Learning Strategy in Cyber Security with Christophe Foulon

Christophe Foulon is a strategic cybersecurity leader with an impressive track record in the field. He has consistently worked to add to the area of cyber security. Foulon holds several certifications, including CISSP and GSLC, showcasing his commitment to staying at the forefront of cybersecurity. 

His ability to navigate digital transformations and mitigate risks has made him a valuable asset to organizations seeking to improve their cybersecurity posture.

Foulon’s extensive experience positions him as a trusted advisor capable of tackling the rising challenges in the field. As Virtual Chief Information Security Officer, he provides strategic leadership, guides organizations through digital transformations, and spearheads efforts to mitigate cyber risks.

Hello, Mr. Foulon. It’s a privilege to have you with us.

Q1: What inspired you to pursue a career in cybersecurity, and how has your passion for this field evolved over the years? What advice will you give to young professionals about this profession?

 Mr. Foulon: My passion for cybersecurity started from wanting to figure out how computers work and help people use them more effectively. Over the years, it has evolved to help businesses achieve business goals by safely using technology to make their roles more efficient. By showing how technology could be used to augment, rather than replace, people safely, I could help a business achieve its mission and do so with reduced risk exposure.

Q2: What must be the first incident response strategy companies must implement to improve their security posture immediately?

Mr. Foulon: The beginning of any IR (incident response) plan is understanding the specific business mission that needs to be achieved and everything necessary to make that happen, including people, processes, and technology. Drilling into the detailed mission plan for a part of any business shows where there might be overlap in resource use and outputs needed for the final product, which means that resilience for overlaps will also be required to achieve the desired business mission. Next, documentation of which resources are required for which process, in the correct order/timing/etc to get the desired outputs. 

Q3: With the growing adoption of cloud technologies, how do you approach securing cloud environments to meet compliance and security standards?

Mr. Foulon: When looking at securing cloud environments, the first thing to consider is the delivery model of the cloud product in question. Is it IaaS (Infrastructure as a Service), PaaS (Platform as a Service), or SaaS (Software as a Service), all of which have different shared responsibilities with the CSP (Cloud Service Provider)? Understanding the particular shared responsibility model with the cloud service you are consuming is the first step of the equation. 

From there, understanding the requirements of the specific or various compliance security standards applicable to your business, process, or data being processed/saved/consumed helps you start to build out the framework of controls you would need to be concerned about. 

Q4: Aligning organizational goals and business objectives with cybersecurity strategies must be very difficult. What strategies do you employ to bridge this gap?

Mr. Foulon:

Then, they can work with business leaders to understand things like the level of risk that the business might be willing to take, the critical systems, processes, and data, and can use that as a framework to help develop strategies to ensure the safe and efficient functioning of the business. 

If you start with Security First and business last, you must be more aligned and try to bridge a gap formed by many misunderstandings. 

Q5: We would love to know some of your challenging cybersecurity projects where you successfully balanced security measures with user experience and productivity. Please share some.

Mr. Foulon: Every project requires balancing security measures that address user experience and productivity. For example, something as small as the types or formats of data that you would accept or allow to be used if you do not survey all the teams ahead of time, you might miss out on teams who might be ingesting or using an older version of a document format not used by others, and their software which is beyond the end of service life is an essential part of the production processes. If it were not for the whole user survey, this might not have been discovered, but it becomes a one-off use case that needs to be isolated and made an exception. 

Q6: Disaster recovery is a tough stage for organizations; you must have seen many dealing with that. What key considerations should organizations keep in mind when developing their recovery plans?

Mr. Foulon: Disaster recovery plans involve holistic planning by companies, or they can discover during an actual disaster that a critical dependency was not considered and was not part of the DR plan. When completing a DR plan, it should be a holistic practice that considers all of the IR plans from the subcomponents, ensuring that you have tested or walked through them all before pushing or walking through the large plans. 

Q7: People underestimate insider threats when it comes to cyber security. How do you address that without compromising business privacy?

Mr. Foulon: Ideally, insider threats should be a consideration of your over application / systems /platforms threat profile exercises to ensure appropriate administrative and technical controls along the way to block or limit the blast radius of their access. Next, as part of Zero Trust Access approaches, you can implement rules on restricting access and duration to critical systems and data. Finally, other administrative controls like job rotations or mandatory vacations can help limit or identify potential active insider threats in the processes. 

