Sedgwick is one of the world’s leading insurance, risk and claims administration providers, there to help its clients navigate the unexpected.

As global CISO, it’s Eric Schmitt’s job to ensure that the company, which has over 33,000 employees worldwide, is prepared for unexpected or novel cyber threats.

What’s more, the data which Sedgwick manages as an insurance provider contains information about over 10,000 businesses, making the company a tempting target for cyber threat actors.

Schmitt first joined Sedgwick on its IT help desk in 2002 and, outside of a four-year gap between 2008 and 2012, has been there ever since, taking on the role of global CISO in 2020.

In this conversation with Infosecurity, Schmitt details how Sedgwick runs its own security operations center (SOC), why he opted to take a whole region offline because of a suspected cyber threat and the importance of buy-in from the board.

Infosecurity Magazine: What are the key responsibilities in your role?

Eric Schmitt: We are one of the largest claims management companies in the world, so there’s significant amounts of sensitive information that we hold. So, cybersecurity is front and center for us. From a corporate standpoint cybersecurity is one of our key risks and a key focus item for our executive committee as well.

IM: What does your team look like and how does it operate?

ES: The entire security function sits underneath me. I've got a security operations team that's designed and built to monitor 24 hours a day, seven days a week and 365 days a year.

I don't leverage any partners: it's purely Sedgwick employees. I’ve got a team here in the US, I've got a team in London, England, and a team in Sydney, Australia. Between the three teams, we cover the globe.

Then supporting them is the security engineering roles to maintain the tooling. That team reports up to me, and we've got security architects as well.

I've got identity and access management in my group too. They’re responsible for ensuring that all of the identities across Sedgwick are maintained and multi-factor authentication is everywhere.

IM: What are your top priorities for cybersecurity strategy?

ES: AI is a key focus area for me. It's something that we're really looking at not just from how to manage and how to leverage it for defensive purposes. But also, how it is changing the security environment writ large: how do we see the evolution and increase in attacks that leverage AI, and then also what that means for Sedgwick from a defensive capability standpoint?

The AI initiatives are also driving a renewed focus on something we do well, which is cyber hygiene. Just like you bathe regularly, hopefully, we patch and maintain our systems regularly and it's just increasing that cadence and that focus so you don't lose sight of the basics as we move forward with AI.

The basics are still key. AI isn't inventing new novel attack methods, it's accelerating the abuse of poor hygiene, whether it's password hygiene or failure to patch.

The recent Citrix zero-day vulnerabilities, we were on that early through some early threat intel. We were working on that on Saturday to make sure that our Citrix environments were patched and they were.

It's driven by the importance of monitoring the threat intelligence and then that rapid patching response. That's going to be the biggest challenge for all of the blue teams around the world. How do we patch faster? How do we respond faster?

IM: What were the procedures in place that allowed you to patch rapidly?

ES: A large part was following existing playbooks. As we've been thinking through the benefits and the challenges that AI brings, we've been looking at all of our processes and going ‘okay, how can we accelerate where we need to.’

Patching was one of those items where we had already thought through this and had a plan in place. So within about 30 minutes of us finding out about this through threat intelligence and validating that, yes, this looks to be real. I was on the phone with our CTO and my team were already keyed up and ready waiting for Citrix to release the patches.

We had the entire enterprise, which for our Citrix environment is substantial and spread in multiple data centers around the world, patched within three hours.

IM: How do you ensure that staff throughout the business at all levels operate securely and are aware of cyber threats?

ES: We focus a lot on protecting the data where it lives. So we're on the zero trust journey like everyone else. Anybody who says they've completed zero trust is either buying in the marketing hype or not fully aware of the environment. It is a journey and it's one that will take the rest of my career, I suspect, wherever I am. But it's an ongoing path.

The biggest area is focusing on awareness. People are the best and last line of defense, ensuring that they're trained, knowledgeable and aware of cyber threats, including fraud and social engineering.

We do regular training like everyone else. But we also do regular phishing simulations that are a little more robust than most, taking defanged attacks against Sedgwick and using those for our phishing campaigns.

You meet employees where they are, providing role-based training. You can have the best controls, technical controls in the world, but if the people don't know how to handle the data they're entrusted with, you're going to fail.

IM: How important has it been to have buy-in from the board on your cybersecurity strategy?
ES: Probably the best part of that is I don't have to worry about my executive team or the board second guessing some of the decisions I make in the moment. I know that they support both the program and me personally.

As long as it's done for the right reasons and for the right level of suspicion, it's been very freeing to know that I can defend the company as necessary. And they support that fully.

I have taken down one of our country’s networks twice now because we saw activity that appeared to be non-standard or potentially high risk and we've shut down the country. And while the folks in the country may not always appreciate it, our global CEO will stand behind and say that was the right action to take at the time.

IM: What happened with these incidents? What led to that action?

ES: We leverage several autonomous, machine learning based, AI tooling where if it sees models of behavior that are specific to patterns that ransomware attacks use, or several custom models that my team has built over the years, it will autonomously take action and shut down the network.

We have twice now in one specific country taken down their entire network for a period of time while we investigate to determine if this is a real attack or not.

Fortunately, in both those cases it was a false positive where the patterns of life should not have been occurring. It was people trying to get some work done, trying to do it a little bit sloppier than they perhaps should. But it matched several patterns that we would expect to see in an attack.

So, the decision stands. We made the right call because it's better to stop the attack than to take damage while you investigate.

IM: What do you see as the biggest challenge in cyber security at the moment?

ES: The biggest challenge is the exact thing that's the biggest opportunity, which is AI. It's the increase in the speed. No longer does it take days, weeks to find exploits from a vulnerability. That time has been reduced down to hours and minutes. Attackers are leveraging that.

Obviously, AI is an opportunity to increase our speed of response, but it's also going back to that hygiene. How do we increase the time it takes us from discovery of a vulnerability and publication of a patch or mitigation to deployment? And that I think is going to be the biggest challenge because it's not just ‘let's throw an AI at it’, you have to coordinate with the business as well.

A lot of that comes back to knowing the business, knowing the organization and being able to map out the risks to it.

IM: What has been the biggest success in cybersecurity in recent years?

ES: I think we've done a better job of explaining what we do, what the risks are and taking it from the nerd speak that we all are native in to really being able to articulate the risk in a business first method, which, where all of our partners live.

Our CFO doesn't understand cyber. He shouldn't have to. But we should be able to articulate the risk in financial terms for the CFO, in operational terms for the COO, be able to break it down and meet everybody where they are, I think has been our biggest win. 

Today, everybody understands it's a business risk. So, I think we've done a really good job as an industry in driving awareness and meeting our partners where they live

IM: What's the top advice you would give to other security leaders?

ES: Like Douglas Adams wrote in Hitchhiker's Guide to the Galaxy: Don’t Panic.

At the end of the day, our job is to be the front line, not the entire line of defenses. So, take the time, know your partners inside the company, know your peers, and have that network.

Without that network on the outside with other cybersecurity practitioners to be able to lean on, support and to bounce ideas off of or that network internally, to be able to help support the patching, the hygiene, the other items that we've talked about, you're not going to get anywhere. You can't be an island. So don't panic and then build that network internally and externally.