ITSPmagazine Podcast Network

The Present and Future of Cybersecurity Culture | An Infosecurity Europe 2024 Conversation with Aston Martin's CISO Robin Smith | On Location Coverage with Sean Martin and Marco Ciappelli

Episode Summary

In this fascinating episode of "On Location With Marco and Sean," recorded at Infosecurity Europe 2024 in London, we talk about the intersection of cybersecurity and culture with Robin Smith, CISO of Aston Martin.

Episode Notes

Guest: Robin Smith, CISO of Aston Martin [@astonmartin]

On LinkedIn | https://www.linkedin.com/in/robin-s-78148a133/

____________________________

Hosts: 

Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/sean-martin

Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli

____________________________

Episode Notes

The latest episode of "On Location With Marco and Sean" features an in-depth discussion with Robin Smith, the Chief Information Security Officer (CISO) at Aston Martin. Recorded live in the media room at Infosecurity Europe 2024 in London, this episode explores the essential role of culture in cybersecurity. Sean Martin and Marco Ciappelli guide the conversation, touching on everything related to the complexities of organizational security culture.

The Icebreaker

The conversation kicks off with some light-hearted banter about yogurt and its cultural significance, setting a relaxed tone before diving into the serious business of cybersecurity. Sean and Marco's playful exchange effectively breaks the ice, before Sean introduces Robin Smith, emphasizing how this conversation is the final one in their Infosecurity Europe coverage. Robin reciprocates with a warm thank you, before sharing insights on Aston Martin’s cybersecurity culture.

Life at Aston Martin

Robin elaborates on his role at Aston Martin, revealing that he considers himself the "luckiest man in cyber." He explains how a commitment to high-quality IT initially existed at Aston Martin but not a fully developed cybersecurity culture. Over the past three years, his mission has been to build that culture, aligning it with Aston Martin’s values and brand prestige.

Building a Cybersecurity Culture

Robin describes how he introduced a comprehensive security program that aligns with Aston Martin’s renowned design and engineering standards. He discusses the importance of integrating cybersecurity as a full-spectrum approach to business improvement, not just a technological add-on.

Lessons Learned

The conversation shifts to some of the challenges and failures encountered along the way. Robin recounts an ambitious but ultimately unsuccessful attempt to engage the board with an open-source intelligence report on their personal information. Though the exercise did not go as planned, it provided invaluable lessons on cultural sensitivity and resource allocation.

The Vision for the Future

Robin and Sean discuss the forward-thinking mindset necessary to navigate both immediate and long-term cybersecurity challenges. Robin emphasizes the need for a balanced approach that combines visionary planning with effective tactical response. He highlights Aston Martin's ambition for full automation and AI-driven security measures.

Impact on Customers and Community

Marco Ciappelli raises the question of how this robust security culture affects Aston Martin's customers. Robin assures that high-value customers expect the best, including top-notch security. He underscores the importance of securing the entire value chain, from suppliers to dealership networks.

Community and Collaboration

Sean explores the role of community among CISOs. Robin shares his positive experiences with the automotive CISO community, emphasizing the value of honest and sometimes brutal feedback. This collaborative environment helps him and his peers continually improve their security programs.

Wrapping Up

As the conversation winds down, both hosts thank Robin for his insights. They reflect on the passion and dedication evident in the cybersecurity community throughout the event. Sean invites Robin for another discussion on cyber futurism, hinting at more intriguing conversations to come.

Marco and Sean close the episode by thanking their audience and expressing their excitement for future events. They hope to see everyone again at next year's Infosecurity Europe, promising more engaging content and enlightening discussions.

Be sure to follow our Coverage Journey and subscribe to our podcasts!

____________________________

Follow our InfoSecurity Europe 2024 coverage: https://www.itspmagazine.com/infosecurity-europe-2024-infosec-london-cybersecurity-event-coverage

On YouTube: 📺 https://www.youtube.com/playlist?list=PLnYu0psdcllTcLEF2H9r2svIRrI1P4Qkr

Be sure to share and subscribe!

