MYRNA SOTO

TITLE: Senior Vice President and Global Chief Information Security Officer

COMPANY: Comcast Corp.

CAREER HIGHLIGHTS: Prior to joining Comcast, Soto held key information and security roles at MGM Resorts International, American Express, Royal Caribbean Cruise Line, Norwegian Cruise Lines and Kemper Insurance. She holds a bachelor’s degree from Florida International University, a Master of Science degree in Industrial Psychology, and a Master of Business Administration degree from Nova Southeastern University, as well as a Masters Certification in Project Management from George Washington University.

QUOTABLE: “You’re never done. You’re constantly tuning and constantly adding more things that you could protect or monitor or respond to.”

Read More >Celebrating Media's Influential Women: The 'MCN' Wonder Women Class of 2017|Meet 2017's 12 'MCN' Women to Watch|The 'MCN' Wonder Women Online Archive

Myrna Soto has been ensconced in high-level technology and cybersecurity circles for more than 25 years, but her successful career track wasn’t blazed in that direction by design, at least early on.

“The reality is that my interest in technology and security were both a little by accident,” Soto said. “They were not my prescribed educational tracks.”

But those tracks eventually led Soto to where she is today, serving in the important role at Comcast in which she’s not just in charge of protecting Comcast’s cable business, but all facets of the company, including NBCUniversal, Comcast Spectacor and Comcast Platform Services.

The knowledge, expertise and skill set Soto has accumulated during her career have enabled her to serve in leading roles across several different and diverse industries, including financial services, travel, hospitality/gaming and, now, for cable, media and entertainment at Comcast.

Soto’s leadership at Comcast — in her day-to-day role there as well as with other organizations within the company — is a key reason why Multichannel News is recognizing her in this year’s class of Wonder Women.

‘A FANTASTIC LEADER’

“Myrna is highly deserving of this honor,” Michael Cavanagh, senior executive VP and chief financial officer at Comcast, said. “She is a fantastic leader and has made significant contributions to Comcast, the industry, and the information security and technology community.”

Soto joined Comcast in 2009, initially focused on the company’s cable business. Her scope of responsibility has since broadened to include developing and implementing cyber security, network/infrastructure, and data security strategies that span Comcast.

It’s been Soto’s ability and desire to speak up, to learn and to pursue new challenges that have been the hallmarks of a career that didn’t initially focus on technology and security.

Soto’s college education centered on psychology and organizational psychology (the study of how psychology is applied to workplace issues), alongside an MBA focused on what was then referred to as management information systems.

That helped to set the stage for the early part of Soto’s career, when she ran a call center for a cruise line. Back then, cruise line companies had “underinvested in technology,” as they were instead laser-focused on other things like building ships alongside a “get it done” attitude with respect to getting customers ticketed and on board, she recalled.

That setup made it tough for Soto to achieve all of her goals without adding automation to the mix. “So I did something that I don’t advise my mentees to do today. … I was a really big, squeaky wheel about the need for technology,” she said.

Soto advocated strongly for new technologies and procedures that, she believed, would enable the call center to become more efficient and make significant contributions to the overall business.

The company gave her an opportunity, providing Soto support to manage a project on her own, but without much help from the company’s IT team. Soto then reached out to some partners who were pitching ideas to her, resulting in a small proof of concept for an interactive voice response (IVR) system that made way for more (and bigger) initiatives.

And, like technology and IT, her entry point into the world of cybersecurity came by way of an opportunity. When Soto later joined MGM Mirage, she was convinced by the CIO at the time to shift her responsibilities from software-enablement and other revenue-producing projects to those centered on cybersecurity.

Though Soto was a bit reluctant to take on such a specialized role, being urged to enter a new field and to run that team “was the best thing that ever happened in my career,”

Soto said. Soto said it’s a special challenge to keep Comcast’s businesses safe while also staying a step ahead of potential adversaries that have access to a broadening set of tools and techniques.

“There are things we are paying attention to that are happening out there in the greater world that may not necessarily look and feel like a concern for Comcast,” she said.

