This edition features a handful of the most iconic leaders in enterprise security that are the forefront of leading us into a better future Read More: https://ciolook.com/the-10-most-iconic-leaders-in-enterprise-security-2022-june2022/

1. VOL 06 | ISSUE 01 | 2022
The
Iconic
in Enterprise
Secur y,
2022
10
Most
Protection
Across Seas
Maritime Cyberthreats
and Cybersecurity

5. Raunak Mhetre
Raunak
The
in Enterprise
Secur y,2022
Iconic
Most

6. 08
COVER
STORY

7. Protection Across Seas
Maritime Cyberthreats
and Cybersecurity
16
ARTICLE
C O N T E N T S
Michael Coden
A Futuristic Leader
Protecting the Present
Charles Henderson
Defending Against Emerging
Cyber Threats
onShore Securities
Ensuring Freedom by Strengthening
Cybersecurity Defenses
22
28
20

8. CONTENT
Senior Editor Alan Swann
Executive Editors Raunak Mhetre
Alex Spellman
DESIGN
Visualizer Dave Bates
Art & Design Director Shyam Sonawane
Associate Designer Revati Badkas
SALES
Senior Sales Manager Kshitij S.
Customer Success Manager Jack Ryan
Sales Executives John, Shrinivas
TECHNICAL
Technical Head Aditya K.
Technical Consultant Victor Collins
June, 2022
Copyright © 2021 CIOLOOK, All
rights reserved. The content
and images used in this
magazine should not be
reproduced or transmitted in
any form or by any means,
electronic, mechanical,
photocopying, recording or
otherwise, without prior
permission from CIOLOOK.
Reprint rights remain solely
with CIOLOOK.
FOLLOW US ON
www.facebook.com/ciolook
www.twitter.com/ciolook
WE ARE ALSO AVAILABLE ON
Email
info@ciolook.com
For Subscription
www.ciolook.com
CONTACT US ON
Pooja M Bansal
Editor-in-Chief
sales@ciolook.com
SME-SMO
Research Analyst Eric Smith
SEO Executive Nikita Khaladkar

9. Brief
Company Name
Featured Person
IBMers believe in progress that the application of intelligence,
reason and science can improve business, society and the
human condition.
IBM X-Force
ibm.com
Charles Henderson
Global Managing
Partner and Head
AIG is a leading global insurance organization.
AIG
aig.com
Cornelius Vander
Starr
Founder
Kingston has grown to be the world's largest independent
manufacturer of memory products.
Kingston Technology
kingston.com
John Tu
Founder
Deloitte is a leading global provider of audit and assurance,
consulting, financial advisory, risk advisory, tax, and related
services.
Deloitte
deloitte.com
Punit Renjen
CEO
Centene Corporation provides high-quality healthcare services
to members in all 50 states.
Centene
centene.com
Sarah M. London
CEO
Johnson & Johnson is the largest and most broadly based
healthcare company in the world.
Johnson & Johnson
its.jnj.com
Joaquin Duato
CEO
BCG Platinion, believes that industry-leading organizations are
bionic, successfully combining the capabilities of humans and
technology.
Boston Consulting
Group-Platinion
advisor.bcg.com
Michael Coden
Senior Advisor
at BCG
onShore Security is one of only a handful of managed
cybersecurity providers.
onShore Securities
onshore.com
Stel Valavanis
Founder & CEO
JMARK has been providing innovative I.T. solutions to
organizations of all sizes.
jmark
jmark.com
Thomas Douglas
CEO
Kyndryl is a focused, independent company that builds its
foundation of excellence by creating systems in new ways.
Kyndryl
btcyber.net
Kris Lovejoy
Global Practice
Leader Security And
Resiliency

10. Our mission at Kyndryl
is to help customers see
around the corners. To help
them transform from a
backward-facing, compliance,
or crisis-driven security
function to one that
embeds resilience by design.

