Human Side of Cyber Security: Q&A With CISO Chris Gay

Ignoring the human side of cybersecurity can leave organizations and customers vulnerable, as employees are often the “human firewall” and last line of defense between a sophisticated cyber-scam and sensitive systems, data and customers. The right cybersecurity education programs, however, can mitigate risk and ensure that human firewall is as strong as possible.

Chris Gay, VP and Chief Information Security Officer of Southeastern Grocers and advocate for cybersecurity education, will be leading a roundtable discussion on the topic at the upcoming Cyber Security Exchange in Amelia Island, Florida, this December 4-6. Ahead of the Exchange, we sat down with him to talk cybersecurity education and awareness, challenges to CISOs at large companies, mitigating risks associated with new technology and more.

Cyber Security Exchange: What is the most interesting aspect of your job at Southeastern Grocers? Why?

Chris Gay: Over the last few years, the grocery business has changed a lot and we constantly have to adapt our strategy to stay contemporary. We also have to look at the risks associated with those changes and the new technologies that our customers are using. The ways groceries are sold is changing, for example, Amazon’s acquisition of Whole Foods, and I’m always looking at new technologies to protect these new ways of selling.

Cyber Security Exchange: What would you say is the single most challenging part of being a Chief Information Security Officer in today’s technology environment?

Chris Gay: I really have to split this answer into two parts. The first is cybersecurity. The ever-changing threat landscape, whether it’s ransomware or phishing, combined with how spread out our people are, makes it difficult to ensure best practices are being adhered to. We’re constantly working to ensure our controls, procedures and policies are in place to respond to any kind of threat. The second challenge is finding talent. There is young talent just entering the job market, or people that are wanting to change their career paths, but finding truly skilled security professionals has been a challenge over the last couple years. When you’re in a smaller market from a population perspective but are competing with other large companies in town, it’s a constant struggle.

Cybersecurity Exchange: People are connecting to organizational networks and making transactions using more devices than ever, many of them not owned by IT, and the Internet of Things means there are more points of vulnerability than in the past. How do you strike the balance between integrating these new technologies to enhance the user experience and mitigating risk?

Chris Gay: When evaluating new technology we always start with a risk-based analysis: What’s going to be moving, where are our points of emphasis and what’s the risk if that data gets out? From there we need to ensure that we’ve got great, detailed policies in place around the utilization of these new technologies. It’s also about understanding that the end-user of that device or new technology, whoever it may be, owns that risk. We can have the best policies in the world, but it’s up to the end-user to follow the procedures we’ve put in place. We want to allow people to do their jobs well and to enjoy the experience, and we have to continue to adopt new technologies because that’s the direction of the market, but we can do so while maintaining data in the safest way possible.

Cybersecurity Exchange: What do you see being the most significant cybersecurity threats to data security into and through 2018?

Chris Gay: I really look at the threats around e-commerce, even in the grocery business. People are “clicking and collecting” and want to be able to order things online. Look at Amazon’s acquisition of Whole Foods. E-commerce may not be a specific threat, but it’s a threat target that we have to acknowledge, because in order to compete with other companies we need to have a very solid [security approach] to e-commerce approach in place. E-commerce is unavoidable; it’s on the horizon for all large retailers, so protecting it is going to be very big in 2018.

Cybersecurity Exchange: You’ll be leading a roundtable discussion on security awareness and education at the upcoming Cyber Security Exchange this December 4-6 in Florida. What do you think is the most significant cybersecurity threat that many professionals may not be aware of?

Chris Gay: I think the lack of education and awareness when it comes to cybersecurity is a threat in and of itself. [There is a tendency in the industry] to put computer-based trainings and posters in front of our people, and we lose out on in-depth, focused training on safe surfing, email best practices and more. At the company, we’ve got all the controls, the firewalls, the secure web gateways and endpoint pieces. When they go home, though, they may not even have an antivirus. Teaching people cyber safe practices is so important. If you get an e-mail saying you won the Brazilian lottery and you didn’t play the Brazilian lottery, you probably didn’t win it! If you’re a Dallas Cowboys fan, don’t create a Wi-Fi network called “Go Cowboys.” Think of something fun and more secure like “FBI Van”! Understanding these behaviors and changing these mindsets in general means safe practices at home and at work.

Cybersecurity Exchange: Do you think a senior IT executive could benefit from being a part of an event like the Cyber Security Exchange? Why have you chosen to attend?

Chris Gay: It all comes down to the networking. At this type of executive event, there’s an opportunity to network with individuals at your level. Going to conferences that have breakout sessions and things like that, they’re great…but I want my technicians to attend those types of things. [When you’re talking to professionals at your level, you don’t get down into the nuts and bolts; you talk about the things you’re actually doing and incorporating. I’ve talked to people freely about some of their ideas and [often find myself saying], “Wow, that’s pretty cool.” The networking aspect is worth its weight in gold.

Meet Chris Gay: Having joined Southeastern Grocers as Chief Information Security Officer in 2015, Chris holds nearly 30 years’ experience in information technology and security. He is currently responsible for the maintenance and preservation of the company’s information security program focused on managing threats and vulnerabilities through technology and administrative controls. He also ensures business imperatives and capabilities possess and promote appropriate levels of confidentiality, integrity and availability of information system assets. He holds a Bachelor of Science degree in computer and information systems from the University of North Florida.