Cybersecurity, she explained, is more art than science in some ways. “It is an art, but it is an art that’s backed up with good data and a good understanding of your capabilities.”

Soto is also a leader in other ways at Comcast. For example, she’s an executive champion for Unidos, an affinity group focused on the company’s Hispanic employee base.

“There was an immediate gravitation for me to be part of Unidos because it represents our goals around diversity and opening up for people of diverse backgrounds, and an opportunity to build, mature and develop our Hispanic employee base into upper levels of the organization,” she said.

PINING FOR A VINEYARD

When Soto isn’t protecting Comcast from hackers, you might find her on the links, as golf is her number one interest outside of work. Her handicap’s been a “steady 13” for years.

She’s also a wine enthusiast — down to studying the wide array of regions and the wine-making process — and admits to having visions of retiring and running a vineyard.

“I’ll probably never do that because I’ll be bankrupt … because I’d drink all the profits,” she joked.

Among other passions, she’s also a self-proclaimed politico. And keeping tabs on that fiery arena is also a good fit with her career, given that security is so heavily regulated.

Though there’s been significant improvement in recent years, engineering and technology remains a male-dominated field. As a role model for other women who are interested in that sector, Soto’s advice is this: “Really stretch yourself … and take some big risks.”

Women, she said, should not automatically feel intimidated about a tech-facing career. “Don’t limit yourself,” Soto explained. “Sometimes it’s not a straight line. Sometimes it’s about getting into a business area that has a technology spin to it.”

Few companies in the cable and telecommunications industries have escaped the cyber attacks that continue to wreak havoc on just about every layer of the supply chain.

Varying degrees of security breaches at Comcast, Cox Communications, Time Warner Cable and other cable providers have raised the red flag in the cybersecurity space and prompted a new mantra: Now is the time to raise the level of security.

“A fundamental evolution is taking place and the security implications are numerous,” Michela Menting, research director at consulting firm ABI Research, said. “Above all are the issues raised by the transition to all-[Internet protocol] networks, which are already highly exploited by threat actors and will be a boon for malicious cyber-agents — and all sectors are vulnerable.

“Investment in security services and corresponding hardware and software is not something they can ignore or put off , except at great cost to their services, reputation and client base,” she said.

Cybersecurity concerns have become so paramount that in its Charter Communications-Time Warner Cable merger order, the Federal Communications Commission required Charter to submit a plan to manage its increasing security risks during the transition.

And according to the Hewlett Packard Enterprise/Ponemon Institue “2015 Cost of Cyber Crime” study, hacking attacks cost U.S. firms, on average, some $15.4 million a year. Globally, U.K. insurance firm Lloyds estimates that cyber-attacks are costing businesses a staggering $400 billion a year.

There’s also the shaken confidence of clients and subscribers about the safety of their data. And not everyone is convinced the cable industry is prepared for any attacks.

“Cable networks are archaic in many respects, as they extend the life of existing systems, and frankly, the security posture of networks and the less time spent on security leads to a lot of holes,” Chris Simkins, CEO and co-founder of supply chain analysis and risk management firm Chain Security, said.

PricewaterhouseCoopers (PwC), a consultancy moving deeper into the cybersecurity space, believes cable companies are getting the message that shoring up their networks should be of the highest priority.

“There’s a lot going on with MSOs and we’re seeing the awareness lev el rising,” Mark Lobel, a principal in PwC’s U.S. advisory practice and Cybersecurity Technology, Information, Communications & Entertainment leader, said. “But cybersecurity is like a chess game with no kings, and trying to stay ahead of who’s across the board.”

And just who is across the board?

“There are many threat vectors,” Irfan Saif, a principal in Deloitte’s Cyber Risk Services practice, said. “There are service-disruption actors, those looking at the backbone to propagate malware and those who want to compromise customers. It’s a broad range of threat actors and companies must be cognizant of them all.”

That will require a holistic approach, Saif noted. “You must understand what behavior is considered normal and what indicates a threat of attack and what are the crown jewels that require higher-grade protection.”

Cisco Systems, another player in the cybersecurity space, concurred with Saif’s assessment.

