(bright upbeat music)
- Welcome to "The Shiproom",
where we learn learn from tech leaders
as some of the world's most successful companies.
I'm Brad Anderson, I'm the vice president, Microsoft 365.
Today I am joined by Bobby Ford,
who is the CISO of Unilever.
(ominous music)
Just a phenomenal company.
This is an organization that has more than 450 products
that are used by more than 2.5 billion people every day.
How do you balance all of the work that you have to do
from a security perspective in your role as a CISO,
across an incredibly distributed global organization?
- I'm fortunate to work for an organization
that's as large as Unilever is.
Some of our key products would be around tea, soup,
soap, ice cream, personal beauty care products,
and being the CISO for that, I sort of see my job as
I'm responsible for ensuring that those products,
right, are secure and that they're available
so that when customers decide to make the purchases
and they go out to buy our products,
that they're there on the shelves.
(bright trumpet music)
- In your role, you're kind of a CSIO
that wants to say yes to things, not no to things.
Yes, let's go figure out how to do it
by engaging and understanding the business.
Can you tell me a little bit about
how you help your team to really engage themselves
to understand the business so they can help make
the right business decisions with the risk management?
- Anyone who knows me will tell you that I immediately say,
"Listen, I'm not the captain of the nobody's.
I'm not interested in working with a bunch of individuals
who find it easy and comfortable just to say no."
I believe that the responsibility of our group, right?
The cybersecurity risk management group
is to enable the business to take risk.
Let's say that you, Brad, hire me
to provide you with security services,
and then you say, "Hey Bobby, listen,
I wanna go to Downtown DC."
And I say, "You know what Brad, you can't go there
because it's dangerous or a risk with going there."
And then you say, "Okay Bobby, I want to go
to the East side of Los Angeles."
And I say, "You know what Brad, you can't go there,
it's dangerous, there are risk with going there."
Eventually you're gonna say,
"Bobby, that's why I hired you.
I hired you so that I could take risk.
If I didn't wanna take risk
and I didn't wanna go to these dangerous places,
then I wouldn't need to hire you
to provide me with security services."
And so that should be our same approach
from a cyber perspective
when we're dealing with the organization.
Recognizing that the organization has to take risk,
that's what it means to be in business,
and that our responsibility is to ensure
that they have the right level of controls
that have been deployed so that they can manage the risk.
- I talk with a lot of CISOs
and there's a conversation with many of them
about having your data and having reliance on the cloud.
Is that more or less secure than having everything on prem?
- I think it depends on what you mean by cloud
and who the cloud provider is.
When I hear the term cloud,
all I immediately hear is someone else's hardware,
someone else's, you know, physical assets.
So that's immediately what I think of.
And then once I think of that, I think of
does that provider have the capabilities?
Does that provider have the resources?
Does that provider have the wherewithal and the knowledge
in order to create a secure environment?
And if they do, then absolutely, I'm a firm believer
that there is the opportunity to be more secure
in the cloud than you are on prem,
but you have to look at the individual use cases
and you have to look at that provider
and then which you're capable of doing on premise.
(upbeat drum music)
- I think we've all seen the Unilever logo
on back of a lot of products, but what people may not know
is within that logo, there's 25 different objects
that represents the catalog of Unilever products.
I'm gonna give you a list of items,
some of which appear in the logo
and some of 'em which do not.
So your job is to identify
is this part of the logo or not part of the logo.
- I'm intrigued.
- First of all, lips to represent beauty,
looking good, and taste.
- I'm gonna say no-go.
- A quesadilla, to remind us
that we all need a snack sometimes.
- Did you say a quesadilla?
(laughs)
So you don't spend a lot of time in the UK, do you?
(laughs)
- But maybe it came from the Dutch side.
(laughs)
That's a no-go.
- Strong no-go.
- Okay, sparkles to represent cleanliness,
healthiness and energy.
- I would have to see what the sparkles look like.
We're gonna say logo.
- DNA, symbolizing Unilever's commitment to bioscience.
- That one is definitely a logo.
- A sauce to symbolize the blending of flavors and taste,
and it looks like a little swirl.
- Oh, that's definitely a logo
because I thought it was ice cream at first.
- Four angry ghosts, as a simple reminder to all of us
to never run afoul of ancient ways.
- Uh.
That should be a logo, but I'm gonna say no-go.
- And finally, a wombat
to show solidarity with all marsupials.
