Managing the cybersecurity of a distributed enterprise with Mike Kail

Introduction

This week I’m joined by Mike Kail, the CTO of Everest. In this episode, Mike and I discuss managing risk in a distributed world. We talk about the shifts taking place with work from home and how this is, and isn’t different from the past work from anywhere model. Mike shares his perspective on how to manage the workforce and data without draconian policies. He goes into discussing zero trust and how the trust but verify concept needs to change to never trust, always verify. Lastly, we close with a discussion on the steps enterprises can take to perform a cybersecurity health checkup.

---

Speaker Profiles

Mike Kail Twitter: https://twitter.com/mdkail

Mike Kail LinkedIn: https://www.linkedin.com/in/mdkail/

Everest: https://everest.org

---

Audio File

---

Featured Hashtags

#CIO #Cybersecurity #WFH #WFA #CISO #DigitalTransformation #CxOitk

---

Podcast Transcript

Tim Crawford 0:01
Companies are looking for new ways to transform their business. Technology plays a critical role in this transformation. Speed and innovation in both technology and thinking are key to this shift. Hello, and welcome to the Cxo in the Know podcast, where I take a provocative but pragmatic look at the intersection of business and technology through the lens of leading CxO executives. I’m your host Tim Crawford, a CIO and strategic advisor at Avoa. This week, I’m joined by Mike Kail, the CTO of Everest. In this episode, Mike and I discuss managing risk in a distributed world. We talk about the shifts taking place with work from home and how this is and isn’t different from the past work from anywhere model. Mike shares his perspective on how to manage the workforce and data without draconian policies. He goes into discussing zero trust and how the trust but verify concept needs to change to never trust, always verify. Lastly, we close with the discussion on the steps enterprises can take to perform a cybersecurity health checkup. Mike Kail, hey, welcome to the program.

Mike Kail 1:13
Hey Tim, thank you for having me.

Tim Crawford 1:15
So, Mike, you’re the CTO of Everest. Why don’t you start off by just letting the audience know who you are, who Everest is, briefly before we get into the conversation today.

Mike Kail 1:24
Sure, Everest.org is a fintech cloud platform startup attacking some of the challenges around digital identity in the emerging market world. Previously, my background was CIO at Yahoo, VP of IT Ops at Netflix, and roughly 20-seven or so years distant technology in general.

Tim Crawford 1:44
So basically, not your first rodeo. Not

Mike Kail 1:47
my first rodeo, though. This is a much different rodeo than others.

Tim Crawford 1:51
So let’s talk about today’s rodeo because this is a very different world that we’re living in. We’re recording this. You’re in your home office. I’m in my home office, just like everyone else in the world today. And for this particular episode, we’re going to talk about managing risk in a distributed world. What does that mean? What is that about?

Mike Kail 2:13
So first, I’m not even sure what day it is anymore. But that aside, as many of us have rapidly discovered we have to learn how to work from wherever, and with the shelter-in-place rules in effect in in most states, especially here in California, all of us are now working from home 24/7 Whether you were prepared to do that or not, that is now the way it is. The thing is, like this was happening before. People were working from anywhere. I would go to a coffee shop or some such and be working. You also had the ubiquity of mobile devices. You were always connected. So, as a CxO, you should have should have been not expecting this pandemic, but you should have solutions in place that handle security and risk to allow and give people the benefit of working from wherever. This shouldn’t be that new to people.

Tim Crawford 3:08
So this shouldn’t be new, but as we’ve experienced and heard from our peers, other CIOs, other CXOs, this is new. Maybe you could kind of break apart the concept of work from anywhere from work from home, because I think that’s an important piece. You know, we see W F H plastered all over the place, but you’re talking about something broader. You’re talking about a different way of thinking, and I think that’s an important component.

Mike Kail 3:34
So it’s much like the move away from perimeter-based security to zero trust security. So you used to think about the office perimeter as being where you worked, and where you’re somewhere else, you maybe weren’t. But first, we deployed VPNs, and people connected to a VPN from home, from a coffee shop, restaurant, airport, whatever, when they’re traveling. The main change now is there weren’t always people doing this, so whatever provisions you had in place to solve for that didn’t have scaling challenges, but now you have everybody connecting to your services or VPN at the same time, and maybe you weren’t prepared for that thundering herd of connectivity.

Tim Crawford 4:15
I don’t know about you, but I see at my own home, I’ve got four people now all at once, instead of working from home, where it might be just one person at a time on video conferencing taxing my home network, now I’ve got four people that are taxing that same network, and God forbid where they’re who knows where they’re going.

