In this week’s episode of Speed Data, we sit down with Tim Callahan, SVP and Global CISO for Aflac, the world’s leading provider of voluntary insurance. Tim talked with host Megan Garza about his favorite aspects of cybersecurity, what challenges him the most, and why he’d be happy to have a farm… so long as someone else manages it.
In this week’s episode of Speed Data, we sit down with Tim Callahan, SVP and Global CISO for Aflac, the world’s leading provider of voluntary insurance. Tim talked with host Megan Garza about his favorite aspects of cybersecurity, what challenges him the most, and why he’d be happy to have a farm… so long as someone else manages it.
Speed Data: Tim Callahan
[00:00:00]
Megan Garza: Welcome to Speed Data, Quick Conversations With Cybersecurity Leaders. I'm your host, Megan Garza. Today, I'm joined by special guest Tim Callahan. SVP and Global Chief Information Security Officer for Aflac. Welcome to Speed Data, Tim.
Tim Callahan: Thank you. It's good to be here.
Megan Garza: Since 2014, Tim has led information security for the world's leading provider of voluntary insurance, overseeing Aflac's global security program, supporting Aflac's core missions, and protecting the privacy of millions of customers. Tim is an experienced CISO with a demonstrated history of working in financial services and insurance, building industry-leading programs.
Megan Garza: Skilled in all aspects of logical and physical security and cyber- and information security, Tim has a deep history in leading global teams in building technology risk, security, and governance [00:01:00] programs. Tim currently serves as board chair for the National Technology Security Coalition and board member for the Technology Association of Georgia.
Megan Garza: and Board Advisor for AuthMind and Beyond Identity. In addition to wearing all those hats, Tim also often acts as the conference keynote speaker and panelist. Tim, when do you sleep?
Tim Callahan: Mostly at work. Just nod off at the desk. I do stay busy. But do try to achieve a work-life balance and, you know, spending time with my family as well,
Megan Garza: Yeah. What made you want to go into cybersecurity?
Tim Callahan: I'm career military, so I retired from the Air Force, and while I was in the Air Force, my actual job was bomb disposal, explosive ordnance disposal, but I always had additional duties. Everyone had additional duties, and one that I always just gravitated to was information security, Computer Security Officer, those kinds of things. So when I left the military, I, [00:02:00] looked for another opportunity and found my, you know, my way working for a bank in Atlanta and then joined the security team there.
Megan Garza: Now, did you say your previous role was bomb disposal?
Tim Callahan: Yes. Yeah.
Megan Garza: Okay, I would think that's a very high-stress environment. So now, you know, compared to being a CISO, what is the hardest thing about your role now?
Tim Callahan: I think the hardest thing is, you know, making sure that you stay focused, right? Because there's so many distractions, there's so many threats, there's things that can really take you off your plan if you're not careful, and so it's, it's very important as the CISO to lead the team, to encourage the team and keep everyone focused on the right things.
Tim Callahan: It's not a singular kind of skill. You know, within my team, I have risk management professionals. I have dedicated technicians, I have information security analysts, information governance, business continuity, and resiliency, [00:03:00] so, taking that whole team and making sure that we're staying focused on what really matters, you know, can be a challenge.
Tim Callahan: I mean, there's shiny objects all over the place and you just don't want to focus on those.
Megan Garza: So then, what do you enjoy most about your role, either day-to-day or overall?
Tim Callahan: I love the people. I love working. I've got a fantastic team. I'm privileged to work for a fantastic company where everyone in the company is very supportive, from the board, you know, down to individual employees. We have a strong security awareness program, and we try to make it fun and, you know, come up with games and things like that to teach, you know, the fundamentals of anti-phishing and how to protect the information.
Tim Callahan: But I just love the people and I love the privilege of being able to lead what I consider the finest team that I've ever led.
Megan Garza: That's fantastic. How has the threat landscape changed since you began your career?
Tim Callahan: [00:04:00] It is interesting. I was speaking to someone just the other day. I was at an event, and when I first came into security, at the bank especially, it was a lot more about compliance, complying with the banking regulations, and making sure that we had a program that satisfied the regulators. But the threat was not as prominent then.
Tim Callahan: And, you know, I'm talking late ‘90s, early 2000s. The criminals — or, back then, we used to call it script kiddies — you know, high-school kids just, you know, being, kind of curious and, quote, “attacking” or trying to hack into stuff. Uh, but it wasn't that intense from that side.
Tim Callahan: The criminals at that time had to manually break in. There wasn't a lot of AI and machine kind of attacks, bots, those kind of things. But it was highly focused on compliance. And then, through the years you start seeing the criminals emerge and getting more [00:05:00] sophisticated.
Tim Callahan: So now, and compliance is still, you know, very important. I mean, that's table stakes. You’ve got to do it to stay in business. But now there are so many other aspects, and it's a lot more focused on keeping the criminals, the nation-states, out of your environment.
Megan Garza: In your opinion, what is the best way to defend against a cyberattack?
Tim Callahan: It's really having a multi-layered defense program, right? In some cases, you know, we're a little more offensive, I don't mean like hack back or trying to attack, but we attack ourselves a lot, so I have a team primarily based out of Northern Ireland that, you know, is constantly looking for weaknesses within our environment so that we discover them before criminals do and so that we can remediate them.
Megan Garza: And what advice can you give security leaders on getting buy-in from the C-suite or board members on the importance of cybersecurity?
Tim Callahan: [00:06:00] I think it's very important that you tell the truth, right? Be very frank, but not alarmist, that you know, you have a good risk assessment that's meaningful and tuned to your company. Then, the risk assessment will tell you where to concentrate and what to do.
Tim Callahan: So it's very important that you communicate that to your leaders and the board, and then, you know, take a very methodical and proper approach. And I think that just builds trust.
Megan Garza: And what advice do you have for security teams that are recruiting cybersecurity professionals, given the talent or workforce shortage today?
Tim Callahan: You know, we've been very fortunate. We've been able to recruit really good talent. When I talk to peers, you know, they talk about high turnover. We have very low turnover. And one of the reasons is, we concentrate on hiring a [00:07:00] person, and in some cases we may hire someone and give someone an opportunity that maybe not have as much experience but they have the right mindset,
Tim Callahan: the eagerness, you know, I really believe you hire someone for culture and fit and then train them the way you need. We also look, you know, we try to make sure that we maintain a very diverse workforce so that we're getting good ideas and ideas that I wouldn't necessarily come up with.
Tim Callahan: I don't need a bunch of Tims running around. I need people that think differently. And so that's what we concentrate on.
Megan Garza: And if you weren't in cybersecurity, what would you be doing?
Tim Callahan: That's a tough one. It really is. What I enjoy doing when I get time to do it is I love working outside around my house. We have 24 acres and, I love to, you know, get on the tractor and do things and cut grass and those kinds of things. So, you [00:08:00] know, if I didn't have to work, that's what I would be doing.
Megan Garza: Do you have animals on your land?
Tim Callahan: No, my two daughters are grown, and their children live there as well. So we have three houses on the 24 acres. My one daughter is always wanting, “Well, let's get goats or let's get chickens or cows,” and my opinion of that is, “Fine, but you're going to take care of them.”
Tim Callahan: I don't do animals. I've got two dogs, wonderful dogs.
Megan Garza: That counts.
Tim Callahan: yeah.
Megan Garza: Well, thank you so much for joining me today, Tim. I enjoyed chatting with you and learning more about your amazing team at Aflac. Thanks again and have a great week.
Tim Callahan: Well, thank you, Megan.