Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is episode 48. Alex, it's January 1st, 2018.

Happy New Year! Happy New Year, everybody. Robb, I'm not gonna kiss you. Well, that would be the first time. So we are actually talking to you guys from Festivus Day.

So we're talking to you from the past. And right now the AI has not taken over the world. Yeah, I assume by the time you're listening to this, bad things have happened and you're now enslaved to your computer. Nothing new there. We told you so.

Now it's explicit instead of implicit, right? Absolutely.

So we are going to finish up our second half of the interviews from the Colorado Equal Security holiday party where we asked about 2017 kind of events and then looking forward to 2018. So this episode is focused on what did we hear in 2018. We're gonna do a little prognostication. Yeah, should we talk through who the guests are again? Probably should, right?

So, so Chris Abbey from Douglas County Schools is with us here. We've got Sue Lapierre from CISO from Prologis. We've got Tim Coogan, the CISO for DIA. Steve Corey, CISO for City and County of Denver. Joshua Foltz, the CISO for eFolder.

Mike Kalac, the CISO for Western Union. Colin Mariner, the VP of Infrastructure for HomeAdvisor. Lucia Milka, the CISO for Polycom. Rich Schliep, the CISO for the Secretary of State for Colorado. Brian Becker, the CISO for Cronky Sports, and Sam Masiello, the CISO over at Gates Corp.

So those guys talking to us about their 2018 plans. So just like last week, we're gonna go throw over to them, let them tell you what they're thinking, and then we'll come back to us and give our opinion. Yeah, before we do that, we're gonna talk about our trivia question. Oh, trivia, I forgot all about that. So since we are recording this in the past, we obviously, we don't have an answer for the reindeer trivia question yet.

So it's not too late if you have a good answer for which reindeer is most— is best connected to Colorado and why, reach out to us. But I think we have a question for this week too, right? We do. We're going to go a little bit subjective again this year or this week. What was the best Christmas present that you got?

Or if you don't celebrate Christmas, you know, any other present that you got around this time? What was the best present you got? And it can be special to you. It can be, you know, if you got a new Tesla, that might be in the running. I could see that.

But if, you know, your spouse cleaned your car for you after it was filled with sand from playing indoor volleyball at the sand facility, that might win as well. Well, even if you got coal, you know, that is very useful. You can use it to heat your house. You know, I actually recently looked up how much coal costs and it is ridiculously inexpensive to buy. It's like a ton of coal is like $5 or something like that.

Wow. Really, really cheap. So is that why you have those big piles of coal in the backyard? Well, I figured it can only go up in value from there. Sweet.

Alright, let's go ahead and throw it over to the questions. What's your biggest focus going to be in 2018? A lot of it is just focusing on risk and how do we implement a security program in a K-12 school district. So what's your biggest focus for 2018? The last couple years we've tooled up and now we're working on processes and maturing, becoming more repeatable.

With the work that we do. What is your biggest focus going into 2018? Phishing and ransomware. Mike Kalec, let's talk about 2018. What's your biggest focus going to be in the next year?

Well, there's a couple things. From meeting New York cybersecurity law and GDPR is big, but we have a lot of focus on reconstructing or doing a next-generation SOC. So we're really taking a look at automation and threat and how we could be more proactive. So we're really rebuilding our SOC from the ground up. What's going to be your biggest focus going into 2018?

It's actually DevOps security, you know, really getting our development people to code securely and own it. That's the big one. Talking with Colin Mariner about 2018. Colin, what's your biggest focus going to be in 2018?

Automation. Automation. The buzzword in the world, in the tech world, is DevOps. Automation of security is where you change security from being a cost center to being able to impact your business in a good way and be more of a feature set and something that is a selling point for most industries or most businesses, as opposed to being that cost center. Automating everything that you can do in the security world It helps you take steps that your organization saw, never even knew were possible, let alone were something that could be in your past and say, oh yeah, we have that.

Oh yeah, we have that. Lucia, let's talk about 2018. What's your big focus going to be in the next year? Trying to actually achieve GDPR compliance by May. What are some things that you had planned for 2017 that you're really going to get done in 2018?

More security training, improved security awareness throughout the company, and I need to get better into metrics.

What predictions do you have for the broader industry for 2018? What are we going to see happen in the next year? More regulatory focus. And I will say specifically around data breach responsibilities. I'm terrified of the new bill this, you know, Senate is trying to pass around jail time for breach notification.