Mike Kail 4:34
I was gonna say that’s a big component of zero trust. I think the previous mantra was always trust but verify, and I think now you need to move to never trust and always verify. We’re both parents, and we should never trust our children for what they’re connecting to, and always verify and log what they’re doing.

Tim Crawford 4:53
Well, we both get the audits on where they are going and have the filtering in place. So, but let’s talk about. Security with these different mediums. I mean, now we’re exposed to a number of different mediums, whether that’s video conferencing or other fashions. Where does security fit into into those different mediums? But as an executive, how should you be wrapping your head around this that is different than maybe what you might have considered in the past?

Mike Kail 5:19
So first, I think you should have already had a good catalog of your data assets and what people are accessing, whether they’re in the office or away. And then once again, keeping track of that, so having proper audit logging and alerting in place. So if something looks anomalous, you should be able to check it out very quickly. And then whatever solutions you’ve rolled out, whether it’s it’s Zoom or or some other video conferencing, like you shouldn’t just rely on the vendor for security. You should understand how you can help them because they’re facing the same challenges all of us are. I know Zoom’s had some issues in the press, and I think they’ve done a fantastic job of addressing them in a very transparent way, and other video conferencing platforms have had security issues over the years. So it’s not like they’re the lone one. Instead of piling on, I think we as executives should help them and figure out like security, especially when balancing user experience, is a very difficult thing to do. So, how can we actually be helpful instead of complaining about it? Complaining is not going to help anything, and certainly not going to improve security and/or user experience.

Tim Crawford 6:30
Yeah, and to your point, they’re facing the same thing. I mean, Zoom alone-what was it? 50 million users in December, and within a matter of a couple months, skyrocketed to over 300 million. That’s a pretty significant drive upward. But when you think about managing security on these devices with these applications, when you’re doing it within your office, that’s one thing because a lot of these tools are looking at the wire, they’re looking at the network, or even the device. How does that change when now these devices and these applications have moved to the home and to a network that you don’t necessarily touch or manage?

Mike Kail 7:09
So I’ve always taken the stance that it’s not about the device. Like people try to secure a device, whether it’s legacy MDM solutions or whatnot, it’s about the data and applications they’re accessing and using, and you need to think about securing that. Like putting locks on the device will just cause somebody to use a different device that doesn’t have those restraints on them. So draconian policies certainly aren’t the way. And it’s also about building proper security awareness within your workforce. Doing yearly security training is not going to help, and they’re probably not going to remember. Like you have to understand or articulate why it’s important, and not being heavy-handed and explaining. Like here’s why we put this into place, and it helps the company, and this is why you should be on board with it.

Tim Crawford 7:57
So let’s talk a little bit about managing that workforce and those draconian policies, because I think this is this is an important piece. I mean, I’m sure you’ve seen it. I know I’ve seen it a number of times where you have folks, including executives, that get frustrated because they can’t connect to the VPN or can’t connect to their corporate location, and so they need to get a document to a device so that they can edit it, and so they just use their Gmail account or their personal email account to forward that confidential document. At the end of the day, you have folks that they’re just trying to do the right thing and get the work done, and maybe they have a boss that’s coming down on them, but yet they they can’t work with the technology, right? They’re constricted by the technology. How do you kind of rationalize some of that, especially considering that the worker isn’t necessarily trying to be more risky in their behavior, but rather just trying to to get the work done?

Mike Kail 8:57
Yeah, and first, let’s be honest. I think every single one of us in the past have made that exception for the exec that needed access to something. So you put a white list in place, or you remove some security control, and you’re like, “I’ll put that back later. And let’s be honest, most of us never did.

Tim Crawford 9:15
We don’t.

Mike Kail 9:16
There’s a bunch of holes in the proverbial dike, but how do you solve that or address it goes back to my comments about user experience, because if you put these draconian policies in place and controls, users that want to get their work done will find ways around it. It’s not that difficult. The holy grail of data loss protection or DLP, like I don’t think anybody’s really ever solved it, and I’m not sure you can, so I think once again you need to have measures in place that don’t trust and always verify, but remove the barriers to productivity for people without sacrificing security, which is a delicate balance. But once again, I think the zero trust model is the. Proper reframing of it instead of trying to layer on more and more policies and controls, because at some point those brittle policies will break, and you’ll have to remove them, and then you’ve now removed all of your security, which is why I believe we continue to see the massive data breaches literally every day, if not every week.

Tim Crawford 10:20
So the zero trust model is in or out, and what about trust but verify?