____________________________

Resources

Learn more about InfoSecurity Europe 2024: https://itspm.ag/iseu24reg

____________________________

Catch all of our event coverage: https://www.itspmagazine.com/technology-cybersecurity-society-humanity-conference-and-event-coverage

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit: https://www.itspmagazine.com/redefining-cybersecurity-podcast

To see and hear more Redefining Society stories on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-society-podcast

Are you interested in sponsoring our event coverage with an ad placement in the podcast?

Learn More 👉 https://itspm.ag/podadplc

Want to tell your Brand Story as part of our event coverage?

Learn More 👉 https://itspm.ag/evtcovbrf

Episode Transcription

The Present and Future of Cybersecurity Culture | An Infosecurity Europe 2024 Conversation with Aston Martin's CISO Robin Smith | On Location Coverage with Sean Martin and Marco Ciappelli

Please note that this transcript was created using AI technology and may contain inaccuracies or deviations from the original audio file. The transcript is provided for informational purposes only and should not be relied upon as a substitute for the original recording, as errors may exist. At this time, we provide it “as it is,” and we hope it can be helpful for our audience.

_________________________________________

[00:00:00] Sean Martin: Marco.  
 

[00:00:02] Marco Ciappelli: Sean.  
 

[00:00:03] Sean Martin: Have you had your yogurt today?  
 

[00:00:05] Marco Ciappelli: My yogurt? Oh my god, you're going there? Wow. Culture.  
 

[00:00:10] Sean Martin: You need a bit of culture.  
 

[00:00:11] Marco Ciappelli: I was thinking books.  
 

[00:00:13] Sean Martin: You eat it.  
 

[00:00:14] Marco Ciappelli: Education, uh, history, anthropology. You go to yogurt. You're always thinking about food. 
 

[00:00:22] Sean Martin: I do think about food all the time. All the time.  
 

[00:00:25] Marco Ciappelli: Well, that's not what we're talking about today. 
 

Sorry.  
 

[00:00:28] Sean Martin: Well that maybe that's part of the conversation. Maybe what, what is culture and its definition, and I think, how do you get it? Mm-Hmm. . Right? And can you, uh, can you sustain it? You have to con continue eating whatever it is or digesting whatever it is you get it from. Uh, so I'm gonna quit being stupid. 
 

Yeah. And I'm gonna introduce our guess. Let's get serious.  
 

[00:00:47] Marco Ciappelli: This is the last conversation, I think. Of the entire infosecurity area of coverage. So I will allow you to be a little bit silly. Allow me to be silly. Silly.  
 

[00:00:55] Sean Martin: Yeah. I'm drunk on, uh, on all the goodness that we had this week. Uh, Robin Smith, it's a pleasure to have you on my friend 
 

[00:01:04] Robin Smith: Thank you.  
 

[00:01:05] Sean Martin: And, uh, for, and thanks for bearing with us as we, uh, as we have a bit of silliness here. Uh, you were part of a panel here, uh, at. That's InfoSecurityEurope for those that didn't pick that up because I don't think we said it. Um, lots going on here. You're on a panel talking about culture and, uh, I think, well, we're, we're going to get into that but maybe a quick word about your role at Aston Martin so we kind of get a sense of what you're doing there and how that plays into the conversation you had today. 
 

[00:01:38] Robin Smith: Sure. So, um, I'm, I'm, I always say I'm the luckiest man in cyber. I've got the best job in cyber working for the best luxury automotive organization in the world. And so having been at Aston Martin for three years, I keep saying to people, they're going to have to take me out of that place in a box. That's how much I love it. 
 

So cool. Uh, you know, design orientated, you know, ripping up F1 now, winning GT Tours, and the DB12 is a marvel of engineering and design, so I'm enormously proud to work there, and there isn't a day go by when people don't inquire whether I'm going to be moving on soon so they can have my job, so, so, yeah. 
 

