​

Passion for growing cyber talent, risk-based transformative decision making and alignment to business outcomes as well as customer mission are three traits successful Chief Information Security Officers (CISO) must possess. LaLisha Hurt embodies these traits and over the course of her varied career, she has held progressive roles as a regulatory examiner, auditor, consultant, IT risk leader and now Deputy Chief Information Security Officer for General Dynamics Information Technology (GDIT). GDIT employs over 30K dedicated employees and provides strategy, technology and mission services to some of the most complex government, defense and intelligence initiatives across the country.

At GDIT, Hurt provides cyber leadership, strategy and trusted advisory support to internal partners to ensure cybersecurity is interwoven into the fabric of business operations. She is also responsible for leading the cyber managed security services (MSS) practice within Technology Shared Services for internal and external customers across federal civilian, defense and intelligence sectors. These MSS include security operations center, threat intelligence, governance, risk and compliance and supply chain security capabilities that are fused together and offered out of GDIT’s Integrated Technology Center in Bossier City, LA.

Hurt’s role is rather unique in the industry and she has prepared herself for this moment with a diverse mix of both experience and education. She has an engineering degree, a Master of Business Administration and a Master’s degree in Information Assurance, along with numerous certifications. This background allows her to communicate and influence across a variety of domains, be it associated with technical IT issues, business needs, or cybersecurity.

Strategy and Business Requirements Drive Cybersecurity

For today’s cyber landscape, Hurt believes it is essential that the security management team partners with business leaders to drive risk-based decisions and outcomes aligned to the mission. Hurt believes, “There is an evolution within the CISO role and it has changed over the past decade. The new and evolving challenges we face today require decisions be made jointly with our customers and business stakeholders, alike. Not just around technology and cyber operations but also addressing critical areas such as workforce demand management, service-delivery, and business enablement.”

CISOs are becoming trusted executive risk advisors and strategic partners who work to align security needs with the corporate vision and business mission. Hurt has adopted this approach and works to advocate this mindset at every opportunity through culture building within her organization. She points out that while alignment to the strategy mission is important, building the partnerships and motivating teams to work together to deliver is just as equally important.  “To be a strong leader requires us to constantly build trusted relationships, communicate with empathy and influence others to drive the business outcomes needed for our customers, ”  she said.

Cyber Everywhere Mindset

In an interconnected world, cyber should be embedded everywhere in all that we do. It’s a mindset that Hurt has adopted as she drives key cyber initiatives to include Cybersecurity Maturity Model Certification (CMMC). The CMMC is a united cybersecurity standard required for Department of Defense (DoD) acquisitions that combines standards, best practices and control processes across defined maturity levels. CMMC is a DoD certification process that measures a company’s ability to protect federal contract information and control unclassified information while servicing its customers.

In addition to CMMC business alignment, Hurt and team are also scaling and growing their 24/7/365 SOC, governance risk and compliance and cyber fusion center capabilities which is in alignment with the most recent Cyber Executive Order that was announced May 12th. GDIT is combining threat intelligence and defense operations into a single integrated cyber platform that promotes information sharing, enterprise-wide visibility and collaboration that can improve response times while simultaneously helping to optimize costs. Hurt points out that “adopting a cyber everywhere mindset that aligns to mission, customer needs and industry landscape is a recipe for a win-win strategy.”

Retention of Skilled Staff is Key

On the subject of the shortage of cybersecurity professionals, Hurt has been successful in attracting diverse talent, particularly in Louisiana and Virginia. She credits this to the strong strategic alliances with various universities, colleges and cyber organizations that GDIT partners with. With these partnerships, she is able to strategically focus her efforts on workforce demand management as well as retaining and growing the talent once on boarded. The key to building a high performing team is aligning to a culture that is rooted in company values – one that allows employees to know what they do each and every day truly matters.

Hurt points out that there are many ways to encourage career development. The first step is to listen to their needs and then provide them with a career journey roadmap that allows them to grow professionally. If an employee says they are interested in a technical career path, it behooves the organization to provide the training required to meet that goal. On the other hand, if someone is interested in pursuing a leadership track, that also needs to be encouraged through formal leadership programs. In all cases, providing individuals the opportunity to be exposed to different positions within the organization is a great way to keep employees engaged. “Providing them training and exposure to different areas of the business is critical to cyber staff retention. The key to retaining the talent you attract is to show them that you’re just as invested in their success as they are.”

Final Thought

When considering what traits allow people to become security professional ‘rockstars’, Hurt points out that curiosity and problem solving are the most important non-technical skills. You can teach people technical skills but curiosity is intrinsic to the person. “In cyberspace you need people who can think about a problem, challenge the status quo, identify risks, and offer recommendations for improvement. These cyber professionals are typically your strong defenders and over time, could potentially be the next CISO for your company.”

The post LaLisha Hurt – Deputy CISO, General Dynamics Information Technology appeared first on Security Current.

Chief Information Security Officers (CISO) are driven. Angel Redoble, the First Vice President and Group CISO for PLDT Group, ePLDT Group, and Smart Communications, epitomizes that attribute. In addition to his position at PLDT Group, the largest telecommunications company in the Philippines and the only Philippine company listed on the New York Stock Exchange, Redoble is engaged in outside activities that promote cybersecurity. He teaches cyber warfare, cyber intelligence, and cybersecurity at the Philippines’ national defense college and is also an adjunct professor and program director for the cybersecurity executive course at the Asian Institute of Management. To grow the number of cybersecurity practitioners within the Philippines Redoble is the Chairman and Founding President of the Philippine Institute of Cybersecurity Professionals.

