Desta Bailey and Sarah Bryson - Edited Mc

Sarah Bryson: And what we found was that a good portion like. At or about, you know, half were control gaps that should have been in place for policy. So they were policy violations. So what immediately we thought is, well, if we can use this to get ahead, we're really able to help this team.

Sean Martin: Here we go, everybody. We are. It's actually the, the final, you're the last

Sarah Bryson: Okay.

Sean Martin: Final conversation. I'm recording here. Okay. At, uh, ISC2 Security Congress. It's been a great week, and I'm excited to have this conversation, uh, with Desta and Sarah from, uh, Southwest Airlines. You guys presented here this week. Congratulations on, uh. Having your presentation, your session accepted. Good stuff.

Desta Bailey: Thank you. Thank you. Appreciate,

Sean Martin: appreciate it.

Desta Bailey: It's been a great experience.

Sean Martin: Yeah.

Desta Bailey: We're happy to be here.

Sean Martin: Ah, so good to have you on. And, uh, yeah. Every, the whole conference for me is my first one, so the whole conference for me has been around education. Awesome. Right. Helping each other understand the challenges we collectively face and give people ideas of how mm-hmm. We've experienced things and done things to help others, uh, perhaps apply some of those same learnings. So we're gonna do that here with, uh, your session. Um, few quick words about your role, maybe your journey into cybersecurity, if you wanna just kind of set the stage. Sarah, start

Sarah Bryson: over. Yeah, for sure. So I've been in cybersecurity for about about 10 years. Um, I am currently working as an advisory CISO at Kudelski Security and prior to that I was at Southwest Airlines, which is. Okay. Where, um, I met Desta, we started to build our program that we've since been able to scale in different ways. Um, but when I was at Southwest, I worked mostly on the governance and risk management side, scaling that team.

Sean Martin: Okay, very cool.

Desta Bailey: Uh, so I had a bit of an interesting start. Uh, I went to law school thinking I was gonna be a lawyer, and right before I graduated I realized, wow, this is not what I wanna do. Uh, so I'm glad I spent three years doing that. Uh, I moved into the regulatory compliance space, risk management for a financial institution. Um. COVID hit. I had a lot of spare time on my hands and I got a master's in cybersecurity. Uh, so from there, that's impressive. Pivoted over into the cyber threat intelligence space. Um. And then from there moved to, to Southwest Airlines, which is where I'm at now. Um, I work on the cyber threat intelligence team There, a small team, but you know, we stay busy and help out wherever we can.

Sean Martin: Yeah, I don't think I've ever heard anybody say we have a huge team. Too many people. I don't think that happens. No luxury.

Desta Bailey: We more of us wish we

Sean Martin: could.

Sarah Bryson: You're always doing more with less

Sean Martin: everywhere. Right. Um, so give us an overview of the, the session. Kind of what was the, well, first off, what was the catalyst for presenting?

Sarah Bryson: So what we found, um, well, we kind of have very, um, complimentary backgrounds. I started on the Intel side and then moved into the governance service management space because I liked the strategy side of things. Um, and what we found when we were, um, at Southwest was that. We could get really useful, really interesting, really practical intel. Um, and we could get really interesting results from emulation. Purple team, red teaming exercises. But then it was really hard to show their value in action. So it was really hard to take those findings and then implement them into strategy and then actually action them in a way that allowed us to be dynamically defensive. Um, so we built what I would call an intel pipeline of how you can feed your Intel program into your governance first management program. So you can have, um, very curated, um, and very timely, um. Response to threat that allows you to have a more proactive security posture as opposed to being reactive,

Desta Bailey: threat informed, risk-based decision making is what we're moving forward. Uh, it's very easy to get lost in checklists and doing this because this framework says I have to, without an understanding why. Let's look at the landscape. Let's look at what impacts you as a business and how you can react, how you can allocate your resources, your priorities to what's real to you.

Sean Martin: So kind of interesting you said at the beginning. Interesting. To meaningful to actionable, I guess. Exactly. Yeah, exactly. Very cool. Um, so what prompted you to say now's the time to share this story with others and why ISC two?

Sarah Bryson: Well, I think, um, because we had developed this together and then we've kind of since gone our separate ways, we've been able to. Test what we built in a variety of different ways. So, you know, I'm able to integrate this more from an advisory CISO perspective with my clients now, and you're able to still scale the program at Southwest. So we're able to kind of have much more meaningful and much more varied insights, which we were able to show in our cases. So I think that was really what triggered us to do it now. Um, and I think we chose this conference because it, it. It was the ISC2 Security Congress for the year, and it was a time when, you know, the entire cybersecurity community usually does come together. Right. Um, you know, and I think the people and the relationships here matter, especially because, you know, cybers can be a grind. You know, we're all in this together. Right. And if we could share any piece of useful information that has been helpful for us, for our teams and our careers about this was the place to do it. Yeah.

