Approaching Security from a Non-technical Background

0:00:02.2 Max Havey: Hello, and welcome to another edition of Security Visionaries, a podcast all about the world of cyber, data, and tech infrastructure, bringing together experts from around the world and across domains. I'm your host, Max Havey, and today we're talking about what it means to be someone from a non-technical background in an increasingly security-focused role with our guest, Savannah Westbrock, VP of Innovation at Coegi. Savannah, welcome to the show.

0:00:24.4 Savannah Westbrock: Thanks Max, this is exciting.

0:00:27.3 Max Havey: Absolutely, and you know, before we jump in here, I feel like I should note, Savannah and I have been friends for well over a decade at this point. And both come from relatively non-technical backgrounds as we both studied at the University of Missouri School of Journalism and wound up in roles that are way more focused on cybersecurity than I think either of us really expected them to be. And so I feel like we're often outside of our jobs talking about pop culture and television and film. So it'll be interesting for once for us to really dig in and talk about our jobs.

0:00:54.5 Savannah Westbrock: Yeah, this is really exciting to see you in work mode. I was trying to think the last time we did a more work-oriented project together was probably me borrowing your econ homework and trying to group project it.

0:01:08.9 Max Havey: Yep, sounds correct. This all makes sense. But 10 years now we're both talking cybersecurity. So to jump in here, can you tell us a bit about what your role at Coegi is sort of focused on at the moment?

0:01:21.8 Savannah Westbrock: Absolutely. So I oversee our innovation discipline and for Coegi, which is a digital media and marketing agency, that role is really dynamic by design. My department is really responsible for keeping our heads up, monitoring emerging technologies, forming our agency point of view in that, advising on what our approach should be for our clients. And as you could imagine, these past few years with the increase in consumer data privacy awareness with generative AI, we've had to get a lot more technical really fast.

0:01:56.8 Max Havey: Absolutely. As that heat has kind of turned up on you, how did you sort of see your role becoming more security focused? Were there any specific signs that kind of jumped out at you as you started to see that becoming more of a focus for your role?

0:02:09.1 Savannah Westbrock: Certainly. Initially, I would say we were really focused on protecting our clients' data. We work against a lot of regulated industries like finance, healthcare, housing, things where individuals' personally identifiable information has to be truly stewarded appropriately under lock and key. But gradually, especially in the past year, we've been really focused on educating staff around generative AI and what they can and can't do in that realm to be, you know, responsible ethical users of that tech. So that has involved me working much more closely with our IT department, seeking out more educated individuals in that specific knowledge area. And just, you know, honestly putting my own ego aside, knowing what I do and don't know, and trying to find the people who have that knowledge that can bridge the gap.

0:03:01.3 Max Havey: Definitely. And I mean, that takes a lot to just becoming more literate in security. I know when I started at Netskope six years ago, I basically knew nothing. And then I think for the first month, I was digging into certification level textbooks to just learn all of the basics. What did you sort of start doing to get more literate around the world of like cyber security as it related to your role?

0:03:24.1 Savannah Westbrock: Well you know that's where our respective journalism backgrounds I think really come in handy here, right? We have to be comfortable saying, hey, I don't know this but I am responsible for figuring it out and knowing how to communicate it to individuals who definitely don't have the time to do that dense deep research. So certainly a lot of reading a lot of podcasts like you mentioned, but also candidly just having conversations with people whom I trusted to know what I needed to know and where I needed to apply my expertise as well. So looking across, you know, an innovation discipline, a lot of that involves things like organizational change management and goal setting, risk management, and de-risking wherever we could. Oftentimes, when I'm speaking to those highly technical people, they do take some of their knowledge for granted, especially if someone's been working in cybersecurity or tech for 10, 20 years, they're not necessarily thinking about the day-to-day staff at a marketing agency. And that's where I come in and try to help them identify some of those risks that they maybe haven't been thinking of.

