Podcast Transcript

Welcome to Cyber at the Top, a podcast from RSAC that unpacks real experiences, lessons learned, and practical strategies from CISOs at some of the world's leading organizations.

Cyber resilience has become one of the most critical priorities for security leaders, shaping how organizations prepare for and recover from disruption.

But what exactly does resilience mean, and how can you put it into practice? Today, I'm delighted to be joined by Emma Smith, CISO at Vodafone, who has led a major security transformation, strengthened resilience across global operations, and navigated moments of intense pressure in the telecom industry.

We'll explore what cyber resilience looks like in practice and how to build it. And also, how do you create an organization that can withstand disruption and recover with confidence?

So let's get started. Emma, thanks so much for being here. Great to have you.

Hugh, thank you so much for having me. I'm delighted to be here.

Emma, was wondering, can you just start off by giving us a quick overview of your role?

So as you mentioned, I'm, the group's CISO of Vodafone. I thought I'd maybe talk a bit about Vodafone first. So we're a European and African telecommunications company, and we believe heavily in being able to connect our customers all over the world to help them live and enable their lives. Just to give a sense of scale, we operate in 15 different countries across Africa and Europe, and we've got investments in about 40 more, so a large global footprint. About three sixty million customers using our mobile network and our fixed networks. We've got undersea cables, satellite and a very large fintech business in Africa. So a super exciting and challenging footprint to protect.

And and one of the reasons I love working at Vodafone is we are really focused on a sort of broader company purpose about using technology to enable people's lives, businesses, build sustainable societies. And, really, we think that trust and inclusivity underpins that, which is a great platform to then go and build, security across an organisation. I've been here for ten years. Before that, I was the chief security officer in a UK bank, and I was there for thirteen years.

So, cyber through and through. My role is a bit broader at Vodafone, so I also have, IT architecture, which means I own part of the solution to some of the security challenges. I've also got a data analytics team, and I look after kind of the pan technology strategy and governance. So everything that pans IT and network, risk management, and strategy.

Wow. Amazing. And that's a huge estate. I mean, so much of the world relies on Vodafone for critical communications and infrastructure, and you've led a significant security transformation there. How has that shaped your personal definition of cyber resilience, especially because you're spread over so many geographies?

I'll talk about personal resilience first because I think working in cybersecurity, you've got to have a certain high threshold and and high resilience and sort of build build that up. And I think it's it's...

My roles have kind of shaped shaped me, I think. And I started my CISO journey the month before the financial crisis hit the bank that I worked for, and we had a number of really public facing incidents. So I was kind of thrown really into the deep end. That that tested me.

I grew so much when I was in that period of stretch and change and then trying to lead a team through a period of uncertainty as well as respond to some cyber attacks. So I think I learned about the importance of people, collaboration, understanding each other, valuing differences, and having a having a really clear mission. And I think that that's important in in what we do because it keeps you focused even on a bad bad day, a tough day. And then the definition of cyber resilience.

We've been talking a lot about this in Vodafone. We've built a really strong strong solid security baseline, but but we think resilience is the destination or the journey that we're on. I like NIST's definition that talks about anticipating, withstanding, recovering from, and adapting, because we know that adverse conditions and threats will keep getting worse and keep challenging us. And so I really like that definition.

We've used that to think about how do we then deploy security and cyber controls across the organisation to make us adaptable, withstand those those impacts. So so we think about that. And then we maybe explore it a bit later, but we've also been looking at how do we measure resilience and what is the difference between security and resilience and what...

How do we take that next journey? And we're thinking about how reducing the scale of impact of attacks, so kind of reducing the blast radius and reducing the impact. We're then thinking about how do we measure improving speed of recovery over time, and that's that's an important factor in resilience.

And then minimizing the impact of attacks, particularly on customer services and customer anything that affects our customer base. And then no repeat incidents. So one of the things we're super humble here at Vodafone. We kind of assume we're never finished, never complacent about the risk that we face, always learning and improving. And I think one of the key parts of resilience is that ability to learn and adjust and adapt.

Oh my gosh. I just think about the word resilience in the context of such a giant telecommunications company.

In this industry, where where services are critical and everything's twenty four seven, what's at stake if an organization isn't resilient?

Yeah. I mean, telecom is a critical national infrastructure, I think, in most countries now. And I think that's because we're we're providing good connectivity to consumers and businesses and governments. And if you think about some of the services that you...

