Ep.152 Transforming Legacy Systems: A CDO & CISO Blueprint for Digitization and Cybersecurity

Joe Toste [00:00:00]:
Hey, what's up, everybody?

Joe Toste [00:00:00]:
This is Joe Toste from techtables.com, and you're listening to the public sector show by techtables. This podcast features human centric stories from public sector, cios, cisos, and technology leaders across federal, state, city, county and higher education. You'll gain valuable insights into current issues and challenges faced by top leaders through interviews, speaking engagements, live podcast tour events. We offer you a behind the mic look at the opportunities top lead ears are seen today. And to make sure you never miss an episode, head over to Spotify and Apple podcasts. Hit that follow button and leave a quick rating. Just tap the number of stars that you think this show deserves.

Joe Toste [00:00:34]:
Today we have Shauna Rogers, chief digital and data officer at the Texas attorney general's office. And for those of you who saw the agenda, we are actually calling an audible. I know for you not sports fans, I switched sports from basketball to football and sell introduce yourself because Solarino is.

Celerino Torres, CISO, Texas Attorney General's Office [00:00:49]:
My name and Torres is my last name, but usually people think that Solarino is my only name. Somebody knows. So it's sell. I go by selling.

Joe Toste [00:00:57]:
Okay, awesome. Well, welcome to the podcast. How long ago did you find out you were going to come on the podcast? 10 minutes ago.

Celerino Torres, CISO, Texas Attorney General's Office [00:01:03]:
Yeah, just about that.

Joe Toste [00:01:04]:
I love that. Calling the audible. I love this. This is fantastic. Okay, so today's podcast is going to be broken up into three parts. Modernizing technology mindset beyond cloud technology, employee digital services and data governance. And for those of you who don't know. So Shauna has been on before, and she is one of the smartest people that I know.

Joe Toste [00:01:26]:
She's an incredibly hard worker, came from the private sector, 18 years at JPMorgan Chase. And so for those of you who are interested in her kind of background, career, we recorded an episode of the Commodore Perry estates last year. We also connect because she likes basketball. So this is like the event to go to. And she likes to, quote, build cool things, right?

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:01:48]:
Yes. And I was also disappointed that Houston got knocked out by Miami.

Joe Toste [00:01:52]:
Yes, I know. And you can check out our episode. For those of you who might not be aware, we were in Orlando. I know we kind of briefly talked about it, but we recorded four Fantastic podcasts. And from Jamie Grant, who's the state CIO, who will be speaking tomorrow at DiR's information security forum. So you'll hear from him to the state CIso, Jeremy Rogers, who his team, FAU, is somehow in the final four. I was like, jeremy, are you going to come to Houston and crash this?

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:02:24]:
He's.

Joe Toste [00:02:24]:
I'm going to a bar in so. And then we had a few great secretaries on who were talking about a lot of the projects and modernization that they're having. So for the city folks here, we had Raimundo Rodolfos, city of Coral Gables, absolutely fantastic, large number of smart city initiatives, and Tamika McKay, who's the CIO for the city of Fort Lauderdale, to round us out. So, Shauna, let's jump right into modernizing your technology mindset beyond cloud technology. The agency is 75% in the cloud today and will be 100% in the cloud by 2023 for admin and legal. And you said 2025 for child support. Talk about the process with changing your technology solution approach to becoming a more human centric and less technology centric organization.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:03:13]:
Yeah. So what I would say is what we've learned is it's very important to actually focus on the human element and the customer and the end user and the, the goals of the organization. And the other thing that we found is a lot of people didn't know what that meant, worked in it. They were very focused on building systems or building an application to support end users, but they weren't so focused on what that meant to the community impact, or what that meant to the mission of child support, or what that meant to the Criminal Investigations Unit Division, or legal case management overall for the administrative and legal section of the organization. So we're very focused on humans and people and the impact to the citizen community, and making sure that we go after bad people and we put them in jail. Right. To keep our community safe. So for us, it's more about community impact, and it's not just about getting off the mainframe.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:03:59]:
Right. And in order for us to approach and teach people the skills that it takes to do true solutions architect, that requires all of us to roll up our sleeves and really get into understanding who are our citizens, what are they engaging us for, what services do they actually need? And so the other thing is really tracking, getting feedback from citizen engagement, and understanding all the services that they're not just engaging our agency for, but long term also other agencies as well, to really personalize those services and make sure that we're focused on that human and the services that they need to receive from the state of Texas holistically.

Joe Toste [00:04:35]:
Yeah, no, that's fantastic. And one of the things I really like about Shauna and just, I mentioned kind of the private sector approach from 18 years of JPMorgan, when she said she shipped software every single day, which I thought to be a very fascinating piece of I absolutely just love it. We try and ship media almost every day. Right? This is the same thing. It's the same concept. And I think one of the reasons why it really resonates with me is when you are able to push yourself beyond what you think is possible, you just figure out there's another level. And then when there are leaders like that who are willing to just give you the hey, friend kind of push, it takes you to another level. And there's people in my life, and I'm sure there's people in your lives, too, they push you, and then you're able to see, oh, I didn't think I could do this before, but the leader always believed that you could.

