How has the Solar Winds breach impacted how your organization thinks about IOT security?

Your point is well taken. Salesforce got breached last year, right? And at the end of the day, you're entrusting somebody else with something for which you're responsible. So how do you sleep at night knowing that they may or may not take that trust the same way in which you're expecting it to be executed. You just can't, you never will.

With Salesforce and all these other SaaS platforms we're using, we are trusting them with our data and everything else. I've had this conversation many times, but a lot of companies I work for just say, "Hey, we have this SLA in place, we trust that they're backing up all our stuff," but in reality, is that happening? If not, do we want to also be secondarily responsible for backing up all our Salesforce data, our NetSuite data, whatever tools we're using?

When it comes to enterprise risk, we looked at our major challenges in order to establish a comprehensive cyber security strategy. Performing an effective oversight was a big issue. We want to take a holistic approach and make sure that we are mitigating global supply chain risks, that means installation of malicious software or hardware. We are addressing the cybersecurity workforce management challenges, and also ensuring that we take emerging technologies into account. For example, artificial intelligence necessitates dealing with the kind of issues that can get built into the code and the model. We've started focusing on improving and implementing those cybersecurity initiatives, working with the CISOs organization. We took a holistic approach in terms of protecting that critical infrastructure, because my team supports all of the analytics (KPIs and KRIs, risk indicators, and the key performance indicators) and the RAMs that go into that organization.We wanted to make sure that we have a federal response to all of the incidents while we are providing the capability of decision-making, in terms of protecting the cyber critical infrastructure, to our CISO’s organization. We wanted to make sure that we are protecting privacy and sensitive data, and we wanted to do that by response, not by reaction. I think that's where we started the conversation, but then we saw a lot of the community contributing to us within the financial services area. The practice of corporate risk management allows us to look at risk from a holistic perspective, not only specifically from a security perspective. A community of practice enables us to understand what the vulnerability risks are. What is needed with respect to infrastructure, strip security, data privacy, and data management. And what integrity and reactive security is needed. The increase of regulatory awareness is a proactive approach that we took. I came from healthcare to financial services. Both are heavily regulated, but the response time to incidents is different: healthcare is reactive, whereas financial services is a little bit more proactive. We wanted to make sure that we are embracing these new technologies, data, and analytics, and leveraging that regulatory data to drive each. A lot of what we did was through sensing and being influenced. We were not the leaders in that, but we followed good leadership in that respect to measure the impact of their influence.