Edna Conway (Microsoft): Start With The Human, Not The Technology

Casey Renner: Welcome to the OV BUILD podcast, Building to Boss. I'm Casey Renner, VP of Executive Networks here at OpenView. This month, we're releasing a special miniseries with female leaders in the enterprise SAS industry who know the path to leadership is challenging, but aren't willing to let that stop them from building something great. Today we hear from Edna Conway, Chief Security and Risk Officer for Microsoft Azure. Edna is responsible for ensuring that the Azure cloud platform is secure, sustainable and resilient. Before Microsoft, Edna spent 20 years at Cisco as the Chief Security Officer for the global value chain. In today's episode, we unpack: why it's important to consider the life cycle of an idea; what it means to operate in a platform economy; and why Edna says security is an inherently human challenge. All of that, and more in this episode of the Build Mini series Building to Boss, let's dive in with Edna Conway. Edna, thank you so much for joining us on the podcast to talk about all things security and career transition, platform economy, and everything in between. So let's jump right in. For those of us who are less familiar with you than say, I am, do you mind telling us a little bit about your role and your responsibility within Microsoft?

Edna Conway: Sure. First, let me say what a delight to actually have the opportunity to talk with you again. I regret that we haven't done it in person, but we will opportunity soon.

Casey Renner: I know. Yes.

Edna Conway: Let me start a little bit by sharing, I think we start maybe Casey, with what I committed to Microsoft. Let's start there, and if you ask me," Hey, what are you going to do for me?" I will tell you, I'm ensuring that the Azure cloud platform is secure, sustainable and resilient. When I say secure, I mean exactly what you think, to the integrity of every operation, transaction and workflow across Azure and deliver productivity free of compromise. When I talk a little bit about sustainable, we have a very strong commitment to sustainability. I'm trying to do that while meeting the needs of Azure customers today and also everyone tomorrow, so that we positively impact future generations' needs i. e. there's a planet on which we can reside and continue to use the productivity of our technology. Then, resilience for me is proactively monitoring and preparing for the inevitable disruption so continuous quality service can be delivered. Example, in Exhibit A, we're not together in the same room during what you could argue is one of our biggest disruptions in our lifetime, COVID.

Casey Renner: Yeah.

Edna Conway: So I could keep going and talk a little bit about what the organization's focus is. Do you want me to go?

Casey Renner: Yeah, that would be great. Yes. Scale of Azure.

Edna Conway: Sure. So the focus of my org is really, it's a simple statement to make. It's hard to do. I want to ensure that Azure is the number one trusted cloud platform on the planet, and that mission really drives everything we do, but there's cause to that mission. You've heard some of these themes in other roles that I've had the privilege of chatting with you about, and core to that is ensuring customer trust, right. Trust in the Azure platform itself, and trust in us as a partner in our customer's success. I think when you look at it that way, earning that trust requires two digital capabilities, Casey. One, security, and the second is resilience. And if you ask, well, that's great what do you mean by security? You know, that I've been, for many years hard over on the fact that cybersecurity is not in isolation. It's part of a comprehensive approach to security. So I'm defining it the same way. Physical security, logical operational security, behavioral security, information security is there at the table, but let's also think as well about IP protection and privacy. Then you start to get really intriguingly complicated when you add risk management because people like resilience. What is that? What do you mean you're doing resilience? Hold on. So I've identified if you will, at least for us, for our mission in this context, what the definition of how to continue operations in a world- class manner no matter what comes your way. And so for me, that's a whole new set of things beyond what you and I have talked about in the past, which includes business continuity, disaster recovery, anti- bribery and anti- corruption, human rights, labor rights, health, and safety, environmental sustainability, and trade and export control. Try doing all of that across, you asked me the scope, right? Whereas in about 140 countries across the globe, and we're in space also. Azure and Microsoft's commercial cloud business exceeded about$ 50 billion in revenue in FY20, and there are more than 1 billion Azure user accounts. We're delivering capacities in this breadth and spectrum of areas like compute and storage and IoT management, and a host of others across that broad a spectrum.

Casey Renner: Got it. That's crazy. I didn't know you were in space. That's so cool. That's so fun. How great. So that is a lot. You have a very time- consuming job. So with all of that, how would you condense that and describe what you do to a third grader? Or how does your husband describe what you do?

