Building an Insider Threat Program from Scratch

Kylie “KT” Boyle joins us in the latest episode of The New CISO, which is also the beginning of a new segment: The New CISO Foundations. Every security program is built off of a foundation; this episode will focus on KT’s mission and what building blocks his organization represents.   Background KT Boyle leads Anubis Security Groups. He has been in the cybersecurity realm for over 17 years. He worked in cyber security operations for the US Cyber Command and various Global Fortune 500 companies. He currently focuses on providing modern cybersecurity and continuous security monitoring, along with data loss protection/prevention.   From Military to Cybersecurity Before focusing on cybersecurity, the first decade of KT’s military career was spent as a special forces soldier. KT talks about his transition into a different realm as he became a father and how he learned about a space that was unfamiliar to him. He also gives advice for anyone who is considering taking the leap into a new job.   3 Core Components of Building Teams This episode breaks down teams into three core components: team performance, visibility and tool efficacy. Human beings are the cornerstone of any good team, and when you analyze employees, you should also take into consideration who they are as a person outside of work. The visibility component discusses having visibility into all of the environments within the team while tool efficacy details how to have efficient tools for your team regardless of what sector or tech stack you are operating on. When you have employees that understand these three core components, KT says this makes the hiring process a little easier because now you no longer need to have a subject matter expert at every level. Focusing on the leadership perspective: what does your business do and what is changing about it? If you can communicate this clearly, you’re ahead of the game.   What Do Bad Security Analysts Do? To keep it simple: bad security analysts don’t ask questions. Some members of the cybersecurity realm are not the most experienced extroverts. However, asking questions show that you’re engaged and interested in learning about the industry and tasks at hand. If you’re not asking questions, this typically means one of two things: you’re looking for a new job or you are happy with your current output and are coasting through. To counterpoint, Steve mentions that some people who don’t ask questions may have worked under poor leadership in the past. The episode discusses ways to incentivize your team members and how to create an environment where they can be comfortable with asking questions.   Links Exabeam Podcasts