Joe Toste [00:05:27]:
And that's, I think what makes leadership so fun is like seeing something in somebody else before they see it in themselves is, I would go with a coaching analogy, is what I love about coaching. Right. Seeing stuff in kids, but same thing with adults, like, having that potential and seeing them meet that I love. And so being able to kind of break that mold and ship, but also having that human centric side and understanding the business is one of the reasons why I really like you.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:05:53]:
Thank you. No. And I would say we've been very focused, again, on building state employees, right? So hiring baby data scientists, and I would say now they're like, in middle school, they're not babies anymore. After three years with the agency. So just watching the agency grow and build the talent in house and making sure that whenever I move on into something else, that we can say, we really built the legacy and we built the talent in house in the organization to make sure that the talent can sustain, the technology can sustain, and we're building the next service. Evolution of thinkers. Right. And leaders in the organization.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:06:24]:
And I'm really happy to work with cell. I know sometimes he probably gets tired of my pushing as the CISO, but he's been a great partner and a great friend to work with.

Celerino Torres, CISO, Texas Attorney General's Office [00:06:33]:
She can push the envelope pretty hard.

Joe Toste [00:06:34]:
So let's unpack that, though. So can you maybe just talk about the dynamic between the two of you and how you maybe see the role of cybersecurity?

Celerino Torres, CISO, Texas Attorney General's Office [00:06:41]:
Well, I started JPMC with her. I didn't do 19 years. I got out as quickly as I could about five years into it. But my background is in oil and gas, and the people aspect of dealing with people from different walks of life in the oil and industry, they come in with not knowing how to work on a keyboard or not probably chewing on their smart card because I came from Slumberger. And that company was really educating everybody else how to be more tech centric. Most people here don't even realize Slumberge was one of the very first companies that had an ip address assigned to them. Class A in 1985. So they really were driving technology even since when even companies in Silicon Valley were thinking of, hey, let's get a class c was dot 17, and the were dot 165, if I remember correctly.

Celerino Torres, CISO, Texas Attorney General's Office [00:07:32]:
I digress. The thing is, the team at working at OEG, it was very different because we have different people. We have plenty of doctorates that are attorneys. Then we have child support people that are always constantly being harassed by noncustodial parents, like, where's my money? Why you want my paycheck? And then things of that sort. And then we got people internally that say, hey, I'm a government worker. Nobody's taking advantage of me. I get no guidance, things of that sort. And I came in and turned it around to the point where the human aspect, we started having fun.

Celerino Torres, CISO, Texas Attorney General's Office [00:08:08]:
First thing I did was do a Myers Briggs analysis, and there I started understanding how they were interact with each other. And the right at that time was a movie called Maverick, I guess Top Gun. So I started calling everybody by their call names. So we got guys that, his name is Curly, got guys named the brain. I'm called something else. You said this was g rated, right? So I can't call it, can't say it, right. But the fact is, that's what I was going. It just started that brotherhood camaraderie, and then all of a sudden, people started reaching out, because it's kind of scary when the security guys call you and say, oh, no, what do you want? And they don't want to share information, and they don't want to tell you anything.

Celerino Torres, CISO, Texas Attorney General's Office [00:08:47]:
Now when we call, they're like, hey, how's it going? Hey, how about the rockets? Go. Coughs right? It's just a whole new thing on the security aspect, and that's what makes it work together, because she drives it as far as the production and all the different things of toys that we need to get to be a better state and get to our constituents, their information faster, and I just have to secure it. On the other hand, I have the easy job. I would think she thinks I have the harder job. But both of us can go to jail together. We don't get the job done right.

Joe Toste [00:09:19]:
Hopefully, no one's going to jail today or in the future. So this is the key to hiring great people. So again, we're going to beat this drum all day today. But, shauna, we've spoken about how hiring great people and working with the fantastic business partners is the start of building a great team. And culture. How do you communicate the culture you want at OAG internally? To make sure everyone is aligned and focused on the mission of serving the public first. And I'm going to add, despite OAG might have a one star rating. Right.

Joe Toste [00:09:49]:
Or whatever it is on Google for.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:09:51]:
People to rate you whenever you're taking money out of their pages.

Joe Toste [00:09:54]:
You take money. One star. Yeah.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:09:56]:
No one is, oh, I can't wait to talk to the Texas attorney general's office. I mean, normally, if they're talking to us, it's not something that the. Yeah. So what I would say from a culture perspective is we work for a fantastic CIO named Tina McLeod. She's a technologist through and through. Absolutely adore her as a person. She's a fantastic person. I've learned so much working for her.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:10:18]:
I honestly feel like I've become a better person working in state government than what I was working in the private sector. And I've learned a lot around the human centered approach as far as staffing and leadership. But for us, it really is about working with the teams hands on. Right. And so it's not just that you're telling somebody, hey, I want to go in this direction, or I would like to build this, but it's really diving into, if I don't understand the technology and if I don't know what I'm asking them to do and how hard it is to implement, then I need to go and figure that out myself so I can have more empathy towards, oh, we're not going to hit this deliverable this spring. Right. And so as a leadership team, I would say we're all very focused on understanding what it takes to actually implement what we're asking for. And that comes from the CIO down.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:11:01]:
Right. There have been many times that we go to explain something and sell and I are whiteboarding something out. Tina's just send me the book and I'll read it. Right. But she really actually will read the book and then come back, and then we come up with a plan together on how are we going to implement this and how are we going to get the staff motivated to do the work. So for us, we feel like we are in service of our employees. We're here to support them. We're here to make them successful.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:11:24]:
It is not a command and control environment at all. We work for our staff, and I think to me, that's probably the most important thing that's made us very successful in building modern technologies in state government.