Rich, let's talk about 2018. What's your biggest focus going to be in 2018? Obviously running another smooth election, but beyond that, as far as the security things we're going to be implementing, we're really focused on privileged access management and trying to implement that across our organization. Brian, what's your biggest focus going into 2018? The biggest focus of 2018 from a professional standpoint is to continue to integrate security into the mindshare, I guess, of our people at KSE.

We're a big diverse conglomerate of businesses that we want to make sure that we're thinking about the company and information security from the get-go. So culture is a very big push for us. Especially at KSC, and then especially also adding and changing KPIs, being able to meet the growing and evolving changes in information security and trying to stay out in the front such that we can be proactive in our program rather than fully reactive. What's your number one priority for next year? So for me, coming into Gates, right, we really didn't have much of a security program coming in, right?

There was a lot of, a lot of things that really still needed to be done just from a foundational perspective. Perspective. So my largest priorities next year are just based upon how you build out that foundation for the security program and starting to build maturity around some of the basic elements that are most important to the organization. As I think about identity and access management, that's a big one for us and something that we're currently in the middle of implementing. But a lot of the goals around the rest of the year's program is going to be around just building a lot of the foundational pieces that you need to make the program successful on top of that.

Not really much on tools or technology. Just more around the foundational pieces that need to be done. Yeah, process, process and policy that need to be done to make the process, make the programmability move forward faster. So those were some good answers. But while we were listening to those, Robb, I did manage to fact-check you a little bit.

You know, I don't want us to be spouting off information that we don't really know anything about. Hold me accountable, Alex. What'd you find? So I looked up how much coal actually costs. Oh, it's a little bit more than $5 a ton.

So Depending on where you get it from, it could be anywhere between $12 and $60 a ton. So isn't that amazing? Like, obviously I was wrong by as much as a factor of 12, but isn't it amazing that a ton of coal could at the most cost $60? Yeah, that still is pretty cheap. Yeah, I mean, it makes me want to buy tons of coal.

So back to the topic at hand though. Robb, what's gonna be your biggest focus in 2018? Well, as much as I've for years said compliance doesn't equal security, Compliance has become a huge focus for us in security, right? For me in 2018, we're going after ISO certification really aggressively in Q1. We're gonna hopefully get certified sometime in March or April.

We have our audit scheduled for the next couple of months. And then GDPR is right after that in May of this year, May 25th, I think it is. We are aggressively going after GDPR compliance. There's no certification process for that, but it's really driven a lot of good stuff, honestly, a lot of data flows in areas that maybe you didn't didn't have it before. Marketing activities, someplace where you're getting consumer data, having really nice defined processes around that.

Those have been big focuses for me next year. How about you? Yeah, you know, I'm gonna go a little personal here. In 2018, I'm gonna try and say no more. I've had a great habit of saying yes to a lot of things, and because of that, I end up with lots of things on my plate.

And I love doing all the things in the community and helping people. Uh, but I think I'm going to try and work on saying no to some things this year. Well, in the spirit of that kind of resolution, um, would you mind giving me $1,000? No, no, you wouldn't mind? No.

Damn it, Robb. All right, let's go ahead and throw it over to some more, more interview questions. So what is the thing that you were going to do in 2017, but you're really going to do in 2018? Um, I was going to encrypt everything. And now I'm starting to encrypt because GDPR in New York tell me to.

No, yeah, we didn't get to encryption as much as we'd like to. What are some things that— what's the one thing that you planned to do in 2017, but you're really gonna get done in 2018? Yeah, I promise. Get all of my projects funded. What are some things that you had planned for 2017 that you're really gonna get done in 2018?

More security training. Improved security awareness throughout the company, and I need to get better into metrics. What's something that you were going to do this year, but you're really going to get it done next year, serious this time, right? Sure, right. So I had a newborn this year that kind of threw off a lot of my plans, but I want to get us— there's 2 things.

One, I want to get us another certificate. Just a professional accreditation, and then I'm looking at like the CSSP and some other things. And then I want to, when you guys put out like the RMISC or the security conferences put out like a request for papers, I want to do and give one of those presentations to talk about kind of the cool things that I've been seeing and that we're doing at KSE. What is one thing that you were, you were going to do in 2017, but now you really, you're really going to get it in 2018? You promise this time, right?

Maybe you've been putting it off for a little while. So if I were to kind of compare and contrast the role I was in before versus the role I'm in now, you know, I was able to build the program at my last place such that, you know, we was at a much different place than where Gates is at today. So if I were to say something I was planning on doing before that I'm not doing now or that I want to do for 2018, kind of comparing apples and oranges, really. You know, a lot of the stuff we're again looking at doing next year are mostly built around how do we start putting those building blocks in place. Around better end-user encryption, better end-user management, better process, better policy within the organization, preparing us for some of the regulatory frameworks that are coming up that are relative to the company, like— not even regulatory framework, legal framework, sorry, like GDPR.

