Citigroup Inc. (C) Earnings Call Transcript & Summary

Next up, we have securing the future of work with Rocco Grillo. Rocco, you're going to introduce your rockstar panel?

Great. Thanks, Hunter. Hi, everyone. Nice to speak to everyone, and thanks again for having me on HMG Live! My name is Rocco Grillo. I know many of you have had the fortunate pleasure of participating in other HMG events. I'm Managing Director with Alvarez & Marsal, oversee our global cyber risk incident response investigation. To Hunter's point, we've put together a rockstar panel today. With us is Gulrez Jamadar from Citi. We've got Greg Kyrytschenko from Guardian Life Insurance as well as Mike Sawyer from Wells Fargo. I'm going to hand over to our panelists. But in a moment, what I'd like to just talk about is to Hunter's point, the theme of our session is securing the future of the workforce, a tremendous amount of information was given so far. A lot of it overlaps in to IT security. But if you see some of the things that we've experienced over the last 3 months, not so much just the last 3 months, but things like spikes in phishing attacks, ransomware, attacks on third parties, fraud, business e-mail compromises. The list goes on. It's not so much that it's new. But it's rampant right now, especially as the workforce has been thrust from working in corporate organizations and environments into overnight and remote and the blink of an eye. To that end, and on those themes, I'm going to hand off to Gulrez, if you could give us a little on your background, Gulrez, and the theme of our topic, and we'll go from there.

Thanks, Rocco. And Rocco, as you said, I think, wonderful panel discussions and comments so far have been taking some pretty good notes as a learning point as well. So Gulrez Jamadar, I am the Global Head for Information Security for the Institutional Clients Group at Citibank. I also have a dual responsibility in that. I'm the Global Head for Technology Risk Management as well. So I do oversee both portfolios. And especially during these times, I think the duality of the role that I oversee has come in quite handy as I get to traverse the entire risk landscape. When I think about not just information security, but technology risk in general. And then, Rocco, we will be talking about securing the work here but the one observation I have tell you from -- at least from Citibank's standpoint, given the globality of our company, it's been an interesting eye opener when you think about the COVID-19 situation, especially in the large sites that we have and how do we actually deal with something of this scale. And then quite frankly, it's really turning into a risk management. It's a business conversation, and I'm sure we'll touch on that. So I'll hand it back to you, and I guess, we'll progress the conversation.

Fantastic. Thanks, Gulrez. Some great points. Mike, over to you.

How is it going, Rocco? Nice to see you. Again, a great panel and great conversations before, I've really enjoyed it. So Mike Sawyer I'm the Global Head of IT Risk and Controls for Wells Fargo Consumer Lending, Merchant Services & Credit Cards in the first-line. Have been around and worked in all 3 different lines, plus some start-ups and consulting and have been in the game for a while. It's very interesting. You think you've learned a lot in your career, especially some of the senior folks that we have on, but this is kind of like back in some of my newer job days or Big 4 when you're just drinking from a firehose, and having to learn so many things and change the way of thinking, and I really feel like at the end of this, people are just going to become much more stronger at adapting and change management. And as Gulrez had said, I mean, risk management and business focus and client focus is really the name of the game. So it's really changed the way that I'm thinking personally about things. So it's been interesting for sure.

Great. And last but not least, Greg Kyrytschenko. Thanks for joining us today, Greg.

Thanks, Rocco. Thanks for the opportunity, and been a great panel so far and look forward to talking with everybody. I'm Greg Kyrytschenko. I'm the Deputy CSO at Guardian Life, I head up cybersecurity services for Guardian Life, which covers a number of different technology areas, and we definitely have been challenged, but have been able to address and come to understanding how we need to help adjust things, both with the recent social unrest as well as also the COVID experience. So we've been doing a lot of different things that have really challenged us a bit, but also been able to look -- to see how do we improve from there and how we continue to get better. So as we continue to be strong leaders, we're always looking and being self critical and how do we reassess and how do we reevaluate how we handle things. So really interested in participating on the panel. Thanks, Rocco.