Mike Kail 10:26
So zero trust means it starts with there is no perimeter. So just because you’re connected to the VPN doesn’t mean that you can’t subvert it, or you’re connected to the VPN, and like you said, I can forward a document to my personal email account and access that from outside the so-called perimeter. So, like I said, the mantra is never trust, which is zero trust, and you need to verify and audit and have alerting. So, how do you have proper dashboards in place without being heavy-handed and employees worrying that you’re monitoring everything, but you need certainly need to monitor access to your secure assets, especially confidential or private data.

Tim Crawford 11:08
It’s zero trust model is in trust, but verify is out. And really, what you’re saying is now never trust and always verify.

Mike Kail 11:18
Yeah. So most likely you should flip your approach completely on its head and start over.

Tim Crawford 11:25
That may be hard for some that have inertia built around that culture. Where should they get started? And kind of in relation to that is just the concept of the VPN. I mean, have we have we surpassed the day when the general VPN has now out of vogue, where we don’t need a VPN. We shouldn’t think about relying on a VPN.

Mike Kail 11:47
So VPNs made a bit more sense back in the world where you were running your Exchange Mail server on your premises in your colocation data center that was where the VPN was housed, and other systems like that, whether it was your HR or financial systems, with the advancement of proliferation of SaaS applications for all of those sectors, those are now not inside your premises, and so the VPN connection still makes external connections. So it doesn’t make sense to have to concentrate all of your users coming into your corporate data center, and then filter them out to external services. Figure out how to have proper security around each of those applications or services, and monitor it from that way.

Tim Crawford 12:36
So I think what you’re saying is the VPN isn’t necessarily out, but rather only use it for those applications that still reside within the corporate data center, and those things that have moved out don’t backhaul that traffic.

Mike Kail 12:48
I think the main thing is make sure all of your services and applications have proper encryption. Then there’s no need for a VPN because you don’t need to encrypt traffic that’s already encrypted.

Tim Crawford 13:00
Now there’s an interesting thought. So as we kind of think about how this relates to the user experience, and one of the challenges is you end up on one side of the spectrum if you want to secure everything. Well, then the user experience traditionally goes down. If you want to be fast and loose, then the experience goes up. What’s that happy medium, or are there ways to get it both ways to address both issues, where you have a good experience, but you’re also operating within a within a secure framework, especially in this day and age where your users are working from home, they’re working on devices that are harder to get to, you’ve got networks that are being taxed. There are a lot of other variables that are coming into the mix these days that didn’t exist just even three months ago. How do you start to rationalize that?

Mike Kail 13:51
I think a good analogy is, and we talked about the health checkup before. You go to your doctor and you hope for the best, but you may not get the best news, like you need to eat better, lose some weight, exercise more, that’s needed. May not be the best so-called user experience, right? There’s going to be some level of discomfort. The same is going to be true with security. So I think the first thing is setting the proper context with your employees. Like here’s why we’re putting these measures in place. Here’s why it’s important to the company and your well-being as well. Whether that’s getting your your account hijacked or whatever, a proper conveyance of why is how you start with it, and then working or selecting the proper vendors that have kept up or out ahead of the consumerization of IT movement, which means that the user experience is not the classic terminal application green screen. It’s like their experience on the social or mobile applications like Twitter, Facebook, etc. It’s very easy to use and intuitive. So, working with your vendors and partners on that, keeping a tight loop of feedback is important, and then just being realistic with your end user base. Like, there’s going to be some friction, but that minimum level of friction is going to pay dividends just in the security posture of our company, and some of those health checkup things, like let’s start with two-factor or multi-factor authentication. Even I get frustrated sometimes, like oh, I have to enter this six-digit code, and I had to wait like a second or two for it to be delivered to my mobile device. Is that really a lot of friction for a significant uptick in security? No, it’s not. Especially in these times, it’s hard for all of us to maintain a better level of patience. So I think a tight feedback loop with your employees about this, and allowing them to have a voice, and then once again explaining why you’re doing it, is probably the proper way to to maintain a healthy level of security.

Tim Crawford 16:00
You know, I like that because what you’re really talking about is you’re getting their buy-in. You’re asking them to buy in and be part of the process rather than just being a cog in the wheel of the process, so to speak. Having them gain an appreciation for why you’re doing it rather than just oh, here’s another policy. You know, Mike or Tim are pushing out this policy. Great, IT’S doing it again, making it harder for me to work. Right? We’ve both heard that.

Mike Kail 16:28
Yeah, I mean, in the past, there’s been too much talking to employees, not with them. Like we’re rolling this out, thou shalt use it, versus any reason why, or asking for feedback. Like, how can we improve this? Like, here’s the start of it. There may be some friction, but let’s work together on making it smoother over time. We both know it’s not going to be perfect.