Desta Bailey: Ultimately, there's a large population from all sorts of walks of cybersecurity that attend, but. At the crux of it, we have a problem to solve. We are defending our organizations, we're trying to increase our security posture, and this is a great way to do it. Uh, our process works from the intelligence side all the way through governance, risk compliance, and everyone in between, whether that's your threat, hunters, red teams, we work together as a team to protect our environment, and that's the population here. There's someone from every walk trying to do the same,

Sean Martin: right. So maybe touch on that for me, and I don't know if you wanna wrap it up in a, in a story of a particular threat. I dunno if the board's asking, let's just say PHI. So something comes up where they wanna know, how does this impact us? Or Yeah, tell me a story and how it impacts the different parts of the team that you working with.

Desta Bailey: I think anyone that's worked in cybersecurity has been asked a question by an executive, Hey, this headline came out, this story, you know, just dropped. What does that mean for us? And we can say, ideally, X, Y, Z, um, hopefully we're protected. But how do you really know? How do you validate that? How do you take what's happening, map that to your controls, and then give a unified response. So following that example, uh, an executive assay headline, say BHB for instance, how does this vulnerability, how does this affect our environment? We take that, pull the intelligence. Map it to NIST CSF 2.0 outcomes to our control set, and then we pass it over to our GRC partners and they really help drive the rest of the store from there. So, and

Sarah Bryson: then [00:07:00] we're able to understand programmatically, because we own, you know, the, the CSF, uh, cybersecurity framework, programmatic implementation, we own Yes. You're talking about Yes, yes. We own the control lifecycle. So we understand, you know, what is in place, what is in policy that's supposed to be protecting us. We're able to take those test findings. S overlay them with our control posture or your security posture ultimately, and understand, you know, are these controls validated in place and satisfying the intent that they're supposed to satisfy. So you can now tell your executives, yes, they are in place and we're getting the, the value from them and the return on investment for them there, or they're in place. They're not working like they're supposed to. They need to be refined. They need to be tweaked to maximize their value. Mm-hmm. Which is really important. You know, we talk about doing more with less. A lot of that is also doing more with less with budget. So making that money spread out is really important. Yes. Certain is. Um, and knowing where you need to prioritize what, and then lastly. Having the ability to identify those gaps before they become an incident. Because when you're able to look at things through that threat landscape, you're able to get ahead of those problems, say, Hey, this is gonna become an issue. Let's bring this to risk committee now, determine how we wanna address it, because that's the win. It's not responding or it's not putting the control, and it's having the conversation to know what is best for the business in that case.

Sean Martin: Yeah, so people who follow me probably heard me say this, and I haven't, I haven't said it in a while, so I'm gonna say it now. I have a dream.

Sarah Bryson: Okay.

Sean Martin: That, uh, in cyber we have information and intelligence that can be meaningful to the business. And my dream is that we can use that knowledge to actually help the business create something that's safe and secure and still functional. Yeah. Rather than we build a bunch of stuff and now how do we apply controls and other mitigating factors. And the example I use is vulnerability management. Mm-hmm. Patch management. We have all this data and we're con, we're spending money on teams and tools to patch and patch and patch and patch. And if we only changed one part of how we built that application, how we set the infrastructure, we might eliminate.

Sarah Bryson: Mm-hmm.

Sean Martin: The need to patch that stuff all the time. So it's a very simple, probably maybe lame example, but kind of paints the picture for me. So are you able to kind of get a view of the picture and maybe even help. The business. Say as you're architecting, as you're defining the requirements for the systems and services you're pulling together, here's the best way perhaps to do it.

Sean Martin: I think, do you wanna take that?

Desta Bailey: Sure. Um, I think that that's really what this is meant to be. Um, you're taking two sides that have two very different, different lenses. I'm constantly looking at the threat landscape, what's out there, what's happening, but also what's relevant to us. Understanding our sector, our industry, our organizational size, our applications tool stacks, taking that information, correlating that with what's happening externally, and then working with a team that knows our internal control set better than anyone else, and putting those two together. Mm, no, go