12. n the face of a three-year-old who is wailing at the door
Ias I leave for a business trip, I can tell you it's an
incredibly difficult choice," Kris Lovejoy told CIO Look
when we asked her about the hurdles she had to
overcome.
Being a Global Practice Leader for Security &
Resiliency at Kyndryl, Kris realizes the challenges
women face in her profession are very different. It
wasn't easy to be a single mom and a business leader
both simultaneously.
It was a pleasure to speak with Kris, who is an
inspiration to many, and learn about her sacrifices and
hardships to get to where she is now.
Storms Abound on the Road to Prosperity
Kris came to Kyndryl from EY, where she was the global
consulting cybersecurity leader responsible for its
multi-billion-dollar security practice. Prior, she was the
founder and CEO of BluVector Inc., an AI-powered
sense and response platform Comcast acquired in
2019. She was also general manager of IBM's Security
Services division, where she led teams that built end-
to-end security programs for IBM's global clients.
Kris holds U.S. and EU patents in areas around Risk
Management. She served as a member of the World
Economic Forum's cybersecurity committee. She was
also humbled to be named one of the "Top 50
Cybersecurity Leaders of 2021" by The Consulting
Report and Consulting Magazine's "Top Woman
Technology Leader" in 2020.
While she never had a choice as to whether she was
going to work – she was a single mom – she had to
decide whether to take the safe road or take a risk and
pursue promotion.
Kyndryl's philosophy and ideology
At Kyndryl, they are committed to the health and
continuous improvement of the vital systems at the
heart of the digital economy. With their partners and
thousands of customers, they co-create solutions to
help enterprises reach their peak digital performance.
The world has never been more alive with
opportunities. Everyone can seize them.
Kyndryl was spun-off from IBM IT infrastructure
services in 2021. Its global base of customers includes
75 of the Fortune 100 companies. With 90,000+ skilled
professionals operating from more than 60 countries, it
is committed to the success of its customers,
collaborating with them, and helping them to realize
their ambitions.
Inspiring a change in the cybersecurity industry
About 25 years of experience in "cyber resiliency," the
phrase Kris prefers, has taught her that everyone must
treat living with cyber threats as one does living with
viruses. They are unavoidable. The question is – how do
you best protect yourself against it and assure a quick
recovery?
Cyber resiliency services are an essential component of
modernizing and managing any IT infrastructure, and
strategies and budgets must be aligned to address the
"new normal." Companies must prioritize fast-track
modernization programs – to infrastructures like a
hybrid cloud – so they can achieve a resilient business
transformation.
Kris' contribution then, she hopes, will be in shifting the
work that she does in this field from simply "security" to
one of "cyber resilience." The public and private sectors
need both. It is important to be able to anticipate,
protect against, withstand, AND recover from cyber
threats. That's what she means by "cyber resilience."
Kyndryl and Its Tower of Strength
When Kris' company was spun-off, the first order of
business was to name the new company. A lot of
thought went into that, arriving at this description that
she attributes to her leadership collectively, beginning
“
The balance between work’
and your life outside of
work is critically important.
Don’t sacrifice one for
the other.

13. with the CEO. The team
articulated: that "Kyn"
comes from "kin." It
represents the strong bonds the
company forms with customers and
with each other. Its people are at the
heart of the business. "-dryl" is coined f
rom "tendril," evoking new growth and c
onnections. By working together, they are gr
owing.
The work they do at Kyndryl reflects these principles.
So, in her leadership role, as Kris travels virtually across
the world and meets fellow Kyndryls, she is often asked,
“What's our vision and mission in the Security and
Resiliency Global Practice?"
Kris answers, "I believe that in order for our customers
to operate effectively in today's world – they have to
not only understand and act on existing risk but be able
to "see around corners," and make informed decisions
about the cyber risk that's emerging so that they can
embrace transformation and innovation with
confidence. Our mission at Kyndryl is to help customers
see around the corners. To help them transform from a
backward-facing, compliance, or crisis-driven security
function to one that embeds resilience by design."
Providing Resourceful Solutions by Utilising
Technological Improvements
While everyone understands cyber risk, they also
understand the needs of a business vis-a-vis IT
modernization. The ability to bridge and navigate is not
a capability many vendors offer. At Kyndryl, they have a
deep bench of skilled practitioners across a massive
range of technology platforms. They also have a strong
and growing set of tech alliances.
At this point of an alliance, they are combining their
world-class capabilities with other companies that have
complementary capabilities to deliver world-class
solutions for their customers. A recent
example is a partnership they announced
with Dell Technologies to help secure critical
data sets for their customers and provide a
verified process to recover data back into their
business when faced with a cyber threat. Today's
technology and a skilled workforce enable this
capability.
Adjusting the Company's Focus to Address Impending
Issues
Business as usual isn't working. So, Kris would shift the
company's approach. A focus strictly on cyber defense
will not suffice. Today it is no longer a question of
whether cyber attackers will breach Kyndryl's
defenses, but when they will break through and how
much damage they will do.
Hackers only need to be skilled (or lucky) enough to
break through just once; businesses and governments
would need to fend off 100 percent of the constant
attacks to remain safe—that's a hopeless proposition.
Just as the company's approach to COVID has shifted
from focusing only on prevention to embracing a