Great. Thanks for that, Greg, and all of you. I'm going to stay with you for a second there, Greg. I know we're tight for time here. And at the same time, this topic itself, we can talk for hours on it. But you and I have known each other for a while, interactions through different industry organizations, [ FSI effects ], the list goes on. Without sharing too much, Greg, and we both travel, we've both been in offices, remote different offices across the country, globally in some instances. But what are some of the challenges that you've seen as much as like even I'd said at the top of the conversation. Phishing is not new, fraud is not new, even nation-state attacks. But in the midst of COVID, what are some of the things that you saw, some of the things that your team may have tackled or just even things in the industry.

Great question. Yes, Rocco. So we've been keeping a pretty close eye on what's happening as to what's -- the same type of attacks, but just different form factors. So we're seeing a lot of stuff on COVID-19, different types of schemes of how to go ahead and do the traditional social engineering techniques that are commonly used. However, in this case, they're used more towards preying on people fears at this point. So we've been taking these threats and really doing a good job of how do we communicate, how do we make sure that we make people aware, especially since people are more distanced now. Some of the chat that would happen earlier was not -- it was more directed. Now we're using alternative means like [ EMR ] and some another internal social media ways to make sure that the message gets out to different folks. We've also been keeping a very close eye on our supply chain. We've seen a lot of uptick in ransomware recently just from a supply chain management, not that we haven't seen anything on our end. But we'll continue to stay abreast of that and really focus on making sure our processes continue to stay sound and making sure that as we identify threats, we're able to -- any indicators of compromise that we get, we're applying them through our various controls that we've put in place. So those are probably the 3 things that we've focused on.

Thanks for that, Greg. And one of the things, no doubt it's now more than ever these issues aren't IT security issues for sure. It impacts the business, business disruption issues. Gulrez, I know and a lot of the things that you do is obviously, IT security and compliance come into play. You mentioned earlier, looking at things from a global perspective. But in communicating with the business and so forth, as much as there's all these different things. The term risk appetite continues to be thrown out there. And I see you chuckling a little bit there. Can you expand on that for us a little bit and especially in your role. What's this opportunity giving us, not only to the business executives, but the overall enterprise from a risk standpoint?

Yes. No, thanks for that actually, Rocco. So what I've seen, and I know maybe it's a multipronged response. Because at the end of the day, you are talking about creating awareness with the business operations folks who are primarily trying to ensure that their operations remains at a critical volume and they can manage through that. But I think it's also coming down to how do you create awareness amongst the various stakeholders of the different, I would say, the elevation of operational risk. So primarily driven by the absence of managerial supervision or the absence of physical controls that you may have in captive environment. A lot of times, people need to be sort of -- you need to take them on to that journey of how things have evolved or how the risk has been elevated. And I think once you get to a point where there's an acknowledgment around the risk itself because people tend to think about, okay, yes, it's COVID-19. Yes, we have people working remotely. What has really changed, right? And I think that discussion does need to happen. And I think the more proactive as a security practitioner or as an IT risk manager, the more proactive you are in engaging your partners into that conversation, the better outcomes you have. And I think I'll also address from -- even from a home work standpoint. If you think about the global nature and some of our companies that are represented even on this panel, you have a global footprint. You have staff who have different skills as well as awareness around security. And more importantly, I would say, capabilities in their home. So when you talk about, I may have like a 1 gigabyte line at home here, but somebody working in India or some other far-flung place may not. They may not even have the standard computer that we ought to be expecting. So I think when you get into a COVID-19 situation, very different things come into play. And I think it's really making sure that you think can engage partners from logistics, from physical security to technology risk and making really sure that the awareness around the risk posture and how the risk has been elevated, it's coming into play and is at the forefront, striking a balance between operational readiness as well as maintaining a level of security that's deemed acceptable.

Great point. Thanks for that, Gulrez. And then I'll -- Mike, I'm going to throw one to you that really combined with Gulrez and even Greg for that matter, we've been talking about the things that have occurred in the last 3 months, how we're getting ourselves ready, how we've gotten ourselves not only stabilized but moving forward. But the very term and the theme of our session, the future of work. There's all these different pieces, a lot of the -- even the threat vectors that I talked about earlier and then being unto death. We -- every day we hear that phishing is through the roof or the insider threat and things that continue to evolve, what's the future hold for us?

