#112, CISO at the AA, Darren Desmond: Covert Ops to Cyber Security

23:08And again, it's not foolproof. We're not perfect, but it's a good bit of kit. We've been trying to get better asset management since I joined. When we started, it was on a spreadsheet. It was partially true. We've invested quite heavily in specific technologies to get better asset management. And what we found is you have to pull data from multiple sources. Running a discovery scan on your network isn't necessarily going to give you everything. It might give you most of it. It won't tell you what this stuff's talking to though. so the micro segmentation platform we brought in once we started running that discovery tool it was very different technology but started filling in a lot of gaps in terms of what our assets were and what they were doing so what they were talking to and you know this is when you start seeing communications are a bit odd you start seeing communications that are talking to the Tor network the onion router network which is typically used for dark web file sharing or nefarious activities yeah or dark web yeah people refer to as dark web you start seeing occasionally that where an agent's been installed something years ago by an employer that employee rather they really didn't know what they were doing perhaps might be malicious who knows so you can start to take that down and prevent that from egressing the organization obviously you can do this at the firewall as well but it's there's multiple places you can do it you also start seeing communications you don't expect with that servers in universities in all over the world and you can start limiting your attack surface effectively in terms of what your systems are talking to and limit them to the business systems they should be talking to and isolating them much more effectively.

24:30So obviously that's all great. And on top of that, we do vulnerability scanning every month. We do penetration testing. We do red teaming. We do purple team. We do lots of stuff. But you need a way to aggregate that view. And if you haven't got a good asset management approach, you're not going to be able to centralize all of that data and then make informed decisions. So getting across asset management is absolutely vital and underpinning. It's central to everything, isn't it? You can't get secure without asset management being in place and being effective. Yeah. No, very well said. How does AI change this, Darren?

24:59I don't think it changes it vastly. I think it changes the velocity of an attack. But equally, if we as an industry get on the front foot with this, we can change the velocity of the defense as well to match it. And that's always been the case, right? It's like an arms race. We put a mitigation in or a new piece of technology that stops a certain kind of attack. And then the attacker works out a way to go around it within six months to a year, typically, if they're really good. That's just going to get faster with the advent of AI-based technologies for the attacker. They're going to be able to do more and they're going to be able to do it faster.

25:27So similarly, as an organization, you're going to have to be able to do more and do it faster. So really, it's about investing in the right types of defensive technology to match the threat. So if you've done a decent threat assessment on your organization and against your assets, because you now know your assets because you've got good asset management, you do a threat assessment against those crown jewels, as it were, and then you move your defensive posture accordingly. You orient it towards a threat. I think trying to put the castle and moat model up from years ago, I think that idea is long gone now.

25:56I don't know how that would work in a modern environment. Yeah, absolutely. So what's the biggest challenge you faced at AA, Darren, since you've been there from a cybersecurity standpoint? So there's a number, but the biggest one is people. Can you just unpack that? When you say people, do you mean the skills shortage, not having people suitably trained and qualified? Okay. People generally. Oh, right. Okay. And again, this is the dollop of love. So historically, the AA had been under-invested in, and our share price wasn't doing very well. for various reasons, the IT function as a whole have been cut to the quick.

26:27And that included the security function, as I mentioned, that it was tiny when I first joined. And the tooling was badly thought out, badly deployed, wasn't really doing much, apart from consuming power. So the biggest challenge was articulating that security is not a standalone activity to my colleagues, my peers, the board, the exec, and everybody in between. Security is not a standalone activity. You don't just get a security guy and they come and fix all the stuff. It's a team effort across the board. whether it's the lady on the front desk looking after reception we've had a couple of ladies that have been with us for decades looking after front reception in basingstoke for example and they're literally the gatekeepers of the building whether it's somebody on the front desk or whether it's somebody who's an administrator on a really sensitive system it's a team effort so it's about having policies and standards that reflect reality so they're not just downloaded off the internet replace this company with that company and push your policies out get certification you're off to the races it's not about that it's about ensuring that the policies and standards you create or articulate in a way that your end users can understand and if they're not reading them and don't understand them then you failed from the outset you're not going to get secure in any way shape or form so it's about communicating those standards engaging with the stakeholders at all levels in the business so that this is a security standard these are mandatory and this is what i expect of you and then testing that so this is where frameworks really come into play so we were iso 27001 certified it doesn't necessarily mean we're secure okay because compliance does not equal security as anybody who works in this field will tell you what it's about though it's about getting people used to producing evidence that they are doing the right thing on a regular basis that's where the real value comes in and probably even the iso people tell you that so we run a number of different standards for very good business reasons across different parts of the company and that's helped change the security culture as much as anything but we've almost and this is why i say the biggest challenge is people it's not because they're bad at what they do or they're doing the wrong thing necessarily or with the wrong intent, should I say.

