You can, you know, send out a couple million, , phishing emails, and even if you have a, you know, you're probably gonna get a, three, four, 5% hit rate, , which is a lot of victims, right? So, . But even with that, you apply AI to it and suddenly, you know, a lot of those, , flags that we're all trained to see the, grammatical errors, syntax errors, typos, those go away with an AI enabled attack.

[00:10:40] Josh: And so they're much harder to spot. , They're much harder to identify. And so, you know, the hit rate is actually a lot higher and you've got a lot more victims. And, you know, particularly, , if you're dealing with a spear phishing attack where you know the bad guys have an idea who they want to go after, it's even harder to defend against those.

[00:10:57] Josh: And, AI makes that all so much harder o n the defensive side. AI also, , has lowered the barrier, , for entry. So at this point. You really just have to have malicious intent. You don't really need any, skills to be able to pull off an AI supported, , malware attack. And, that's really disconcerting for, you know, folks like me that are, trying to defend against things like this, , to counsel clients and, help them defend, you know.

[00:11:27] Josh: It doesn't take a whole lot, , you can buy a fishing kit, , on the dark web and, it's all prepackaged for you and it's all, AI enabled to, exploit weaknesses that, are out there and are really hard to defend against.

[00:11:40] Josh: So, the barrier to entry is much lower at this point. And, and that's really, kind of disconcerting. On the other side of it though, we do have, , AI enabled defenses. And so, you know, threat intelligence enrichment, AI finds patterns. That's one of the, things that AI is really great at.

[00:11:57] Josh: And so. You can apply artificial intelligence to your threat intelligence suite, and it will enhance the entire package. It'll, help you identify, you know, what things you really need to pay attention to, what things are most likely to target you in particular, as opposed to just broadly.

[00:12:16] Josh: , And so the, you know, AI can really be a benefit on the defensive side as well. . And, we're actually seeing companies pop up a number of startups that have, , , opened up in the last couple of years, basically using artificial intelligence to, , detect anomalies and to, more efficiently automate your incident response.

[00:12:36] Josh: So there is a whole lot of, , really excellent things that AI is enabling too. It's not all bad news.

[00:12:42] Craig: Yeah. and kind of where we focus and, and I, you know, I believe your focus as well is, more on the industrial pieces of things. So, as you're, , very aware the industrial networks and a utomation, or is very, let's call it antiquated because of the life of the assets, the amount of time they've been around the lack of patching on the industrial side.

[00:13:06] Craig: So there's, it makes it easier for an adversary to leverage tools like AI to try and, you know, write a basic script, malware script or whatever with these p ackages that you can procure on the, the dark web and, and really play into that. It's even more important where we play and focus that, you know, to try and balance that out.

[00:13:29] Craig: Mm-hmm.

[00:13:29] Josh: Yeah, you're absolutely right. And, artificial intelligence can, what I've seen is that it can be leveraged to a nalyze those systems and find vulnerabilities that, people haven't been paying attention to. It is really critical, , on the defensive side to understand all of the systems that you have that could potentially be exploited, how they all interact, , if they do interact and then.

[00:13:54] Josh: the most critical piece that I've seen is how the people that you have actually understand what their roles are with each of these systems. And, you know, if a billing system is compromised, it doesn't necessarily touch your, OT, but, Are you making decisions around the OT based on your billing, are you not delivering product because you're not getting paid for it? And then what are the ramifications of that as well?

[00:14:20] Craig: Yeah. In the OT space, obviously, you know, , we are very big proponents of visibility. You gotta understand what your network is, what's on your network, what are your assets, what are they talking to, what's talking to them, back to, you know that understanding what you have before you can begin protecting it and securing it.

[00:14:42] Craig: And the OT intrusion detection softwares that are available out there, Claroty and Armes, and Nozomi. Those type platforms are really that same concept where they are building a baseline. They are telling the operators whether that be an InfoSec team, that is a little bit about the OT team. How are they detecting anomalies and how are they understanding what's different in their environment,

[00:15:14] Josh: No, absolutely. It's always kind of startling to me when people don't understand how everything is connected, right? you know, whether it's, , your, , endpoints, your OT, your, IOT you know, how can everything be interconnected? How can you segment it so that it's not quite so interconnected? Right? , how can you separate, , for example, a, a car dealership, , that has, , all of the cars are connected, but are they connected on the same network as all of the, , sales and, and maintenance software within the dealership?

