>> It's my pleasure to welcome
Kelly Bissell from Accenture and Vasu Jakkal from
Microsoft to discuss why security and privacy matter
for all modern organizations.
Now, Kelly, you work with
organizations to better understand
the need for a comprehensive approach towards security.
Why has this topic grown so important today?
>> That's right. I think all companies need to take
a comprehensive view even more today than
ever before because I think
the risk score are greater and
our ability to innovate is
outstripping our ability to secure it.
This is really important, and I'm delighted to
spend some time with Vasu with me.
If I could ask Vasu,
what are you seeing in the market,
and what do you think are some of the takeaways
that we should talk through today?
>> Well, hello, Kelly. It's great to be here with you
and Mariana to discuss this critical topic.
To start with, I just want to say it's
hard out there for defenders right now.
You look at what's happening in our world,
the increased sophistication and
complexity of cyber attacks,
meeting the exponential increase
in digital attack surfaces,
and then you have geopolitical tensions
as well as talent shortage.
But it's also a really inspiring time to
be in security because security matters.
It is quintessential to who we are
as human beings and it's a fundamental human need.
There's some key takeaways for me as
we look at security and how do we protect our world,
our organizations and our people.
First, we need a comprehensive security posture.
We need to look at it end to end,
across key pillars of Cybersecurity,
compliance, identity,
and management as an interdependent whole.
We have to protect and extend this across
all Clouds and all platforms.
We know that attacks can come from anywhere,
so we need to look at it outside in and inside out.
The second takeaway, Kelly, for me,
is about security being a team sport.
This is a village.
It takes a village.
We're not in this alone.
We have to work together.
We have to meet our customers where they are at.
We have to understand their needs
deeply and we have to protect them on their terms.
Lastly, related to that, great partnerships matter.
For us to work together and for us to
protect and increase our collective defenses,
we need to match our superpowers.
That's why I'm excited about
working with you and Accenture.
We have a great partnership.
We will bring our own unique superpowers, after all,
we are all unique in our own ways,
and reforming Justice League,
the Avengers, or pick your favorite superhero.
I'll sum it up by saying,
I'm so proud to be a defender,
I'm so proud to be in security.
It really matters and let's
empower everyone to use security for
innovations so that everyone can bring
their best lives and live their best lives.
>> I love that, to be
Avengers and superpowers, if you will.
I agree that we have to actually do this together.
If we're going to make a dent,
we've got to go together.
Maybe one of the other takeaways for me is
the importance of Zero Trust for security.
We've had this thing about least privilege for
more than 15 years back from the Sarbanes-Oxley day,
but that was really focused on access controls.
Zero Trust, as Arc organizations have talked about,
it is around all elements of security,
not just the access controls so we
can interrogate does the user or
even machine have the right in
this context to access this information?
How do we ensure that we're safe across the board?
I love that we can pull that
together and things like access control,
multi-factor authentication, encryption, and
all kinds of other security elements.
As companies, I think that we have to
really ensure that we move forward
with this continuous Zero Trust model
so that we can really ensure
the safety inside of our organizations,
not just the outside.
>> I love that, Kelly.
It's interesting that security is about
trust and trust starts with zero trust.
It's ironical.
Many customers ask where
should we stopped the Zero Trust journey,
because it's unique to every organization and
every single step strengthens our security posture.
As I think of Zero Trust,
there are a couple of things which come to mind.
First is start with a strong Cloud identity.
You talked about it, access really matters at making
sure that we are protected against what's coming in,
we have strong authentications,
we have strong multi-factor authentication,
conditional access, and so.
Second, make sure your devices are healthy.
Management matters, patch, patch, patch.
Third, you have to embrace the Cloud.
The Cloud gives you
so much leverage with all these built-in defenses,
bringing together the best of what
defenders have been doing and simplifying
your assumed breached tool set to bring
that extended detection and
response coupled with the same.
Then lastly, don't forget about compliance.
Data, data, data, that matters.
What's happening inside your organization,
how is data leaking,
what's happening with insider risk,
so think about those four pillars
as you think about a Zero Trust posture.
>> That's right. I think that
now we could think about Zero Trust and we think
about through the lens of
this increase attack with
nation-state attacks and other things,
now we got to think about how do we rethink?
How do we transform the way we think about security?
I believe it starts with a board.
As Henry Kissinger would say,
"I don't have time for crisis.
My schedule is full."
I think that's true.
But I think that we got to really
think differently about this.
As we look at the board where they have directors,
I think they're going to reflect the company.