Yes. Thanks, Rocco. I think it's really interesting, and I'm sure most kind of realize this, but I think about it in 2 ways, and it's -- it could be a game changer. So in one word, decentralization of the workforce. And I think a lot of us over the course of our careers in different companies, it always seems like whether you're domestic or international that you have certain areas that you can hire in, or wait now you can't hire, or wait now you can hire. But I think that's going to change, right? So working remotely has proven effective for most, right, especially in financial services. Again, it doesn't seem to have kind of these locked in positions, like you can hire, but only in these areas or you can hire, but only for this kind of niche kind of product or service. So I think it's really going to open it up that people, security risk professionals don't necessarily have to live next to a metropolis. And more importantly, digital is on steroids now. I think with most automation, machine learning, quantum computing, the kind of -- at first, I noticed it kind of ramp it up so we can help with some of these decentralized efforts. But I think what that may do, and not to be a forecaster of crystal ball is that if you have these other things in place, you may open up the career for information security or risk professionals that necessarily aren't tenured and these types of experiences. So it may make it easier for other folks from other walks of life to step into these areas and opportunities, and maybe someday that will help with 4 million to 6 million cyber openings that we always care about. So I think it will be interesting from a social perspective.

For sure. No doubt, the need for talent continues to evolve. And some of the things, I think we're all seeing, whether it's embracing new technologies or this remote workforce, that whole idea that you have to be in a major city or report into a corporation, there's so much talent around the country globally that -- on the blink of an eye, you've got access to -- I know we had the executive recruiter panel earlier. I'm sure they can speak volumes on that theme that if people have the ability to work remote, it's incredible. And I'm going to shift over to you, Greg. I know especially on the themes of what Mike was talking about, didn't mean to throw him into the middle there with a crystal ball. But from your perspective, I know you like that term, the hybrid approach when we not even work from home, work from anywhere, work remotely. What are some of the things that you can expand on from that perspective as to where we're going with the workforce from a hybrid perspective?

Yes. No, I think the ability to work from anywhere, part of our journey even at Guardian has been to do more of a work-from-anywhere type of arrangement. So we've actually been practicing that for a couple of years now ever since Hurricane Sandy hit New York City pretty hard. We're definitely impacted. So we've been working on kind of the strategy around work from anywhere. And that's one of the things that we feel is potentially a game changer for us. So to Mike's point, you can hire somebody from anywhere that has the right skill set at the right time has really, really been beneficial to us. And I think that, that's going to definitely, to Mike's point, be a game changer for how you hire and how we look at things in the future. Definitely, keeping the risk lens on it, but also making sure that we're -- we've been working a lot on how we form the right culture, turning on the video camera has been a big thing to make sure that you have that interaction with folks and making sure that we've been leveraging teams as well as a platform to really be able to bring the collaboration together, which traditionally in the past, doing things through just a text message or an e-mail has not been as personal. But now you turn on the cameras, have the conversation, be able to collaborate on a digital whiteboard has really been able to help change the game of what was once you had to be in a metropolis in order to really have that workforce. So now the fact that you can be distributed across multiple time zones and multiple geographies, really, I think, can be a game changer to help move companies along.

Great points, Greg. Looking at things from a global perspective, like you had pointed out before, Gulrez, especially when you look at a company like Citi or companies that are of the size of world-leading financial institutions, you've got employees in different parts of the world. From a regulatory and compliance standpoint, how do you stay up to speed, especially when we've gone to this work from anywhere, work remote, how do you manage to stay -- keep the employees compliant, following the standards and requirements we have in place?

Yes. I mean, look, it is certainly a very slippery slope, right? I mean, I think given the complexity and some of the challenges that we all face as part of -- even in normal BAU environment, let alone a COVID-19. So I think when we get into this, it really comes down to one of my mentors at Citi also, like, when I talked about how do we actually get this the right way? And he said, "Look, you've got to make sure you hire the right people." And I think it goes without saying, making sure that your management chain as well as the people who are -- we are bringing in, we are doing the right diligence around it, right? And then the trust element that I know Sigal and some of the other folks talked about it as well. We do have an ability to monitor productivity in terms of system and usage, et cetera. But that's only an indicator, one indicator. At the end of the day, managerial conversations, speaking directly to staff irrespective -- and one thing I would say about Citi is given the global nature, it is -- it has a huge advantage in the sense that for us, we don't make a distinction anymore. You could be having like 50 people on a call and folks from all over the world joining. So for us, it's almost like it doesn't really matter that boundary. So for us, it's more about how do you have and maintain their line of sight. And then it comes through, I would say, direct conversations, a little bit of more, I would say, now in this day and age of COVID, whether or not more Zoom calls, making sure that we have more of a -- of the Citi, I would say, work schedule. Like a small get together with small teams, et cetera, just to make sure that people are in sync, and we have that face time with them. So I would say a number of things, but I think -- but it clearly is a challenge. It does require quite a bit of sustained effort.