You'll be my mentor. So I've worked, Aston for three years, hopefully for another 27 years at least. Nuclear and policing before. I find myself at an organization that I can completely align my kind of values and aspirations with and I think the future for us is extremely positive and I'm proud to be part of the team. 
 

[00:02:37] Sean Martin: Perfect. And so, so three years. Let's start here. Three, three years. Um, we can get into the panel and some of the points that came up here, but I want your, your initial perspective. The culture. In cyber, in Aston Martin, what was it like? And did you join it? Did you come in and tweak it? Did you come and wholesale change it? 
 

What was that experience like?  
 

[00:03:07] Robin Smith: I can be flippant and say I invented it. Because before I arrived there was no cyber culture. There was a commitment to High quality IT that included security and there was pockets of good practice across the organisation and thankfully they hadn't had any issues. Serious security events. 
 

They've had one or two, but they've arrived at a point where they wanted to build a security culture. And I previously worked in nuclear industry, and you can't get a bigger contrast than working in UK nuclear industry and going to global manufacturing, you know. One is orientated around process, process, process. 
 

Another is orientated around, we need to sell units in this next quarter to keep the business going. Slight exaggeration, but there was a real contrast. Aston had understood the value of cybersecurity at a board level and at a CIO level, and they asked me to come in and to build a program of delivery that included getting good alignment with the way in which Aston operates by understanding its risk tolerance, but also respecting the brand prestige. 
 

Let's be, let's be clear, one of Aston's, you know, amazing cars, but it's also got one of the most recognizable and valuable brands globally. I think it's listed in the top five of valuable brands. So, you know, with the heritage of James Bond, 110 years of luxury manufacturing, it was important to arrive to understand that Any security culture was part of a wider enterprise. 
 

It had to link to the values of trust, design, delivery. And it had to understand that security is not abstract. It's not, you know, it's not kind of this philosophical approach to business. It should be a multiplier of business by making sure that risk is managed and opportunities are multiplied. And that's really the perspective we've taken. 
 

[00:05:07] Sean Martin: And quickly, Marco, I just I can hear the words, we'd like you to come in and build a security program. Did the words also include culture? Specifically, or is that a byproduct? And I'm being pointed here because I'm wondering how important is culture? I mean, I can see it at the brand level. Um, did that directly translate and come to you with, we want a program. 
 

That has culture that aligns or just program that aligns.  
 

[00:05:43] Robin Smith: It is a great question. It did. Because we've got a very progressive board and a very progressive CIO who don't understand things individual domains, which you kind of have zeros and ones. There is a good understanding of the whole of the organization consists of culture that's subdivided into different groups and different subcultures. 
 

So I think there was a respect that, you know, we needed to look at security as a process, as part of the overall culture and then to amplify the value in key areas, you know, maybe. Maybe parts of the business don't need to kind of worry about NIST frameworks, but maybe the board need a really clear, quantified position on cyber risk. 
 

Maybe parts of the organization just need to know a little to make sure they're secure, safe, and are able to deliver the fantastic cards that we build. And maybe other sub cultures in the business, IT, research, uh, you know, uh, the fantastic kind of production stuff. They needed to inculcate security in a much tougher, more direct way to make sure that we continue to protect. 
 

So I think it was a mature take from the CIO and the board, and it was a take that included, you know, perspective of cyber is not technology, it's a full spectrum approach to improvement.  
 

[00:07:05] Marco Ciappelli: I love that you went there because I wanted to underline the fact that if you look at culture from an anthropological perspective, it's hard to say that you decide what is going to be the culture, right? 
 

It's just something that happened because it's the convergent multiple things that are happening in our society and I see the business as a small society. I went in a company where the brand culture and the quality driven, the design and being proud to be part of the company. I'm not going to say made the job easy for you, but I feel like maybe you had already a good base to say, All right, let's, let's try to add this to something that is already a strong identity. 
 

[00:07:57] Robin Smith: Yeah, that's that's a very good insight, which is there was no years here. However much I might pretend that I invented cyber security in 2021. Probably not quite true  
 

[00:08:06] Marco Ciappelli: or the Internet  
 

[00:08:07] Robin Smith: or the Internet or the Wii or whatever it would be. I'm not that old. Um, I think that's a really good insight. And I think it is. 
 

