Today, Steve is in conversation with Dr. Ashley Sweetman, co-author with Nina Paine of the recently released book, Communicating Cyber Risk: Build Cyber Resilience Through Compelling Communication, including how to translate complex cyber risk into business and financial terms. Ash highlights the importance of empathy and honesty, and notes that more and more C-suite executives now consider these “soft” skills as important as technical skills. Ash and Steve also dive into how to communicate cyber risk to the board, what a security-focused culture is, and challenges created by AI.

Key Takeaways:

1. Lead with honesty and transparency, but make sure you understand who you are communicating to and tailor your message accordingly.
2. A leader that takes cybersecurity seriously goes a long way to build a security-focused culture.
3. Cultivating relationships between the cybersecurity team and other teams is important for cyber resilience.

1. Why more cybersecurity employees should receive communications training (4:48)
2. What a security-focused culture looks like (9:24)
3. Ash’s advice for communicating cyber risk that leaders can implement right now (20:37)

1. “Communicating things in business and financial terms is a pretty key skill. If you can put numbers on things and give talk in kind of estimative intelligence language, that can be helpful. It's about explaining things in terms of real world impact and the impact on the customer or your clients.” - Ash Sweetman
2. “It's having those relationships with the board that preexist, the trust and credibility that you build up over time so that when the inevitable happens or if you're in a bit of a crisis period, everybody knows their roles. The board is able to challenge effectively. They're equipped with the right skills and questions to provide constructive challenge, and that is built over time rather than just when your back is against a wall.” - Ash Sweetman
3. “I don't think anytime soon AI’s going to be relied upon as the kind of producer of communications, but I think it could do some good peer comparison, for example, or ask some really good constructive challenge questions and things like that.” - Ash Sweetman

Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.

This week’s episode is unique and personal. Earlier this year, Steve announced that he had been diagnosed with stage 3 prostate cancer. Today, Steve and and Producer Tavia Gilbert sit down to talk about what his life has been like over the past year. He shares how he reacted when he first got his diagnosis and explains why it’s so important to choose the right medical team. We also discuss resilience and mindset, how people in his personal and professional life have responded to his news and his decision to be publicly transparent, and, now that Steve’s nearly done with radiotherapy, what comes next.

Also, let’s cut to the chase. The whole point of today’s episode is this message: men, get your PSA levels checked!

Key Takeaways:

1. Get tested! Early detection significantly improves survival rates.
2. Taking control over your treatment is important, and that can include choosing your medical team, being brave and asking all the questions, and doing your research.
3. It’s okay for people around you to be uncomfortable or not know what to say.

1. How Steve responded to his diagnosis ()
2. Adopting an athlete-mindset ()
3. Steve’s use of meditation ()

1. “I think most leaders like to think that they are pretty invincible, and when something like cancer comes along, it doesn't have to be prostate, it could be anything, you suddenly realize that actually you're not. Lo and behold, you are actually human. And you do have to rely on some of your softer side to be able to cope with not just the physical pressures, but much more importantly, I think the emotional and the psychological impact.” - Steve Durbin
2. “From the security standpoint, of course you have the ability to be objective because you're talking about a business, or somebody else's business. When you're talking about yourself and balancing risk at an individual level, at a personal level it takes on a whole new dimension because it is for real. If you probably get one shot at it, maybe two if you're lucky, but you've got to get it right in terms of how you balance that out and how you talk about it.” - Steve Durbin
3. “There was one other decision that I did take, and that decision was that I did not see my cancer as making me a sick person. So in my mind I do not have an illness. I am not sick. I happen to have a cancer. There's a little part of me that has got something that's not working the way that it ought to, and that's fine. I'm fine with that because we can fix that. But I'm not ill. ” - Steve Durbin

Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.

We’re back with the second part of Steve’s appearance on John “Jock" Brocas’ podcast “Legal Owl”. Today, Steve and Jock discuss artificial intelligence, the global powers shaping the cyber landscape, and how to get lawyers, board members, and other non-technical business people to care about cyber resilience. Steve also gives some tips for law firms looking to beef up their cyber practices.

Key Takeaways:

1. Bad state actors operate all over the world, and national cyber resilience efforts must reflect that reality.
2. With AI’s rapid growth, good compliance training is more important than ever.
3. Many law firms still don’t grasp the need for good cyber hygiene and resilience.

1. AI and cyber (4:53)
2. Steve’s tips for law firms looking to commit to a more robust cyber effort (18:10)
3. Steve's advice for a law firm that's suffered a breach (21:33)

1. “I think the best outcome for AI is humans working collaboratively with the tool. No doubt you can get things done a lot quicker. You can get to certain points, but that doesn't mean that you stop validating and switch off the brain. You need to be looking at these things and saying, "Okay, does that actually make sense?" And questioning. And I think the assumption that because it's AI, somehow it must be absolutely right. No, it's not at that point yet. My personal hope is that it never gets to that point.” - Steve Durbin
2. “I always say that good security will result in good compliance. Compliance will not necessarily result in good security.” - Steve Durbin
3. “If a law firm is breached, I would hope that they have run through their resilience testing beforehand. I would hope that they have run some cyber simulation exercises where they are ready to respond to that kind of thing. If they haven't, I would say they're being negligent.” - Steve Durbin

Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.