Being Ready For Anything with Dan Lohrmann

Dan Lohrmann: I mean, it's always about the communication and how you communicate. Who's going to talk to who? When? What do you do first? In what order? How do you do it? Are you prepared? How do your playbooks work out? You bring to those exercises, those tabletops, those full scale exercises, your playbooks to really almost practice makes perfect, right?

Dan Lohrmann: And so, just like a fire team would practice putting out fires, you don't want somebody first time they ever put on the suit to come to your house when your house is burning down, you want them to know what they're doing and know where to go, and what to do, and how to do it based on different situations.

Speaker 2: Hello, and welcome to Security Visionaries hosted by Jason Clark, CSO at Netskope. You just heard from today's guest, Dan Lohrmann, field chief information security officer of Presidio.

Speaker 2: The idea of being ready for anything doesn't happen magically overnight, it takes practice, repetition, and diligence. And bad actors will always be there, with new ways to test just how prepared you are. As security leaders, it's our job to be ready for even the most unexpected challenges. Just as a firefighter wouldn't run into a burning building without proper preparation, security leaders need to view digital fires in much the same way. Putting yourself in the mind of the hacker takes training and role playing, aim to be multiple steps ahead at all times, because no company wants to be caught in their first fire without ever having tried on the suit. So before we dive into Dan's interview, here's a brief word from our sponsor.

Speaker 3: The Security Visionaries podcast is powered by the team at Netskope. Netskope is the SASE leader, offering everything you need to provide a fast data centric and cloud smart user experience at the speed of business today, learn more at netskope.com.

Speaker 2: Without further ado, please enjoy episode of six Security Visionaries with Dan Lohrmann, field chief information security officer of Presidio, and your host, Jason Clark.

Jason Clark: Welcome to Security Visionaries. I am your host, Jason Clark, chief strategy and security officer at Netskope. Today I'm joined by a very special guest, Dan Lohrmann. Dan, how are you?

Dan Lohrmann: I'm doing wonderful. Thanks, Jason.

Jason Clark: I think you and I we've probably known each other for about 15 years.

Dan Lohrmann: Exactly. I remember first meeting you back in Websense days. And back when I was Michigan chief information security officer, and you were a great customer focused executive back then, I know you are still today, so it's great to be on with you.

Jason Clark: That's one thing I love about doing all these podcasts, it's just kind of reconnecting with everybody. And especially during the crazy times of the pandemic. And so, we're going to start with kind of, what was your first job in cybersecurity, Dan?

Dan Lohrmann: So I went out of college with the Valparaiso University, got a degree in computer science and started at the National Security Agency. The old cliche we use is, if I tell you what I did, I'd have to kill you. But I was in computer networks and this is on call unclassified, but my first job back in the late '80s was really working with a variety of different vendors, interoperability.

Dan Lohrmann: So back in those days it wasn't all TCP/IP or IP version four, IP version six and all the mumbo jumbo. But it was like S&A, and we had DECnet, and we had all those different. So basically, getting networks to each other from IBM to DEC, to digital, to Sun SPARCstations and all those kinds of things. And I was running that lab. And were deploying networks all over the world really before there was an internet, which was pretty cool.

Jason Clark: That sounds a lot like my job when I kind of started in the army. It was just all about getting networks to talk. It was a heavy banian tree. And then we were kind of converting to NT 4.O and active directory. And it was a lot of fun. It's so different when you're managing the tech from being a CSO. There's days you probably miss it, I'm sure. You tell it what to do and it doesn't.

Dan Lohrmann: I agree. And a hands on piece, I missed that. But we went to England after that, I won't tell the whole story there, but just how all hands on networks and some crazy stories about how we almost brought down a satellite. And that was pretty scary stuff, but it was all good. And I love of the hands on stuff as well, I do miss some of that.

Jason Clark: I saw the news on the new role at Presidio. So, I'd definitely love to hear about that.

Dan Lohrmann: Yeah. Thanks. I'm the field chief information security officer really focusing on public sector. So, as you know, I've done a lot of different roles in CSO roles in Michigan government, and CTO in Michigan government. Last six, seven years I was with Security Mentor as a chief security officer.

Dan Lohrmann: So this role really Presidio partners with Netskope and a variety of other companies providing really guidance to C-suite mainly focused on SLED, state, local, government education, but I had some work with other governments as well. And really just hearing what their issues are, and providing solutions, working with partners to provide an end to end solution to their cyber needs.