The thing about culture is that we've talked about it consisting of various different groups. So we always segment the culture really well. We also understand that there's a constant conversation around culture and there's a dialectic that's important within the business. And it isn't me talking to the business, it's the business engaging in a whole conversation. 
 

And, and, you know, cybernetics. One of the best things about our approach to culture is the idea that Feedback is the most important thing here. Feedback from the culture is the most important thing because it will verify whether we've taken the right decisions and it will confirm that I've taken the wrong decision. 
 

I can give you multiple instances of when that's happened. So I think, you know, culture lives. Culture is a kind of diverse ecosystem within Aston. We've got dealerships, we've got engineers, we've got production staff, we've got designers. So, so you don't take, um You very rarely take a totalizing view. 
 

What you tend to do is look at the organization and then start to dissect it. But continue to have a core message, which is security is safety, which is at the heart of everything we were doing.  
 

[00:09:23] Sean Martin: So I'm curious, I'm the ops guy of the two.  
 

[00:09:26] Marco Ciappelli: You can tell.  
 

[00:09:29] Sean Martin: Exactly. And one thing that always intrigues me is how a team takes action in the moment, right? 
 

And it, it's the ethics and the, and, and, and the, uh, remember the other word? No. Uh, yeah, the, the, the values that an organization possesses and the culture that, that surrounds that, that will drive them as they're making decisions day in and day out. Can, can you give an example of where you can say decisions are being made in line with, or in support of the culture that we want? 
 

And how do you identify when things might be kind of swinging outside of where you want things to go?  
 

[00:10:14] Robin Smith: Yeah, that's, I think that's really interesting because, um, the risk tolerance formally would be zero cyber risk. So you would want to be nailing everything down, but if you do that, you're then kind of preventing good business taking place. 
 

So one of the adaptations we've done is to have a cyber design. process that mirrors how we design cars. Not completely, but the idea is that cyber solutions are considered, they are in line with things like Secure by Design. They consider the user's perspective. So when we were rolling out training, we were Training wasn't just hitting people within the culture and hitting people in a kind of blank way. 
 

We actually designed and personalized training to make sure we understood that the different audiences required different content. They required different skills and different literacy levels and that is something that astounds us very well. It understands that design is at the heart of everything we do and I'm not so sure that cyber practitioners are so well versed in principles of design, you know, form, function, and, you know, we can see some brutalist architecture behind us, but the thing with Aston is that it puts a premium on considering the options. 
 

Road testing the options, stress testing the options, and then actually picking high quality solutions that are going to change it. We did that with training and we've had some very good feedback with regard to this fits in with both skills need and the personal kind of choices that people want to take around developing literacy and the ability to protect themselves online. 
 

So that, that premium design was a really good guiding point for us. Interesting.  
 

[00:11:57] Marco Ciappelli: And have you, um, have you seen things that didn't work while you were trying things? And, and, you know, I'll be curious to know what things didn't work and you were like, all right, I learned something from this.  
 

[00:12:11] Robin Smith: Yeah, and I, this is, this is going to sound kind of, very kind of masochistic, but actually I'm really happy for things to fail. 
 

That's absolutely fine. Life is, you know, my big hero, Sugar Ray Leonard. Got knocked out in his last fight, lost his last fight. That's Sugar Ray Leonard. So Sugar Ray Leonard fails. I fail. That's good enough for me. . So, so I think I'm being a little bit flippant, but one of the things we tried to do, we do try and push the envelope 'cause I think we should be cyber futurist to a degree. 
 

Maybe we took about that in a bit. But one of the things we profiled, we, we sought to get the board engaged and one of the things we sought to do was to profile all of the open source intelligence about our board. And some of our board members are. International figures. They're on Netflix documentaries. 
 

I won't mention the chairperson, but everyone who knows it knows who that is. But we compiled all the open source intelligence about the board members, and it included, you know, family information, previous jobs, all this sort of stuff. A real forensic review, and we landed it with the individuals themselves. 
 