We all depend upon that that communications companies operate. So for example, being able to phone emergency services when you need them most, being able to contact loved ones when you need to most. And so...

And it's those moments that matter that are really important. That's why resilience is so important across the network. And we connect to all parts of society. So everything from governments through through to small businesses, large businesses, and then people like you and I interacting with our families every day.

So so we really do take that role as critical national infrastructure really seriously.

And it can have a massive societal impact. I mean, I take a sort of parallel example. We saw power outages in, Spain and Portugal, and that had a massive impact on everything from the road system, homes, businesses, livelihoods being able to take payments, and telecoms is a bit like that. So if we have a large significant issue, it can really affect multiple different sectors and economies in the countries that we operate.

So really impactful. And then we're very heavily regulated for all the right reasons. We're a heavily regulated sector, and so that can have implications when things go wrong as well. And unavailability of services is something that regulators monitor.

And then most of all I kind of think about trust. So I think any resilience impact or something that impacts customers and is significant can really undermine trust. And we know it's really hard to gain trust and then also keep it. So we think it kind of underpins the digital economy.

But you're so right. I mean, I have five kids, and I I just assume always that the telecommunications infrastructure is gonna be up and available. If they need me, they can call me. It's it's almost just an assumption and a reliance.

And I I wanted to ask you about controls in general.

Many organizations know the kinds of controls that they should have in place, but they often struggle to make them stick. Right? There's a project. You get something installed. You get it rolled out.

Why why do you think that there's such a challenge around making controls and their efficacy stick in the business?

And often, people talk about security basics, don't they? And I think it's anything but basic to get controls in a way that they are automated, sustained, know, they really stick. So it's not basic. It's really hard, I think, to get the hygiene and the good security baseline in place.

And and I guess why is that then? I think, sort of knowing what the controls are is the first step in the journey and being able to prioritise those. So knowing how controls reduce risk, I think, is is vital so that you can prioritize efforts on the things that have the biggest impact. And then making sure, that they are configured correctly to do their job.

I mean, how many times do you read about something where there was a control in place, but maybe it was misconfigured or it wasn't in line? Or...

So making sure that you're kind of tuning all of it and operating the platforms that you run as security controls.

And then it's really challenging to make sure every little corner of the organisation and the technology that we need to protect is covered with these controls. So getting coverage across all little parts of a very large organisation is super challenging. And so when we're measuring control deployment and control effectiveness, we're thinking about does the control actually mitigate the risk? So is adequate?

Then we're looking at does it...

And does it go everywhere? Have we covered everywhere? Have we missed anything? And it's always those things that you miss that kind of turn up, and you're like, did we not know that was there?

So I think get...

Getting that in place is is challenging. And then obviously, new technologies, new vulnerabilities all of the time. It's a moving landscape. And so not only do you have to deploy, you know, operate, say, vulnerability management or patching, it's a regular continuous sport that we have to play all the time.

So so I think, there's often a perception, I think, from out...

From people working outside, security disciplines that you kind of deploy a a security tool and then you're done. But actually, as we know, it's like this continuous operations of engineering of the platform and then continuous response to what you're finding and and and always sort of pushing pushing the dial. And then people. Right?

People are really important. And having a having a team of people that are curious and sort of put put happy to push the boundaries really helps when rolling out controls.

Let me ask you this. When you look back on your transformation journey, what actions that you've taken do you think have had the single biggest impact?

I wanna give you a multipart answer, I think. I'm not sure if there's one single single thing that I would pick. I talked about people just now. I think it's...

Everything we do in cybersecurity is built on people. Most of our adversaries are human, and they are humans operating even technical attacks. So I think building the right operating model for your organisation and having the right people is vital because without that and the right culture across the organisation. So when I joined Vodafone, we're quite locally empowered.

We really respect the cultures in which the countries that we operate. We give local accountability. But cyber is a little bit different. So in cybersecurity, we've decided that the right model for us is to have a vertical across the whole globe where we operate the same operating model, consolidated tooling, global visibility, global response, and and made that decision about seven years ago.

And for us, that was the right operating model. It may not be the same in in every organisation, but being really clear on that has helped us a lot. We then got a common blueprint in every country that we operate in, and that means we're quite a harmonised security team but still in touch with what's happening locally with regulators, customers, threats. So for us has worked really well.

