That Tech Pod
Welcome to That Tech Pod, a podcast co-hosted by Laura Milstein, Gabi Schulte and Kevin Albert. Each Tuesday, That Tech Pod will feature in depth discussions about data privacy, cybersecurity, eDiscovery, and tech innovations with heavy hitters in the industry. Subscribe so you don't miss an episode! Visit thattechpod.com for more information.
That Tech Pod
Why Do Big Companies Keep Getting Hacked? With Cybersecurity Expert Adley Francois
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Today on That Tech Pod, Laura and Gabi chat with cybersecurity expert, Adley Francois. Adley is a senior cybersecurity executive with over two decades of experience. He has created and assessed security infrastructure and operations at the national, international, and corporate level having worked with senior government officials, foreign ministers, and senior corporate executives in over 24 countries. Adley Francois is a senior cybersecurity executive with over two decades of experience.
Learn more at https://www.cywall.co
Follow That Tech Pod: Twitter-@thattechpod LinkedIn: LinkedIn.com/thattechpod website: thattechpod.com
Hello and welcome to that tech pod where we discuss all things e-discovery, data privacy, cybersecurity, and tech innovations. I'm Gabby Schulte and I know next to nothing about technology. And I'm Laura Milstein and I know at least a little more about technology. That's why each week we're talking to heavy hitters in the industry to help us break down these topics. And this week, Laura, who are we talking to?
SPEAKER_01Today we're talking to Adley Francois. Adley is the president and COO of SciWall. He is a senior cybersecurity executive with over 20 years of experience. He's done a bunch of work with the government and Fortune 500 companies across the globe, and is basically an overall baby Jesus of cybersecurity. Adley, thanks for being with us today.
SPEAKER_00Thank you, Lova. Thanks for having me.
SPEAKER_02What an introduction, baby Jesus of cybersecurity. Um I want to know more about that, actually. But before we get into the weeds of all things cybersecurity, Adley, would you want to just tell us a little bit more about you and how you got started in the industry?
SPEAKER_00Sure. I uh started in the industry, actually in the military. I served uh about six years in active director and and um in the military. So I was um initially a what they call a system analyst. So did that for about six years, and then after that, I I left the service and got into the financial industry. As we all know, the financial uh industry is heavily regulated, and it's also an industry that is heavily targeted. So that gives me a plenty of opportunity to sharpen my skill by actually learning to secure those sort of highly targeted uh type of environment. So in that particular space, I was a system engineer, I was a system analyst, I eventually became a director of security and eventually a chief information security uh officer within that space, securing a large financial um institutions across the country.
SPEAKER_02Awesome. And we want to dive deeper into um Cywall and your experience particularly, but before we do, this is the part of the show where we kind of want to take a step back in case anyone who is listening isn't super familiar with all things tech. So can you break down a little bit generally what cybersecurity is? What exactly do people mean when they say that, and why is it so important, especially uh in today's age?
SPEAKER_00Well, let's just put it this way, right? When you're looking at most things this way, uh most environment uh in today's world are digitize, right? So we no longer have boundaries, we no longer have borders, and everything is essentially connected to the internet. If it's connected uh to the internet, which means people can potentially access it, and if they can access it, they can make changes, they could potentially make it unavailable as well. So for that's essentially what I'm trying to do every day, right? To make sure the folks that need access to those particular systems can access it. And uh stuff that needs to be, you know, if you can imagine for a bank, uh uh once you make a deposit, you would want that bank balance to be accurate. So only folks that that is supposed to make changes to those particular balances have the appropriate right to actually do that. So that's essentially that the it's it's a lot of that. I'm oversimplifying it, but most systems and and most uh most of the data, it's all internet accessible. As a result, folks from across the world can potentially attach it, steal it, manipulate it, and things of that nature. My job is to make sure that uh only people that actually need access can access it, only people that that have the right to make changes can actually make changes. It's a lot of words, but that's essentially what we're trying to do here to some degree, making sure that there's that that data is available to the right person and uh and making sure that that data um is not is not manipulated in any way. And uh that's the gist of it, right? It's a lot more complicated than than than than that, but we want to make sure stuff is available and and and only people that have the correct access could could change it.
