FUTR Showcase with Motorola Mobility CISO, Richard Rushing and Perdoceo CIO, Dave Czeszewski Panel

We want to now focus on the CXO panel. The goal is to have the CSO from Motorola Mobility, Richard Rushing, and Dave Czeszewski, CIO of Perdoceo, talk about the state of security, what's happening in the world of security, what their jobs are like, the problems they're trying to solve, but also what is working. A lot of stuff in security is very hard and doesn't work great, so when customers are doing something that works well, we want to share it with the rest of the group so you can get some best practices and hopefully something actionable after this event. Chris will run it. I just want to take a moment to properly introduce these guys. They both have long tenure in their organizations, which is very rare. That speaks to the fact that they must be doing something right. So first, please welcome Dave Czeszewski, CIO of Perdoceo Education Corporation, for over 21 years. He brings a very technical perspective, advises the venture community and startups about technology trends, and has a strong background in security. Also, let's welcome Richard Rushing, future information security officer at Motorola Mobility. Richard has a long background in security with companies like Siemens, GE Capital, and VeriSign, and for the last 13 years he's been building a world-class security organization at Motorola.

It kind of changes depending on how rapidly it changes, and it changes within a reasonable window. Are we out of the log4j thing? No, I don't think so. That's part of the issue: the goalposts get moved all the time. But the classic is that our parent company, Lenovo, has visions of being innovative, providing innovative technology and services to support businesses and consumers worldwide. That sounds like a nice fantasy, but at the same time, it's about customer data, supply chain to make sure everybody has PCs when they need them, especially in the world of COVID and supply chain theatrics. We're a total organization of 71,000 people doing $60 billion in revenue. You can imagine there are a lot of different parts and pieces across four business groups. We're trying to manufacture that Motorola is the number three cell phone manufacturer in the world. Congratulations. I tell everybody, can we move back down the line because that makes us less of a target? If you're in the top three, you're always the target. So you run into different things: protection of intellectual property because things we create and make are very dynamic and can be leveraged. We operate in 147 markets around the world, so there are huge risks. We manufacture in 14 different locations globally. We want to be seamless as part of security, and that's the hard part. I don't want to create friction—everybody uses that word, so they need to come up with a better one—but especially where our gross margin on products is typically around 3.5%, if you add friction, that becomes 1.2%, so every product you sell you lose money. That doesn't work. As far as innovation, we play a large part in biometric facial recognition. Would you rather type your password 14 times to log into your PC, or swipe a fingerprint or be recognized by your face? Or always-on connection using 5G networks to have your laptop always connected to the corporate network without VPN shenanigans. The Internet is a dangerous place; it was in the 1990s and the 1970s. Dealing with that is critical, and how you deal with it is more important than ignoring it. How I do something about it is the big concern.

I appreciate the fact that you're slowly helping us get rid of passwords. I didn't want to ask about challenges you guys are facing that maybe you don't have an answer for or a gap in the market. Where do you see the challenging side? What are the barriers?

I always carry around two sticks with me for your exact question of wider things. I use it all the time in senior leadership: I need people and I need more money. Those are the two things that always come up. Why? If I want to do more, what am I supposed to ask my people to stop doing? That's my choice. Either I ask you to stop doing something, or you don't mind working 80 hours this week, and that's your other answer. If I do that, staff will leave. So I need more people. I need money because the Internet is a dangerous place and it's not getting easier to attack. There are tons of holes, and I have to plug them with technology, a solution, or a service. If the budget last year did 10% of the holes, guess what? There are 10 more new holes that have popped up. Cloud, API, you can name them all. I need money to do it because I either stop doing something or I continue doing things but need more. I need people and I need money. It doesn't work any other way. If you have money to spend, there's a people element to that money. You have to do things, and doing things costs money, and it costs people. You just don't magically reduce things. Like energy, it just transfers and moves around; it doesn't really reduce.

Are you seeing that, since we've seen so many high-profile attacks, the board or senior management is more sympathetic and allowing more money to flow?

Definitely. For the last few years before COVID, I was like, this is the golden age of cybersecurity. I've been doing this my whole life and in executive roles for most of that. The hardest part was always convincing senior management there was a problem until around 2014 when the Wall Street Journal, Forbes, and Fortune had articles daily about attacks. Then Microsoft, Google, Facebook, Bank of America got hit. They said, wow, those are huge companies with huge staff; how are we going to compete? You're not. So you solve the problem of convincing them there's a problem, but then they want a plan and to know how you'll execute it. As long as you have that plan, they're on board. If you just say, I need $10 million, and they ask what for, and you say I don't know, that never works—except maybe for marketing guys.

Dave, are you seeing more money flow with all the visibility into security?

You mentioned that if you put 'cyber' in front of anything, it seems to get approved. Is there a magic phrase when you go to the board?

Richard, is there a phrase that pays for you?