28:17They've just not been told what's right. And it's very difficult to do that when you've got a project that's finite in terms of resources and time. And then you've got to add security into the mix as well. And they just, I think, users expect security to be built in regardless of any effort they put into it. And that's the sort of culture we're trying to change. And we're a good way down the road there with certain parts of the business. Some parts got a bit catching up to do. But the people element is critical. And I think organizations pay lip service, to be honest. Yeah, I see what you mean.

28:45Do you know what? The biggest culture shifting instances will be when it's happened to them personally, when their identity has been stolen, when they've been involved in a security attack. And I think, unfortunately, people often don't shift their behavior until they have to. We've had quite a few going on, like whenever we had a new starter the other day working for us, within a day of them being here, they had an email from someone impersonating RMD from a totally different email address. They didn't try to, it was a hotmail account or something, but the name said the MD's name. And we've been having this for years.

29:19A couple of people have fallen for it in the past. So it's little ones like that, obviously through to the big ones that like what you're talking about. So look, AA, when you ask anyone in the street, what are the AA famous for? Most people will say, picking me up on the side of the road when I got a flat tire or when I got a problem with the engine. Obviously, the proliferation of EVs, they're increasingly becoming more ubiquitous, aren't they? They're sort of all over the place. How is AA going to evolve and change? Because there's going to be less roadside assistance inevitably. It's all software now.

29:51The roadside assistance can be done remotely a lot of the time, can't it? But how has the AA shifted in terms of its services and products? So we've made quite a shift over the last few years, actually. As the EV proposal has become more of a realistic prospect, A significant number of our patrol vans are now electric. We've got a flatbed recovery vehicle that's electric, fully electric. It's a beautiful piece of kit as well if you're into your HTVs, but it's a gorgeous piece of machinery. Most of our technicians, if not all of them, are trained on how to deal with EV issues now as part of their standard training for roadside recovery.

30:22So all this sort of frontline stuff is already in flight. We've adapted our vehicles and also our systems to deal specifically with EV issues, so we can tow an EV if needed. Battery run out, I bet that's a big one. it's getting less though it's getting less and less common i think in the early days when we first started adopting as a nation perhaps four or five years ago we saw a lot of that but it's almost matching fuel run out pickups now how do they deal with that by the way do they have like a little sort of generator in the back to plug it in to give it a mile or two some of the vehicles i've built in battery packs which can you know give you a surge into your electric vehicle to get you to the next charging station yeah okay because i've got an ev and it's not quite happened to me yet, but I've been pretty close.

31:03We've got dedicated systems in the vehicles now for dealing specifically with EVs. So we made the move quite early. It's not the first time we've looked at electric vehicles as an option for our patrols either. We had electric scooters in around London for a few years in the 90s, late 90s it was. So it's not a new proposition to the AA and we've just adapted our previous experiences to suit the modern EV landscape. And it's evolving at pace but we've also built a product now that covers end the driver's journey end to end so if you look at we've got driving school we run bsm and aa driving schools right we've got the driving schools pick up users right at the very start of the driving journey we have a company called prestige that we own that we do service maintenance repair for fleet vehicles yeah which nowadays includes a lot of evs so we've had to make that adaptation quite quickly we run a company called drive tech as well which does a lot of driver training so including the speed awareness courses that you may be familiar with.

