Casey-Marks - edited by marco

Casey Marks: I think that folks should know, what shouldn't folks know at this point in time. wide Um, you know, the way that I'd say it is I think that we are in a place um, self-serving um, with the velocity and sheer volume of information that is all sides now, but the signals coming from some time, you know, know, big data fears and, and all these things that have been. been. of third party attestation validation is so much more important having trusted sources of information, um, as best as you can get, is so much more critical that has ever been

Sean Martin: Casey Marks? C-O-O-ISC2? You've been doing ISC2? stuff for few days now, think.

Casey Marks: Yes. Just a Few

Sean Martin: One, one of the, uh, one of the long term folks, if I'm not

Casey Marks: yes. yes. Um, a little Um, entering my, 11th at ISC2 I'm very happy to say And, um, started, uh. Back in 2015 as the director of Examinations, uh, principally responsible for, um, taking the CISSP from a. hour examination to a, Computerized Adaptive Testing.

Sean Martin: come

Casey Marks: on. I like the six

Sean Martin: hour.

Casey Marks: is not an indication I know people like to exert on the that come after them, but it, is, was genuinely unnecessary.

Sean Martin: Uh, hours. chill. I forget even where I took it. traveled somewhere for it. But anyway.

Casey Marks: The trauma.

Sean Martin: trauma. Exactly. Um, all right. 11 Uh, changed profession. for technology, obviously. Um, talk about continued education. stay current, stay relevant, stay interested, to stay connected, what matters you, society, whatever it moves you. Um, we, I believe humans, we need continue to learn, important as professionals do uh, customers they serve. Um, this thought's been rolling around my head first day we're live Denver, by the Um, it's two sides of the The individual keep their skills remain relevant in the workforce, things in a way or learn things matter the business so they can contribute effectively their program to bottom line. and potentially the business is making some investment in the, in individual do Um, what I'm thinking is one thing to send somebody get, extra education, go Congress to attend sessions. maybe even sit for three hours get the exam. pass the exam certification. Um, it's another to actually embrace the learnings the benefit of business. So, and the, thing that I'm struggling and why I wanna thoughts on is

Casey Marks: Sure.

Sean Martin: take AI for example. Mm-hmm. I know companies are opening up the use of AI for certain But people aren't allowed to code or they're not allowed to build agents, they're not allowed to connect systems,

Casey Marks: right,

Sean Martin: but only do small certain things, they're kind of not really enabled to take all the learning they have and, and continue to learn, help the business learn as well, So I feel there's some. Some muddiness there

Casey Marks: there's a certain, uh, super superficiality in terms of if you can't actually apply. what you learned, right. to put it in the real world and, and and to do than um, deploy you learn, but be able to create knowledge beyond And I, think you know, question pretty fundamental. to the an individual and the environments that they work in, um, who they're responsible to ultimately, know, immediately and And I think that, you know, in ISC2, you know, we know, embrace that there's, there's lots of different ways that individuals, you know, come come their profession. prepared, Right. I mean, formal education, there's certificates, there's certifications, there's ongoing learning, there's on job training, there's, you know, apprenticeships and and mentorships all of that, to that that development knowledge and the ability impart it. Um, there are a couple of things unique, you know, about. the certification mission that, you know, it, it only comes about because it's It's it's scalable. It's an opportunity. not Um, that, know, it would be wonderful if everybody could learn at the Master's for 20 years. right? It's just not, feasible. it's just not possible And not everyone has that opportunity in life. Some people are very lucky uh, to, be able to do that. but for Those who aren't, um. they need opportunity. You know, The the classic conundrum of, you know, how do you get experience without a job, How do you get a job without experience, you know, these types of things, like, um, you have to start somewhere. And so certification is a, is a very clear indicator of of how serious you are about, you a robust environment terms um, at ISC2, all of our certifications do require work experience except, except for the CC, which is level foundational first level certification in cyber. Um, but for everything else, you know, you need to have demonstrated some, some genuine have to, get to that point. You hope that once you're recognized and um, specialty of your discipline, you want to be able to have that professional responsibility to utilize, you know, your knowledge, skills, and abilities and deploy them effectively and efficiently and, and pass it on. I mean, this is we're here at congress and um, this is one of these great networking events, right? People have formal learning opportunities to learn the latest and greatest happening here. But, um, you. all and you find out, out you find out the differences. Um, and I know that there is a, a deep seated, and I've heard this many times during the course the last couple days. Um, the willingness to give back and to be able to provide um, what an individual learns back to someone who's just or who hasn't had the opportunity the otherwise. So I think it is fundamental. I think it is, it is a challenge. It will always be a challenge in a. In environments where Genuine risks to, um, the health wealth and the, the safety and welfare. of, of, um, it, it's an ongoing challenge, but you, you would hope that the demonstrated ability to have gone through a process, and very rigorous process like certification would lead to um, employer individual

