Data Responsibility in the World of Cybersecurity

Opening

Mike Krass: Hello and welcome to What's The Problem, the podcast where we dive deep into the most pressing issues facing cyber and data security leaders today. Each episode, we're joined by expert guests who share their insights and their experiences on the challenges they're facing in the world of cyber and data security. Whether you're a seasoned veteran or a new leader in the field, this podcast provides valuable info and some strategies to get organizations to the next level. So join us as we explore the ever-evolving landscape of security and discover new ways to tackle the problems that keep us up at night. This is What's the Problem. I'm your host, Mike Krass. Let's get started. Today we are joined by Seth Garske.

Conversation

Mike Krass: Seth, say hello to our listeners

Seth Garske: Hi. Thanks for having me on.

Mike Krass: Absolutely. Seth, first question, why are you qualified to talk about security?

Seth Garske: I've been working in digital marketing for over 15 years, specifically around data attribution and personalization. Right now I'm currently at F5, where we sell quite a few, and market quite a few, SaaS security products.

Mike Krass: So you're the guy who was personalizing all my recommendations as I crawl around the internet and see different F5 products and solutions.

Seth Garske: That's right.

Mike Krass: Awesome. Seth, before we pushed the record button, you and I were speaking, and we got into this interesting topic. And the topic was, what are the different data privacy responsibilities for folks that are involved in selling and marketing security products or solutions? I guess a good question is, do we have some responsibilities or an unwritten code of ethics that we should be paying attention to? Or is it the Wild West? Do you believe we should be able to do whatever we like?

Seth Garske: No, I think it's a good question. It applies to not just security. Any product, even on the consumer side. And one of the things that I always ask people, my peers, and those I'm working with when we're looking to do personalization is,” Are you adding value for the customer, the site visitor, or whoever?” I think that's important. I have a lot of examples we can talk through around when you're not providing value. It just kind of goes wrong, it doesn't feel genuine. And a lot of times people just cringe at what you are trying to do. So that's a key question you should always be asking yourself, in any space in marketing.

Mike Krass: And you talked about adding value. You also used a really interesting word. Being genuine. I'd like to come back to those two things. Adding value. What does that look like? Do you have an example from your career that you could share with our listeners?

Seth Garske: I have a couple. I have some examples. It's easy to go to the ones that weren't adding value. Even just yesterday I was searching for something. I clicked on a Google ad. It took me to the site. In the headline, it said Seattle and then the rest of the headline. It was kind of odd. It was a weird experience. They were targeting me because I live in Seattle, which is based on my IP address. But other than that, I had no idea why it was there. It didn't provide any value at all. It just felt kind of like, I don't know, a trick or something. It's like, why are you targeting me? I know where I live. How does that help me search? It had nothing to do with region or anything around the product. It was really out of place. Another example where I've seen personalization go wrong: there are some vendors where you can pick up somebody's company name. And I've seen a situation where this group put the company name in the banner ad, and it upset people. We were targeting security folks. CISOs and similar. It was taken the wrong way. A competitor's name was put in the banner ad and that upset the customer. There was another example where it was the right name, but then the customer misinterpreted it as a case study about their company and they ended up contacting their sales rep and saying, “Hey, why are you using me as a case study?” That wasn't the case at all. That's not what that group was trying to do. It was just that they were trying to get people's attention. Which they did, but not in the right way.

Mike Krass: Grab their attention in the sense of, “Hey, I didn't want that. The contract I signed didn't include marketability and using name, image, likeness. Then all of a sudden I'm getting ads driving to case studies about our instance or our deployment.” I could see that I was starting to spin or wind myself up there. I could see a customer doing the same thing if they hadn't agreed to that, or if it came out of the blue. I can see that being kind of a big issue. And we talked about responsibilities in the world of selling and marketing security. That's a big misunderstanding. It sounds like the account ended up being fine once it got smoothed over. But that's the kind of error that could lead to losing a piece of business or losing trust with a current or prospective customer.

Seth Garske: Yeah, I think there's a lot of great examples, too, that are out there where personalization has been really successful. I've seen cases where it's 4x, 8x ROI, or improved conversion rates when you're leveraging personalization. I have an example. This is kind of a B2C one. This was when I was on the agency side, and we were marketing a software subscription. And we had two SKUs. We had an education SKU and then a general SKU, like for households. Students are on a tight budget. I know when I was in school, I really couldn't afford that software. It was really expensive to the general consumer, but their education SKU was significantly discounted. That was huge. This was a really valuable software. Every student's going to need it. And a lot of students I don't think even considered it until they realized that there was that SKU. And so we ran a campaign where we were using targeting to target anyone that was a student with banner ads. It was really successful. And it went really well. But I think that one was a risky one. There was a lot of debate around that because one of the things we also talked about was around “What if you get it wrong?” Like in the last example where they got the company name wrong. Or here in this case it’s like what if somebody isn't a student and they see this kind of SKU price? And then they go to buy it and realize, “Wow, this is like four times more.” And I think, in that case, most people were generally accepting of students and that discount. It kind of made sense. So, in that case, that brand didn't really get any blowback. There was a lot of… We definitely tested it and eased into it because we were a little concerned. But, at the end of the day, people were less upset because most people were understanding. That made sense. Students should be afforded a slight discount now, in this case.

