Security professionals rarely start their careers in security. They generally gravitate to the position. Some have short journeys and others take a much longer path. David Levine, the Vice President of Corporate and Information Security & CSO for Ricoh USA, Inc. is one who has taken a serendipitous trip. At this time he is responsible for a wide range of activities that include corporate security, investigations, physical and cyber operational security, security policy, access management, trade compliance, eDiscovery and litigation support and HIPAA Compliance. He also leads Ricoh’s Global Virtual Security team and is routinely engaged in customer opportunities to discuss risk and security.
Photography, Copiers, Infrastructure, & Security
Few security executives can match the bottom-up journey that David Levine has traveled. He has held a wide and diverse variety of positions over the course of his career. When young he wasn’t in a technology field. He started as a professional photographer, working at that trade for several years before he switched gears earning a degree in Management Information Systems, with minors in Computer Science and Business Management. Following college he went to work for a systems integrator and was thrown into the deep end. On the first day on the job they slapped a dot matrix printer in front of him and said, “fix it”. Levine will never forget that because he remembers thinking “Oh my gosh, what have I got myself into?”
He quickly took to his new position and gradually progressed from a bench technician to field service to networking. Eventually he was managing the networking team which built a Network Operation Center. Within the information technology department he worked on vendor management, project management, and engineering. Levine eventually moved out of the IT department to participate in Six Sigma projects. This allowed him to learn about different parts of the business.
Levine returned to the technology side of the business as a vice president handling infrastructure. It was in this role that he became engaged with the security function. IT infrastructure covered the Data Center, Network Center, Help Desk and Telecommunications with security being a blended function inside all of those components.
This is What I Want to be In
Over time Levine found himself spending more of his time working on security related issues. He states, “I enjoyed working on security and eventually began spending the majority of my time working with sales teams helping them close deals from a security perspective, talking to customers about security and other one off security matters.” Eventually he realized the growing importance of the information security activity required that the function should be organized as an independent entity. Management accepted the proposal and as a security subject matter expert and eventually earned the position of CISO.
Having cybersecurity as a separate group allowed for Levine to concentrate on specific security initiatives. He says he enjoys the technology, the people, and the challenge security brings. From the beginning, to this day he has been constantly building and improving of the overall security program. He does relate that he had a great advantage when he carved out the security team from the infrastructure group. “I had some great people doing security within my infrastructure teams and basically brought them over with me into security.”
Security is a Continuous Effort
For David Levine the greatest challenge working in cybersecurity is it is a constant endeavor. A never ending task. “You can’t plant a flag and say security is done, what do I do next?” The industry makes advances to address new threats but the attackers respond as fast if not faster. In order to keep up with this evolving environment requires a strong team who are constantly learning and sharing knowledge. You need to keep up with the daily news feeds, threat intelligence reports, and additional learning opportunities such as webinars.
Staying current for Levine includes identifying new security technologies, best practices, and tips that could be used to fill a gap that arises based on what adversaries are targeting or generally improve our security posture and/or operations. To help him in this regard Levine relies on his peers to provide insight. He is very active in the local CISO community and the insight is immensely valuable. “For example, if I know a peer of mine had a really great experience implementing something, that recommendation goes a long way.”
“No one has all the answers and leveraging each other’s expertise is invaluable”. He has seen a shift in the way products are delivered which has been a positive development, in most cases, within the industry. The consolidation within the market means that many vendors have significantly expanded their scope and offer similar functionality and or solutions. Looking across your existing partners you can frequently find competing products, which gives you options without having to go to new vendors and add yet another tool. This provides the opportunity to select a strong solution which can fit into your existing architecture.
Six Sigma
Between David Levine’s stints in IT he took what could be called a sabbatical to participate in Six Sigma projects at Ricoh. He became a Black Belt in the discipline and was a Green Belt instructor. Six Sigma is a set of quality management techniques and tools that seeks to improve processes. By using empirical and statistical methods it can identify and remove the causes of defects.
Levine says Six Sigma is about making data driven decisions instead of basing those on intuition. It forces you to use real data, to validate the data, and then analyze that information in order to discover process improvements. He believes the methodology could be useful in improving security processes. There is real value but Six Sigma is very time consuming and given the constant need to address ongoing threats it is difficult to do the deep dive required by the process.
Need for Speed
Being a CISO can be stressful so taking time for stress relief is important. David Levine makes time for his family but what he enjoys doing when time permits is building and racing cars. He raced competitively for one season but now it is limited to participating in track days. Track days allow you to drive on a real racetrack in a controlled environment. He has visited many tracks but he is fortunate that what he considers one of the world’s best road courses, Road Atlanta, is only about 15 minutes from his home.
Levine says that driving is a great escape. Being on the racetrack at speed requires 100% of your undivided attention at every second. The Zen-like concentration required when driving blocks out other thoughts on your mind so ultimately it becomes relaxing and therapeutic. Levine also adds that it is “crazy fun”.