Who Owns Cyber Risk? NIS2 Explained with Matthew Rosenquist, CISO & Cybersecurity Strategist

(Matthew Rosenquist at 00:00:00) Because a lot of the predictions you'll see, it's marketing fluff. Let's not split hairs here. It's made by companies that are trying to get you to buy their product. So what we've seen, and we've seen in the US, we've seen all over the world, is that boards and executive levels will insulate themselves. They'll hire a CISO.

(Matthew Rosenquist at 00:00:24) If I told you I could give you total security, but it would cost you 100 times your annual revenue, you'd go, no, absolutely not. Right?

(Joel Beasley at 00:00:40) I wanted to give a special thank you to Nord Security for sponsoring today's episode. And Nord has been kind enough to give us a discount link for their newest product, NordLayer Browser, that we have put in the show notes below. If you don't know, NordLayer Browser gives IT control over browser sessions so that work data stays protected where the work actually happens. All right, let's give some foundation. Who are you? Tell me about your podcast and your career and what you've done.

(Matthew Rosenquist at 00:01:07) So Matthew Rosenquist. I'm a cybersecurity strategist. I'm a CISO. I've been in the industry a little more than 36 years. So I started in this industry before it was called cybersecurity, before it was even called information security. So I was in this field when it was a dead-end field, but I'm here because I have a passion for it. And I have a passion especially around understanding the intelligent adversary, and that's what really fundamentally changes cybersecurity and sets it apart from IT problems, where you've got a technical problem and therefore you can have a technical fix. And so I've had a passion. I did 24 years at Intel. I justified and built and managed their first 24 by 7 SOC. I was the first incident commander when there were no incident commanders in the industry. Right? There were no real crisis or groups that went off and figured things out like that. I've managed security for hardware, firmware, applications, infrastructure, cloud, AI, you name it. And throughout my career, which has been really focused on making digital technology trustworthy... Right? We have to look at all these different layers in that cake, from the hardware, the firmware, the OS, the apps, the networking, the data formats, and whatnot. I've been advising governments, businesses, and academia to look forward. Right? Looking back is easy. What broke yesterday? What was attacked yesterday? But looking forward is really where the value becomes, because that enables us to align and position ourselves, orient our resources for maximum effect. So I have done cybersecurity predictions every year for like 15 years. I started at Intel, and I'm one of the few people that publish it openly free. I'm not trying to make any money or anything, but it's really about changing the perspective of our industry so that we can be better prepared to make our digital ecosystem, make our digital world more trustworthy and beneficial to everyone.

(Joel Beasley at 00:03:26) How accurate are you with these predictions?

(Matthew Rosenquist at 00:03:30) You tell me. My predictions are available online, and I want people to go back and look at them. Because a lot of the predictions you'll see, it's marketing fluff. Let's not split hairs here. It's made by companies that are trying to get you to buy their product. So their predictions are around whatever they sell. And then they don't want you to look at them for the next year. Oh, no, no, no. Right? I want you to look at mine because credibility comes from consistent performance. So please, anybody, take a look and criticize. Give your fair assessment. Am I good or am I not good? Now I will say I go to different organizations and medias and have them review them every year. And typically I'm in that 90% range, which is far above and beyond what most organizations can do. So I'm proud of it. And people keep asking me, and governments keep asking me, okay, what are your predictions for next year? We need to figure this stuff out. But yeah, I want everybody to go out there, take a look, and determine, hey, does this guy know what he's talking about, or is he just crazy?

(Joel Beasley at 00:04:45) Yeah. Maybe a little bit of...

(Matthew Rosenquist at 00:04:47) May be both. Right? They're independent.

(Joel Beasley at 00:04:51) I love that, though. You're exactly right. The marketing, they have to push everything through their lens. So... But you're in there shoulder to shoulder with the practitioners. So you don't care. You don't have a dog in the fight. You're just... My dog in the fight is understanding for my peers where things are headed, not for a particular brand. So that makes sense.

(Matthew Rosenquist at 00:05:12) I don't like to lose. I don't want my industry to lose. So I want everybody to win.

(Joel Beasley at 00:05:17) Even the intelligent adversaries.

(Matthew Rosenquist at 00:05:19) We are fighting not against each other as vendors or products or services. We're fighting against the adversaries, and we have to keep that in mind.

(Joel Beasley at 00:05:27) You don't want them to win?

(Matthew Rosenquist at 00:05:29) No. Everyone loses. Everyone loses when they win.

(Joel Beasley at 00:05:35) Let's talk about first of all, how do I say this? NIS2? Do I say it NIS2?

(Matthew Rosenquist at 00:05:40) NIS2. However you want to say it, because we have NIST in America. Right? Institute of Standards and Technology. NIS2, people sometimes get confused here in the US. In Europe, they understand it. So however you want to say it.