Edna Conway: Oh yeah. Edna does things.

Casey Renner: Usually she travels.

Edna Conway: That's describing it. Third grader. Let's see. That's about eight years old. You know, these guys are actually digital natives. So we would say Azure as a cloud platform, it's something that allows you to use the power of computing. But most importantly, it allows you to use what you need, when you need it, from anywhere. Whether that's, let's see, it's a third grader, accessing music, doing math or storing your homework. I made sure that you can count on Azure to be there whenever you want it, and trust that nobody will see the things that you don't want to share, even with your parents, or change things that you have created and want to stay the way you made them. How about that?

Casey Renner: That's great. I mean, I feel like honestly, some days people should just tell me what they do as I'm a third grader. Now I know exactly what you do at work. All right. So let's talk about your life prior to Azure and prior to security. You were a New Hampshire assistant attorney general, and practiced law for 18 years. What was your path like to the security world? How did you get here and how did law translate to the place where you are today?

Edna Conway: I always say the most annoying people to be around are engineers, and the worst inaudible engineers or technologists who also are trained in law, because just in case there isn't in one area that you're going to be persnickety about, there's another area that you can. But that, and all due respect to my sainted husband, who is the double agent, but yeah. I think it's a story really of embracing yes. It's a funny way to describe it, but it's saying yes when a choice is offered, or when a change lands in your lap. Sometimes it's not your choice, right? So, legal to engineering, to supply chain, to security, is a journey. For me, I got out of undergrad and went straight to law school and I think I started picking up skills in successful quick pivots and deep resiliency at a personal level after law school. Why? Because I joined the New Hampshire AG's office and I was all set to practice environmental law. Okay.

Casey Renner: Okay.

Edna Conway: Sounds great.

Casey Renner: Yeah.

Edna Conway: Guess what? I arrived, and the AG pulled me into his office and said, listen, we're going to put you in the criminal bureau. You're going to prosecute homicides and you're going to work with forensic pathologists, crime lab technicians, and state police officers. So, you know, what are you? I was 24 years old, I had loans coming due from school. You say, yes. It's the first price of, yes. And 15 years of private practice of law really allowed me to learn from civil engineers and excimer laser technologists and turbine, and hydro- power specialists and software developers, and inorganic chemists as clients. And I'm one of those relentlessly annoyingly, curious human beings. That actually came to another moment of embracing, yes. One of my clients said," Hi, we need help. Why don't you come join the legal team?" And I said, that would be great, but I'm not moving to California. I live here in New Hampshire and that turned into a two decade opportunity to translate technical hurdles to government regulators, to talk about cybersecurity, risk management and privacy with Cisco. I think the flip side of all of this was also the opportunity to present security goals, to deep technology experts. To use your question as a backdrop, plain language that even a third grader could understand, and they're pretty darn smart by the way.

Casey Renner: Yeah, they are. No, they definitely are.

Edna Conway: We also drive innovation through a process and experimentation because I found lots of technologists, scientists are fabulous at many things. Process, may not be among them. Experimentation, is a strong suit. So bringing all those skills together was really just a, somebody sat in front of me and said," Hey, how about?" And I'd say," Hey, that sounds good. Yeah." And I leapt, I really leapt. And sometimes I didn't know if I was going to have a safety net, but I leapt at it.

Casey Renner: Okay. That's a wild ride.

Edna Conway: You bet.

Casey Renner: I didn't know that's how you got to Cisco.

Edna Conway: That is how I got to Cisco. One day when we're eating more chocolate together I'll tell you the in- between bits.

Casey Renner: Perfect. And you're still in New Hampshire. Look at that.

Edna Conway: Well I am, although I spend time in Redmond, Washington as well, but now I'm sitting deeply embedded and not moving from New Hampshire given what's going on in the world around us.

Casey Renner: Exactly. Well, and I love that. I love that comment you just made the embrace, yes. I feel like that's just a good life motto that people should take a hold up because that is... you hear that so often from women, especially who are in these really powerful positions at their companies like you, that it was all about, you just have to put your hand up and embrace what comes to you and say yes to opportunities. So that is great to hear. Right, you've said that security is an inherently human challenge. What do you mean by that?

