Rich Baich, who was appointed CISO at AT&T in April, continues to advance the company's cybersecurity narrative — network-embedded security. The carrier claims its recent announcement of the creation of a standalone managed cybersecurity services business is another step toward that vision.

Baich has a wealth of experience as a former CISO for the Central Intelligence Agency (CIA), AIG and Wells Fargo. But in this new role, he is not just focusing on securing and protecting data systems within the enterprise but is also working with product development teams to integrate security into AT&T's network.

“I'd say that would be the biggest differentiator is working on behalf of advancing the products or integrating security into the AT&T network,” Baich told SDxCentral. “And unlike most companies, the network is the business model for AT&T.”

He also brings a unique perspective on risk management to AT&T. “We need to be the first to know about things. We need to be able to filter through the noise, get to the most appropriate things. It needs to be as close to real time as possible,” he said. “And then use it: How do we get that information to the right leaders and risk leaders in the organization, so we can make the best risk-based decision based on the kind of cyber ecosystem or information that we're presenting?”

The tier-one operator detects and monitors an average of 180 billion security probes across its network each day as bad actors and others search for cyber vulnerabilities.

Baich's priorities as CISO reflect these threats and the evolving cyberthreat landscape. He emphasizes the importance of operational excellence, which includes leveraging artificial intelligence (AI) and automation to validate that the security basics are being actively practiced. Meanwhile, investing in emerging technologies like AI and future capabilities is also key.

AT&T recognizes the growing security needs and a higher level of assurance from its customers, particularly those in the small and medium business sector who may need more resources and expertise to manage complex cybersecurity solutions effectively.

“We believe there's an opportunity that we can make it very simple and easy for them. So for example, we might say, 'AT&T recommends this security posture. But if you want more, you can go in here and you can click these things to give you even more security,'” Baich said.

The goal is to prevent either malicious or inappropriate traffic as much as possible, which will allow customers to deal with less traffic and help them look for “potential needles in the haystack” with their existing perimeter or endpoint security tools, he added.

“Since we're very, very first contact, we feel we have an opportunity to provide some additional security opportunities that ultimately will help our customers have much more defense in depth, but also less traffic to look through to find out or prevent any type of malicious activity from occurring,” Baich said.

Continuing to focus on the enhancement of its network-based security capabilities and managed services, AT&T last week announced an agreement to create a standalone managed cybersecurity services business and a capital investment from Chicago-based investor WillJam Ventures.

AT&T will retain an ownership stake and board representation in the new entity as a global managed security service provider.

“Our direct focus remains on unlocking the power of our best-in-class connectivity with embedded security features that will allow our network to intelligently protect customers end-to-end,” Rick Welday, head of AT&T enterprise markets, said in a statement. “We’re energized about this new business model and the opportunities and capabilities these network enhancements will bring to the market.”