14. broader strategy that also includes managing its
inevitable impact, cybersecurity must also adopt a new
posture. It's time to embrace a comprehensive strategy
for cyber resilience—not just cyber security.
Cyber resilience means anticipating, protecting against,
withstanding, and recovering from attacks on cyber-
enabled services. These cyber incidents affect all of
society, spreading uncertainty and risk among the
public, governments, and commercial markets alike.
"We must make 2022 the year we implement a whole-
of-economy cyber resilience strategy. The business
community and policymakers must align on a consistent
set of cyber resilience principles to ensure that our
entire economy and critical institutions are prepared
for future attacks. That's the direction I would take this
industry," Kris adds.
Preparing to Be a Part of Major Changes
Nation-states seeking an advantage in the cyber
competition are turning to AI for offensive and
defensive applications. On the defensive side, AI
automation of cybersecurity tasks previously handled
by analysts and detecting so-called "dark patterns"
from large quantities of data demonstrates the
possibilities of machine learning methods for detecting
zero-day malware, threat detection, and automated
remediation. From an offensive perspective, the
growing diffusion of AI tools and techniques in
cybersecurity functions also presents a new front in
cyber competition, specifically making the conditions
even more conducive to cyber conflict.
Attackers are already using methods like reinforcement
learning and generative adversarial networks to
produce new types of cyberattacks that can evade
cyber defenses, meaning that adversaries could employ
a variety of methods, including compromising ML
supply chains, poisoning training data such as open-
source malware repositories, unleashing malware with
greater degrees of autonomy, and targeting defenders'
trust in machine learning systems.
Net - as AI becomes the new normal in cyber
operations, the line between offense and defense will
continue to fade. It may fuel the low-level drumbeat of
cyber competition during peacetime. And during a
crisis, the concern is the potential for AI technology to
It’s time to embrace a
comprehensive strategy
for cyber resilience—not
just cyber security.
misinterpret information, signal, and event, possibly
leading to an avoidable escalatory cycle.
Their intention at Kyndryl is to help lead the market in
establishing a set of cyber norms that inform and guide
behaviors vis a vis the appropriate use and
management of AI specifically, and advanced
technology like quantum computing within the cyber
realm. They believe technology companies and
regulators need not act as competitors but work
together to create a level and ethical playing field and
allow for innovation.
On the Path to Excellence
For Kris, future goals are fairly simple – build security
and resiliency capabilities that enterprises both need
and value, deliver those capabilities via knowledgeable
and passionate practitioners, and assure those services
are delivered with excellence. If she can achieve those
goals, she is certain that market success is inevitable.
And market success in terms of leadership means that
she has achieved her ultimate goal – changing the world
for the better by making it possible for organizations to
innovate with confidence.
A Guiding Light
Kris has a piece of advice for aspiring entrepreneurs,
"The balance between "work" and your life outside of
work is critically important. Don't sacrifice one for the
other. Your contributions to your partner, your children,
and your family are as important, if not more important,
than the work you do for your company. Embrace both
and bring your 'best self' to the task of achieving what's
important to you and your family, as well as your
career.”

15. 1 Year
12 Issues
$250
6 Months
6 Issues
$130
3 Months
3 Issues
$70
1 Month
1 Issue
$25
CHOOSE OUR SUBSCRIPTION
Stay in the known.
Subscribe to CIOLOOK
Get CIOLOOK Magazine in print, and
digital on www.ciolook.com

18. | June 2022 |
www.ciolook.com
16

19. Maritime
Cyberthreats and
Cybersecurity
ceans have long been the
Ocentral support pillar of
international trade and
commerce. Humans have been
using water bodies to transport
products from one location to
another for almost 5,000 years and
have gained a better understanding
of the strategic advantages of
marine trade. Watercraft
progressed from logs linked with
rope to miniature, carved wooden
vessels. The first significant trade
routes appeared not long after, and
the worldwide maritime
transportation network was well
underway. Marine transportation
contributes to one-quarter of US
GDP from this transition, or about
$5.4 trillion, and most global supply
chains depend on maritime
transport for their basic needs.
Outside of the United States, the
sea and ports moved around 80% of
global trade by volume and more
than 70% by value. Global marine
trade is gaining traction; in 2018,
the industry grew by 4% globally,
the most substantial rate in five
years.
Similarly, operational efficiency and
profit drive maritime transportation
in other critical infrastructure
industries. The industry has seen an
exponential increase in sea trade
and has driven prices down
Protec on Across Seas
www.ciolook.com | June 2022 |
17

