Most Ingenious Leaders in Cybersecurity to Watch, 2024

VOL 06 I ISSUE 08 I 2024 What You Really Need to Know? Cybersecurity Myths Debunked Environmental Sustainability Most in Cybersecurity Ingenious CSOs Driving Green Ini?a?ves Leaders in Cybersecurity to Watch, 2024 Camilo Gómez Global Cybersecurity Strategist Yokogawa Camilo Gómez Integrating Cyber Resilience Across Business Lifecycle

Cyber Heroes in Action n cybersecurity, 2024 showcases a cohort of potential cyber incidents, ensuring a swift and leaders whose innovative strategies and forward- effective response when faced with adversity. I thinking approaches are redefining industry standards. These individuals stand out not only for Beyond their technical prowess, these leaders are their technical expertise but also for their visionary advocates for ethical cybersecurity practices and leadership in navigating the complex and ever- standards. They champion transparency and changing landscape of digital threats. accountability in cybersecurity operations, ensuring that privacy and data protection remain paramount in At the forefront of this vanguard are leaders who have all initiatives. Their commitment to upholding ethical harnessed the power of artificial intelligence and standards sets a benchmark for the industry, inspiring machine learning to revolutionize threat detection and trust and confidence among stakeholders. response. Their initiatives leverage cutting-edge technologies to proactively identify and neutralize As we navigate the complexities of a digital landscape emerging cyber threats before they can inflict harm. fraught with challenges, these leaders stand as This proactive stance is crucial in an era where beacons of innovation and integrity. Their relentless cyberattacks are becoming more sophisticated and pursuit of excellence and their dedication to pervasive. safeguarding digital assets make them indispensable in shaping a secure and resilient cybersecurity These leaders are not just focused on technological ecosystem. Watch closely as their ingenuity continues solutions but also on fostering a culture of to drive transformative change, paving the way for a cybersecurity awareness and resilience within their safer digital future. organizations. They prioritize comprehensive training programs and simulations to prepare their teams for Prince Bolton Editor's Note

S C O V E R S T O R Y 08 T Camilo Gómez N Integrating Cyber Resilience Across the Business Lifecycle E P r o f i l e s Frank Domizio Strengthening Cybersecurity Through 18 Strategic Leadership T Meet Your Digital Defender Yehia Elghaly N Creating A Cybersecured Global 26 Future for Everyone A R T I C L E S O Environmental Sustainability in Cybersecurity CSOs Driving Green Initiatives 22 What You Really Need to Know C Cybersecurity Myths Debunked 30

Pooja M Bansal Editor-in-Chief CONTENT FOLLOW US ON Deputy Editor Anish Miller www.facebook.com/ciolook Managing Editor Prince Bolton www.twi?er.com/ciolook WE ARE ALSO AVAILABLE ON DESIGN Visualizer Dave Bates Art & Design Director Davis Mar?n CONTACT US ON Associate Designer Jameson Carl Email Featured Person Company Name Brief info@ciolook.com SALES Camilo Gómez Camilo is a Senior Cybersecurity & Risk Management For Subscrip?on Yokogawa Senior Sales Manager Wilson T., Hunter D. professional, delivering thought leadership and strategic Global Cybersecurity www.ciolook.com yokogawa.com thinking within the organization and the automation industry. Strategist Customer Success Manager Collins J. Copyright © 2024 CIOLOOK, All rights reserved. The content and Sales Execu?vesTim, Smith Frank in his current position, is working to secure the assets of Frank Domizio images used in this magazine should a $1 trillion organization by strategically guiding all levels of Mom's Meals Chief Information not be reproduced or transmi?ed in information security and privacy through process improvement momsmeals.com TECHNICAL any form or by any means, Security Officer and agile transformation. electronic, mechanical, Technical Head Peter Hayden photocopying, recording or Lance Mathews otherwise, without prior permission Lance and his team deliver forensics and cybersecurity Technical Consultant Victor Collins Principal - Cybersecurity crai from CIOLOOK. investigation support in the areas of data privacy, litigation & Incident crai.com Reprint rights remain solely with support, data scraping, and other disruptions that may threaten SME-SMO Response - Forensic CIOLOOK. a company’s integrity, values, or success. Investigatons Research Analyst Eric Smith SEO Execu?veAlen Spencer With over 18 years of experience in ICT and Cyber Niel Rooyen Security,Niel has successfully operated within various private magicorange Chief Information sectors, including mining, retail, manufacturing, and magicorange.com Security Officer telecommunications. sales@ciolook.com Over the past more than 11 years, Yehia has successfully led Yehia Mamdouh and executed over 200 projects across a wide range of sectors, June, 2024 Red Team Senior Cybersecurity including government, banking, aviation, oil and gas, redteam.com Consultant education, and critical national infrastructure systems.

C O V E R S T O R Y Camilo Camilo Gómez Global Cybersecurity Strategist Yokogawa Gómez Integrating Cyber Resilience Across the Business Lifecycle The role that cybersecurity standards play is fundamental, not only for building cybersecurity in organizations and products, but for stepping up what Camilo calls end-to-end supply-chain cybersecurity.