Joe Toste [00:11:36]:
So could you just maybe talk about that training piece for the staff underneath? We're going to hear later today from Tim Roemer, and he's got this great line where humans are the weakest link in the cybersecurity chain. Just maybe just talk about how you think about training in, specifically in OAG for your team.

Celerino Torres, CISO, Texas Attorney General's Office [00:11:54]:
Oh, absolutely. Well, I will definitely tune in what you said. Tina McLeod has actually given such a wide, broad aspect of control for us, to guide us and really navigate this sea of unknowns, because human behavior is so hard to control. And I remember one time we were actually sitting down and we were talking about asymmetrical and symmetrical encryption, and the mentions, well, I know what you're talking about. Well, do you know about homomorphic encryption? And she goes, that's not. She went to go find out and she goes, this is interesting about homomorphic. She's on it. She really wants to know.

Celerino Torres, CISO, Texas Attorney General's Office [00:12:38]:
But as far as learning, in my team, I do the ABC type of thing. I know it's an Alphabet thing, but it's awareness, behavior and culture. Learned that from Perry Carpenter. And it starts with making them aware. But just because they're aware doesn't mean they're going to care. Just period. Phishing as an example. We have phishing campaigns, and we were doing the quarterly, and we weren't getting the needed things from it, so we made a game thing out of it.

Celerino Torres, CISO, Texas Attorney General's Office [00:13:05]:
People love to play games. Gamification is awesome. Paulo Alto taught me that back ten years ago, where people just want to play. Look, you're gamifying the final four here, right? The whole presentation here is a gamification of fat.

Joe Toste [00:13:21]:
So don't tell them the Secret, don't.

Celerino Torres, CISO, Texas Attorney General's Office [00:13:23]:
Tell them cat's out the bags. So the awareness aspect comes into play. Then you make it a gamification. Then on the behavior pattern, you start showcasing to them. Hey, great job. When they reported on outlook that we had this fish, they get an email, they get a call from me, let's go have a cup of coffee with the seesaw. Some people want it, some don't, but they like it. And finally, at the end, culture comes into play, even from the very high end.

Celerino Torres, CISO, Texas Attorney General's Office [00:13:53]:
We have on the CSD side, Ruth Ann Thornton. She comes down and says, you know something? I got the phishing campaign and I passed it, and it just infects everybody else. And all of a sudden, everybody's just happy that they passed the campaign. So that's one where we gamify it, we make it fun, and everybody has a good time. It's kind of odd, right? Fishing and having a good time don't mix. But that culture change has been changing a lot just from that perspective. So, yeah, gamification is really this key.

Joe Toste [00:14:27]:
Yeah. I think the layer underneath that is, like, how can you either exude or just transfer that energy so people get excited about it? I think there's some funny ways that you can do that in cybersecurity. When Tim came on, I think it was in Phoenix we were talking about. It was, like, someone with swedish fish and bitcoin and all this other bitcoin chocolate candies and all this stuff where. And trying to test out other people, and he's, dude, you're probably butchering this right now. Let me just tell the story later. But just trying to transfer that energy and fun and enthusiasm is something that is maybe as mundane as a phishing.

Celerino Torres, CISO, Texas Attorney General's Office [00:15:00]:
Campaign can be and something you bring up. Since I started in August of 21 and I had to break the ice, they were saying, who's this guy? What does he do? I came on October with a campaign called I made it up, but it's called Rocktoberfest because it was October Cybersecurity Month. Then the rocktober or the music hall of Fame or the Rock and Roll hall of Fame was having their campaign on October. And finally, I was the new kid. We had something called coffee Clash, remember? And that coffee Clash was we as CIOs and the directors, we showcased a little bit of ourselves. When was it going to talk? I have a dog. I have a wife. I have two kids.

Celerino Torres, CISO, Texas Attorney General's Office [00:15:43]:
My kids are already big. So I spun it around and asking all the directors, give me your top music list of all rock and roll. And I came in with my altered ego with a wig that looked like Howard Stern mexican style slash type of thing, and published it on teams. And people were coming to the coffee clash wondering, Howard Stern? Who paid for Howard Stern? Wow. And I'm just like, all right. And the background was music, and it got everybody going. Everybody was cool, I would say. And the next one I was playing on the tape turntable, just everybody's different songs.