Developing Cybersecurity Professionals

To successfully protect against hackers and cybercriminals requires a dedicated and educated cybersecurity workforce. Recruiting and training the next generation of cybersecurity professionals is a passion for Redoble. He believes it is imperative that the Philippines needs to create a constant sufficient supply of trained and dedicated security technicians. “Cybersecurity is a national security issue.” Redoble understands the appeal of cybercrime to some talented young people but by appealing to patriotism is it possible to encourage talent to do the right thing for the good of business and for the country.

“Hackers are constantly creating, testing, and launching attacks, and thus, cybersecurity professionals must continue learning and enhancing their skills.” To turn these thoughts into reality PLDT Group has institutionalized a five-month training program for new hires. It is a rigid training program that allows PLDT to have the staff start to contribute before the program is fully completed. “We are probably the only organization in the country who hires fresh graduates for our cybersecurity operations group.”

As is demonstrated by the training program, Redoble’s teaching activities, and participation in a professional organization, he believes CISOs need to share with the community. “A leader creates more leaders. A good CISO needs to inspire people to embrace the profession of cybersecurity.” He sees a future where people work together to make the “world and our cyberspace a safer place to live, work and do business.”

Advanced Planning Was Invaluable

Since the beginning of the COVID-19 pandemic cybersecurity has been a challenge. Cybercrime has spiked around the world with a few hundred percent growth. However the biggest challenge for a CISO was the changing nature of the workforce. The lockdowns forced organizations to have staff work from home instead of in an office. PLDT Group and Smart Communications were no different. With foresight Redoble and his staff prepared for the possibility of a lockdown. Starting in January 2020 they prepared for having up to 20,000 employees working off-site. They had to ensure that the level of security for remote workers was comparable to the office environment. Working with the IT department they developed a plan that ensured enough VPN licenses were available. “We had to reinvent and re-engineer how we do things, to make sure we protect our infrastructure at the same level we protect our users. The paranoia just went higher than before.”

Dual Protection Strategy

As CISO at a telecommunication company, Angel Redoble has two roles. He is responsible for managing the security of the company infrastructure but is also entrusted with protecting the customers who use the company’s services. His philosophy is “customers entrust their confidential and sensitive information to us therefore it is our responsibility to ensure the highest level of security is implemented to prevent security issues.” He added that providing clean traffic (e.g. connections free of malicious activities) to his subscribers is part of the company’s strategic goals. To be successful requires robust end-to-end security that does not require the customer to change their behavior. Redoble explained that PLDT Group has deployed technology that prevents their millions of subscribers from accessing websites identified as malicious or phishing sites. They also have a continuous supply of threat intelligence information fed automatically into their threat intelligence database.

During the past year security controls have needed to work because of the huge increase in criminal activity as a result of COVID-19. Attacks against users have escalated immensely. In the whole of 2019 they blocked access to websites about 13 billion times. They are now preventing nearly as many connections a month.  For example in April 2020 connections were stopped almost 10 billion times. They specifically “blocked more than a hundred thousand COVID related scamming and phishing websites.”

Passionate Calling

Related to protecting customers, Redoble is passionate about ending the scourge of online sexual abuse and exploitation of children (OSAEC). “One reason I helped create the Philippine Institute of Cybersecurity Professionals was to advance awareness within the Filipino community about the dangers of the internet, especially to women and children.” The PLDT Group is also committed to combating this plague. They are working to prevent their millions of subscribers from accessing child pornography. Redoble related that the Group has taken down over three thousand websites that host illicit content. They continue to expand the capabilities of their network-based child protection platform and are testing additional technologies that allow automatic blocking of end-user access to prohibited content.

In order to advance this further, Redoble advocated for, and finally formalized membership into the Internet Watch Foundation (IWF) by the PLDT Group and Smart Communications. As a member of this global coalition PLDT and Smart expands additional intelligence sources by gaining access to the large global database of domains with identified OSAEC content.

CISOs Management Responsibility

Angel Redoble’s role as FVP and CISO of a large telecommunications company is challenging yet he believes he has an advantage many CISOs do not have. “I report directly to the CEO who is also the Chairman of the Board.  I’m in a very good position.” When hired it was with the understanding that he would have control of all three layers of defense. Prior to Redoble coming onboard, the security functions were divided between operations, risk and assurance, and internal audit. He believes distributed leadership inhibits cybersecurity improvement. “By combining the three layers of defense we can implement a comprehensive strategic plan.  Centralization allows proper allocation of resources, fosters internal communications, monitors spending, and implements improvements based on input from all three disciplines. With concentrated management there is no need to spend time and effort negotiating compromises”.

He believes all CISOs must report to the CEO, company president, or whomever is running a company. There are two specific reasons for this position – strategic authority and budget. “No matter how good you are as a CISO if you do not have full authority or budget you will not be successful.” A CISO must have the authority to develop policies and processes, deploy needed technologies, implement improvements, and ultimately to have full visibility into network operations. Regarding budget matters in order to fulfill the security strategy the CISO needs to know what budget is available and not need to rely on some other department.  Having full budgetary control allows flexibility to shift monies as a result of changing priorities.

Final Thought

As a final thought, Angel Redoble has worked exceedingly hard, as has his whole team during the COVID pandemic. When the Philippines went into lockdown and many employees worked from home, the critical network and security staff quarantined within the security operations centers. Supplies and belongings were pre positioned so that when the orders came down they were prepared. Prior to the lockdown Redoble relaxed by visiting his family’s farm. Over the last year that was not possible but he is looking forward to being able to travel to the country to visit with his family. Until then he continues to support and advocate for improved cybersecurity within the Philippines.

The post Angel Redoble – PLDT Group, ePLDT Group & Smart Communications FVP & Group CISO appeared first on Security Current.