Securing Industrial Operations! Subsequently, as the internet became adopted as a connectivity alternative by corporations, Camilo n the industrial operations sector, where technology focused on designing and implementing regional and operational integrity converge, cybersecurity extranets to securely interconnect the corporation with I resilience emerges as a critical necessity. Protecting engineering firms and construction sites involved in operational technology (OT) and industrial control building O&G onshore and offshore production systems (ICS) becomes increasingly essential as facilities. industries evolve. This domain, filled with complexities, requires both technical expertise and a profound It was then, during a cybersecurity assessment of the IT understanding of operational contexts and business infrastructure of an offshore platform at a construction constraints. site, that a project manager approached Camilo. He noticed that the equipment in the process control rack In this challenging sphere, seasoned strategists like for the facility oddly resembled the equipment in the IT Camilo Gómez play a pivotal role in handling obstacles rack and wondered if it should also be cybersecurity and fostering resilience. As Global Cybersecurity evaluated. Strategist at Yokogawa,Camilo’s journey reflects the evolution of cybersecurity in industrial settings. With a Navigating the Challenges of Industrial Operations background rooted in managing service delivery and leading secure technical integrations, his course Initially inspiring Camilo to specialize in OT/ICS, highlights the crucial role of cybersecurity in shaping cybersecurity was the intriguing combination of operational landscapes. challenges and experiences posed by computing and communication technologies, perceived, at first, as His experiences, spanning diverse environments from black boxes. The complexity of these technologies, not only in terms of cybersecurity, but also in maintaining onshore oil & gas facilities to offshore platforms, shed light on the diverse nature of cybersecurity within operational integrity, fascinated him deeply. industrial operations. In the pursuit of cybersecurity excellence, strategy is as crucial as execution. For Moreover, his firsthand experience supporting field Camilo, driving cybersecurity resilience into every operations in incredibly demanding environments phase of the OT business lifecycle is not just a slogan further fueled his interest. He has supported industrial but a guiding principle. operations situated in regions of high geopolitical volatility, frontier areas with harsh weather conditions, can play a role in making these systems safer and more Many organizations focus solely on prevention, As industries navigate evolving threats and and even deep-sea installations inaccessible to humans. resilient, ultimately benefiting society. neglecting the fact that cybersecurity is fundamentally technologies, his unwavering commitment to nurturing Such hazardous environments handled materials vital risk management. Being prepared to respond to cyber collaboration, embracing advancements, and for producing and transporting energy and other The Continual Process of Cybersecurity threats is equally important for Camilo. Ignoring this championing resilience reflects a transformative essential resources, which were critical for society. reality can lead to severe consequences, including approach to cybersecurity in industrial domains. Cybersecurity is often perceived as highly complex and costly cyber compromises. OT/ICS cybersecurity goes beyond textbook challenging, yet its foundational principles have been Let’s explore Camilo’s journey in cybersecurity from knowledge—it requires a deep understanding of established for over two decades with minimal changes. Cyber risk management encompasses both proactive intriguing challenges to operational integrity: business intricacies, operational contexts, and Despite this, organizations do not consistently practice and reactive strategies for Camilo. The process starts constraints associated with industrial environments or fully implement and maintain these principles. with implementing robust preventive measures and Journey into the World of Cybersecurity where the OT technology is implemented. This response protocols to strengthen defenses and address expertise is gained through direct experience and an Cybersecurity is not a one-time endeavor for Camilo; vulnerabilities, thus mitigating cyber threats. In the late 1990s, after several years of developing data immersive understanding of the operational landscape. it’s a continual process akin to other critical business network & telecom solutions and services in support of This is a field where the “had been there and done that” It involves developing detection capabilities to rapidly functions. It demands discipline—requiring careful oil & gas field operations in the US, Latin America, and approach is crucial. identify breaches and responding promptly to contain planning, design, correct implementation, ongoing the Caribbean, Camilo was tasked with leading the incidents, minimizing business disruptions. Following support, and maintenance. Just like safety, secure technical integration of corporate networks The most rewarding aspect of working in OT organizations must exercise cybersecurity continuously containment and recovery efforts, post-incident during the business merger and acquisition of an oil & cybersecurity for Camilo is the opportunity to effect to remain effective. reviews are conducted to glean insights for refining gas major. This involved ensuring secure, full positive change and contribute to larger-scale future response strategies and enhancing overall risk integration on day one of the merger and acquisition. improvements. By enhancing cybersecurity practices in management. critical infrastructure and operational environments, he

prerogative, believing that not all scenarios require end-to-end supply-chain, from end-users to product stringent security measures. On the other hand, some suppliers, in comparison with the IT space where view security as paramount, advocating for a certification and standard consensus is not prevalent. comprehensive approach with security integrated from the outset, incorporating the highest levels of security An integral part of Yokogawa’s strategy and capability. commitment to cybersecurity is illustrated by their continuous contribution to the development of Leading stakeholders to recognize that cybersecurity is cybersecurity standards and cybersecurity certification an enabler, not a roadblock, that the functionality of products for the OT/ICS space. Yokogawa has been defined by the O-PAS standard is built around actively contributing to the international committees cybersecurity capability, and that having a baseline developing the ISA/IEC 62443 standard since 2005 and level of cybersecurity is necessary to enable is a founding member of ISCI, the consortia developing interoperability of the functionality defined, has been a the ISASecure Certification since 2007. journey for Camilo. Embracing Cybersecurity Advancements in the OT This is a successful journey where cybersecurity Industry thinking is fully ingrained and developed everywhere in the O-PAS standard development process, from the For Camilo, staying updated implies being both definition of functionality to the certification of outward and inward-looking: looking outward to the products. OT industry and IT technology developments and looking inward to Yokogawa’s internal innovation The Fundamental Role of Cybersecurity Standards developments, as well as the adoption of emerging IT technologies and cybersecurity advancements. The role that cybersecurity standards play is Staying aware of the advancements in the OT industry, fundamental not only for building cybersecurity in the cybersecurity space, and emerging IT technologies organizations and products, but for stepping up what Camilo calls end-to-end supply-chain cybersecurity. are all very important to him. This is a time when the This is one where one person’s ceiling is another adoption of IT technologies and cybersecurity person’s floor and where everyone is both a consumer advancement in OT solutions are at inflection points. Balancing Diverse Viewpoints on Cybersecurity and a supplier. Today, the so-called IT technologies such as AI, cloud, virtualization, and containerization, for example, Facing challenges is a constant part of the career of The ISA/IEC 62443 Cybersecurity for Industrial permeate both IT and OT solutions. It is not that every cybersecurity professional. A recent example is Automation & Controls Systems Series of Standards is solutions in the IT space and the OT space are Camilo’s engagement with the Open Process the most compelling example. A standard initially converging but that they both use the same Cybersecurity is not Automation Forum (OPAF), where he is Co-Chairing developed for the process industries in the O&G and underpinning technologies. the Security Subcommittee and editor of Part 2 – chemical sectors was rapidly adopted by electrical, a one-time Security of the Open Process Automation Standard (O- transportation, manufacturing, pharma, and others, In OT/ICS cybersecurity, both technology and PAS). including other standards. operational context are very important to him. After all, endeavor for him; one cannot secure what one doesn’t understand. There OPAF is not only standardizing the next generation of The success of the ISA/IEC 62443 series is precisely are several concurrent advancements in the OT space, it’s a continual process control technologies but also paving the way due to the fact that it addresses cybersecurity for all such as Industry 4.0, NAMUR, OPC UA, and OPA. They process akin to for easier adoption of IT technologies, into the OT stakeholders: end-users, system integrators, service all incorporate cybersecurity in some way or fashion, space. The forum consists of end-users of OT providers, and product suppliers. It effectively helps from requirements to specified, mandatory security other critical technologies, OT system integrators and product organizations with all levels of cybersecurity maturity, capabilities. However, in context, they may differ, suppliers, IT system integrators and product suppliers, from those looking to build cybersecurity for the first augment, or complement each other. Interestingly, they business functions. and others eager to participate in the OT space. time to those looking to enhance their maturity. are all aligned or mapped to security capabilities in the OPAF has demonstrated a steadfast commitment to ISA/IEC 62443 standard. cybersecurity since its inception. However, it faces the In times when supply-chain cybersecurity is a hot topic, common challenge of accommodating diverse one of the most overlooked is the role that the ISA/IEC Similarly, the development of Yokogawa’s innovative stakeholder viewpoints on cybersecurity. Some 62443 standard and product certification have played solutions, such as distributed control systems, safety stakeholders prioritize security as an end-user in building and stepping-up cybersecurity in the OT instrumented systems, and a collaborative information