So these were individual reports. It cost a pretty penny, and we thought it would spark A really interesting conversation with the board about why does your online presence matter to the, to the organization and why does, why do you need to kind of take steps to protect yourself, your family, but also your position as, you know, CEO, CFO of Aston Martin. 
 

It went down like a Led Zeppelin. It went down very, very badly. Where we didn't, you know, either we didn't get any feedback, which was bad, because this was not a free exercise that we undertook. So, I'm a big believer, if I spend a pound, I want two pounds of value. So when I'm giving that board member that report and they're like, Well, number one, I'm not very, you can see on their faces, I'm not very chuffed with this, or very happy with it. 
 

And number two, your feedback is going to be a stony silence. Worse than that was where we got feedback, and people were not happy with the rationale, the methodology, or the results of what we found. Nothing, there was nothing, there was no smoking gun. I'm not saying we We certainly didn't embarrass anyone and we didn't kind of pull out any skeletons. 
 

But these are the board members that are kind of very sensitive to both profile and the impact on the business. And rightly that's their job to do that. So that was a failure. And what that spoke to was cultural sensitivity, understand that there is a bit of hierarchy. Manufacture is quite flat, flat structures. 
 

At the board you should be showing a bit more respect in terms of Look, they're exposed enough. Maybe they don't want any more potential coverage. And when you go sourcing open source intelligence, there was a perception that we were kicking the hornet's nest. We weren't. We did it in a professional manner. 
 

So that, that was a, even if I just look at the money spent, that did not deliver value and it didn't kind of engender the sort of conversations that allowed security to become part of their consciousness. It stuck in their mind as This is not the right tactic for us. You need to go back and rethink it. 
 

I'm happy to talk about that. You know, don't get me wrong, I didn't enjoy it. I don't think it was a brilliant success, but we took the lessons from it. I think it's that mindset of, OK, if it all goes swimmingly, I was a SWAT at school, so I was a straight A student, and you can stroll through life and a lot. 
 

Actually, it's these disruptions, these problems, these embarrassments that are very instructive and make you a much better CISO.  
 

[00:15:36] Sean Martin: So, the value came in the lesson. Can you, is there, is there a story you can tell where you applied the learning?  
 

[00:15:45] Robin Smith: Yeah, I think, I think, I'm a big believer, there's a great book called, um, Adaptive Resilience by Maria Santa Caterina. 
 

It's a great book, and it's a bit of a tome for me. It only came out, sort of, in the last couple of years. And it talks about developing your mindset around, um, Not just the near term, but your recent experience and what you're planning for the future. And I've mentioned futurism. We are, we're cyberfuturists at Aston. 
 

We are talking about full automation. We're talking about autonomic operations. We might not get there, but we've got a real vision around how AI, our own LLMs, our approach to machine learning is going to drive security to machine speed response. We want an autonomic system where we can match the best of cyber criminality with our response. 
 

Our detections and our risk intelligence to synthesize, you know, if cybercrime is infinite, we want a response that is using priorities and resources really well. So the lesson there was to um, direct our resource to only the things that would count, that would count within the culture. Profiling the board members, I thought was a good idea. 
 

Wrong. Directing resource to the most pressing Posture issues, the most pressing risk issues. That was the lesson, which was know what we're about. You know, in some respects, you can have your five year vision, but within manufacturing, it's really the next five minutes that count. Production goes down. My vision of autonomic security operations is irrelevant. 
 

[00:17:13] Sean Martin: A new vision of another 30 years.  
 

[00:17:15] Robin Smith: Exactly. You know, I've got a pension to think about. I think the lesson there is tying the two together. Vision with good tactical response in every situation. I think the mindset has changed around being a little bit too future oriented to tactics and operations around security. 
 

You need to support the business, they need to amplify value, they continue, they can have that future vision but by aggregating successes day to day, week to week.  
 

