Back
Q&A: Doug Brush Talks Incident Response, DJI Drones, and Mental Health in Cybersecurity
When the term “reality check” is used, it’s intended to get someone to recognize the truth about a situation. In a fast-moving industry like cybersecurity, reality checks from its leaders are necessary. Thinking pragmatically about the solutions to our biggest challenges helps drive the industry forward.
I recently sat down with Splunk global advisory CISO Doug Brush on the Agent of Influence podcast, a series of interviews with industry leaders and security gurus where we share best practices and trends in the world of cybersecurity and vulnerability management. During our conversation he shared three major cybersecurity reality checks:
- Most tools out there are going to be part of the picture, but they’re not going to solve everything. The slow progression of incident response today is not a technology problem.
- Chinese-based organizations, such as DJI Drones and TikTok, have much in common with the Bay Area tech community. We have a lot to learn from them.
- A top-down mentality must be applied to mental health in cybersecurity. Prioritizing mental health should be adopted at the C-Suite level.
Read on for highlights from our conversation around the evolution of incident response, security practices at Chinese-based organizations, mental health in cybersecurity, and more. You can listen to the full episode online here, or wherever you listen to podcasts.
Nabil: You’ve done many different incident response investigations. How that has that evolved over time – or over the course of your career?
Doug: I wish incident response has evolved more. I would say it’s a slow evolution. Early on, it was very manual process to parse things. Say if you’re doing dead box forensics, or even memory forensics to a large degree, there weren’t tools that could automate some of those processes.
By no means is a tool an answer to all problems, but it’s going to help build efficiencies if you understand the process. We had to deconstruct things in hex editors, it was a very manual process and took a very, very long time. Now, you can script automate a lot of those and these tools can build databases – so that’s gotten better.
When I see things like the SolarWinds incident, we focus on the TTPs around how somebody gets in. And once they get in, they move laterally, privilege escalation, build backdoors, get domain, get other accounts, and build this persistence mechanism. We’ve been tracking this since 2006/2007. There’s nothing new about it. And that’s the frustrating part to me. While we think some of the technologies evolved to allow us to be more efficient, some of the root things that we should be looking for, we are not. I think there needs to be a greater focus on detection and response and building our response capabilities, as opposed to an afterthought past defense.
Nabil: Is there a reason why that hasn’t happened yet, or why it’s taking so long?
Doug: It’s hard. And it’s not a technology problem. I work for a technology vendor, I would like to say. “we’re the best in the world and we can stop everything, detect anything,” but that’s not the reality. Most of the tools out there are going to be part of the picture, but they’re not going to solve everything.
When you look at the entire security operations, it’s going to be people, process, then technology. Technology is only a small percentage, it’s not your entire program. We get really excited about cool, new shiny objects. We all go to Black Hat and RSA, and we all pat ourselves on the back that all these new things are coming out. The reality is that we’re solving the same problems we saw 30 years ago. We don’t have good asset inventory. We don’t have visibility of our environments.
Nabil: Let’s shift gears to talk about a topic that I quite enjoy. I would love to learn about your work with various Chinese based organizations – DJI Drones and TikTok. In particular, what do you think about the privacy and security concerns that people bring up about using their technology?
Doug: It gets overly politicized at times. Inevitably, the Chinese government has their agenda, and I would add the blanket statement that there are also a lot of Chinese companies that don’t necessarily align with how the Chinese government operates. Some of these companies I’ve talked to have said, “You folks in the U.S. think we’re the enemy and think we’re stealing all this data. But we’re just a startup.”
The thing that surprised me most in Shenzhen was that the tech center reminded me of the Bay Area. It was very westernized and had a startup vibe with many young professionals. That’s the fallacy that we have: they’re against us. We don’t realize how much we have in common. They have a distrust of their government, just as we have a distrust of our own government. They have a mentality of “trust but verify” more than we appreciate. They have some built out documented and thoughtful programs when it comes to governance and organization.
In reality these companies are trying to create cool products just as we are. The reason DJI Drones became so popular is because they work really well. They built a vertically integrated manufacturing process where they weren’t using third parties – they had control over their supply chain. They manage third party risk well in advance. There are a lot of things that these organizations do that allow them to be competitive in the capitalistic and development space that we need to learn from.
We have to change this mindset that, because you’re in a specific country, you have to share the viewpoints of whatever the loudest political party is at that time. We need to try to look at things in a more pragmatic and realistic way.
Nabil: You’re a big advocate for mental health. It’s a huge issue and an area of focus today in the security industry, especially due to things like staffing shortages and burnout. What advice do you have for security leaders when addressing mental health?
Doug: Yeah, it’s a tough one, there’s no doubt about it. The last few years have been particularly tough, but it’s an issue that’s been coming up for a long time that we don’t talk about enough. First of all, we need to have honest and frank discussions about it. There was a nominated study in 2019 that looked at global cybersecurity professionals. 91% of the CISOs surveyed said that their stress levels were suffering and 60% felt really disconnected from their work role. In the U.S., almost 90% of CISOs have never taken a two-week break from their job. And a lot of them feel that a breach is inevitable in their environment.
We talk about top-down security and top-down leadership, which should go for mental health too. It has to be something that is adopted at the board and C-Suite level. Leaders should recognize that they’re only as good as the people that are working for them… when they’re at their best. Humans aren’t batteries, you can’t just revolve through them. The cost of acquiring the good cybersecurity professional right now is very high and CISOs are even harder to find and you don’t want to be churning through these people. Continuously hiring people, training them, and getting them onboarded, increases the cost and reduces efficiencies. We need to change this idea of how we hire.
I would say it’s changed since I started in consulting. It was very easy to continue this idea that you had to work 80-90 hours a week. More of the folks that I’ve hired in the past decade or so have focused on balancing mental health. We shouldn’t expect someone to work overtime each week if we want the best from them. Happier staff results in better work, more efficiencies, higher employee retention – which, in turn, results in happier customers and more top line revenue.
When people feel the best, they perform at their best. This idea that it’s mental health versus business is a zero-sum game. If we construct that from the leadership level down and appreciate the fact that you can do more to retain your employees by giving them a better self-care environment, they’re going to be better employees for you. Investing in employee health, mental health, and wellbeing is non-negotiable.
Nabil: Can you also share a little bit about the neurodiversity initiatives you’re supporting at Splunk?
Doug: The mental health aspect is just one part of the neurodiversity journey. When we talk about diversity in the workplace it should also include neurological differences like autism, ADHD, mood, and other functions. These have historically been viewed with a negative perception, but they’re just natural variation in the human genome. These folks have exceptional abilities alongside what is traditionally been viewed as a “disability.” Recognizing that it’s not something that needs to be fixed is a shift that needs to be adopted and supported.
Instead of saying, “thou shalt think like we do,” it’s this idea that a diverse mental environment is going to give you more candidates, and probably a better output. When I’ve had a diverse staff and we all get in the room, I don’t get affinity bias. My greatest fear is that I’m going to build my own echo chamber of people telling me what I want to hear. We need diversity in thought to increase better output for our customers. You’ll find that you get a better outcome overall when you bring a lot of different people to the table.
For more, listen to episode 33 of Agent of Influence. Or, connect with Doug on LinkedIn, Twitter, or listen to his podcast, Cyber Security Interviews.
