0 seconds

Sharon: Today guys I have such a special guest. This is such a treat

0:005

5 seconds

This guest is a partner at EY he’s a partner of both 

0:08

8 seconds

privacy and cyber security uh he came to Canada from Mexico in 2012 

0:14

14 seconds

He’s an instructor at UF School of continuing studies he volunteers at the IAPP 

0:21

21 seconds

he also volunteers at ISACA am so excited to have him on this show um and I do see him let's see if I can get him in the car

0:29

29 seconds

hey Carlos well it is so good to have you

0:36

36 seconds

you are an expert in both privacy and security what is actually the difference between privacy and security

0:42

42 seconds

because I find so frequently that when I talk about privacy um prospective

0:49

49 seconds

clients or you know companies are like oh yeah don't worry we we have security or yeah don't worry our IT is taking

0:57

57 seconds

care of privacy and then it gets me thinking they not actually understand the difference between the two when 

Carlos: we are talking about privacy we are talking

1:04

1 minute, 4 seconds

about this discipline that is paying attention specifically to personal information uh there will be two major goals that you will have in privacy

1:12

1 minute, 12 seconds

number one protecting personal information and that's perhaps for the similarities with cyber security may come or information security you need to

1:20

1 minute, 20 seconds

keep this information confidential you need to keep its integrity and you need to make it available for those that need to have access to it now information

1:27

1 minute, 27 seconds

security or cyber security will take care of any type of information in the organization that includes of course personal information so it's any type of

1:36

1 minute, 36 seconds

information that the company is is concerned of I I get your point when you say you have found organizations that say yes a great people is taking care of

1:44

1 minute, 44 seconds

privacy because if that's the case chances are pretty high that they are taking care of the technical portion of it but not of the compliance human

1:53

1 minute, 53 seconds

rights privacy rights aspect of it 

Sharon: Would you say that sometimes security of course while they're there to protect

2:00

2 minutes

the information they may not actually know what is being done with the information itself and that's where privacy can also come in where we

2:10

2 minutes, 10 seconds

observe what are you doing with the information and are you allowed to do it in compliance with the legislation 

Carlos: exactly and it's it's not a it's not oh

2:21

2 minutes, 21 seconds

[Music]

2:25

2 minutes, 25 seconds

ou know I I am Mexican

Sharon:  no 

Carlos: yeah no didn;t you know that 

Sharon: I would have never guessed that's insane hold

2:33

2 minutes, 33 seconds

hold on 

Carlos: every single time someone meets me for the first time I just make a very stupid joke so I say hello to people and when they ask where are you from I

2:41

2 minutes, 41 seconds

always say Sweden and and it's it's very funny to see the faces going like ah and then they say well no I'm not from uh Sweden I'm Mexican 

2:50

2 minutes, 40 seconds

Sharon: okay I have a question for you I've been meaning to ask you this privacy and security is

2:56

2 minutes, 56 seconds

like a taco and burrito because that's the 

Carlos: question because 

Sharon: yeah 

Carlos: because there are things that are similar but the

3:04

3 minutes, 4 seconds

things that are not both of them have a tortilla because the two of them need to pay attention to data protection but

3:12

3 minutes, 12 seconds

when the things comes very specific and may make of privacy a taco is on the fact that privacy needs to be focused on a

3:20

3 minutes, 20 seconds

very specific type of data which is personal data or personal information when if you go to cyber security and that can make cyber

3:28

3 minutes, 28 seconds

security the burrito you need more ingredients because you need to pay attention not only to personal information but to different types of information the company needs to pay

3:35

3 minutes, 35 seconds

attention to but the thing is that when when I decided to come to Canada I was already working on privacy at the time privacy was a very junk Concept in Mexico 

3:42

3 minutes, 42 seconds

Sharon: ah what 

Carlos: a junk Concept in Mexico I will say like 

Shaorn: did you say junk

Carlos:  junk not drunk junk yeah sorry I think the drunk

3:51

3 minutes, 51 seconds

one is Jun No yong young like like young when you are a a a a young  person A young individual so the concept was I would change the

4:00

4 minutes

word not young new in Mexico from the compliance perspective and there were companies that were uh making efforts to

4:07

4 minutes, 7 seconds

to to comply with the regulation and stuff like that so when I moved to Canada I said Canada has been doing this for a long time so I'm going to a country that is much more mature than

4:16

4 minutes, 16 seconds

Mexico from that perspective I think it will be exciting to see how things are going there so I came to Canada and I executed my first privacy assessment for

4:24

4 minutes, 24 seconds

a company and I remember saying to them well thank you I'm I'm here to to assess your privacy program uh how do you feel your privacy program is

4:32

4 minutes, 32 seconds

from the maturity perspective and they said oh we are very mature the program has been in place for I don't know X number of years so so we are complying

4:40

4 minutes, 40 seconds

with everything and doing what the regulation is demanding and I said okay that's perfect. You may  see your personal information inventory and they said uh

4:48

4 minutes, 48 seconds

we we we don't have one and I said uh okay uh may I ask why and they said well it is it is not mandatory under Canadian

4:57

4 minutes, 57 seconds

regulation and I said oh well well we we may have a conversation on that.  

