When you hear “Director of the Indiana Security Council,” you might guess an IT background, but it’s actually Chetrice Mosley-Romero’s liberal arts education that helps her unite and empower communities across the state in the name of cyber hygiene. In this episode, sponsored by AT&T Business, Chetrice joins Kevin L. Jackson to discuss how she helps balance competing priorities across the state, tips for maneuvering the influence of politics on cybersecurity initiatives, how to dismantle the digital divide and empower equitable cybersecurity messaging, and more.

Watch on-demand sessions of the Securing the Everything 2022 Cybersecurity Conference featuring Chetrise here: https://security-conference.att.com/#sessions

Intro/Outro (00:01):

Welcome to Digital Transformers, the show that connects you with what you need to build, manage, and operate your digital supply chain. Join your host in a timely discussion on new and future business models with industry leading executives. The show will reveal global customer expectations, real world deployment challenges, and the value of advanced business technologies like artificial intelligence, blockchain, and robotic process engineering. And now we bring you Digital Transformers.

Kevin L. Jackson (00:32):

Hello everyone. This is Kevin L. Jackson, and welcome to Digital Transformers on Supply Chain Now. Today’s show is sponsored by AT&T Business and the 2022 AT&T Security Conference presented by the AT&T Chief Security Office. During this year’s conference, experts from AT&T government, industry, and across the security spectrum helped explore how we can secure everything. If you missed this year’s event, you can still catch it on demand at securityconference.att.com.

Kevin L. Jackson (01:19):

So, on today’s show, I am honored to have one of my favorite event speakers, Ms. Chetrice Mosley-Romero, Director of Indiana Security Council. Chetrice works collaboratively with public and private stakeholders to administer the development and implementation of the state’s cybersecurity strategy and policy through the Governor’s Executive Council on Cybersecurity. Prior to her current role, she was the executive Director of External Affairs for the Indiana Utility Regulatory Commission, where she led the public relations policy and consumer affairs. Welcome to the show, Chetrice.

Chetrice Mosley-Romero (02:11):

Oh, I’m happy to be here. I mean, when you read my bio, I’m just super tired all of a sudden.

Kevin L. Jackson (02:18):

Wow. You have very impressive, impressive career.

Chetrice Mosley-Romero (02:24):

Yes. I’m glad.

Kevin L. Jackson (02:24):

But before we dig into your cybersecurity role for the state, how did you get there? Where did you start in your career? And how did it actually lead you to your current position?

Chetrice Mosley-Romero (02:36):

Yeah. It’s quite an amazing story when you, like, consider when I’m talking, especially, to students and we’re always talking and professors are always telling them how you can get into cybersecurity can come from a variety of ways. So, I always kind of do the, “How many of you think my background is IT?” And everybody thinks my background is IT. And I am actually a Liberal Arts Major in Communications as well as a Journalism Major in Public Relations through the Indiana University. So, I come actually from public relations, crisis communications, business strategy, external affairs policy.

Chetrice Mosley-Romero (03:19):

And this role kind of came about in a kind of an interesting way through my position at the Utility Regulatory Commission. You know, I think at the very basis of it, it really just kind of comes to the problem. You know, when you look at the problem of cybersecurity is, we’re looking at what Verizon report says, 80 to 85 percent now is all human error. The solution is not more tech. The solution is having somebody who understands people, having somebody who understands how to strategically align things that are happening on the technical side along with things they’re having on the human side, and just being able to approach it, I think, from a much more collaborative sense, and then ready to basically deal with a bad day. That’s where my crisis communication kicks in. So, it’s been an interesting road.

Chetrice Mosley-Romero (04:10):

I think if you would’ve told me in college or even my first job as a public relations specialist that I would end up to be the cybersecurity director for the state of Indiana – which, I’m the first in this role, so it wasn’t even a role that even existed – I would’ve been like, “You don’t understand me. I don’t know how to turn on my computer half the time.” So, it’s quite a remarkable kind of way I got here, but it’s been an amazing ride, and I love what I do, and, unfortunately, I think cybersecurity is going to be where I end up because once you get into cyber, it’s just kind of hard to leave.