20. internationally. This rapid increase in dimensions has
resulted in ships, and the Maritime Transportation
System is becoming more complex. Every ship in the
industry has some common functions but is
fundamentally different in operation, cargo and
passenger capabilities, and crew requirements. The fact
that one's country of registration, ownership, and
management may all be different complicates applying
legislation to vessels, necessitating the coordination of
numerous countries when adjudicating an occurrence.
This is why cybersecurity must be implemented and
practiced by people engaged in all maritime activities.
The maritime industry has spent years developing and
deploying proprietary software and hardware, limiting
its connectivity and risk exposure. Cybersecurity
initiatives in the Maritime Transportation Systems
(MTS) demonstrate how difficult it is to securely design,
manage, and run a fully linked system—especially when
these environments differ from ship to ship and port to
port.
The MTS's greater reliance on merging OT and IT
systems has brought new vulnerabilities and widened
the attack surface in the marine environment. However,
the emphasis and resources spent to combat these new
threats are still lagging. All components in the MTS
logistical chain work together to build solid programs,
appropriately train staff, and maintain the operational
efficiency required for all elements to function as one
to prevent any Cyber-attacks. Companies have
increased cybersecurity investment compared to the
increase in automation and digitization in recent years
to keep up with the rising attacks. A 400 percent
increase in maritime cyberattacks occurred in 2022,
and a 900 percent increase in attacks targeting ships
and port systems in the previous three years suggests
that the maritime industry is in the crosshairs of
malicious cyber actors.
There are many reasons attackers target the maritime
industry and make hay. Attackers in cyberspace fall
within some broad categories based largely on intent
like pure cybercriminals, cyber activists, terrorists, and
state-sponsored entities. Cybercriminals, like criminals
in the physical world, are chasing monetary or other
tangible incentives; they are not ideologues; they want
the money. Annually, cybercrime damages the global
economy by about $1 trillion. The MTS has roughly 33
cyber criminals who are responsible for the majority of
ransomware activities. The attacks they carry have
some large motive built around them and are often
successful. The next group consists of cyber activists
with philosophy, politics, social movements, and other
nonmonetary goals. Defacing websites, launching social
media demonstrations, and committing cyber
vandalism are common hacktivist techniques; while
criminal in nature, the objective is rarely financial.
These attacks are fuelled by enmity and lead to
criminals completely destroying companies' systems or
vandalizing them.
Cyber terrorism has been a massive problem for all
industries worldwide, and the maritime industry is no
different. The employment of cybersecurity capabilities
by a traditional terrorist actor could be driven by
political goals and resemble an act of terrorism in real
space—a violent criminal activity aimed to frighten or
induce fear. This concern might cause major economic
upheaval, either directly or indirectly. Terrorist groups
frequently use cyberattacks for financial gain to fund
other activities and recruit new members. This brings
us to the next group, which is State-sponsored entities.
The most prevalent goals for this type of entity are acts
of financial, industrial, political, and diplomatic
espionage in cyberspace. According to some estimates,
intellectual property (IP) theft damages the world
economy by more than $2 trillion annually.
Governments worldwide spend a lot on these attacks to
know about rival motives and design their strategies.
Millions are being spent on cybersecurity by the same
governments to protect their maritime activities,
creating an endless loop of cyberwar.
| June 2022 |
www.ciolook.com
18

22. Charles Henderson
Global Managing Partner
and Head of IBM X-Force
IBM
| June 2022 |
www.ciolook.com
20

23. e need to rethink this entirely," states
WCharles Henderson, "We need to 'give up'
on Security as we currently know it."
According to the Global Managing Partner and Head of
IBM X-Force, what you formerly thought safe is no
longer so and cannot be trusted in this new reality.
We've outgrown the necessity to keep the adversary
out; now, we must master the art of discovering them in
the victim environment before they gain access to
critical data.
Charles helps businesses stay ahead adversaries, using
his 20+ year experience as a hacker.With the belief that
modern business models have rendered the perimeter
obsolete and our reliance on a plethora of trusted
connections, Charles suspects a complete overhaul of
our security strategy.
The firms that X-Force works with range from Fortune
500 companies to small and midsized businesses
looking to improve their security posture or deal with a
security incident.
CIO Look caught up with Charles in our attempt to find
"The 10 Most Iconic Leaders in Enterprise Security,
2022."
Below are the highlights of the interview.
Brief our audience about your journey as a business
leader until your current position at your company
name. What challenges have you had to overcome to
reach where you are today?
My introduction to Security goes back to my early
childhood –I was always fascinated with how things
work, what they are supposed to do, and what more
they might do. I was more interested in the way things
broke rather than how they were built. In my youth, I
started hacking, making devices do something other
than what they were intended to – it was a form of
problem-solving that stuck with me for the long haul. It
all started from there and led to a more than 20-year
career as a hacker, being hired by some of the world's
largest companies to outsmart their security
technologies and strategies.
As a hacker, I've found that one of the biggest
challenges I've had to overcome is a dated, deep-rooted
misconception of hackers as criminals, but it's also
made me very passionate and incentivized me to
educate the business community about offensive
security and the value of hackers.
Today, as the head of IBM X-Force, I have the privilege
of leading a global team of hackers, security
researchers, investigators, incident responders, and
Charles
Henderson
There is no greater asset
than teamwork and
cultivating an environment
where each team
member can feed off each
other’s creativity,
brainstorm, and
problem-solve together.
www.ciolook.com | June 2022 |
21