Celerino Torres, CISO, Texas Attorney General's Office [00:16:20]:
They liked it so much that we had a second annual Rocktober fest the next following October. And now it's something that's become cultural driven, that they want to invest, to know. They want to give me their playlist. It's just driving the culture that just started being a clown, and it played out and people just want to be part of.

Joe Toste [00:16:42]:
This is the second live podcast where someone's talked about, they put a wig on, we give it really fun. And I love this because a lot of times when you kind of walk into your team or you walk in a locker room and especially with kids, they just stare at you. You think it's awkward. It's not awkward when I look at adults and even though you'll kind of stare at me, but kids are like, and you're trying so hard to build the culture and the energy and in the locker room and it's still. And then after four years, they're like, they're crying. You're like, I didn't even know you paid attention. It was incredible.

Celerino Torres, CISO, Texas Attorney General's Office [00:17:17]:
Right?

Joe Toste [00:17:19]:
But keeping, I love the rocktober fest and Keanu, keeping that tradition up and yeah, it builds the trust in order for them, for the folks on your team to hear about actually kind of what you're trying to communicate. So I really like that. Sean, over the last 18 months, you've learned how to build and implement AI platforms. The team builds self service data, intelligence and chat platforms. You focused on modernizing and automating foundational it capabilities, but now it's time for more. And you have several projects in flight right now that support the service evolution of providing a more streamlined and modern employee workspace environment. Talk about those projects and kind of what you would like to see in the next 18 months.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:18:02]:
Yeah, so we've done really well the last 18 months. We started off three years ago with building out a reference architecture and core services in the agency, building foundational things like a CMDB that's not fun or sexy or nobody really wants to talk about, but it's really necessary. And then we moved into getting analytics on modern platforms and actually knowing what data we have off of the mainframe and being able to make them consumable and building real time analytics to understand customer engagement of what people are calling us for, what people are coming in on chat for, what people are hitting our websites for. So now we're into the service evolution and we've been babystepping into moving a little bit past insight generation for machine learning and actually looking at predictive analytics and retooling our engagement platform so that we have more automation to relieve some of the influx of emails and calls into our contact center and provide more proactive engagement to our citizen base. So we're really excited to see what's to come. We're going to start doing some experimentation with all of our external services and see what the world has to offer from an employee digital services perspective. We're very focused on moving away from standardized applications and having more personalized services on an employee desktop. So let's say every day you have a Persona as a manager of the contact center, and you go into log into your laptop and you see the metrics that are important to you.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:19:24]:
And it doesn't matter if those metrics on ten different platforms, they're in a unified portal. You can search and see what other metrics you want to in a chat service, and so you're not having to log into multiple disparate systems any longer. If you want to look and see if your employees checked in for the day, you have that in a unified portal. Right. So really personalizing and helping each person who works for the agency have the information that they need at their fingertips to do their job and to do their best. We do have an issue with staffing also for our agency, especially on the business side, for child support. I know that we try really hard to get people to come and work for the agency as child support officers. So we need to do the best that we can to try to support the people that we do have to be as efficient as possible on the jobs that they have.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:20:08]:
Because of that reason.

Celerino Torres, CISO, Texas Attorney General's Office [00:20:11]:
It is a tough thing, especially getting there. Now, just to add a little bit of more humor, can we gamify that? No, it's just, I go with what you're saying. It's kind of hard, especially on the child support side, because it's not a fun game, it's not a fun job for most of those folks. And the thing that's made my team grow is I won't call him out by name, but he comes to work with the notion of, I work for the state of Texas, and I'm here very proudly to maintain this movement. And he's on a mission, and everybody has a mission in my team, and it just drives it more. It can become mundane, it can become boring, but we gamify it. We go bowling, we go smash stuff. And when they're really stressed during this audit, it was two weeks of just high pressure.

Celerino Torres, CISO, Texas Attorney General's Office [00:21:01]:
Everybody was struggling, and they came out and I told them all just take off, and they really respond, but they own it. It just has to be extreme ownership on your side. Shauna, you have the drive of your teams to design, develop, and just go at full light speed. And I'm trying to catch up with you. I really am. I have all these because we no longer have perimeter based networks and things of that sort. It's all zero trust type of environments and cloud, it's hard to keep up.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:21:32]:
It's a stretch for staffing and skills, I think, in the security side, because we do architect things so quickly and we implement very fast every time we invest in a new technology, it's a.

Celerino Torres, CISO, Texas Attorney General's Office [00:21:43]:
Stretch to learn it as fast as possible.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:21:45]:
Right, for your team?

Celerino Torres, CISO, Texas Attorney General's Office [00:21:46]:
Yeah, it does. But we're there.

Joe Toste [00:21:49]:
I love it. So let's continue on the theme of AI and ML. So both for the customers and for the internal stakeholders in this beautiful abstract that you sent me over, which is great as a productivity tip. So everyone who comes on podcasts, I've got this one massive database of stuff in my Evernote. So anytime it's like I want to research anything, it's like I now I'm surfacing all this information, right? Whether it's AI cloud, I just type in Shauna Houston. And everything's coming up, right? And I'm like, cybersecurity, what do we have today? I type in cybersecurity, right? And as I'm prepping for Chris Mitchell's questions, I'm like, cybersecurity? What can I ask him that makes me sound smart? And so Shauna provided me this abstract, which I put into Evernote, and it was absolutely fantastic.