(laughs)
(bright upbeat music)
I like what you said about how the security team
needs to understand how the business works.
So how do you ensure that your security team
is best educated on the business?
- For me, a mature cyber strategy
happens at the intersection
of business intelligence and then threat intelligence.
Recognizing that if all you do is gather threat intelligence
and by threat intelligence, what I mean is
if all you know is about the vulnerabilities
and you know about what the adversary is doing,
and you know about, you know the likelihood of an attack,
that's only half the equation,
so you'll only be halfway successful.
So you could give it all you have,
and you can deploy all your technology
and you can develop the best strategy.
But if it lacks business intelligence,
it just won't be successful.
And then once you fundamentally understand
that you recognize that
in order for you to deploy that strategy,
there has to be a conversation,
like you want the business to have some skin in the game,
you want them to help you to prioritize,
you want them to help develop the strategy so that it's not,
you don't make these decisions in a vacuum.
Let's say that you want someone to come out
and you want them to deploy a security system in your home,
and they say, "Okay, what do you consider to be
the most valuable room in the house?"
Right, because that's half the equation.
You have to tell them that,
the person providing the security service,
they can't tell you that
because they don't know your home like you know your home.
- It's a challenge of communication and collaboration
or an opportunity of communication and collaboration,
and that's how you get the best outcomes,
both for the business and for the security of the business.
- As a security professional, as a cyber professional,
you have to be really good at listening,
like you really have to listen.
(upbeat music)
- Well hey, we're getting a phone call coming in here.
You're here on "The Shiproom", who is this?
- Hi guys, it's me, a cow, moo.
(upbeat music)
- You got a question for Bobby?
- Well, I don't know if you guys heard,
but while the whole world screeched to a stop,
we cows kept doing our, you know, milk thing.
So we're really ramping up ice cream production.
And since Unilever makes more ice cream than anyone else,
I wanna pitch Bobby on new flavors.
- Yes.
- Okay, moo.
- Challah atcha boy, a Kosher product
with vanilla custard ice cream, raisins,
caramel swirls and chunks of challah bread.
- Love it, challah atcha boy.
- Nacho Man, Randy Savage, avocado ice cream
with cheddar cheese sauce ribbons,
corn chips and candy corn.
- Oh yeah.
(laughs)
- The Keto My Heart, Greek yogurt, hazelnuts,
chia seeds and the 16-ounce steak.
Now I think about it,
that money's pretty dark coming from me.
- I'm gonna say a pass on that.
I don't think, yeah, pass.
- I have a very particular set of dills.
Prepare yourself for the taste sensation
that comes from combining strawberries,
blackberries and pickles.
- I love the name of it,
and I think that people will enjoy it because of the names,
so yeah, that's a keeper.
- There's more where that came from.
- I hope not.
- No, I mean, that's the last one, it's called,
there's s'more where that came from!
It has a marshmallow base with chocolate and graham crackers
and I think there's a real opportunity
for some moo law here.
(laughs)
- Thanks for joining us on the show.
Any final questions you have for Bobby?
- When you look at your current set of challenges
and when you look five years ahead
of the challenges on the horizon,
what do you need security vendors to do better or do more of
to help you stay ahead of security threats?
- I know, what I look for is an opportunity
to create a frictionless user experience.
So anything that enables me
to better secure the environment,
so enhanced security, while at the same time,
improving UX like I'm all about that.
(bright upbeat music)
- The more importance of inclusion
and diversity and equality is something
that is near and dear to you and I both,
and to both of our organizations.
And I'm curious how the importance of this is emphasized
and presented inside of your business.
- One of the reasons that I came to Unilever is because
Unilever truly takes diversity seriously.
I remember looking at the scheduled interviews
and I could tell just by the names from the interviewers,
that Unilever took diversity seriously.
That if you really take diversity seriously,
then even in the recruiting process,
that should manifest itself.
- In what ways do you think
bringing diversity of perspective, experience,
diversity in its broadest perspective of the definition,
how does that increase security for our organizations?
- I think the simplest answer would be
that the adversary is diverse.
It's hard to combat and defend against
a diverse opponent when you lack diversity.
I think that's the first, right?
That's the quick and the easy answer.
I think if you dig a little bit deeper, you'll understand
that diversity also means diversity of thought,
and I really wanna be clear when I say this,
that I wanna see diversity, but also wanna hear diversity.
And when you start hearing diversity,
and diversity of thought, it forces you
to either A, improve and solidify your position,
or B, understand if you need to take a new position.
