Podcast: Play in new window | Download
Thank you for reading this post, don't forget to subscribe!
Subscribe: Apple Podcasts | Spotify | Amazon Music | Android | Pandora | iHeartRadio | Podchaser | Email | TuneIn | Deezer | RSS | More
Navigating the Evolving Landscape of Cybersecurity: Insights from Tammy Klotz
In the latest episode of “Leadership Powered by Common Sense,” host Doug Thorpe delves into the critical and ever-evolving field of cybersecurity with industry expert Tammy Klotz. Recently named one of the top 50 women to admire in cybersecurity, Tammy shares her extensive experience and insights on the sophistication of cyber threats, the importance of training and awareness within organizations, and the pivotal role of leadership in managing cybersecurity risks. This blog post will break down the key themes and actionable advice from the episode, providing valuable guidance for listeners and readers alike.
Tammy Klotz’s Career Journey
Tammy Klotz’s career in cybersecurity is a testament to the importance of adaptability and continuous learning. With over two decades in various technology roles within IT, Tammy’s journey took a pivotal turn when she was approached to join the internal audit function of her organization. Initially hesitant, this role allowed her to gain critical insights into what matters to a board of directors and the significance of cybersecurity in a publicly traded company. Her leadership in the first cybersecurity program assessment marked her entry into the cybersecurity realm.
Tammy’s career progressed as she took on the role of Chief Security Officer (CSO) in three different manufacturing companies. Her unique blend of business understanding and audit background has been instrumental in her success, demonstrating the value of diverse experiences in cybersecurity leadership.
Evolving Cyber Threat Landscape
The Unpredictable Nature of Cyber Threats
Tammy emphasizes the unpredictable nature of cybersecurity threats, highlighting the challenge of identifying risks that organizations may not yet be aware of. While known vulnerabilities can be protected, the unknowns pose a significant risk. This uncertainty is compounded by the rapid evolution of technology, particularly with the rise of artificial intelligence (AI).
The Dual Nature of AI
AI technology presents both opportunities and risks. On one hand, AI can enhance business operations through high-speed analytics, pattern recognition, and predictive insights. On the other hand, it introduces new risks if not managed properly. Tammy warns that proprietary and confidential data could be inadvertently exposed to a global audience if organizations do not implement stringent controls. This highlights the need for a balanced approach to leveraging AI while safeguarding sensitive information.
Email and Phishing Schemes
Email remains a common attack vector, with phishing schemes becoming increasingly sophisticated. The rise of AI has enabled bad actors to craft emails that appear legitimate, making it more challenging for individuals to discern threats. Additionally, the emergence of deepfake technology poses new risks, as it allows for the imitation of executives, complicating the verification process for employees.
Data Protection Strategies
A foundational element of securing an organization in the age of AI is having a solid data protection strategy. Tammy discusses how many organizations struggle with immature or nonexistent data protection frameworks. She stresses the importance of classifying data effectively to ensure that AI and machine learning models can access and utilize information appropriately. This classification is crucial for preventing data exfiltration, where sensitive information could be exposed unintentionally.
Training and Awareness
Making Cybersecurity Training Personal
Tammy advocates for making cybersecurity training personal, as individuals often encounter phishing attempts outside of work, affecting their families and friends. By connecting the training to their personal lives, employees are more likely to understand the importance of vigilance. This approach not only enhances their awareness but also fosters a culture of cybersecurity within the organization.
Continuous Education
Cybersecurity training should not be a one-time event but a continuous process. Regular updates and refresher courses are essential to keep employees informed about the latest threats and best practices. Organizations should invest in comprehensive training programs that cover a wide range of scenarios and provide practical, actionable advice.
Communicating Cybersecurity Urgency
Translating Technical Jargon into Business Terms
As a CSO, Tammy emphasizes the importance of translating technical jargon into business terms when communicating with stakeholders. Effective communication depends on the organization’s culture and the credibility established with peers. When discussing incidents or new technologies, Tammy focuses on highlighting the potential impact on revenue, production, and overall business operations.
Engaging with Cross-Functional Teams
Tammy regularly meets with a cybersecurity steering committee composed of cross-functional representatives to build awareness and understanding of cybersecurity issues. She also engages with the executive team, providing high-level updates on cybersecurity metrics and incidents that may have broader implications for the organization. This collaborative approach ensures that cybersecurity is integrated into the overall business strategy.
Leadership Style Evolution
Acting as a Risk Advisor
Tammy’s primary responsibility as a CSO is to act as a risk advisor to her peers and the executive team. This involves understanding their business objectives while ensuring the organization remains secure. Active listening has become a crucial part of her communication style, allowing her to interpret and respond to the needs of her colleagues effectively.
Creating Clarity Around Cybersecurity Risks
Tammy emphasizes the importance of creating clarity around cybersecurity risks, helping stakeholders understand the potential consequences of their decisions. Transparency regarding the organization’s cybersecurity posture is essential, ensuring that everyone is aware of the risks and challenges faced.
Board Responsibilities and Cybersecurity
Increased Frequency of Updates
The frequency of updates to the board has increased, with many organizations now providing quarterly reports on cybersecurity initiatives and incidents. This shift reflects the growing recognition of cybersecurity as a critical business risk. Boards must be informed and engaged in discussions about cybersecurity risks and strategies to ensure that organizations allocate the necessary resources and attention to protect against evolving threats.
Debate on Cybersecurity Experts on Boards
There is an ongoing debate about whether boards should include cybersecurity experts. While some organizations have made this a requirement, others are still determining the best approach. Cybersecurity reporting often falls under the audit committee, but it can also be addressed by risk committees, depending on the organization’s structure.
