Manuel Chowrimootoo is an IT consultant with over 12 years of experience, specializing in CISO Advisory Services. He started as an IT Auditor in the Big Four and moved on into different IT Security roles in different industries. His interest has always been at the point where people and technology meet. He is currently a Business Information Security Officer (BISO) in charge of ensuring that security is always taken into account and “baked in all projects and initiatives within the company.View the profile
About the talk
Manuel Chowrimootoo, Business Information Security Officer, Cogeco The role and importance of a business security office/practice within companies is of growing importance. This session will present a first-hand perspective to creating bridges and connections to ensure that security is on everyone's agenda and mind, from analysts to VPs.
I don't want to Welcome to the session on the rise of these are all my name is Manuel Trevino to, I'm trying to be so at critical Communications credit, always a Communications company, headquartered in Montreal Canada. And the presentation is to share with you my story on the couch and a half a bu Sabah security practice to start from scratch in the inactivity. And I want to show 36 parents at what is it one of these? Oh, what is a bezel? And the weakness of that fact. You show it to the
challenges, the success. He's at work. He don't work. So if you find yourself in this role, you would have some inflammation and also have you feedback as well? First started. So he's a legend has pre-packs. We have our butts with will do the best years to get it all the time. So fast forward to reach the world bezel. What we need to get started and do what you do to prevent cyber security as a service in the company. I work for and then we discuss about the focus on value. That is a very poor indicators for the executive that's paying the bills or
the other day and give you some key takeaway. So, first of all, let's define what is a bezel stand for business information security officer, swing my role at work with him, the information security interests of the business. Maybe that's that's up to you. So it's a very strong organization and why don't you do that presentation to ask for you? When I came to my first rc conference, the last in 2020. I just don't know which role and I was trying to meet all the pieces as well to you. She'll charge us to understand what
was happening and and get some information and force that could hardly find one search on Google and at that time then the only a very few articles if you make a single search. Now you would stop to get the Big Boy Hits. Call Monica Getz in 2020 and it'll hear from Spiegel series.com Sunrise, River. Well, one of the main function that I do every dance bees always to be a business. You never physically, I don't say no to anything that needs to bring a software on the network, but
always, yes, but that's, that's how it is. Most every day and you will see more in the next fight. How to fix a brand new role and the to hit search on Google, you can get a few Altos. I will share with you heal some of the obstacles that you can find a higher than green, the main in a month,. As you see Africa, come a lot of bridge from the central vacuole function to the business artist and the goals of the business units and what it would need to protect. And being a link between business and technology.
Just give you a bit of background essay. The year. I join a team that just started out within my company. So 15 individual started in September, 2019 for me. When you come up with cyber security team under the leadership of a Caesar. Team, four months later in January 2020 and my Monday. When I landed was best, boss. Sherry here, so I'm supposed to get the team known within the organization. Get the subscapular known. There was a pressing need to deliver cyber security services to two of your foundation.