Tim Crawford 16:49
So if I circle this back around to the work from anywhere, does that awareness become more prevalent? Because when I’ve got a user that’s on a network that I’m managing, I can do things like blocking their access to certain websites and and locations. That’s harder to do when they’re on a network that I don’t necessarily manage, unless I require the VPN to be involved for all traffic. Is this awareness more important as we start to think about the work from anywhere, work from home model, or is it not?

Mike Kail 17:25
No, it most certainly is, and I think what you said goes back to some of the the prior IT solutions or mentality about trying to secure a device or a network or or a specific IP address. Much like I said about data is the the thing you need to, and applications are what you need to secure on the user side to allow them to work from anywhere and access applications and data. It’s about having a common secure identity and having a proper enterprise identity solution, preferably with single sign-on to remove the friction we just talked about, but being able to manage that and understanding the different roles, so using role-based access control to applications and data, is how you should solve it versus trying to keep tabs of networks and IP blocks.

Tim Crawford 18:16
But it also seems like that awareness for users is important. I can think of examples where I personally needed to get something to a person that worked for a large corporation, and I might have used something like Box to move that file around because it was a large file. I don’t want to send it through email, and then the person on the other end that works at the corporation says, “Oh, I can’t get to that because our company has blocked access to Box because we use OneDrive or use internal storage, and this is where I kind of think about: is there a way to kind of get people smarter about what they’re doing rather than trying to, using your terms, trying to put those draconian policies into place?

Mike Kail 18:59
If there was only interoperability between all of the different cloud storage providers, and

Tim Crawford 19:05
hey, a boy can dream.

Mike Kail 19:09
So I think about you talked about you need to have employees have situational awareness, like what networks are they connecting to, how can you help them make sure that even in a public Wi-Fi, how do you add layers of security without adding the friction and bad user experience? Then it’s about also communicating with your other vendors or partners that you’re working with, and agreeing on a common set of tools, whether it’s Box, Dropbox, Google Drive. Like, let’s not put these policies in place just because and block it, and then people will go around it. Let’s work together. So I think the internal talking with employees, you have to do that externally as well, and talking with partners and getting alignment there.

Tim Crawford 19:52
Yeah, but the key there is talking with, not talking at.

Mike Kail 19:57
Yes.

Tim Crawford 19:58
Yeah, it sounds like there’s a lot. We can learn, and I think the working from anywhere, as you’ve outlined, really brings things that we maybe should have had in place. But now we have to be thinking about whether it’s the education, whether it’s how we use technology, whether it’s the security architecture. There are pieces that we need to be considering as we go down this path as we go through the virus crisis, economic crisis, and the social impact that goes with it. The

Mike Kail 20:25
need to have proper communication is even more amplified in this current environment we’re in, because you’re not in. So you lack some of the potential physical signals of communication. Your written communication has to be much clearer, and even verbal. Like I catch myself sometimes. You’re on a video call, and it’s like, okay, I should say something, but like, how do I interject because somebody else is talking? And it’s like you don’t want to talk over people. So then the suffering and silence. So need to figure out a good way to address that. I I don’t currently have any ideas? But here’s something for the Zoom engineers to and other video conferencing engineers to figure out.

Tim Crawford 21:06
There is an option you can raise your hand in Zoom, so you could do that.

Mike Kail 21:10
There’s the physical signal, like it’s yeah, you forget about it because you’re not in person.

Tim Crawford 21:15
Yeah, or you could, if it’s video, actually just raise your hand. I understand your point. I mean, whether it’s you’re on the vendor side, you’re on the end user side, you are an end user, you’re an IT leader. The reality is, we’re all learning how to work in this new world, and I think that’s really the the point here. Is there a number of things that we have to think about as we go through this this journey that we’re on

Mike Kail 21:40
to put a positive spin on this current situation, I think it’s a great opportunity for new innovations. Like, how do you solve some of these problems that have been kind of solved in the past but not fully?

Tim Crawford 21:51
Yes, absolutely. And we’re going to talk about that in future episodes, and that’s probably a good place to wrap. Mike, hey, thanks for taking the time for this episode has been great to get your thoughts and kind of set a baseline for folks to think about as they start to work from anywhere and think about how some of these different technologies play a role in the role of cybersecurity.

Mike Kail 22:13
Absolutely, thanks for having me. Fun as always.

Tim Crawford 22:17
For more information on the Cxo in the Know podcast, visit us online@cxointheknow.com You can also find us on Apple Podcasts or wherever you listen to your podcasts. Please subscribe and thank you for listening.