Navigating Cybersecurity: Insights from Brown-Forman’s CISO Sailaja Kotra-Turner
In an era where cybersecurity threats loom larger than ever, companies like Brown-Forman, the renowned owner of Jack Daniel’s whiskey and Herradura Tequila, are at the forefront of safeguarding their digital assets. Founded in 1870, Brown-Forman has a rich history, but like many modern organizations, it faces the daunting task of securing its systems and data against evolving cyber threats. To gain insights into the challenges and strategies in this critical domain, we spoke with Sailaja Kotra-Turner, the Chief Information Security Officer (CISO) and Director of Global Infrastructure at Brown-Forman.
The Role of a CISO: A Multifaceted Approach
Sailaja Kotra-Turner describes her role as encompassing three key areas: security, infrastructure, and operations. This multifaceted approach ensures that all aspects of the company’s IT environment are secured. “Operations is combined for both security and infrastructure,” she explains, “but I also oversee network servers, workstations, security engineering, access management, and governance.” This comprehensive oversight is crucial in a landscape where cyber threats are constantly evolving.
Understanding Cyber Threats
When asked about the types of cyber threats her team encounters, Kotra-Turner emphasizes the importance of staying ahead of the curve. “We focus on engineering, figuring out where new threats are emerging and what tools and process improvements are necessary,” she states. The interconnected nature of today’s security landscape means that vulnerabilities in third-party vendor software can have significant repercussions. For instance, while Brown-Forman was not directly impacted by the CrowdStrike incident, Kotra-Turner acknowledges the potential risks posed by vendor-related issues.
The Rapidly Changing Threat Landscape
The speed at which the threat landscape evolves is staggering. Kotra-Turner notes that technological advancements, while beneficial for protection, also empower attackers. “As fast as we’re coming up with ways to protect ourselves, technology improvements work in all directions,” she explains. The rise of generative AI has particularly transformed the cybersecurity landscape, making it easier for malicious actors to craft sophisticated phishing attacks. “Two or three years ago, you needed a certain level of knowledge to be a hacker. Now, thanks to generative AI, you don’t need that,” she warns.
Phishing: A Persistent Threat
Phishing remains one of the most significant threats facing organizations today. Kotra-Turner reveals that over 90% of phishing attacks are caught by technological defenses, yet the human element remains a vulnerability. “We train our end users to recognize the more difficult phishing attempts that look extremely realistic,” she says. The emphasis is not just on detection but also on reporting. “If someone clicks on a phishing email, it’s crucial that they inform us immediately,” she adds, highlighting the importance of a proactive security culture.
The Impact of Generative AI
Generative AI is a double-edged sword in the cybersecurity realm. While it can enhance security measures, it also facilitates more sophisticated attacks. Kotra-Turner explains that AI can generate realistic phishing emails and even create deepfake videos to impersonate individuals. “Our training has to keep pace with that,” she emphasizes, noting the need for employees to be vigilant about identifying AI-generated content.
Strengthening Security Measures
To combat these evolving threats, Brown-Forman employs a layered security approach, often referred to as “defense in depth.” Kotra-Turner explains that this strategy involves multiple layers of protection, from user training to advanced software solutions. “If someone clicks on a phishing email, it’s not the end of the world,” she reassures. “We have other layers that will stop it.” This multi-faceted strategy is essential in an environment where human error is inevitable.
Data Collection and Security Challenges
As Brown-Forman continues to collect vast amounts of data for operational and analytical purposes, Kotra-Turner acknowledges the challenges that come with it. “The data generated is enormous, and ensuring its security is paramount,” she states. The company relies on security incident and event management systems to parse through this data and identify anomalies. Additionally, Kotra-Turner emphasizes the importance of data governance, especially as AI tools proliferate.
Lessons Learned from Cyber Incidents
Reflecting on the 2020 REvil ransomware attack, Kotra-Turner views breaches as opportunities for growth and improvement. “A breach is a major growth and learning opportunity,” she asserts. The lessons learned from such incidents lead to enhanced security measures and a more resilient organization. “A company is often most secure three to six months after a breach,” she quips, highlighting the proactive steps taken post-incident.
Collaboration with External Partners
While Brown-Forman has a robust internal security team, Kotra-Turner acknowledges the value of external partnerships. The company collaborates with third-party security firms for penetration testing and risk assessments, ensuring an objective evaluation of its security posture. “We cannot just focus on the technical aspects; we need to be enmeshed in the business,” she emphasizes, recognizing that cybersecurity is integral to overall business strategy.
Conclusion: A Proactive Approach to Cybersecurity
In a world where cyber threats are ever-present, Sailaja Kotra-Turner’s insights shed light on the proactive measures Brown-Forman is taking to secure its digital landscape. By embracing a multifaceted approach to cybersecurity, investing in training, and fostering a culture of awareness, the company is well-equipped to navigate the complexities of the modern threat landscape. As technology continues to evolve, so too will the strategies employed to protect valuable assets, ensuring that Brown-Forman remains a leader not only in the beverage industry but also in cybersecurity resilience.