cybersecurity capabilities to supporting managed per Camilo’s observation. Cybersecurity then becomes About Yokogawa cybersecurity services and solutions. Typically, an added layer rather than being integrated from the Yokogawa has obtained ISASecure certificates for start, which can be less effective and more costly to Yokogawa provides advanced those sorts of platforms and ISASecure SDLA for the retrofit into existing systems. solu?ons in the areas of development process. measurement, control, and Fostering Collaboration through Cybersecurity informa?on to customers across a Yokogawa also focuses on delivering long-term lifecycle Integration services while understanding customers’ challenges broad range of industries, and working continuously for improvements in a close For Camilo, a key strategy to foster collaboration and including energy, chemicals, partnership. Yokogawa follows one overall objective: to alignment is integrating cybersecurity thinking into materials, pharmaceu?cals, and minimize risk and maximize corporate values according business processes, starting with those he can directly food. Yokogawa addresses to the self-commitment as a lifecycle value partner. influence. In his role, he works with other strategists customer issues regarding the Yokogawa aims to become the end-user’s #1 trusted researching and developing advancements in OT op?miza?on of produc?on, assets, partner and achieve long-term, stable, and secure technology such as Open Process Automation (OPA), and the supply chain with the operations. industrial automation to industrial autonomy (IA2IA), robotics integration platforms, and several others. effec?ve applica?on of digital The broad-based lifecycle cybersecurity services technologies, enabling the include consulting services and an IT/OT security He influences and assists internal product and solutions transi?on to autonomous operations center (SOC). The SOC provides a proactive development teams, advises project and engineering opera?ons. defense with the detection of known and unknown teams, and builds reference architectures. He supports risks and rapid response to incidents. cybersecurity conversations with customers and Founded in Tokyo in 1915, motivates and inspires others to follow. Yokogawa con?nues to work Integrating Cybersecurity Resilience into Business toward a sustainable society Lifecycle In his experience, decomposing cybersecurity complexity to make it simple and relatable has been through its 17,000+ employees in One of the most inspiring aspects of Camilo’s instrumental in influencing his direct stakeholders to a global network of 129 management of cybersecurity in the OT space is the ingrain cybersecurity thinking in their business companies spanning 60 countries. mitigation of cybersecurity risks that can escalate from processes and helping him promote cybersecurity For more informa?on, visit corporate impacts to broader societal consequences. thinking throughout the whole organization. www.yokogawa.com This underscores the importance of integrating cybersecurity resilience into every stage of the business lifecycle—from the capital projects implementing OT technologies to multiyear field operations utilizing them. Each stage of the business lifecycle presents a vital opportunity to ensure that cybersecurity is seamlessly integrated into the design, For Camilo, a key strategy to implementation, and operational processes. foster collaboration and An important business consideration often overlooked alignment is integrating by organizations, as observed byCamilo, is the significant disparity in budget allocation between cybersecurity thinking into capital projects and ongoing operations, particularly in operational technology (OT) environments. Capital business processes, starting projects typically receive higher budgets compared to with those he can directly operational phases. Thus, the opportunity to do cybersecurity right from the beginning starts with the influence. projects, not in operations. Delaying cybersecurity conception, design, and implementation until the operational phase can pose substantial challenges and result in increased costs, as

Understanding OT Systems The Role of Strategy in Cybersecurity Improvement As Camilo has mentioned before, OT cybersecurity is Camilo’s guiding principle is to embed cybersecurity not something one can simply learn from a book. Thus, resilience into every phase of the OT business lifecycle. if one doesn’t already have the background, it’s “Effective cybersecurity starts with a robust foundation important to learn what OT systems do and how they and thrives through continuous support and work. One should understand what PID is and the maintenance,” is his motto. difference between closed-loop and open-loop, for example. It’s crucial to learn how OT environments In his view, a carefully planned and diligently executed operate. One should get acquainted firsthand with the cybersecurity strategy forms the basis for continuous operational intricacies of OT environments, such as improvement. An adeptly crafted OT cybersecurity safety, permit to work, management of change, and strategy evolves seamlessly with technological, operational excellence, among many others. operational, and business changes, promoting This is a challenging function that requires discipline. continuous adaptation and enhancement. It is very rewarding to make a difference and help others practice cybersecurity. Like safety, cybersecurity is everyone’s responsibility and something we should exercise continuously.