(Joel Beasley at 00:05:55) Okay. Well, what is it? Let's start with that.

(Matthew Rosenquist at 00:05:59) NIS2 is an EU directive, and that's important. It's not a specific regulation. It is a directive to help the different European Union countries or anybody else around the world. But it's kind of a framework to say, okay, independent countries and governments, go off and create your specific regulation for your country that aligns to this directive, these strategies to make the world better, if you will. And there's an analogy here. If you go back to privacy... Right? Europe has some of the strongest privacy regulations. Well, as a precursor to all that, they had an EU directive. Actually, it was back in 94-95. And it was the EU directive for privacy, digital privacy. And that's what spawned all the individual nation states coming up and coming together to create some of the most privacy-forward rules and regulations around the world. This is the same thing, except it's not focused on privacy. It's focused on executive-level cybersecurity accountability.

(Joel Beasley at 00:07:19) Why didn't they just blanket the laws across everyone?

(Matthew Rosenquist at 00:07:22) Well, because every nation there is an independent sovereign country. They have to decide what's applicable to them, their people, their priorities. And so the rules and the jurisdictions have to align with what's already on the books and what's important to those individual nations. And so they have to craft it. So the directive, the EU directive, is kind of a given framework and still allowing individual countries to tailor it and adapt it to their needs, their peoples, and their priorities, and still having a common overarching umbrella.

(Joel Beasley at 00:08:05) But was the GDPR a law across the whole union?

(Matthew Rosenquist at 00:08:09) GDPR is, because they all decided, yes, let's start getting together and hammering that out. It started as a directive. Right?

(Joel Beasley at 00:08:19) Oh, it did. Okay.

(Matthew Rosenquist at 00:08:20) Yeah. The EU... It was the 94-95 privacy directive. That was the directive that started the conversations about these different nation states. And they started working on regulations, and they eventually came together because they realized if it were too far apart, right, it starts to create cracks that people can take advantage of. So that was one of the things where they realized privacy is so important. And they have a historical precedence on why it is that we don't have in our culture. Right? World War II, where privacy really was going to determine whether somebody potentially could live or die. They felt it's so important that they decided to come together. And over the years, it has gotten closer and closer and closer.

(Joel Beasley at 00:09:10) So they're taking a similar path. They're first starting as directive.

(Matthew Rosenquist at 00:09:14) And this is normal for the EU because they do respect their individual member sovereignty, rights, priorities, and so forth. But they come together because they realize big problems need cooperation.

(Joel Beasley at 00:09:28) So you don't think we'll end up with 20-plus different NIS2s? They'll probably all come together and come up with one.

(Matthew Rosenquist at 00:09:37) So not all the countries are on board just yet.

(Joel Beasley at 00:09:40) Okay.

(Matthew Rosenquist at 00:09:41) Right? So we've got a lot of them that have created national legislation. You know, Germany, Italy, Belgium, Greece, Slovakia, Romania, things of that sort. But there are others that are, let's just say, in the process, and they're working towards that. So it's not done yet. And until you get the individual country regulations and understand, well, what are the real differences? The differences do want to be overcome. Sometimes they can. Sometimes it's a little more difficult. So until we get there, right, we've got big members like France, Ireland, Spain that don't have the regulations in place yet. So again, depending on how divergent they are will depend on how much it can come together.

(Joel Beasley at 00:10:36) I'm sure they're using AI to just like copy and paste. So like, what should we do? Ah, let's do it. It's weird, though. Right? Because we use it as humans for all sorts of things. And it's like, what stream are you drinking from? You know, it's kind of interesting to me too, because they're going to be using the intelligence that we have available to us to help weigh some of these decisions. And that's to me a fascinating area that's very off-topic from this episode, but how that'll impact us as humanity going forward.

(Matthew Rosenquist at 00:11:07) It's a whole different topic. It is very interesting. And I think it will play a lot when we look at governance, when we look at security, when we look at privacy, when we look at acceptance of risk. AI will play a more, a growing level of importance and a play in all of those decisions.

(Joel Beasley at 00:11:30) So now that we understand NIS2 is a directive, not regulation, and then the countries will make their own regulation inspired by the directive, what is it exactly? What are they directing in there? Is this...

