U. Wisconsin CISO moves to private sector

Bob Turner, the chief information security officer at the University of Wisconsin-Madison for the past six-plus years, left the university this month for a new role with the cybersecurity vendor Fortinet.

Turner, who had announced his impending departure from Wisconsin in June, is now a field CISO with Fortinet, advising the company’s higher-education clients on cybersecurity strategy, vulnerability management and other practices.

Bob Turner (University of Wisconsin)

In a LinkedIn post announcing his new job, Turner called his time with Wisconsin “the ride of a lifetime — sometimes a rollercoaster, most times a rocket ship to success.”

During his time in Madison, Turner was responsible for building up a cybersecurity program on the state’s flagship campus, which serves more than 45,000 students and employs more than 2,200 academic staff. He sponsored the creation of the UW-Madison Information Security Team — or MIST — a board of IT staff responsible for developing campuswide cybersecurity training sessions. Turner’s office launched a new training course in April that faculty and staff were required to complete this spring, while students will be required to take it when the fall semester begins.

Along with the cyber hygiene education, Turner was also credited with building up Wisconsin’s cybersecurity office overall.

“We now have an exceptional team of cybersecurity professionals and a growing community of technologists and managers who actively practice cybersecurity risk management,” Lois Brooks, the university’s chief information officer, wrote in a June 24 blog post.

Brooks also praised Turner for a July 2020 proposal to modify some of the color-coded language frequently tossed around in IT and cybersecurity practices. Turner’s idea, which came amid a national reckoning on race, proposed doing away with terms like “blacklist” and “whitelist” in favor of “block list” and “allow list,” and replacing terms like “master” and “slave” with “primary” and “secondary.”

“Developing slang and jargon may save time. But choosing terms that are insensitive defeats the learning, especially if you are the one offended,” he wrote at the time.

Turner’s cybersecurity office also sent routine alerts to the Wisconsin community about the latest threats and online scams. Last November, he warned that cybercriminals are increasingly using artificial intelligence and machine learning tools to improve their tactics, which he said was a reason organizations like universities should also use those tools in their defenses.

“The criminals that are out there, they’re also using AI and ML to advance their ability to create malware,” he said. “And those are great opportunities for employees to use AI and ML in our environment, making sure that the hundreds of thousands of things that go on on our network are captured on a regular basis and also that we’ve understand them.”

Jeffrey Savoy, Turner’s former deputy and a university employee since 1995, is serving as university CISO on an interim basis, university leaders said.