Aflac Incorporated (AFL) Earnings Call Transcript

Good day, and thanks for joining. I'm Bob Bragdon, Senior Vice President and Worldwide Managing Director of CSO. Organizations of all shapes and sizes have unique stories of resilience to tell about their experience as responding to the pandemic. Lessons have reach beyond just pandemic response and speak to the resiliency of their organizations. Today, we're speaking with Tim Callahan, the Senior Vice President and Chief Information Security Officer of Aflac. Aflac, a Fortune 500 company, which operates in the United States and Japan, provides financial protection to more than 50 million people worldwide. Tim is a major force in the CISO community, and I'm pleased to be speaking with him today. Tim, welcome, and thanks for sitting down with us.

Thank you, Bob. Glad to be here.

So tell us about your role at Aflac and a little bit about the organization itself.

Yes. So we -- in 2016, we established a global security organization. Prior to that, we had security embedded in each of the business lines. But through the various industry studies and internal studies, we determined that we needed to take a more global approach to securing our environment. And while you think of Aflac in Japan and Aflac in U.S., we still have several subsidiaries as well. And so we wanted to bring that together in a common framework. We -- so I've got, kind of, the expanse of traditional information security, but as well as things like information governance, and we certainly have BC and business resiliency and recovery as part of our organization. We have a cybercrime prevention team. We have the traditional security ops, but really have put a lot of emphasis in our threat intelligence program, which comes under our Director for Security Operations and then identity access management. We have -- also we run a PMO, a global security PMO. We have recently, in fact, in January, actually announced information security service that we offer to our independent agents. And we've got a Director for that. We've established a separate legal entity to be able to offer that. And then we've recently also opened up a cybersecurity innovation center in Belfast, and that's operating. So that's kind of the expanse of the organization.

No small task. So what was Aflac's COVID-19 experience?

Yes. So we actually -- there are several things that kind of influence that. One thing back in 2017, we restructured our whole crisis management program, crisis management team. We lead that primarily through our business resiliency program. And we adopted a model, the work anywhere model, which we didn't coin the phrase. We use it a lot. But prior to that, again, we were very kind of focused within our different business lines with our programs. So as we globalize the program, we adopted, like I said, all hazards planning approach. And that's -- it's interesting. I don't know if you may recall in circa 2012, 2011 around in there, the CDC came out with the zombie apocalypse plan.

Great.

And that caught a lot of attention. But what they were trying to emphasize is, well, if you can plan for the zombie apocalypse, you can kind of plan for anything. And so -- and they were using that as an education point for an all hazards approach. So we adopted that, certainly had a pandemic plan. And then we had a program where we exercised our global crisis management program a couple of times a year, but definitely once a year with the executive team, where we all got together as the executives across the whole company and then went through tabletop exercises. So the combination of those things, also the fact that we did have a presence in Japan and got some pretty early warnings from that, our executive team even before a pandemic or a crisis, we actually established a pandemic task force to start refreshing the plan, walking through, talking about it, having conversations. And so when we had walked through a stage-down approach if we needed to work from anywhere, work from home. And so as we kind of walk through that and then we were very well prepared when the different states where we operate started declaring the shelf-in-place models. We were able to get our employees out the door pretty rapidly. We made the decision as part of our 2017 plan to devours ourselves somewhat from a traditional disaster recovery trailer kind of thing to, like I said, the work anywhere model. And so we invested in the security technology and the remote work technology to be able to do that. And has...

So it wasn't the model like some businesses head where they go. If we were to take -- pick up our workforce and put them in another office because we had to evacuate a building. Yours was all in.

It was. And we've been -- as we said, we canceled our contingency trailers, we did go through a step of saying, okay, what facilities could we double up on -- and just they're all part of the plan. But the key to it was we were not bound by a facility. We have the connectivity. Even to the point, we've gone through scenarios. Well, if we had to, we'll go contract a hotel or a conference center or whatever. So it gave us a lot more flexibility in that model and that proved to be very beneficial in this case.

That's great. What have been some of the challenges you've encountered as a result of the pandemic?

Yes. So we've not had major challenges, we've been very fortunate on that. But in the early days, getting people out the door, getting them comfortable. Some of them had never worked from home. So the kind of the calls to the help center, getting them set up and helping them work through that. We do use a multi-factor for all of our remote access. So in some cases, people had not exercised that yet. Most cases, they had, but they hadn't in some cases. So walking through those kind of things. I think the biggest challenge is the HR challenge, I think, of helping people understand to start achieving a little bit more balance. I mean I know and probably you experienced the same thing. You wake up at 6 in the morning. When you traditionally, so you still wake up at 6 in the morning and you get in and instead of having a 1 hour and 1.5 hour commute, you're on the computer. And then especially in our case, in many of my team, especially once we did have the global program, we're doing calls with Japan at night and very early in the morning. And then through the day, our traditional calls. So you can sustain 12-hour days for a while. At some point, your body starts reacting to that. So a lot of that has been those kinds of things, getting people comfortable and making sure that we're paying very much attention to the human aspect. I mean we do have kind of a all hazards, but people first approach to everything we do. And so we want to do that. We have -- we got early intel on some of the activity of the criminal. I thought it was very humorous. In fact, I put a post on LinkedIn one of the famous ransomware groups that early came out and said that during the pandemic, they weren't going to attack anybody, right? And of course, we didn't believe that. But we've got some early intel that certainly, some of the people are going to take advantage of this and we've seen tremendous increase in activity. We've also seen that it seems like a lot more of the criminal element shutting at third parties, going after third parties. I think if you got a bunch of CSOs that met around a table like you often do, Bob. But we would have that conversation about how our third parties are coming a sharp or attacked us.

Yes. Yes, not too surprising. Have your priorities changed compared to what they were maybe at the beginning of the year but before this whole thing started? And your security priorities, I should say.

Yes. The priorities haven't changed. I think we -- we're -- almost we're strong 4-year, almost 5-year into our long-range remediation plan. So we had deployed most of our capabilities, some, we found that we've had to redeploy. And so we have a road map, a global program road map. And we're staying pretty focused on that. What I will say is some of the business priorities have changed. And so we've obviously changed our focus to make. For instance, we were on a pretty aggressive digitization transformation anyway as a company. And we found in this that we needed to accelerate some of that. So especially some of the security engineers, security solutions architects have really had to take a little bit of focus away from what we were doing and move over there. Just to make sure that we're supporting the business and our technology partners.

Yes. We're hearing a lot of that across all industries because that acceleration of digital transformation has just exploded. Has your perception of resiliency changed at all because of the pandemic?

That's an interesting question because we always talk about resiliency in theory. I have -- when I do presentations, I'll often talk about the evolution of security. You can remember way back, when we were primarily, especially in financial service, primarily compliance focused. And then as the threat increased, we said, compliance is good, you have to do that. But it's not always security, so we became security focused. And then we've looked at, well, how do you measure that? And we started talking about maturity models and how that integrates into program. And then we started talking about defensibility, right? So it's how do we talk about the program when something happens and thinking through that. And now it's resiliency, not the others have gone away, right? They're still there. So you overlay resiliency in there. So in theory, we talk a lot about it. And then this, I see as an object lesson in resiliency. So it kind of brings at home, it teaches. Okay. All this conversation we've been having, this is part of resiliency, how do we continue business in less than optimal conditions? And that's really the definition of resiliency. And I see that it's -- as we have the conversations, it's no longer abstract. We can really use this as one example of what we mean by resiliency. And that's been very beneficial.