Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Bill Dunnion on the push for transparency in security breaches
Guest:
Bill Dunnion
Published:
Updated:
Duration:
30 min
Episode summary
Bill Dunnion, chief information security officer at global telecommunications company Mitel, is well-versed in the critical nature of telecom infrastructure and the devices that support it. He’s also keenly aware of how his role as CISO is under increasing scrutiny from regulators around the world and in Canada, where Mitel is based.
In this episode of WE’RE IN!, Bill expresses skepticism about AI, preferring the term “machine learning” for most current applications, but he acknowledges its potential benefits, such as improving threat detection.
Listen to hear more about:
How Bill’s diverse background in telecom, IT, and security has provided him with a well-rounded perspective to approach his CISO role
Why the integration of voice, data, and collaboration tools in enterprise communications presents new cybersecurity challenges
Why security awareness is crucial for both professional and personal life
Listen to the episode
S3 E17 · Bill Dunnion on the push for transparency in security breachesWE'RE IN! Podcast · 30 min
Key takeaways
Check your D and O coverage Bill recommends CISOs ask whether their role is covered by the company's directors and officers insurance, since recent liability cases centered on how breaches were handled and communicated.
Collaboration tools blur voice and data Tight integration of chat, file sharing, and calls means adding an external party to a meeting can expose sensitive files and chat history without anyone noticing.
Know where AI tools send your data Bill cites a case where developers pasted code into a public AI tool to fix it, turning intellectual property into retained training data, and urges teams to read the terms before using such tools.
Use awareness campaigns to support budgets Sharing attack and incident numbers during Cybersecurity Awareness Month also reaches senior leaders, which makes later budget requests for tools or staff easier to justify.
Tier suppliers by risk With thousands of suppliers, Mitel focuses due diligence on high-risk partners such as managed service providers with broad access, rather than vendors with no connection to the IT environment.
Topics covered
Compliance
Industry Specific
Notable quotes
…we need security not for security's sake. In my mind, we need security to be acting as a business enabler.
…as soon as you post a picture on where you are on vacation and you're having a great time, you're also telling the world that you're not at home.
So whether a radio button needs to be red or blue is as important as making sure that you don't have cross site scripting in an app, right?
We know the bad guys are talking and sharing information, so if the good guys don't talk, we lose.
Questions this episode answers
Can CISOs be held personally liable for breaches?
Bill says recent precedent-setting cases were less about the breach itself and more about attempts to hide facts or mislead the public about its size. He recommends confirming the CISO role is covered under directors and officers insurance. Read this section
How does cyber regulation in Canada compare with other countries?
Bill notes most new legislation focuses on privacy, citing GDPR and California, and that Canada's Bill C-26 covers critical infrastructure security as well as privacy. Other laws target specific sectors such as critical infrastructure. Read this section
What are the biggest security risks for enterprise communications systems?
The tight integration of voice with data, file sharing, and email in collaboration tools. Adding an external party to a call can make it hard to restrict what they see in chats and file shares. Read this section
What does secure by design mean?
Bill interprets it as shifting security left so that security requirements are as important as functional requirements from day one, instead of finding vulnerabilities in late-stage testing and shipping anyway. Read this section
How should organizations manage supply chain security with thousands of suppliers?
Through risk-based decision making: a supplier shipping paper with no IT connection is low risk, while a managed service partner with broad access to your environment is high risk and deserves more due diligence. Read this section
About the guest
At the time of recording, Bill Dunnion was chief information security officer at Mitel, about six months into his second stint at the company after working in its product marketing team in the late 1990s. Based in Ottawa, he spent the first half of his career in telecommunications and the second half in IT security, holding sales, marketing, product management, and delivery roles, and helped kick off the government of Canada's identity and access infrastructure program. He co-founded the security meetup now called the Canadian Cyber Forum and helps with the Cybersecurity and Identity Summit and BSides Ottawa.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer, and I'm delighted to be joined today by Bill Dunnion, chief information security officer at Mitel. Bill is based in Ottawa, where he has led several grassroots cyber community initiatives we'll talk about shortly. He's been at the forefront of the world of cybersecurity for over two decades and notably helped kick off the government of Canada's identity and access infrastructure program. We'll get into some of the cyber policy issues and threats Bill's navigating as CISO at Mitel, but first, here's a quick word from our sponsor.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. synack.com/playbook.