How to connect with a different business units? Understand that is what they needed from security, what they understand, what they don't understand. And what would you do to help and organize the deliveries and provide regular support to the pieces tonight? So that was physically, the high levels of time and dates and based on that. I have to get out how we were going to do this. Took stereo heart function in the company. I am. So this is a structure in operating model. That would be the cat Weaver different now. A new organization on your Spears. And this is
what I live through. You, lieutenant sites. We have a corporate functions. So for instance, internal audits for commence, legal Enterprise, risk management, and some other items that are comfortable on the right hand side of the it teams, with which we are with you, please. And I bring the road here so you can see the difference between herpes on which kind of the first person that can pop into your mind. Why a new roll again, in a space between the corporate functions and the CIO of
the CTO at the, I see a leadership. And in my role as a bezel, I do a similar report at the most tactical and operational level, so, I will be there also. Corporate functions between the architecture and operations within the business units. We have different business units Freeman in different locations to give a very concrete example, let's say, for instance, is Russia still with seats on the audit committee and interact with Avicii internal Audits and saying the high risk of the company's risk and having
all the height of information of this points and be the strategy, of course on how we can help to two. She's so try that goes with literally and business strategy plan with the EPO ch.com skill level. So I will deal with your father and your aunt has directly understanding. What kind of fun is they have? What are the two critical wants? What all the important ones that they need to be sold at need to be refrigerated. So then I can work with them and I talked with the busy streets and supposed to
close them on the field. And that's why we have those two different layers are more the Tactical and operational level. Go back to the Sea. So How to do work to meet the key Partners, so I did find the key Apartments as I just showed her the brakes line, so I had to meet for sex with Deerfield this new buyers, punch Madison office individuals in the organization where they didn't read the last two of Judy. As we ought to get to know each Department's structure. How many people
are in? This is what is the work clothes security? If any was he work with all that? Well, and understand that process very important as well. Swap time I meetings around but I have to be my date. I have to go with whisper to so I could go to prison or practice, who you're coming through or what we can do with all scripts offers and understanding what they need to see, if what we offer our missionaries out. You have to find you. So that was one of the first step. So that's a plus to get started
and I had to literally take a shower on the road now. So, how do you put my meetings, having my cyberdeck enhance? I could go meet. So if this was the face of the new Sobieski practice, I introduced myself to the Tactical and operational operational teams or by organizing Face fleece. One-piece was possible that we have to move everything Visual and the goals of all these meetings at hand. We supposed to say to all the approximate illegal was willing to further, increase awareness of the
subsidy practice. You have security team to reach out to We wanted to reach out to people. Those responsible for implementing our office who is breathing soft. Who's Billy bringing. Sorry, software's over that work forces and get security on to the edge of the house. Send me all these interactions. That have the key Focus for me was always, do take out and understand the people. The process of the technology of high-level. I was tending, who is doing, what, what are the processes. How can we work with those teams on Sons of Brooke mattinata guideline, so we
could a battle steps in the process. What technology are they using to interact to the house. All forms of evaluation services to use by a pregnant Sim and you don't know if maybe you need to be the one. So at least having this information was going to help us balance rocks. We saw with our business units. After the Roadshow Sewer Commission, a lot of what they needed and of course, I needed a lot. So I already have the knee treatment service. Food process to really be able to interact
with the Beast units, cuz everybody has needs everybody insecurities, but you need to be able to capture those requests to ensure that all fuzzy fruit, reach the objective analysis success at the beginning. So we have a genuine a box so they could reach his house. Phone number or email. Answer, we could request form initially on the Nexus sheet to be able to capture what the needs would be. That template organizer for structure would be a resource center process. We both stopped with the police and also defended the actions.
So might take out here from the first experience that he says, of course, overwhelming at the beginning. But we did learn a lot along the way and I might take out to use was we to reevaluate week early and we found the process to better accommodate the be used for since I was saying, we have an extra sheets. We could be hard to decommission it and move to a more user-friendly version of phone. So we all might use. Once we have stood, their service is also received what they need. So we could easily been pre-approved by Muse on the musically for me the properties of constantly
changing. So we have to pry reprioritize a lot to be that one. Day, They noticed me request, all you need. I need to install an architect. Yeah. I'm somewhere else and we negotiate. A green on the timeline that they were very important cuz everybody needs you help. But you need to know what they need. When can you deliver? So quickly, we learned that sometimes we had want some salmon. Sometimes we'll be probably at the rhaetian. I could have requested coming in and saying that it's a long few hours a week for next week home. Can we