31:54I've done a few. Unfortunately, yes. Yeah, I think we've all been there. Well, in Wales, it's 20 mile an hour. So yeah, it's particularly bad. Yeah, I ride a motorcycle and I've ridden through Wales since that has been put in. So yeah, so we've got a number of different diverse businesses and I hope I haven't missed any. AA Cars, we sell second-hand cars via the AA Cars website. So our business runs really, what we're trying to do is we cover the end-to-end journey from the cradle to the grave for driver's experience, obviously the roadside recovery built in there. And also smart breakdowns another initiative we launched a couple of years ago.

32:25And that's really to help diagnose modern vehicles over the phone, as you mentioned a moment ago, remotely. So we can do a fix over the phone rather than the driver and the wait for a patrol to come out to fix the problem. I think as we're able to ingest more data from the vehicles, then we're going to be able to do those sort of remote fixes more and more frequently. So as you say, the battery dying or running out of juice is still a problem, but it's less of a problem than it was a few years ago. And it almost equals the amount of fuel, traditional fuel run-out calls we have. What is your thoughts on maybe we can get the crystal ball out at this point and sort of say what what do you think about evs is it going to kill combustion engine cars in the medium term do you think we're on that trajectory or do you think there's going to be a split for quite a quite some time to come what's your thoughts i don't think evs are the answer and this is controversial because i think our organization i've heard a lot of people say that pushing ev as there is this sort of the nirvana of motoring but the thing is a lot of these companies now looking at hydrogen based engines other hybrid engines I know there was a biofuel engine that Porsche were looking at some time ago they were developing the biofuel specifically and they were going to scale the factories if it worked so I don't know where that got to because I've touched the story but so I think hybrid is the future without a doubt I have a traditional combustion engine car right and my wife and I have a car each I've got a motorcycle as well so I'm a big fan of internal combustion engines despite the sort of the impact of the environment I appreciate it's not great for that but I love the sound of an engine like I say I'm a lifelong motorcyclist so I'm probably never going to give that up And I've tried electric bikes.

33:51They don't quite do it for me. It's not the same, is it? No, it's not the same. But I genuinely think hybrid is the way forward. And I think that's probably where government should be averting their gaze instead of trying to force everybody in. I don't think that's practical for a lot of people. If you live in a block of flats, how are you going to plug your vehicle and all that sort of stuff? I don't think it's been fully thought through. And this is just a personal opinion. We're not that other company, obviously. But so I think that for me, that's where it will go. And if I were to invest in a new vehicle, I would probably buy a hybrid rather than a pure EV.

34:17No, that makes sense. I've got to ask you about just in that crossroads between EVs and cybersecurity. I've read some dystopian article before about the prospect of bad actors hacking into EVs and causing cars to drive off the side of a bridge or whatever, unbeknown to the driver. Obviously, we're potentially moving into an era now of driverless cars. Do you have security concerns about EV, the software-run cars at all? Have you got any thoughts on that? Every new technology we adopt, right, and going back to AI, it's the same there. We have rapid adoption and uptake of a new technology and the security controls and the data privacy controls in some respects often left as an afterthought.

35:00We saw the same with blockchain and cryptocurrencies, which is why you still see big cryptocurrency heists. We saw the same with cloud adoption some sort of 15, 20 years ago. They rushed into deploying the new technology with little thought for data privacy or security. I think it's been the same with modern connected vehicles. and I don't just limit that to EVs, but my Mini is eight years old and I can still connect to the internet via the in-vehicle system. So I think we've probably rushed into it without really considering the longer-term impacts, as I say. I say longer-term impacts specifically mean around security.

35:32So I think it's a reality, that could come to reality of somebody taking control of a vehicle remotely. If it's not already happened, I haven't seen a report of that. It wouldn't surprise me if it's not already happened in a lab somewhere. Yeah, it was more someone writing about the prospect of it happening than reporting on a specific incident. But if software is hackable everywhere, isn't it? It's possible, I suppose. I did a presentation a few years ago at the Space Center in Harwell, and we were talking about hacking satellites then. Now, if you think, everything's connected right these days.

