Blog

Dr. Margaret Layton (Meg) has been working in the IT industry for over two decades. In 2001, she joined a start-up company that was acquired by Symantec, and she has since been working in various roles within the company, both on products and working on the intelligence that fuels the front-line responders. She is Director of Engineering for the Cyber Security Services business unit, working with a talented team of software engineers and security professionals building tools for our defenders in cyberspace. Meg has a Doctorate of Information Assurance from the University of Fairfax. She also holds a Master of Science degree in Telecommunications and Computing Management from Polytechnic University in New York, which is now a part of NYU; and a Bachelor’s of Art in Political Science from Albertus Magnus College.  Meg maintains several certifications in the Cyber Security realm that she is passionate about, including both the CISSP and CSSLP certifications from ISC(2), and GIAC certifications for Incident Handling, Forensic Analysis, and Penetration Testing. She is CNSS 4011 and 4012 certified. In her role as Director of Engineering, she also holds Agile certifications. She lives in Virginia with her husband and children, and volunteers as a Technical Mentor for local CyberPatriot organizations, as well as serving as Adjunct Professor for colleges, teaching courses in Information Security, including Computer Forensics and Risk Assessment.

If you had to choose one event that led you to work in information security, what would it be and why?

Meg Layton: There’s probably a couple of different things that led down the path.  When I tell of my start, I often discuss the influence of working in telecom during the dotcom era and working in Africa while learning security.  Security in a developing country is much different than what happens in the U.S.
However, if I had to consider the defining “Here I am and I should stay here” would be the Nimda virus outbreak in 2001. It was what I like to call “the other date in September” that year. I was working in a government facility which was still on severe lockdown. My job was to monitor early versions of SIEM alerting and contact the contractor if I saw anything unusual. There were a lot of delays getting through security in the morning because I forgot that I had my husband’s fishing rods in the van, and metal tubes are suspicious to facilities on lockdown.
I got to my desk, put down my things, checked my screens (it looked fine) and went to get coffee. By the time I returned to the desk, my screen was scrolling through alerts in a ridiculous manner. Because it was a locked down facility, I could only make phone calls.

I called my office. They called a couple of people, and that’s where I found out how collaborative the community really was. By the time the external monitoring service called the facility to “warn of suspicious activity,” we had already removed most of the servers, had an executive briefing, and written rules that would group together and let us know if other infections existed.
A lot of the work that goes on in infosec seems like it is not recognized. But that day, I found the power of smart people working together and making a difference. And plus, I was good at it.

Why do you like working in the information security environment?

Meg Layton: Every day you are solving problems. It isn’t always obvious how, but every day you solve a problem. And in infosec, those problems are often what I tell my kids are “People problems.” Infosec exists because of human traits: desire, doubt, trust, integrity. Human beings are unpredictable and fallible, and all of that is why infosec exists. So there is not always a right answer to a problem, there is just a more secure one or a different way of approaching it. That makes it interesting, every day.

If a n00b to the infosec world asked you for a piece of advice, what would it be?

Meg Layton: Infosec is a wide river, and to get across you need to pick a wave to ride and always learn. The best and most talented people I know in infosec know there is always more to learn. Remember you have to keep learning, since the technology changes so fast you won’t ever get to the “end” and “know everything.” Make mistakes, learn from them, and move on. I guess that was more than a single piece of advice.

What is the most important issue facing professionals in the information security landscape today? Why?

Meg Layton: That’s a hard one because I think there’s a lot. But I think the biggest issue is likely the inability for many professionals to connect their issues with the business needs. The ability to do that will influence investments, regulations, laws, and the future of technology.
I often think of that line from Jurassic Park, “you were so preoccupied with whether you could, you didn’t stop to think if you should.” As we push for agile and faster and more connected, this springs to mind often. How do you articulate how to make things safer in a way that matters not only today, but will matter tomorrow? The infosec professionals better figure it out, and fast.

What is the most important issue facing consumers in the information security landscape today? Why?