(electric piano music)
- There's so much in the news right now
about inequality, about racism,
and there's just so much work to do,
you know, I'm just curious
as you think about the work that we as a society need to do,
what are the kinds of things that you,
that come to mind that we need to really work on?
- I realize and I recognize and fully appreciate
how difficult a topic this is to talk about.
It's a difficult topic for me to talk about,
and I can even start the conversation off by talking,
like from the perspective
of what's it like to be a black dude
and to talk about other black people
when everyone is talking about black people.
And the reason why it's a difficult topic
for me to talk about, is because I spent my entire career
trying to avoid that conversation,
because the last thing I want anyone to see
when they see me, is to see a black man.
And what I mean by that is
I want you to see an intelligent man,
I want you to see a strong man,
I want you to see a competent man, a capable man,
I don't even want you to see my color,
I just want you to see the talent, the skills,
the ability that I bring to the table,
that's what I want you to see.
But we have to talk about this,
and I think my 11-year-old son, he said it best, right.
I was talking to him about everything that's happening,
and I was talking to him about injustices,
and he was like, "I just think we gotta say something."
And I'll be honest with you, Brad, it hit me
on an emotional level that nothing has ever hit me on.
Because again, remember what I just said,
I spent my entire life not talking about it,
here's what I'll say about it, is that
you have to have the conversation and you have to remember
that a conversation has two components, right?
Talking is one part of it,
but listening is also a component of it.
And if you don't know what to say,
and this is any, this is counsel I would give to any leader,
if you don't know what to say, then say that
and then just listen, and you would be surprised
at the feedback that you'll get.
If you don't know what to say, then just listen
and then be receptive to the feedback
and to the material that you receive.
- The number one question that I get, I lead the diversity
and inclusion efforts for all of Microsoft 365,
and the most common question that I get from people is
"I'm worried to have the conversation,
worried that I'm gonna say something wrong."
The reality is you will,
and you just hope that there's grace on both sides
where, you know, when you do say something wrong
that, you know, people are able
to help you understand what it was
and that you are a grace when how you receive that feedback,
but you have to have a conversation.
- And I don't wanna use the word confident,
but that's how I feel, right.
I feel confident that this time is different,
and I think what sparked this movement
and what makes this movement so powerful
is that it's the first time that we've collectively,
and I do say we, because I think
it's like we're all in this together.
I think it's the first time collectively we recognize
how loud silence is.
(upbeat music)
- While we're talking, we had some AI capabilities
that listened in to the conversation,
identify what the key topics are
and come up with 12 questions that are most aligned
with the topics that we've been talking about
for the last, you know, few minutes,
and we call it the database dozen.
(bright upbeat music)
Your company makes a lot of stuff,
shouldn't it be called multilever?
(laughs)
Is British food underrated, overrated or correctly rated?
- Correctly rated.
- Who's gonna win in an arm wrestle, Ben or Jerry?
- Jerry.
- So you spent some time in the army,
how many push-ups could you do right now?
- With no one looking I could do, easily, I could do 45,
with someone looking I could do a cool 30.
Once we get beyond 30, Brad, it gets really ugly.
(laughs)
- What was St. Ives the saint of?
- Oh, that's a great question, I have no idea.
- Have you ever had a full English breakfast
and not regretted it?
- No.
- You think the queen uses email?
- Absolutely.
- Shouldn't deodorant be called preodorant?
(laughs)
- When used correctly, it should be.
(both laughs)
- Ice cream-flavored shampoo or shampoo-flavored ice cream?
- Ice cream-flavored shampoo.
- At the LiftFund factory is splitting the team gossip
or a serious industrial accident?
- Serious industrial accident.
- Final question, are the SlimFast division
and the ice cream division on speaking terms?
(laughs)
- We're all in speaking terms.
(upbeat music)
- Hey, thanks for being on "The Shiproom" here
with us Bobby, it's been nothing but a pleasure,
and I love the way that you balance the need of security
with the needs of the business,
I think it's an example for all of us to listen to you.
So if anybody wanted to learn more about you personally,
or get in contact with you about Unilever,
where would they go?
- So you could always go to unilever.com,
and me personally, you can always visit me on LinkedIn.
(gentle music)
- That's a wrap of "The Shiproom", we'll see you next time.
(upbeat music)
- My peanut butter cup runneth over.
This one is just a frozen jar of peanut butter.
That's it.
(laughs)
(upbeat music)