Kevin L. Jackson (04:49):

Well, one thing you had mentioned, I mean, liberal arts and communications, isn’t that one of the most important aspects of cybersecurity though?

Chetrice Mosley-Romero (04:59):

Absolutely. Yes. I would agree. I think, you know, a lot of times people think it’s all about the certificates or the tech side of it. But, really, it comes down to – and I always tell – any employer and any university is always looking for the critical thinkers, the ones that communicate something complicated and simplify it, the ones that can think outside the box. And so, I use on a daily basis the skills I learned from my Bachelor’s in Liberal Arts. So, it’s kind of a funny world, right? But I think it took a while for tech to kind of realize that. I mean, you know, typically executive councils, in government, it was led by tech people. While that’s great and they’re most certainly the amazing such a matter experts that I count on, on a regular basis, sometimes there is a stereotype out there that tech people are not the best communicators and tech people are not the best people-people. So, I think my ability to kind of cross over from both sides and have a deep understanding of the human side of things has really allowed Indiana to really be able to improve its stature and cybersecurity in the nation.

Kevin L. Jackson (06:20):

I tell you, that’s something I always say about myself, my superpower is being able to translate complex technical aspects into something that sounds like English.

Chetrice Mosley-Romero (06:34):

I agree. Yes, I agree.

Kevin L. Jackson (06:37):

And according to the Executive Council website, your task also includes forming an understanding of Indiana’s cyber risk profile and identify priorities, establishing – big word – strategic framework of Indiana’s cybersecurity initiatives and leveraging the body of talent to stay on the forefront of cyber risk environment. Wow, that sounds like a Herculean task. How does that look from your viewpoint, really?

Chetrice Mosley-Romero (07:16):

You know, I have the most amazing wine collection – no, no, no. Not wine collection.

Kevin L. Jackson (07:24):

Well, you may need a wine collection to get through the day, right?

Chetrice Mosley-Romero (07:26):

I may need one, yes. I definitely have great coffee. The council is made up of people that I have worked very hard in my position within government to empower them. That’s not something that’s very comfortable for government to do sometimes to bring in subject matter experts within the council. We have, like, more than 250 members on the council, and that’s not because I was looking for a prize for how crazy can you get Chetrice. But when we looked at cybersecurity from the beginning of my role as I developed the framework in which we work right now, it really wasn’t going to work if we focused on just one section.

Chetrice Mosley-Romero (08:11):

I mean, technology is moving so fast. So, some states, because of resources, because of access to collaborations, may only be focusing on workforce development or economic development, or maybe a certain sector, or maybe they’re focusing inward. They have sectors in the room to get best practices to learn from and use within their state networks, and also maybe push down some of those best practices to local government networks. But what I found was, in cybersecurity, we need the whole ecosystem involved. I mean, we really do need to attack the whole elephant. Now, how you go about that is you not having 30 people that represent whole sectors, and, really, honestly, in an unfair way. Because even if the person who is coming from a small organization or a bigger organization, either way, they still won’t completely understand what it takes to do cybersecurity in the most efficient way and the most effective way for the opposite organization.

Chetrice Mosley-Romero (09:11):

So, big company, while they may understand and sympathize with the others that are in small companies, with cybersecurity changing so much, we really need everybody at the table. So, it was really, really important for me that we had not just the breadth of cybersecurity knowledge on the council – which is what most states do. And I absolutely understand why they stopped there, because it is a lot of work – but it was so important for me to have the depth and to allow people to be experts within their right.

Chetrice Mosley-Romero (09:46):

So, for example, I always kind of tell people, you you don’t have your CIO write your news releases. You don’t have your CIO do crisis communications. And you don’t have your CIO writing your cyber incident response plan for the entire organization because that’s an operations item. That’s typically what the CO or emergency manager or the writing of news releases with your PR. So, why would we not approach cybersecurity in a strategic way with those various pieces involved. So, we have 15 committees all with the depth of knowledge within each of those committees, so we have a committee that deals with emergency response. And who staffs that committee? It’s not CIOs and CISOs. It’s emergency responders who have been doing it for decades, who understand how to simplify emergency management and principles for cyber instant response planning that others can use that will never hire an emergency manager because that’s not their cards for the organization because they’re too small.