36:01So a satellite's only 200 miles above Earth orbit. It's only 200 miles away. But hackers can hack systems all the way around the world. You can be anywhere in the world. If you're connected, you can get to anything. The concept of hacking a satellite is pretty simple, really. When I played that scenario back to the audience, they were aghast. They were shocked at the prospect of it. They hadn't really thought about security being built into the communications of the satellite. Yeah, absolutely. So the same is true of modern connected vehicles. It's a bit of an afterthought. I suspect it's catching up now.

36:29I'm not too close to it. I suspect it's catching up. But again, when you look back over the last 10, 15 years, and you can see we've not really resolved the issue of security on traditional IT systems, let alone a system that might appear in a modern connected car. it's entirely possible that will become a reality. How has it evolved in the last couple of years since you've become the CISO of AA? And how do you see it evolving over the next five years as the security landscape obviously becomes more complex? Yeah, so it's a strange one because I've been talking to quite a few different people about this recently because the job market for CISOs seems to have dried up over the last 18 months.

37:04And it's almost as though the technology that enables security in many organizations has got to the point where organizations don't necessarily feel they need a CISO to deploy the security strategy, to look after the team, to help with testing and configuration, as I mentioned before, to drive the security strategy. And a lot of CIOs have picked that up as a second hat in their role. So the job market for CISOs seems to have dried up over the last, say, 18 months. And I think the reality is it's commercially driven. So you might have a CISO who's got a head of, say, a head of InfoSec and a head of SecOps with him, and maybe even a head of physical security reporting into him.

37:38And in order to cut costs, what a lot of organizations are doing, get rid of the CISO role, pass responsibilities directly to the next level down. And that seems to be the norm at the moment. So there are a lot of really good CISOs who are currently between roles because of that. Yeah. Which is quite interesting because, you know, a few years ago we had this huge challenge of ransomware knocking companies over left, right and center. That's not gone away. In fact, it's still getting worse. Yeah. We've not solved that problem. But the minute the financial crisis bites, the first people they seem to get rid of are the security leaders and organizations.

38:06So it's a difficult one to predict where it's going to go. And I think it will come full circle. I think we'll see an evolution of ransomware and it probably will be driven by AI. These technology leaders will need specialists to look at implementing a strategy. Now, for me, employing good basic cyber hygiene is the starting point of controlling any technology, whether it's, as I said before, blockchain, whether it's AI, whether it's cloud security. You have to have a good level of basic hygiene across the board. We talked about zero trust in the security industry for some years. We still haven't really achieved it.

38:36I think it's a nice concept. It's very difficult to implement. Until we get to a point where that is genuinely implemented, we're always going to have gaps in our security attack surface. So I don't think the role of the CISO will go away anytime soon. But again, we've seen it evolve from a technology leader to more of a business leader in the last few years. And I think a lot of forward-thinking businesses get that. They understand that security needs to be part of their strategy to win new contracts, to maintain existing contracts, to demonstrate due diligence to a financial regulator, for example.

39:03And I think as we see the next few years unravel, I suspect a lot of these regulators will mandate the role of CISO in many organizations, much in the same way the Information Commissioner mandated the role of a data privacy officer in organizations, even though they're sometimes double or triple-hatted. I suspect that's the way it'll go, because a lot of companies are going to end up in court because they haven't taken the appropriate due diligence on the security front, and that has resulted in a big data breach and loss of revenue for the organization, particularly enlisted companies. So I think that's the way it's going to go.

39:32It's a bit of a strange time at the moment, for CISOs. Yeah, I just assumed that CISOs had become, it used to be like in addition to the CTO type thing, you'd have a CISO as almost like a periphery job title. But now the CISO has almost become the CTO, if that makes sense. Security is so central. So I hadn't looked at it the way you framed it there. But yeah, I thought security has just become mainstream. Therefore, CISOs are CTOs nowadays, or the CIO. But yeah, it's an interesting one. And to add to that, I think we'll probably see, because of this, it's almost drying up of the market a little bit at the moment.