No phrase, but there are power points. We define high-level risk buckets: brand security, customer data, factory shutdown. We align projects around those. We typically work on 20 to 30 projects annually, but I list 40 items that are part of the big buckets. Some items I'm not covering, and I highlight that. They ask why it's red, and I say, 'We're not doing anything about that.' They ask why, and I say, 'I need people and money.' That's my two sticks. Then I show a chart with likelihood and risk. For example, factory shutdown from ransomware: last year it was lower because ransomware hadn't reached critical mass. Now it's up, so what's going to bring it back down? What's my arc of risk acceptance? If I show it above that arc, they want to know how it will come down. I say this project here will lower that if you give me a million and a half dollars. They say okay. In three slides, they get it. When you simplify and visualize it so they can understand, you're not arguing pricing or deployment. It becomes a simple conversation: is this the right thing to do? You say it's the right thing to do, and trust handles the rest. Then they say, 'Can you make a couple of these red things not red?' and you say, 'More money.' It helps.

You've both touched on prioritizing risk. Dave, you mentioned Abnormal Security as a success. What are some things that have really moved the needle for you?

Richard, what about on your front?

We did a couple of things pre-COVID, ahead of the curve. We focused on endpoints as the weak link. We had over 100,000 endpoints on our network that come and go, and we didn't have much control besides AV or patching software. So we took ownership of the patching process from IT. We used the same tools but wanted to own it because we didn't believe they were doing the job well enough. We really focused on endpoints, from patching to everything else. We also went back to the classic of taking a step back and getting basic hygiene right. Before you clean, you need to know what you actually have on your network. If you don't know that, how can you protect it? That includes vulnerability scans—are you just scanning the data center, outside in, or inside out? We took that step. As a hardware company, you can just imagine, if you need a new computer, there are boxes of them. You take one out, it has no software, isn't on the domain, and now sits on the network in disrepair. One of our big successes was creating a security ecosystem early on. All the tools have to interoperate. If I decide to block a hash or IP address, it's one place, one button, and it goes everywhere. It's not just that everything logs correctly. You have layers of security that work together so if I need to stop something, I can do it at multiple places. For example, blocking on the firewall worked until everyone went home. Then you can't block on the firewall for endpoints. So you decide: is the AV, EDR tool, or Windows firewall the right place? It depends on what you're trying to do. That was a big win, saying all tools must interoperate. I remember when no tool interoperated with anything.

You're touching on operationalizing security, which is so missing from many organizations. What tips and techniques are you using? What's the secret sauce?

I appreciate the focus on operationalizing because it's often overlooked. Part of it is considering how many FTEs it takes to run a system. I've had products that require three FTEs when I don't have that. If something needs more than a half-load of 20 hours a week to keep it running, that's a problem. So operationalizing includes how much time and care and feeding something needs. Does it do automated updates for clients? How have you not figured out that I don't want to have to load your software on every endpoint? That simplifies it. Also, look at the thought process in the dashboard. How many clicks does it take to get to the data you need? One click, two clicks, three, four, then export to CSV? That's not operationalizing; it's a pain in the ass.

That leads into creating a culture of security and finding and retaining talent. Dave, how do you create that culture?

Richard, how do you create that culture and attract and retain talent?

There are multiple ways. You have to have a mission or direction, but you also need to claim your wins and the hard work people do. In security, it's all about what broke. You never talk about all the stuff your technical infrastructure stopped. You highlight what got through. On an average week, our data center in Chicago blocks over a billion bad attempts. People are amazed, but they want to crack me open for one thing that got through. You have to win and be passionate. Also, discover what your individual team members' missions are. What do they want to be when they grow up? Do they want to manage people or not? You build around their goals. I give a training budget of $15,000 per team member to spend how they want. In my tenure at Motorola, going on 15 years, the core team I adopted 15 years ago is still with me minus one person who retired. People get to retire and come back as consultants.

We got dragged into this from a security standpoint. Other departments like sales and marketing present their wins—revenue targets, how much money they made. They don't say how many deals they lost. Marketing talks about impressions, not how many people didn't click. We inverted our newspaper. Instead of page one showing all the stuff we stopped, we take page six, the obituary, and show who died.

If you could go back to the start of your career and tell that person one thing, what would it be?

Don't blow up at board members. Do not use the f-bomb in board of directors meetings. Also, you have to take risks. In security, if you get paralyzed by 'what if this could go wrong,' you never act. It's never 100%. Also, simplification. Drop things down to the lowest common denominator. For the last couple of years, I've used time. My staff works 40, 50, or 60 hours. When log4j came, everyone worked weekends and Christmas. The CFO says they're salaried, so it didn't cost money. But the time did. Those 4,000 hours could have been used for other projects, so all projects are delayed. Unless you tell someone to work 60 hours now, how do you fix that? More people—my two sticks—to balance it out. Otherwise, all my projects are a month delayed.

Thank you for providing an incredible perspective. You have a lot to offer. Thank you for sharing your stories.