Chetrice Mosley-Romero (10:51):

And then, likewise, we have finance and we have utilities, water, energy, elections. Why would we combine all those groups and not allow them to be able to speak with people that understand their world to figure out the solutions of incorporating better cybersecurity practices in their sector? And then, the amazing bonus of the council is that when a sector does that, because I’m kind of seeing that’s all happening, maybe a sector is thinking about doing a best practice manual SCADA systems. But part of that has cyber hygiene principles, like generic cyber hygiene principles. Well, maybe they’re doing that in utilities, but finance is actually doing something very similar, except they’re just focusing on cyber hygiene principles. Why would we not connect those people in a strategic sense so that we’re not creating additional work?

Chetrice Mosley-Romero (11:51):

I do not believe in recreating the wheel. And I’m also been in government my entire career. So, I’m used to doing things with no budget. So, you always kind of be thoughtful of how it really works out on the ground level. And it has worked just so greatly. And so, how I can do the Herculean tasks, I am just surrounded by really great people. And it is just me overseeing the whole council. I have a communications manager who runs our website and runs our social media. But from the strategic sense of things, it is just one person for the State of Indiana. But it’s amazing when you’re surrounded by the right people.

Kevin L. Jackson (12:38):

Well, when you said you had like 200 people, the first thing that popped into my mind was, “What? She had someone from every town and every county?” And then, I thought about it, I said, “Well, response from Indianapolis area, an urban area to cybersecurity, will be different than a rural county.” I know we’re going to talk a little bit more about that. But is that an important part of your diversity on the council as well?

Chetrice Mosley-Romero (13:12):

Absolutely. Actually, every committee is required to have certain demographics. So, you’re required to have a large organization within that sector, a small organization association. You’re required to have regional representation of Indiana because, you know, sometimes capitals, like Indianapolis, get really stuck on everything that stays in the capital is the capital, but they’re making decisions that affect the whole state. The way that Northern Indiana operates from a population perspective, from a collaboration perspective, because our Northern Indiana is connected to Chicago. I mean, a lot of things, factors, are different from Evansville and our Southern Indiana that is on the border of the Southern State.

Chetrice Mosley-Romero (13:58):

So, when you’re looking at that, we’re like, “We need representation to have a good understanding.” And when we develop the state strategy plan, that I can honestly say our plan is a state strategy plan. It’s not a plan developed by the state that is the states, but doesn’t quite include the states. And that’s what was important too. So, it was very important for me to have diversity, different perspectives.

Chetrice Mosley-Romero (00:14:25):

It’s quite amazing, I have a legal insurance team where they have competing law firms coming up and developing projects together that is beneficial, not only to themselves, but for everyone. And the fact that you can do that, where, typically, you imagine lawyers – which I’ve still not met a lawyer exactly like this, the ones, at least, the government – they’re like, “Well, how much are you paying me every 15 minutes?” You have some amazing lawyers that really do love the law, but they want to figure out how can they simplify it.

Chetrice Mosley-Romero (15:00):

And I appreciate you talking about being able to simplify it. You know, I always kind of go back to the Einstein quote of, “If you really understand a subject, you can simplify it.” And so, it’s always kind of a red flag to me if somebody can’t get there. I can help with it, but if they can’t get there, it makes me wonder do they really understand. Can we really distill such a complex aspect of cybersecurity into something that could be usable for the community that is just never going to hire a CISO? And it’s just not going to be in their cards anytime soon. So, how can we help them in small organizations, medium-sized organizations in our critical infrastructures? These are things that are the backbone of our society, the backbone of our communities.

Chetrice Mosley-Romero (15:45):

We’re not purposely going for just things that aren’t helpful. But at the same time, whenever I look at things – personally, I review things – I’m always like, “All right. Can a local government use this? And bonus, can a small business use it?” How does, you know, Debbie’s cupcake store use this information? Because Debbie’s cupcake store is just never going to hire a cybersecurity firm. They’re never going to hire a CIO. They’re going to hire another baker. That’s their world, and appropriately so. So, I always kind of view things from the lens. And I’m grateful that the council members also view things from that lens. They’re always thinking, ” All right. We have these best practices, these large amazing organizations that have countless numbers of cybersecurity people in there to do their job and develop training and develop these practices, how can we simplify that and package it for the person who just will never be at that point?”

