Hi and welcome to malicious life in collaboration with Cyberism. I'm Ren Levy. ran leaving. If I were to ask you what makes an organization good at cyber security?

What would you say? The most obvious answer is people.

If you get talented security people in a room together, you have a pretty good shot at success.

There's also that stuff you put around those people.

Money, for example, and the fancy tools and gadgets we all like to play with.

That stuff isn't worth much on its own,

but in the right hands

it can be a great boost to any cyber sec operation.

But there's another factor too, management. IT security reports to executives who have the power to grant or deny funding.

Team leaders who don't set their foot soldiers in the right direction and inspire good work in them tend to leave security vulnerabilities

in their wake.

You could argue that these business people, even if they never touch a keyboard, are nearly as important to an enterprise security

operation as the actual cybersecurity professionals. It's why on November 8th 2017 when the Senate Commerce Committee organized a hearing on corporate data breaches,

they brought in a panel of CEOs, like Richard Smith.

Even before being called to testify, Richard was having a bad 2017.

His company, Equifax, had experienced arguably the most severe breach of personal data in history.

When the public found out he was fired.

Then he was ping-ponged through Washington, D.C.

sitting before tribunals of senators and congresspeople who used him as a punching bag.

No more was this the case than when Elizabeth Warren on the Senate Banking Committee

systematically broke down how Equifax was actually profiting off its heck

by selling fraud protection to the very customers whose data it exposed in the first place.

...