Celerino Torres, CISO, Texas Attorney General's Office [00:22:33]:
It's perfect.

Joe Toste [00:22:33]:
So I'm, like, looking over as I'm prepping for this. So, anyways, can you talk about the. Welcome to the live podcast. Can you talk about how providing meaningful data to employees and managers in near real time is helping oag stand out with its stakeholders as one of Texas's finest agencies?

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:22:52]:
Yeah. No, absolutely. I'm going to go back to customer engagement first, because that's the thing that we actually have done, and that's in production that we're using today. So, for instance, we have 286 people in our contact centers, three contact centers across the state of Texas specifically for child support. And so at any given time, anytime that there is an emergency in the state, again, anytime that there's an issue, or let's say right now, we know that we're going into tax season. And for those of you who are not aware, if somebody has not made child support payments on time or if they're behind on their child support, we will take money out their income tax return. So you could imagine we get an influx of calls during tax season where it's, you took my money. Where's my money? Why didn't I get my money? How can I get my money back? Right? And so being able to have the analytics and information to actually measure and understand what channel of engagement that we need to proactively communicate with our customers on so that we can kind of nudge them towards the right channel based off of current call volumes or chat volumes, is really important for us.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:23:51]:
So that's one use case where things are going to evolve going into the next biennium, which I'm really excited about is really more in the criminal Investigations unit area once we get off of the mainframe for the administrative and legal side and get our new case management solution online this year to where we can really look at technology and how it supports things like human trafficking across the state of Texas. Right. Or online child predatory practices. So that's the stuff that I'm super excited to be able to get more into the legal area also with machine learning and being able to really share data with other local and state and federal agencies so that we can do something that's more protective for the citizens than just servicing child support. Not that feeding families is not a minor thing, because it's also very major, but I think that there's a lot we can also do with technology to really protect our citizens as well.

Joe Toste [00:24:44]:
Yeah, I know that's a lot of really high impact work. And at the commodore, we were talking about how basically I grew up on child support payments, but there was, I think, I don't know if there was a mainframe or how they were doing it back then. This is like 1990 something. Early 19. Yes.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:24:58]:
1990. Man, that's really old.

Joe Toste [00:25:00]:
Yeah, right?

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:25:01]:
They might have sent, like, smoke signals, I'm not sure, in the 90s.

Joe Toste [00:25:05]:
Anyway, what's the cloud? It's really funny. Okay, so let's jump to data governance. There was some other stuff that was really good, but I know there are folks who want to get to the q and A, but I am super curious how you think about today's environment of protecting agency data through policy and education in the world of AI platforms like Chat GPT. We had Chat GPT-3 not that long ago, and now we're on four. Right. And I use it all the time, by the way, and I love it for my own kind of personal stuff. But how are you addressing the governance side of that?

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:25:37]:
Yeah, so we started on data governance two years ago, and there is a legislative mandate in the state of Texas to tag and classify all the data that you have within a state agency where it's regulated. And we have a lot of regulated data in the state. So we started down this journey a couple of years ago, and I feel like we're probably in a pretty good position as far as modern technology. We are having to revamp our security control policies in this space because what we're finding is a state agency, our security control policies are very much centered around, back in the day, whenever we used to compile applications and load them on a desktop. And so we didn't authorize your technology, basically, and we don't control it, then we don't approve you using it. Well, that's not going to work, right. The fact of the matter is, 90% of our applications are web based. You can't keep someone from going to a website.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:26:27]:
You can't possibly block every single technology that's modern today, nor do you really want to. So for me, it's more about updating those legacy policies to actually be of use and then really educating people on what information they can or can't share. Because I can say even within the IT organization and even within the leaders in the IT organization, look, this is really cool. I did this and that with chat, GPT. We're all excited about all the new technology that's out there and how we can use it to even help us become better at our jobs. So we want to educate how to use people, how to use things safely. I don't think that we want to really stagegate people, and I think things like security services like CASB are going to be critical to upgrade and modernize in the next six months or so.

Celerino Torres, CISO, Texas Attorney General's Office [00:27:09]:
Yeah, it'd definitely be because it's about classification, because we have a lot of regulations to go by. We have IRS, HIPAA sieges, and based on the release of the CUI, the control, so many acronyms, right, the CUI data set, we follow sieges patterns and the IRS patterns in order to go into the AI aspect and put policy in play. But it's so tough that it's a great thing that we have set up a governing body, that we all have. The different departments work out together of what they want and what can be done and what should be done can't be done. So it works out well even from physical, because we didn't even think about physical at one time. And now we have records management. Every different philosophy has a different pattern. IRS is seven years siege, just is one year.