Sarah Bryson: ahead. I was gonna say, and I, I think it also, you know, going back to the vulnerability management perspective. Going to a non-cyber team, your tech team, and saying, Hey, you need to patch this now. Like, why? I have a backlog of a million items. You know, I, I don't have time for this. Like, why do I need to do this right now? Right? When you are tying the threat to that, you're keeping the context, you, you don't lose the plot. It's, I need you to do this now because this threat is coming. This threat is impending, or this threat is attacking us, right? So they ask crafts a better narrative to get the buy-in from people who are not in the trenches of cyber day today. And I also think what it does more broadly for cyber teams, which I think is really important 'cause I, I find, you know, they tend to get siloed sometimes. You know, um, it unifies the mission. You know, if you work for cyber in an industry or if you work for cyber, in my case, I'm on the advisory side, we're always on the defensive. You know, we're never, you know, it's really hard to get ahead of the threat. And when you have the understanding of what the threat is doing relative to your current posture, you can start to get a little bit ahead of the threat. You can gain a little bit of competitive advantage. And I, I, I kind of have been saying this week you get to defend from the highest point. You don't have to defend from the trenches. And that unifying mission helps not only make sure you're having the, be you building the best cyber team you can, but it keeps your culture engaged.

Desta Bailey and Sarah Bryson - 10-28-2026_11-10-31_A: Right.

Sarah Bryson: Which is really important in the work that we do.

Sean Martin: Yeah. Yeah. Culture is key. And you said mission. I think it's easy to forget about the mission. You're, you're looking into a piece of technology and looking into patch and trying to explain it

Sarah Bryson: a hundred percent.

Sean Martin: So how, how does what you've done kind of help create that conversation that is that main establishes and maintains that culture?

Sarah Bryson: Yeah, so you know, typically, you know, we, when we were both at Southwest, we worked on a team called Cyber Defense. You know, our mission was to defend the company. Mm-hmm. You know, and. That. That's it. Period. Right? Defend them. Protect this house. You know, that's what our director company used to say, protect the house. This is ours. And you know, when you start looking at how you are protected relative to what you are protecting against, it keeps that in mind and it keeps your why very front. And it also allows you to bring the rest of your team along with you, because why am I here? Why am I doing this is very relevant. It's borderline imp pending sometimes depending on. The meaning and the risk and the, the, the tactics and the approach that your organization is taking that day,

Sean Martin: right?

Desta Bailey: This process front to back makes everyone work together in a way where everyone feel like they have a stick in the ownership. Intelligence is doing our portion to help you. Uh, our threat hunters are no longer, uh, doing work and throwing it into a black hole, right? Everyone hates the black hole risk registered where we put it up there and what happens. We built this process, so every finding, every action that someone does feeds directly into the decisions our executives are making. So our teams aren't doing work for the sake of doing work. We're all empowered. We all have a stake in the game, and we help that organization together and we see it, right? Mm-hmm. We see findings that we come, may come from a purple team exercise, and it directly leads to a decision that our executives make. And we're all part of that process.

Sarah Bryson: Yeah. I think one of the most meaningful things that we found when we started this exercise was we started to look at our threats and our tactics and our controls and overlay it with, um, anomalous events and kind of incident data. So the, the things, the grind that ir, which I would argue is maybe one of the over most overworked teams within cyber. And what we found was that a good portion like. At or about, you know, half were control gaps that should have been in place for policy. So they were policy violations. So what immediately we thought is, well, if we can use this to get ahead, we're really able to help this team. That is right. Always, you know, always responding, always, you know, always on. and that

Sean Martin: arm them,

Sarah Bryson: you know, arm them, empower them and give them the space. You know, now they have time to get ahead to, you know, better prepare their workbooks, their response books, and um, now you're really playing a team sport. Yeah. Now everyone's not working in silos, but I really, like you said in our session, you know, you get to pass the baton, you know, now it's a relay and that is really important.

Sean Martin: I like that analogy. Can you gimme an example maybe you shared in the session? Mm-hmm. We were able to do this because of this process and program that maybe we weren't being able to do before. And then what was the, kind of the, the big takeaway, the, the call to action, if you will, for folks in this session of, if you're gonna do one thing when you go back to the office here, here's what it is.

Sarah Bryson: I think the big takeaway, honestly, was start having your teams talk like, you know, Intel is. You know, the bedrock of intel is trust. If you want action, the intel, you need to trust the person on the other side of the table. Otherwise you're gonna get intel with ulterior motives or it's going to be incomplete. So, you know, we encouraged as you start to build this out, because typically GRC and Intel, you know, they don't talk, you know? Right. I said we have unique backgrounds. I came from Intel and moved into GRC. He came from GRC and moved into Intel. Right. So it, it, it allowed us to be able to have conversations from the jump very easily. 'cause we knew each other's languages. Um. But just getting them to start talking, getting them to build that rapport and that relationship was something that was really helpful when we actually got in the rooms and we're like, okay, teams, we need you to start mapping these. We need to start understanding the intents of these controls, the tactics that we're seeing that threat actors do, and how they impact our organization. Um, so I would say the, the, the, the main thing I would have anyone take back is. Start making sure that your team is building relationships with other teams within your cyber program so they can be a team and they can work in a team sport capacity.