Meg Layton: Also hard. Because there is so much facing consumers and so many of them don’t even know it. Probably the biggest issue is understanding the difference between privacy and security combined with  the transparency that organizations provide surrounding these topics. Many consumers are simply unaware, or consider things hard. The stigma needs to change so that the security is accessible and easy to the user so they can have the power to protect themselves.

What are your three “guilty pleasures” that have nothing to do with information security?

Meg Layton: Buffy the Vampire Slayer, because obviously. Musical theater, or really any theater. I often tell folks that my first computer was actually a lighting board, so really theater is why I got into tech. It is not beyond the possibility that I will randomly break into song if I need to. Yay Stage Crew! Third, scrapbooking. I do a lot of preserving of memories and putting pictures on the page kind of soothes me.

What’s your favorite book-to-movie adaptation and why?

Meg Layton: This is tricky. Because I like books so much more than the movies in most cases, and I always have my kids read the books first. What world you enter in your mind when you read is seldom what is created on the screen. So it is going to have to be a toss up, and both because of the sheer talent of the people who created characters: The original Willy Wonka and the Chocolate Factory with Gene Wilder, and the Princess Bride – because, that casting was just genius.

Compliance offers internal stakeholder value even though your stakeholders don’t always see it. Anyone who’s ever been a fan of Calvin and Hobbes cartoons will remember Calvin’s transmogrifier, the cardboard box that magically transforms him into whatever he wants to be. Compliance automation is the way CISOs and CIOs magically transform compliance into internal stakeholder value.
Request a demo today to see how you can transform compliance into internal stakeholder value.

How to Define Stakeholders

Defining your stakeholders is the first step to showing them the value of compliance. You have internal stakeholders as well as external stakeholders. You have high level stakeholders, and you have those who need detailed information.
Internal stakeholders are often the ones you worry about most because they make decisions about your resources. If you provide them with clear information, they will value you more.

ZenGRC offers different levels of information presentation that allow you to give your stakeholders what they need, the way they need it. Being able to decompose your reporting by demographic makes you more effective and helps transform compliance into more than a requirement. Now, you can show your internal and external partners how your value affects them.

Board of Directors

Your Board needs to know the high level vision of your compliance to prove that they have done their due diligence. For companies that need to be SOX compliant, reporting to the Board has legal ramifications as well as business concerns.
With this in mind, you need a compliance tool that offers your Board a quick view of where you’re compliant, how you manage your vendors, and how this relates to the financial bottom line. If you’re currently managing this information on spreadsheets, making this information clear to your Board is time consuming.

ZenGRC offers high level views such as risk heat maps and a system of record dashboard that gives an easy to digest visual showing the percentages of controls finalized and mapped. When your Board wants to know what you’ve been doing to protect the company, this shows them exactly what they need in a way that they’ll understand.

Executives

You know as a member of the c-suite what your cohort needs. However, you’re also the technical one in the group. Your vice presidents, chief financial officers, and chief executive officers don’t need to understand the technical side of compliance. They need you to show them how compliance fits into their corporate strategies.

Your c-suite wants to know their risk, how you’re mitigating it, and how they can turn that into a financial asset. This means they don’t want the details of your definitions of the threats, vulnerabilities, and controls. They want the overview that shows how you’re protecting the organization and how that affects their strategies.

Automated tools allow you to use clean visuals that show the needed metrics. With ZenGRC’s comprehensive dashboard, you can show your c-suite the current risk profile and your controls for those risks. For example, the status bar graph offers your c-suite a color-coded visual of the tasks assigned, in progress, and completed. This provides the metrics needed to inform long-term business decisions.

Senior Management

These are your guys “in the weeds.” They’re helping you do the work to protect your organization. They’re the ones reviewing access logs. They’re the ones creating passwords. They’re the ones training your company’s employees.

These stakeholders need to be able to share information with you and with each other. If you’re collecting their reviews in documents and spreadsheets, you’re putting your information at risk. If two departments use different controls to protect the same asset, you have a compliance problem.

Automation allows you to store information in a single location while offering your internal stakeholders a comprehensive workflow that organizes information. ZenGRC’s tool for compliance increases stakeholder value by allowing your senior managers to see each other’s information so they can streamline their reviews and documentation. More importantly, you get to set access controls. This means that you decide not only what people see but also what they can change. With automation, you can destroy information silos, give people the information needed for their own tasks, and control your program.