(Matthew Rosenquist at 00:11:44) Yeah. What is the problem this really is trying to address is the heart of the question. And what it really comes down to is making sure that executive-level management and shareholder representatives, right, and we're talking board levels, we're talking C-suite levels, CEOs and C-suite, that they actually have to take accountability for the cybersecurity, right, of their organization, the data that they manage, the systems, and the interdependencies on how that impacts critical infrastructure and things of that sort. So what we've seen, and we've seen in the US, we've seen all over the world, is that boards and executive levels will insulate themselves. They'll hire a CISO and kind of give them a little leeway, maybe get a few reports once a quarter, but pretty much they are the scapegoat. And if things fall, break, get breached, they then blame the CISO. Oh, well, it was our CISO. It was our security. Right? And they are able to extricate themselves from the responsibility of failures. And this is meant to address that so that the boards can't go, oh, I didn't know. Right? And really hold them accountable. And in some cases, liable. In fact, the directive specifically calls out they should be held liable. So each individual country, when you write your rules, keep that in mind. They've got some recommendations about the liability, about the potential impact. But we don't want companies and their executives and their board members to go, oh, gee, I didn't know. Oops, I'm sorry. We created a cyber incident and exposed the population's sensitive data. Or, oops, something bad happened. How could we have known? And now the critical infrastructure, the power, the water, the food distribution goes down. Right? It's simply raising that accountability so you don't have plausible deniability. You have to own it, which means you have to have more oversight for cyber risk, just like you're held accountable to the other types of risk you're responsible for, whether it be competitive risk, regulatory risk, whatnot. Boards already understand, oh, I have to manage that. But for cyber, they have taken a step back or not wanted that level of accountability. This defines it. This mandates it and says, no, you will be held accountable.

(Joel Beasley at 00:14:37) And so what does that... What are they just going to wrap that in insurance policy? Like, how do they manage that risk?

(Matthew Rosenquist at 00:14:44) So, you know, insurance policy...

(Joel Beasley at 00:14:46) I'm sorry. I just want to say one more. They're not just going to wake up tomorrow and change as human beings. Like, we... You and I both know these types of people. They're great people, whatever. But we do understand that human behavior change is not an instant thing. Anyone who's lived any amount of time here understands that. So the reaction is, how do I put a protective blanket on me? And is it insurance? Is that the answer?

(Matthew Rosenquist at 00:15:08) Well, insurance only has certain limited benefits when we talk about these kinds of regulations, especially within the EU. So if you are breaking the regulation, and there's two different types of insurance, D&O and E&O. So you've got directors and officers insurance, and then E&O, which is errors and omissions. So if you're a service provider. Right? And the services you provide are bad. But D&O is the big one. Now, D&O insurance... And again, I'm not an attorney, and you should definitely talk to your insurance broker and read every clause in your insurance that you're paying for, including the cyber clauses. But essentially, D&O, if you line it up right, can help cover attorney's fees. Right? If the nation comes after you and says, hey, you guys did something wrong in the cyber. You weren't following this regulation. We're going to pursue litigation on you. Right? The D&O may cover the attorney's fees, but if you're found liable, right, by that nation, by that court, by whatever system that nation has, insurance won't pay that fine. So the company is then going to have to do it. You cannot transfer the risk of the penalties if found guilty. So there's a certain barrier that you can't cross, and this is also true in GDPR. Right? So there is a standard that's set. So insurance only allows for so much risk transference. And that's all insurance is, is you transfer the risk. You're not mitigating it. You're not eliminating it. You're not accepting it. You're essentially insuring against it to transfer the risk. Now, the other thing that you mentioned is, hey, behavioral change, because this is a behavioral change. We know behavioral change doesn't often happen unless there is some motivation, some relevance. That's why you have regulations. Right? That's why you have penalties. Because if you don't have those and people are not acting in the best interest of their customers, suppliers, vendors, or whatnot, they're not going to change. So you have to put regulation in in situations like that to drive change. And this isn't... These concepts are not new. That's the other thing. Boards have been told this for the better part of a decade. You have to take more responsibility. You have to have accountability. You have to have awareness. You should be bringing in experts. You should be doing proper risk management. You should be handling this.

(Matthew Rosenquist at 00:17:51) You should be able to look at it from a preventative as well as a response, right, survivability aspect. So they've been constantly bombarded, but it takes work and effort, and that has been the barrier. But now when you have regulation that says you have to, or you may be personally liable as well, right, that would be an extreme case.

(Matthew Rosenquist at 00:18:15) Now that's where you're going to see the transition, where you're going to get over that final hump. Okay, now we have to. It's a regulation. We have to do this.

(Joel Beasley at 00:18:24) Oh, boy. So personally liable sounds really scary. That sounds like it's going to get a lot of attention.

(Matthew Rosenquist at 00:18:31) It will. And, you know, the reality is for regulations like this, and we've seen a few in the US as well, the number of cases that really get down to that level is really, really small. But it doesn't have to be big because if you're an executive and you sit in a comfy chair and you drive a nice car and live in a beautiful villa, right, the idea that you may go to jail is just not acceptable. Right? So I don't care what the company has to spend. Let's make sure we're in alignment with that. I don't want my personal fortune or freedoms at risk. Now you have my attention.

(Matthew Rosenquist at 00:19:12) Okay, whatever the company needs to do to be compliant with regulations is really what we want to do. And that's what it takes. Sometimes you've got to make sure there's skin in the game by the decision makers.