24. intelligence analysts. The team provides clients -from
Fortune 100 enterprise companies to small and mid-
sized companies - with offensive and defensive security
services. On the offensive side, our team of hackers is
hired by clients to find, prioritize, and help fix
exploitable vulnerabilities before attackers find them.
On the defensive side, our team of first responders,
investigators, and researchers helps clients rapidly
detect, respond to, and investigate threats to reduce
attacker dwell time and minimize impact.
Tell us something more about your company and its
mission and vision.
IBM Security is a global security leader charged with
helping businesses thrive securely, protecting their
data, trusted relationships, and mission by leveraging
one of the most advanced and integrated portfolios of
enterprise security products and services. As part of
this effort, the team I lead, X-Force, enables
organizations to effectively manage risk and defend
against emerging threats.
IBM operates one of the world's broadest security
research, development, and delivery organizations and
monitors more than 150 billion security events per day
in more than 133 countries. We serve all types of
businesses, all the way up to the world's largest
multinational corporations. And no matter who our
customer is, we can scale to whatever their demands
are at any given time.
Enlighten us on how you have impacted Security
through your expertise in the market.
As I mentioned earlier, there was a lot of education that
needed to be done when it comes to hackers and
offensive Security, and I'm proud of how X-Force Red,
IBM's hacker team within X-Force, contributed to
elevating and destigmatizing the hacking profession, as
well as raising awareness about the importance of
penetration testing, vulnerability management, and
adversary simulations to strengthen businesses' cyber
readiness. X-Force Red is also sought out by some of
the most renowned conferences in the global security
community as featured speakers to help not only
advance offensive security practices but attract
aspiring talent to the field, including Black Hat, DEF
CON, RSA, OWASP AppSec USA/Europe, and SXSW.
Undeniably, technology is playing a significant role in
almost every sector. How are you leveraging
technological advancements to make your solutions
resourceful?
It's mistakenly believed that one of the biggest
challenges in Security is complexity – but complexity is
not the challenge; simplicity is. The current security
construct is formed in such a way that businesses are
accustomed to adding tools on top of the tool,
technology on top of technology, in an effort to bolster
their security posture against threats. As a result,
businesses have entangled themselves in a web of
complexity that they can't get out of and one that
adversaries know all too well how to manipulate to
their advantage.
At its core, IBM's security portfolio is meant to help
simplify Security for our customers, and we're doing
that by relying on open technologies and solutions
founded on open security standards, so
interoperability, collaboration, and agility are never
sacrificed. More and more businesses are recognizing
| June 2022 |
www.ciolook.com
22

25. the business value in an open, hybrid cloud approach,
making the adoption of open security standards all the
timelier and more important.
What, according to you, could be the next significant
change in the Security sector? How is your company
preparing to be a part of that change?
In Security, it takes a village to defend against a
constantly evolving adversarial landscape, and the
private and public sectors are both parts of that village.
Following the Solarwinds compromise, and shortly
after the ransomware attack on Colonial Pipeline to the
more recent disclosure of the critical Log4j
vulnerability, we've seen a rapid shift in how private
companies and government security agencies
collaborate to stay ahead of the threats. The progress
we've begun seeing with more information sharing and
threat-sharing partnerships between security teams
and the government is the start of a new chapter in
Security- what I call the democratization of threat
intelligence.
IBM is a proud Alliance Partner in the Joint Cyber
Defense Collaborative (JCDC) that DHS CISA formed,
helping its critical mission to establish a collective and
coordinated defense against cybercrime. In addition,
we remain committed to democratizing our X-Force
threat intelligence and developing new threat insights
daily, stemming from our cross-industry incident
response and penetration testing engagements, threat
monitoring capabilities, and open-source data, which
we make available through the open-access X-Force
Exchange threat sharing platform.
Where do you envision yourself to be in the long run,
and what are your future goals for your company?
When you look at where X-Force has come since its
inception, our long-term vision stays largely the same:
to continue building expert teams of hackers, incident
responders, intelligence analysts, and developers to
resist modern threat actors and protect and inform the
clients we serve.
What would be your advice to budding entrepreneurs
who aspire to venture into the business sector?
An essential piece of advice I can offer is to value your
team. There is no greater asset than teamwork and
cultivating an environment where each team member
can feed off each other's creativity, brainstorm, and
problem-solve together. Success has no room for
superhero syndromes – especially in the security
industry, where it's essential to collaborate, lean on
diverse skillsets, and each team member can cover the
other's blind spots.
www.ciolook.com | June 2022 |
23

