Equifax CISO: Trust Starts and Ends with You

Organizational culture is key to good enterprise security posture, Jamil Farshchi told Black Hat attendees.

BLACK HAT USA — Las Vegas — One of the main takeaways from major data breaches like the one at Equifax in September 2017 is that organizational culture is fundamental to a good security posture, said Jamil Farshchi, the credit monitoring bureaus CISO, in a talk here today.
Farshchi was CISO at Home Depot when the breach at Equifax happened. He was hired at Equifax less than six months later and has been in charge of rebuilding the companys beleaguered security program. Its the same role he was called in to play at Home Depot following the 2014 data breach that exposed data on over 50 million payment cards.
Equifax was meaningfully impacted right out of the gate, Farshchi said. The company experienced a 40% loss in market cap in the immediate aftermath of the breach. It also lost its CEO, CIO, and CSO and had over $1.25 billion in incremental transformation costs. Recently, Equifax also agreed to pay $700 million to compensate victims of the breach.
Incidents like these tend to focus a lot of attention on the immediate causes and less so on the underlying, systemic issues, he said. At a Senate hearing on the Equifax breach, for instance, many of the questions that Farshchi received were focused on technical issues, such as the companys patching processes, certificate management habits, and asset inventory-handling capabilities.
While all of the questions were meaningful and relevant, they did not touch on root-cause issues that often have to do with organizational culture and attitudes toward security, he said. If you are looking at individual breaches, you are missing the bigger picture, he said.
Farshchi said his experience has shown that five things are key to having an effective security organization. First, the head of security or the CISO needs to have the ability to influence and drive change as required across the entire enterprise. Second, this person also needs to be able to regularly interact with the board of directors and senior leadership on security strategies and direction.
The third big driver is economic incentive. The organizations that are doing well at security tie economic incentives to the effectiveness of the security program.
Farshchi identified the fourth and fifth key factors to security success as risk management and crisis management. Security teams that conduct regular crisis management exercises with executive leadership and the board are often better prepared to deal with an actual one, he noted.
Security organizations need to have the ability to identify meaningful risks, and security leaders need to have the conviction to escalate concerns even if doing so means halting or delaying a business initiative, he said. It is absolutely critical for security groups not to just identify an issue but to do something about it, Farshchi said.
He noted a new say/do motto within his own organization that emphasizes the idea that if you say something, you absolutely need to deliver on it. Trust starts and end with you, Farshchi said.
Related Content:
Equifax to Pay Up to $700M for Data Breach Damages
Former Equifax CIO Sentenced to Prison for Insider Trading
Senate Report on Equifax Raises Questions Ahead of FICO Product Announcement
8 Free Tools to Be Showcased at Black Hat and DEF CON

Last News
▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Equifax CISO: Trust Starts and Ends with You