Greg Van der Gaast, formerly named one of the World’s Most Infamous Hackers, sat down with AI Journal to discuss leadership in cybersecurity and what he would advise his younger self. A popular AI and digital disruption speaker for corporate events, Greg is highly regarded for industry knowledge – do not miss this exclusive interview with a leading cybersecurity expert.
What is the most pressing cyber threat to UK businesses?
“Everyone will say ransomware, but ransomware is basically a payload. It’s a way of monetising a breach. And I think the really shocking thing is the way companies get breached, the way that people get in the door, really hasn’t fundamentally changed in the 25 years I’ve been doing this.
“People are still not building systems properly, they’re still not maintaining them properly, they’re still not doing asset inventory. They’re not patching properly, they have poor processes, they have a lack of consistency in processes. You’re basically living in a house with a thousand doors and a thousand windows, and some constantly being left open.
“That’s how people get in.
“For large businesses and organisations, you need a holistic and business aligned security approach that’s truly proactive and in line with the business, in line with how things actually work, so that you come up with effective, sustainable ways of doing things rather than the security status quo, which is just ‘buy another tool’.”
What does leadership in cybersecurity look like to you?
“I think leadership is leadership. It shouldn’t be related to cybersecurity at all.
“I see a lot of leadership courses in cybersecurity about tech and frameworks and compliance and this and that. I’m able to have a decent conversation with an executive and they find it hugely refreshing.
“Explain stuff in simple English and don’t be that really boring person no one wants to invite to dinner. You would be surprised at the amount of traction you get. I think in security, we’re somewhat protected because people have no idea what the hell we’re talking about, because we’re the geeks. And when something goes wrong, no one wants to deal with us.
“I was actually at a conference a couple of years ago where they asked boards what the primary reason was for them funding their security organisations, giving their CISOs money. The most popular answer – 35% of the votes – was to make them go away.
“They hadn’t justified a strategy, an approach, an ROI or anything like that. They were just so annoying and unpleasant to be around; they just wanted to make those people go away.
“I don’t think security should be cost centred and I mean that beyond the risk equation. I think you should provide businesses value, where you’re actually generating more revenue than you’re consuming. And then the fact that you’re reducing risk in the process, that’s just a bonus!”
If you could give your younger self one piece of advice, what would it be?
“I’ve had a hugely transformational journey. I was a severe victim of Rockstar syndrome at an early age, because I was technically very strong, quite arrogant, highly certified, doing lots of stuff.
“I kind of got stuck at some point in my career where things got pretty dire, and it’s been almost out of desperation of ‘I’m going to die in a ditch’. So, I may as well just give away everything I know. And that’s when that transformation happened, when I started just giving away everything I knew, trying to help others by sharing the knowledge without getting anything back for it.
“That’s when I started getting that recognition of, ‘oh, this person actually knows stuff’. It automatically makes you an authority, and that kind of elevated me. It led me to the wonderful leadership positions that I get to fill now, where I get to work at C-level and board level in the business and have my own teams.
“And my teams to me, they’re my people. They’re like family. I love them to bits!”
This exclusive interview with Greg Van der Gaast was conducted by Mark Matthews.
