She is an eager beaver, always on her toes; Christy Wyatt is one of those #InfoSecSuperwomen who have made a place for themselves in the information security world that is still struggling to attract enough talent. Christy, who was recently announced as the finalist in the Security Champion of the Year category in Women in IT Awards, has already made it in the Inc. Magazine’s list of Top 50 Women Entrepreneurs in America. She was declared the CEO of the Year by the Information Security Global Excellence Awards in 2015, ranked among the top 100 women leaders in STEM in 2012, and has been among the “Most Influential Women in Wireless” several years in a row.

The CEO of Dtex Systems is a sought after name in the blue-chip of cybersecurity industry. Her masterstroke with regards to the acquisition of Good Technology by Blackberry is no less than history. Christy who has held leadership positions across both consumer and enterprise at Citigroup, Motorola, Apple, Palm and Sun, opened-up about her gumption in cybersecurity, Artificial Intelligence, and gaps in cybersecurity strategy.

Dtex is into cybersecurity innovation. Please share your views on the kinds of innovations we will get to see in cybersecurity in the near future, including AI?

There has never been a more tumultuous time in our industry.  The lines between hackers, hobbyists, and nation state attackers are continuously blurred with security leaders having to scramble to defend against an ever-evolving slate of attacks. A CISO today has no idea if valuable data is being taken to make a national statement by someone with a vested interest, or purely for the market value. Because of this, one of the more interesting trends we’ve been seeing is the focus on the vulnerable insider or employee – as a potential root cause of any of the three scenarios above.

As we move forward, however, and AI becomes a critical tool for both hacker as well as defender, the “why” will matter increasingly less. The ability of each side to fulfil their mission will rely on visibility and the agility. The CISO needs to focus on lightweight, high-fidelity data collection to be able to identify and respond to new risks in real time – coupled with transparency and rapid learning. Analytics engines running in batch mode to cope with massive amount of heavy, unfiltered data, will not scale to meet the challenge.

Dtex Systems was launched in Australia but it is now headquartered in Silicon Valley. Any reason in particular?

Australia continues to have a vibrant security community – but as we see with many other Australian startups, it became necessary for Dtex to move to Silicon Valley in order to connect with the talent and funding pool needed to grow and scale a business.

We were thrilled this year to be able to re-enter the Australian market, which is one of the more mature and forward-thinking at present.  It remains a high-growth business opportunity and area of focus for Dtex, and we will continue to invest.

How much would you rate Australia’s Cybersecurity infrastructure and workforce, on a scale of one to ten?

Unfortunately, you cannot look at any of these items as static. The only constant in the world of security is change and increasingly, our success both as vendors and defenders will be dependent on our ability to adapt – and how we respond to both the market and risk.  We have found, in working with Australian partners, customers and technologists, that there is a depth in both security understanding and ability.  And some of the most forward looking CISO’s that we have had the honor to work with have been within Australia.

The recent cyber breaches across the world show that there are gaps in the cybersecurity strategy. Where do you think the major faults are? Is the world really working on improving it?

Cyber is a world of change.  If the last decade has taught us nothing else, it is that whatever you fear today is not going to be what you fear tomorrow. The risk landscape is continuously evolving.  If I look at extremely mature industries – like financial services or the public sector, they have become much more aggressive in evaluating and embracing new technologies. Evaluation and procurement cycles that were previously measured in months, in some areas, have been cut in half.

This adaptability and capacity to absorb new technology is what is going to keep the enterprise immune system strong. The inverse is the enterprise’s ability to cycle out old, or underperforming technologies. This is an area where I believe there is more work to do.

What are your views on a collaborative cybersecurity platform for the world?

Ideologically, I am a believer that strength comes from transparency and collaboration. Practically speaking, however, this is much harder.  I think the concept of openly sharing data is entirely achievable – but a centralized, global cyber immune system is much less practical as every country has its own definition of ‘risk.’  We can all agree on the identity of an individual – but what the US deems to be a risk, may not be consistent with the view in China. I do believe we should invest in global information-sharing capabilities, which can still go a long way to providing a platform for creating compatible cyber systems.

Former ASIO boss David Irvine recently sent out a warning on Australia’s ‘relatively weak, uncoordinated’ cybersecurity infrastructure. How much do you agree with that? 

I think it’s important to recognize that David Irvine ran ASIO and ASIS up until 2014 – and since that time, the Australian cybersecurity market has matured significantly. However, I would tend to agree with his suggestion that a ‘single Commonwealth-led cooperative agency’ could help to break down silos and present a more coordinated approach to combating cybercrime.

It’s also important to note that the Australian Government has recently taken steps towards a more centralized approach by consolidating its cyber teams, including those of the DTA (Digital Transformation Agency) and the ASD (Australian Signals Directorate). This demonstrates a major shift towards the consolidated approach recommended by David.

An industry veteran with more than two decades of experience, Kelly Isikoff joined RenaissanceRe in 2016 with global responsibility for directing strategy, operations, and budget for the protection of information assets.

Before joining RenaissanceRe, Isikoff was an Executive Director for JP Morgan Asset Management, where she was responsible for setting security strategy and policies as well as managing operational security departments. Prior to her time with JP Morgan, she was a Senior Vice President for Citigroup and managed infrastructure, data management and security across departments. Previously, she has also worked at Warner Music Group, where she led security and new media initiatives to identify innovative revenue channels within technology.