SPEAKER_02Right. No, yeah, I'm sure it's way more involved than that. Um, but given that, I kind of want to ask you about something that happened at the time of this recording. Um, it was kind of breaking news that there was a major internet outage uh from Washington, DC to Boston affecting internet and cloud providers. Um and so in in cases of that, uh what role does cybersecurity play? Because you talked about you talked about there's really no one no borders anymore, and when internet and and cloud servers are uh affected in that way, what what kind of what kind of um kicks into gear from a cybersecurity spec perspective?
SPEAKER_00Correct, we don't know what the nature of this particular outage is yet, right? But when you're looking at outage, those could be an opportunity for bad guys to potentially have access to system because an outage could actually create a blind spot for security systems and security professionals. So potentially that's a vulnerable position when whenever you have any sort of outages, right? But beyond that, uh there are things like denial of service, where potentially a bad guy could actually bring down uh entire economies that have happened before with uh um broad distributed denial of service a couple of years ago, they actually brought down literally uh um barely you know half of the 14500 companies almost simultaneously. So that's a um those are all things that could potentially happen. But with this particular case, we don't know exactly what happened. But Mike, uh one of the concerns that actually comes to mind immediately, it's the it's a blind spot, right? Uh uh and it creates opportunities for somebody to take full advantage of systems.
SPEAKER_01Right. Interesting. So um, Adley, speaking of that, I I know that you do have a vast experience working with the government and Fortune 500 companies. So when you're working with them, what are some of the top security priorities for both of these sectors? Is it more of firewall management, patch management, vulnerability management? You know, I think nowadays a lot of people say we have everything in-house, and then all of a sudden there's a major issue that happens to these bigger corporations. And so it makes you question if you have everything, why did that happen? How did that happen? Um, you know, what are those big uh big top security priorities?
SPEAKER_00Correct. Uh it it's all it's it varies for different organizations, right? I think when you're looking at uh across the spectrum of cybersecurity, there's probably more than a dozen different disciplines that requires uh deep domain knowledge and deep uh expertise within those particular areas in order for an organization to manage those particular areas effectively, right? Almost no one companies are gonna have, unless you're, you know, unless you're a super large organization that have you know 50, 60 cybersecurity professionals on staff, it will be pretty hard for you to have deep domain expertise within 12 particular um domains, right? Uh you're going most organizations are lacking within one area or or another. Uh, I've within the government space, uh I've done a lot of program design within that space. This is where we're talking about uh things like policies, procedures, process, and being able to align things to a specific framework within the commercial space. Uh, sometimes it's specific things like vulnerability management, and sometimes it's operational issues like how do I design a security operation or a security infrastructure that is effective, that is scalable, how do we multi-layer all of those different uh sets of technologies that where we get the best bang for our buck and things are designed in such a way where it can scale with the organization and things in that nature. So there's a lot of that that actually happened within the commercial space. But obviously, things like manage firewall, manage ideas is part of what I deal with in a day-to-day basis, but also again, program design, right? It's hard to put, uh it's hard to operationalize security without starting with a program, without having the overarching governance, policies, procedures, process. And then from that point forward, you work your way down towards technical control, right? Uh technical control are things like antivirus, firewalls, and things of that nature. But if you don't have an overall governance program, you're somewhat throwing dots at the wall, right? You don't have any overarching theme to what the organization is trying to achieve from a security perspective. So it's all based on where the organizations that I'm dealing with, it's all based on where they are within the life cycle. Some of them have very have good governance where they have a program that is mature, and all we need to do at that point is we're working on the security controls. And there are some that where we need to build that that overarching program from scratch and then put together a multi-months or a multi-year uh plan to make sure that they are getting to a more uh secure state.
SPEAKER_02Yeah, and so uh building on that a little bit, what are the main challenges that you're finding um not only for you and your company particularly, but for the cybersecurity industry as a whole, what are some of the challenges, the biggest challenges that you think are are out there today? And then also what are some of the solutions to those challenges that you think are most efficient to tackle them?