Sean Martin: So back in the day me, it security, security, application engineering and human awareness and all kind stuff. Um, obviously AI has taken, taken over the, the, uh, the news cycle and touching all of that stuff again. Put it in a Right, exactly. So how, I mean, it was clear to me. System

security. Sit down with systems. Maybe work teams talk about they work, they're vulnerable, how you secure them, how they compromised, and how you recover kind of that whole Thing do that for all the different and I was fortunate to work for a company supported me in I'm wondering today with ai, and kind of back my question as well. Um, we had access to tools, what I'm right. not everybody has access to the tools to get in and get down and dirty with what's going on, really learn to then learn for the new certification that

Casey Marks: think

Sean Martin: that you're putting

Casey Marks: out. I think that's a fundamental now in opportunity Um, the Opportunity, to experience, is a genuine I wish I had better answers how how solve some of these problems. I think that opportunity is gate kept, um, from a genuine concern standpoint. Um, and then general economics as well in terms of who has access to what. and when. Um, I think that there there are some

Sean Martin: tokens cost money too.

Casey Marks: there, are, some, there are some real, some real issues. Um, we're at the precipice of that right now. I mean, but if I, but if I were to, to conjecture, I think eventually it will be understood that, given the risks that. that are presented the It has to, move toward a permissive environment, for people to be able to be attack. and I there's, there's not gonna be a substitute for it because those who don't probably won't be around to realize, don't frontier people. getting outta they there. Frontier people, they have to, have to be they have be

Sean Martin: of it.

Casey Marks: They be the

Sean Martin: how, How does one create the, the AI certification is right, pilot now, I guess, announced

Casey Marks: Is that we, announced that today. Go. That's, um, after, after months of development, um, in very rapid short form, um, express, uh, We will, uh, we announced the content outline the, the beta test. Um, we are expecting that in December of this year, that the beta test will be available, um, to candidates, uh, globally. That will be the, the first, uh, test of what the work that's been done. And if I could characterize that it's, uh, this has been largest has uh, undertaken certification. development. we've Dozens of countries representative. all not only, um, describing practice, you know, what what is impacting them today, what are they anticipating? Um, what's important, what happens a lot? What, what, what's really important? you know, trying to discern because, you know, ex exams, infinite. know, must make decisions um, we we've had over 10,000 people raise their hand and express interest in being a part of this. Uh, we've an any, at a think that, suggests that, uh, practitioners in general they're, they're hungry for, for understanding and, and, and moving forward. So, um, as you indicated, we we made this available. Um, we are just starting out. Um, everything from the the exam definition phase to the exam development phase. We are in the throes right now of. Of building. Content, to be able to match that. All volunteer driven. Everything at IC two in the certification programs is for members by members. Um, we have augmented that learning with people outside of the membership, um, in, in, an, in an AI first uh, type environment where, um, maybe they're not security professionals, but they perhaps, AI those build bridge, right. and to be

Sean Martin: So, without getting into I wouldn't expect you to know all this stuff, but what are some of things that people can to see? exam.

Casey Marks: That's, that's, really interesting. So, um, if I can characterize some of what's been, what tell there are fundamental principles of security that will, that Um, this is AI first. environment. So this is not slapping AI in front of CISSP, domains. Um, you will see a, a number of things that are different. Um, you A lot of those embedded challenges with regard lot you're seeing in practice right being, addressed in fundamental ways that are, that are not genuine. Um, reg, uh, current practice is what I'll say is that you're seeing a a lot of the best way in speaking with practitioners right now, um, what they're bringing to the table today is not even what they would've had. 12 ago, things change so rapidly usage and what have you. Um, what I, what I can tell you is that there is a very, very concerted, discussion that happened amongst almost all the practitioners that were involved ISC2 members in, in Europe And in Asia, and North America, um. professional, I don't know that, um, I've ever seen that um, any of our examination development efforts that really focus that much on, on ethical Um,

Sean Martin: because you oversee the ethics and

Casey Marks: Of conduct

Sean Martin: and all the other too.