[00:15:47] Josh: Any vector can be exploited, but are you protecting each vector independently. Are you , segmenting each thing? that's something that, it requires real deliberate thought to actually create a, defensive structure that is more challenging to exploit.

[00:16:03] Craig: Okay, let's kind of come back, I guess up to the top. If we look at all of the things that we just talked about, how AI's playing into it, the, piece of the OT team understanding their assets, the way that it works, where's the C-suite? Where does the executives, the board of directors, where do they fall in line and help the listeners understand.

[00:16:25] Craig: What's important, what are some key things that they need to focus on, I guess, to keep them, let's call it outta jail, for lack of better term. Because as policy and regulatory pieces get tighter and tighter there's more of an emphasis on personal liability, and how do they protect themselves and the organization?

[00:16:46] Craig: 'cause that's, that's something that a lot of our listeners. Are trying to understand how do they better secure and protect their organization, whether they're CEO, COO, Board of directors. What's that? How's that look?

[00:16:59] Josh: Yeah. It really is about being informed and you can't avoid it. Maybe five, probably more like 10 years ago. , You know, C-suite executive, , could say, you know what, , this is IT, this isn't my area we need to talk to our head of IT probably at that point wasn't even a CISO.

[00:17:16] Josh: Right. , But you know, that's the person that is gonna answer the questions, , and m aybe five years from now, the CEO will not have that option at all. You know, the accountability will be alright. I'm the CEO and I need to be able to talk about our cybersecurity posture. from start to finish, I need to be able to, explain to the board myself, what's going on here.

[00:17:41] Josh: , I'm not gonna be able to just rely on my IT banking that I bring in to explain about, , you know, all these technical, things. it's even more the case when you're talking about regulators, right? The regulators are becoming more conversant in cybersecurity.

[00:17:54] Josh: By need. they have to. And so the more conversant they are in it, the more they expect that everyone within the organization that they're talking to, they need to understand it as well. that is, the single biggest takeaway is, you don't have to have a background in computer science.

[00:18:11] Josh: You don't have to have a, technical background at all. But you have to understand how. Your systems integrate across your organization, , just at a high level, and you have to be able to talk about it. And if you can't talk about it, you're doing yourself a disservice. You're doing your company a disservice.

[00:18:30] Josh: , and ultimately, you know, you're kind of putting your a target on your back because. Other people are going to be able to do that. You know, they're going to be able to talk about, you know, how each different, system across your organization works and what the defenses are. Just again, you know, 30,000 foot level for the details.

[00:18:49] Josh: You can rely on the people that are doing the work day in, day out, but at that, you know, 30,000 foot level, you need to be able to talk about it. And if, you can't, it's gonna be a problem.

[00:18:58] Craig: So two things that I see with that and I, I'm. Sometimes not real nice well, I like to call it out and I'll like to say, you know, from an organizational standpoint, a lot of times the CISO will have the responsibility of securing and protecting the OT space equally as he does the it when the CEO says, Hey Josh, you now own.

[00:19:24] Craig: All of the enterprise. Great. Thanks a lot. Can't wait to start on that. But what he forgot to tell you, or maybe he didn't convey to you, is the authority to perform those actions. what does the liability, where does that fall? You know, in five years down the road, if, the CEO is responsible for that.

[00:19:46] Craig: Organizations have to pull their head out of the sand and they have to grow up and really start addressing it. How do we hurdle that responsibility versus authority? Because when you get to the plant, all bets are off.

[00:19:59] Josh: that is an excellent question. , And. , you cannot have an effective CISO who doesn't have authority to do the things that that person has been, , tasked with doing, right? So if you are not giving the CISO authority, , just the responsibility, then the CEO needs to fully back the ciso.

[00:20:21] Josh: You know, that authority comes from somewhere, and if the CISO doesn't have it, then the CEO needs to own the authority and empower the CISO to do what the CISO needs to do I've seen this, , I've seen this many times where, you know, the CISO has the responsibility to do something.

[00:20:40] Josh: No one pays any attention because there's no teeth behind it. There's no, you know, there's ultimately no, , power to enforce the organization's rules. and that is a terrible situation. It's just, it's begging for a problem. And ultimately it comes down to the CEO accountability.