Well, now you've been at Mitel for just about six months now. How have you found so far adjusting to the culture there and starting to build out your own vision for security?
It's just about six months now, so I'm still, in many respects, getting my feet wet. But to be honest, it's not my first spin here at Mitel. It's my second tour. First tour was back in the late nineties, second job out of school, and I was in the product marketing team for Mitel back then. Several people that I worked with twenty five years ago are actually still with the organization, so that's provided a very easy transition for me, because a lot of the people and culture that I remember from my first five year stint is still present. So that that that gives an excellent base of familiarity for me as I take on this new role.
I don't know if there is a typical path to get to a CISO, but if there is, I don't think I followed it. The first half of my career was telecom and telecommunications. So with the advent of moving to voice over IP, that gave me the introduction to the IT world and ultimately the security world. The second half of my career has been in IT security. And in the journey or the path, I've held roles in sales, marketing, product management, delivery. So it's given me a very well rounded view of how businesses and organizations operate. And all of this background and experience in my mind is going to help me be a better CISO, because we need security not for security's sake. In my mind, we need security to be acting as a business enabler. So how do we conduct business safely? The different perspectives in my background, I think, will help to contribute to that.
I think that's a great perspective. And let's talk about the CISO role for a little bit. There seems to be more and more responsibility piled on to CISOs almost by the day, but especially in recent years. There have been... In some cases, you know, we've seen in the press cases of CISOs being held liable in the event of major security incidents and just increasing demands on the business and the analysis of the risks going on. How do you navigate that?
Oh, one day at a time. Yeah, one day at a time. You're absolutely right. I think if you look at kind of the history of the advent or the, I guess, the origins of IT security, it really started off with infrastructure, right? All of a sudden, hey, our business is open to the Internet, we need a firewall, and then the bad guys leapfrog the firewalls, and then you add more pieces in. And so with that, the world really, everyone around the world is realizing that protecting information and data is everybody's responsibility. And the cases that you mentioned, yes, absolutely, in the last year or so there have been some precedent setting cases where CISOs and potentially boards of directors have been held personally liable. And I'm not the lawyer in the family, but in my view, it was less that the breach or the attack happened, and it's...
And the accountability is more around what was done to cover it up or how was that breach handled in the communication. So in both cases, individuals were found or being accused of trying to hide facts and mislead the public as to the size and severity of the breach. It's definitely stressful. One of the things that I asked, and I would recommend that other CISOs ask, is is the CISO role covered under a company's D and O, Director's and Officer's Insurance, right? It's just like if you're doing professional services, you're going to have errors and omissions insurance and coverage. In a similar way, CISOs shouldn't be held accountable for doing their job or if you're being negligent, then that's one thing. But if you're doing everything within your power to protect organization and the organization's information and data, bad things still may happen.
That's a really good point. And yeah, and the ambiguity of the cyber arena, it's so easy to just have one slip up. You could be a great defended organization, have all your i's dotted and your t's crossed. Still, I mean, breaches are gonna happen from time to time. It's a it's a it's a problem that faces any organization of all levels of sophistication and defensive capabilities. Now it was interesting you mentioned the... Holding CISOs liable. Some of the folks, you know, who did make waves in the press... Obviously, we don't need to go specifics, but there were... There was a sort of extra twist, right, of trying to brush things under the rug. And we've seen certainly... I'm based in Washington DC in The US, and we've seen a push on the regulatory side to require... Start to really require more transparency and either, you know, mandate cyber disclosure after a certain amount of time or whatnot. Now I I understand you're based in Ottawa. How does the cyber policy arena in Canada compare and contrast to The US?
