Enabling Security from the Top-Down with Max Chan

Max Chan: Do not play adversary with your security organization, whether or not they are part of your group. At the end of the day, truly see that as your personal accountability and looking at it through the lens of the end price. That will ensure success. That will ensure the right tone from the top down through the organizations to ensure that everyone embrace that vigilance that is so needed to secure the company.

Speaker 2: Hello and welcome to Security Visionaries. You just heard from today's guest, Max Chan, chief information officer at Avnet. Securing your company and doing it successfully starts at the top. From speaking with the board to enabling employees, CIOs are personally accountable for communicating risks and solutions to folks throughout their organization. Max Chan is ensuring his company maintains a robust and secure IT environment through thoughtful communication. Before we dive into Max's interview, here's a brief word from our sponsor.

Speaker 3: The Security Visionaries podcast is powered by the team at Netskope. At Netskope, we are redefining cloud, data, and network security with a platform that provides optimized access and zero trust security for people, devices, and data anywhere they go. To learn more about how Netskope helps customers be ready for anything on their SASE journey, visit N-E-T-S-K-O-P-E.com.

Speaker 2: Without further ado, please enjoy episode 14 of Security visionaries with Max Chan, Chief information officer at Avnet and your host, Mike Anderson.

Mike Anderson: Hello, everyone. Welcome to today's episode of Security Visionaries podcast. I'm your host, Mike Anderson, chief digital and information officer here at Netskope. Today, I'm joined by my friend and peer, Max Chan, CIO for Avnet. Max, how are you doing today?

Max Chan: Mike, doing well, really good to be talking to you here today. I say to you when you send me the invite, I don't know why I'm here, because I don't profess myself to be a security visionary in any way. So, maybe you can enlighten me throughout the conversation today.

Mike Anderson: Security is a team sport, so I'm sure we'll have a lot to talk about, and the key is hiring good people on our teams that know how to lead the security program. Before we jump into that though, just to set the background, maybe tell everyone a little bit about Avnet, because not everyone is familiar. I am obviously, because I've worked with Avnet over my career as both a customer and partner. Then, also maybe tell us about your journey to becoming a CIO.

Max Chan: Absolutely. So, Avnet is one of the largest technology solution provider specializing in supply chain solution for all technology distributions. We're actually taking care of the entire value chain of that technology solution from design to new product introductions all the way to mass productions and go to market. We work with our supplier partner as well as customers at any step of their value chains. As long as we are able to bring value to them, we can play a role in their supply chain.

Mike Anderson: That's great. Tell us a little bit about your journey to becoming a CIO. Obviously, you got a CIO 100 award earlier this summer. I got to be there with you when you received that award. So, tell us a little about that journey to becoming a CIO, and then we'll jump into some more of the security topic that you're so familiar with.

Max Chan: So interestingly, I still consider myself as a newbie at Avnet. I've only been with the company for 11 years. Avnet has been in business for a little bit more than 100 year, and many of the leadership team has been with the company for well over 20 years. When I started with Avnet, I was asked to go to Hong Kong to take on a divisional CIO role for the Asia Pacific business, did that for the first three and a half years with the company, implementing a regional template for ERP for the business there, as well as rolling out a regional instance of CRM for the business. Having done that after the first three and a half years, came back to Phoenix, Arizona to take on a global application role which evolved over time into a divisional CIO for the Americas business, before being offered the job of a global CIO about four years ago when the previous CIO, my predecessor, left the organization.

Mike Anderson: That's a great journey, definitely that international experience, definitely will play in. We'll make sure and dial into a little bit of that from a security standpoint, because I guarantee you know more about security than you lead on. Before we jump into the security specific topic, I know you got the award for CIO 100. I know it's great. You always like to talk about the great work your team is doing, maybe just one minute on the exciting projects you're working on there. Then, we'll dive into some of the security topic.

Max Chan: Just like many companies, our focus is on digital transformations. I like to just unpack a little bit more on what that means for Avnet, because digital transformations, the same two words means all kind of different things to everyone. As far as we are concerned, there are three key components to digital transformation, the first thing being digital enablement. That is the typical digital transformation that people talk about where we look at internal, external interactions. We do a digital workplace. We do look at AI, ML, as well as automations. That is where we look to create the most value to the organization, to the business, introducing frictionless transactions or interactions, machine to machines, as well as capabilities that allowed us to be better service provider to our supplier partner, as well as our customer. You continue to hear me mentioning supplier partner, because they are a important component in our entire ecosystem, right?
Avnet is in the paper business. It's all about our supplier. It's all about our customer. It's all about employee, and that's why that digital enablement strive to create that single pane of glass, single source of proof, a solid integration layer through API M, microservices allowing us to get data downstream to where it needs to go for consumption afterwards. So, that's the first pinnacle component to our digital transformations. The other two aspect which is more foundational to the digital transformation that we have is really our cloud migration and our ERP modernization. We see that as critical component to bring us to achieving the digital enablement I talk about. The idea here is really to drive modernizations, and we move all the workload into the cloud, leveraging the inherent capabilities that we can get from the cloud, as opposed to what we are doing here on premise. ERP modernizations, it is what it is, as the name suggests, a long journey, but important to our overall success.

Mike Anderson: That's great work. I definitely agree that everyone's got a different definition of what digital transformation means, and it's important to clarify in simple terms what that means for your organization. You did a great job of doing that. When I think about the transformations you're doing around the enablement and APIs and cloud modernization, the theme this year of this podcast is security as a team sport. Because, now as we think about our cloud journey, we have to make sure we have the right security posture around our cloud environments. We have to make sure that we don't have blind spots there when we enable our customers and think about APIs. The CISO is governing the policy and the program, but obviously we have to embed that into our people across not just IT, but the entire organization. So, maybe frame a little bit. How do you think about that challenge? And, how do you make sure security is in the mindset and as a team sport at Avnet?

Max Chan:I liked how you put it. Security is a team spot, right? You alluded to earlier, Mike, that the CISO and the security team essentially are defining the strategy, creating the framework, ensuring that we are actually measuring the right things so that we can improve on the right thing to secure the environment, to secure the organizations. However, the security team does not have the resources to do a lot of the downstream execution. For example, let's take a very, very simple vulnerability patching. When the security organization identify areas where we need to secure our environment through patching, we do not have a large group of security team who will be able to go to the entire environment to look at what we have and secure the envir