Mike Krass: Yeah. When I think about that responsibility, I think of the world of airlines, both here in the United States as well as in Europe. The example you just gave with the SKU being discounted for a student versus a different buyer, maybe a household or a professional corporate buyer. I think of the feeling that I have anytime I deal with a low cost airline. And they always get you safely from point A to point B, but it seems like I look at flights on the internet. Spirit or Frontier or somebody like that. The flight that Google Flights says is 100 bucks. Then by the time you get through the process of picking a seat, they charge you for that. And if you want to use overhead bin space, they charge you for that. It's like by the time you've gotten through that process, it doesn't feel…I'm going to take your word from earlier… It doesn't feel genuine because I now have a $200 flight. It's twice the price. I know over in Europe, you've got the low cost carriers like easyJet and Ryanair, and Vueling, and some of those folks. It is true. You can just buy a $100 seat and what you should expect for that is, you have no idea where your seat is going to be. So if you're traveling as a family or with somebody, good luck. What you're buying for 100 bucks is from point A to point B safely and nothing more. Every other cost has been stripped away. And I still buy those seats on occasion, but it always makes me feel… It's disingenuous in my opinion, using the antonym of the word you used earlier. It's totally a bait and switch. I'm sure with that SKU example you gave. If I was buying it for my company, I was like “Holy cow, I just saw a great deal! It must be a Valentine's Day special or something.” And then I actually get to the purchase page and put in my email address. I don't have a .edu handle or however you are checking that. And before I know it, I'm like, “Oh, well, that actually was twice the price.” And that doesn't feel as good.

Seth Garske: Yeah, and that's the other piece that I always kind of ask people to think through when you're doing personalization. If you're getting 8x increase in ROI, the inverse can also be true if you get it wrong. That's going to happen no matter what, especially if you're basing it on cookie data and third party sources. There's going to be situations where you're going to get the personalization wrong. And so the key is in those cases, think am I really going to tick people off? And am I going to get negative 8x ROI on this if I get it wrong? Are people going to go “Okay, I understand.” Or is it just general enough that it just seems a little off? But I'm not going to be upset as a consumer or a customer.

Mike Krass: Yeah. Well, when it comes to handling data and data privacy, it's my impression… I'm asking you to educate myself and the listeners. It's my impression that F5 networks has a few, artificial intelligence powered solutions that involve a little bit of telemetry. How do you wrangle or wrestle with the idea of privacy and the responsibilities you have for some of the products that you're representing?

Seth Garske: That's a great question. Our stance really is like the separation between church and state. We have some really sophisticated products. A lot of it is using AI and telemetry to spot bots and bad actors. We’d say it's a utility. It's keeping our customers’ customers safe. And their data safe. And that data lives totally separate from our marketing data. We keep a very strong wall between the two. So from a marketing perspective, we’re leveraging your standard adtech/martec data, just like everybody else. And so that's kind of a big one for us. The delineation for us: is the data we're collecting used to help run the site? That's one set of data. Then the data we use for marketing and retargeting is a totally different set. And we don't let those two things cross.

Mike Krass: This is a delicate question. Answer as much as you can, but I recognize that there will be some limitations here. How do you keep that church and state, that wall set up between the two sets of data so that there isn't any unintentional use of the wrong data set? Can you talk to that a little bit?

Seth Garske: Yeah. Some of it's through tag management and the rules and the policies around how we're collecting the data. And then, as far as storing it, it's totally separate. So for our marketing data, again, that data is being stored. We're using Adobe cloud. So that's all going into its own space. And then, for our customers, that data is being stored completely separate. So that's it. The easiest is just keeping the data completely separate and siloed. That's really the key.

Mike Krass: Yeah. There were two steps I heard there. And I'm gonna poke into this a little bit more. They were policy around collection methods. You're using tags. I assume you're using Adobe Tag Manager? Yeah. Oh, Tealium. Got it. Okay. So you’re using Tealium. That sets the rules of the road or the policy, so to speak. And then it sends it to the correct place to be collected so that it can't be turned into a brackish set of data, if you'll allow the analogy. Tell me about working with Tealium to set up that policy. Election makes a lot of sense to me. It seems like setting up a policy of handling data becomes the critical first step to get right. Because if you get that incorrect, you're going to be in all kinds of trouble.