including risk management, threat detection and response, compliance, and security awareness training. One of the main challenges Frank faces is the sheer Frank Domizio scale and complexity of the organization’s digital Strengthening Cybersecurity Through Strategic Leadership ecosystem. With numerous interconnected systems, applications, and devices, ensuring a consistent and robust security posture across the board requires careful coordination and collaboration with various stakeholders. he cybersecurity industry plays a pivotal role in comprehensive cybersecurity strategies developed and preserving the integrity and functionality of the implemented by Frank and his team. The sheer scale Additionally, staying ahead of emerging threats and T digital ecosystem, enabling individuals, and complexity of Mom’s Meals’ digital ecosystem evolving regulatory requirements is a continuous businesses, and governments to harness the full present ongoing challenges, necessitating agile challenge. However, Frank believes he can address potential of technology while reducing the inherent approaches and collaborative efforts to ensure a these challenges and safeguard the organization risks. This industry is characterized by its ability to consistent and robust security posture across the effectively by leveraging advanced technologies, anticipate and respond to threats like targeting organization. fostering a culture of security awareness, and sensitive corporate data, ransomware attacks crippling maintaining strong partnerships with industry peers. essential services, ensuring the integrity of digital Let’s explore how Frank is adopting innovation in infrastructures, and protecting valuable data. cybersecurity: Empowerment in Cybersecurity Leadership In this industry, individuals like Frank Domizio have Transitioning from Law Enforcement to Cybersecurity Frank’s leadership style in guiding information security emerged as pillars of resilience and innovation, and privacy strategies is characterized by collaboration, navigating the complexities of securing digital assets Frank’s journey into cybersecurity began in the 1980s transparency, and empowerment. He believes in with precision and expertise. Transitioning from law when he got his first computer, a Tandy 1000 HX. This fostering an inclusive environment where team enforcement to cybersecurity, Frank’s journey interest led him to get involved with technology members feel valued, supported, and encouraged to epitomizes the evolving nature of the industry. throughout his career as a Philadelphia police officer contribute their ideas and expertise. and into his current career. As technology evolved, so Frank Domizio Driven by a passion for protecting organizations from did the threats associated with it. Witnessing the Chief Informa?on Security Officer By promoting open communication channels and cyber threats, Frank’s expertise has led him to his increasing importance of cybersecurity in safeguarding Mom’s Meals actively listening to the perspectives of all current role as Chief Information Security Officer digital assets and privacy, he felt compelled to pivot his stakeholders, he ensures that decisions are informed learning. He believes in leveraging agile methodologies (CISO) at Mom’s Meals. As CISO, Frank oversees a wide career toward this field. and aligned with the organization’s objectives. He also to enhance their ability to respond quickly to evolving range of security initiatives, including risk management, prioritizes mentorship and professional development, threats and challenges in the cybersecurity landscape. threat detection and response, compliance, and Over the years, he has honed his skills, transitioning empowering team members to enhance their skills and security awareness training. from law enforcement to cybersecurity. Each step of take on new challenges. This involves breaking down silos between different the way, he has been driven by a passion for protecting teams and fostering cross-functional collaboration to Mom’s Meals, a leading provider of medically tailored, organizations from cyber threats and ensuring the At the same time, he leads by example, demonstrating a streamline processes and workflows. By embracing a home-delivered meals in the nation, relies on integrity of their digital infrastructure. This journey has strong commitment to integrity, accountability, and culture of experimentation and innovation, they can led him to his current role as CISO at Mom’s Meals, ethical conduct in all aspects of their cybersecurity identify areas for improvement and implement iterative where he continues to apply his expertise to fortify efforts. By fostering a culture of trust and changes to their security operations. He also their cybersecurity posture and mitigate risks in an collaboration, he enables their team to effectively emphasizes the importance of leveraging automation ever-evolving threat landscape. navigate complex security challenges and drive and technology to optimize workflows and enhance Frank believes in leveraging meaningful outcomes that support the organization’s efficiency. Guarding Digital Asset agile methodologies mission and goals. to enhance their ability to Through regular feedback loops and data-driven As the CISO of the leading provider of medically Adapting Agile Methodologies in Cybersecurity insights, they can continuously evaluate their tailored, home-delivered meals in the nation, Frank’s respond quickly to evolving Operations processes, identify bottlenecks, and implement responsibilities revolve around developing and threats and challenges in the targeted improvements to strengthen their implementing comprehensive cybersecurity strategies In his approach to process improvement and agile cybersecurity landscape. cybersecurity posture. Overall, his approach is to protect their valuable customers and assets. This transformation within cybersecurity operations, Frank centered on fostering a culture of agility, innovation, involves overseeing a wide range of security initiatives, prioritizes adaptability, collaboration, and continuous 18 19 www.ciolook.com | June 2024 | www.ciolook.com | June 2024 |