26. I
magine boasting a CV with a letter of appreciation
from the White House for leadership qualities in
helping the National Security Council develop the
NIST Cybersecurity Framework and being named the
th
6 most innovative cybersecurity leader of 2021. The
one who achieved these honors is Michael Coden, one
of the top cybersecurity leaders specializing in strategy,
implementation, and resilience. He has an array of roles
in the form of Managing Partner at Magjic, Senior
Advisor to BCG, Associate Director at Cybersecurity at
MIT Sloan, Advisor to Safe Inc., Advisor to The
Decision Lab, and Member of the DBOS-Project. His
advice and consultation attract Boards, CEOs, C-suites,
and CISOs so that they gain from his valuable
knowledge about IT and OT.
Michael is the author of 17 patents on network
equipment, data protocols, cyber risk quantification,
and fiber optic semiconductor devices. He has also
authored numerous scholarly contributions and
published The Fiber Optic LAN Handbook, with a
circulation of 100,000 copies. He is committed to
arming companies to protect themselves against cyber-
attacks through his various advisory roles and his
company Magjic.
The First Attack of Knowledge
Michael has a Bachelors degree in electrical
engineering and computer science from MIT, a Masters
in Business Administration from Columbia University,
and a Masters in Mathematics from the Courant
Institute of Mathematical Sciences at NYU. After
graduating from MIT, Michael first started working for
HP in their computer division, developing the first
minicomputer timesharing system. He was recruited
away by Digital Equipment Corporation (DEC) where
he developed a new memory system that allowed 3
CPUs to access the same main memory for parallel
processing, and the first multitasking operating system
for minicomputers. Impressed with his achievements, a
customer hired him away from DEC to automate a
marine container shipping terminal. Using
minicomputers and a unique database system he
helped develop called MUMPS, he was able to reduce
the loading and unloading of a 50,000-ton container
ship from 3 weeks (manually) to 8 hours, 15 minutes.
Michael was then invited to join Exxon corporation to
invest in innovative technologies and started the
Optical Information Systems (OIS) division of Exxon,
one of the first three companies to commercialize
semiconductor lasers. OIS was acquired by McDonnell
Douglas, which used OIS lasers to deploy the US
military satellite communications system – a ring of
satellites around the earth that communicated securely
using beams of laser light. This started his career in the
cybersecurity domain.
Michael had the wonderful opportunity to co-found
Codenoll Technology Corporation specializing in highly
secure networks for companies across all critical
industries, including organizations such as the US Air
Force, US Navy, AT&T, and the New York Stock
Exchange and many others. Codenoll was acquired by
ADC Telecommunications, where he continued as Vice
President of Technology and Marketing, developing
secure hardware and data protocols. He then became
President of an Israeli cybersecurity company,
NextNine (now Honeywell), where he helped develop
software to secure critical infrastructure systems used
by companies like Shell, Motorola Cellular
Michael Coden
A Futuristic Leader Protecting the Present
I believe that
one mark of a true
leader is to always have
a succession plan.
“ “
| June 2022 |
www.ciolook.com
24

27. Michael Coden
Managing Partner
Magjic Consulting
Senior Advisor
Boston Consulting Group (BCG)
Associate Director
Cybersecurity at MIT Sloan

28. Communications, GE Healthcare, Rockwell
Automation, Schneider Electric, ABB, Yokogawa, Tokyo
Electron and many others. His journey with the Boston
Consulting Group (BCG) began when the company
hired him to build its Cybersecurity Practice. He built
one of the fastest growing and highly respected
cybersecurity consulting practices, resulting in The
Consulting Report naming him number 6 in "The Top 50
Cybersecurity Leaders of 2021. In 2020, he
encountered DBOS, a new operating system developed
at MIT and Stanford that will revolutionize
cybersecurity. On January 1, 2022, he turned the BCG
Cyber Practice over to his successors, resigning as
Managing Director of BCG, where he remains a part-
time Senior Advisor.
The Gateway to Cybersecurity Specialization
Michael's belief that the focus of cybersecurity needs
to shift from protection to resilience is the mission of
Magjic. Michael says, "All organizations are targets and
will be successfully compromised. Those that are resilient
will suffer the least damage. Building ever more complex
cyber-protection takes a long time and a lot of investment.
Building effective detection, response, and business
continuity plans can be made quickly at a much lower cost.
Boards of Directors knowing that the company cannot
protect against all possible attacks and encouraged by the
new SEC rules that will require business continuity plans to
be described in 10-K and 10-Q, will reorient organizations
thinking to be more focused on resilience. At both BCG and
Magjic, I advise Boards, CEOs, C-suites, and CSO/CISOs on
prioritizing, activating, and implementing cyber-resilience
that will reduce the impact and damages from a successful
cyberattack."
In addition to advising Boards and senior executives on
cybersecurity, Michael's long-term strategy is to help
commercialize the DBOS operating system. The DBOS
prototype has demonstrated the ability to detect
| June 2022 |
www.ciolook.com
26