(Joel Beasley at 00:19:24) So right now, they could more so just blame the CISO and fire them and say, hey, sorry about that.

(Matthew Rosenquist at 00:19:29) Yeah, that absolutely happens, of course, right? Or if they don't have a CISO, go, oh, we don't have a CISO. I guess we need to hire somebody. That's, you know, forgive us. We'll go hire somebody. And there's very little recourse right now.

(Matthew Rosenquist at 00:19:43) If you're a shareholder going, wait a second, you didn't even have a CISO? Right? You didn't even have a risk plan? No. No, we didn't. There's very little recourse. But if there's a regulation that says, hey, you need to have these things, you need to be overseeing it, and now you failed, hey, now I'm going to sue you. You have failed your fiduciary duty as a board member. Now I've got grounding. I've got standing to say there's regulations that you ignored. Therefore, I'm going to sue you, right, for this incompetence. So it brings in a lot of other risks that definitely get the attention of board members, right? Shareholder lawsuits is not a good discussion topic in board meetings.

(Matthew Rosenquist at 00:20:32) Right? So, yeah, you get more attention, you get more seriousness, you get more focus, which is really what the industry and governments are asking for by their suppliers, by those companies that are handling critical infrastructure of the nation. Right? We want to make sure they're stepping up and they're being responsible, especially as the risks are going up, including the risk from that AI. We talked about AI. AI is skyrocketing those risks. So they're trying to move now to make sure that executive level management take it seriously, act professionally, and incorporate this in the corpus of their responsibility that they're actively managing.

(Joel Beasley at 00:21:20) I know you're not a legal expert, but I'm... My... We can edit everything and do whatever you want. But my curiosity is pulling me towards... I don't understand how it works in other spots. Like, let me give you an example. Let's say you're a transportation company. Obviously, the transportation regulations are very clear. If you violate those, does that make those executives personally liable?

(Matthew Rosenquist at 00:21:43) Potentially, right? It depends on the regulations, and it depends on where that accountability sits. If you own a trucking company and one of your drivers runs a red light, you know, when it's a one-time thing, no, you're not going to be held accountable. I mean, you're going to pay damages and whatever, but the board is not necessarily going to be held accountable for that. Now if the board knew that drivers were driving drunk and they decided, no, we're not going to do training, no, we're not going to do vetting, no, we're not going to establish policies, and from a systemic perspective, they are going to intentionally ignore those risks, and there's accident after accident and this is piling up, then, yeah. Yeah. The shareholders may come after the boards. Regulators may come after the boards and say you are not meeting your duties here as board members.

(Joel Beasley at 00:22:42) Yeah. That makes sense. I was interested to know, you know, why we don't have this already, and I think it's just because of the newness of it, right? Because when you... And also, it's not so visible. Like, let's keep going with that transportation analogy. If you're not getting your brakes checked and you start seeing semis pulled over and families dying and, like, all this... You can see it. It's out there in the world. It's very obvious that it's happening. This tech stuff isn't so obvious. You can see brake pads pretty easily. Seeing malware, it's just like it's not the same thing. It's not this physical object in the same way that the average person interacts with these other physical objects in society. So that would make sense, and you could tell me if I'm way off base. But that would make sense about, like, why we don't have it yet.

(Matthew Rosenquist at 00:23:33) It's definitely one of the reasons, right? The ambiguity, the plausible deniability, and the attribution when it comes to cybersecurity incidents is so murky that it is very, very difficult, right? Only now are we starting to get regulations here in the US that say, hey, if you have a data breach, you have to let people know. Yeah. They didn't have to previously. And in some industries, they still don't. In many situations, they still don't. Right?

(Joel Beasley at 00:24:07) Today in the—

(Matthew Rosenquist at 00:24:07) US, I don't even have to tell my shareholders or my business partners or suppliers, vendors, or customers when an incident happens. Why would I? Right? And maybe it happened, and maybe it was my fault. Maybe it wasn't. I don't have to investigate it. Right? And, you know, your data gets breached and you get hacked. Can you really point it back to me? I mean, you deal with a lot of companies. You have your data all over the... Can you really definitively point it back to me? You can't? I don't see a problem here. That becomes the mentality, right, when you can kind of have plausible deniability, right, when investigating things and doing security properly and that investment and that friction to your business, if you can ignore it, why wouldn't you? Some companies act unethically. Right? And some people wouldn't say, hey, no, that's not unethical. That's good business. You're saving overhead costs. You're helping the value of the stock by not wasting money on security. Right? Unless you're being held accountable, why waste the money? That is part of the problem. And so now we're seeing those foundational blocks starting to come in. If you have a material breach, you have to report it.