0:04:31.9 Max Havey: Certainly. I think it's helpful, speaking from experience, looking at it from a non-technical perspective, being able to be the person to say like, okay, in English, Egon, like how can we best contextualize this sort of thing?

0:04:43.1 Savannah Westbrock: My go-to example when I'm working with our IT folks is to remind them that we had some coworkers in our office in Minnesota leave their laptops in their cars overnight and not realize that that was a problem. Right? So certainly when you're setting policies, when you're setting organizational goals, you have to be representative of the folks who are a little bit more knowledgeable, but definitely you have to watch out for those individuals who are just going about their days and they don't have this constant running security mindset.

0:05:15.4 Max Havey: Certainly, and because there's so many elements to it that you just don't think about, from the data security, information security, to the actual just kind of like OpSec of it all, don't leave the door open for people that are coming in, watching out for social engineering and spam emails and things of all that. A lot of things you don't necessarily think of as security very quickly kind of all like land in that bucket.

0:05:34.9 Savannah Westbrock: The password on the sticky note still is something I see every now and then.

0:05:39.4 Max Havey: It's good when you have a bad handwriting though so then no one can actually tell aside from you.

0:05:43.5 Savannah Westbrock: There you go that's a new security strategy, you're a pioneer. Chicken scratch password sticky note. It's great.

0:05:50.2 Max Havey: Well in that same sort of vein here, what are some of the challenges that you really run into as someone who's non-technical and has more of a security purview now, are there any like major challenges that have jumped out at you beyond just educating people and helping them better understand what that security looks like?

0:06:07.8 Savannah Westbrock: Yeah, I think my best example to answer this question is going to be to zoom in on GenAI for a moment, especially in the marketing world. It has dominated the conversation for the past two years. And we have some people who are those AI evangelists, they're very eager to get started, they're rushing forward and ahead. And then we have some people who are really hesitant, right? They're not ready. They don't want to learn a new skill or they are caught up in the cultural conversations surrounding AI and they are intimidated by that. Our role typically is bridging that gap. Oftentimes that involves having uncomfortable conversations with executives about, hey, I know you're eager, I know this is a big opportunity for us, but we are also opening ourselves up to a type of risk that we've never experienced before. So it's going to take that collaboration between those highly technical individuals and folks like myself who have a fair amount of technical knowledge but certainly don't have a formal academic background in this area. And that collaboration has really been successful for us thus far, you know, taking more of a council approach, taking that kind of human centric de-risking approach and finding the ways to have that security mindset be something that's a little bit more the forefront of everyone's minds and framing how they view evolving technology through that lens.

0:07:33.3 Max Havey: Absolutely. I think human centric is a really good way to describe that. The way our current CISO kind of described it a couple of years ago is to use a pop culture reference. In a Jurassic Park life finds a way kind of thing. If you're blocking people, you're stopping them from using these tools they want to use, they're going to find a way around it either way. So you may as well find a way to best enable them and have those hard conversations now so that you're not having kind of oops moments six months from now.

0:07:56.3 Savannah Westbrock: Yeah. And to that point, we've certainly encountered some folks who were saying, Hey, as an organization, I think we're moving too slowly. So I just went ahead and got my own ChatGPT pro subscription. So now you have like a shadow IT problem. And especially if they're using, you know, our client data is a huge risk. Thankfully we haven't had anyone go that far. We at least got ahead of it enough to emphasize, hey, client data is absolutely a no-no here. But even our own softer intellectual property, things like our media strategies, or even the storyboarding that we're doing in tandem with creative agencies, we wanted to make sure that we have those protocols, that guidance, that governance in place for people. So that even if you are going rogue, if you are life finding away about it, you have that baseline level of education and we at least know you're thinking of it. That is really our first challenge is just making sure people are pausing and being intentional with their AI usage.