Casey Marks: I'm very that, uh, our our standards and practice group, um, building on the ethical canons that all ISC2 members are responsible. code professional conduct, um, that goes above and beyond, and it's more exemplifies, uh, genuine uh, dilemmas, in the workplace with regard to how practice is engaged. And, Um, it's one of these things that, Uh, members here, and folks who are attending ISC2 Security Congress are, are debating, discussing. and, and learning. Um, it, we have, uh, free courses online be read and utilize and deploy, um, and it's part of the professionalization. So, Um, in a professionalization scheme as you this young industry as it's currently defined. Um, it's not like you know, medicine banking or nursing or what have you. Um, that we're still evolving and developing, right. And So to have um, to have, uh, a definition of competency. um, to have, um, ethical, um, responsibilities that are associated with it, um, and then moving on moving forward in you licensed um. one thing to say you have code of how to behave. what the individual who chooses not to, Um, what do you. do about them the, I, Our responsibility is solely to the, individual it's to all the It's to the employer, How that those letters. that they know what they, they're supposed to know and they know how to be able to do what they're supposed to be able to do and they're gonna do. it

Sean Martin: third, third bullet.

Casey Marks: Yeah.

Sean Martin: Ah, so many things we can dig into. Um, let's, wrap this. lot of my audience are security leaders, CISOs They're managers. a lot of practitioners, but also business leaders who trying to wrangle with ai. maybe word of advice or some things that, can take away

Casey Marks: really So if I were to maybe parse the audience slightly differently. I'd, I'd have different, different, advice but I'll, I'll, I'll take the in terms of, uh, business leaders, those who, um, who rely on security experts to be able to, to, to get what they need and to be able to do what they do. become more steeped, um, in in this space. Right? So, um, cybersecurity while it can be worth diving in. Um, it's worth understanding. I think that there's um, Um, if I were to conjecture from being on the outside, there's there's kind of the older paradigm regards to technology and innovation. you worry worry um, if something breaks, that's when we'll worry about it. If something's hurtful, when I think, um, there's been enough, um, cognizant, the you the concerns frontier. models. Um, you not not to be mentioned specifically, but it talked about, you know, the you know, the end of, of. of humanity, basically business technology, um, that would seem to suggest that maybe more people need to be involved, and understand security, and So I think that there, um, again, um, two perspective, uh, we do make it approachable, Um, there are entry, know, maybe cyber important to you. Uh, whether it be you learning certificates, certifications. are genuine more your More comfortably. And I think that would be really, really uh, for, for CISOs and, and security leaders. Um, uh, it would be hard pressed for me to give the advice that they probably have already been given, um, that, um, it is different this time. Um, and it, it's not going back, Scott spoke about it at to uh, security, Um, that, uh, the rate of change is be can expect anybody anticipate what the next steps good on because gonna be challenging.

Sean Martin: They might be right today and wrong tomorrow, but

Casey Marks: anyway. Absolutely. probably equal parts of

Sean Martin: All Um, Anything we didn't touch on uh, you should

Casey Marks: I think that folks should know, what shouldn't folks know at this point in time. wide Um, you know, the way that I'd say it is I think that we are in a place um, self-serving um, with the velocity and sheer volume of information that is all sides now, but the signals coming from some time, you know, know, big data fears and, and all these things that have been. been. of third party attestation validation is so much more important having trusted sources of information, um, as best as you can get, is so much more critical that has ever been be in the context of professionalization, um, you know, there are those who believe in certification and you know um, I know what I, know and I can, when I can, tell my story. I can. That's all great. That's all fine. I'm, I'm a Professional as well. I have the same things. I also hold credentials in my space as well for the same exact reasons. Um, it, if nothing else demonstrating and showing a commitment is as important as any specific problem staying

Sean Martin: sure. Looking, looking for a doctor. go to What creds do they have? What's their experience? You, you want And it's, when it's something important, You want all three of

Casey Marks: And you want to know that for every one of those new drugs that you see commercial that out every that You where they come from, what how they work. with Every use of technology um, biopharmaceutical, you rate of change is incredible in all we do best

Sean Martin: hopefully they have a good bedside manner and can chat with too.

Casey Marks: course.

Sean Martin: can understand what they're saying.

Casey Marks: Of course.

Sean Martin: all comes together well, Casey? Pleasure meeting Pleasure chatting with Thanks for having me Congress.

Casey Marks: Thank you so

Sean Martin: much. Keep up the good work. I'm volunteering on the AI Perfect. So I think they just called on me for whatever the step

Casey Marks: happy to have

Sean Martin: you there. you. Thank you. I'll be contributing there. And, uh, everybody listening, tuned. live from Denver ISC2 Security Congress. Lots conversations heading your way.