(Matthew Rosenquist at 00:25:40) Right now, this is a requirement for... In the United States, just recently, right, for publicly held companies. You have to report it. For certain industries, health care, for example, doesn't matter if you're public or private. If it's more than 500 records, like here in California, over 500 records, you have to report it. But there's still gaps. There's still inconsistencies, right? And a lot of it comes to judgment, right? Even the strongest rules we have, it says you have to report a material breach. Well, some people can argue, well, what's material? Right? I don't know. Let's talk to our attorney and finance department and see, is that material? Well, it's certainly going to be material if we report it. I'll tell you that. Right? So, again, companies can play games, and we've seen this. We've seen this in lawsuits. It's a little squishy. So the reality is companies will act in their best interest or the perception of their best interest. Most upper tier leadership, executives don't understand cyber risk, right, and believe it's a technical problem that just can be fixed anyway. So there's a lot of misconceptions.

(Matthew Rosenquist at 00:27:05) Attribution to did it really happen? If we don't look at it, maybe it doesn't. Nobody can point it back to us. You know, maybe it wasn't us. Okay. We had a data breach, but so did somebody else. Maybe the negative impacts were attached to theirs and not ours. Right? So you've got a lot of this variability. And people don't want their companies to be devalued. People don't want customers to be angry. People don't want lawsuits from shareholders. People don't want lawsuits from their vendors or suppliers or whomever that there may have been, you know, detrimental impacts. So regulations that call out specific things are important in situations where organizations or industries are not aligned to the benefits of their customers or anybody downstream. And I, for one, actually don't like regulations. Right? I'm not a regulate everything kind of guy. In fact, I don't... I would rather have market forces because in general, market forces tend to reward those who are best servicing and providing the best products and services to the market. Right? In general, that works. But there are cases, especially cases where attribution and so forth can't be pointed back, right, to an individual company where the market has malformed in such a way to where that isn't rewarded. Good security, good safety, good privacy isn't rewarded, and that's where we do actually need to have regulations and strong, clear regulations.

(Joel Beasley at 00:29:01) I feel like I'm data breached out. I get, like, notifications every day. And I just... I have, you know, obviously, a password manager system. And so I roll my keys. And then I wonder about, like, is the Social Security number concept ever going to improve technologically? Like, can I? I should be able to roll my SSN key if it appears in a breach, but I can't. You can't do that. You get one. Do you think we'll ever improve that, or how do you think that'll go?

(Matthew Rosenquist at 00:29:29) There are limitations to all security that we have. So Social Security in the US, for international viewers, it's similar to a national insurance number, right? But our Social Security numbers here in the US, which are issued when we're born, do not change ever even if they're breached. And so that's a limitation. In general, you shouldn't be using Social Security for any type of identification other than trying to get Social Security benefits. Unfortunately, our industry and market has decided, hey, that's a unique identifier. Let me use it for every business service. You sign up for a cell phone plan, you have to give your Social Security number. Right? It really wasn't intended to do that. It was intended for a specific purpose, and in using it that way, it can be secure. We have to understand that when we're identifying people and authenticating them, there are certain strengths and limitations based on the type of tools that we use. For example, how many people out there use facial recognition, fingerprint scanners, any type of biometrics? If that's breached, you can't change that either, can you? So we understand that to be a limitation. Is that a great method? Well, there's pros and cons for that. You're using a password manager, which means you're probably setting it, hopefully, to very high complexity for passwords or passphrases. That's great. And they should absolutely be unique, never reused across different services. The stronger that passphrase or password, again, the more secure. However, it's also more complex. You're not going to be able to remember it. You have to use the tool, so there's an inconvenience factor that's associated with it.

(Matthew Rosenquist at 00:31:22) So again, there's trade-offs in security, and that's important to understand. And this is something that the boards will have to understand. And, you know, I've got my own advisory company and I work a lot with boards, boards, CEOs, C-suites, and so forth. And there is always a learning curve because when they bring me in, typically it's something is not going right or they need help or whatnot. So there's a learning curve. And one of the most common problems I run into is even today, they will ask, oh, we need to be good on security. What do we need to buy? Right? What tool? Right? Or what technology do we have to institute? Well, there's not just a simple tool that you buy that works for everyone that gives you security, and security is never in totality anyway. Right? And so we have to start understanding, and it's not just technical. There's behavioral. There's process aspects to it. It's really a matter of finding the right level, what we call the optimal level of security. And it's a trade-off between what is acceptably secure, how much it's going to cost you, and what is the friction to your organization. If I told you I could give you total security, but it would cost you a hundred times your annual revenue, you'd go no, absolutely not. Right? But, on the other end of the scale, I can tell you I can give you zero security and you'll get hacked every day, but it won't cost you anything. Well, no, we don't want that. I said okay. So we know it's not way too expensive and zero, but it's somewhere in the middle. Now let's have a discussion where you're happy. Right? Where the amount of money that you're willing to spend to reduce the risk to an acceptable, informed level, right, and the impacts to your business. It may... Security may delay your product release. Security may inhibit features. Security may consume engineering and internal resources. Right? Okay. Great. But you, as the executive leaders, have to figure out what that optimal balance is in an informed way and go, yes. That's the right amount. And they do that with business risks. They do that with regulatory compliance. They do that with all sorts of other risks anyway. So this isn't some strange concept. But once it's explained to them, the light bulb goes off. Oh, I get it. It's not binary. It's not a simple fix. It's not just technical. Oh, I have to do what I do every day and figure out what that optimal path is and keep us on it.