and continuous improvement to ensure that their perspective and enhanced problem-solving abilities, areas of cybersecurity that align with one’s interests cybersecurity operations remain effective and resilient enabling him to tackle complex cybersecurity and career goals, whether it’s penetration testing, in the face of emerging threats and challenges. challenges with creativity and agility. incident response, cloud security, or risk management. Frank’s leadership style in guiding informa?on security Staying Ahead of Emerging Threats with Data Continuous Learning and Collaboration in Second, he emphasizes the importance of cultivating a Analysis and privacy strategies is Cybersecurity continuous learning mindset and staying abreast of the latest trends, technologies, and threats in the characterized by collabora?on, Cyber threat intelligence analysis plays a crucial role in Frank needs to stay agile and adaptive in a constantly cybersecurity landscape. This could involve transparency, and Frank’s day-to-day responsibilities as CISO, particularly evolving cybersecurity landscape, which requires a participating in industry conferences, workshops, in proactively identifying and mitigating potential empowerment. multifaceted approach. It’s crucial for him to maintain a webinars, and online communities, as well as pursuing threats to their organization’s security posture. continuous learning mindset and stay abreast of the advanced certifications and higher education Drawing from his experience with the CISA, he latest trends, technologies, and threats through opportunities. recognizes the importance of using open-source ongoing education, reading, and industry events. language, he empowers individuals at all levels of the information and publicly available data to stay ahead of Additionally, fostering a culture of collaboration and Next, he advises not to underestimate the importance organization to make informed decisions and take emerging threats and trends in the cybersecurity knowledge-sharing within the cybersecurity team of soft skills such as communication, collaboration, and proactive steps to enhance cybersecurity. landscape. enables them to leverage collective expertise and problem-solving. Effective communication and insights to address emerging challenges effectively. collaboration are critical for working effectively in This emphasis on accessibility not only fosters a culture Using intelligence bulletins, articles, and podcasts, they interdisciplinary teams and conveying complex of security awareness but also strengthens their overall can gain valuable insights into adversary tactics, Embracing innovation and experimentation is essential technical concepts to non-technical stakeholders. As cyber defense posture. Ultimately, his experience with techniques, and procedures, as well as emerging for him. By encouraging experimentation with new the founder of Soft Side of Cyber, a non-profit the FBI has equipped him with the communication skills vulnerabilities and exploit trends. This allows them to tools, methodologies, and approaches, they can identify organization dedicated to promoting the importance of necessary to effectively advocate for cybersecurity anticipate and prepare for potential threats, enabling innovative solutions to evolving threats. This approach soft skills in cybersecurity, he can attest to the initiatives and drive meaningful change within the significant role these skills play in the advancement of them to implement proactive defensive measures to also involves being open to feedback, learning from organization. both successes and failures, and iteratively refining IT professionals. protect their organization’s assets and data. their strategies and processes. Tackling Complex Challenges with a Broader Also, analyzing open source and publicly available data Also, he encourages seeking out mentorship and Perspective informs their incident response planning and decision- Furthermore, establishing robust partnerships with networking opportunities within the cybersecurity making processes, enabling them to prioritize and industry peers through organizations like the community. Building relationships with experienced Transitioning into roles that demanded skills beyond allocate resources effectively. Overall, open source and Healthcare Sector Coordinating Council Cybersecurity professionals can provide valuable guidance, insights, cybersecurity, such as Frank’s time as Social and Digital publicly available data analysis are essential Working Group, a partnership between the healthcare and opportunities for career advancement. He suggests Media Manager with the Philadelphia Police components of their cybersecurity strategy, community and the Department of Health and Human considering joining professional organizations, Department, has been a valuable learning experience empowering them to stay informed and vigilant against Services, enhances their ability to stay ahead of attending networking events, and connecting with for him. One of the most significant lessons he has evolving cyber threats. emerging threats. By leveraging collective intelligence peers on platforms like LinkedIn. learned is the importance of adaptability and versatility and collaborating on important policy initiatives, they in navigating diverse professional landscapes. Shaping Cybersecurity Leadership through FBI can collectively strengthen their cybersecurity posture. Finally, he stresses the need to be adaptable and Embracing these new roles required him to step outside Training resilient in the face of challenges and setbacks. The his comfort zone, challenge himself, and acquire new Lastly, maintaining a proactive stance towards risk cybersecurity landscape is constantly evolving, and the skills rapidly. Frank’s experience working at the FBI’s Philadelphia management and compliance ensures that they remain ability to adapt to change and persevere in the face of Regional Computer Forensics Lab has been aligned with evolving regulatory requirements and adversity is essential for long-term success in the field. Moreover, these experiences underscored the instrumental in shaping his approach to cybersecurity industry best practices. By continuously assessing and He urges you to embrace opportunities for growth, take significance of continuous learning and growth in leadership. The training he received from the FBI reassessing their risk landscape, they can proactively on new challenges with enthusiasm, and never stop today’s dynamic work environment. By embracing emphasized the importance of translating complex identify and mitigate potential vulnerabilities before learning and evolving as a cybersecurity professional. opportunities to expand his skill set and take on technical concepts into accessible language—a skill that they escalate into significant security incidents. unfamiliar challenges, he has been able to enhance his has proven invaluable throughout his career. overall effectiveness as a cybersecurity leader. Advice for aspiring cybersecurity professionals Additionally, transitioning into these diverse roles has Drawing on this expertise, he strives to demystify deepened his understanding of interdisciplinary cybersecurity for Mom’s Meals employees, leaders, and For aspiring cybersecurity professionals, Frank’s advice collaboration and the interconnectedness of different board members, ensuring that everyone understands would be multifaceted. First, he suggests focusing on fields within the broader organizational context. the significance of cybersecurity and their role in building a strong foundation of technical skills and maintaining a secure digital environment. By bridging knowledge through formal education and hands-on These lessons have not only enriched his professional the gap between technical jargon and everyday experience. He recommends specializing in specific journey but have also equipped him with a broader 20 21 www.ciolook.com | June 2024 | www.ciolook.com | June 2024 |

Environmental Sustainability in Cybersecurity CSOs Driving Green Initiatives n recent years, the intersection of cybersecurity and environmental sustainability has gained significant attention. I Chief Security Officers (CSOs) are increasingly recognizing the impact of cybersecurity practices on the environment and are actively driving green initiatives within their organizations. Further, we explore how CSOs are embracing environmental sustainability in cybersecurity, the challenges they face, and the innovative solutions being implemented. The Environmental Impact of Cybersecurity Practices Cybersecurity operations traditionally consume substantial resources, including energy and materials for data centers, cooling systems, and equipment. The proliferation of cloud computing and the rise of digital transformation have exacerbated this environmental footprint. According to a study by the International Institute for Sustainable Development, global data centers alone consumed about 200 terawatt-hours (TWh) of electricity in 2018, with projections to reach 400 TWh by 2025 if current trends continue. The carbon footprint of cybersecurity operations extends beyond energy consumption. Electronic waste (e-waste) generated from obsolete hardware and devices poses environmental hazards due to improper disposal practices. Additionally, the manufacturing and disposal of cybersecurity hardware contribute to greenhouse gas emissions and resource depletion. CSOs Leading the Charge for Green Cybersecurity Chief Security Officers are uniquely positioned to champion environmental sustainability initiatives within their organizations. They oversee cybersecurity strategies, policies, and investments, making them key decision-makers in reducing the environmental impact of cybersecurity operations. CSOs are increasingly adopting a holistic approach that integrates environmental considerations into cybersecurity practices. 22 23 www.ciolook.com | June 2024 | www.ciolook.com | June 2024 |