Seth Garske: Yes, exactly. And a lot of that's around the EU. So that's where we put a lot of the rules and policies around that. And then there's just flags within Tealium that says if you're in the US, the rules are slightly different, depending on which state you're in. But those are all rules that you can plug into the tool. And actually all the tools…most of the tag manager platforms are all built with this in mind now, because this is just kind of common practice. I think that's the good news. So I think implementing it isn't as hard as it used to be. I know, in the beginning, it was a lot more stressful around setting that up and making sure that tags were flagged appropriately. Now, in the system, we only have a handful of tags that are not marketing. And those ones we can flag, as you know. This is a utility. This is something that helps run the site. It's not doing something related to the marketing team.

Mike Krass: Interesting. Well, Seth, this has been a very interesting conversation. You know, we talked practically about things like Tealium tag manager policy and data collection and whatnot. As well as…I felt a few ethical conversations come up too. Just because we can, even though neither of us said this, what I heard was, “Just because we can doesn't mean we should be doing certain things.” And additionally, I heard you say things will go wrong. Even with the best of intention, you're going to accidentally put an ad in front of your customer or some such example and they're going to think that you're taking liberties with their image and likeness and using case studies that they've never approved. It also seems like what I've learned in this conversation is, even with the best of intentions, things will go wrong. And so that comes back to your original comment when we started the show, talking about value. We're here to deliver value and we're here to be genuine. And part of being genuine is saying when you screwed up. You raise your hand and say, “Hey, like we screwed up, and we're going to make this better.”

Seth Garske: That's right. Yeah. And I think there's a value exchange. I think a lot of people are more willing to accept targeting and personalization when it's helping me find…Or through my search or research or whatever I'm looking for, it’s solving my problems. It’s helped me solve my problems. I think if you take it from that mindset, I think people are gonna be far more accepting of being targeted or being personalized to. Versus what I would call disingenuous, where we're just doing it because we can. We're just trying to sell something. And I think that's where you should be. I think if you can skew towards the solving-people's-problems mindset, I think you're going to have far more success.

Mike Krass: Yeah, I think the last thing I'll mention on this episode today is solving someone's problems means you have a comprehensive understanding of what their problems might be in the role that they're currently in. I'm kind of talking about it like a B2B sale right now. In my mind, when I hear you say that, I think as long as I have good intentions and I truly seek to understand what kind of problems and challenges my customers or my ideal customer profile is experiencing. And how we could be a partner to help solve those, or at least make the pain hurt less. At the very least, it should just hurt less. It seems like that's a great unintended byproduct of focusing on delivering value and being genuine. That means that I have to focus not on just pushing product. I'm not here like the use car analogy of we're not just here to move some metal off the lot. We're here to actually put you in the right car. Or put you into the right security product or solution. We understand your problems and we can prove that we understand your problems. It seems to me that it would start by building a relationship on trust. And that just seems like a great way to start a business relationship.

Seth Garske: Yep, absolutely. And the other thing, especially in the B2B space is, within the organization, I think the challenges are a little bit different even within a team. You have your decision maker. They're thinking more broadly. Like the budget and how they’re going to resource this thing or this solution. Versus a practitioner who's thinking, “Man, how the heck am I going to implement this thing?” So that's the same. It's the same group, the same team, same problem. But they're all coming at it at a slightly different angle. And it's really just providing the right information for all those different folks, and helping them and guiding them through that problem and how we’re going to solve it.

Mike Krass: Yeah and that's a great lens as well. The person who's working on resourcing it isn't even thinking about how the heck this thing gets deployed. They're just trying to figure out how they're going to reach under the mattress and move some budget around and maybe get some headcount: either full time or equivalent, or maybe some contractor agency assistance. They're kind of in that mode of like, “I'm just here to make this thing appear. I can't even get to the implementation.” Whereas the implementer… We've been on calls with both of these persona types and responsibility types in the world of security. You know, the implementer is like, “How can you not be thinking about this? I've got all these detailed questions.” It's kind of like a chicken and egg conversation. But the resourcer is like, “This could not actually happen. So who the heck cares about how it's gonna get implemented?” This is a reality. This could just never show up on your doorstep. Whereas the implementer is like “I want to sink my teeth into it. I genuinely care about these details.” There's that friction there. It's nothing wrong with it. It's just that there's a little bit of friction there between the two parties.

Seth Garske: Yeah, that's exactly right. Our job is to make sure that we're surfacing that information to the right people at the right time. They need that info and I'm trying to make sure that they're getting the information they need, making it clear so we can figure out how we can solve this challenge that their organization’s having together.

Mike Krass: Yeah. Well, Seth, I appreciate you joining us and dropping some education on our listeners.

Outro

Mike Krass: To our listeners, that's a wrap for this episode of What's the Problem. I hope you found our conversation with Seth to be insightful, to be informative. Remember to tune in next time for more discussions on the latest challenges or topics in the world of security. Also, I just want to give a quick shout out to our host MKG marketing. MKG is focused on helping cybersecurity companies get found, get leads, and close deals. So if your cybersecurity business is struggling to generate leads or close deals, let us help you. Learn more by visiting our website mkgmarketinginc.com. Until next time.