Desta Bailey: Uh, [00:16:00] something I say all the time is you can have the best intelligence team in the world, but if they're not working with others, if they're not helping them do their job, they're useless.

Sean Martin: Mm-hmm.

Desta Bailey: Uh, as a smaller example, you mentioned vulnerabilities earlier. Having those intelligence teams that know what application we're looking at, what's critical to those VM teams and us proactively watching for them. So we can quickly feed that information over and help them prioritize, they have enough on their plate, so let's work together. Let's start passing the baton over so that we can take a little bit of the load off. Right? Mm-hmm.

Sean Martin: Yeah.

Sarah Bryson: And then from from A GRC perspective, you know, if you have that information, you feed into GRC, we can look at the controls relative to whatever vulnerability they're looking at and say. This matters right now. This is internal. It's not really public facing. We don't need to prioritize this right now. So it helps them prioritize and, and that context, you know, manage the disposition of the vulnerabilities without just having the swath of vulnerabilities that you just hope someone starts doing, which is, you know, really overwhelming to, to give to your tech team sometimes. Mm-hmm.

Desta Bailey: [00:17:00] It's nice to talk about, but I think one of the really important things is documentation. Uh, there's a lot of moving pieces. There's a lot of teams working together. Interesting. Something that we did was. Write all of this in. So we know every finding has to go to this team, every exercise we need this type of information because GRC requires it. They need to have these conversations. They need to be armed to do so. So everything that we do is written down, documented so that we don't, nothing slips through the cracks. We don't forget. 'cause you forget once. You forget twice, and then it just stops happening. And

Sarah Bryson: then you can,

Sean Martin: it's kind of like a playbook that you're running constantly.

Sarah Bryson: Exactly correct. And it's always iterating and then you can scale. The teams we're we're big believers that, um, leaders shouldn't be bottlenecks. So we wanted to build depth and, you know, great teams that had a large bench. So we documented as a way to make sure that we could pass this off to anyone on the team and they would be able to implement and they would be set up for success.

Desta Bailey: The process happens the same way no matter who does [00:18:00] it.

Sean Martin: All right. Let's close with this. Um, I wanna talk forever, but we don't have time. Um, was there a que, I'm assuming you got rushed on the stage and people came, came up to talk to you. Um, was there a question that stuck with you that, that showed you people were really listening and care and maybe made you think about how you put this together?

Desta Bailey: I have one. Yeah. Uh, a big portion of our talk was moving away from checklists and. Auditors driving what we do to the threat landscape and that being what we focus on. But there's a world where we live together, right? Mm-hmm. I think there is a place for audits, whether it's internal auditors working with your regulators. Uh, there's industry knowledge, best practices that they can bring to the table, but we can work in tandem. This approach can be a tactical operational system that we use to react to the threat landscape in real time and drive decision making, drive strategy. Right. So now we're all working together. We have information coming from all sources, and we're driving the mission.

Sarah Bryson: Yeah. And I um, I mean, all of the questions I thought were really good. Like I, I was, I was so thankful because it meant many people were listening.

Sean Martin: Right.

Sarah Bryson: Um, but one of the ones was actually when I, I didn't fully answer. I'm not really satisfied with my answer. They asked about how you've integrated this more into disaster recovery and business continuity. Um, okay. Yeah. Which I think is An incredible question. Um, and I mean, the short answer is I haven't yet, but I actually am gonna be doing a tabletop about it in a few weeks, so I intend to, so I guess stay tuned for that update.

Sean Martin: Yeah, there you go. That's, that's the fun part about this, this space, right? There's so many,

Sarah Bryson: yes.

Sean Martin: Moving parts and, yeah. Sounds like you did a great job. Intel and GRC and back to the business for good, meaningful data-driven. Decision making. Yes. Which is cool.

Sarah Bryson: Yes.

Sean Martin: And, uh, congratulations.

Sarah Bryson: Thank you. Thank you. Thank you for having us.

Sean Martin: Yes. Pleasure.

Sarah Bryson: It was a pleasure. Yes,

Sean Martin: pleasure. Sarah [00:20:00] Desta. Thank you. And everybody listening and watching. Hope you enjoyed this one. If you're catching this one first, even though it's the final conversation I'm having here, make sure you go back to all the others. I, I'm gonna start off with, uh, with Mr. Beal. Uh, Mr. Scott Beal, who, uh, kicks off this whole series for you this week. Uh, so it's very good. Thank you both. Awesome. Thanks everybody.

Sarah Bryson: Thank you. Thank you.