1. Energy Efficiency in Data Centers Cost Considerations: Investments in energy-efficient technologies and renewable energy sources may Data centers are the backbone of digital infrastructure, require upfront capital expenditure, posing financial housing servers and networking equipment that challenges for organizations, especially smaller ones. require continuous operation and cooling. CSOs are implementing energy-efficient practices, such as Complexity of Cloud Services: Integrating green optimizing server utilization, virtualizing infrastructure, practices into cloud computing requires collaboration and utilizing energy-efficient hardware. Data center with service providers and adherence to complex operators are also exploring renewable energy sources, regulatory and contractual agreements. such as solar and wind power, to power their operations and reduce reliance on fossil fuels. Legacy Systems: Organizations with legacy IT infrastructure may struggle to adopt energy-efficient 2. Green Cloud Computing technologies and may face higher energy consumption and maintenance costs. Cloud computing offers scalability and flexibility, but it also demands significant energy resources. CSOs are Lack of Awareness and Expertise: Many organizations collaborating with cloud service providers to adopt lack awareness of the environmental impact of green cloud solutions that prioritize energy efficiency cybersecurity practices and may require education and and renewable energy sourcing. Cloud providers are training to adopt green initiatives effectively. investing in data centers powered by renewable energy and improving the efficiency of their infrastructure to Innovative Solutions and Best Practices minimize environmental impact. CSOs are leveraging innovative solutions and best practices to overcome these challenges and drive 3. Lifecycle Management and E-Waste Reduction environmental sustainability in cybersecurity: Effective lifecycle management of cybersecurity hardware and devices is essential for reducing e-waste Virtualization and Consolidation: By virtualizing and minimizing environmental impact. CSOs are servers and consolidating infrastructure, organizations advocating for responsible disposal practices, including can reduce hardware footprint and energy refurbishment, recycling, and donation of obsolete consumption in data centers. equipment. They are also exploring sustainable procurement practices that prioritize vendors Renewable Energy Adoption: Investing in onsite committed to environmental stewardship and product renewable energy sources, such as solar panels and longevity. wind turbines, enables organizations to generate clean energy and reduce reliance on grid electricity. 4. Carbon Footprint Reduction Strategies Measuring and reducing the carbon footprint of Conclusion cybersecurity operations is a priority for CSOs committed to environmental sustainability. Carbon Chief Security Officers are pivotal in integrating footprint assessments help identify areas of high environmental sustainability into cybersecurity energy consumption and inefficiency. CSOs are strategies and operations. By adopting energy-efficient implementing carbon offsetting programs and investing practices, reducing e-waste, and investing in renewable in carbon-neutral technologies to mitigate energy sources, CSOs can mitigate the environmental environmental impact. impact of cybersecurity operations while enhancing organizational resilience and sustainability. As Challenges in Implementing Green Initiatives organizations navigate the complexities of digital transformation and cybersecurity threats, embracing Despite the growing momentum towards green green initiatives ensures a secure and sustainable cybersecurity practices, CSOs face several challenges future for all. in implementing environmental sustainability initiatives: 24 www.ciolook.com | June 2024 |

Meet Your Digital Defender Yehia Elghaly I have had the honor of Creating A Cybersecured Global presenting at esteemed gatherings such as the Future for Everyone “ Middle East Info Security Summit, QuBit, e create our present in the past and the believe that much of my expertise has been honed through future in the present. Small, young, or hands-on experience,” he emphasizes. DefCamp, and Blackhat, W adults, how we cope with challenging Yehia Elghaly situations shapes our course. Yehia Elghaly’s foray into By engaging in various projects, developing and Senior Cybersecurity sharing my insights cybersecurity commenced during his high school years. publishing open-source offensive security tools, and Consultant and contributing to the This journey was catalyzed in the late 1990s when his conducting research in exploitation development, red Red Team father presented him with his first computer, a machine teaming, and social engineering, Yehia has been able to global discourse on powered by a Pentium 4 processor. At that time, dial-up apply theoretical knowledge in practical scenarios, connections predominantly facilitated internet access, further enhancing his skills. cybersecurity.” characterized by their notably slow speeds. The Turning Point Yehia says that the pivotal moment that truly ignited his interest in cybersecurity occurred when his computer His professional trajectory began as a Senior Security was infected by a virus. “This malicious software targeted Researcher, where he honed his skills in offensive security and corrupted files with the .exe extension, effectively on a freelance basis. “This role served as a foundational rendering all my downloaded software unusable. Despite step in my career, enabling me to delve into the complexities the initial frustration and loss, this experience awakened of cyber threats and defense mechanisms,” says Yehia. my deep-seated curiosity. I became fascinated by the power of seemingly insignificant pieces of code to cause The next phase of his career took him to Dubai, a such extensive damage,” adds Yehia. dynamic hub for cybersecurity innovation. Here, he had the privilege of working with some of the region's top On A Journey to Quench Curiosity cybersecurity and Corporate firms in both consultant and managerial roles. These experiences broadened Motivated by this curiosity, he embarked on a journey Yehia’s technical expertise and provided him with a to understand the intricacies of computer programming global perspective on cybersecurity challenges and and cybersecurity. Yehia reflects, “I began by teaching solutions. myself programming languages that served as my entry point into cybersecurity. My quest for knowledge extended Over the past more than 11 years, Yehia has beyond traditional education; I delved into the depths of successfully led and executed over 200 projects across hacking forums and online communities.” These platforms a wide range of sectors, including government, banking, provided practical knowledge that significantly shaped telecommunications, aviation, oil and gas, education, his understanding of cybersecurity. construction, energy, healthcare, marine, ports and terminals, and critical national infrastructure systems. Recognizing the importance of formal education in this His project portfolio spans diverse geographical field, Yehia pursued professional certifications in regions, including Asia, Europe, Africa, the Gulf, and cybersecurity and a master's degree in information Latin America, enabling him to develop a security and digital forensics. These programs helped comprehensive understanding of global cybersecurity solidify his foundational knowledge and provided a landscapes. structured framework for his learning. “However, I firmly 26 27 www.ciolook.com | June 2024 | www.ciolook.com | June 2024 |

