We ‘Go Phishing’ with Jonathan Fischbein, Check Point Software’s Chief Information Security Officer, who tells us about life both in and outside the office.
1. What would you describe as your most memorable achievement in the cybersecurity industry?
After 25 years in the cybersecurity industry, I have had many memorable achievements, but I would say that successfully moving the entire Check Point workforce to remote working securely and effectively during mid-March 2020 stands out as one of the most important ones. The thing I’m most proud of is that our customers and partners experienced a completely smooth transition. The very DNA of Check Point is that people need to access very critical and sensitive information, which in the past, would have been held centrally at HQ and not easily accessible. However, to enable everyone to continue to be productive during to the pandemic, we were able to tweak our systems overnight and make everything accessible safely and above all, securely.
2. What first made you think of a career in cybersecurity?
I first thought about it in 1999 and got my first opportunity in 2000 in the first security operation centre in the Middle East. Due to my military background, I applied for it, as it looked interesting and exciting, and I knew back then that there wouldn’t be a single predictable, boring week in cybersecurity. Luckily, 20 years later, I am pleased to say I’ve still not had one dull week in the industry.
3. What style of management philosophy do you employ with your current position?
For me, my philosophy is that communication is key, and my style is to be the ‘good cop’ when it comes to educating and explaining processes to customers and employees. I’m very communicative in my style as a CISO and I spend a lot of time explaining security policies, so people understand why we do things the way we do. About 90% of my role is internal, but about 5 – 10% is with customers, but whoever the audience, communication is key. People always want to hear about the ‘war stories’ that you’ve experienced in your role, which is always a good way of explaining.
4. What do you think is the current hot cybersecurity talking point?
Firstly, how organisations can secure supply chains securely is an on-going hot topic, as we’ve seen with the SolarWinds attack last year, as well as other attacks such as the Stuxnet attack on Iranian Power Plants in 2010. Because of the complexity of corporate supply chains, it’s not easy to find the weak links in those chains and fix them. Secondly, cloud security is a huge topic. There are various cloud platforms such as AWS or Google Cloud, so you can be an expert in one but not the other – which can create problems and lead to security gaps. Lastly, IOT security – the number of IOT devices inside corporate networks is a very big issue. We are allowing employees to work and connect to enterprise networks from home, but what else is on their home network that could be vulnerable to attack – such as IOT security cameras, or even smart lightbulbs? These are all potential security issues.
5. How do you deal with stress and unwind outside the office?
Most importantly, I cherish spending time with my family. I also love sports and tennis in particular.
6. If you could go back and change one career decision what would it be?
In the last 18 years at Check Point, I’ve moved eight positions and I’m proud of my accomplishments and that I’ve been able to work in different roles. I’m probably the wrong person to ask this question to as I’ve had a really interesting career so there isn’t anything I would change.
7. What do you currently identify as the major areas of investment in the cybersecurity industry?
The top area of investment I would say is cloud security, especially automation. There is a huge lack of expertise here. For example, as the CISO of Check Point, I am managing about 46 different solutions. Of course, 90% are from the same brand, but the variety is still huge, so you need that expertise. The only way you can sustain it is through automation. If you have good automation it can save up to 70% of the manpower, so it’s important to invest here. In the last few months, we’ve also seen a lot of start-up investment in building security into Devops and CI/CD approaches. Another obvious one is threat prevention. We’re likely to be living in ‘hybrid mode’ as we continue to navigate through the post-pandemic world, which will see some people working from home, some returning back to the office, so automated threat prevention for remote access security will be key.
8. Are there any differences in the way cybersecurity challenges need to be tackled in the different regions?
I don’t think so. I live in Israel and we have customers from all over the world, but I hear the same challenges from all the different regions. The only thing that differs is their intensity.
9. What changes to your job role have you seen in the last year and how do you see these developing in the next 12 months?
Organisations have no doubt admired and cherished their IT security teams for helping employees adapt to the seismic shift of securely and effectively working from home. That’s undoubtedly the biggest change over the last 12 months. I also think that the last year has made it clear that IT security teams can only work under stress for so long, as the pandemic was a very stressful time for those in the industry – it isn’t sustainable to work under stress for months on end, as it leads to mistakes. Mistakes often lead to the security posture being jeopardised. That’s why we have so many great products at Check Point that offer red alerts when there is a problem or misconfiguration. Finally, I’d say that the personal touch is missing and what’s changed. You lead people by example and when you’re stuck at home without seeing your team. We can do plenty of things online but you can’t beat in-person time with colleagues.
10. What advice would you offer somebody aspiring to obtain a C-level position in the security industry?
In the past, people thought that being a CISO is a very technical role, but it’s also a managerial role. You need a technical understanding, but if you’re not a manager or leader, it will be very difficult to succeed. You have to know how to deal with peers and customers and to be able to manage and prioritise requests efficiently. It’s a question of communicating clearly and helping people to understand your expectations.