But putting that aside being or not a

5:05

5 minutes, 5 seconds

mandatory requirement my my question for you is how is it that you can protect something you don't know I mean if you don't know the personal information you

5:12

5 minutes, 12 seconds

have if you don't know how it flows and the applications it goes through how how are you protecting that they started

5:20

5 minutes, 20 seconds

stumbling and and then I realized that this organization had pretty nice privacy policies and procedures and

5:28

5 minutes, 28 seconds

all of that, so everything on paper look very decent but when it came to operationalization they were simply not

5:35

5 minutes, 35 seconds

not able to operationalize that 

Sharon: Yes, and this is an issue that a lot of um companies that I talk to have um they

5:44

5 minutes, 44 seconds

you know when we do our assessment they're like here's our book of you know all of our policies and procedures and we read them we're like oh yeah t

5:53

5 minutes, 53 seconds

that that's pretty good but then when we ask some further questions about the implementation the operationalization

6:00

6 minutes

it's like nothing there so what why do you think that happens 

Carlos: I think, 

6:07

6 minutes, 7 seconds

that the disconnect comes from the fact that uh on those cases uh privacy is just considered from a compliance

6:14

6 minutes, 14 seconds

perspective you just do that and and that's like like the bare minimum to try to comply with something however regulations ask for something that will

6:23

6 minutes, 23 seconds

specifically enable a privacy program and and just having policies and procedures is is just not not that 

Sharon: well

6:30

6 minutes, 30 seconds

I mean I also don't think that many regulations specifically say You must have this policy and that policy they don't give you a list of policies that

6:39

6 minutes, 39 seconds

you have yet people companies think that if they just have a written policy they're compliant but little do they

6:47

6 minutes, 47 seconds

actually understand that if shit were  to hit the fan and Regulators were to come knocking on their door yeah sure they

6:56

6 minutes, 56 seconds

may be asking for the policies but I think they dissect way further to see if you're actually compliant with your own

7:03

7 minutes, 3 seconds

policies I think part of the problem for the implementation piece why it's not there is because it's hard

7:12

7 minutes, 12 seconds

Carlos:  it is something that I will say shook me is that recently in one of these studies we make it was found that the cyber

7:20

7 minutes, 20 seconds

security officer or the cyber security team tends to have a very good relationship with IT but not with the rest of the company that's something

7:28

7 minutes, 28 seconds

where you need to definitely partner with human resources or or training depending on how the organization is structured because they are the ones who

7:35

7 minutes, 35 seconds

know how to interact with people and if we don't have these type of alliances made in advance 

between cyber and those those actors privacy and those actors we

7:45

7 minutes, 45 seconds

will not be effective 

Sharon: it's really hard for privacy to talk to the IT team because they're so Technical and privacy

7:53

7 minutes, 53 seconds

is not necessarily so technical they may be coming from you know the legal side of things and often times your

8:01

8 minutes, 1 second

communication just doesn't come together

Carlos:  I was moderating a panel and there were three cisos acting as panelists and

8:10

8 minutes, 10 seconds

one of them was a young lady uh very smart and I remember that at some point in the conversation she said I want to

8:18

8 minutes, 18 seconds

call out something and what I want to call out is the fact that it is known and it is constantly said that 

8:24

8 minutes, 24 seconds

the weakest leak in cyber security is people I don't know why cyber security professional all of us she said tend to be very proud

8:33

8 minutes, 33 seconds

of having complicated cyber Security Programs if we know that the weakest link in cyber security is people why are

8:40

8 minutes, 40 seconds

we making things hard for them I will go just with one simple example and that's awareness there's a very good friend of mine she's a very well experienced ciso

8:49

8 minutes, 49 seconds

and she works for a large Canadian company and uh she was struggling on on how to effectively deliver an awareness

8:56

8 minutes, 56 seconds

campaign in order to make them aware of the uh issues and challenges with fishing so she ended up buying a fish

9:05

9 minutes, 5 seconds

custume 

Sharon: A what 

Carlos: a fish custume and she dressed as a fish and she went office by office branch by Branch delivering the

9:13

9 minutes, 13 seconds

With this message dressed as a fish and it worked so 

Sharon: that is amazing 

Carlos: and it was very funny because she's very formal

9:20

9 minutes, 20 seconds

very serious and and and when I saw her dressed as a fish I said I I I just can't believe that but the way she broke uh

9:29

9 minutes, 29 seconds

the the the the the way people was expecting her to behave and to show something was very effective for her now the interesting thing here is that she

9:38

9 minutes, 38 seconds

was working with their privacy team to partner on delivering the content and she worked as well with the human resources team just to find a creative