“The best approach is a holistic look at security and where each layer builds on top of each other — firewalls, advanced malware protection, email and core technologies like conditional access, DRM and anti-piracy technology — a breadth of security,” Cisco senior product and solutions marketing manager Sam Rastogi said.

Another less glamorous threat, but just as dangerous, comes from the inside.

“Employees or vendors with access to information is a growing concern,” Rastogi sad. “Who’s accessing information and how, and is there abnormal activity? A risk-based program with alerts, authentication measures and more will give companies more insight.”

CableLabs, the cable industry’s research and development consortium, is accelerating its cybersecurity activity with two initiatives: It’s working with the Wi-Fi Alliance to ensure links to hotspot access points are secure, and it’s reaching more deeply into home managed access points.

“The level of engagement is very high and there are real questions being asked,” The mindset is changing,” CableLabs principal security architect Steve Goeringer said.

That’s a good thing, said Rick Michaels, CEO of CEA, a cable industry-focused investment bank. “It’s one thing that cable is carrying 60% of the Internet traffic, but now there are data centers and multiple services with different touch points in cable. Cybersecurity should be of paramount interest to the cable industry.”

Most cable companies are understandably reluctant to discuss their cyber security strategies. Comcast, which in March hired Noopur Davis as senior vice president of product security and privacy, offered a statement from Myrna Soto, senior vice president and global chief information security officer: “We’ve committed extensive resources with a focus on risk management and built resilient and smarter networks with many security layers that are monitored continuously. Using automation, tooling and analytics is key.”

Arris, another key equipment supplier to cable networks, said in a statement (in part): “Security remains a top priority at Arris, as it does for all manufacturers of Internet and network-connected devices” and that it “employs a variety of protective measures to help ensure the safe and reliable operation of our devices including, but not limited to, DOCSIS compliance, vulnerability scanning, and monitoring programs.” It works “actively with security organizations and our service provider customers to identify and quickly resolve any potential vulnerabilities to protect the subscribers who use our CPE devices.”

Breaches cut across both residential and business markets, added Sander Smith, president of Sericon Technology.

“It’s clear that very soon we’ll see consumers filling their home networks with IoT devices, and these devices will be rushed to market with very little thought given to security.”

Yet even with the increase in cyber attacks (PwC reported a 38% increase in 2015 vs. 2014), there is cautious optimism that with emerging cybersecurity innovations, an expanding community of cybersecurity companies and a heightened awareness among service providers, security is being strengthened.

“We’re seeing various levels of maturity in cable and telecom and a raising of awareness in those organizations,” PwC’s Lobel said. “But they can’t lose focus.”

The National Cable & Telecommuications Association is focusing its cybersecurity attention on two areas, senior vice president, science and technology and chief technology officer Bill Check said.

“We are leading the industry’s Cybersecurity Working Group and working with the FCC’s Communications Security, Reliability and Interoperability Council (CSRIC), along with various cybersecurity-related working groups,” he said. “The challenge is to anticipate current and future threats and design systems of early detection and resistance, because cyber-criminals will always look for new exploits.”

Comcast Corp. has promoted Myrna Soto to SVP, global chief information security officer, where she will head up the alignment and development of cyber and data security strategies and policies across the entire Comcast enterprise, including Comcast Cable, NBCUniversal and Comcast Spectacor.

She reports to Michael Cavanagh, the recently named SVP and CFO of Comcast.

“Myrna is an outstanding leader both at Comcast and in the information security and technology community,” Cavanagh said, in a statement. “We’re pleased to have someone with her expertise to oversee this critically important work.”

Soto, who joined Comcast in 2009, most recently served as SVP, chief infrastructure and information security officer  within Engineering & Platform Services for Comcast Cable.  She holds a bachelor’s degree from Florida International University, a Master of Science degree in Industrial Psychology, and a Master of Business Administration degree from Nova Southeastern University. She also holds a Masters Certification in Project Management from George Washington University and is a Certified Project Management Professional.

A recipient of the 2015 CSO Compass Award, Soto also was named Information Security Executive of the Year in 2013 by ISE, and was named one of the top 20 Most Influential Technology Latinos by CNET in 2014.