(Joel Beasley at 00:34:08) Tell me about the incident reporting inside of the NIS2.

(Matthew Rosenquist at 00:34:13) Yeah. So this has caught a lot of attention. Part of that transparency, part of the trust, part of that foundation we were talking about to get out of that ambiguity is you have to be able to communicate when something bad's going wrong. Because if not, now you're hiding it, you're concealing it. There's all sorts of problems. So the reporting requirements, which is steeped in traditional terms, but the world is coming to accept it, is any time you believe you have had a cybersecurity issue, right, of material value, of significance, you have to give what they call an early warning for any significant incident, and that's twenty-four hours. Twenty-four hours from the point that you realize there's a significant incident, you have to report it to some type of regulatory oversight body. Okay? And some of these are going to be false positives. Hey. We think we got a data breach. We weren't sure. We reported it, but after we investigated it, no. It was just a server. You know, a power supply went down and a server went out and nobody hacked it or anything. A fuse blew. Oh, okay. Fine.

(Matthew Rosenquist at 00:35:31) Right? But that early warning within 24 hours. Within 72 hours, they have to give an incident notification, which essentially says, okay, you have 72 hours to determine, was this actually an attack, a breach, an incident? If it was, you now have to formally notify us.

(Matthew Rosenquist at 00:35:54) You've already given us the early warning, but now we've hit the 72-hour marker. Now you have to definitively have said, yes, this is, or no, this is not an incident. And then in general, and there's some exceptions, in general, one month after that incident notification, you have one month to give a final report. And the final report is what you would expect it to be.

(Matthew Rosenquist at 00:36:23) What happened? What caused it? What were the failures? How did we fix it? What was the damage, kind of thing?

(Matthew Rosenquist at 00:36:30) And you may not have all the details at any of these levels, but there is an expectation of good faith that you've done your due diligence, you've employed the right resources to come up with the best answers possible. Right? You didn't ignore it and that you're being forthright in the findings that you had. So if it does go to court and we subpoena your CISO, we subpoena your network architect, and we subpoena whomever, right?

(Matthew Rosenquist at 00:37:00) And maybe we even subpoena the attacker, that all the stories jive, that you did give a clear report out for all of these early warning incident notification and final reports.

(Joel Beasley at 00:37:16) Did you just say subpoena the attacker?

(Matthew Rosenquist at 00:37:18) Sometimes you get the attacker. Right? Think about it. Alright. If an incident happens, and we've had this before.

(Matthew Rosenquist at 00:37:26) An incident happens and the company decides we're gonna hide it. We're not gonna be forthright about it. And the regulators go, hey, wait. Something smells fishy here. And eventually, the bad guy gets caught. Guess what the bad guy is gonna do? Oh, I'm gonna rat out the company.

(Matthew Rosenquist at 00:37:47) Oh, no. They knew. I was telling them they were hacked. I sent them the information. I sent it to their CISO and their CEO and their board members.

(Matthew Rosenquist at 00:37:54) They knew on this date. I can show you. I'll give you all that if you reduce my sentence. And again, the board members are like, oh my gosh, right?

(Matthew Rosenquist at 00:38:05) Yeah. We, you know, wait, start deleting files and emails and everything else. And that's where you get into some of those personal liabilities and personal criminal penalties that could come into play, where you intentionally did not comply with the regulations. You intentionally misled government investigators. Right?

(Matthew Rosenquist at 00:38:31) You provided false evidence. And when we had you under oath, you gave false testimony. Right? Now guess what? Now this is a crime.

(Matthew Rosenquist at 00:38:40) And by the way, those D&Os and E&Os, they won't cover you for criminal. No. If it's criminal, you're on your own. Hire your own lawyer. Right?

(Matthew Rosenquist at 00:38:53) So, yeah, that's where you get into some interesting situations that we've seen in the past.

(Joel Beasley at 00:39:00) Throughout this entire conversation, many times you've referenced material or significant. Is there any guidance in this NIS2 about how to determine that size of company revenue, total amount of data that you store? Because it's gonna be dynamic. Those words are inherently dynamic based off of the company size and what they do.

(Matthew Rosenquist at 00:39:21) It is. It is. So there is not a single definition. And for good reason, because as you said, it really depends. It's variable.

