Episode 59 - From Fortune 500 CISO to the Future of Cybersecurity with Tim Youngblood

And those gaps aren't unique to the telecom industry, right? And mergers and acquisitions, that's a fairly common thing, at least that I found in my experience was in the aftermath, it was just sitting right in between them that they were able to, whether it was by luck or just almost by design.

Is that something now when you're doing what you're doing that you try to get folks to focus on, especially during an M&A opportunity?

Yeah.

Yeah, I mentor several CISOs today and I give them guidance around this.

I also am an advisor with a crisis management platform company called SlipTactic and I also advise them in this space too.

One of those things you want to do when you're coming right into role is to establish what is the perimeter for this company, right? Where do we have controls? Where do we have the ability to monitor what's happened? Likely there's an incident going on or it's already happened.

You just haven't discovered it yet.

And then once you understand that perimeter, then you need to dissect that entire environment and start to determine what normal looks like and see if you can discover sometimes what's a needle in a haystack.

What's happened that you're going to need to respond to first? Because I just tell everyone, I said, you're going to have a crisis, right? Yeah.

You just need to go find it as quickly as you can.

Right.

Yeah.

And in addition to mentoring CISOs, you also teach resilience at OU.

In your opinion, what do students get wrong about recovering versus preventing?

Yeah.

So I just started teaching at OU this year and I've enjoyed working with MBA students there.

These are not technologists, so they're coming in trying to understand the basics of cyber.

And many of these are in oil and gas and energy sector as well that I work with.

When it comes to understanding how to communicate out what's going on.

So understanding who your stakeholders are, right? And that it's not something that just security deals with.

It's like, you've got to have a set number of teams from legal to ops to even procurement, because all of these leaders have to work in conjunction to message out to your customers, to message out to the board, to message internally to employees.

As to what's happening and getting them to understand that you need to practice this and to have holding statements ready and all that's just brand new for them.

Right.

And after we kind of go through a few examples of what's going wrong with people don't have these things, they get it like, okay, yep.

We definitely need to establish this thing at my company.