Team Structure and Resources
Collaboration with Other Departments
Tammy’s cybersecurity team consists of fewer than ten dedicated security professionals in a $3 billion company with 3,500 employees. Despite the small size, the team covers a broad range of responsibilities, including cybersecurity operations, architecture, governance, risk, compliance, identity management, and training. Collaboration with other departments is crucial to enhance the organization’s overall security posture.
Conclusion
This episode of “Leadership Powered by Common Sense” provides valuable insights into the world of cybersecurity through the lens of Tammy Klotz’s experiences. The conversation highlights the evolving nature of cyber threats, the importance of training and awareness, and the critical role of leadership in managing cybersecurity risks. As organizations navigate this complex landscape, effective communication, transparency, and collaboration will be essential in fostering a culture of cybersecurity awareness and resilience.
Listeners are encouraged to explore the video version of the episode on YouTube and engage with the content by leaving comments and sharing their thoughts. Doug concludes with a motivational message, urging everyone to take proactive steps in their cybersecurity efforts and make it a great day.
Guest Bio
Tammy Klotz is a vibrant and accomplished executive with over three decades of diverse experience in the manufacturing industry, specializing in cybersecurity and transformational leadership. She offers keen expertise in navigating mergers, acquisitions, and divestitures within both publicly-traded and privately-held companies and is seasoned in security, risk, and compliance leadership. Tammy brings a dynamic and positive approach to problem solving, excelling in simplifying intricate IT and cybersecurity concepts and facilitating pragmatic, non-technical dialogues that resonate with business executives. She is recognized as a strong, knowledgeable, thoughtful security executive who excels in public speaking and thought leadership, striving to empower others through knowledge sharing.
Tammy currently serves as the Chief Information Security Officer with Trinseo. Tammy joined Trinseo in October 2023 and is the process of defining the cybersecurity strategy for her new company. She intends to improve the overall security posture of the organization with a focus on securing production operations across a fleet of 24 manufacturing sites and 11 R&D facilities.
Additionally, she has goals for increased cybersecurity training and awareness for the 3400-person workforce as well as building a more robust third-party risk management (TPRM) program for Trinseo.
Prior to Trinseo, Tammy served as the Chief Information Security Officer with Covanta Energy. Here, she successfully executed a $6.2MM Secure Operations project, enhancing the cybersecurity of the organization’s Waste to Energy facilities. This achievement involved a significant collaborative effort between the IT and OT teams, and Tammy was recognized with the CEO Excellence Award for the accomplishment. In late 2020, she presented the organization’s cyber risk profile to the Board of Directors, marking the first such discussion since 2018. Tammy obtained consensus to prioritize the overall improvement of the company’s cyber hygiene and spearheaded the development of a program to enhance the cybersecurity of Covanta’s operating facilities. After Covanta’s acquisition by a private equity firm in November 2022, Tammy partnered with the CIO to
address infrastructure challenges and secured substantial funding of over $10 million for a complete infrastructure refresh and the replacement of legacy network equipment in Covanta’s facilities.
During her tenure as the Chief Information Security Officer for Versum Materials, Tammy was a member of a high-performing IT team to establish a green-field IT environment. Within 18 months, she securely transformed numerous sites, manufacturing networks, endpoints, and applications, including SAP S4 HANA, with a strong focus on security. Her forward-thinking approach,
including the adoption of a cloud-first and BYOD strategy, positioned the organization to a level ahead of its time.
As a Global IT Leader and Head of IT Audit during her 20+ year tenure with Air Products and Chemicals, Tammy notably established a collaborative and proactive partnership between Internal Audit and IT. She also led the first-ever Cyber Risk Assessment of the company’s Cyber Program, identifying potential risks and implementing appropriate mitigation controls.
Additionally, Tammy revitalized the Global Audit Team Meeting, introducing engaging business and industry-focused learning sessions and teambuilding activities to energize and empower team members.
Tammy’s leadership style is characterized by her genuineness and authenticity. An extrovert, she thrives on the energy derived from partnering and engaging with people. Her approach to leadership is inclusive, promoting an open-door policy that encourages collaboration and input from team members at all levels.
In addition to her professional experience, Tammy has a bachelor’s degree in Math, Computer Science and Secondary Education, as well as her CISM, CISSP and CRISC certifications. An active thought leader, she is involved in several professional organizations, including serving as President of the Lehigh Valley Chapter of Cloud Security Alliance, Membership Chair for WiCyS – Delaware Valley, Governing Body Member of both Evanta and Cybersecurity Collaboration Forum, Infragard,
ISC2 and ISACA. In 2023, she was honored with the Covanta CEO Leadership Award and in 2022, she was named a Top 100 CISO by Cyber Defense Magazine, acknowledging her outstanding contributions and leadership in the industry.
Link https://www.linkedin.com/in/tammyklotz/
Doug Thorpe Social Media:
Doug is a coach for CEOs, Business Owners and Senior Leadership Teams. He has over 30 years of leadership experience. He is the president & CEO of HeadwayExec, LLC and the Doug Thorpe Group. Doug is also a podcast host.
He helps owners understand the ways they need to reshape their thinking and attitude to make a successful break through the wall.
Ready to leave the corporate grind? Visit HeadwayExec to learn more about entrepreneurship through acquisition.
LinkedIn: https://www.linkedin.com/in/dougthorpe/
Doug Thorpe Website: https://dougthorpe.com/
Podcasts: https://podcasts.dougthorpe.com
Twitter: https://twitter.com/dougthorpe_com
Doug Thorpe Facebook: https://facebook.com/headwayexec
Instagram: https://instagram.com/dougthorpe_com
YouTube: https://youtube.com/@dougthorpe
Buy a Business: https://headwayexec.com