And we've gone about making everybody sort of really in tune with the mission so that people are part of the the big picture. And then I think there's a piece about delivery and strategy. Asked me about controls a moment ago, but I think we've got to be known for being able to deliver and operate cyber control, so actually having an impact. And often, I think when you're with the board or senior stakeholders, they'll be constantly assessing the credibility of the security team and the security leaders.

And so being able to show that we know our stuff, and we do what we say we're going to do. We're really transparent about the problems, and we ask for help when we need help. I think that senior engagement and showing that we can deliver on the things we say we were going to do.

We did, in in Vodafone, we do, we set a set of technology priorities, each year to the whole company, and they're based on the strategy. We take input, and we syndicate them, and we review them together. And then each year in the summer, six months before the budget process, we issue the next year's set of priorities within three year targets. And that harmonizes the company around a consistent set of priorities.

Now I own that process as well as owning cybersecurity, which really helps in setting targets for every country, and then we track those all the way to the CEO. That's had a really, really good effect. And I also attend the budget meetings of all the large parts of the company, all the large operating companies to look at how capital is being invested and is it being allocated to the to the big priorities. And then I'd say the other thing we've worked really **** ** is transparency.

So all the way up to the board, external stakeholders, we issue a cyber fact sheet externally every year. So building credibility and trust through transparency and consistency of reporting, I think, is is important. And sort of being transparent about cyber risk, the actions that you're taking, and the things that are and are not going well. And then we've been quite hands on with our with our board.

So we have them to the cyber defense center to come and visit and sort of see see...

Meet the real teams, get the teams to take them through how they work, kind of make...

Making it real.

And then in each of our countries, we run a cyber simulation with the exec team at least once every two years, and my teams will go in remotely. We'll fly in, and we'll put them through their paces of simulation. And there's usually not a good outcome to the simulation, so it makes them kind of feel cyber risk. You know, they're immersed in a real experience and having to make difficult decisions. So that helps to bring it to life, I think, and make what can be quite intangible, tangible.

So much of what you said just sounds like building relationships, building trust. You mentioned transparency. You mentioned consistency.

It's how internal stakeholders may trust you. It's how you may trust other internal stakeholders, how external stakeholders may trust you and trust the business.

How do you build and maintain trust? You talked about transparency. You talked about consistency.

What's what's what's the what's the secret?

I mean, I think we we can imagine how hard the job would be without the trust of senior stakeholders. It's hard enough already. So I think being seen as the team that will take accountability is part of that. So I think cyber is a shared shared responsibility for sure.

It's not just the cyber team who own the risk. But also being seen to take accountability and not just admire the problem, I think starts to build, you know, reliability. And so people can see that we're taking ownership of of what the risks are and what to do about them. And then we ask for help when we need help, and we ask for money when we need money and all of those things.

And then tailoring what we're talking about to the audience because there's no point in going into an audience that's very focused on commercial targets and talking about something super technical on cyber. So kind of adjusting the way we present and talk about cyber. And then also framing ourselves as a business enabler. I think we all want to enable growth and customer service for our company.

Doing that in practice is really challenging and not being the bottleneck for growth and new tech and and delivery. So that...

I think that's a topic that challenges us all the time. But when you show that you're taking it seriously and you're aligned to the business goals, it goes a long way to sort of forming that bridge between helping with each other with each other's objectives. And then I'd say being really prepared for discussions. I remember listening to a CEO talking a while ago, a presentation I went to about him going into the board and how he used to be quite defensive and not like the hard questions from from the board.

And he said the very day that he decided to go and embrace those questions and enjoy those questions and want difficult conversation, it led to a completely different level of trust with his board. And it made me think, know, am I sometimes too defensive when I'm going into the board? And actually, if I embrace the questions and really lean into the discussion, it creates a completely different two way relationship. And I'm actually hearing different perspectives that do make you think differently.

So that was I thought was a great piece of advice from that CEO about those difficult conversations are there for a reason. I embrace them. Lean into them.

That that is such a great idea and a tip. You know, most people go into this mode, like you said, of being defensive and, look, I told you we were gonna do this. We did this, and here's what that means.

But it is those questions that help shape you, help shape your organization, but help the person on the other side say, yeah. This is a partner of mine. I I I love that.

And and you've talked so much about the team, like the importance of the team, trust of the team, reliance on a team, especially with an organization of this size.

What capabilities or qualities do you believe are most important for a resilient security team?