Well, fair enough. Yeah. And and I may even take this opportunity to expand it. Mitel is global. We've got approximately 80 locations around the world, and each country and each region has versions or are thinking about versions of similar legislation. And so I find especially a lot of the legislation right now is geared around privacy. So I think everyone knows the acronym GDPR, so that's the European privacy legislation. If you look at segments of North America, California, at the state level was probably the most proactive state to come out with privacy legislation. Canada's got Bill C-26, which I think is in its final reading, that talks about critical infrastructure for security as well as privacy. A lot of the countries around the world, US and Canada included, are busy working on their own versions of privacy legislature.
The foundation of that is basically individuals need to be in control of their own information or data, so that everyone is seeing cases where you insert your social media platform here, you press delete and you think your account is deleted, but really the information is still there. So, being able to take ownership of your own information and data, and there's a slogan out there, or I guess an approach called Privacy by Design, that really embodies that. Blake, you sign up to a site, you have to put a whole bunch of information in. Okay, great. You should be fully aware of what that information is going to be used for. Is it going to be retained? And if you want it back, you should be able to delete it and have the comfort in knowing and the reassurance in knowing that, hey, when you press delete, it's actually gone. So that's kind of the fundamental business there.
Other legislation I find is coming out targeting specific industries or areas, critical infrastructure being the most prevalent one right now. And we see this between Russia and Ukraine, unfortunately. Your critical infrastructure, your electrical grid, your water supply, if it's subject to a cyber attack and you lose it, then it produces real harm. And so, having that duty of care and having your security programs at a respectable level or minimum requirement is definitely important. We're starting to see regulation come into play in those areas to make sure that everybody... That they have compliance now as a reason to make sure that they put the security controls in place that are needed.
It's certainly been eye opening seeing some of the really alarming cyber physical nexus threats hit, as you alluded to, the Russia Ukraine hybrid conflict. You've had attacks on the power grid, the first of their kind actually cutting out lights to people in the dead of winter before in 2015, 2016. Really frightening stuff and and ongoing today. With regard to the threat landscape for telecoms, you know, also definitely critical infrastructure in its own right, where are the biggest risks?
Uh-huh. Where are the biggest risks? And so telecommunications, I think there's two levels, right? A lot of people think about the public carriers, and so with the public carriers, that has one level of impact. I think everyone has seen outages from various major players in Canada. Rogers Communications is one of the primary carriers, and it wasn't a cyber attack, but still it was an IT upgrade issue. That whole communication network offline, we saw the impact first hand for nine eleven services, hospitals and other organizations that relied on them for public internet and public telephone communication. The public carrier space is, in my mind, critical infrastructure, and the impact of removing it is potentially catastrophic.
From a Mitel standpoint, we're more on the business communication side, and with all communications these days, back in the day, when my first tour, unified messaging I think was the label given to the precursor to what we take for granted now in Teams and Zoom and other online chatting and video sessions, right? So back then it was a novelty in just getting off the ground, and now it's expected. So for enterprise communications systems, one of the main risks in my mind is the tight integration and collaboration with data and file sharing and emails, right? So the line between voice and information and data is extremely tight or blurred. It's started to improve, but you look at Teams or some of these chat sessions, it may be your internal tool, and it's tightly integrated to both your data environment, your file storage, as well as your voice environment in order to make calls and add people.
But as soon as you add an external party to your video call, from a chat standpoint, all of a sudden it becomes very difficult a lot of times to restrict what information they see in the chat and file shares and everything else. And so accidentally you may be exposing sensitive information to outside parties without even realizing it. So similarly from an attack standpoint and an attack surface, I think this convergence of voice and data and really trying to help with seamless collaboration increases the risk for companies like Mitel that are producing and delivering products to help make collaboration communication easier.
I'd be curious to hear, where does AI fit into this mix? Because I feel like I'm constantly being prompted. I'm on my Zoom call or my Google Meet or whatever, and it's like, I have an AI summary. And I'm like, well, what if this is a sensitive call or whatnot or we're discussing some proprietary information and then the AI is spitting out some data somewhere, is soaking it up? I always worry about that. What what kind of AI trends are you looking out for, good good or bad?