[00:20:59] Josh: And I've addressed CEOs about this directly and said, look, you are the problem. And if you are not empowering this person to do their job, then it can't get done

[00:21:10] Craig: but does that mean that the CISO is now the plant manager? Because from an organizational standpoint, the plant manager reports to VP of operations, reports to the COO, who has the same power level as the, the CISO in the corporate office. But If my pay structure is based on productivity and I get paid by widgets that I make, and here comes CISO walking into my plant saying, Hey Craig, I need you to shut this down for.

[00:21:40] Craig: Two days, take a little bitty timeframe so that we can do these tasks and upgrade this and secure that. I'm looking at my calculator and I'm saying, duh, it's gonna cost me and my team X amount of money. No thank you. I'm not gonna do that. and the CISO has no ability to force me because. I don't report it, and I'm gonna say, look, I don't report to you.

[00:22:03] Craig: Bring me my get outta jail free card, signed by the CEO that says I'm gonna get paid my full amount of money no matter how much I make.

[00:22:12] Josh: No, you're absolutely right. And what it really boils down to is, the C-suite needs to act with one voice. , You know, when it comes to cybersecurity, when it comes to defending the company, the C-suite cannot be split. and I've actually seen this, , as well, and it, I've seen it during incidents, which is, , particularly troubling, , where, some parts of the C-suite will disagree with the strategy on how to handle an incident and they'll start telling their teams to do things differently.

[00:22:45] Josh: And, you know, then you get just completely divergent, , efforts. It's completely counterproductive and, it's really the fault. of the CEO for not controlling the entire, , executive, body. you have to have, that, you know, top line buy-in to say, this is important and we need to focus on it, and we need to address it.

[00:23:08] Josh: And if you don't have that, then you know, it, unfortunately, it ends up with, you know, everyone for themselves and, you know, everyone's just, , you know, looking out for number one and no one's worried about the company and no one's worried about the, you know, the customers. And, that's, that's a problem.

[00:23:23] Craig: So I'm, and I'm guessing, and maybe you can correct me if I'm wrong, but in a situation like that, an instant response plan where there is. Different messages being given to the different teams and things aren't as smooth as they should be. is it ultimately the cso, the CEO, the board. when something doesn't happen and misinformation is provided to regulatory bodies or the media or whoever, who, is it ultimately just the CEO that's gonna get head chopped or what?

[00:23:55] Craig: What happens there?

[00:23:56] Josh: Yeah, I mean, when I've been in that situation, commanding an incident where. we've got senior executives disagreeing, but not talking to each other about the disagreement, right? And just telling their respective teams to do things differently during an incident. what I've had to do is I bring the C-suite together and say, look, you all need to solve this right now in this room.

[00:24:19] Josh: we need one command structure, and we need one decision to come outta here. Whatever strategy you decide is fine. But it has to be a single strategy, and then let's go execute it. And I have not had this, scenario where. I've had to elevate it to the board after that.

[00:24:38] Josh: , Because, you know, I think the executives with that kind of, come to Jesus talk, right? It's, you need to fix this right now, or we are going to have a massive problem. You know, you thought this incident was bad. Watch what happens when it's outta control.

[00:24:52] Josh: Right.

[00:24:53] Craig: yeah, and not only that, but when we decide, one of you, let's pick one person, one person's gonna communicate the message and everybody else is gonna stand tall and say, we trust him. He's our deliverer of whatever we decide and we all stand united. That's where things get sideways, I believe.

[00:25:13] Josh: Yeah. if you want to debate, debate in the room,

[00:25:16] Craig: Yeah, totally agreed. So one other thing I really want to kind of talk about today if we can, is it seems that anytime there is an incident, pick a company doesn't make a difference. It's always tends to be cloak and dagger. There's not a lot of information sharing.

[00:25:35] Craig: It's the very first phone call. Before the CEO sometimes is straight to legal counsel that says, Hey, we had X happen. And then they're like, oh, great. Sign this NDA and let me handle the rest of this. And no one can say anything to help the industry get better. maybe you can share a little bit about.

[00:25:57] Craig: Why that is and are there ways that anonymously, or, you know, maybe not in a competitive way, we could help all use that information like in ISAC almost to better the industry, help us, the listeners kind of figure that out some.

[00:26:16] Josh: the reason for the secrecy is, fear, it's self-preservation, it's fear. It's, , , You know, you discover that there's something wrong and you don't want to admit it, you don't want to acknowledge it. You certainly don't wanna do it publicly, right?

