The Importance of Continuous Control Monitoring with RegScale’s Dale Hoak

This is Textron tv. Hey guys, thanks for the throw. We're here with Dale Hoke, who's senior Director of Information Security at Red Scale, and we're talking about a new continuous controls monitoring report put together by the CISO Society.

And well, that really just goes to the whole heart of this, what's going on with GRC and cybersecurity. Dale, welcome to Shell. Thank you, Michael.

I appreciate the invite. Looking forward to having a conversation. So give us the high points of the report and why you guys think that this is significant, because, um, there's just a lot of things to worry about in the land of cybersecurity and compliance.

So how do we make this a priority? Well, I, I mean, the, the key factors around the report that kind of surprised me was 95% of CISOs don't believe that they have a good control on, on their, um, on their programs. And, uh, but outta that 95%, they all believe that that automation is the key, right?

So when you start talking about GRC, I don't know about you, but in my head, I hear antiquated processes. I, I hear, uh, spreadsheets, I hear right? Siloed data, I hear people who can't have conversations.

Your data is stored in, you know, disparate places all over the place. When I hear con continuous controls monitoring, right? That is more of, you know, uh, dynamic operational control assessment, right?

I have, I have a security tech stack. I take the outputs of that security tech stack, and I get good compliance, right? And I do that by optimizing my resources, right?

It's a force multiplier really is how we look at it. How do you keep people from wasting time, right? How do you keep companies from wasting money?

I would say, you know, the report, it cited a good, um, 40%, uh, either didn't have funding for compliance or it wasn't a priority, right? Where I, I, I'm sure if you talk to some of these, uh, some of these, uh, auditors, right? They understand that, that in order for them to operate anymore, right?

Compliance is, is gonna be a priority. And how do we achieve that compliance without crippling security? That's the real question.

Everywhere I go, somebody is complaining about regulations and yet it sounds like, you know, we're not doing anything to automate the process to make it less painful to execute. So are we involved in some sort of catch 22 here? Absolutely.

Right. So there's, I think there's three pieces of that. So first, nobody can agree on the standard.

You have Osco that's been around, but it hasn't been used because nobody can agree that that standard is worth it. You have OCSF, right? Um, you, you know, the, the, that, that chosen framework should help you digitize your output from your security tech stack and bring 'em into generally any tool that you have out there to give you a single pane of glass into compliance.

But, um, you know, it's still subjective, right? So you have a subjective, um, deliverable, right? That, that somebody has to look at and agree with.

Then you have largely manual processes. So why would they spend the money to automate them if we can't even agree a standard, uh, to report against them? So you see, you see NIST and, uh, FedRAMP is moving towards more of the compliances code and NoCal, but I think we, we lose track of what compliances code is.

The digital outputs, the machine readability of these exports saves a lot of time. But also, you know, compliance is code the digital readability and your CICD pipelines also operationalizes your security, right? In my pipeline, I'm making sure that I'm building in security.

Then I make sure I build in, in compliance on top of security. And then at the end of that, I had GRC outcomes at the earliest onset because it is just too expensive to try to fix compliance problems or security problems at the tail end of a delivered product. What is the relationship between the folks who are doing GRC and security these days?

'cause sometimes you hear about these two things are melding together, and then the next thing you'll hear is, you know, well, a compliance standard isn't good enough for security, it's just the bare minimum. So, um, how do we meld these functions? Or should we meld them in the first place?

Well, I, I believe that to answer your, to answer the last part of your question first, I believe you have to, right? I think you, you have to meld them because if not, you're just gonna burn time and money, which no, CO has enough of, right? Their people are doing a thousand things and nobody steals work, right?

They just keep stacking it on top of it. So they're just throwing more trash in on top of a dumpster fire and not putting it out. Um, I think what we need to do is improve, um, I is look at, you know, your security tech stack should give you GRC outcomes compliant outcomes, right?

You should be able to rely on the fact that my scanner is doing all of these things that needs to be done. And at the end of it, I have good reliable compliance because Michael, I agree. Compliance does not equal security, but compliance was designed right to enforce security, and it should have been a roadmap on how to be more secure.

It's become subjected over time. It's, it's developed cascading problems, different verticals viewed risk management and compliance differently. And all of that has been, like I said before, just increasing the dumpster fire.

So I think we need to kind of take a breath, right? Recognize where I can get my GRC outcomes. I can take my scanner through the use of, uh, uh, you know, integrations, bring in my scan data, review that, scan data, digitize the compliance process, put it into a single with pane of blast so that not only CISOs understand the state of compliance in in their environment, in their enterprise environment, they also understand the state of security.