Kevin L. Jackson (16:48):

Well, I tell you, we’re talking about the difference between the northern part of the state and the southern part of the state. I’m here in Virginia, just outside of Washington D.C., and you would think that Southern Virginia would want to excommunicate us or something because things are so different in Northern Virginia than it is from Southern Virginia. But you are also tasked, however, with collaborating with other states to protect personal and government data that’s stored on state systems, as well as developing statewide plans to combat cyber attacks against these information technology networks. How do you tackle that requirement? I mean, is it easy to work, like risk the State of Virginia or California or Mississippi?

Chetrice Mosley-Romero (17:53):

Yeah. You know, I always kind of joke, but it’s true, the best part of working in government is you don’t have a net profit, the worst part of government is you don’t have a net profit. So, one of the best parts of my job is being able to help the people that we were talking about, being able to grow students, and be able to mentor them. And the next one to that is being able to just give all my templates and all my advice and all my lessons learned to other state counterparts that are trying to do the same thing.

Chetrice Mosley-Romero (18:31):

And I’ve done that over the years. You know, people are like, “How do you do this? We can’t even get the regulator and the utility in the same room. And you have multiple regulators and utilities in the same room.” And so, you know, I give them advice. It’s complicated waters when it comes to regulators and the regulated, and government, and private sector, and vendors. But I just found that being transparent and sharing best practices is the best that we can do, and just being there, because it’s a hard job. It doesn’t pay nearly the amount of money that other cybersecurity professionals make. But I would say that the impact of it is quite amazing and important. And it’s just needed when it comes to the kind of threats that are out there.

Chetrice Mosley-Romero (19:18):

And that’s not just myself. I know that our office technology works a lot with other states in sharing best practices. I know that our Indiana Department of Homeland Security does the same and they support each other. So, you look at, yeah, it’s 50 states, but it is just 50 people who are doing this similar things. So, you know, it’s helpful to know that, one, you’re not alone. And two, there are things you can learn from each other. And I always tell people when they meet with me, like, “Listen. I’m not going to be offended if that’s dumb for our state, because your state can be totally different than us. So, take what you like and leave the rest.” And I think that’s a benefit that, at least, if we kind of just keep an open door and collaborate.

Chetrice Mosley-Romero (20:05):

The beauty of cybersecurity, for me, it’s apolitical. So, when you’re dealing with other states that may be dealing with their own politics and that kind of thing, when it comes to cybersecurity, it does become much more ones and zeros. And when we deal with the issue of cybersecurity, which is people, I mean, the way that people learn and communicate is the same across the world. The way that we respond to emotional things, it’s a study, psychology, it’s psychiatry. So, we can learn a lot in those aspects through psychology, sociology to really learn how can we make an effect on a larger population with regards to cybersecurity, cyber hygiene, and just protecting yourself.

Kevin L. Jackson (20:56):

Well, I’m sorry, but you kind of opened a door there that I’m hesitant to go through, you said that cybersecurity is apolitical. I mean, a couple of years ago I thought healthcare and medicine was apolitical. And we found that to be not quite true. So, how does politics get into cybersecurity?

Chetrice Mosley-Romero (21:27):

Oh, yes. And when I say it’s apolitical, I mean the nature of the core of it is apolitical. Leave it to humans to mess that all up, right? To muck up and add the grade to the ones and zeros world, right? And I completely agree, yes, I mean, I think with the Federal Government doing all the great stuff they’re doing, there’s still distrust from some groups, and that happens in state government, that happens in local government. The politics between the local governments and the state governments have always been complicated in all states, and Indiana is no exception. But we are working really closely with local governments to figure out how do we break that barrier down. Because, yes, in other areas, I always tell local governments, I’m not saying the state is perfect. The state, sometimes, does things that just hurts you guys, and there doesn’t seem to be apology following.

Chetrice Mosley-Romero (22:22):

But I’ve gone into meetings and say, “On behalf of the state, I’m sorry. Let’s try to do the right thing with cyber. Let’s try to focus on cyber and be the case study that shows that if we approach it with empathy, if we approach it with empowerment, if we approach it with, “Listen, we know that you love your community, you want to secure it, we want do the same thing. We may come from different backgrounds, but at the end of the day, this is the goal, and focus on that.” I think there’s a power to that.