provide that support. So we saw things to consider when you when you be such a pain? Pissing razors ships is Sweeney poses, to all the key players. I'm either comedies on a monthly basis. We call this weekend is to say, the very least. They need the issues that decision. I'll swap over Gregory blood, pressure points on the phone so I can talk to all my business to see what's happening. What's going on at Wrigley showcase the Sabbath service, offerings regularly as they would be the practice. So new Services of coming all the time. I'll save it to my shop new Services. We will showcase
a full of regularly. I won't defend weakness and concerns. And communicates with old apples, communication is key in this job and shoot the face with a management. My substitute members. The request has the palutena's, they audit legal, they all speak different languages. So I need to be able to speak security. Call Dan. I hope. So. That's, that's the important aspect of this, but it's very important. You're welcome. We have to asleep on the folks plan and a female that's very important to do to align with a seasonal and C2
strategy plan because otherwise, we going all directions at once and sometimes better to take. I mention to your approach and and be discharging of the way example. Define either mandates and they are we are focusing. The timeline was the first year, maybe won't you integrate with the procurement process and have it showing at the moment? You level the next year of exotic moths. You want to go on a process and so on and improve along the way. Wcu management support is really key, Arch, get supposed to be present on the tables and other need to retake to
Searcy,. They will know you. So you need to know what, you talked to a lawyer for the first time, the legal team and will literally tell you what to do or what you want to. And having seen your mattress for the loss of along. The way when we have an interaction appearance and wanted to say that we have to Beware of the one-size-fits-all approach which is kind of the first way you want to go. Because you need to suck it all because he broke my legal difference of a funnel to capture this which is great. But you need to be able to tailor what you doing to the
strategy of the business units. Be advised. Who is the company. We quickly have to be the Catholic of stories? Could we come? Everybody wants to work with you, but it don't know you they don't know what you're capable to do so long, the way we stopped at 2 to to be that kept abilities and and shook his all different success stories with different departments. If your project. And I'm having a coaster short and long-term strategy. So Sookie. Get back to where I was mentioning earlier travel on a red focus and its online.
Now, we've been at the top of service. So having all these requests coming in. There are two key things that we are really do, every days to match the request. First to respond, to the needs of all the first step, moving the request, correction of documentation and information to know what it is about. So I knew I had to just call someone from this location to Townline. Very important. So we use a request track to that, help us to do that. To be between, should they refuse service to give you
lots of Optics reviews for PCI compliance, might rain. So I swept regularly with what I call all internal clients and hold regular meetings to make sure that we deliver on time, what I need. And it's Osteo sweetheart for the Post, every because it's more sexy to work, either review, so that go on to the next appointments, but I still need to keep in touch with my request to see what's coming. Next. Were they happy? What can we do better than next time? So always keeping you informed and
ahead of the business units and equity. Super, my experience here, has a c, a clementine and communicating a streamlined request process whiskey with Menelaus. Not responding it. We need to make any more, unless an easy to switch work with all our strength. They called us is important. At the beginning. I remember, we were always saying bisexual is our service level, but in the long run, if you need to give it time, I so because you can imagine. So we found this pretty quickly. Once. We have enough data, to see how much time it takes to give you
points and softball cheer, as you promise, not to tell, if a trap to trap because of the beginning, you weren't together trust. You would want to other promise. So that's why we kind of hold on to the back after us, to avoid committing, all of the deadline. So, yes, you get it next. And what happens if you say next week in a little better, you would a company right away. So I will set you to be well. I spect ons on the cybersecurity has practice at Sequoia, is to manage with my request. Might as well. So connecting regularly with the
audit. We Stand Community needs is more important, so we can identify the high-risk issues and open findings to help us, stop and eat, and Tackle. What is the most important? So, working together? We will keep the proposed and enforce the implementation of security measures and techniques controls was very cheap. If you can reach out to them, being able to attend meetings is great with you. Try to get us both of those meetings yet, but you so much for mission to be able to to to see there. Apples to Apples to
support business, to be stupid, Mendoza combination for test results as well. So far more experience, I would say early withdrawal. It seems, if you would have to walk with coronavirus to prioritize, you request and the efforts towards the most high-risk areas and also to coordinate with governance teams to review the risk, register on a regular basis. So please put them all those made. The focus on value. So another thing is that they're using these, you want to know. How are you doing, what's happening?