In an exclusive interview with CISO MAG, she discusses cybersecurity practices in the insurance sector, women representation in the cyber world, and much more.

Please tell us about your role and responsibilities in RenaissanceRe.

I am the head of the information security for the global organization. I also manage all of the strategies, programs that will help us maintain our compounds across most of the regions. I also manage the additional groups that feed into security that have a role to support overall defenses. So that being said, a smaller organization unlike the larger organizations I worked with in the past were are using different types of managing security service providers for different capabilities to achieve the same level of security. So my role is to transform the organization and manage a lot of the overall security program and help it to maintain compliance and achieve compliance with pretty big regulations that are coming up and hitting a lot of other financial firms and worldwide global firms.

It looks like a lot of the states within the U.S. have started to fall in line with the same cyber regulations that we have in New York. It seems like every country around the world is starting to uplift their cyber regulations, so making sure that we get things right and follow a standard process and framework is the key to making sure that we don’t have to continue to go through our compliance checklist with each one of these different countries, states, and jurisdictions.

Cyber attacks in the insurance sector are growing exponentially, as companies are migrating toward digital channels in an effort to create tighter customer relationships.  What are the things RenaissanceRe is trying to keep the hackers away?

I mean there’s not one practice that we follow. We have a lot of partners that we work with and a lot of vendors that we manage and that (Third party security management) is a big issue for a lot of companies, not just a company of our size. There are a lot of new companies that are entering the space and provide you assessment services. Unfortunately, some of them are not robust than others.

So, third party security is a big issue and we are receiving more and more requests from clients for much more exhaustive security reviews of our control and a lot of my time is dedicated to calls with our investor group, different types of business clients to go over our security program with them and then go over their security program with us. So, there’s a lot of vetting of partner security that’s happening across the industry.

As you said, you are actually working with a lot of third parties and partners. What do you do to keep the data transfer absolutely secure?

Well we follow different frame works. Our strategy focuses on cybersecurity framework which is really flexible across the industries and really simple to follow, and we also follow top 20 critical security controls which were developed from a lot of industry practice within the community. So, that’s our strategy and that’s how we set our programs for the year.

How important is cybersecurity education or training for employees in keeping cyber threats at bay?

Security awareness training is very important to us. We have continuous programs as well as digital annual trainings and certifications. Also, there are company meetings on key security risks to the organization. Security is everyone’s responsibility, not just one department’s. As far as protecting ourselves against a cyber threat, we have a lot of controls on data access on an add need-to-know basis. We really have a strong program around building out our access control of critical data in critical systems.

What is your take on cyber insurance?

We’re really seeing an evolution of cyber as a specific product to cyber as a peril which can influence multiple insurance products. Most insurance products today focus on credit marketing and notification cost, and these costs are often required by a regulation. So we see a potential growth for risk managers as they asses a cyber risk for their business and starting to work more with our insurers and re-ensure a way to access monitor and mitigate risks. This could include a broader cover for system failure, and interruptions for example.

Do you think cyber insurance is keeping pace with cyber-exposure?

Definitely, I know that a lot of large finance institutions are increasing their coverage through larger cyber offerings and a lot of other multiple insurance products are starting to develop cyber policies within it. So, we’re saying more aesthetic cyber policies into multiple insurance clients.

The representation of women in cybersecurity has remained stagnant at 11 percent for the past four years, according to a report. This is despite growing awareness on cybersecurity, and expanding career options. Most of times, the reasons cited is the lack of women role model and the impression the industry carries. What can be done to break the gender stereotype so that women, even in their teens, are inclined to join the cybersecurity space?

Well, you’re right! There’s definitely a skill gap and I do feel like a minority in my profession. I think some of the things we can do is promote cybersecurity across universities to encourage young women because it is really dynamic and interesting field that’s constantly changing. It’s not something for programmers or people who like technology. It is much more diverse than that. You need to have an investigative type of mindset, you need to look at a lot of different ways that your systems, your information, your business can be compromised and have the ability to work with business to understand your risk, so you can protect against them. It’s really important for me to mentor young women who are interested and moving into security.

According to you, is there anything that the CISOs are doing wrong at a time when the threats are evolving with each passing day?

What we really need to learn from recent attacks is that CISOs need to understand the full scope of security. It’s not just infrastructure parameter anymore. It’s also about application, user behaviour, and other things. They need to know the overall threats that are targetting your organization. You need to follow the cybersecurity framework and employing it for your environment and understanding your risk level. For say, if you’re managing a company that has a lot of Web exposure, you really have to up your application security program. Overall, understanding the risk level of your organization and speaking closely with the business leaders to comprehend the key risks and how do you mitigate those risks and build a depth of control around those risks. That’s what I would recommend the CISOs or new CISOs entering into that space because that’s where I’ve seen a lot of CISOs who failed.

What advice would you give to a budding information security professional?

There are so many different areas within the security to grow into. So, getting a broader in-depth knowledge of various kinds of security domains and understanding the different domains and skills you’d be doing in each area. Basically, understanding what might interest you! That’s what I would recommend to anyone who’s getting into the security because there are so many different specialties within security. It wasn’t like that when I got into security. I worked between infrastructure and application groups, managing security process domain. There weren’t many specializations then, whereas now there are so many specializations and with that there are many opportunities to learn and develop unique skills that make you even more valuable in the marketplace.