A conversation with Mike Lashlee, Deputy CISO of Mastercard, on the changing nature of payments and the interconnected risk landscape of our current era.

• As cybersecurity evolves and looms as a larger and larger global issue, how do you see the role of the CSO and CISO evolving? How must executive teams and their boards evolve in addressing the issue?
• Michael, how has your career at the Secret Service informed your leadership as Deputy CSO at Mastercard? Paul, how has your career informed your thinking as Global FSI Lead at Palo Alto Networks?
• With the migration to the cloud, how are you managing your legacy systems, decommissioning where appropriate, as well as rationalizing for consistency going forward? How does security enter into the IT decisions?
• With cybercrime becoming more sophisticated, what do you both see as the largest risks on the horizon for 2022, and beyond? 
• More and more businesses are “going digital” and at the same time, they are harnessing the power of the cloud. What are the best practices for securing the cloud and having a robust risk posture? 
• How can you tap into both SecOps and DevSecOps to enhance your cyberdefenses?
• With more workforces going remote during our response to COVID-19, how does this new hybrid work from anywhere model change the nature of the threat perimeter? How does Zero Trust enter into the security equation?
• While we are securing systems and operations, the human component and social engineering loom large as a threat vector. How do both tools and education interact to secure hybrid workforces?
• As Ron Green, CSO of Mastercard, noted recently, “Interconnected systems mean interconnected risk.” Of course, nowhere is that more true than payments. What are the core third-party risks to be managed in the year ahead, and beyond? 
• How has the threat landscape changed in the last year, in light of SolarWinds, the Log4j vulnerability, and the more visible ransomware attacks on Colonial Pipeline? How do you see ransomware evolving? How can both threat intelligence and dynamically scaled security operations be proactively engaged and deployed to address this issue?
• Can we type the balance of power with cybersecurity? Will it always be about solid preparations and playing defense? Are there proactive steps that a CSO or CISO can take? Any other final thoughts?