40:06I think you'll see a lot of CISOs move to CIO roles because they tend to be quite technology-focused, technically competent. I think you'll start to see a lot of CISOs move into those CIO roles where they have those skills. Yeah, absolutely. No, I agree. Let's talk about AI very quickly then. It's a double question. What are you most fearful of, okay? And what are you most excited about in relation to AI? It doesn't have to be about cyber, just in general societal and business impact of artificial intelligence, large language models, generative AI, whatever. But what are you most fearful of? What are you most excited about?

40:38I don't know if I'm fearful of it, really, because it's been around since 1954 in one aspect, one format or another. So it's been around a long time, and it's not. We haven't seen the rise of the Terminators yet. Skynet is coming, Darren, but not quite yet. It possibly is, yeah. So I think, what am I fearful? I think my biggest fear is around the poisoning of data. So there's a number of different specific AI controls you can apply to control your AI and large language model environment. One of the key aspects of that is protecting the data source that the AI relies on. If you put incorrect data in a large language model, the AI will spit that data out as though it's the truth, regardless of how good the AI is.

41:16So unless you have human intervention or some level of checking in there, you're not really going to know if that's right or not. So protecting the data source, I think, is probably the priority action we need to take if we're deploying LLMs anywhere. And again, that comes down to basic cyber hygiene, right? So it's security in the software development lifecycle for the AA and the LLM. It's protecting the infrastructure, so it's vulnerability management for the infrastructure. It's knowing what talks to that infrastructure. So again, it's your asset management piece. It's all of those basic cyber hygiene activities I mentioned earlier.

41:44And if you look at a fairly typical model to adopt is NIST's cybersecurity framework. If you apply all of those controls consistently to a mature level across all of your organization, then you're going to be in a pretty good spot. you're going to reduce the risk of data exfiltration. You're going to reduce the risk of a vulnerability being exploited on your LLM infrastructure. You're going to reduce the risk of that data being poisoned. And having observability, going back to detection response capabilities, which again is part of the NIST model, if you have that capability in place, then again you're going to minimize the risk of an event becoming a data breach or a significant security incident.

42:16So whilst I am concerned about data poisoning, I think if you apply the controls consistently across your organization and test them regularly, ensure the configurations remain consistent. I think the fear factor is fairly low, let's say. Yeah, that's really good. What are you most excited about then? So I'm most excited about the opportunities it brings for users, really. I'll give you an example. These are fairly low-level activities, right, or use cases that I'm talking about here. I mentioned earlier about people being somewhat of a challenge for security folk because most of them find security quite dull.

42:47And again, it can be quite a dry topic, but I love it. I find it fascinating, but I've worked in some fascinating parts of security such as forensics and threat intelligence. I love that side of it. But the reality is we need to build a tool that enables our colleagues to be able to get access to the information they need really quickly in the context that they need it as well. And that's not always possible from a PDF standard or a database or a, God forbid, an Excel spreadsheet. But you can do it from an AI chatbot. You can ask the chatbot the question, given this system serves this customer, this data, and it's under this regulatory regime, what control should I apply for identity access management?

43:21and it will tell you in simple language, you know, you're able to go, okay, I get that now. Whereas at the moment, we have a set of security standards that are quite technical. You know, they're appropriate, but they're quite technical. They're not very user-friendly. So for me, creating that user-friendly face of different aspects of the business, not just security, but any aspect, contact centers, people call in whether they're vulnerable customers perhaps and they've got specific needs, but some of the information they need can be generated by an AI chatbot. Again, you've got to protect that data, make sure it's appropriate, have a level of human checking, between the data and the customer.