Dan Lohrmann: And so, I'm really excited. I'm drinking from a fire hose right now. I've only been here for about five weeks, but just loving the job, loving the people, and learning a lot already. So, yeah. It's pretty cool.

Jason Clark: So governments, especially SLED has historically always been known as kind of moving a lot slower in adopting tech and transformation. What does that look like right now? How is that changing, especially with kind of some of the new executive orders around cybersecurity, just in general, I'd just love to get your perspective.

Dan Lohrmann: Yeah. I mean, just like everyone else they're getting, first of all, the threat landscape is just going crazy. So, just getting hit hard with ransomware and other things like that, and cyber attacks. And it is exciting, the good news. I mean, we don't get a lot of good news in cyber. But the good news is we just got the new dedicated cyber grants to state and local governments, it was a billion dollars over five years. I think that's really going to help a lot of state and local governments.

Dan Lohrmann: Honestly right now, what the biggest issue killing it's this bleeding state and local government, they can't keep people talent. And that's where they cross the board. We're seeing that in the private sector as well. But I'm hearing CSO say, "Dan, we just can't."

Dan Lohrmann: I mean, one team I know, big state lost half their people on the cyber team since the beginning of this year. So that's just a huge challenge. I think they're getting it, they're to really understand because with the Colonial Pipeline, all the different things have been happening this year, it's so front and center and the digital transformation that we've seen during COVID has just been so huge.

Dan Lohrmann: So, the need is there, the move to work from home is there, all of that is there, it's still just a really, really difficult challenge at the moment.

Jason Clark: So when we talk about the billion dollars, right? When you look at SLED and just the federal government in general, what do you think the biggest vulnerability that they have that they're not aware of right now? It's a kind of two part question, either they're not aware of, or where should they be putting the most of those dollars?

Dan Lohrmann: I think visibility. The old cliche we used to say at NSA all the time, you don't know what you don't know. And so, knowing there's been a huge move to the cloud, which has been great, and everything's going to the cloud now.

Dan Lohrmann: I mean, the resistance to the cloud is just not anything like it was a decade ago. I mean, everything's going to the cloud and that's great. It's just, I think the challenges are not knowing where all their data is. So the visibility in the data, not knowing all the different kind of end to end pieces of that journey. And I think people want to do zero trust. They want to do SASE. They want to do that. And I can say, I think the challenges they're facing at the moment are around the people side of it. It's always people processing technology. It is it's always that.

Dan Lohrmann: But as you know very well for what you do, just saying, "We're going to stick it in the cloud and we're going to give it over to Microsoft. We're going to give it over to AWS." Doesn't solve the problem. It's like, I hear that a lot. Well, I know AWS or Microsoft, and these are good companies. I'm not knocking anybody. I'm just saying. They think, well, they're bigger and they're more powerful so they can do it better than us, and maybe they can, but you really got to think about the configurations. You really got to think end to end. You really got to think about the whole, the end points and of course, identity management, the whole end to end piece. And I think that's really where the challenges are. And some are doing it well, there's always kind of leaders, followers and laggards. There's three groups. There's some people doing really well, and there's some people that are really struggling.

Jason Clark: Yeah. I mean, like you just said, you just talked about the big companies as we're going cloud. There is this weird, like sometimes you get the CIO is what I call. Well, we just assume they got the security, right? Versus, no, you're the one responsible for your data. They don't take responsibility for your data security, as an example for your configurations.

Jason Clark: And I think there's so more awareness that needs to be driven around that. So hopefully a lot of the, like you said, it's visibility. It's getting the full visibility, especially as things move to the cloud.

Jason Clark: How much of the effort is focused on the people though? Of that billion dollars, is anything directed towards, well, let's pay people more, or let's help you outsource more? I mean, like you said, it's the number one problem. So, how is the billion dollars going towards that?

Dan Lohrmann: Well, and I think the guidance is coming. The one thing what the law says, the act that was signed by the president says is you have to have a plan. Which is good. A lot of people don't have plans. And so, it's not clear is that going to be every state has to have a plan and then municipals can feed up into the state plan, or does every city, every county, every township have to have their own plan. That's still not clear yet from DHS and CSA, that's still coming down.

Dan Lohrmann: I think it is going to be based on outcomes. And I think part of it is going to be divvied out by population, and there's going to be lists of things you can spend the money on, and things that are eligible and things that aren't. And there's going to be a competitive pieces of this to say, "Okay, the state that has