Personal Resilience in Cyber

Emily Wearmouth [00:00:01] Hello and welcome to another edition of the Security Visionaries Podcast, an all round excellent lesson for anyone in the cyber data or related industries. I'm joined today by two excellent guests. Shannon Jurkovic is the chief information security officer at Bendigo and Adelaide Bank in Australia. Her career background is in risk management and before her current role, she worked for many years as a consultant at both KPMG and EY. In a recent count, she determined that she'd supported more than 150 organizations in their risk management efforts. So there's no doubt that she knows a thing or two about things. Welcome, Shannon.

Shannon Jurkovic [00:00:34] Thanks, Emily. Great to be here.

Emily Wearmouth [00:00:35] My second guest is Samm MacLeod, who's also a CISO. At the moment, she holds the role at Culture AMP. But over the course of her career, she's held CISO or other security and risk roles within energy companies, banks and also the NBN, the organization responsible for building and running Australia's fiber network. Welcome, Samm.

Samm Macleod [00:00:52] Thanks, Emily. Pleased to be here.

Emily Wearmouth [00:00:54] I think it's clear from the little snapshot I just gave of Samm and Shannon CV's that they're no strangers to high stress roles in organizations that operate often very critical infrastructure. And so the thing I wanted to talk to them both about today is personal resilience. Research earlier this year suggested that 94% of CISOs reported suffering from work related stress. 94% is one of the highest percentages I've seen on any survey like this, so it really is no trivial topic. I wanted to start Shannon, Samm, just one of you want to kick off by helping us set the scene of what we mean by personal resilience. Maybe. Shannon, you want to go first?

Shannon Jurkovic [00:01:29] Sure so resilience in its pure form is really about the ability to adapt to changing situations and difficult situations and challenges. And if you look at, I guess, the conversation we're having today, really, you can look at it from two angles, one being the cyber perspective. So how we go about protecting our organizations and being resilient in terms of responding to cyber attacks and keeping the business running as we respond and then being able to bounce back as business as usual. But if you also flip it on, its on its head. It's really also around that personal resilience. And so again, it's about being able to identify and to adapt to challenging and changing situations. And certainly from a cyber perspective, we we deal with this every day and multiple times a day, but then really gets around having the mechanisms and applying those to respond to and now and ultimately bounce back from those sorts of situations.

Emily Wearmouth [00:02:25] Samm are personal resilience and corporate resilience completely intertwined?

Samm Macleod [00:02:29] Oh fabulous question. Yes, I feel like so particularly for CISOs. So if I look at, you know, what are some of those keys to being resilient? It's all about the contribution you're making, the control that you've got over the situation that you're in, how well you cope. And I think a lot of the things we look at from a corporate point of view is how do we control a particular set of circumstances, how do we make sure we've got teams that can work their way through problem solving to achieve a particular outcome for an organization. So I think they're very well intertwined.

Emily Wearmouth [00:03:04] When you're looking at your risk planning for an organization, how much do you factor in personal resilience or sort of the the negative side of that personal burnout? How much do you factor that into risk planning? Is it a conversation that organizations are realistic about?

Shannon Jurkovic [00:03:20] I think that it's growing in and how much we focus on that. And I think if you look at the cyber landscape that we are working in and operating in, it's relentless and there's no mental downtime. Whenever shore cyber professionals, when an attack will occur, when we need to respond, could be any time of the day or night. I think cyber teams certainly know the impacts that a single failure or event can have on an organization. And I think too, if you look at cyber today, we used to talk five, ten years ago. It was all about technology. It's not about technology today. It's holistic. It's about, you know, a huge role around people and culture. And so you need to be including that people and culture element in it. If you look at my role as a CISO professionally, you know, it's necessary, not the case, but you do feel personally accountable for protecting the organization and looking after your teams and also yourself. And so while there's a level of reality to that, it's an organizational risk. Security is everyone's responsibility. We hear that cliche, but we also reflect on the fact. And we're hearing this more and more that cyber is a team sport. And so you need to be looking at the personal elements of this because to be able to respond, to be able to do cyber, you need people and you need those people to be switched on. But you also need to make sure that they're effective and what they can do, and providing them with the balance and the support that they are not just 24/7 responding, but also looking after themselves and being able to to be resilient and bounce back.

Samm Macleod [00:04:57] Just to add on to what Shannon was saying there, we we can see in statistics that organizational performance is linked directly to to people and culture, and I think we spend a lot of time diving into what are the risks from a financial point of view, what are of the risks to cyber point of view, where are our operational risks, but I would question whether we're diving deep enough into what those