Oh, alright. Fair enough. First off, I I am a self declared skeptic when it comes to AI. I'll put that disclaimer out there right off the bat. I've done a lot of research on AI and the origins, I guess, probably probably, and I know I have to get over it, but to me it's the misuse of the term artificial intelligence. For the geeks on the line here, the fellow geeks on the line, because yes, I'm one. And the origins actually go back to the Second World War and Alan Turing. So if you want to see a great documentary, quasi documentary, docudrama, whatever, The Imitation Game talks about that story. The work that Alan Turing put into breaking German codes during the Second World War, all of the algorithms that he created formed the foundation for modern AI. All the algorithms that we're using today have their foundation and origins going back to Alan's work back in the 30s and 40s.
And there's clear levels, right? And artificial intelligence is the top or the fourth level. Everything else is machine learning. And so that's really realm that we're in. The Turing test for AI is basically conduct a conversation with the entity and not be able to tell the difference between human or machine. And so that is his formal definition of AI. And so we're starting to get there. Think with the deepfakes that we're getting to that AI, but everything else is machine learning. So, sorry. I'll just get off my my soapbox. No.
I I I think our listeners will appreciate that distinction. And and, Bill, just to make sure, can you select all images here of traffic lights before we proceed in this conversation? I wanna make sure that you're not an AI talking... No. Just kidding. Do do you see on on balance Gen AI and and, you know Nope. Okay. Yeah. Helping or hurting more in the next twelve months for attack and defense?
Both. Both. I do see the huge potential for automation. Right? And if I pick on security and our SOC operators, we get thousands or tens of thousands of events a day. It's impossible for a person to look at the stare at a screen at each one of those events and be able to pick out the needle in a stack of needles. And that's where machine learning and tools can really help to sort through the noise, keep the signal to noise ratio down, right? And that's from a security standpoint. So I do see benefits to society. Dictation, whether it's a patient doctor transcription so that nothing's missed. In sales, the tools are out there to pick up on email communications and string threads together and be more accurate on quotes and responsiveness, that sort of thing. Anyway, so I do see the benefits for sure.
On the flip side, the scary part is how large language models and AI air quotes tools are being used on the hacker side. In one case, the ML AI tool was used in a capture the flag event. The Docker, even though the Docker was misconfigured, the AI model was still able to bypass the controls and capture the flag, even though the configuration shouldn't have allowed it to be possible. And there's another paper out around using large language models to take advantage of day one vulnerabilities, right? So it's known, it's announced, so now the adversaries will try to figure out how quickly can they exploit it in the field. So I think like a lot of these tools, they can be used for good or evil, depending on who's wielding them. The last point that I'll throw in there, I think, I'll throw it as a caution for organizations and people that are implementing them is, you have to understand the terms and conditions, you have to understand how the tool works.
And what I mean by that is, and it was a public case, Siemens ended up doing a public breach announcement, not to pick on them, but they had software developers that put...
it's public, so developers took code and put it into the public version of OpenAI in order to fix the code. As soon as you did that, then that code is retained as training pool data, And so all of a sudden you've got intellectual property that's now in the public domain. So you have to know where that information and data is going, who's retaining ownership of it, and actually kind of where we started with the privacy piece, can you retain information and data? Letting an AI model, an ML model loose as a tool, you do need to be cognizant of where is your personal and company information and data going, and making sure it doesn't leave the environment uninvited.
Absolutely. And it's timely that we're discussing some of these risks and opportunities because it's Cybersecurity Awareness Month. The theme this year is Secure Our World. No small task. I know you said you've got 80 locations all around, at Mitel, but to try to put Cyber Awareness Month into some maybe more concrete terms
How how can security leaders like yourself leverage Cyber Awareness Month Yeah. To potentially support security budget requests or other goals they may have?