Edna Conway: Yeah. You've spent way too much time talking to me. That's what that concludes. I think, let me answer it by first sharing a fundamental premise. Okay. I didn't know this. So that premise is that technology is here to serve us, the human. Not the other way around. Although I suspect, look, there are many days when all of us are doing battle with technology to better meet our needs than a consumer would serve the technology tools, right. But what premise sits at the foundation of why I say security is an inherently human challenge, because if you set that as the foundation, that means that while we automate and deploy digital innovation to enhance our productivity, the reality is, and that's all great, but it's the humans who create the technology. It's the humans who must safeguard the security integrity of the technology. And let's never lose sight of the reality. It is humans who attack the security of technology, right? And inaudible against, and mitigating the impacts of those human attackers. Guess what it requires? And now inaudible of an inherently human factor motivating, right. As you and I have talked about this. Is the attacker seeking to make a quick buck? Are they looking to learn some IP, for example? I, myself, I don't want to steal IP but I'd still love to know the recipe for original Coke, which is my favorite drink of choice and is probably one of the world's best trade secrets.

Casey Renner: Yeah.

Edna Conway: That motivation could be targeting an individual or an enterprise for revenge. Think of a disgruntled former employee who had insight or access, or it could be a nation state seeking a political advantage. So when I say security is inherently a human challenge, I'm basically reminding all of us to ensure that we keep the human factor in mind, as we develop, deploy and evolve our security strategies and practices.

Casey Renner: That's yes. I mean, yeah, we've talked about that before, but just hearing the whole thing that yes, that is a very valid point. How do you use that when you are approaching a challenge or in your job, and how has that made you the leader you are today having that mindset?

Edna Conway: Start with the human, not the technology.

Casey Renner: Yep. I love that. All right. What does it mean to live in a platform economy? Tell us.

Edna Conway: Yeah, well. We talked about this. I started this with you last year.

Casey Renner: Yes I know. So we were chatting briefly before we began this podcast. It's quite clear that digital transformation is certainly accelerated in 2020, right. Across all industries and sectors. I think what's happened though, is with that, we may not have seen it, but we've cemented the reality that we operate in a platform economy. I have a view, cloud and mobility, I believe, are the foundations of that platform. Remember what I said, what I did, right? Make sure that it's secure. Make sure you can do it from anywhere and make sure that it does anything you want anytime, anyway. The platform. We should probably level set on what I mean when I say a platform and a platform economy. We live in a world of platforms, they are pervasive in industry in our personal lives. Let's just talk about two examples. In industry, an integrated factory, that's when I say integrated digital, merging a single platform for visibility to operations. I mean, I don't know if you've been in a motor vehicle factory recently, but they are amazing. I still remember the first one that I went to and they put us in the little go- karts, and we would go on a run. They're like, don't get out of the go- kart and I came upon an engine that was moving because I saw some sensors and I lept out of the go- kart and everybody was like," What's with the woman from Cisco. She's like hugging the engine." I'm like, this is beautiful. Look at what you've done, right. But as individuals, we also use things like on- demand personal transportation platforms. That's the platform economy. Start there, and then apply a security and resiliency perspective. This has really caused an increase in complexity of security because it increases interconnectedness. Sometimes you can see actually a decrease in focus on that balanced, comprehensive approach to security that I talked about. Everybody might be really focused on operational security and have forgotten behavioral or information security or the other way around. I think we've also seen as a result of the platform economy, an expansion of unaccounted for risk, because we're relying on a platform and I remember years ago, you and I talked about supply chains, which are still essential. But the form that you're relying has a deep and rich chain behind it and there's a whole host of unaccounted for risk that you may not be aware of, right. Then finally, I think in order to address that inevitable unaccounted for risk in a platform economy, we need to start talking about how to develop and share what I've been calling Indicia of trust, which are ways to actually validate that you're using what you intended to use, that it is going to be secure in the ways that I talked about. It will not take your stuff. It will not throw your ideas. It will not allow someone else to do that. Right. What are those Indicia of trust? That's all because we live in this wonderful world of platforms. Awesome. Kind of building on that, but a little separately, what are the challenges and opportunities of living in a hyper- connected world?