The Learning Constant many restrictions regarding the scope of work or Also, keep in mind that it’s impossible to secure executing the projects from their environment. “It has everything perfectly. Prioritizing risks and focusing Yehia says, “My commitment to continuous learning and many system retractions that make my red team resources on the most critical assets is more effective. research in cybersecurity has also established me as a assessment execution a bit difficult,” he says. Cybersecurity challenges are diverse and multifaceted, keynote speaker at numerous international conferences. I often requiring creative and unconventional thinking to have had the honor of presenting at esteemed gatherings Treading Together resolve. A team with diverse backgrounds, experiences, such as the Middle East Info Security Summit, QuBit, and perspectives can lead to more innovative solutions DefCamp, and Blackhat, sharing my insights and Yet, Yehia approaches leading and collaborating with and a stronger security posture. contributing to the global discourse on cybersecurity.” his team to ensure the successful execution of Red Team operations. He says that during his career, when Spreading the Cyber Wisdom Furthermore, his journey has been marked by a strong he led projects, he collaborated with his team members belief in the power of education and knowledge by clearly defining the goals and objectives of the red In his advice to those aspiring to pursue a career in sharing. This conviction led him to author a book on team operations and client security objectives, ensuring cybersecurity, Yehia suggests: ‘Build a strong learning penetration testing using Python 3x every team member understood the purpose and foundation and start with a solid understanding of programming and write many articles for top expected outcomes of the operation. “I set the goals for computer science and information technology cybersecurity magazines worldwide. every team member based on their different skills.” During fundamentals. Familiarize yourself with operating the project execution, regular meetings are set up to systems, networks, databases, and programming Currently, as a Senior Consultant of the Red Team, discuss progress challenges, brainstorm solutions and languages. This foundation is crucial for understanding Yehia has a variety of responsibilities that mainly encourage an open dialogue where team members can the complexities of cybersecurity. Keep in mind that involves a proactive, layered security approach include leading projects for clients that focus on share insights and concerns. He involves the team in automated tools are not a silver bullet; having the combined with continuous monitoring and designing and executing realistic cyber-attack planning operations, which can uncover unique insights technical depth of understanding will keep you ahead improvement. This includes simulations that mimic tactics, techniques, and and innovative attack strategies. Conducts thorough and creative in the execution of projects. Always stay procedures (TTPs) used by actual adversaries. debrief sessions after each operation to review what informed and curious to learn new threats and Ÿ Regularly updating and patching systems, Managing and executing projects by conducting technologies; don’t put yourself in one area. was learned, including successes, failures, and Ÿ Employing advanced threat detection and response thorough assessments to identify vulnerabilities in an unexpected outcomes. Certificates are a really good source to gain information technologies and organization's networks, systems, and applications, as but not enough to get hands-on practical experience. Ÿ Conducting regular security assessments and well as keeping up-to-date with the latest cybersecurity Exploring Inspirations And finally, joining the cyber security community, penetration testing to identify and mitigate trends, threats, and vulnerabilities. “My main networking is the key to sharing information and vulnerabilities. responsibility is developing red team tools and Yehia says leadership plays a crucial role in driving learning from others.’ methodologies that can enhance our execution level, and innovation and success within the cybersecurity Additionally, it's crucial to tailor security strategies to finally train and mentor the junior level employees of my industry by setting a vision, fostering a culture of An Ever-Evolving Cybersecurity Leadership each client's unique needs and risk profiles, ensuring team,” shares Yehia. continuous learning and improvement, encouraging that protective measures are robust and cost-effective. risk-taking and experimentation, and providing In his plans to continue advancing his career, Yehia says Educating clients about potential risks and the Leading the Curve resources and support for innovative initiatives. his long-term goals and aspirations are to teach kids importance of cybersecurity hygiene plays a significant Effective leaders inspire their teams to explore new about security and how they can stay safe while being role in reinforcing their overall security posture. Finally, Staying ahead of the threat landscape, as the ideas, adopt cutting-edge technologies, and develop online, which will reduce the number of kids being staying informed about emerging threats and trends in cybersecurity threat landscape is constantly evolving, creative solutions to complex security challenges. They harassed, bullied, and hacked globally and its output the cybersecurity landscape allows for the anticipation with new vulnerabilities, attack vectors, and adversarial also prioritize collaboration and knowledge sharing will be next generation of kids are aware of cyber of new risks and the swift adaptation of defense tactics emerging regularly, requires continuous learning within their organizations and with the broader security threats and how they stay safe while online. “I strategies, says Yehia. and adaptation, which can be both time-consuming and cybersecurity community to stay ahead of evolving plan to continue advancing my career by learning new challenging. Also, the complexity of modern IT threats. By empowering their teams and investing in technologies and keeping informed about new cyber The Learning Curve environments is increasingly complex, with a mix of their development, he adds that leaders in threats.” legacy systems, cloud services, mobile devices, and IoT cybersecurity pave the way for advancements that not Sharing lessons, he’s learned from past experiences or devices. Understanding the intricacies of these diverse only enhance their organization's security posture but He concludes that students should participate in mistakes that have helped him grow as a cybersecurity environments and finding ways to simulate attacks also contribute to the industry's overall resilience and cutting-edge cybersecurity research, either within an professional, Yehia says, “In my past experience, I have across them effectively can be difficult. One of the capability to counteract cyber threats. academic setting or through private sector R&D. learned in a hard way that being very talented in other challenges is keeping the client system safe while Finally, they should learn how to develop and technicality does not make you a good leader, or being a executing red team operations, especially when the Fostering a Proactive Threat Response Attitude implement cybersecurity strategies that align with leader in cyber security requires a management way of client system is a critical infrastructure with legacy business goals. thinking and how to present deep technical threats in a systems and can be affected easily. Also, sometimes Also, maintaining a balance between staying ahead of simple way to the top management.” clients must execute red team assessment through cyber threats and ensuring effective risk management 28 29 www.ciolook.com | June 2024 | www.ciolook.com | June 2024 |

