When Cyber Meets Physical: Building Executive and Employee Protection Programs That Actually Work | A Redefining CyberSecurity Podcast Conversation with Roland Cloutier, Principal of The Business Protection Group

0:30And hello everybody, you're very welcome to a new episode of Redefining Cyber Security. I'm Sean Martin your host where I have the pleasure of having conversations about a topic that I love. The years and years I've been working on security from protection and detection and response and looking at things from an operational perspective and I've landed in a world where I believe security has a chance to do good things for the business. Not just be a department of no and of controls but actually I'll drive business value and protect the growth and the revenue that it generates. And not an easy task if you're sitting in the CISO seat and my guest today sat in that seat for quite some time and some organizations you probably are familiar with.

1:31Roland Cluteier, how are you my friend? Sean I am fantastic and thanks for having me. It's a pleasure to have you on. I forget when we chatted last but it was a good conversation and I'm happy we have a chance to connect today. We're going to be looking at executive and employee protection programs and kind of what that means from a security leadership perspective and a business perspective and some of the things you're seeing and hearing in that world and perhaps our organizations and security leaders need to think about that stuff. So excited to have that chat. Maybe a few words about the things you've done in the past that led you to where you are now or you're up to at the moment. Sure. Well, 30 years go by really, really quick, Sean. I think what's interesting is that I actually started out on quote unquote the other side. So I came from the Air Force and their security police and anti-terrorist division and that

2:32migrated into civilian law enforcement, federal law enforcement and then I got a lot of cases that happen to have security risk and privacy issues associated with cyber and data and all that cool stuff. So I actually went back to school to learn about cyber and the next thing I know I fell in love with cyber and second career, 20 years later, chief security officer for EMC, for ADP for a decade, bite dance and for the last few years before coming into advisory road supporting other chief security officers and CSOs in their roles. I get to do a lot of stuff and one of my passion areas of course is being a converged security leader wrote a book on it and it has been part of me helping other organizations for the past several years. Yeah, it's a good natural way I feel to establish a relationship with people and then get an understanding of what's going on, big picture driven by real stories, reality, right?

3:37So what are some of the things you're seeing organizations struggle with that maybe not every organization realized they should be struggling with or may not realize they are struggling and can't put the finger on what it is. So you know, typically there's really three flavors of this, two are from the CSO side and one's typically from general counsel side when I'm working with customers in this area. The first is an emergent issue that happens with a business, someone threatens an executive, the CEO, workplace, violence issue. I mean, it could be one of several different things, a travel security issue with a lack of operational expertise in place and they turn to the CSO and say, you do this stuff for a living, why don't you help us and make sure we're doing this right. So it becomes, you know, sometimes a sense of urgency to figure out what an organization should be doing at what level and is often, you know, the normal knee jerk reaction and

4:41then, you know, a pragmatic review. And the second flavor is when the, it comes in a not urgent way, but a CEO or the executive leadership team turns to a security executive on either side and says, you know, we'd like to streamline. We have costings we'd like to do and I'm tired of two different security leaders coming to me with two different sets of risk metrics, priorities, I want one throat to choke or one back to pet, I think I look at it and figure it out and create something that makes sense for me. And the third one is not much different, it comes from normally non security practitioners on either side and comes from the CEO or general counsel that says, you know, I'm being asked questions from the board about our ability to protect our executives, resiliency and threats to the business, their security, I don't think we have a good handle on it.

5:44And I would like an external view that has done this before for large companies to help us figure figure how to do that. And that has been, you know, kind of over the last call it three years or so, the majority of the cases that have come to me. And so how, I guess, like my question is, how, as with many things early days of cyber and I think executive and high, high level employee protection programs, it's kind of a fairly new concept in the grand scheme of things. Security is not new, but relatively new compared to a lot of other things. And I'm wondering, do organizations recognize this risk or are they waiting to hear that they're counterpart or the next business sector had an issue or some news element finally

6:48makes the mark to catch their attention? What's the awareness of this? I guess is the question. I think it's becoming more and more aware since the attacks on some business executives in the United States a couple of years ago and in ongoing cases around threats to people of high net worth. I think it becomes a consistent message and quite frankly, the level of violence perpetrated as well as tax through technology on identity and, you know, wailing and all the other things that we've seen around best type issues, it just kind of accumulates at the same time. I think convergence, in my opinion, of course, I'm slightly jaded, but is super important when you think about our responsibilities as business protection executives, right? Our jobs around ensuring the continuing operations and capability and the leadership in the go-to-market of business or an agency or whatever we do and some of that is cyber, some

7:52of that is resiliency and some of that is resiliency and availability of the people involved in doing it. And so it all mixes together and I think from my standpoint, from my purview, is that we often think it's cost level, right? Often businesses will push in this direction and say, I don't need a CSO and a CSO and a director of corporate security in this and that and there's a lot of reasons for it, but I think a lot of people immediately go to a cost and there is obviously cost multiples that make sense. It is the leveraging of the expertise on both sides as a force multiplier and I'll give you a couple examples. So most people, especially in what we do, understand that physical security and facilities defense and public safety now has a lot of technology embedded. And whether it's gauging large, it's technical security, whatever you want to call it or it's the management of certain intellectual property defense or it's our phones or what have we.