29. 99.96% of all cyberattacks in less than 1 second in the
operating system at zero additional cost. This compares
favorably with current expensive external SIEMs and
analytics engines that typically require 4-5 hours and
are only 80%-90% accurate. Moreover, DBOS can be
"rolled back" to the state before the attack in less than
5 minutes, allowing much faster and more robust
business continuity when compared with current
backup/restore technologies.
His contributions to the cybersecurity industry have
ranged from helping develop the NIST Cybersecurity
Framework to developing several ways for companies
to implement increased cybersecurity at a reduced
cost. One of his contributions is BCG's Cyber Doppler, a
method and patented tool for quantifying cyber risk
that allows companies to make cyber investment
decisions based on an ROI, which is calculated as: the
"greatest reduction in cyber risk" divided by the cost of
cyber projects. This method has allowed many
companies to optimize their cyber strategy and spend.
He shares, "I am currently on the advisory board of Safe.
security Inc., which provides a cyber risk quantification
product. I have also developed methodologies for enabling
companies to develop common reusable cyber functions for
multiple cloud service providers. Many companies have
used this approach to reduce the time and cost of
developing secure cloud applications and reduce security
and audit operational costs. Reducing development time
allows products to generate revenue more quickly; reducing
operating costs allows software systems to be more
profitable." He adds, "Additionally, I have pioneered
dissecting "cyberculture" into "cyber behaviors and am a
member of the Advisory Board of The Decision Lab, a
behavioral science think tank. I have also helped develop
methods for companies to cost-effectively increase their
cyber resilience, which is my current focus."
Experimenting Ideas, Delivering Results
Michael is working with a team of 20 faculty and
students at MIT and Stanford led by Mike Stonebraker
(Turing Award Laureate) on a new operating system
that is a relational database built on "bare metal"
(DBOS). All the applications run as stored procedures
wildly fast in DBOS, without having an extra layer like
Windows or Linux/Kubernetes complicating system
operation and slowing things down (think 10x quicker).
DBOS is also much more scalable than current
operating systems eliminating the need for complex
cluster management. Exciting and important are the
cybersecurity functions built into DBOS. There are
many use cases for it, so he believes that this could be
the next generation of operating systems.
Cyber protection strategies often take years to
implement, at great expense. Companies need to make
sure they can detect, respond, recover, and continue
business operations. He would promote cyber risk
quantification as a way of prioritizing cyber
investments. Most importantly, he would like to see the
applications being transformed to the cloud be
transformed to DBOS for greater cyber-resiliency.
Focusing on the Idea
Michael expects a significant shift in attention and
investment from cyber protection to cyber resilience.
He shares, "At BCG, MIT, Safe, and Magjic we have done a
lot of work in this area, advising Boards, CEOs, C-suites, and
CSO/CISOs to prepare, execute and deploy cost effective
cyber resiliency in their organizations. Longer term, I
envision a shift from writing applications in complex
Linux/Kubernetes containerized environments to the more
elegant and cyber-resilient DBOS serverless cloud
environment. I am currently seeking companies who will
volunteer to test the DBOS prototype that we have
developed at MIT and Stanford."
In his advice to budding entrepreneurs, Michael gives
his concluding thoughts,
• Focus on the value your idea will deliver. First
describe why someone would give their money to
you. You must be able to concisely articulate the
value of your product in 2-3 sentences. Then work
backward from the value proposition to how you
deliver that value, and lastly, the technology you
developed.”
• “Twice a year I ask my team to give me a ‘Report
Card.’ They gather together for two hours, without
me in the room, and then give me an anonymous
report on what I should do, and stop doing, to make
their jobs better and easier – with feedback on how
well I’m doing implementing their previous Report
Card.
• I believe that one mark of a true leader is to always
have a succession plan
www.ciolook.com | June 2022 |
27