9:46

9 minutes, 46 seconds

way to work with people in order to deliver that and the message was amazingly well delivered I was recently just surfing the internet and I saw a

9:54

9 minutes, 54 seconds

Tortilla blanket and I just got a tortilla blanket and then I went to my family and I said hey I'm a taco that's the rest of thing I

10:02

10 minutes, 2 seconds

Sharon: I mean I think if you wear a taco costume most people will understand you're bring in Awareness privacy and security I mean especially after

10:11

10 minutes, 11 seconds

watching this episode they'll understand 

Carlos: exactly exactly I

Sharon:  mean Taco screams privacy and security okay 

Carlos: don't

10:19

10 minutes, 19 seconds

take this out of the video this is cool 

Sharon: okay so Carlos you um may have mentioned to me

10:28

10 minutes, 28 seconds

that on a road trip you like to eat something in

10:34

10 minutes, 34 seconds

Particular

Carlos:  I think I did

Sharon: okay oh this is odd I think you'll have to

10:42

10 minutes, 42 seconds

explain yourself

uh you like to eat a pear

Carlos:  yeah I love pears now now now now

10:49

10 minutes, 49 seconds

the challenge is that uh yeah it can be messy oh thank you you are

10:55

10 minutes, 55 seconds

completely prepared 

Sharon: I'm totally prepared 

Carlos: uh yeah exactly that's cool that's cool

11:02

11 minutes, 2 seconds

that's a good one 

Shaorn: and also while you're eating your pear you can compare privacy in 

Carlos: oh that's cool

11:10

11 minutes, 10 seconds

you're completely prepared 

Sharon: yeah sure I am I'm prepared for this whole thing tell us one story about where you saw

11:18

11 minutes, 18 seconds

privacy and security come together like a on the ground Story

Carlos:  one day it was a Friday and I was just about to uh leave

11:27

11 minutes, 27 seconds

the office this was before covid and and uh a client of mine just called and he said Carlos we we do have an issue uh

11:34

11 minutes, 34 seconds

this was a CFO of a large company and I said oh I'm I'm sorry to hear that uh how do you think we can help and this

11:42

11 minutes, 42 seconds

gentleman said well the thing is that we were going to be just releasing a new marketing campaign next Monday on TV and

11:50

11 minutes, 50 seconds

we just found out today that our main competitor is just launching the exact same product a $1 cheaper than ours okay

11:59

11 minutes, 59 seconds

so that's not a coincidence they I am sure that they had access to our marketing plan and I think I am sure he said that this is something that went

12:07

12 minutes, 7 seconds

out through the network so I want you to come with your team to do some sort of an internal assessment for five days all right it was a Friday at the end of the

12:15

12 minutes, 15 seconds

day and he said I want you here tomorrow Saturday and I said oh oh sure sure we will be there so we went there we started talking and he was of course

12:24

12 minutes, 24 seconds

very concerned about what was happening and the building was almost empty because it was a Saturday.

but then at some point we started hearing someone

12:31

12 minutes, 31 seconds

literally yelling at reception so we ended up going to reception talk to the guard and and and the guard gave us what this gentleman was just delivering and

12:39

12 minutes, 39 seconds

it was uh the marketing campaign binder the guy was a messenger from the marketing agency the company was working with that was bringing for the third

12:47

12 minutes, 47 seconds

time in a week okay a copy of the marketing strategy binder that they made for the company on a Saturday okay

12:54

12 minutes, 54 seconds

because it was urgent now as as the guard was just explaining this I just started looking around and 

13:01

13 minutes, 1 second

we noticed something that was pretty interesting there were no doors in the company we just 

Sharon: very trendy open concept

Carlos: Exactly, that's great from the people perspective

13:09

13 minutes, 9 seconds

but is there any way we can go to the the the office of the chief marketing officer so we went no door no door and

13:17

13 minutes, 17 seconds

in addition to to having no door I mean there were like like like binders all over

13:23

13 minutes, 23 seconds

the place with information even media that that was just there available to

13:30

13 minutes, 30 seconds

anyone and I said to the CFO I have to tell you I mean I don't doubt that you may have issues on the digital side of

13:37

13 minutes, 37 seconds

things but frankly it is clear to me based on what we just saw that the information you lost just went through the door to be 

Sharon: you mean no door

Carlos:  exactly

13:46

13 minutes, 46 seconds

there's organizations where they manage sensitive information that they need to be paying attention to and properly protect 

Sharon: generally it's better

13:54

13 minutes, 54 seconds

to have your information stored in a cloud than documents in your office while vendors such as cloud service

14:00

14 minutes

providers do have mature sophisticated security controls you should not rely on them solely and that you as a company

14:09

14 minutes, 9 seconds

should have additional Security safeguards in place to protect that information

Carlos:  I would say that in general that that would be more effective

Sharon:  okay

14:18

14 minutes, 18 seconds

amazing boom done 

Carlos: I'm enjoying my pear

Sharon:  nice

14:24

14 minutes, 24 seconds

[Music]