8:56There's an aspect of technology involved in physical security and our DevSecOps and our engineering teams have been doing this stuff for a long time. So giving them yet another discipline to add from the SOC or the CERC or the thread-in-tell platform or an operational control platform or what AbU is saying, physical security, device control management, PCEM, integration, it makes sense, right? You have a set of engineers that can provide a set of services in the existing infrastructure architecture that they know lead and manage and so you get a better quality product. Faster to a global initiative, typically these companies are global. Secondly, you get a better threat picture. I mean, at the end of the day, you get a better threat picture, right? Because there can be a threat to the business that is often you can have threat to people and the implications of that. So are people trying to steal data through an individual, are they trying to get through their homes into corporate devices or just get information to hold, you know, hold them

10:02hostage in some way, you know, or blackmail them. I mean, there's a lot of ways to look at this. I've seen companies have up to four different threat management platforms for their company, including cyber, executive, brand, and customer, right? And they all report differently. There's no single threat view and there's no team working all the threats. Again, it gives you this ability to consolidate the data to become a real true force multiplier in seeing that visual picture, that threat, and then being able to prioritize those risks. If I go in with a clear picture about a totality number of risks associated with security to the organization and sit down and can step through them in their implications with the CEO or executive security counselor or what have you, it's a much better conversation than the head of risk, the head of cyber, you know, the head of physical security coming at different times to talk to different groups without a standardized way to prioritize,

11:04manage, and address those threats. So again, it's a great way to do our jobs better. For me, the natural course would be the executive leadership team would have a question or a set of questions that are not siloed, like the teams are, right, they wouldn't go to security and say, give me the security risk or security positive, give me the physical team, security team, give me the challenges you're facing, they have the business view. Tell me as an organ, as a leadership team, these things, are we at a point where executives know how to ask that question across silo or what are some of the conversations and sound like, I guess. I think they're getting better, I think they know what they don't know and they're asking

12:04people to get the answers is the way I would look at it. You know, for other people, it's just another GNA function that they have to, you know, there's just a reality to that in many cases. But most organizations have an informed board, especially public organizations or those around critical infrastructure or those that have, just call it critical jurisdictional oversight from different regulators. And so those organizations are starting to hear questions from their board about the resiliency of their people, threats to executives, threats to the company. Others are involved in different areas. You know, when YouTube had the shooting several years ago, they did a great job in sharing what went well, what went wrong, and what they would do differently with other folks in the industry. So you saw other social media companies, competitors, actually listening and learning and doing certain things. So you see this industry by industry many times.

13:06Unfortunately, some of it pops up when there's a negative impact event, you know, we saw that a couple of years ago, you know, with the shooting in New York. And so, you know, that industry took, took a clear and different view and learned. But to answer your question, yeah, I think people are asking the right questions. And one of them is, what's the right level of security for the threat to the business and the type of people that we have working for us? I think that's one. The second one is, is how do we care for our employees when they're working on our behalf around the globe? I mean, think about how many people this week happened to be working somewhere in the Middle East for their organization and found themselves in a tough situation. Do we have the ability to provide the capability to remove our people as necessary, protect them, facilitate, transport, medical evacuation if they need it and all those things? And people are seeing this part of due care. And the last component, I would say that people are learning well is, do we have the

14:11right organizational structure, right? Are we set up to succeed? Most informed CEOs in general councils I talk to don't have the knee-jerk reaction. They're taking a step back and saying, how do we measure the risk, apply a lens that's appropriate for our organization and that we can carry forward and continue to do that view and make those right decisions? And I think that's a great approach. Yeah. I remember it was around the time in the pandemic and there was a lot of, I'll just say unrest here. A number of years back with demonstrations and protests and whatnot. I was speaking with a security leader at one of the large banks here in the U.S. and she was describing this need to not just protect the banking systems but to protect the banking people. She wanted to ensure that her employees at the bank were safe online but also at home because

15:14they were all working from home and perhaps in areas where there was unrest as well. And so they took this total view of how do we protect our employees digitally and from a cyber perspective but also from a physical and even a health perspective when we tie the COVID stuff into that. There's an interesting conversation I had with her a couple of times and I'm wondering, it doesn't seem like a lot of organizations have that view, right? It's, there's the system, the person gets rights to access that system and that's the stuff we're going to protect and we'll give them health insurance but that's the extent of the additional care we provide and unless you're an executive then maybe you get some detail to if you're traveling into a bad place or a risky place and we might monitor your stuff online to make sure you're not being targeted for ransomware, extortion, whatever. Where do we sit in terms of kind of softening things from the pure tech perspective to really