When we created the single operating model about seven years ago, I also worked with an external partner to put together a cyber leadership academy because it's really obvious to me that this library is a lot about leadership and a lot about tech, and you've got to have both. And so we did a leadership academy together, and that involved everything from doing sort of psychometric assessments, talking about the different skills that we needed, building development plans, and we've carried that on. So we we kind of learned together as a as a set of leaders across my organization. We have actually about 80 people now that are part of that leadership academy.

And the idea was was that, you know, in each country, my cyber teams have got to be able to engage from the top to the bottom of the company and and sort of drive change and have an impact. So it it was predominantly about that and about, know, people developing their own, personal leadership style, but one that did have an impact. So I think that's one thing. I think, I'd also say, it comes down to sort of the tenacity and restlessness.

I talk a lot about being restless and being tenacious. But I think that that sort of we're never finished. Always just wanting a bit more and pushing pushing harder to to to keep raising the bar on on how we do things. And then humility.

Learning, admitting mistakes, saying sorry, asking for help, being adaptable. They are very important, and we'll never get all the calls right. Sometimes we've got to make difficult decisions in the heat of the moment, and they won't always go right. So...

But knowing that and being willing to sort of hear it. And then one of the values that we...

My team all resonate with is integrity. Typically, you find that security teams have got really high integrity. As long as that's balanced with some pragmatism, but doing the right thing even when no one's not...

No one's looking.

I'm just thinking about the massive scale and structure of the estate that you're protecting.

How do you structure and govern cybersecurity to support resilience without slowing down the business? You mentioned this earlier, right? There's a perception that security's coming in. We may stall things. We may stop things. How do you do that? How do you alleviate that perception and make folks partners in it and wanting to do it?

I'm not convinced to you that I've managed to succeed in that yet.

I think, we try try and really, really try a very honest response to the tough question.

Yeah.

Yeah. Exactly. And so we try really hard. I mean, with a number of AI use cases that we're all trying to work through and get a good responsible AI outcome, it's challenging.

It's challenging to sort of scale up, I think, especially on on demand for things like AI or really get scale across the kind of DevOps pipelines that we have. So so we've done a few things. We try and build patterns whenever we can so that we can reuse patterns and actually put those in the hands of the developers and engineers so that we're kind of empowering them to do security and rather than having to come to us. I still think we've got a happy problem where we have huge demand for security by design resource in Vodafone, which is a good happy problem.

It means that people are coming to us to review what they're working on. But scaling to that's been super difficult, especially in different legislative environments as well and making sure that across Europe and Africa, we're doing the right things by all the different legislation. We've done a lot of work to try and, prioritize, different use cases or projects based on the business impact. Is it customer facing?

Does it have customer data?

What would happen if? So that helps you to... It helps us to get the balance of where we put the effort. And then we're just looking at how we automate some of the workflows that we have, particularly in our security by design pipeline and AI. So I look after the responsible AI team as well. How do we try and automate that so that as much as possible of the workflow can be in the hands of the developers and the process is less manual? So that's the journey we're on.

Do I think we're there yet? For sure not. No. There's there's more to do. But I think showing a real open respect for the other people's objectives so we're not really siloed and only thinking about security. I know that the company objectives are my objectives, and I need to work really hard to try and help others be successful.

I wanna ask you about one of the things I think has plagued cybersecurity in general for a really long time, which is metrics.

Like, in in cyber, we've never really had fantastic metrics, really hard to kinda communicate in the right way around measuring cyber and how much risk have we covered and communicating that to all kinds of different levels in the business. But now you're also talking about resilience and measuring that. How is measuring resilience similar or different from the challenge of measuring cyber?

I mean, at the moment, we're taking a maybe too similar approach. We tend to, as I talked about earlier, we think about we're quite control centric when we're thinking about measurements. So we're typically we do something called key risk indicators.

And so these are typically we're measuring how well rolled out and how effective a control is at mitigating risk. We do have some level of risk quantification that we do as well, but I'd say we focus more on measuring those controls. I was reading a really good World Economic Forum article on this topic. Actually, I'd highly recommend, a read of it, and it talks about kind of moving beyond static assessment into more security focused benchmarking, more adaptive measures.

It had a few different dimensions to it. I can't remember them all, but it was things like trying to measure everything from the leadership, people and culture, responsiveness, crisis management. So finding different measures to maybe the more traditional control measures. And we're we're really focusing on four things at first, that scale of impact that I talked about.

