Leadership: Branko Džakula, CISO at Kaia Health
An interview in Cybersecurity Observatory Europe on the weight of the CISO role, incident response and honesty after a data breach.
This interview appeared in the Leadership section of the second edition of Cybersecurity Observatory Europe, published by Cyber Startup Observatory in November 2020, when Branko Džakula was CISO at Kaia Health. The introduction traces a passion for the field that started in 2010 with private projects, a cybersecurity career that began in telecoms and moved into information security management, and experience across airlines, SaaS, online travel and healthcare.
Asked how a CISO lives with the fact that attackers only need to be right once, he answers with the Stoic idea of not worrying about what is outside your control and giving your best to what is inside it, which lets a CISO keep a cool head and be the voice of reason when the worst happens. He recommends practising a hypothetical data breach, even only in your head, and keeping a rehearsed incident response plan with specific scenarios. He describes the CEO as the one steering the ship and the CISO as the first officer, so without the CEO’s commitment to security and privacy the CISO is doomed to fail, and he sees CISOs as communicators, educators and ambassadors of their practice.
If attackers have succeeded, the company should execute its incident response and crisis plan, gather the team and run a full investigation, and it should never hide evidence of a confirmed breach or stay silent. He argues that CISOs have an ethical responsibility to warn users whose data is in criminals’ hands, even at a financial and reputational cost, and that honesty and transparency bring the highest user retention after a breach. On balancing security and innovation, his rule is that security has to be convenient, and he ends his awareness trainings by telling people that there are no stupid questions and that a message or a call might prevent the next company disaster.
Key findings
- 01A Stoic focus on what is within your control helps a CISO keep a cool head and lead when the worst happens.
- 02Rehearse a data breach, even only in your head, and keep a practised incident response plan with specific scenarios.
- 03Security works only when the CEO leads by example, because without that commitment the CISO is doomed to fail.
- 04After a confirmed breach, follow the plan, investigate fully, and never hide evidence or stay silent.
- 05Users have the right to know when their data is in criminals’ hands, and transparency brings the highest user retention after a breach.
- 06Security has to be convenient, and an open door for questions can prevent the next company disaster.