So rather than having two siloed entities, which compliance people with security people, they do, I mean, they getting them to talk in any major organization is next to it possible. Um, that's just two of the biggest silos in this. And then you stack legal on top of that, or third party risk management or all of the other things that are coming about, uh, with CMMC and the, uh, you know, GDPR and all of the different, uh, cybersecurity frameworks that we have.

You just have a recipe for disasters. So you've gotta line that up. The only way that, that any compliance person is gonna line that up is by working with security practitioners, working with their operations team, developing what, developing what good operational security looks like, and then, um, getting compliance outcomes at the tail end of it.

And not using compliance as just a checklist. 'cause that's not what it was intended for. That's just what it's turned into.

So, as you kind of noodle this a little bit, I always felt like part of the exercise was to try to get those auditors in and out of the building as fast as possible. And, and it seems like if the processes themselves are manual and the data's everywhere, doesn't that just increase the total cost of the audit? I, I believe so, right?

So, uh, I believe that if you're, if you're not, you know, putting evidence collection on a timeline, this, here's what's happening. You set up a continuous monitoring plan manually, you're assessing controls if they get assessed in accordance with the schedule, right? It, it, it's built into a three year process.

And then six months before the audit, people are scrambling around, right? Then the auditors have gotta find the data, get the data, review the data. Um, the CM process should enable you, uh, if executed properly to have all that evidence audit ready all the time, right?

Single pane of glass. I know people laugh when you say that, but I'm a thorough believer in putting everything in one place where you can see it, right? And then putting a schedule over it so that it's pulled automatically, right?

You don't have to reach out and wait for a week for somebody to open their email in order for you to get your evidence requirements. It's already there. Oh, this is out of, uh, this is out of freshness, right?

That you get a notification, it says, Hey, uh, you need to, you need to provide this evidence, and it shouldn't take a compliance person, right? Setting an email or walking across the office to say, Hey, I need this scan, or, Hey, I need you to update this control implementation statement. That stuff should all be done, uh, through automatic notification.

And where you can, particularly on the technical controls, provide automated updates right there. It's really easy to update. Um, um, you know, your RAC data, it's easy to update any of the access controls.

It's easy to update, uh, any of the scanned data, right? RA five should be, uh, entirely automated if you're working into a FedRAMP or, uh, in this 800 environment. There's just, I could go on and on.

There's just so many places that you can minimize the pain points of an auditor by bringing that data in. It's there, it's, it's in a readable format that they're ready to go check, check, check down their checklist, and then they're out the door. So I believe it should, uh, and, and, and speaking with many three PAOs, they agree, right?

They don't want to be there, right? They, they don't. They don't, they, and no three PAO that I've ever talked to wants to fail somebody in an audit.

They want you to have a good plan. And in order to have a good plan, if you have a good automation with good evidence collection and good policy reviews and workflows, that can all be optimized into a single pane of glass, which gives s CISOs increased visibility and allows them to make decisions in near real time vice scrambling to prepare for an audit at the last second. Is this a psychological problem?

And I ask it from this perspective, it feels like we historically, always thought of as an audit was an event that was gonna occur at a given time period, and therefore we would get organized for the audit when it was coming. But it's really should be a process, right? I mean, it should be something that is just continuously running and it's not really an event.

I, I totally agree. I I believe it should be something that is planned for, you know, you're gonna get an audit. It shouldn't be a surprise, right?

Even a surprise audit, you should be audit ready, right? Through the use of the CCM practices. You should be audit ready all the time, regardless of, uh, and that should be platform, if not agnostic.

That should be everybody's goal to be ready for an audit 24 7, 365, and to have everything in, in a workflow that you can produce evidence on, on demand. It's unfortunately, right? You get stuck in these silos where people are comfortable as the value of change is, is not recognized, uh, compared to the, the value of, of not changing, right?

So if you have these processes, they've been in place for a long time, people are comfortable, right? Uh, you know, you know, every every company has a compliance guy that's been doing it for 30 years and has done it the same way for 30 years. So, quite frankly, automation scares 'em.

And then add AI into the automation, right? That's the latest evil word, right? So instead of recognizing that machine learning can actually shorten your time by about 80%, if not more, right?

It's looked at as either one, you're gonna lose people, which nobody wants to do, or you're gonna lose control of processes, which these things are not true. Every compliance analyst is overworked, every auditor is overworked. There's way too much work in order to meet the compliance standards.