SPEAKER_00Well, if we had a single solution, I'll be the richest man in the world uh today, right? But I don't think I don't think there is a single solution, right? But I think there's this child the challenge is multi-faceted, right? You have uh new threats that is coming out almost on a daily basis, and you have most companies these days do not have borders, they don't have parameters. So now everybody is in the cloud, right? They could be in AWS, they could be in Azure. So you got really completely distributed system, and employees are no longer working from a single office, they could be working from home or anywhere else around the country. So that makes the problem, you know, the scope of it, the scale of it is quite significant. But beyond that, I think to solve it, you obviously need uh um uh good uh a good program. You obviously need the right mixture of technology, and you obviously need the right sets of people that can manage uh uh those technology by tuning them appropriately, enhancing them to business rules, and making sure that they are effective for that specific business, right? And one of the things that we face within the industry is a challenge um human resource. Uh uh folks that have the right set of knowledge to be able to do this sort of work. They're not necessarily available for that reason. That's why we have our labor pool is not just centrally located within the United States. We are pulling on staff here from North America, both the US and Canada. And we're also pulling from folks from India and various parts of the world to make sure that we're bringing to bear for our client all of the best possible mind that can uh wrap their heads around this challenge and uh and reduce risks for them.
SPEAKER_01That's very interesting, Adley. And uh one of the reasons we wanted to bring you on this show is because you know, Cywall is one of the top cybersecurity companies. You are a cybersecurity company that seems to be known for handling things that other cybersecurities can't, the companies can't handle, which which makes me wonder, you know, what what secret you kind of have to be able to always be that one that can solve the problems that others can't. Is is there anything that that you can tell us about uh trends in cybersecurity or things coming down the pipeline to pay attention to?
SPEAKER_00Yeah, I mean, I think it's just uh when you're looking at the way we manage things, it is changing in a day-to-day basis, right? I think it's a um things like identity and access management, the way that uh the way that we we manage uh identities across company simply because of the borderless uh situation, because of the way um uh uh the lack of parameter. I think uh identity and access management is becoming more and more important. And then beyond that, um uh privilege management inside of an organization, those sort of things are becoming quite uh uh imperative, right? Uh who has uh the keys to the kingdom? Who can make massive changes across the environment? And how do you keep those particular keys safe? I think those are becoming, those are hot topics that is um that is that that we're helping our our client to solve those those sort of challenges uh as we speak, right? So it's a uh uh if um if the keys fall into the right hand, massive amount of damage could be done, right? So it's to have the right system, the right structure to make sure that at all times, 24-7, regardless on where a particular system exists, those particular keys are actually uh secure.
SPEAKER_02So, Adley, before we uh end the discussion and let you go, is there anything else you want to add to the conversation uh in terms of cybersecurity? You know, we we talked a little bit about challenges and trends. Um is there anything else that you think you know people should know either if they're kind of getting into this industry or if they're veterans of the industry? What do you what would you add?
SPEAKER_00Correct. I mean, ultimately, to summarize things, there are no secret source, right? There are no silver bullet. It's a lot of things that have to be done correctly in order to maintain security, right? It's um it's systems, it's people, it's visibility, it's all of those sort of things that have to come together all at the same time in order for companies to remain secure, right? So uh with that says I think that's just uh uh most companies have a significant amount of things that they have to do, and they have to do them right all the time in order to remain secure. So it's not just one thing, it's not buying a firewall, it's not buying an antivirus, it's not hiring Joe, but it's it's all of that, plus a half a dozen of other things, all of them have to work cohesively in order to uh to secure an environment.
SPEAKER_02Awesome. Well, Adley, this has been such an amazing conversation. We want to thank you so much for joining. Um, is there any is there uh anywhere that people can follow you or find you or your company, you know, if they want to reach out for more information, or if there's anything you kind of want to plug uh and let the audience know is out there to go and check out for themselves.
SPEAKER_00Well, we can always be reached at www.sywall.co. So that's that's an easy way to actually uh get to us.
SPEAKER_02Perfect. And we'll be sure to note that in our episode notes too, just so everyone for sure has that information. So thank you so much for joining us. Uh this this was awesome, Adley. Thank you so much. Okay, thank you. Thank you for listening to that tech pod. Laura and I have some big news coming up, so be sure to stay tuned. Listen next week. Uh, we're really excited to be announcing some really exciting things. In the meantime, make sure you like, share, subscribe, uh, do us a favor and write us a nice review on Apple Podcasts or wherever you're listening to this podcast. Uh, if you just heard a sigh, that was my dog because she's over me uh recording. So I'm gonna let you guys go. Have a great week and see you next time.