Yeah, it's Awareness Month. Half of the organizations out there wake up and say, Oh, it's October 1. I don't know. What are we going to do? And the other half wake up and they say, It's November 1. Oh, rats, I missed it. And yeah, Security Awareness Month, I think it's important, and like it says, for awareness, right? Because you know the bad guys are talking all the time, and if the good guys don't talk and share information, we lose. And so Security Awareness Month is great because it's basically an opportunity to talk about things that everybody needs to know. One of the best, I think, reasons for it is security impacts you not just at work, but it impacts you as much or even as more so at home, right? And a lot of the tips and tricks and a lot of the things that we try to in the basic security hygiene we try to bring into play in the office will also benefit you at home.
Like one simple one, someone actually stopped me when they saw me in person and said, Hey, I never would have thought about this until you mentioned it. Everyone loves posting pictures. Apparently it's not possible to eat a meal without posting a picture of it first. But as soon as you post a picture on where you are on vacation and you're having a great time, you're also telling the world that you're not at home. And all of a sudden your house is potentially vulnerable. So there's unintended consequences. The other thing I think, and you talked about budgets and what other benefits, it's pretty much standard across the board. All companies' security departments are fighting for budget. If a company has a chance to spend a dollar to make 10 in sales, or spend a dollar to help protect, they're going to spend a dollar to make more revenue, right? And so awareness can actually help to increase demand within a company or an organization, or highlight deficiencies.
Highlighting, Hey, we've had this many attacks, or We've stopped this many, or Here's a number of incidents that we've actually had to address, which is just general good information and insight for people in the company. When in doubt, don't click this. But then when you translate that message, the company officials and the senior leaders are also getting these communications and emails. And so when you bring it up again at budget time or if they get a more detailed report on some of the incidents, then it's like, Oh yeah, I'm sorry you were talking about that before. Why weren't you stopped? And they say, Well, we could benefit by having this tool or that tool, or we didn't have enough people to review all of the alerts, right? You could use awareness to increase visibility of your efforts, the security department efforts within the organization. And it should be able to pay dividends again when you start to ask for important additions to your program.
Yeah, and it's too often that security is viewed as kind of a cost center. To your point about 10x ing your investment in sales or whatnot. It's like, why why allocate that? I'm speaking generally, of course, not about Mitel. Why allocate this towards security? And so, yeah, any tool, whether it's Cyber Awareness Month or what have you, to reframe that conversation is definitely helpful. I I wanted to touch on some remarks by Jen Easterly, head of the US Cybersecurity and Infrastructure Security Agency. She's been leading something of a a secure by design push, she's calling. I know you mentioned privacy by design earlier. And she said, quote, we don't have a cybersecurity problem. We have a software quality problem, end quote. What are you what are your thoughts on that?
I think it's a wonderful quote because it's... It puts things into perspective. And the whole concept around security by design is really trying to shift the problem left. And if you think about the way things work today, quality testing started off as being at the end of the development cycle, So you've pushed it through, you've finally got your code ready to release, and the product ready to release, it's going through the final testing, user testing, etc, and then after it's all wrapped up, and then it goes to the quality people, and then they find something. And while nobody wants to go back and open the code, you're already late, the train's left the station, we'll deal with it later. And then the next thing you know your product ships with a vulnerability. So security by design, the concept in my mind, the way I interpret it is the security requirements should be as important as the functional requirements of whatever the product you're building.
So whether a radio button needs to be red or blue is as important as making sure that you don't have cross site scripting in an app, right? Or that you're asking for MFA, etcetera, etcetera. So build the security requirements in from day one, and make sure that the security requirements are as important as functional requirements. That's really the the founding principle behind security by design.
And that's that's all fine and good for shipping your own products and, you know, your own code and with your own teams. Now you've spoken about supply chain security, which throws a whole another wrench into the works, I should say. Yeah. What is the main challenge as security leader with effective supply chain side
It just seems so overwhelming to me when you talk about third party, fourth party, down the line, suppliers to the suppliers. Who has Log4j in their code? Who doesn't? Who's go... It's just as, like... You could just your head could explode.