So is there a way I can demonstrate that through our actions over time, we're reducing the impact of events, attacks, threats. And so particularly, as you know, are we able to protect certain high risk parts of the organization from attack by doing things differently, adjusting the controls, segmentation, that kind of thing. So so we're looking at how do we reduce the scale of impact and whether different actions would have led to a different impact had we taken them earlier or differently. Speed of recovery, so not just time to respond, but really looking at the speed of recovery and going beyond time to respond.

I think time to respond can drive the wrong behaviours. It can sort of stop that curiosity in the following of the thread. So so time to really recover and learn learn from incidents. And then take... Going deep on on PIR, so post incident reviews.

I think that really putting time and prioritizing doing PIR so that we're learning. And then we're gonna try and measure any repeat incidents. So did we have the same thing happen in more than one place, and why didn't we learn or adapt our controls? And we think that's a good a good measure.

And then looking at... Don't measure things that got blocked because we think that's a really difficult to accurately measure and a bit bit delusional type of measure. But we do... We are trying to look at events that didn't have an impact. So where the controls did their job, we might have still seen something that got, you know, a certain way through the life cycle, but actually we managed to not have a business impact or a customer impact or a data impact. So I think having a look at whether the controls are effective or not and being able to demonstrate that is one way.

And and, you know, I've seen several occasions now that resilience projects have started in a company, but... And there's a lot of energy, and there's a lot of fervor at the beginning, and we're gonna look at what we have in place now, and we're gonna have redundancy, and we're gonna test it and test on a regular basis.

But then sometimes those projects just sort of fizzle. It's like, okay. Well, we're we're we're done with it now or, you know, we've gotten to the end of it. How do you ensure that resilience stays a priority over the long term beyond the initial transformation push?

I think that's a really good question because a lot of the enablers to resilience are invisible, aren't they? Like, you know, having a really good asset inventory and knowing where the critical services are or, you know, doing...

They're all invisible if they're working. And so it is quite hard to keep people focused. I I think your your question about metrics is part of the key. We're a really data driven organization, and we love looking at dashboards and data.

So having that that data that's regularly refreshed and and then for the right audience tailored. So that...

That's one way. And we have this...

We have the same measures in every country. Competitive, and so we sometimes have league tables that show how different countries are performing against each other, and that sometimes helps to drive momentum. And then we tend to tell stories of things that have happened inside the organisation or that we're learning from others. And we haven't touched a huge amount on kind of collaboration outside of the organisation, but I think it'd be really important from a resilience perspective.

And then using things like simulations, doing sort of...

Whether in to capture the flag with teams or whether it's at a board level doing simulations. That's important. And then we go through things like decision matrices to make sure we're really clear on who's got accountability for different decisions. And that just people...

It focuses people's minds a bit more. And then process. We try and try and put put Cyber into all of the normal business processes. So whether it's the annual report process and signing off the accounts, we got section there, and then that leads to our cyber fact sheet or the budget process.

Really trying to make sure it's just a core part of everything that we're doing in in the normal governance of the company.

So I'm gonna put you on the spot and ask you one last question, which is if you had one piece of advice to give another CISO who wants to try and strengthen cyber resilience in their organization, what would it be? What what would be... You're you're in the elevator with them. They ask you the question. What would what would you tell them?

I think it has to be about making an impact. So don't admire the problem for too long.

See, we're really good at admiring the problem insecurity. I think understand the problem and start to take some action. Try things.

And if it doesn't work, adapt and change. But I think have have an impact and be clear on risk risk impact. And then I probably have to have... I have to give you two because it's a long elevator Yeah. Yeah. Yeah.

Yeah. It's a long... Imagine a very long elevator ride. Yeah.

And then I do think personal resilience. I talked I talked very briefly before about collaboration. So have a network of friends and contacts inside and outside the organisation in your team is not an easy job. And so actually that humility and leaning on others and knowing when you're having a bad day, ask for help, the personal side of the job, think don't don't don't deprioritize that. It's really important to look after ourselves as well as our teams.

Emma, thank you so much for being here. This has been great because you...

You've added so much human dimension to this problem too. It's it's terrific. And and listeners, thank you so much for tuning in. Please keep the conversation going on our RSAC membership platform platform by visiting 1rsac.com/membership.

And be sure to check 1rsac.com for new content posted year round. Emma, thanks again. This is great.

So great to see you.