Celerino Torres, CISO, Texas Attorney General's Office [00:28:00]:
And there's paper and there's digital, and there's, wow, it just can be overwhelming for so many people, especially in the government space, because they're so used to just one paradigm of methodology, of control. Now we have that flow be all encompassing because it's going out to a SaaS instead of it being a cots on desktop.

Joe Toste [00:28:22]:
That's great. And so last year at the commodore, Mark K. I know Mark's in here somewhere, right? Is he still here? Oh, yeah. There you are. See, it's kind of hard because lights are leaning down and so you look out. I know I listen back to anyone who was coming on stage. You've been on the podcast before. I listen back to all of their podcasts, which you can kind of do on a walk.

Joe Toste [00:28:42]:
Right. So I'm listening through, I'm thinking I want to see. And so I get to the audience. Q A and the reason why I'm pointing out Mark is you asked a question last year. It was a good question, don't worry. And he's like looking at me like, what did I ask? Wait, that's on camera? Yes, sir. So you said with the passing of SB 475, what are some of the projects and data governance that you are most excited about? So I was thinking about, we're almost a year, maybe it was like eleven months ago. What's changed in almost a year from the Commodore?

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:29:13]:
Yeah, I mean, a lot has changed in the year. So I feel like we've done two years worth of work or three years of work the last twelve months, honestly, looking at everything that's happened from last year to this year. But the technology, the service evolution of technology is just moving at light speed. Right. So again, we can't slow down our users. We can educate our users and we can control what information or what data that we're sharing on these other platforms or technologies, whether we've invested in them and they're secure or not, we can't show down the evolution of technology. And I think the last twelve months have been major as far as service evolution and some of the new technologies that are coming out that are artificial intelligence based. So again, for us, I think getting ahead of that as much as we can and figuring out a game plan, because it's just the start.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:30:01]:
Like, I think in another twelve months, if we come back together, it's going to look completely different. Does today. Things are moving so fast, and even on the implementation that we've done with some of our partners, like Mark, with modern data platforms, their platforms have changed drastically in the last twelve months. All the new services and capabilities and features that are offered are completely different now than what they were whenever we initially started down our modernization journey. So there's just a lot of work to be done. It's hard to keep up. You read every day just like you do. Like, I do my research, but it's hard to keep up with all the changes that are happening as fast as technology is moving now.

Joe Toste [00:30:37]:
And I'm not, like, sponsored by Snowflake or anything, but the CEO of Snowflake wrote a book called amp it up. And it was like, this is like my jam, right? I love Mike. I love this. We're going to amp things up. So I actually bring some of these books to the high schoolers, and they're so funny. Yeah. Tech tables. Yeah.

Joe Toste [00:30:53]:
Amp it up. Yeah. Go team. Right? It's pretty funny.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:30:57]:
So are you cool or are you not cool? That's the question. Because my kids do not think I'm cool at all. I'm just curious to know. I was told again last night, mom, I love you, but you're not cool. Right?

Joe Toste [00:31:10]:
So I mean this in the utmost humility, please, no one take this. I am very cool.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:31:15]:
Maybe you can give me some pointers.

Joe Toste [00:31:17]:
On how to be going to have unfair advantage. No one take this out. People are like, joe's got the biggest ego. No. The reason why I say that is. So I married a woman who has a daughter named Annabelle. So I count her as my daughter. She's 13, and she was five at the time, so now she's 13.

Joe Toste [00:31:36]:
So she's in 8th grade, and her entire class, they come to DP high school. And when you go to DP at a public campus, and Felipe goes to a lot of high school campuses, too. But when you're a coach at a high school campus, especially a large high school, you are popular. When you're on the court side, you stand out. It's just what it is. And so that's, I think, kind of one of the reasons why I would say I'm pretty cool. Oh, yeah. Hands down.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:32:08]:
Oh, well, then you're definitely cool, because 13 year old girls don't like hardly anyone.

Joe Toste [00:32:12]:
Yeah. Jamie, do you want to come in here? She's not even here right now, but she can't even hear if you get.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:32:15]:
An approval by a 13 year old girl.

Joe Toste [00:32:17]:
Yeah. So the 13 year old. Yeah. Great approval. I know. See, this is the human part. But you talk about building. We build family culture.

Joe Toste [00:32:24]:
So we'll go out. I'll take her. She loves movies, so we go to the movie theater. She likes to play video games. Like, every 13 year old has something different friend that they. Right.

Celerino Torres, CISO, Texas Attorney General's Office [00:32:31]:
So.

Joe Toste [00:32:31]:
But one of the things that we love to do is the whole family comes to the game. Right. And so when you have a giant crowd and especially, like, we play, especially rivalry games, Santa Barbara is a high school San Marcus. It's like very heavy, and the energy is on, right. Like the moment is on. And some of you are like, I haven't been in a gym in so long, right. But if you go into a high school gym, it's not really that big. Most of them aren't that big.

Joe Toste [00:32:55]:
And the energy is intense and you're trying to keep the team focused because some of them can get really nervous. Right. When the lights are on and it's like an official league game. And not this year, but last year we had a deep state playoff run. That's awesome. Anyways, that was a long winded answer, too. Yeah, I think I'm pretty. And I host a podcast.