Absolutely. Yeah. Line of sight. I mean, it's tough. Right? It's... Anything can be done given two things time and money. And so both time and money are limited. So how much can you do with with supply chain? And actually tying it back into into regulations, France has just released, I believe, or about to release legislation around disclosure for building products. If you think about, there have been a couple of products out there, high profile breaches, where the actual source code or the product had malware introduced to it or backdoors introduced to it, then it actually then exposed every one of their customers. There is legislation in France, and I'm sure other countries will follow, where it says, hey, as soon as you're aware that there's a vulnerability in the product that you built that potentially puts the users of that product at risk, you need to notify and be public about it. So when it comes back to what are the challenges you're facing is the level of information.
How many suppliers does an organization have? And in Mitel, I think it would be measured in the thousands. How do you ask all of the right questions? How do you know you're getting all of the right answers? How do you catalogue and retain all of that information? Again, it comes down to I'm a big believer in risk based decision making. And so if somebody's shipping you pens and paper and they don't have any connection to your IT environment, then the risk is going to be pretty low. If it's a managed service partner and it's a SaaS service and they are doing second, third party support for you and they are in your environment regularly and have access to a lot, basically the full domain, then that's a high risk and you want to make sure that you focus on the higher risk suppliers and partners and vendors. Do the due diligence to try to stay safe.
Absolutely. I guess it all comes down to prioritization. Flipping back to the micro level, you've worked at the grassroots level, especially in the Ottawa security community as I understand it supporting that. What can you tell me about that experience and what's coming up for you locally?
Oh, that's great. So, yeah, so geez, seven years ago, I accepted a cold call invitation from someone who's now a dear friend, and at the time he was doing multi factor authentication. He was with a multi factor authentication company, and so I was waiting for the sales pitch, and over a cup of coffee we were talking about everything except his product, the topic of different meetup groups and security talking events came up and how we were lamenting the fact that there weren't many in Ottawa and the ones that were here were pay to play, and then you got to see the same 10 people every month. So we started off a security meetup group, and it's now called the Canadian Cyber Forum. So over 2,500 people have joined us over the years. We meet monthly and a spin off from that is the Cybersecurity and Identity Summit, which is coming up on its fifth year of being in existence, so a cyber tradeshow here in Ottawa.
And I'm also helping out with BSides Ottawa, which is going to be live late November. And so I find it very rewarding giving back to the community. I think I used one of my taglines earlier: We know the bad guys are talking and sharing information, so if the good guys don't talk, we lose. And that's really the main reason why I've been so active in trying to promote forums and environments where like minded people can get together and share ideas.
That's a really good point. It is the sense of community in the cybersecurity industry. Honestly, it's what drew me to the industry initially as well. You really see it and obviously that that only is sustained as long as there are folks such as yourself really working to make that community as active and as communicative and collaborative as possible, which is great. Now, finally, this is something that we ask of all our guests in the podcast, and that's the the fun fact question, if you will, or what's something that we wouldn't know about you, Bill, just by looking at your LinkedIn profile?
Oh, fair enough. So I heard this one liner, a couple a couple days ago. So I'll start with that as a teaser. I said, I I wanted to be a baker, but I couldn't make enough dough.
Yeah, yeah, yeah, yeah. Well, don't get me started. So something... So the high school I went to just closed down. There's a super school being built, and so all the students are moving over. So when they took it down, someone that was there took a picture of a list of all of the record holders school record holders in track and field on the wall. So they took a picture of it and sent it to me. With the school no longer there, apparently I am a record holder in the 400 meter hurdles and the senior 110 meter hurdles. Yeah, so no one can take those records away from me because the school no longer exists.
Wow, that's impressive. Yeah, and those are tough. You're already running 400 meters. Why you gotta put hurdles in there? I mean, that's just... That's that's a lot.
I don't know about that. Well, thanks so much for joining me on the podcast, Bill. Great to have you, and really appreciate your insights into your CISO leadership at Mitel.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