What You Really Need to Know Cybersecurity Myths Debunked n an increasingly digital world where cybersecurity threats loom large, separating fact from fiction is I crucial. Misconceptions about cybersecurity can lead individuals and organizations alike to adopt ineffective or even harmful practices. To navigate this complex landscape effectively, it's essential to debunk common myths and understand the realities of cybersecurity measures. Here's a comprehensive exploration of some prevalent cybersecurity myths and the truths behind them: Myth 1: I'm Not a Target, so I Don't Need to Worry About Cybersecurity One of the most dangerous myths is the belief that cybercriminals only target large corporations or high- profile individuals. The reality is that cybercriminals cast a wide net, targeting anyone with vulnerabilities they can exploit. Small businesses, individuals, and even non-profit organizations are all at risk. Cyberattacks often target vulnerabilities in software, weak passwords, or even human error through social engineering tactics like phishing. Myth 2: Antivirus Software Provides Complete Protection While antivirus software is essential and can detect and block known malware and viruses, it's not a silver bullet for all cybersecurity threats. Modern cyber threats are diverse and constantly evolving. Antivirus software alone may not detect sophisticated malware or protect against phishing attacks, ransomware, or zero-day exploits. A comprehensive cybersecurity strategy includes regular software updates, strong password policies, and user education about recognizing and avoiding potential threats. 30 31 www.ciolook.com | June 2024 | www.ciolook.com | June 2024 |

Myth 3: Strong Passwords Are Enough to Protect My spread of malware or participating in denial-of-service Accounts attacks. Every internet-connected device represents a potential entry point for cyber threats. Using strong, unique passwords for each account is crucial, but it's only one aspect of account security. Myth 7: My Mac is Secure, I Don't Need Antivirus Many people still use weak passwords or reuse the Software same password across multiple accounts, making them vulnerable to credential-stuffing attacks. Multi-factor While Macs historically have had fewer viruses and authentication (MFA) adds an extra layer of security by malware targeting them compared to Windows PCs, requiring users to provide two or more verification they are not immune to cyber threats. As Macs gain factors to access an account, significantly reducing the popularity, they have become increasingly targeted by risk of unauthorized access even if passwords are cybercriminals. Apple regularly releases security compromised. updates to address vulnerabilities, but users should still install reputable antivirus software and practice safe Myth 4: Cybersecurity is Strictly an IT Problem browsing habits to protect their devices from evolving threats. Cybersecurity is everyone's responsibility within an organization, not just the IT department. Employees Myth 8: I Can Spot Phishing Emails Easily play a critical role in preventing cyber threats through awareness and adherence to security policies. Human Phishing attacks have become more sophisticated, error, such as clicking on phishing links or downloading making them harder to identify. Cybercriminals use malicious attachments, remains one of the most tactics such as creating emails that appear to come significant cybersecurity risks. Organizations must from trusted sources or mimicking legitimate websites invest in cybersecurity training and promote a culture to steal login credentials or distribute malware. Even of security awareness from top management down to tech-savvy individuals can fall victim to carefully all employees. crafted phishing emails. Organizations should conduct regular phishing simulations and provide training to Myth 5: My Data is Safe in the Cloud; I Don't Need to help employees recognize phishing attempts and report Worry About Security suspicious emails promptly. Cloud service providers invest heavily in security Conclusion measures, but the responsibility for securing data in the cloud is shared between the provider and the user. Debunking cybersecurity myths is essential for Users must configure security settings correctly, individuals and organizations to adopt effective manage access controls, and encrypt sensitive data security measures against evolving cyber threats. stored in the cloud. Data breaches can occur due to Recognizing the realities of cybersecurity empowers misconfigurations or human errors rather than flaws in users to take proactive steps to protect their data, the cloud infrastructure itself. Organizations should devices, and networks. By combining awareness, implement a robust cloud security strategy and education, and practical security practices, everyone regularly review their cloud configurations to mitigate can contribute to creating a safer digital environment. risks. Stay informed, stay vigilant, and prioritize cybersecurity in your personal and professional Myth 6: I Have Nothing of Value to Hack endeavors to mitigate risks and safeguard against potential threats. Even if you believe you have nothing worth stealing, cybercriminals may still target you for other reasons. Personal information such as email addresses, social security numbers, or even photos can be valuable to cybercriminals for identity theft, fraud, or extortion purposes. Additionally, compromised devices can be used as bots in larger attacks, contributing to the 32 www.ciolook.com | June 2024 |

www.ciolook.com

Most Ingenious Leaders in Cybersecurity to Watch, 2024

Most Ingenious Leaders in Cybersecurity to Watch, 2024

Presentation Transcript

The Most Inspirational Business Leaders to Watch, 2019

The 10 Most Trailblazing Business Leaders To Watch in 2020

The 10 Most Futuristic Business Leaders To Watch in 2022

The 10 Most Pioneering Leaders To Watch In February2023

The 10 Most Iconic Leaders in Procurement to Watch, 2023

Ingenious Patent Watch Services

World’s Most Inspiring Leaders to Watch in 2023

Most Inspiring HR Leaders in Middle East to Watch, 2024

The Most Influential Women Leaders to Watch in 2023

The 10 Most Influential CFOs to Watch in 2024

The Most Influential Leaders In Tech To Follow,2024

The Most Impactful Women in Cybersecurity For 2024

Top 10 Trends in Cybersecurity for 2024 to Watch

The Most Iconic Woman Leader to Watch in 2024

The Most Influential Women Leaders in Hospitality, 2024