Edna Conway: Yeah. That's sort of the ying and yang with challenging community, right? I think enhanced productivity for sure is one of the most wonderful opportunities that we have. The ability to focus on strategic differentiators for your pick a poison, a business, your citizens. If you're a nation state, your students. If you're an academic institution, we can keep going, right. That's what this opportunity gives us at a highest level, that productivity and strategic focus. Look, I mean, an example, let me give you an example because you know, I love examples. Looking up, inaudible company at OpenView, Expensify, right? Expensify uses this intriguing hybrid cloud and band metal architecture to streamline what is one of the most painful processes all of us have to deal with, expense reports. That is the biggest opportunity of a hyper- connected world. It also includes speed of delivery of service or product, but also think about speeding, capturing corrections in any connected operation that we might not have figured out before, right? Think of an IoT sensor or an industrial IoT device that can tell us when something is going wrong before its full ramifications have manifested. Now that world is wonderful. That's on your ying side of opportunity. There's a challenge with that and we talked a little bit about it and let me elaborate it. Along with that comes this wonderful, unknown, but expanded attack surface, right? We have more things that could go wrong. We have more things that are connected. We have more who's in our lives that we may not know are in our lives. Addressing that third party risk then has become now more complicated. You know, you may not have complete visibility to, as I've always said it, who's touching your stuff, whether it's virtual or physical. And of course, you're ingesting that inherent risk of those third parties. Now I like to say, when we think about Azure, our customers bring their risks and their security problems with them to our platform. How do we integrate them into the digital environment in a way that makes sense? We have a glaring example of that right now, going on, watching what the impact is of solar winds, right?

Casey Renner: Mm- hmm(affirmative), yeah.

Edna Conway: I think the other thing that is the last challenge is just to society as a whole, given that interconnectedness makes critical infrastructure far more vulnerable.

Casey Renner: Yeah. It's crazy. All right. So we're going to, well, I suppose the next set of questions are a little lighter, so to speak. I don't know if lighter is the right word, but we'll be.

Edna Conway: Right, take me there.

Casey Renner: All right when, there's some deep ones in there just to keep you on your toes. But when you're hiring, now, just from a leadership position and in the careers you've had and the hires you've made, what do you look for when you hire and what mindsets are necessary to be successful?

Edna Conway: What mindsets? So look, I look for a couple of things always, right? Honesty, directness. I don't have time to waste. I will not tolerate rudeness, but you can be direct. Direct is inaudible, right. I think the ability and the backbone to point out that the emperor has no clothes. That is a fundamental mindset for me. I think grit and perseverance. I think I've been talking about value chain and third- party risk for over 20 years. Everybody's seen the light, but boy, it was lonely in the beginning, right. Then I think there's always, look, we have to put on the table, of course you have to have familiarity with key disciplines that are relevant to the role, but there's other pieces here, because you used an intriguing word. A lot of people say what traits do you look for? What skills do you look for? You said mindsets. That's a freaking word. So I think the mindset is please be who you are. Then a lot of time looking for diversity of thought and background and skill set. If you don't bring that to the table, you're not optimizing the diversity that I thought I was buying, right. And then please, please, please stay relentlessly curious. It is the key to success in an ever- changing, hyper- connected, fast- moving world. Casey, you used an intriguing question word, right? Your question included the word mindsets and a lot of people say, what traits or what skills do you look for when you hire? So let's think about that for two minutes because I try very hard to always look for diversity of thought, diversity of background, diversity of skills and approach. So I need a mindset that is comfortable of being who you are, the come to the table and be who you are, otherwise I'm not optimizing for the diversity that I thought I bought. Then always, always, always stay relentlessly curious. It is the ticket to keeping up with the pace of change in a connected environment in the world we live in today. Then, I think we have to focus on something that is very near and dear to my heart. And you and I have talked about this, you know, I wrote Crew Undergraduate in law school and it taught me the power of a team that was in a complete state and what you can do alone is far less effective than what you can do together. So I would say collaborate, but I'm going to use specific words, collaborate with wild abandon because I really believe that together we have the capacity to achieve the goals and the level of success that we need in today's platform economy, and at the speed at which life simply proceeds.

Casey Renner: Yeah. Collaborate with wild abandon. That sounds so sexy. We probably have to edit that out, but.