Chetrice Mosley-Romero (22:53):

And I just think that as politics get more involved in cybersecurity, because it definitely is the issue that’s not going to go away, we just got to remember, from my perspective, the core reason is we need to protect our critical infrastructure. We need to protect the people of our nation. And what are we talking about? Is it going to serve that main purpose? And how can we not just serve that main purpose, but empower those that you’re trying to task with these things, and making sure that they have everything they need to do the best that they can with everything.

Chetrice Mosley-Romero (23:32):

So, I think that’s kind of how I approach politics, which is probably why I’ve worked under several governors. I really kind of just lean in on the, “I’m not here to be political. I’m here to show you that this is the expertise I have. And here’s quantitative results of the success and here’s what I can do for the people of Indiana because that’s who I serve.” And it’s been a blessing, most certainly. And I’ve been very lucky that everyone’s kept me around.

Kevin L. Jackson (24:01):

Well, you certainly have a great viewpoint and a great attitude. I really love that about you. The other thing is that, during the AT&T CSO Conference, you spoke on something that I think is a real passion of yours, and that’s managing risk and the digital divide. In its most basic form, the digital divide was defined as the opportunity gap between those with the reliable internet access and those without it. What is it to you and how has this manifested itself in Indiana?

Chetrice Mosley-Romero (24:44):

Yeah. I mean, I think across the nation we’re hearing about the broadband, getting internet and the Internet of Things. So, it’s not just internet and they’re going to just open up and the flood gates open to data. But they’re also opening up to things like smart T.V.s and smart security systems, things they wouldn’t otherwise be able to run without having the backbone of the infrastructure of the tech. So, it is really important to me when I’m having discussions with leadership of the states and in the private sector in that area, especially communications, when we’re talking about, “Hey, this is great that we’re doing this.” And I’m a big believer, you know, there are some in cyber security that’s like, nobody should do anything. You shouldn’t be on any social media. You should go off grid. You should –

Kevin L. Jackson (25:31):

Put your head in the hole in ground.

Chetrice Mosley-Romero (25:32):

Exactly. Find your bunker and get in there, right? The thing is I’m a mother of four. Like, even if I try to be off grid, I can’t because the teachers require me to have an app to do daily communication. Even though I would like to not have to be on Facebook, that’s the way that I get events for certain things, that’s the way that I do stay connected with people I otherwise wouldn’t be connected with because I’m so busy doing this whole job and being a mother. So, I always kind of approach it with, the answer is not to not do it. The answer is let’s do it. Let’s increase our technology. Let’s embrace it. But we need to also embrace education alongside it. Not an afterthought, but along with it.

Chetrice Mosley-Romero (26:22):

So, when we’re bringing broadband and interconnectivity into the rural areas, I think it’s hard for people in urban areas where it’s natural for us. Like, we can’t even imagine a life without being able to easily connect. We get annoyed if after five episodes on my Netflix past, when Netflix starts judging me, Netflix does a little pause for five seconds, and I’m like, “Oh, my gosh. This is the worst thing in the world.”

Kevin L. Jackson (26:52):

It’s buffering again.

Chetrice Mosley-Romero (26:53):

I know. It’s buffering again because all my devices are on because I have four kids. It’s easy to get stuck in that and not realize that there are communities here in Indiana that people still have to walk five miles to get to the library to have really crappy internet service, but that’s how they’re getting it. And so, as we are improving that divide and we’re crossing that. It’s so important that we also teach these people who are brand new to cyber in a lot of ways. They don’t have the infrastructure that we have now. They don’t have the smart technology that they’re going to have.

Chetrice Mosley-Romero (27:31):

This is an opportunity that’s saying, “Hey, with this great power comes great responsibility.” You’re going to get this amazing gift that smart people have developed around the world. And now we have this where it’s nothing like it was 20 years ago or 40 years ago. But with it, comes here’s how to protect yourself with it, here’s precautions to start with. So, we should be educating them alongside, if not a little bit of head when they get that, so that they’re starting off on the right foot on protecting their identity, protecting the organizations, and, as importantly, protecting our critical infrastructures as critical infrastructures in those areas are also coming online. So, yeah, I’m very passionate about that because I feel like it’s difficult responsibility to take to provide these services. I feel it’s just as much of a responsibility to provide education around those services.