43:53And I think that's where it'll add the most value. And obviously automation is slightly different. Robotic process automation has been around for some time as well. We use it to great effect in the AA. The level of automation that I think we can achieve using AI is very exciting. I think that will come with cost efficiencies and possibly replacing some roles, which I think is inevitable. But again, as we say at the AA, we can move people onto more interesting tasks. And again, that's true. Nobody wants to be moving spreadsheets around all day. I think if we can replace that boring activity with something a bit better, then that's better for everybody.

44:19Yeah. Do you have fears with jobs displacement, Darren? Do you think, I know every technology innovation in the past, the roles have just been upgraded to more sophisticated roles and the machines have done the legwork. But now, is this different? I think it will be in the future. I think we're a little way away from that though, because as I mentioned a moment ago, you're still going to need a human intervention to check the data's correct. I think what it will do, it'll increase efficiencies in people's days. Yeah, of course. So they could probably do more of the same type of work. But like I say, make it a bit more interesting for them because nobody wants to be pushing data around.

44:51So I don't think that's an immediate concern, certainly not for us. I think it is inevitable, though, in the long term, there will be some displacement of roles. But I think it will be those very manual, tedious tasks that people probably aren't getting that much satisfaction from anyway. Yeah, sure. So let's finish on this one then, Darren. You're in your armchair with your cigar. I know you ain't done yet, but you've got a while to go in your career. But looking back now on your career, that 24-year-old who joined the Army, me, I think you said you were, what would you say to that guy? What advice would you give to your 24-year-old self?

45:24Gosh, so I was quite an excitable young man, and I was always chasing the bigger, better prize, not necessarily from a financial perspective, but I always wanted to be the guy jumping out of the helicopter with a dagger between his teeth all the time. I didn't do that, by the way. That's what I wanted to do. Darren Rambo Desmond. Exactly. When you're a young man, I think that's fairly natural, right, to go after that. Oh, absolutely it is, yeah. But it's about focusing on the goal not necessarily how you get there i think and this is probably counter to what a lot of people say because i was never clear on what my goal was ever i was just enjoying the ride and i did enjoy the ride very much so but that has caused compromises later on in life so i guess it's pick a goal and try and work towards it and if it doesn't work out but don't fear that just pick another yeah sure but at least have one goal to steer towards and i think that's probably the best advice i could give my younger self because i was like a dog with a bone a lot of the time and I'd just be running around enjoying life, which is great.

46:16It's a great thing to, I'm very happy with what I've done and where I am now, but I just wish I'd been a bit more structured and perhaps a bit mature in my thinking. I was quite a mature young man, so that's perhaps the best advice I could give myself. You're definitely not the only one, Darren. And don't give up on that dream of owning multiple chippies either. It's never too late, okay? Well, look, it's been a pleasure, Darren. I've learned a lot in this conversation. I'm sure the listeners have too, and it's been a real, it's been great fun. So yeah, thanks for coming on the Tech Leaders Podcast.

46:45No problem. Thanks for having me. I really appreciate it.

46:51That was a fantastic conversation. I really enjoyed that. We've had plenty of CISOs and security experts on the podcast over the years, but few speak about cyber with as much passion and clarity as Darren. There were so many takeaways, but I think the key takeaway for me was the critical role of understanding your software estate and maintaining strong IT asset management practices, it's surprising how many organizations still overlook this. As Darren said, if you get your ITAM right, it forms the backbone of a solid security posture, turning security from a constant firefight into a foundation for innovation, growth, and just more progressive endeavors, which I completely agree with.

47:38I hope you enjoyed this episode. If you did, please subscribe, leave a review, and don't forget to connect with us on social media. It really helps us reach more people and bring you more amazing guests like Darren. Thank you so much for listening.

47:58This episode was brought to you by Be Digital. Be Digital support leadership teams to optimize cost and get more out of technology investments. BDigital and the team have unrivaled expertise with technology license management and data remediation and are therefore perfectly positioned to help prepare organizations for AI technology capability. And on the last point, BDigital have developed a cutting-edge AI readiness assessment, which provides tech leaders with a platform they need to make well-informed decisions about AI adoption strategy in 2024 and beyond. Go to Be Digital UK to find out more and get in touch.