Cybersecurity Speaks Up

Speaking the language of both security and business isn’t always easy or possible for CISOs. Terry O’Daniel is changing that, and it’s a very good thing.

Cybersecurity is big business. It’s also young as disciplines go. The first cybersec class may have been taught in the ’90s, but in those days, it was viewed as an engineering or IT function. As with most youngsters, Chief Information Security Officers (CISOs) are struggling to find their place in the world. Their place is changing rapidly and will continue to evolve as novel technologies emerge and mature. The place that CISOs are headed? The boardroom. And that requires new ways to communicate with business leaders.

“I spent five years at Yahoo as a director of production engineering. That’s where I realized that we can do a lot of amazing technical work, but it misses the mark of what the business really cares about.” That voice of experience is Terry O’Daniel, one of the most in demand cybersecurity consultants in the game. “I realized that my strong suit was really providing a translation layer between the business and technology, helping them translate a revenue recognition risk from our finance team into strong security controls,” he told us.

O’Daniel grew up loving (and Frankensteining) computers. After graduating from UC-Davis with a Music specialization during the dot com boom, he worked for scrappy startups in San Francisco. “I planned to become a musician like my parents, but the opportunity to work in emerging tech was just too exciting to pass up,” he says. “Fortunately, I still get to work with amazing companies like Mixtape that are using tech to bring personalized music playlists to amaze and delight listeners.” As his reputation as a security leader grew, he went on to consult with some of the most influential companies in business.

Working at a series of very small, very scrappy startups gave him the opportunity to hone his risk and compliance skills. “I never wanted to be a feature developer. I focused instead on all of the things that developers don’t like to do, like infrastructure, security, operations, and IT.

“I often worked as a one-man shop taking care of everything behind the scenes so that startups could build those amazing early products, deliver them to customers, and put them on the web.”

At Yahoo, O’Daniel blended his technical background with understanding risk and compliance at scale. “None of the engineers and architects I worked with wanted to deal with any of that stuff, and I actually found it fascinating,” he said.

A dash of “right place, right time” gave him the chance to flex his security muscles. He helped build the security assurance function at Netflix and helped Salesforce build out their first security risk team and their first customer trust function.

He described his time at Salesforce as a master class in working with executives, which changed the way he thought about how to frame problems, bring them to the table, and make them easy to understand. “That made it much easier for me to uplevel to speaking to the board by pressure testing at first with non-technical veneers, not just talking to the CTO and CIO but understanding what makes sense to the CFO.”

In the middle of the pandemic, O’Daniel and his teams worked with Instacart. Not only were they part of a critical infrastructure to get people fed, but they also had a very clear mandate: Be ready to go public in 18 months. “At the time, security was really sort of hidden under infrastructure engineering, which was great for me given my background, but it didn’t really help the business of the company understand how to put security at the forefront. There’s an amazing rocket ship there,” he mused, “but the toll on security leaders can be intense. I’m glad I can ‘pay it forward’ by supporting non-profit organizations like Cybermindz that are helping CISOs address burnout in a manageable way.”

The discipline sometimes lacks the tools and maturity to translate risk into dollars. “That’s one area where CISOs have lacked the tools to traditionally show up as business leaders and to speak the language of business,” he said. O’Daniel creates pathways that lead to questions about risk, and how a goal makes sense to engineers, and in turn, learn how to make what the engineers have built make sense to the auditors. “I enjoy working with startups like Axari that are focused on helping CISOs speak the language of the business and run their security organization like one.”

“It’s not enough anymore to build an amazing technical solution,” he said. “You have to use the business pressures, be it regulatory requirements, customer demands, or wanting to expand into being able to sell in certain industry verticals or sell in certain countries or regions.”

He may come from a deeply technical background, but he embraces customer pressures because they present opportunities to build better security. “It’s not enough to treat security like an ethical challenge of simply trying to keep the bad guys out.”

Security has shifted as a business function as well, facing new questions around such as the security of a product, customer acceptance, and the ability to survive pressure from internal and external threats.

“It’s not enough to force your employees to take annual security training to ‘check the box’ for compliance,” he says. “Every company should really be using modern hyper-personalized training products like Herd Security to make that training relevant to every employee, every day. Because humans can be the weakest link in security, or they can become your greatest asset.”

“The more we can think about those things and solve those problems early by building guardrails so that the products we build have a higher chance of success, the easier it is to do the right thing. That’s where we really succeed. For example, Socket is a tool I love deploying because it brings guardrails right into the developers’ environment, rather than asking security to chase them with ‘fix it’ tickets.”

Thanks to AI and an ever-growing ecosystem of security vendors, CISOs are now able to continuously test an environment for vulnerabilities without a team full of penetration testers or vulnerability experts. “I can actually use tools that integrate AI to continuously test for risks,” he noted. “Cytrix immediately comes to mind as a platform that uses good pressure from regulators and customers to give security teams what they need: a continuous pulse on where we’re vulnerable, how attackers could exploit those vulnerabilities — and a way to turn all of that data into actions that can be performed by agents. It’s a little ‘space age’ to realize that we’re at the point where not all of my security team will be humans — but the future is here!

“As CISO I’m able to go to the board and tell them the top five risks: I need live data, I need to get it at scale, I need to get it at speed, and I need a really clear signal because, ultimately, risk management is just resource management. We have a finite amount of resources, and we have to understand where to put those resources for the best effect.”

O’Daniel’s strategy includes appealing to an organization’s values and risk appetite, noting that the startups, scale-ups, and high-tech organizations have a healthy taste for big swings and making big bets. “They want to get to market sooner than their competitors. They want to build a moat around their product. To do that sometimes means they are jumping headfirst into the deep end, and I can’t stop them,” he admitted. “I don’t run the company. The best thing I can do is provide context, not control, and help them make eyes-open, risk-aware decisions.”