So you need to be able to bring some reporting all those activities and it was mine. I want is my responsibility. So there's always two sides when it comes to reporting. Quite a few factors and quantity factors factors. It's harder to measure but we are avoiding the potential risks that we see and the bucon syringe that I collect on my resume, things to see a man on the field to collectible supposed to bring them up and not. So astonishing is communicating coping strategies is what is very important because
what we see on the field, can have to be those allergies to kill strategy up solo, counterfeit top down approach and bottom-up approach. Solving problems with key as a c, we don't hate you say, no. We see how to say? Yes. But so we have to be creative sometimes to propose Solutions, mitigation strategies that work with the fender like to be a concerning the budget, constraints as well and getting all the players on both. So as you see how you would see that news
travels very fast do bats. It's going to come, you will know. We don't want to see the picture of responsibility and transparency as well. Have you spoke to get sold to pay your own balls? On the court is at the side with beads, our reports and articles as you know, our Magnum say. I like that post. I want to see things, but I called Reggie to create a prospective. So we be able to see those tools so we won't have to find matrix to showcase the value. We are leaving cuz that's the points that happens
after a few months is why is the value you bringing? So we were able to come into town at 4 today, rubles for status, on Pawn Stars of two weeks to provide us with your opinion. So that someone is an opinion or GFCI requirements for new software 2 weeks would be Oslo so we can make to, to formalize timeline. The sweeper message reporting tools, chili toppings contributions, and success, and number of effort hours. So we could have reported reports reporting turn based on the audience. So emo high
level. And we are at the Red Sox manager. Saw the request of the want to see the status of the phone is why we are, what is the deadline? How many days? So we could find some beef every week, even twice a week? So we get the last post on a weird dancing. So we were able to you to be those reporting. That's that's really help you because at some point if someone was going on it would be very difficult to have everything on top of your head and having information since the lies and lies is is really really helpful. Not let me give you
some key. Takeaways of my Spears here as as a commissioned officer. The day today is actually not as easy. As you would become the in-house service representative, literally the best out of it and the strength to us at all do sometimes. And so you have to wear many hats, sometimes, I don't even know all the time to discuss what I do. Some days. I will be appointed manager and negotiator expert on Netflix because I'm being thrown in the beating like that or third-party Ali's, but you coming you capture the information and you can bring the Explorer that you need a table. So I
asked if you liked to see things from Mom, A Wider angle. Privacy, scan, and reach, and other moment's notice. So, you have to be very flexible. So, I actually have every reason to take my coffee because I have an account that you can go to different once. It's all right. We always. Did you think of the focus of the five again, once I couldn't get down at 4:32 p.m. Long-term at the beginning you with Santa Fe short-term to get success to deliver deliver, but you need to
see what all the new service is coming to hide. What is the strategy of the department? Because even if I have some priorities will change, you want to see what's coming next to be ready for the new upcoming initiatives? And actually something I've experienced people skiing is actually much more important. My role as a technical skills. The reason why is because I coded with so many internal policies. Everything is security, of course, so if you background will help you to go, but you have to be someone who wants to work across the board. So big
about you connect security and business, understanding be able to have a meeting at 8:00 with the lawyer. That's not a talk with some of the Pokemons and then with network security, and then being able to change tables. And having those people skills is veediki, when you have to do with this type of individuals. Three challenges. I faced was to be able to bring the right people at the right table, at the right time. Sometimes you will be honorable thing and then realize how I known. I would have brought, I want to talk to text. So, today to be
able to get around things ahead of time. So you can bring the right people and avoid to four meetings and Morty days is if it's difficult by respond. I was able to to, to find a ways to to to reach this goal. When I go to meet each other, right? People would become the man in the middle defending. You teams representing been on this current location to known as Department likely GoPro commodity, especially when you read the contract that always wants the kid, that is 10, what's happening. So you are
I'll be applied science. As you know, I always say, we likes you to give a bra size and what you can do his actions. I would say the first thing you can do when you get back to its you work is to identify. You contact. If your if you don't know yet, who is it? You contact for questions and concerns. And the request of the cyber security team service catalog. What did you once they offer? How can they help you? And what's up sexy always use that they have to collect those documents and compact. And in three months read the policies. You have any questions, ask the questions to the
Buy this talk
Buy this video
With ConferenceCast.tv, you get access to our library of the world's best conference talks.