[00:17:45] Marco Ciappelli: So, does the Security culture trickled down to the, to the customers. Like, does it, are you seeing that it brings a value, like an added value to the, to the product? 
 

Because I'm also assuming, I mean, I know that the Aston Martin customer wants the best. There's no doubt about it. I'm also assuming it's a well educated person and maybe it's, you know, Demanding a certain level of security or am I just being idealistic?  
 

[00:18:18] Robin Smith: No, not at all It's it's this is a prestige brand if you're paying what you're paying You're expecting the very best whether it's the braking system the infotainment or the security Um, there are some emerging regulations around exactly what you're talking about called connected car So the un if you heard of these un have defined Cybersecurity management systems for cars. 
 

They've also devised software update management systems. R155156. So we have a dedicated team within Aston which is to say the car is basically the new boundary. Whether it's driving in Sao Paulo, Palo Alto, Tel Aviv. The car is part of our fabric and it needs to be protected on an ongoing basis. So, those, um, Those, uh, regulations are defining new ways of controlling and protecting personal information, customer information. 
 

And Aston customers tend to kind of, uh, come back again and again and again. They're, they're high value people. They're high value customers. And we want an ongoing relationship with them. They, you know, once they buy an Aston, we want them to kind of always buy us. So the premium placed on protecting infotainment, which contains a lot of personalization, but also protecting the dealership network, which contains a lot of quite sensitive information about these high value individuals. 
 

We take it seriously and we make sure that security has permeated it, not just into the dealership network, but into the thousands of customers. Over a thousand supplies that we use on a long term basis and people talk about supply chain. It's not just the dealerships. The dealership is our sales and after sales, you know, supporting those individuals. 
 

You've got to be thinking further to the left. It's that supply chain that also needs to be protected because end to end, that's the Aston value chain, not just in the engagement with the customers. That's vital, but it's vital as part of an end to end value stream. But we are making. I'm not suggesting it's perfect, but it's not. 
 

I think we can always do better, particularly with regard to customer information. Touch wood, we haven't had any sort of serious incidents. But, again, we learned the lessons from Ford, from Toyota, who were hacked by Russian state sponsored actors who knocked over production. So, I think we keep vigilant. 
 

And when we have events, when we have events, because they're going to come, is that we have really good response protocols in place that protect personal data, that protect the supply chain and maintain the value of Aston.  
 

[00:20:44] Marco Ciappelli: I think this is an extended culture, right, that trickle to the customer, maybe comes from the customer and Gets into the company. 
 

Hard to control, but good to be there.  
 

[00:20:57] Robin Smith: Yeah, and it's another conversation, you know. Life is about kind of dialectics really, which is the customer tells us what they want. We respond, we define, and I think, um, it's only good to be taking that feedback and building it into where you operate.  
 

[00:21:10] Sean Martin: Can I, uh, and I'm sensitive of time, but I have one more question. 
 

Go for it. That's my, that's my job.  
 

[00:21:17] Marco Ciappelli: The last of this info set.  
 

[00:21:19] Sean Martin: Um. You talked about getting feedback, uh, on the stuff you do internally, the cultural feedback from the customer. Do you work with your peers? I'm fortunate enough to be part of a number of CISO groups, and they invite me in, chat a mouse rules, I don't say anything what they talk about, but there's a very tight knit group. 
 

They come together and share stories, look for opportunities to do better in their programs and help their teams. 
 

You find value in the community and how much of an impact, if you do connect with the community, how much of an impact does it have on the culture that you bring to your organization?  
 

[00:22:07] Robin Smith: Yeah, there, there, there is a tight knit CISO community. I would say an automotive. I expected it to be a bit more cutthroat that we would be looking to kind of stitch each other up, but it's not like that. 
 

Uh, I was, I was coming from public SEC sector service where, which is very collegiate. I'd expect the private sector to be pretty cutthroat and competitive. Now, don't get me wrong, the automotive CSO group is competitive. We do want to kind of do well. We don't, we don't lack ego, but I would say that there's some really great people out there, like Tammy Archer, who works in CHEPA, is a fantastic person. 
 