30. n a world driven by information, cybercrimes are
Iconstantly rising with the growing digitalization in
every field. Cyber attackers are prepared to exploit
even slight complacency. Being equipped against these
attackers with solid cybersecurity defenses is a critical
strategy. onShore Security is exclusively focused on
ensuring the safety of the precious information of its
clients, aiming to enhance the clients' freedom by
strengthening cybersecurity defenses. Stel Valavanis
founded onShore Networks in 1991, elevating and
maintaining the cybersecurity defenses of every
organization.
Focus Exclusively On Security
Stel's journey as an entrepreneur in the online space
started when he was a sole proprietor, working for
banks and other clients. He expanded and created
onShore Networks (former name of onShore Security),
and then the company continued to grow as needed to
best serve its clients. That was the driver for a lot of the
growth of onShore. Many of onShore's clients were
facing the sudden loss of their internet service as their
provider shut down. Therefore, the company built its
ISP almost overnight to ensure its clients could
continue doing their work.
In 2015, the company shifted its approach to focus
exclusively on security when cybersecurity had become
the most important thing for its clients. onShore
Security knew that it would be the most significant part
of the security industry, where the company could have
the most impact and continue to expand its capabilities
and service.
Security is A Process
A core belief at onShore is that "Security is a process, not
a product." A security operation is like a living thing,
evolving, growing, and learning. A policy is tuned and
refined using automation and human analysis,
recursively becoming more robust with each cycle. The
biggest challenge, and the core mission in
cybersecurity, is to stay ahead of known threats,
strategize for unknown threats, and prepare for the
dangers that exist slightly beyond the event horizon of
current technology. It's a constant struggle against bad
actors. Anyone downplaying that is probably trying to
sell you a product; Security without the work of the
process. onShore Security is constantly challenging the
notion that security can be purchased as a product off
the shelf.
onShore Security
provides 24/7 real-
time monitoring,
correlation, and
organization-wide
network security
data analysis.
| June 2022 |
www.ciolook.com
28

32. Leading by Example
Another impact that onShore security had in the
industry is the processes and policies that developed its
Panoptic Cyberdefense. onShore Security hopes to lead
by example and take cybersecurity beyond perimeter-
based defense in its offering.
onShore Security believes that all the traffic on the
network needs to be analyzed, and its emphasis on
detection is starting to manifest as more security
operations focus on MDR and XDR.
Speeding Up Processes
A significant recent technological advance for onShore
Security is introducing a new machine learning cluster
into its stack. It will augment the ability of its expert
analysts to correlate data to inform tuning, model
larger data sets, more precisely ingest data streams,
and speed up many of its processes. onShore Security is
already seeing better outcomes with more speed.
Identifying the Source of Threats
Accelerating attacks perpetrated by state-funded
organizations is a significant change in the
cybersecurity field, and onShore Security is already
seeing this happen. These attacks are both parts of a
cyber arm of military force and civilian groups,
sponsored and funded by nation-states.
Stel says, "Cybercrime will continue to grow, but it will be
increasingly clear that we are not merely headed for a world
full of cyberwar, but we are already living in it. The
motivations and tactics of these cyber attackers will
challenge a lot of ideas and practices that are central to the
current common cyber defense strategy. On the other side,
governments will expand regulation, and compliance with
such laws will be a much more visible effort for businesses
and organizations." Stel also believes that there is a
change in cybersecurity insurance coming. He says,
"Providers will be more discerning, requiring companies to
qualify for coverage. Cyber insurance premiums and other
costs will grow, but it will hopefully become more evident to
more companies that insurance is not protection."
Changing the Misconceptions
The misinformed presumption that a company need not
worry about cyberattacks because they have insurance
is part of a more considerable misunderstanding of
cybersecurity. Stel would love to see this presumption
change. Many companies Stel has talked to misbelieve
that they are inherently more secure if they move part
of their operation to the cloud or believe they can pass
on responsibility by engaging with third-party vendors.
Stel doesn't expect every leader or member of a board
of directors to have a high-level understanding of
cybersecurity processes and practices. Still, there are a
lot of myths and misunderstandings out there that
inform security strategy and posture that Stel would
love to see debunked.
Elevating Defenses
Stel believes that cybersecurity threats will continue to
grow in the coming years. Attacks will continue to
evolve to include disruptions that are felt offline, in real
life, by people outside the scope of a business or
organization. State-funded attacks on supply chains will
cause issues and shortages that will range from
inconvenient to deadly. He states that there have
already been attacks on medical facilities that resulted
in care being delayed or refused. There have been
fatalities due to this, and he wants to elevate and
strengthen defenses.
Protecting Clients and the Community with Security
Stel's advice to people looking to enter the
cybersecurity space as entrepreneurs are to make sure
they want to do it. Starting a business, especially in
cybersecurity, will mean much time away from family,
friends, and life outside the industry. It will mean
spending a lot of time and effort on projects that may
ultimately fail and seeing that as part of the ongoing
improvement process. Stel says, "However, if you have
the commitment and ambition to do amazing things, this is
the place. Cybersecurity is an ever-changing and exciting
field, and I feel that protecting our clients and the
community is a just and worthwhile goal. At onShore, we
believe that security gives us freedom, and it is very
satisfying to see that in action, as our clients do what they
do best without fear of cyberthreat.”
| June 2022 |
www.ciolook.com
30