About this video

• Video Title: How Collaboration and Risk Governance Shape Security Strategy with Bill Dunnion
• Channel: Cyber Business Podcast
• Speakers: Matthew Connor, Bill Dunnion
• Duration: 00:42:27

Overview

This video features an interview with Bill Dunnion, co-founder of the Canadian Cyber Forum and CISO at Mel. The discussion centers on the importance of community, collaboration, and risk governance in shaping effective cybersecurity strategies. Bill shares the origin story of the Canadian Cyber Forum, highlighting its mission to provide a space for cybersecurity professionals to share insights and best practices. He also discusses his diverse career path, the evolution of the CISO role, and how security can be an enabler of business rather than just a cost center. The conversation touches upon Mel's recent Chapter 11 restructuring and its positive outcome.

Key takeaways

• Canadian Cyber Forum's Mission: The forum was established to create a collaborative space for cybersecurity professionals to share knowledge, discuss challenges, and foster community, countering the "bad guys" who actively share information.
• Community Driven Growth: The forum's success, evidenced by consistent attendance and new members, is largely driven by word-of-mouth and a commitment to providing value without turning attendees into the product.
• Evolving CISO Role: The CISO role is increasingly shifting from a purely technical or "department of no" position to a business-focused strategic enabler, integral to business goals and revenue generation.
• Security as a Business Enabler: Effective cybersecurity strategies focus on understanding business needs and enabling growth by securing contracts and mitigating risks, rather than solely operating as a cost center.
• Mel's Restructuring: Mel successfully navigated a Chapter 11 restructuring through a debt-to-equity conversion, resulting in a healthier balance sheet and continued profitability, positioning the company for future growth.

Bill mentions that he has had two tours at Mel, with his first being his second job out of school. He was in product marketing and worked there from 1995 to 2000. He notes that he has seen sales from various perspectives, including marketing, channel, wholesale distribution, and reseller. He also humorously states that he hasn't met another CISO who has also been to "President's Club."

He further explains that Mel recently went through a Chapter 11 restructuring. He clarifies that Chapter 11 is different from a typical bankruptcy and that Mel emerged with $1.1 billion less debt and reduced annual interest charges. Mel was profitable before and during the restructuring and remains so, with new owners, a new board, and the same performance-driven team. Globally, Mel is a leader in the unified communications marketplace, with over 75 million phones installed worldwide, 7,000 channel partners, over a billion in revenue, and more than 5,000 employees. Bill views this as a positive outcome, highlighting Mel's ability to adapt to changing market conditions.

About this video

• Video Title: How Collaboration and Risk Governance Shape Security Strategy with Bill Dunnion
• Channel: Cyber Business Podcast
• Speakers: Matthew Connor, Bill Dunnion
• Duration: 00:42:27

Overview

This video features an interview with Bill Dunnion, co-founder of the Canadian Cyber Forum and CISO at Mitel. The discussion centers on the importance of community, collaboration, and risk governance in shaping effective cybersecurity strategies. Bill shares the origin story of the Canadian Cyber Forum, highlighting its mission to provide a space for cybersecurity professionals to share insights and best practices. He also discusses his diverse career path, the evolution of the CISO role, and how security can be an enabler of business rather than just a cost center. The conversation touches upon Mitel's recent Chapter 11 restructuring and its positive outcome.

Key takeaways

• Canadian Cyber Forum's Mission: The forum was established to create a collaborative space for cybersecurity professionals to share knowledge, discuss challenges, and foster community, countering the "bad guys" who actively share information.
• Community Driven Growth: The forum's success, evidenced by consistent attendance and new members, is largely driven by word-of-mouth and a commitment to providing value without turning attendees into the product.
• Evolving CISO Role: The CISO role is increasingly shifting from a purely technical or "department of no" position to a business-focused strategic enabler, integral to business goals and revenue generation.
• Security as a Business Enabler: Effective cybersecurity strategies focus on understanding business needs and enabling growth by securing contracts and mitigating risks, rather than solely operating as a cost center.
• Mitel's Restructuring: Mitel successfully navigated a Chapter 11 restructuring through a debt-to-equity conversion, resulting in a healthier balance sheet and continued profitability, positioning the company for future growth.

Ask me anything about this video

1. What was the initial inspiration and process behind founding the Canadian Cyber Forum?
2. How has the role of a CISO evolved, and what is the current perception of this role in organizations?
3. What strategies can be employed to shift the perception of cybersecurity spending from a cost center to a business enabler?
4. Can you describe the specific financial and operational improvements Mitel experienced after its Chapter 11 restructuring?
5. Turn this video into a tweet...

Here are speaking points about AI, the evolving role of the CISO, and security as a business enabler, based on the transcript:

Artificial Intelligence (AI)

• The transcript does not directly mention or discuss Artificial Intelligence (AI).

Evolving Role of the CISO

• Diverse Paths: There isn't a single "typical" path to becoming a CISO; Bill Dunnion's own career path is cited as an example of this diversity.
• Business Acumen Over Purely Technical Skills: Organizations are increasingly recognizing that the CISO role should be a business role, not just a technical one.
• Involvement in Business Decisions: CISOs are being pulled into strategic business discussions, such as RFP calls and go/no-go bid decisions, indicating their integral role beyond technical implementation.
• "No, But" Department: The CISO should aim to be a partner in finding solutions rather than just saying "no." The approach is to understand the business need and then advise on how to achieve it safely.
• Understanding Business Drivers: A CISO's varied background and understanding of what drives different parts of the business can elevate security conversations.
• Security as a Business Enabler: The goal is to shift security from a "cost of doing business" to a "cost of sales" or a business enabler.

Security as a Business Enabler

• Customer Perspective is Key: Understanding customer requirements and translating them into operational procedures is crucial for enabling business.
• Supply Chain Risk Management: Security and risk management are increasingly being pushed upstream, becoming critical factors in RFP processes and supplier selection.
• Enabling Contracts: Compliance (e.g., ISO, NIST) can be framed as a way to secure customer contracts and support the business, rather than just an expense.
• Cost-Effectiveness and Scope: CISOs can add value by understanding scope and implementing security measures cost-effectively to meet customer needs, potentially reducing the burden of extensive audits.
• Moving Beyond "Just Spending Money": Arguments for security budgets should focus on retaining contracts and enabling business growth, not just on industry averages or general spending.
• Focus on Business Goals: The primary focus for IT and security leaders should be on how their function helps the business achieve its goals, transforming them from cost centers to integral team members.
• Maturity of the Industry: The industry is maturing, with more focus on the business side of technology and security, moving beyond just the technology itself.

Based on the transcript, here are the key points Bill makes regarding the sharing of information by "bad guys" and the importance of "good guys" doing the same:

• Adversaries Collaborate Actively: Bill explicitly states that malicious actors (the "bad guys") are constantly talking and sharing information.
• Rapid Exploitation Dissemination: As soon as an exploit becomes available, it's shared among attackers, leading to a swarm of activity.
• "Blood in the Water" Mentality: When an organization is breached or attacked, it attracts attention from other attackers, creating a "blood in the water" scenario where sharks (attackers) swarm.
• The Need for Proactive Communication Among Defenders: Because adversaries are so collaborative, Bill argues that if "good guys" (security professionals) do not communicate and share information, they will "lose."
• Community as a Countermeasure: The core purpose of the Canadian Cyber Forum is to create this collaborative environment for like-minded individuals to share what's working and what's not, directly addressing the need for defenders to communicate.