The Chief Information Security Officer (CISO) Exchange is a flagship event bringing together innovative and insightful technology leaders across industries for in-depth discussions and exchanges of experience and ideas to address the emerging landscape of digital business in a digital economy.
Taking place this year March 24-26 at the InterContinental in San Diego, California, this year’s theme was “Empowering A Circle of Trust: Consistent and Collaborative Security from Inception.”
Here, Cyber Security Hub caught up with Albertsons CISO John Kirkwood to find out what's on his mind, what initiatives he's taking on this year and how to be more proactive with security.
Vice President and CISO
Albertsons-Safeway
John Kirkwood is an industry recognized Global Chief Information Security Officer who has successfully implemented information and cyber security governance, risk management, controls and compliance programs to large corporations in the financial services and retail industries for more than 18 years.
As the Global CISO and for Albertsons Companies, Kirkwood is responsible for ensuring that the information risk management and security program meets the needs of the merged Albertsons and Safeway companies. Albertsons is one of the largest food and drug retailers in the United States, with both a strong local presence and national scale, operating 2,200+ across 35 states and the District of Columbia under 18 well-known banners including Albertsons, Safeway, Vons, Jewel-Osco, Shaw’s, ACME Markets, Tom Thumb, Randalls, United Supermarkets, Pavilions, Star Market, Carrs, Haggen and Plated.
CS HUB: When it comes to protecting your network, what keeps you up at night?
KIRKWOOD: Since our network extends to our cloud, we are dependent on our cloud providers to protect our network. The concern is that these partners may or may not have implemented the controls or compensating measures that ensure that threats to us are managed.
CS HUB: Have you recently started adding any artificial intelligence-embedded products to your organization’s security arsenal?
KIRKWOOD: We aggressively utilize AI and machine learning. Virtually all of our tools either utilize ML to create and enhance their rule engine, or AI in determining what new rules should be implemented. Further, we find that there is a symbiotic relationship between ML and AI. AI helps us to improve our existing rule bases, ML uses the learnings from AI in the iterative analysis of events, matching the events to known patterns and vector of cyber attacks.
CS HUB: How do you know the tool is working?
KIRKWOOD: It’s trust but verify. So for ML we make sure the rules are what they are supposed to be. It makes no sense to find something with AI and then you can’t do anything with it. AI and ML have to work together. I’m trying to get to AI. ML to me is more the arms and legs that are rule-based. AI says, ‘Hey, can I find 100 needles in 1,000 haystacks?’ So AI is being used to enrich what you have and find patterns where you didn’t have them before.
CS HUB: What are your best practices for ensuring visibility when your data resides in multiple and/or hybrid clouds as well as for classifying all connected devices?
KIRKWOOD: We use a CASB (Cloud Access Security Broker) to provide visibility and management of our multi-cloud environment. While CASB software and our internal processes are still maturing, we have found great value in the information we receive from our CASB.
CS HUB: When it comes to being proactive about security, what’s the one piece of advice you’d give your peers that you think is not practiced enough?
KIRKWOOD: I would ask them to focus on how they provide services and capabilities, linking them to overall business priorities. The business proactively typically does not (and probably should not) care about security unless we can demonstrate the benefits or advantages to the business. And we need to be able to move with agility to accommodate the hyper speed of business innovation and transformation.
See Related: “Albertsons Leverages Microsoft Azure, 365 To Enhance Customer Experience”