If you're a pharma company around
joint ventures and labs and clinical trials and
manufacturing to distribution but also
cyber because regulation is changing all the time.
The threats are changing every day.
I think that we need to really
think about in our companies,
not only Zero Trust within what we have today,
but how are we moving the future of
innovation like AI and quantum?
How do we not only embed security and privacy into that,
but how do we recover if something doesn't work?
I think we've got to really think
differently about our innovation,
about how we think about through from
order to cash processes, if you will.
We have to think about third-party risk and suppliers,
and how we think about
Zero Trust across the board for all of that.
>> I love that, Kelly, and I love you started with
preparation because preparation really matters.
You have to prepare, you have to be ready,
and you have to prevent,
detect, respond across the board.
One of the things, as you think of preparation, is
not only think current on where the threat landscape is,
where your response and your playbooks need to be
but also preparing yourself with skills.
We heard from Mariana that skilling is
a top thing that
our communities are thinking about right now.
We can start our skilling journeys anyway.
It requires a growth mindset,
it requires us to learn new things and it's exciting.
With that, I'm super-excited that Microsoft launched
four new skilling certification
across security compliance,
identity, as well as management to
tackle some of the talent shortages that we're seeing.
It's like 3.5 million jobs right now,
but also to help people learn more about security.
It's fun stuff, and I'm really excited we are doing that.
Check out our resource page.
Also, check out this pretty robust
technical resource library that we have.
If you need anything more,
if you want to learn, shoot us a note.
With that, Kelly, I would love to, again,
pass this back to you to hear from your standpoint
about skilling and what else is top of mind for you.
>> That's really important, and
I think that we have to double-down on
the skills of
not just computer science people but industry people
that know how banks work or pharma
companies or oil and gas.
Then track the data and who has access to it and
our responsibility to our customers so
that we can create trust and resilience.
Vasu, look. I'm very
thankful for Microsoft stance on security and privacy.
Together, as superheroes, as the Avengers, if you will,
that we can make the world a
safer place and that we can all thrive.
Vasu, thank you for spending some time with me
on the subject. Back to you, Mariana.
>> Well, we all definitely feel safer
knowing that the Avengers are out there,
keeping us safe from the Cybersecurity threats.
One of the takeaways for me actually was that
security is not just about protection,
but it is an investment that helps enable
growth and innovation for organizations.
Earlier during this conversation,
we posted a poll to hear from
our audience the results are coming in.
Everyone's talking about this hot topic, as I mentioned.
We're going to start taking one of
the first questions and let's see, it's coming in.
I'm going to ask one of each of you and
this first one is coming in for Vasu.
How do you see the role of
Enterprise Board of Directors
evolving in light of increasing cyber risk?
>> Yeah, great question. Thank you so much.
If you look at the role,
the board of directors plays
a really critical role in Cybersecurity
and has evolved tremendously over the last few years.
Board Cybersecurity is a topic which
is critical from the boardroom to the backroom.
Thus, because Cybersecurity matters
not just in terms of economic impact,
but it matters in terms of reputation and brand
and safety and growth and all of that,
so the board of directors right now plays
a pretty critical role in
asking great questions around governance.
What is the Cybersecurity posture of an organization?
What are we doing to strengthen our defenses?
How are we tackling?
What's the best way to measure security across the board?
I do think that with
great governance and that the board asking
these great questions and playing
a critical role in innovation for the company,
we can all build a better organization and better growth.
>> Thank you, Vasu.
Kelly, now, people want to know
your opinion on this issue is.
Let me re-ask the question.
How do you see the role of
Enterprise Board of Directors evolving
in light of the increasing Cybersecurity risk?
>> That's right. I agree with Vasu.
I think she's absolutely right.
But boards don't take a management position,
but they need to actually understand the issues of
today and where they're going
and all the regulations associated with that company.
They can actually hold
management accountable that's their job.
I think that the more that they know the better.
They can drill into the very specific questions
around how they implemented Zero Trust.
How do they know it's working?
How do they know that they're,
not only the corporate office is safe,
but what about their whole team environment
or their plans?
How do they ensure that
their subs and affiliates are safe?
What about those third parties that really they
rely on their ecosystem?
I think the board's role is something that they need
a dig in deeper around
this Cybersecurity and privacy topic.
>> Thank you both. Unfortunately, we're out of time,
but what an enriching discussion.
I'm sure [inaudible] would've wanted both of
you on his crisis team. Thank you.
To learn more about the topics discussed here today,
we are going to check out some of
the featured resources posted in
the chat and on the Envision website
where you're watching now.