Everything Starts with People with Rehman Khan

Rehman Khan: I think it will be the design, security design. Like I said, really focusing on security design and making sure that the way we approach security is not just with a whole bunch of tools, but we should be really stepping back and designing security into the overall organization, the process.

Producer: Hello and welcome to Security Visionaries, hosted by Jason Clark, CSO at Netskope. You just heard from today's guest, Rehman Khan, Director of Security Strategy, Research & Design at Charles Schwab. With more than 20 years under his security belt, Rehman has worked with all kinds of people. With this kind of experience, there's a reason one of his top recommendations is to double down on people. Security leaders picking the right team members has a profound ripple effect. The importance of these decisions make or break careers in security. So choose wisely. Before we dive into the interview, here's a brief word from our sponsor.

Ad: The Security Visionaries podcast is powered by the team at Netskope. Netskope is the sassy leader offering everything you need to provide a fast, data-centric and cloud-smart user experience at the speed of business today. Learn more at netskope.com

Producer : Without further ado, please enjoy episode eight of Security Visionaries with Rehman Khan, Director of Security Strategy, Research & Design at Charles Schwab, and your host, Jason Clark.

Jason Clark: Welcome to Security Visionaries. I'm your host, Jason Clark, CSO of Netskope. And today, I am joined by a new guest, Rehman Khan. Rehman, tell us a little about yourself.

Rehman Khan: Hey, Jason. Yeah, glad to be here. I am basically leading the Charles Schwab Security Strategy, Research & Design Organization. And, I live in St. Louis, Missouri, and have lived there for eight years almost. And, before that, I was in Minneapolis, working in cybersecurity for roughly 12 to 15 years, and doing other things along the way. So, that's me.

Jason Clark: Yeah, in the time I've known you, you've been an architect, head of architecture for a lot of really big companies, global companies. You've made a big impact in your organizations you've been in. But, one thing I did just noticed is that your hair's a lot shorter than the last time I saw you. Was that kind of a result of the pandemic and then kind of coming out where, I don't even know how many inches you cut off just now.

Rehman Khan: Well, yeah. Hey, I think we're all kind of tinkering with our little needs and wants, I guess. Yeah, I'd probably say I got six inches off just a couple of weeks ago. Thought I'd just clean up for the new year. That goes and maybe get a fresh start, but this pandemic absolutely has given us kind of this opportunity to maybe grow our hair long.

Jason Clark: How'd your family or at work, who reacted the best or worst to you cut everything off?

Rehman Khan: I think they took me as I presented. I guess there's always something going on with me. I mean, I'll have a goatee, and then all of a sudden, a couple years later, I'll have a beard. And so I think people are sort of used to the way things change about my, I guess, look. But, I'll tell you, I think people in general were very complimentary, but I did have a couple of times where, I think it was actually one of the chairperson at Wash U, they looked at me and they're like, "Wow, were you at the Survivor show?" I mean, it was literally, their reaction was like, "Where were you?" And so, yeah, I think that there's a kind of a mixed bag, but mostly people were nice and they understood that.

Speaker 5: Deep dive. Dive. Dive. Dive. Dive.

Jason Clark: So you speak six languages. Tell us a little bit what those are and how they've been valuable to you.

Rehman Khan: Yeah. So really, if my background, growing up, I was born in Kuwait. I grew up there, then went to Abu Dhabi. And my dad worked for Lufthansa, so you can start seeing kind of the pattern of us being able to travel the world. And then I moved up to Minneapolis from Abu Dhabi, which was a huge change. But I guess, coming back to your question, really, I would say Abu Dhabi was a city where I got to learn and interact with international crowd. And, I've learned German. Arabic was already there, Urdu, and just kept on going. And I think that resonates with me, and it kept on building up my palette.

Jason Clark: I think about that. So I grew up globally as well, being a military brat. And, I think about the fact that, how do I give that same exposure to my kids? I want them to grow up global citizens and not just sitting in one city their whole life. And what I've decided is that, starting in two years, every single summer, we will spend that summer in a different country. And that's how I'm going to make them, as much as I can, global citizens.