Kevin L. Jackson (28:28):

Well, one thing you really highlighted during your talk at the conference was the difference between rural and urban populations in Indiana. The thing that caught my attention was your observation that rural families actually limited the number of computers that they had in their homes in order to conserve bandwidth. How does that even translate in an IoT world based on entertainment and smart appliances and connected cars in the garages and you’re connected home?

Chetrice Mosley-Romero (29:08):

Yeah. I mean, I’m working right now on a local government pilot and kind of, again, figuring out that barrier between. And one of the things I’m learning is, a lot of times, the only connectivity they have is their smartphone. And it’s a smartphone that they may be getting from their government because they work for the government, their local government. Or their local government may have six computers and it’s tired of the government. And, yes, they’re super old computers. And, yes, they definitely probably need a lot of help in the cybersecurity infrastructure side. But, again, that’s been their world. I always kind of tell people, imagine rural Indiana as what we were 20 years ago. That’s where they’re at. The good old dial up tones. When we started getting smart technology before fiber and before those kind of upgrades were made, 5G, we were also struggling with keeping our online, having computer going, and a smart TV going.

Chetrice Mosley-Romero (30:14):

And so, with the various populations, again, that has never had this before, they’re making adjustments to them themselves. But how are we also helping them make adjustments to their security posture and their cyber hygiene, which is, I think, so critical on protecting themselves? And, also, better using the systems because I always kind of like to think the backbone of the system is still vulnerable if everyone on the system is vulnerable. So, we want to be cognizant of strengthening the lowest common denominator, and that is just people.

Kevin L. Jackson (30:51):

You know, it sounds like you’re saying that people are still doing dial up and listening to “You’ve got mail.” I mean, it’s kind of weird with such a wide gap in society. How does the state address education around cybersecurity and cyber hygiene? I mean, that’s so different.

Chetrice Mosley-Romero (31:20):

Yeah. If I had my wand and all the money in the world, it would be a personal delivery of a fun thing with a new laptop computer that has all secured and everything taken care of. But I don’t have that, so I would say, cybersecurity can’t be solved by one entity alone. The State of Indiana most certainly shouldn’t be the only one solving this. And I think our communities and our partners appreciate the fact that, as a cyber director, I really rely on their expertise and their collaborations and their organizations that are in the communities, that serve the communities, that are developed, that are funded by the communities, and they’re well-connected into those areas.

Chetrice Mosley-Romero (32:09):

So, the street is coming down and saying, this is what you should be doing while entertaining may not hit home. But a friend of the family who also works at the university that is doing a cyber security program and hygiene program education, giving that to key people members of that local community is going to be well-received and more effective. And so, I think one of the things that I’ve learned is, we have to connect people with the people that they trust. Word of mouth is still the number one way of things getting through. So, as government, I can say over and over – I think the Federal Government is the same way – these are the things you have to do. But until somebody that you care about says it, it just doesn’t stick as much as we would hope so.

Chetrice Mosley-Romero (32:59):

So, the way that I approach that is collaborations. We have to collaborate. We have to empower people with the right messages that we’re all consistent. And we have to just let them go. You know, from my perspective, I don’t require my council members to approve every single thing through me. I let my council members know, “Hey, go forth and do great things. And just come back so that we can also all celebrate in your win, but also learn from your win, so that others that are looking for that same kind of thing can learn from it and maybe use it too.” And I just found that that is the best way that I’ve seen in my career versus just only the state owns it, the state pushes it out, the state controls the message.

Chetrice Mosley-Romero (33:47):

With cyber hygiene, the message is pretty consistent across the board, multifactor, you know –

Kevin L. Jackson (33:55):

[Inaudible].