Joe Toste [00:33:15]:
Right. And it's so. All right on audience. Q A. Meg from Accenture.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:33:23]:
Meg hare from Accenture. So, Shauna, you talked a lot about emerging technologies, AI ML. I think Texas is already, like, leading the nation as far as child support recuperation, right? I think so. Right. Are we still neck and neck with California? But number one. So when you look across all of these emerging technologies, where do you see the biggest impact for the mission of the OAG? How are these emerging technologies going to make an impact on recuperating funds for those children who need them? Yeah. So we're now moving into a space where we're actually implementing predictive analytics to understand what the probability of collecting collections for a child support case actually looks like. And so instead of us spending all of our time and effort chasing after someone, that we might not have a decent probability of collecting child support, we're looking to focus more energy and time and resources on making sure that we're focused on collecting payments from people that actually have the ability to pay kind of first.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:34:24]:
So it doesn't mean that we would change everything that we're doing. It just means that where we have a higher probability for payment, that we would be able to prioritize collecting in that space. So that would be one of the use cases. But there are many use cases now that we actually know what data we have, and we've been filling in the blanks with our data over the last 18 months. Pretty much in every business aspect, there are use cases where predictive analytics can actually help us meet the mission of the agency. So, yeah, I'm really excited about the next year and a half and what we're going to be able to accomplish.

Darrell Tompkins, CIO, Texas Water Development Board [00:34:58]:
Daryl Tompkins CIO with the Texas Water Development Board. Kind of a similar question a little bit, but it sounds like you guys obviously have an AI footprint established that is providing benefit to you. And obviously that is the buzzword. You can't look or talk to somebody without talking about AI. But the thing that I hear a lot in the groups that I affiliate with and colleagues that I talk to is how do I start? By finding a practical use for this technology that is going to give me value. And I'm just like, what approaches did you all take to that? Did you consult with people? Was it just internal? Just curious about that.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:35:36]:
Yeah, I mean, kind of a new approach to working with our business partners, to bringing them along and getting buy in is more around experimentation before we even make an investment. Right. For instance, if we're looking at a new customer engagement platform, let's say we wanted to look at something around chat, for instance, right? And this is all hypothetical, but we would start off in the lab by looking and defining success criteria and goals with our business partners. And then we would install multiple technologies and actually test out our major and our prioritized success criteria and showcase the technology with our business and say, hey, this is what we're thinking. This is what we learned. Let me demonstrate what the technology can or can't do. This is what we think we could do for the agency long term, and then bring them kind of along the way of making those decisions and making sure that they are a major stakeholder and they really are the decision makers and what we invest in and what it looks like. It's hard for us to draw the use cases out sometimes.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:36:33]:
So sometimes we don't know what we need to know without doing discovery. So we really take a lot of time and focus on understanding the business, doing the solutions architecture with the business, defining success criteria with the business, again, making sure that we have those goals around what success looks like, documented and agreed to, going into something. But what I'm finding is experimentation is really important to make an investment with newer technologies because people are scared. Otherwise they're like, I don't know what you're saying. I mean, I get a lot of this, right? I'm going to read a book on this, but I have no idea what you're talking about. Right. But if you can show them, and if you can show them even other use cases with technology that you've installed in a lab environment and how it could be meaningful to them, a lot of times our business partners are so smart and they work so hard that they just start firing off ideas. Right.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:37:21]:
But it's just that opportunity, giving them that opportunity to see it.

Celerino Torres, CISO, Texas Attorney General's Office [00:37:25]:
And it does help to add value on that one, is that you got to have a partner and gamify it again, but make it a good story. The use case has to be iron core and it has to be flexible because if it's not flexible, then they start feeling like it's too rigid. It's going to fail. No, it's going to have to be gel and it forms.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:37:44]:
And I would say don't be scared.

Joe Toste [00:37:45]:
To fail because we fail forward.

Chris Humphries, Founder, The Anfield Group [00:37:47]:
So it's a two parter. I want to ask Sean a question first and then sell chime in as well. Sean, you mentioned data sharing with external partners, so how do you envision that impacting the mission outcome, whether that's in child support collections or you also mentioned human trafficking as well. So there's a lot of data sharing.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:38:04]:
There just for child support alone. We share and exchange information with more than 27 other state and local federal entities. Right? Man, I am not a fan of ETL and I would love to get into an API data strategy or platform sharing so that way we can do things more real time. Because what I find is that lag in how we share information because the technology and approach is so legacy as legacy as our mainframe green screen natural database system, that we're missing opportunities to do something more and something bigger. So for me it's like how do I get buy in with other agencies over the next two or three years to just consider not sftping things and publishing APIs and using more modern technology stacks. Because if we could actually get in a position where we really, we already share the data today, it's not like I'm asking you to share information that you're not sharing, but just doing it more fluently. I think that we would all be in a better space long term for modernization.