(Matthew Rosenquist at 00:39:33) Right? So you do have to look at the outcomes to see if it is significant. Now the good thing is most companies and corporations, they already have some kind of internal standard. Right? Because if it's a public company, they have to give their 10-Ks.

(Matthew Rosenquist at 00:39:53) They have to do quarterly reports out to the investors. So between their attorneys and their finance, they look at what is precedent in our industry. They come up with these to say, okay, this is this level is justifiable. Right? If a factory burns down, but it only handles 0.0001% of our revenue, it's not material. Right? Doesn't meet that.

(Matthew Rosenquist at 00:40:20) We've seen this before. Doesn't meet it. But if the factory burns down that represents 30% of our manufacturing capacity, yeah, we've got precedent in our industry that says, yep, that's material. We have to report that to our shareholders.

(Matthew Rosenquist at 00:40:34) So there is some general guidance, but it can be argued one way or another. And so prosecutors and regulators would also come in and say, okay, for your industry, we would expect these kinds. This is what we've seen in the past. This is what we've communicated to you.

(Matthew Rosenquist at 00:40:52) This is where we've prosecuted people before. This is kind of the demarcation line. And if you've got questions, pick up the phone. Right? It's not like we're not going to tell you.

(Matthew Rosenquist at 00:41:03) So if you have an incident and, by the way, you're contacting us early warning, that probably should be one of your questions. Hey, regulator. We have a potential incident here. I'm within 24 hours. I'm letting you know.

(Matthew Rosenquist at 00:41:17) What would you consider material? But in general, the companies probably already have that as part of their emergency operations criteria or what they use to determine what they're putting in their quarterly 10-Ks to their investors, things of that sort.

(Joel Beasley at 00:41:40) Well, as we start to wrap up, I'd say one of the things I'd be most interested in as a listener would be to understand, how do I reduce my personal exposure? Yes, we want the company to do well. Yes, we want shareholders, but I don't wanna go to jail. Okay. So what's the first step a leader could take to reduce their own personal exposure?

(Matthew Rosenquist at 00:42:00) Yeah. The first thing, especially for those executives, is to understand, one, there's no reasonable way to say, hey, I didn't know. I didn't understand. Not my problem. Cyber has risen to the level that it is a board-level problem, and you will and should be held accountable for it by your shareholders and by your partners and everything else, and now by regulators as well.

(Matthew Rosenquist at 00:42:26) So you need to treat it just as you would other areas of risk that you currently manage. So you need to understand what the risks are, be able to make decisions, have an approval structure, figure out how you're going to invest it at that level to support it, oversee the implementation. And you don't have to be checking every single, oh, so-and-so came into work or they, you know, pushed that patch, but at a high level that the program is being implemented. And you need to have that measurement and feedbacks. There will always be exceptions.

(Matthew Rosenquist at 00:43:01) There will always be determination of what that risk level is. And from a board level, that probably is your most important job. Clearly define what is acceptable risk so that the CISO and everybody else can go off and create controls or processes to meet that expectation. Then you can track against that. Right?

(Matthew Rosenquist at 00:43:27) And in doing so, you have to be documenting that you made an informed decision. You knew the trade-offs. You knew the likelihood. You knew the potential impacts. You decided on a plan of action that you felt best represented the interests of your investors or your customers or the nation.

(Matthew Rosenquist at 00:43:49) Right? And that you made that informed decision. You documented it, and you're willing to stand by it. And if anybody comes up, you're willing to talk about it. If you have to go into court, you've got the documents to say, hey, this is what we did. We believe this is a good process. It's consistent. It's what we've done before. We've looked at all the pertinent information.

(Matthew Rosenquist at 00:44:09) We made the decision. Here, this is the line of the acceptable risk. We knew. Here's the data of the risk we looked at. Right? And this is the direction we went forward with.

(Matthew Rosenquist at 00:44:22) If you can say that, you're probably doing good. A lot of companies at the board level are going, hey, we've got risks. Or the CISO comes in and throws up some crazy charts, and we just asked him or her, are we good? Are we secure?

(Matthew Rosenquist at 00:44:37) And they nod their head, and we move on to the next thing of business. That is not acceptable. That is not overseeing and taking accountability for the potential downstream impacts of failures in cybersecurity.

(Joel Beasley at 00:44:57) You scared me a little bit.

(Matthew Rosenquist at 00:45:01) Hey, you know, board members get compensated very well, and so do C-suite members. They have to earn it. Right? And part of this is making sure that you're compliant from a regulatory perspective and that you're properly doing your fiduciary duties to protect and maintain the interest of the investors and shareholders.

(Matthew Rosenquist at 00:45:22) Right? That's the job.

(Joel Beasley at 00:45:24) Is this for, like, specific... I didn't wanna get, like, too deep into tooling or anything like that, but there are tools that center across, like, your enterprise, like NordLayer, the browsers. They're monitoring the people. They're doing all... Is not looking an acceptable strategy?