0:09:00.3 Max Havey: Absolutely. In this case, the client data being the proverbial T-Rex in the cage, you don't want to turn off the fence lest it get out and that causes a much bigger problem.

0:09:09.5 Savannah Westbrock: Correct. I would love to find a way to make like a feeding it a goat versus hunting reference, but I'm just not there. I'll come back. I'll leave that in a comment maybe.

0:09:18.5 Max Havey: I was gonna say, we'll circle back to it. We've got time, so there are more questions here. To move on from there though, is there anything that you are prepared to admit still makes you feel out of your depth when it comes to security as you've been taking on these responsibilities? Are there still areas that you feel that you want to get better at? Or you feel like you're just still trying to wrap your brain around?

0:09:38.2 Savannah Westbrock: No, all the time, every day. Every time we have a conversation, especially around governance, our company is like SOC 2, type two certified. So I've had to brush up against that every now and then. And translating that to, like you said, plain English is often a huge challenge. So it takes a lot of patience. It takes, again, a lot of putting your ego aside and being comfortable admitting, hey, this is not my area of purview. I'm going to have to rely on those external partners, that internal expertise wherever it may exist, and just make that information accessible to people. That is truly my biggest challenge each day is being almost that translator between those really technically minded individuals and then our executive decision makers and our everyday staff who need to know these things.

0:10:31.1 Max Havey: And that sort of translation is key to being the person that has to transmit that information as well. Translating and transmitting wind up being the key link between those two sort of disparate crews.

0:10:43.4 Savannah Westbrock: And it also is something that I have to make sure I'm really confident in because I am the one responsible for setting a lot of our agency goals around these challenges. And to set a measurable and attainable goal, you have to understand what's possible and what's not, what is going to be something that I can delegate to individuals or ask them to pay attention to and track. It's really, you know, representative of that larger organizational challenge where I think we're beyond the state of having one or two internal tech guys, right? We're living in a world where everybody is going to have to have that higher security familiarity and set those types of goals, have those types of internal staff development priorities.

0:11:29.9 Max Havey: Absolutely. And that's the thing that I think, you know, we've been talking about in some other conversations, the way that almost every team now, regardless of the business unit they're a part of is a data team now. They are a team that wants to use large amounts of data, often with tools that, you know, may not always be secured. And you want to make sure you have the proper governance guidelines, data protection. You want to make sure that everything is locked down as best as possible, so none of that leaks out.

0:11:54.4 Savannah Westbrock: Yeah, we've had to develop an entirely new vetting approach to acknowledge the fact that there are startups crawling out of the woodwork every day, emailing whomever they can find at our agency and saying, hey, let me get in front of you, right? So that consistency, that governance again, is what we're responsible for. But to your point, you know, we're not the tech people. So we have to do that work in tandem with the individuals who know those risks. And then we can balance out the more human-centric risks alongside that.

0:12:26.7 Max Havey: Absolutely. And to change yours here slightly, you know, is there anything that you've learned that you found particularly interesting as you've sort of dove directly into the world of cybersecurity from your perspective?

0:12:41.0 Savannah Westbrock: I have most been interested in the areas where legal overlaps with a lot of these concerns. Shifting away from AI, another major conversation these past few years in marketing has been that consumer data and the cookie list future you've probably heard a couple times, so that shift away from more probabilistic third-party data to individual brands, advertisers, companies owning their own first party data and still finding a way to make it actionable for some of their marketing goals. Things like data clean rooms and everything Google has started, stopped, attempted and given upon is an area where my department is responsible for owning our agency point of view on that. So that is another area where we've had to understand what is the regulatory landscape, what is the legal landscape, and where does that intersect with our own priorities for our security, our data management, and then what is our responsibility as the stewards of that data, as opposed to the clients who own the data. And a big part of that has been educating our own clients on, no, you should actually be the ones owning this data. Like you really don't want our hands in it. So we're here to be that guiding light. But again, it's an agency paradigm shift. It's something that 10 years ago, people were not discussing. So we're gonna have to evolve and see where it goes from here, but it's certainly an area where we've had to keep and maintain that focus, even as it changes every six or eight months.