Rehman Khan: Yeah. No, I think that's a great idea. I feel that we have, I mean, hoping that with the pandemic, in the next couple years, we can get that kind of a chance to freely mobilize. Because part of it is not only, you could sit at home and learn all these languages, and we do the same with cybersecurity, so on and so forth. But some of this is about interaction. And you really, when you interact with people, both in personal life, you learn. And I think that by traveling, you learn. You instill the confidence in your children. And I think that's a great plan. I myself want to do that, but I think it's about going to an environment where you have to deal with the situation and then you start-

Jason Clark: It's the culture.

Rehman Khan: Yeah.

Jason Clark: It's like, there's two types of people, the ones that go somewhere and say, "All right. Here's the 10 sites. I want to go see them," which you can basically see by Googling it, or the people that say, "I want to embrace the culture. I want to try the food. I want to meet the people. I want to go to the local bars." It's a very, very different essence of what you're trying to accomplish. So, I normally ask this question a little later, but I'm curious right now, from getting into security, what's your favorite security domain? You run architecture, and you've done that over and over again, which means you kind of get to oversee, like a CSO, every security domain. What's your favorite domain?

Rehman Khan: Boy, that's a tough one. Can I give you two?

Jason Clark: Yeah. Give me your first, and then your second.

Rehman Khan: Okay. I'll say it. Look, identity and access management is where I grew up and what I learned, and I continue to see it evolving. I think that's my first one. That's kind of the go to, and right behind it is data security. Those two are been always there. Yeah. I mean, I think that they kind of go hand in hand. You could look at it from an application security perspective. But yeah, I think those are kind of the domains.

Jason Clark: Those are great domains. And if I had to ask you, what's your one that you hate the most?

Rehman Khan: And this may apply to all the above, but it's kind of the security operations, if you will. It's such an important aspect, but I also feel that, I think security operations and maybe I can tell you why.

Jason Clark: It's a different kind of stress. Tell us why you hate operations.

Rehman Khan: Well, I'm a designer. I have always been a designer. I'm after the aesthetics. I am after the actual design. And I feel that the reason we have operations in its current state, the way it is, is that we're not focusing on design. We're not designing security solutions and applications and so on and so forth with security in mind. And well, there's a residual risk and effect of that. And that's what security operations is today. I mean, I think that's what makes me kind of stay away from it, because why do we have to be so stressed about it? Why can't it be like other operational domains that are automated. They're working, functioning, manufacturing. I mean, you take any of the other business domains, so-

Jason Clark: You don't want to be the result of other people's bad designs. You don't want to be the tail. You want to fix things and design them right.

Rehman Khan: Yes.

Jason Clark: Makes lot of sense. I get it. And so you're frustrated in operations when you see bad designs basically.

Rehman Khan: Yeah. Yeah. And then you see them over and over again. I mean, we're seeing it with Log4j. It's kind of an interesting landscape, if you will.

Jason Clark: That one, I think, hurt a lot of people's Decembers. It hurt a bunch of vacations of people. Everybody I talked to for at least 45 days was like, "Oh, what's going on?" "Yep. Log4j. That's what's going on. We're just scrambling because of that." So you teach at a couple of universities, which I always applaud, to helping the next generation. And one of them is Wash U where I got my MBA, and love, love seeing that on your background and what you're working on. So, why do you do it? What's your view on the next generation and the importance of teaching them cybersecurity? And what do you teach them?

Rehman Khan: Yeah. I look at it as a learning process, really. By teaching, I'm learning. I think that's the one thing that I really focus on, because you have this interaction with the students, and you're getting questions. And sometimes, I have the answers and sometimes I don't. It's such a different question that I was not expecting. So, part of it is that, it's something that, maybe call it kind of self-fulfilling prophecy. I'm trying to get ahe