[00:26:31] Josh: And so, let's just put a blanket over the whole thing. Let's just, keep it quiet. Let's not tell anybody. it's understandable, but. It denies the reality that all of your competitors probably have the same warts, right? They're, they're probably all doing the same things wrong if in fact you were doing anything wrong.

[00:26:50] Josh: , but it also denies Industry at large, the opportunity to get better and, you know, to shore up its defenses. And so, you know, one of the things that, you know, , like you mentioned, the ISACs, you know, ISACs are an invaluable tool. There are other, , more, you know, industry specific. Organizations that can be, , absolutely vital. You know, it could be, , , , geography based or industry based or, or what have you. But, , like I'm, I'm in Boston. I know that there's an organization in Boston that is, across industries.

[00:27:23] Josh: , It brings together, , CISOs and, GCs, for cybersecurity information sharing. it can be anonymous. if you've got an incident, you can report it anonymously to them. They pass it out to their membership and say, Hey, you know, we have this going on. One of our members has this going on.

[00:27:40] Josh: And, you know, just keep an eye out. Right? Be aware, , you know, if there are IOCs that can be shared, you know, they can be shared that way. And it's really a, great opportunity to help. Other companies, either in your space or in your geography or or what have you, to help everyone get better and help defend, , against these threats that they don't care.

[00:28:00] Josh: these threats are relying on you. , Not sharing information, right, because it makes it much easier for them to use the same approach, to target somebody else. So, it can be counterintuitive. It can be really challenging to overcome that fear.

[00:28:15] Josh: You know, you, don't want your stock price to drop. , certainly don't want to get sued, right? But. if you share some information, you know, you can help everybody get better. But there's another factor that I think is often overlooked, and that is that, in order to address an incident, you cannot, , keep the team so small that information won't leak out.

[00:28:38] Josh: So, what I tell my clients is, if you are telling more than a handful of people. You might as well be telling it publicly, right? You might as well put it on your website because if you're telling more than five or 10 people, it's going to get out. And the more interesting it is, the faster it's gonna get out.

[00:28:55] Josh: So, be honest, be straightforward, be transparent. , But just recognize that, you know, this information's coming out one way or another. You can control the narrative or you can let the narrative control you.

[00:29:08] Craig: Okay. one final word of of wisdom, if there is something that you know, you would like to impart on the listeners of, wherever you are in the journey, here's some advice. Legal or not legal or professional, that is something that you should try to incorporate into an instant response plan or your journey or use of AI or, or whatever.

[00:29:34] Craig: how would you advise the listeners today to try and figure that out?

[00:29:39] Josh: the single thing , that I would suggest is. Collect the bad guys, Because they are very creative. they're not constrained by the same sort of, you know, ethical box that the rest of us are working in. So think like the bad guys. Think about, you know, what are the things that, can exploited in my company?

[00:30:02] Josh: What are the things that are going to be most damaging to me and how can I protect those things? Right? and then. Actually do some tabletops on those specific issues. And when you're doing a tabletop, you have to ask the questions of, you know, who is doing the work, not just who's making the decisions.

[00:30:21] Josh: 'cause the decisions are important, but if the people that are doing the work don't know that they're the ones that are responsible for doing that work, it's all gonna break down. creative, be thoughtful and, be imaginative when you're coming up with a, tabletop scenario.

[00:30:36] Josh: And then, you know, run that scenario as though it's a real life event. And you've got literal people that are tasked with doing literal jobs and then, you know, set it off like that.

[00:30:47] Craig: you think they should run a tabletop of, going to coplay concerts? Should that, be a, part of the message of, of what to do and what not to do?

[00:30:55] Josh: that's amazing. you would have to have a really incredible imagination to come up with that specific scenario, just think about generally, all right, I've got, , you know, a, executive that makes some sort of massive public blunder, and how do we react to that?

[00:31:14] Josh: How do we respond?

[00:31:15] Craig: Yeah.

[00:31:16] Craig: It has been a great conversation. Josh, thank you so much. I really appreciate your time. , You know, hopefully the listeners that have learned something from this can take this back to their, roadmaps, their, planning, continue to listen and like, and download the episodes and, you know, just continue the journey.

[00:31:34] Craig: we appreciate everything.

[00:31:35] Josh: Absolutely, and thank you Craig so much. It's been my pleasure.

[00:31:38] Craig: Thank you.