0:14:16.6 Max Havey: Certainly, and I think it's interesting that you noted the idea of being a journalist or having that journalism background, helping with becoming more literate in all of this. But it's especially interesting because you are wearing so many different hats in all of this, where it is the contextualizer hat, the person that's like a policy analyst, the person that is looking into regulations, that's looking into all of these different things that all kind of need to come together, that you need to synthesize into a thing that is digestible for the layman and for like the hyper-technical folks.

0:14:44.3 Savannah Westbrock: Absolutely. I think whether or not you became a practicing journalist, like having that background really speaks to the fact that we get bored if we don't get to explore enough. I can't do the same thing two years in a row. I have to have that dynamic challenge to keep forward and stay motivated. And this is an area of, you know, the digital world we live in where it's always evolving and it's always changing. And it gives you so many opportunities to reach out to other people, pick their brains, have conversations like this one. Find those experts you can rely on.

0:15:19.9 Max Havey: Absolutely. A retired professor for the Missouri School of Journalism, who's a family friend of mine, once noted there's no profession quite like a journalist where you just get to ask interesting people about their lives all day. And that's kind of what this is. It's just specifically in the world of cybersecurity and related to data. But even so, still very interesting. And there are still so many worlds to explore there that I'm still interested by.

0:15:43.3 Savannah Westbrock: Yeah, even on the days when it makes me want to rip my hair out because, you know, the tech headlines of the day are driving me crazy. And I know I'm going to have to explain them to someone who's starting from that zero level of knowledge. Having those dependent folks to call on, it really saves you at the end of the day.

0:16:01.3 Max Havey: No doubt. Well, to change gears here again, what sort of advice would you give to folks who are finding themselves in a similar position to you where their role is becoming more security focused, despite having less of a scholarly technical background?

0:16:17.0 Savannah Westbrock: Yeah, I think I've touched on this a couple of times, but I would just underscore the importance of admitting what you don't know and not being afraid to say, hey, I need help, right? That is usually the first challenge, I think, especially for folks who work in an adjacent digital realm, like digital marketing. Often you have this pressure to be the expert on behalf of your client. Sometimes you have to fake it till you make it, but the best thing to do is just to be candid, be upfront, say, hey, I don't necessarily have an answer in my back pocket for something that's technical, but I know who to call. And I will make sure to give you that information in a way that's digestible and relevant for whatever challenge is in front of you.

0:17:00.6 Max Havey: Definitely, Knowing a guy for every situation you wind up in, I think, is kind of invaluable, regardless of what industry or business unit or domain you're working in.

0:17:10.1 Savannah Westbrock: Well, and that's where I think not challenging yourself to do everything is pretty key. Finding those opportunities where a beneficial partnership, and especially if you can find something that's going to be long lasting, it gives you that emergency break glass solution where it's like, hey, this is not an area where I know but I can even be the handshake or just the facilitator to find the people who can answer your question or who can address this challenge with you.

0:17:41.1 Max Havey: Knowing that you're not in any of this alone and this is the thing that I think a lot of people are kind of maybe they're also sort of faking it till they make it or they're trying to find their way around it but reaching out and saying you can't do everything here so you may as well find the people who can best communicate that to you so you can do better is I think a lovely way to put that everybody needs a council of advisors for every problem. You can't do it alone especially in technology You would go mad trying to ingest all of the changing information and doing it all yourself is just not possible. It touches too many branches of life at this point.

0:18:16.7 Max Havey: Definitely. It's difficult to be in a world where tech is evolving so fast. And there are constantly new tools popping up every day. And I know I, myself, can be a little reluctant to using a new tool just because my old tools have worked just fine. But I think knowing that there's a way to go about it in a safe way, in a way that I can experiment with it and find ways to make it work is really, really helpful and makes that, I think, a little bit less scary and a little bit easier to sort of comprehend.