Uh, and without automation, without the use of ai, right? I, I think we're just burning capital that no CIO has, And the audit itself, at least in my experience, is only true or current for approximately 10 minutes, because then somebody changed something and, and then, you know, we're back to the same cycle all over again where we're outta compliance and maybe there'll be a surprise audit or whatever, but to your point, didn't we just inject too much stress in this system and we're kind of our own worst enemies? I, I believe that, that that part of it is there, right?

I think part of your statement is true. I think that the other contributing factor there is that technology outpaces compliance, right? And compliance struggles to keep up, right?

So I, I believe that compliance is doing the best job it can. I believe that, that every AO is doing the best job that they can, uh, in light of the current situation. But let's face it, the drivers for technology, right?

The drivers for business practice against technology are going to supersede compliance, right? Because if you're telling a company that they have to, that they have to make money, right? Or they have to be compliant, right?

But very rarely the two line up, um, and where you, they can be accomplished EAs easily, the company's just gonna a fault on making money, right? So we as a, uh, we as security practitioners and compliance practitioners have got to find better ways to make compliance, keep pace with technology to improve business outcomes. And right now, right?

Without the use of any type of compliances, code automation, um, and, and industry without the, uh, it's being used, but it's being used sparingly. So without that, that being put into place, you know, getting the good business outcomes am being compliant, it's very difficult. And the paradox here is that every nickel we spend on compliance is one nickel that we don't have to either bring back to the bottom line or invest in something else, right?

Correct. Right? And so, I mean, I think it was 46% of the companies, uh, did, or 36% of the companies, and, and I'm working off the top of my head here, didn't recognize compliance as a, as a business value.

And then 46 of them just didn't have the money. So, small companies, right, aren't gonna have the money to stay compliant all the time without automation, which we've seen in the report. Um, and most of the companies that are embracing automation are small companies that need to be compliant nor to get into the marketplace, uh, and to make real money.

So it is, it is like a snake eating its own tail, and it be becomes really ugly. All right? So what's your best advice to folks then?

I mean, what's that one thing that you just keep looking at and makes you shaking your head and go, folks, we need to be better than this. Guys. It's not hard.

It's not hard. Find the places that hurt and automate them, right? And everybody has the same pain points if you sit and talk to 'em, right?

You, you have a limited amount of experts or SMEs that operate in compliance and security. You have the, a limited ability to stay on top of compliance frameworks and the regulatory changes that happen. And you have a limited, uh, you have a finite amount of capital, you have a finite amount of money that you could throw at any problem.

So find your top five paying points, right? And, and do some research on how to automate 'em. And I think everybody's gonna, gonna come to the same place, automatically collect my vulnerability data, write it automatically to an issues tracking, whether it's a poam or a workflow, or ServiceNow or a Jira, manage that automatically as it's fixed, my compliance is updated.

I always have good dynamic operational control assurance, and in a single pane of glass, I can see what's going on all the time, right? And this is not hard. A lot of people have done this right on the spreadsheet by writing scripts.

So now all of the, there's a a handful of platforms out there that'll take it, automate this for you. Second, become familiar with what, uh, compliances code is, right? Get familiar with Osco.

There's a lot of resources on the NIST website. There's A-O-O-S-C-F is, there's got a lot of good resources, right? Let's be, be familiar with what I'll call, you know, compliance benchmarking, where, um, these, instead of using compliance as a check mark, use the system on the front end to achieve appliance outcomes.

Um, and I do that by doing a business impact analysis, right? Recognize where compliance actually will improve your business. Because I think everybody, if they looked at it, honestly, would see that there's probably four or five spots that they could automate and save a bunch of money, and then take your time and incrementally deploy it, and then go back and do metrics, do a metrics assessment.

'cause if you're not measuring it, it's not, it's not successful. So figure out how much time does my guy do it in Excel? And then how much time do I do it after I automate work slow, right?

It, it's, it's, it's, change is painful on everybody and it's scary, right? So don't, don't boil the ocean, right? Chop the elephant up in the small pieces and eat it a small piece at a time.

Pick your number one control that you think is the most painful, right? To me, it's RA five, right? Get your security scans in, automate the outputs, generate automated workflows to repair the issues, and then update your compliance and see where you stand at the end of that.

And I think you're gonna find that you saved a bunch of money on your security team, your compliance team, and your operations team, all of which has to touch that workflow at one point or another. All right, folks, you heard and hear words to live by it. If it's not fun, go find a machine to do it.

Hey Dale, thanks for being on the show, Michael. I appreciate the invite. If anybody has any questions, happy to answer 'em.

All right, back to you guys in the studio.