Q8: What emerging technologies are most promising for enhancing cybersecurity defenses in the coming years?

Mr. Foulon: There are a variety of different emerging technologies that are on the horizon, from the ability to implement the use of AI further to help identity, isolate and prevent the execution of the actions from threat actors to those being able to help automate, correlate, and escalate potential threats for soc operations leaving them with considerably high fidelity alerts to act, and finally when it comes to the ability to quickly and accurately identify threat actors and isolating them in life-like environments which allows threat defenders the ability to observe their TTP (Tactics, Techniques, and Procedures) which would enable them to further refine their defenses based on threat actors who are actively targeting them. 

Q9: With the rise of remote work, how do you ensure that cybersecurity measures remain robust while accommodating a distributed workforce?

Mr. Foulon: The rise of remote work just enforces the need for companies to operate in a ZT (Zero Trust) environment with everything from network architecture, Identity and Access Management and process configurations designed in a way that there is zero inherent turn give to any component of the process or system and it much validate why access is needed, what access is required, what type of data of access is needed, how long is this access required and who is the person/process/system on the other end of these system requests for access. In summary, one can see the level of detail system knowledge that one must have in designing an accurate zero-trust system. While many systems might claim that they are ZT (zero trust), it ultimately comes down to the proper configurations of the systems. 

Q10: How do you educate and raise cybersecurity awareness among employees to reduce the human factor in security breaches?

Mr. Foulon: Making employees aware of the cybersecurity risks starts with educating them on the concepts and implications of risks, and demonstrating a story or parallel to their personal lives helps quickly illuminate the impact on the organization. Awareness of the risk is just one part of the equation; one must then provide them with tools to help mitigate the risk, the authority to escalate when they notice irregularities or misconfigurations, and, most importantly, build that level of empathy for them to feel for the organization and reciprocated levels of care from the organization that these employees are more than an exchange of time and money for their services. Loyalty from both parties helps glue this together. 

Q11: When it comes to International cybersecurity regulations, how do you assist organizations in navigating complex compliance requirements?

Mr. Foulon:  This goes back to the “The beginning of any IR (incident response) plan,” in which you identified all of the people, processes, and technology needed for the optimal functioning of the organization. From there, you can evaluate which applicable regulations need to be considered, which administrative or technical controls might need to be implemented, and finally, whether the implementations of those controls will enable or hinder the operations of the business.

When you identify rules that might hamper the company, it becomes a business decision on whether they want to implement the control and accept the inefficiency that comes along with that to remain compliant. Alternatively, the company can take the risk of non-compliance as the potential regulatory fines imposed do not outweigh the potential revenue streams generated by remaining non-compliant. Cybersecurity and risk professionals analyze these risk/reward scenarios and present them to business leaders for their decisions. 

Q12: What inspired you to pursue a career in cybersecurity, and how has your passion for this field evolved over the years?

Mr. Foulon: Some of my interests include how we can use different ML/AI systems to safely enable the business while understanding the risk exposure from these systems and sharing them with process/system/business leaders. Most of the time, these systems are just a component of a significant business system, so their reliance on or integration to ML/AI systems can become a significant risk to the organization if not adequately understood. 

Q13: Was there any incident that led to a personal growth experience and shaped your approach to leadership and cybersecurity?

Mr. Foulon: For many in the industry, incidents like Log4j were eye-opening incidents as they exposed software supply chains both internally and externally, which systems could be built or depend upon, and fixing something would involve considerable upstream and downstream considerations of particular process flows, some which might not just be limited to the confines of the organization in question. 

Thank you so much Christophe Foulon for the interview. Our readers will get benefit from your knowledge and insights. As for our readers, you can follow Christophe Foulon on https://cpf-coaching.com/, on Twitter https://twitter.com/chris_foulon, or follow his YouTube channel youtube.com/c/BreakingIntoCybersecurity where he often shares his views.

Keep following PureVPN blog for all the latest updates related to cybersecurity. Stay safe and take care, everyone!