Contributors

These stakeholders are everyone else in the organization who need to understand your compliance stance. They can be middle managers, specialists, auditors, or analysts. For example, your sales team may need to understand your vendor management stance to help sell the organization to a client.

With ZenGRC’s platform, your compliance offers stakeholder value by giving you an easy way to share the compliance posture and milestones. If your sales team needs to know your vendor risk tolerance, they can see it. If your business analyst is trying to streamline business processes, they need to see what controls you have in place before implementing a new application, such as payment processing. This means that ZenGRC’s single source of truth can give the information your stakeholders need to do their jobs more efficiently.

Automating Compliance Offers Internal Stakeholder Value

Your internal stakeholders need to know how you’re servicing them. To do that, you have to share information in ways they understand.

ZenGRC is not only easy for your internal stakeholders to use but also provides easy-to-digest information. Request a demo today.

Photographer: Gilles Cohen

Tiphaine Romand-Latapie is leading a team of hackers at Airbus. Tiphaine’s first love is cryptography. She previously worked as a telecommunications operator Orange, where she was in charge of new product security. Tired of meetings full of misunderstandings, she decided to 1) record the most absurd quotes she heard,  and 2) design a role playing game to teach people about the basic principles of infosec that she published in 2016 at BHUSA. She likes to be the translator between the highly technical security team and the rest of the world.

If you had to choose one event that led you to work in information security, what would it be and why?

Tiphaine Romand-Latapie: I studied Mathematics applied to Computer Sciences, and during those studies, I discovered Cryptography. It was really my first glance at infosec, and I loved the technical challenges and the cat and mouse game that you find in infosec.

Why do you like working in the information security environment?

Tiphaine Romand-Latapie: There are so many reasons. First, you are in a position to help people. Second, you work with everyone, discovering so many different jobs or technology in the process. This leads to the third reason which is the “puzzle” aspect, discovering the way to answer a challenging issue. Finally, I love that you are forced to always put yourself in others’ shoes (what will the attacker do ? Why my business is asking me that? Will my user follow this recommendation? etc.)

If a n00b to the infosec world asked you for a piece of advice, what would it be?

Tiphaine Romand-Latapie: To a n00b entering the professional infosec world, I’d say: the rest of the world doesn’t care about the technicalities (even if they are beautiful and important), your job is to understand those for them. Most of practitioners come in infosec for the technical aspects and find themselves disappointed with their management/client for not caring about them. This makes them feel undervalued when it is not the point at all.

What is the most important issue facing professionals in the information security landscape today? Why?

Tiphaine Romand-Latapie: The gap between what infosec experts consider basic facts and what the rest of the world actually understands. And I am not talking about basic technical facts, but “life facts” like who are the attackers, the diversity of their profiles, what is sensitive information etc. The consequence is that we don’t speak the same language most of the time. It is frustrating for everyone. This is why I have created my role playing game, to make non security-practitioners aware of what we consider basic facts.

What is the most important issue facing consumers in the information security landscape today? Why?

Tiphaine Romand-Latapie: I’ll answer the same than for the previous question. When you don’t really understand why you need security, all infosec seems scary, or useless. The FUD communication doesn’t help at all. We need to teach people to ask themselves the rights questions: what do I want to protect? Against whom? So they feel empowered instead of crushed.

What are your three “guilty pleasures” that have nothing to do with information security?

Tiphaine Romand-Latapie: 1) Reading (I don’t feel very guilty about it) SciFi, Fantasy or Thrillers 2) Taking naps 🙂 3) Taking a day off to be all by myself to regroup (no husband no kid, just me and a book)

What’s your favorite book-to-movie adaptation and why?

Tiphaine Romand-Latapie: Outch, very hard question … the first that came to my mind (maybe because it is recent) is “Arrival”: the film is changing some elements of the story but do not betray at all the spirit of the book in my opinion. And for once, the end was not rewritten in favor of a “happy ending “ .