For sure. Great point, Gulrez. And on that theme as much as throughout not only our session, the overall summit. We've talked about the work remote and focused on the employees. But Mike, in your role, third-party risk management, the suppliers, the vendors and so forth, they fit right there with the employees because as much as they've got their contractual obligations and so forth when government regulations come down at your shops or business, it really has put third-party risk management in I shouldn't say so much into a tailspin, but definitely needs further attention. What are your thoughts there, Mike?

Yes. I think this is part of kind of the newer practices, the focus on third parties because, as Greg was saying, in addition to concentration risk and supply chain, for myself and peers and friends in the industry, it just seems like it's a lot more focused lately or maybe it has a renewed focus, it's always important, right. But that -- not only the third, but the fourth, the fifth person kind of in the chain. And I've noticed that it's not just necessarily a security assessment where you hire a consultancy firm or someone from information security a risk goes on-site because you could go on site, but no one is in there, right? So that's kind of been an interesting thing as well. So the regulators definitely expect it as they should. But it's kind of -- we're seeing a little bit more virtual assessment using tool sets. And it's going to be interesting, say, in a year or 2, hopefully, if things flip back, when they flip back to normal. Will the on-site assessment be as prevalent as it once was? And how is that going to change things just from a confidence level? And I really think -- Rocco, we've known each other for years, but I really think the concentration risk, the supply chain as a whole, will really start to get past that third or fourth step. I know that's been kind of the mission in that industry forever, but I think this really puts a light on it.

No doubt. And even on that theme, I don't want to get myself in trouble from a PCI or QSA standpoint, going and doing those kind of assessments akin to third-party risk management, there's the on-site element to it. And I know the PCI councils are looking at those requirements for companies that have to undergo things of that nature. But as much as we talked about our employees, we talk about the third-party service providers, the theme of insider threat. They're not -- the theme of insider threat isn't always a malicious employee. By contrast, we can almost zero in on who the malicious employees are, but the big exposure comes into these employees. By and large, all of our employees want to do well by the company. Likewise, so do third-party service providers. Greg, on that thought in the middle of this, when we talk about insider threat, what can companies be doing to really enhance their insider threat programs to take it to the next level, especially as it relates to the pandemic?

Yes. I think great question, Rocco. I think the big thing for us is rethinking about our insider threat program. Initially, it was more -- you were in the office space. Now there's different factors that play into where people may be having lost a financial kind of money is coming in or things where somebody has some type of issue or problem against the corporation. So we've recently kind of pushed a reset button and are looking at different user behavior patterns that are different from what we've traditionally looked at before. So we look at COVID as an opportunity now to see how do we transform our ways of thinking, using use case that we have, but then let's enhance them a little bit more where everybody is distributed and being remote as opposed to being in the office, where some of the controls that you had in place were different. So it's building a better mousetrap to be able to trap for those types of conditions.

Great point, Greg. And I know we're running short on time. But Gulrez, if you could give us a closing point and Mike, that would be great and being conscious of time.

Yes. I mean, look, I think we are certainly living in interesting and challenging times. But it comes down for us as security practitioners and IT risk practitioners to really be an advocate and an advisory to our partners. And I know we use this term often that we need to be advisers and so on. But I think given these climates or these situations, I've seen personally first-hand proactively reaching out and working with partners across the board, across many lines of defenses, right, whether it's compliance, regulators or audit, et cetera, making sure that everyone understands and converges on what that risk actually means to the organization and getting them to understand. And in fact, appreciating different points of view in terms of what this risk actually is or how it could be -- how it could manifest in different ways and means. And I think as long as we have that open line of communication across the teams and then bridging those conversations, I think, will get us to a much healthier space in terms of risk advocacy and risk management. And I think that to me is like really the key thing, especially in these times when we are not face-to-face, but having these conversations, keeping those lines of dialogue open with all these different layers of controls and across the organization, I think, is key.