Edna Conway: Somebody actually asked me, how do you deal with this environment where everything is virtual and you seem to be meeting new people? This wonderful thing called technology. I will use Teams and pick up the Teams device and say," Hey, I'm going to call this person today. They don't know who I am and maybe they'll answer, maybe they won't. And if they answer, I'm saying hi, thanks for picking up the phone. I'm Edna Conway and I'm relatively new to Microsoft and I was wondering what you do? Do you have five minutes?" People are so taken aback by the fact they don't have an appointment and they're like scrambling clearly to like inaudible directory and figure out like, Oh God, that's our level. Yes, of course I have five minutes inaudible called me and had no agenda. That's wild abandon, right.

Casey Renner: I love that though. That is great. I feel like, and especially at a large company, the fact that you are doing that is awesome. Okay. And also yes, many Ednas, I feel it's like everything you described that you look for is how I would describe you.

Edna Conway: But I hope that I'm not doing that because I really do. And I have built an extraordinary team of people from the financial services industry, the technology industry, the trade and export industry. It's amazing, compliance experts. It's just that diversity is so important to me.

Casey Renner: Yeah. Oh, well, yes. But don't worry. I imagine that a lot of the people, if not all who work for you, probably aspire to be like you. So definitely a compliment. I surveyed them separately to ask, no, I'm kidding. I'll report back what they said. Okay, onto the next, how important is it to consider the life cycle of an idea?

Edna Conway: So that was the most intriguing question I've been asked. You get the gold start on that one because it's not the life cycle of a solution. It's the life cycle of an idea, right? Go back to your mindset question, right? A mindset has to do two things. It always has to be applied to identify a goal, that at the forefront of all efforts. Then I think it, you also need to have recognized that every opportunity and challenge can be approached. Some of them are daunting, but this sounds very pedantic. Break it into its component pieces, build a plan and roadmap, all the stuff your mother told you, right? Like make sure you don't eat carbs, eat vegetables. Digital transformation and the pace of change has made us forget sometimes that one step at a time is essential and we need to look up as we're taking on those steps, of course, and validate that they're leading us towards the goal we wanted to get to because it's always easier to course correct midstream than when you arrive at the wrong conclusion. That's not answer to the question. That's the backdrop to your question, which is if you believe that, as I do as a mind sight premise, a lifecycle of the idea is, one key trait that allows us to recognize that the pace of innovation and change is moving fast is, we have to be more adaptable than ever. Well, if you're defining goals and building solutions that can evolve skillfully, you might have to discard one of them. So all of that backdrop was really to get to the meat of what you asked which is, how important is it to consider the inaudible of an idea? Well, if you think about, we have to recognize the pace of innovation and change. It requires adaptability, right? And I would argue, that's a fundamental trait that you need, but you have to be adaptable in many ways and the primary way is, are you building something? Are you driving something that's going to get you to your goal, number one? Number two, holy moly, something changed in the world and I have to evolve swiftly. That may require you to discard something. It may require you to say the path that we were taking is not applicable anymore. The way I would answer your question is ideas and solutions, just like humans, have shelf lives. If you are not thinking about that shelf life, in the mindset that you approach, which for me is always in successful security and risk management, you're missing the boat because what was good three months ago, may not be good today. We'll have to be thinking about that as an approach, not as an after fact of like" Oh, good look at that. That's broken", right? Rather, is this still the path that I want to take or do I need to make a left turn?

Casey Renner: Interesting. All right. Personally, I love to eat carbs over vegetables. That's my biggest takeaway there, but no, I'm kidding. All right. What opportunities do you see for emerging companies and entrepreneurs? I mean, you advise so many companies, we always talk to you about what you're seeing, but from your perspective.

Edna Conway: Well, I mean, for a broad, across a broad portfolio, like new portfolio or others that I have the privilege of working with, I think a couple of things that are at a very high level, right? You know I'm hard over these days on silicon in quantum, but to not be specific on a technology, I would say collaboration solutions remain at the forefront. Look at what we're doing today, right? There's an opportunity that lies in enhancing the collaboration experience on existing platforms. I'm not sure if everybody is really looking at that, right? They're like, well, there's too many of them. I can't compete with them. That's not the answer. The answer is, how do I make them better? What's the sweet spot on what is the goal of the user of the collaboration collection? That's one area. I think the other thing is, we've certainly moved to this world of X as a service. I got it. But guess what, nothing works in a vacuum, right? Software doesn't operate without hardware. We've had that conversation, et cetera. I think emerging companies and entrepreneurs need to ask themselves, how do I deliver the most trusted service in my space? That is a true differentiator. Then apropos to that, and connected to it, is think about so many entrepreneurs always want to do it alone. That's why they were entrepreneurs. They're innovative. They like their path. I think of early as possible. Thinking about how do you partner to scale? It can often be the path that propelled you ahead of competitors. So you're not doing things in a vacuum, you're looking at collaboration solutions, how do you scale and who can you use to jump up five steps instead of taking all of those five yourself? The one thing I would leave you with is, probably near and dear to my mission, but make quality and resilience priority number one, and let quality and resilience map perfection. That's a very special mindset.