0:18:43.9 Savannah Westbrock: And that's a huge part of what we do at Coegi on the innovation team. We emphasize to people, we want you to experiment with these things. Our job on behalf of our clients is to bring them those sort of cutting edge solutions. But our key word is intentionality. We want smart, intentional experimentation. And sometimes the easiest way to do that is to just set goals up top. Even if they are pie in the sky, super hypotheticals, and you just want to see what's possible, if you write something down and commit to it before you start experimenting, it gives you a little bit of a narrower scope or at least some goalposts that you're aiming toward. And then it allows you to scale it beyond individual experimentation and tap a more representative sample of the staff and the different types of backgrounds we have across our agency to say, hey, how else can we address your questions? Are there things that we have not considered? Is this a place where we do need those technical background individuals, or is this a place where we need to talk to someone who can barely use a calculator? We really have to full scope all of those challenges so that our experiments lead us to the best solution at the end.

0:20:00.3 Max Havey: Certainly, And it's a thing where, especially with a GenAI app, you know, it seems like it could do truly anything that you want it to do. Anything you feed it, it's going to spit you something back. And that is overwhelming and to some, a little bit scary. And I think you sort of don't know until you try with a lot of it. And asking the right questions and knowing what questions you can ask and maybe breaking some things along the way, I think helps you better understand like, oh, we've taken the complete roundabout path to get to this thing. We can just ask it something much simpler and get a better result.

0:20:34.2 Savannah Westbrock: Well, and GenAi again is such a perfect example here because I think, you know, culturally, a lot of people have that anxiety because they're reading in the news, hey, AGI is imminent, you know, Skynet's coming. But the folks who are actually using GenAI every day are like, no, you can gaslight this thing into a point of confusion that it turns into. Like the Pokemon hurting itself in its confusion, that happens to us every day. So we give people that guidance of how to actually work with it. And in doing so, I think we reassure some of those individuals who are, you know, tracking the headlines and not necessarily having the personal experience and getting really anxious about it. And that's what shuts down that experimentation before it even begins.

0:21:20.6 Max Havey: Absolutely. That's such a lovely way to put that. I really liked that a lot. Near the end of my questions here, what excites you most about your future in a more security oriented role? What are you most excited by as you continue to grow in this role?

0:21:34.6 Savannah Westbrock: On a personal note, taking more of the security mindset has helped me clean up a lot of my own personal like household, you know, topics, budgets, et cetera. I think I was a little fast and loose with my personal data these past five years. I think we all heard.

0:21:50.5 Max Havey: Among us wasn't.

0:21:51.4 Savannah Westbrock: Yeah. It wasn't entirely my fault, but it is now my responsibility to clean it up. And that touching that in a work sense and being able to call my parents and say, hey, I've got a list of stuff for you to check up on. I mean, that's not a work answer, but I think it's a way that being more security minded in your work does affect your life more broadly. It can help protect you, protect your loved ones, protect your data. All of those things are gonna be more and more important as we do shift into this world that's sprinting ahead with AI.

0:22:24.9 Max Havey: Well, I can see our producer is waving at me through the virtual window here that we're about at time here. So I just want to say Savannah, thank you so much for joining us here today. It was an absolute joy to have you on here and I really hope we can have you back on sometime to chat some more.

0:22:38.2 Savannah Westbrock: This was lovely Max, I'd be happy too. Cheers to more security.

0:22:43.0 Max Havey: Indeed, cheers to more security. And with that, you've been listening to the Security Visionaries Podcast, and I've been your host Max Havey. If you've enjoyed this episode, share it with a friend, and subscribe to our back catalog of episodes, and keep an eye out for new ones dropping every month, hosted either by me or my co-host, the wonderful Emily Wearmouth. And with that, we will catch you on the next episode.