(Joel Beasley at 00:45:40) Or once you know that there are tools like NordLayer, wherever, where you can monitor what everyone's doing and how they're using stuff, like, does that become a requirement? How does that fit in when you're talking with boards?

(Matthew Rosenquist at 00:45:51) So, again, the requirement is you need to understand the risks. Okay. And depending on the industry and what you're providing, whether it's a device or a service or whatnot, the risks will vary. Okay?

(Matthew Rosenquist at 00:46:04) If you are a service provider, right, the risks of some one piece of hardware over here that doesn't have anything to do with your service getting hacked or being pulled offline in a lab, who cares? Right? It's not going to bring down my services. It's not going to expose customer data. There's really no downtime for end users.

(Matthew Rosenquist at 00:46:26) Material impact is low. Alright. I'm not worried about that. Whereas if you're a hardware, you know, you're a manufacturer and that device runs your manufacturing line, and that one little device brings your manufacturing line down... And I work for Intel, so I understand.

(Matthew Rosenquist at 00:46:42) One little machine can bring down an entire factory easily for six hours. Right? And then you have to bring it back up, and you're losing tens or hundreds of million dollars per hour. That's a lot of money. So every organization's a little different.

(Matthew Rosenquist at 00:46:57) So do you need to be monitoring the dirty lab that's isolated? Probably not. Do you need to be monitoring your critical internal infrastructure, the primary dependencies, the most important and sensitive data, your intellectual property, customer information? Yeah. You really should.

(Matthew Rosenquist at 00:47:17) Because if you don't do that and you stand in front of the regulator going, oh, yeah, we looked at the risks. Really? Show me how you looked at your risks. Well, we didn't really have any observance. We just kinda...

(Matthew Rosenquist at 00:47:32) We looked at a chart. We, you know, someone put up a chart and we looked at it. Yeah. That doesn't work. That's not taking it to the right level.

(Matthew Rosenquist at 00:47:40) There was no confidence of that. Just because someone takes some crayons and draws you a chart, that isn't necessarily reflective of your risk. You know better than that. Right? You deal with spreadsheets.

(Matthew Rosenquist at 00:47:52) You deal with... You're right. Right. That's not reasonable. Right?

(Matthew Rosenquist at 00:47:56) That's incompetence.

(Joel Beasley at 00:47:56) Yeah. A little offended. We didn't use crayons. We used Gemini. Okay?

(Matthew Rosenquist at 00:48:01) Yeah. Yeah. It went from chalk to crayons to white or black... Dry markers and now to AI charts. But, yeah.

(Joel Beasley at 00:48:10) Classy grown-up kids, you know.

(Matthew Rosenquist at 00:48:11) Mhmm. Uh-huh. Oh,

(Joel Beasley at 00:48:13) alright. So, a lot of what you do is bringing awareness, helping people understand where to look and pointing them in the right direction. Yes. Okay. Cool.

(Joel Beasley at 00:48:22) How can people connect with you? Where do they find you? Oh, let's do a shout-out for your podcast. What's your podcast?

(Matthew Rosenquist at 00:48:27) The Cybersecurity Insights. Again, it's for security risk geeks and so forth. Again, I talk a lot about where the industry is going, where some of the challenges are. I talk a lot about AI because I look at disruptive technologies. If you need to get ahold of me, LinkedIn is the best place.

(Matthew Rosenquist at 00:48:43) I've got a couple hundred thousand followers on LinkedIn. I post probably way too much, and I'm very opinionated. So I'm finding calling out companies or issues or lawsuits or whatever is good, bad, or... And it's my opinion. But, yeah, LinkedIn is good.

(Matthew Rosenquist at 00:48:59) I've got a Substack account. But what's important is our industry is really, really difficult. Again, for some of the reasons we talked about. Right? The ambiguity, the chaos, the fact that you have an intelligent attacker, disruptive technologies like AI and everything, mixing everything up.

(Matthew Rosenquist at 00:49:17) We have to, as a cybersecurity community, we have to communicate and collaborate. We have to share our ideas, our experiences, what works, what doesn't, what we're worried about, what we're investing in, things of that sort. Right? So that all of us can uplevel because it's an uphill climb every single day. And so we have to work together, and that's why I'm on social media.

(Matthew Rosenquist at 00:49:44) That's why I do podcasts. That's why I do keynotes. That's why I sit and I advise with boards and C-suites and CISOs, because we have to work together.

(Joel Beasley at 00:49:55) Thank you so much for listening. And if you found this episode useful, please share it with a friend or colleague who you think would get value from it. And if you have topics that you'd like to hear discussed on the podcast, either add me on LinkedIn or send me an email: [email protected]. Every time I get an email or LinkedIn message, it absolutely makes my day and inspires me to keep going.