Chetrice Mosley-Romero (33:55):

Exactly. User access, good passwords, updates, patch, and have your backups and have a plan. I mean, no matter what an area of industry, it’s the same key ones, at least at the very top, that take care about a majority of the cyber attacks. So, let’s start with the simple things too. Let’s not go in and start talking about, you know, putting in a bunch of systems and doing these check things and stuff like that. I mean, not to say that that isn’t what we should be doing, but let’s start with the human aspect of it, not clicking the link. Let’s do cyber education in a fun way.

Chetrice Mosley-Romero (34:33):

And, also, let’s start talking to our younger generations about cyber education. Because at the end of the day, they’re the ones that are going to be taking on this digital divide that’s smaller and smaller and running with it. So, what does the next generation look like in cybersecurity? And I really believe that you’ll have the people who enable cybersecurity and the technical side of things. But other than that, we should all be cyber ambassadors at the very least in just being aware of what we can do for ourselves and our family and our organization to protect it. And if everyone’s doing what is little for individuals, I mean, how powerful can that be? It’s kind of that whole drop in the ocean. Well, drops are just drops until it’s an ocean.

Kevin L. Jackson (35:18):

You tell me. Maybe all our cybersecurity leaders should have a liberal arts background.

Chetrice Mosley-Romero (35:25):

I could probably argue that, yes. I could probably argue that.

Kevin L. Jackson (35:30):

So, you’ve mentioned the human side of cyber quite a few times, but when the governor established this council for cybersecurity, was that part of their thought process? What does it really mean to address the human side? You talk about training and education, yes, but how does your office really focus on the human side?

Chetrice Mosley-Romero (36:05):

So, this pilot has just been so amazing already because what I learned is, it’s not enough to have your CIO or equivalent, your IT director, and your leadership to understand the importance of cyber and push down the policies. Because policies to the day-to-day employee are just that, they’re just policies. It’s like a pirates thing. It’s a guide, not really law, right? Just kind of what they consider. What I have found though is, when I speak to the middle management, when I speak to the people who have direct connection to the people that are running everything, that when I connect with them through it’s important from a perspective that we talk regularly about how important they are in the organization and how important it is that they protect the organization. But here’s the thing, people pay attention to that, and they sometimes will pay attention to that but leave it at the office when they go home.

Chetrice Mosley-Romero (37:06):

So, what if we connect to people and the people world. Let’s connect to the parents who care about their kids online. Let’s connect to the people who are about to retire, who wants to protect their assets and their finances. And that’s the stuff that the bad actors are going for. Let’s look to see how people will protect their elderly parents and their grandparents and the people they love and care most about. And I feel like if we focus more on the human side of things, we focus more on what makes us human, which is the people we care about, the things we care about, our future, our dreams, those kind of things. All those skills that we’re teaching them there, don’t click the link, use multifactor in your social media, make sure you’re backing things up not on the same computer if you care about all those pictures on your computer of your loved ones, those kind of things translate perfectly into the organization. It doesn’t always go from the organization home that we see.

Chetrice Mosley-Romero (38:07):

So, I feel like when we talk about the human factor side, we need to interlay cybersecurity into the culture of an organization at every level of the organization, but not through the organization’s advantage and perspective, but through the people and the employees and their lives, where we can really address the thing. Because that’s where behavior change happens. When people are motivated to protect the things they care about, the people they love, they change the habits.

Chetrice Mosley-Romero (38:36):

If you’re telling a disgruntled employee, “Don’t click the link or you’re going to take down our company,” what do you think a disgruntled employee is going to do? Probably nothing. They’re going to be like, “Well, that’s your problem, not mine. I still get to leave at 5:00.” So, I feel like that’s one element of it.

Chetrice Mosley-Romero (38:54):

And then, I really do believe in the children. You know, I feel like much like the drug campaigns, the DARE campaigns, or smoking campaigns, or the fire alarm campaigns, you have kids coming home and telling their parents, “I noticed we use the same password for everything. We shouldn’t be using the same password. Anyone can get our information.”

Kevin L. Jackson (39:20):

They’re teaching their parents, right?

Chetrice Mosley-Romero (39:22):

They’re teaching their parents, and that’s a powerful thing, right? And more importantly, those kids are going to grow up to be parents that will have that innately or will have that in them so that they can also then teach the next generation. So, how do we change cybersecurity culture in our society? We have to start at really looking at the people, which is the biggest problem in cyber, but addressing them like people and not just like additional endpoints on a system. And I feel like that’s the way to do that.