Google have actually brought together, uh, uh, automotive CISO leaders to have regular discussions, and they've been really open, they've been really inspiring, and they've been really challenging as well. There's nothing worse than a community. And we live in this modern age, which is very pat on the back, and we mustn't talk The automotive CSAS will talk about everything. 
 

Oi Robin, we saw you did that wrong, let's talk about that in detail. Uh, and I think it can be brutal and stressful, but those sort of conversations really are kind of Where you learn a lot from, you know, high quality people. I'm, I'm inspired even at my age. I'm inspired on a daily basis by my pal, Leo Cunningham, who, who works for Alken. 
 

I'm inspired by Tammy. I'm inspired by people working at JLR. So I think it's a, it is a really useful community. I'm not one for too much navel gazing. I think CISOs need to, Let me say this carefully, I think CISOs need to be more stoic because it is a stressful job. But I'm happy to support my peers and sort of say, look, you need to talk about it, come and talk to me. 
 

But I also think we need a little bit more stoicism in the community because you can't, CISOs can't be influential, well respected and really important to an organization without having to endure a degree of stress. So I always try and bring to the CISO community a little bit of levity, let's not take this so seriously. 
 

CISO's put their trousers on one leg at a time like everyone else. And we should realise that, you know, our role is part of the business, not as some sort of super person that's out on the edge. No, you should be integrated in the culture, you should be a cultural player, and you can learn a lot from the culture. 
 

So let's get away from this CISO as the most, you know The most difficult job out there, because my job is fantastic. Yes, it's stressful, but it's absolutely brilliant. Best job I've ever had, so. Fantastic.  
 

[00:24:35] Marco Ciappelli: Well, you said you want it for another 30 years.  
 

[00:24:37] Robin Smith: At least, very minimal. I'm not sure my wife would agree, but I'm not sure my graying hair will agree either, but I love it, and I kind of, I know not everyone's in this position, but. 
 

For me, it's a, it's an honor to do my job and I love Aston Martin.  
 

[00:24:51] Sean Martin: Well, 20 years you get the watch, 30 years you get the car. I'll be with you.  
 

[00:24:55] Marco Ciappelli: Well, I think, I think you, you can tell by the way you talk that you're passionate about it. You're really into it. And, you know, I think passion is something I've seen this entire event. 
 

I think every conversation we had from analyst to, to researcher to, you know, many other people, panelists to, and people into. in the police department. Everybody's passionate about what they do because, because let's be honest, being in cyber security is something to be proud of. And I think you needed some sort of a vocation to do that. 
 

[00:25:27] Sean Martin: So, and each, each is carrying their own culture with them. You mentioned the police, uh, uh, from, from Wales on thing. So, uh, yeah, I mean, you can just, you can, you can sense the passion, you can sense the culture. Um, He's doing something that fits well within his region and it's innovative. It seems to be working. 
 

It's pretty cool. I'm going to have a chat with him probably next week. Um, I have about a thousand questions. Marco will kick me really hard. If I start going down any of them, I'm going to, I'm going to on the record invite you and you can say yes or no later. I'm not going to put you on the spot for that, but I'd really love to chat with you about cyber future. 
 

I have some thoughts on that in myself and I think it'd be really fun to have some conversation, but for now.  
 

[00:26:14] Marco Ciappelli: For now, this is it.  
 

[00:26:15] Sean Martin: This is the final, uh, the final chat. And, uh, you were the closing keynote in our coverage.  
 

[00:26:23] Robin Smith: It's an honor.  
 

[00:26:24] Marco Ciappelli: Well, it's an honor for us. It certainly is. And I want to thank you, and I want to thank every Everybody that's been listening or watching the video we've been doing here and we hope that Everybody will join us next year. 
 

I am actually looking forward to be here in London again Yeah, with this beautiful view of the Millennium Mills or whatever. That was  
 

[00:26:46] Sean Martin: it might next year might look like Prague We might get confused  
 

All right. Well, thanks everybody. Thanks again Robin