Celerino Torres, CISO, Texas Attorney General's Office [00:39:03]:
This is where she probably will smack me because she doesn't like me in that regard. We set up real stringent policies, like for example, API key rotation. We make sure that they are in adherence. We are implementing a PAm strategy relatively soon. It's been in process for a while, just so we can have privileged access management, therefore trying to pursue an environment of passwordless criteria so the people don't have access that don't know their. So it's tough, but we're getting there and it's just really, we work kind of like partners in crime. She tells me, hey, I think we have an issue here and we go sit down, we whiteboard it like she mentioned, and we come back out. Then we storm upstairs to Tina's office, she goes, let's sit down guys.

Celerino Torres, CISO, Texas Attorney General's Office [00:39:49]:
This is what we're going to talk about. And we hash it out and we come up with a solution and it actually works. When you can work together like this, things really flow well.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:39:58]:
He keeps me honest.

Celerino Torres, CISO, Texas Attorney General's Office [00:40:00]:
Yeah, I do.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:40:02]:
That's his job, right?

Chris Humphries, Founder, The Anfield Group [00:40:03]:
So I'm Chris Humphries with the Anfield group. Colonel Winnick and I are on the state cyber council there in Austin. One thing I constantly see with state agencies or I deal with utilities a lot, Munis, co ops and people like that. Do you guys have a holistic requirements collection component across other business units where you're not duplicating tools? Because I see that a lot of times where every own so siloed off that you've got four tools, different tools for like file integrity monitoring, and yet they're complaining they don't have the budget to get the tools they need. Do you guys see that a lot?

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:40:33]:
Yeah, I mean that was one of the things I did coming in is we didn't have a reference architecture. And so whenever you go back to good core fundamental solutions architecture and enterprise architecture was we had huge gaps in our reference architecture. We had duplicity of tools, very expensive tools supporting legacy environments. And then we were missing core fundamental features of a solid foundation for a technology organization. Whenever cell came in, I think we had already started looking at a security reference architecture. And again there were some very large gaps in our security reference architecture again. So we're still going through the maturity. I would say the pendulum was far right.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:41:13]:
And then we bought a number of tools and we went far left. And I'd say over the next two years we'll come back center and we're starting to remove tools where we have redundancy or there's new services and we'll start decommissioning those tools that we actually don't need. But we were so far behind in having things like fundamental monitoring and CMDB, inventory management and all these things that you really need to have a good security foundation. We were missing those things starting off. So we spent a lot of time on incident management and change management and all the things that nobody likes because they're not cool and sexy, right? We started off tackling that the first twelve months that I was at the agency.

Celerino Torres, CISO, Texas Attorney General's Office [00:41:50]:
Absolutely. We would have in certain situations over auditing of information, so many different sims. It's just kind of crazy. We cleaned up house to that same sort of vein.

Chris Humphries, Founder, The Anfield Group [00:42:03]:
Your security architecture, how does regulatory compliance dictate that? Do you guys find that you're driving that, making sure it checks the boxes for everything you do? Or is it an afterthought, or is it obviously, as a former regulator, I tell people, if you're secure, you should be compliant, but if you're compliant, you're not secure. How do you balance that as you go as well, and look at that as risk in your architecture also?

Celerino Torres, CISO, Texas Attorney General's Office [00:42:28]:
Sure, my mantra, and my team knows it very well, is we go by the spirit of the law, by the word of the law, so we surpass, even, say, IRS specs or any of the sieges specs. Oh, yeah, I'll say it clearly. We had a password change requirement policy and the IRS had one specification and the sieges had another one. So we went with even our own, which was surpassing both well and to.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:42:57]:
Kind of answer your question. So security is fundamentally built into every solution that we architect, and it's in every core architecture stack. So whenever you look at DevOps as a whole, it's not just DevOps, it's Devsecops. Whenever we move into machine learning operations, security is the foundation for machine learning operations. Right. And you can't secure anything. What's missed level one, a CMDB. Right.

Shauna Rogers, Chief Digital & Data Officer, Texas Attorney General's Office [00:43:20]:
So it is really building and looking at those core services as a really solid foundation for the agency and just making sure that he's on my change management, he's on our incident management, he's on every solution that my team comes up with, like security is part of the entire service evolution of everything that we do.

Joe Toste [00:43:38]:
That's great. Well, we're going to wrap up this podcast. Thank you, Shawna and cell for coming on. I really appreciate it.

Celerino Torres, CISO, Texas Attorney General's Office [00:43:44]:
Thank you for having me.

Joe Toste [00:43:45]:
Hey, what's up, everybody?

Joe Toste [00:43:46]:
This is Joe toste from techtables.com and you're listening to the public sector show by techtables. This podcast features human centric stories from public sector, cios, cisos, and technology leaders across federal, state, city, county and higher education. You'll gain valuable insights into current issues and challenges faced by top leaders through interviews, speaking engagements, live podcast tour events. We offer you a behind the mic look at the opportunities top leaders are seeing today. And to make sure you never miss an episode, head over to Spotify and Apple podcasts. Hit that follow button and leave a quick rating. Just tap the number of stars that you think this show deserves.