Kevin L. Jackson (39:55):

So, you want to create digital natives, I guess.

Chetrice Mosley-Romero (40:00):

I like that. Yeah. Getting ingrained.

Kevin L. Jackson (40:01):

Yeah. Getting ingrained into it. And it’s clear that government plays a significant role in helping society transition to our connected future. But does that role really align with industry’s profit minded focus? I mean, if you’re not making money, you’re not going to have a job. How does government and industry play together in the same sandbox of cybersecurity?

Chetrice Mosley-Romero (40:37):

You know, I get that question a lot because I have so many people at the same table, again, that regulars and regulated. And at the end of the day, the risk is still the same across the board. For example, energy companies don’t want the energy grid to go down. Regulators don’t want the energy grid to go down. The goal is still the same. So, incorporating cybersecurity into the culture of an energy company, whether it’s being required by regulators or not, even on their own, we’re finding industry is saying we need to get this incorporated into our culture because we need the person to care about and learn and change their behavior to be more cautious online, to be more cautious about what they’re putting in our system, be more cautious about what they’re clicking, to make sure that they’re enabling multifactor, and those kind of things.

Chetrice Mosley-Romero (41:30):

So, it’s a kind of a mutually beneficial goal. And I think that’s where a lot of our collaboration hits. It’s a mutually beneficial goal. There’s no talk outside of what our main goal is within our council. It really is all about that and everything else that is going on outside of that where they may be at each other a little bit for. Just, again, I’m very lucky, people just put that aside for the cybersecurity discussions, and they just jump in and want to make the difference.

Chetrice Mosley-Romero (42:05):

So, I think, it isn’t going to be as hard. I think when it gets difficult for industry and government is when government goes down the path of regulation. And regulation, well, it has its place most certainly. I do feel like, again, if we’re looking for the mutual benefits for all of us working together, like we have in Indiana, we can do a lot without laws being written. Like, nothing forced us to all work together. It was really literally just me saying, “Hey, I know you care about this. I care about this. Tell me what you want that makes it better for you. I’ll tell you what I think might make it better. And if we disagree, let’s figure out and understand each other why we disagree. And maybe we walk away from that part of it and maybe we don’t.” And I think that just that respect of understanding where everybody is, it makes a big difference.

Kevin L. Jackson (43:00):

Wow. I’ll tell you, I really appreciate you sharing your insight and knowledge about the human side of cybersecurity. But, unfortunately, our time has come to an end. I could talk with you forever on this, and I’m sure the audience wants to learn more. So, can you tell the audience how to reach out to you in order to follow up and to become better liberal arts practitioners when it comes to cybersecurity?

Chetrice Mosley-Romero (43:33):

Yes. So, the website that we have for the state of Indiana is in.gov/cybersecurity, so definitely go there. That has our strategy. That has our appendices toward the strategy, literally the templates that I used, again, all about transparency, where it’s appropriate. And then, my information, I’m sure you can post on the thing, but you can look me up on LinkedIn, romeroclm@iot.in.gov. And I am more than happy to talk to people who are passionate about this. I want to learn from people. If people find or even you, Kevin, find a great article or here’s a different perspective than you, I want to know that because that’s the only way we get better at this, is learning from each other.

Kevin L. Jackson (44:19):

Okay, great. And we will definitely put your contact information in the show notes. Thank you. Thank you very much. So, in closing, I would like to invite everyone to check out a wide variety of industry thought leadership at supplychainnow.com. And you can find Digital Transformers and Supply Chain Now wherever you get your podcast, so be sure to subscribe. On behalf of the entire team here at Supply Chain Now, this is Kevin L. Jackson wishing all of our listeners a bright and transformational future. We’ll see you next time on Digital Transformers.

Intro/Outro (45:05):

Thank you for supporting Digital Transformers and for being a part of our global Supply Chain Now community. Please check out all of our programming at supplychainnow.com. Make sure you subscribe to Digital Transformers anywhere you listen to or view the show, and follow us on Facebook, LinkedIn, Twitter, and Instagram. See you next time on Digital Transformers.