Casey Renner: Yeah. I really like that. What do you think the future looks like for GRC, for global, for security, risk and compliance?

Edna Conway: You know, so many people hear GSE and turn off and say that's a corporate requirement. It's not important. It's not innovative. I think what we need to remember is the more connected we are, the more trustworthy inaudible uptime in enabling our customers to conform with regulatory mandates that are impacting their businesses on a regular basis. Ensuring that inaudible they rely upon is free of compromise and inaudible manner that doesn't negatively impact our planet and is adaptable as their needs change, is a new way to look at security and risk. For me, I would say the future is addressing a couple of key ingredients, essential to trust. One, ability. If you were looking, remember we started the conversation earlier with Indicia of trust. What am I going to look like five years from now is something I probably want to be sharing with you if you're a trusted partner. Well, how are you going to be accountable to that customer to show them that they can trust you. Two, transparency. It's more important than ever. Doesn't mean you can give them this actual recipe for the Coca- Cola, but you inaudible and how do you go about establishing verifiable integrity? I would love to see GRC disappear and people start talking about profit with three new areas, accountability, transparency, and verifiable integrity.

Casey Renner: I love that. And then final question, before you can answer your rapid fires. You have yearly themes, so what is your 2021 theme?

Edna Conway: I don't have one specifically this year. So I thought about that. Last year was platform economy inaudible that was about value chain. I think this is the year it all comes together. I think it comes together in maybe a couple of areas, public inaudible cloud, mobility, and please pay attention to silicon and quantum, it lies at the future of where we're going and the foundation of what technology can deliver.

Casey Renner: All right. Silicon and quantum. We'll come back to you in 2022.

Edna Conway: Hopefully we'll have proven the top logical group of Biden.

Casey Renner: Exactly. All right. Rapid fire questions. Are you ready?

Edna Conway: Ready?

Casey Renner: What three items do you always have with you?

Edna Conway: A pencil and paper. A mobile phone. At least one extra battery for the phone.

Casey Renner: All right. Well that's almost four. If you count pencil and paper, but I'm going to give you that as one combined thing.

Edna Conway: Sorry, I'm a little bit deviant, aren't I?

Casey Renner: You are deviant, yes. It's okay, I too, I actually have my pencil and paper right next to me right now. So we are old souls in that together. Favorite book.

Edna Conway: The Riverside Shakespeare. You laugh, you cry, you love with Shakespeare. You're never alone.

Casey Renner: You are never alone. You are not. It's an emotional roller coaster Shakespeare. Favorite board game.

Edna Conway: Oh, that's easy. You should know the answer to this- Monopoly. There's finance, there's business continuity, there's disaster recovery, there's capitalism and there's even charity. It's fantastic.

Casey Renner: I've never heard of monopoly put like that, but I love it. I will always view it differently now when I play. And your favorite quote.

Edna Conway: The man in the arena by Teddy Roosevelt.

Casey Renner: All right, everyone, go check that out. Edna thank you so much for joining me, chatting with me on all things, security and law and embracing yes, and a platform economy. So I appreciate, and what we look forward to our 2022 to seeing if these predictions come true and where we are in terms of our platform economy from that. So thank you.

Edna Conway: inaudible Thank you so much, Casey.

Casey Renner: You're the best.

Edna Conway: Thanks for listening to this episode of the OV Build podcast, Building to Boss. We hope you learned as much as we did. We'd love to hear what you think about the show. Please leave us a review on Apple podcasts and subscribe to stay up to date with all the new episodes. If you're looking for more Open View content, follow me, Casey Renner on LinkedIn. See you next time here on OV Build.