16:21understanding and caring about our people? So I believe that the the best in class companies that do this do it well with a risk funds but a broader discussion on employee protection, not just executive protection. That doesn't mean have a bodyguard for every employee that's not what I'm talking about. What I'm talking about is have the conscious and capability to understand the environments that the people work in and where they live and have programs that provide a level of continuity and capability that ensures that their employees are safe, the best of the company can provide. I think that's number one and I'll give a couple examples of that in a second. And the second part of that is is when there is a higher level of threat, threat against an executive threat against a key employee or a key employee who would be targeted

17:22because quote unquote they have the keys to the kingdom or they are the only people that understand a very sensitive part of the business is that the business takes a special view of that and understands that the employee's ecosystem is not within the four walls of the building of the office that they operate and but rather it is part of their home life. What we call their total life and how they operate and the risks on their family and their home and other things and they take an approach with higher risk issues and whether they be episodic or they be permanent because of an individual's perspective that they offer a reasonable level of do care and assistance to ensure that they have the necessary help that the company has put them in because of the position that they do that's that's kind of in that area. Now getting back to the employee area I'll give you some you know some pragmatic views of this. Maybe an organization has a capability that's watching for major events in large

18:24populous areas that their employees live in maybe they have you know a branch in New York a branch in Nashville a branch in Atlanta branch in the Bay Area whatever it may be and their their threat intel group or their employee protection teams monitor for significant events and so not just one do they have a fire in the building are they sending out an are you okay when there is something in a geographical region that impacts a significant employee level they send out are you okay or maybe it's everyone then they have some great automation and play that says hey I know you live within two miles and you're a work from home employee of you know this major you know fired petroleum are you okay and then have assistance and operations available to help those out whether there's a few third parties or through their own internal managed service that's great now I happen to have worked in the past for you know a large multinational

19:27that specialize in human capital management technology that focused on making sure that their people were up and up and able to help and support their their customers and so they had a massive capability initiative to be able to roll out kind of in a FEMA mode when something major have their hurricane or you know a massive disaster to go into those areas set up capabilities to get their people out of harm's way get them to a location that they and their families were safe and get operations back up and running and and and it wasn't just about the business getting up and running it's making sure their people and their families were safe and they were able to do their jobs in a safe location and so then the two helped each other and I know the employees were really appreciative of that and so were the clients so that's one example but I think there's two sides to that point absolutely well we have a few minutes left here and I want to kind of bring this back to the the security leaders who listen to this and perhaps maybe you and some of the

20:32practitioners who may or may not see things in logs that that might make them think hmm it doesn't it didn't trigger anything from a tech security perspective but now that I'm hearing this conversation perhaps there's an employee human perspective we should be looking at as well so some thoughts and comments for CSOs CISOs that maybe thinking about this this area and may not know how to approach it with their ELT and I don't know is there are there ways to tap into the board perhaps to make some change here as well then we started the easiest level maybe it's not a segmentation in a coverage program maybe it's a shared program right maybe maybe we become service providers to each other there's a CSO on one side and a director of focus security or CSO on the other side and the CSO provides engineering and thread and tell platform services maybe there

21:33is an opportunity for the CSO and CSO to marry up risk and threat services from a prioritization together as they go in and look at these things maybe there are opportunities for the organization to leverage executives going across each side so they have more rounded teams is often one of the things that they can do frequently and I see really great leaders and executives coming from cross-programs so that's number one number two is you know start thinking about what your business needs where they feel gaps they're going to tell I mean these this is nothing new this is something that I think we hear often and don't understand it so I have an open conversation with your leadership I have an open conversation with your CEO or or whomever and and ask you know are you getting

22:42everything you want do you think that security risk and privacy and physical security can be providing more and if so what and then do a planning session sit back and say okay if I'm if I'm going to jump into this what are the things the businesses asking for how does it help our go-to market our customers our employees and our shareholders and then do a crawl walk run you get some news done up before and and sit back and say what are the things I can do with existing people existing programs what are short-term things that we can do as an organization to plan for a next step to to create the level of service capability that they want and then start talking about the importance of convergence and how to have a standard management umbrella risk view and service delivery and financial model that makes sense for your business I think that's kind of the best way to to start yeah yeah this is spurred by by a post you made on LinkedIn and

23:43and I love following what you put up there and so I'll I'll link to that up that that article slash post in the show notes and hope everybody connects with you and and follows along with all the other stuff that you put out there it's good good to see it and thanks for thanks for getting back to the community and Sean thanks for having me I'm glad to cut your eye and happy to always have these chats with you so thanks so much for having the pockets likewise I appreciate you taking the time and thanks everybody for listening and watching this episode of redefining cyber security hopefully you open your mind a little bit more like it did for me and I get you to think a bit then perhaps take some actions to change how we approach security in our organization next again we're all and thanks everybody thank you