GDPR is a big thing for us for next year, and so making sure that we're ready for May 25th come next year for GDPR so that we don't have a regulator knocking on on our door May 26th asking us to see all of our GDPR compliance stuff, right? So if I start to think about something that's near-term really important for us at Gates, it's going to be around GDPR, and also how do we operationalize things like GDPR globally, right? Because the last thing you want to do, at least from my perspective, is look at GDPR as just being an EU-specific directive. You should be looking at that as how you can implement data privacy regulations across the entire organization. So a lot of good stuff that people are going to do next year, obviously in security.

We just can't get it all done. Alex, what are some stuff that you wanted to do this year that you're gonna look to do next year? Yeah, I'll say, you know, kind of half the stuff that we wanted to do in 2017, we're gonna try and get done in 2018. We had a lot of unexpected things happen, ramp up in workload, a lot of things happen in 2017 that kind of threw off our initial plans. So we did a lot of great things, a lot of things we weren't expecting, but those things that we were gonna do in 2017, about half of them we're gonna try and get to 2018.

It's funny, and I don't know about you, but, you know, at Ping, in my program, we have a list of priorities, things we want to go through, you know, call it 80 items long, and we have the capacity to do 12 of those a quarter or whatever. There's no way— the math tells me we'll never get to the bottom of the list, right? So it's always there. And of course, you know, you could do something like due diligence for a potential acquisition or or, you know, a new product coming out, and it takes a whole lot of cycles that you otherwise would have put to those projects. So anyway, it's always going forward and tough balance.

Yeah, this stuff's always going to be coming up. All right, well, let's go ahead and throw it over and have a little talk about predictions for next year. Uh, what predictions do you have for 2018 around information security? I think awareness is going to go up. I think that we're going to see a lot more class-action lawsuits based on the Equifax breach, and I think we're gonna see more awareness among people in general.

From a larger industry perspective, what do you think is the biggest things that are gonna happen in 2018? Automation, I think, will start really coming to fruition. We're gonna figure that out. I think we'll finally realize that the SEM is dead, but I think automation and starting to get these products to work together a bit more. What predictions do you have for the security world in 2018?

What can go wrong will go wrong, unfortunately, right? I feel like we have an industry where one of the biggest consumer reporting agencies got hacked this year. One of our largest consumer apps in Uber got hacked this year and didn't even tell anybody about it. Personal information on the web is, in the US, is not as much of a premium as it is in the rest of the world. So I don't see that trend changing.

I see it's more of the same. The frustrating thing there is that America will continue to allow it to happen, right? But as far as 2018 is concerned, I think that we'll see the rest of the world really rebel against that norm. You'll see GDPR coming out. You'll see real impactful penalties for not meeting GDPR.

So I think that that's probably what we'll see is the rest of the world rebelling against this constant norm of information getting leaked and information becoming less and less important to individuals in the US, but becoming more and more important to societies around the world. What predictions do you have for the broader industry for 2018? What are we going to see happen in the next year? More regulatory focus, and I will say specifically around data breach responsibilities. I'm terrified of the new bill this, you know, Senate is trying to pass around jail time for breach notification.

And then do you have any bigger predictions for 2018, things that you see coming in the next year? I have a feeling that cryptocurrencies are going to continue to make a lot of money. What predictions do you have for 2018 in the security world? I think the first one is, is that when the GDPR comes out, the European Union is going to drop a hammer on somebody, a 4% revenue fine that's going to shake our information security program, people, leaders, leadership to the core, right? It's like, if that can happen to them, it can happen to us.

And so I think that'll really kick somebody in the butt. So that's my first one. So do you think that in 2018 there will be a 4% fine? Absolutely, 100%. Just because the people, some of the people I've talked to from many different businesses that I have contact with, they all say the same thing, is that we don't know about GDPR, we don't care enough, or we're not getting enough push.

So I think that there's gonna be a big eye-opening hammer that's gonna drop. Number 2 is that more states and countries and sovereign nations may release their own form of the GDPR, much like the New York Financial Cybersecurity Act that they have going on. I think we'll see maybe California come out for one that might make it a little bit more difficult to operate from a regulations and governance and compliance standpoint. Headwinds for more information security professionals, right? My third prediction is I think we're going to see a continued rise and focus on the SecDevOps practice.

That's something that we are definitely interested in doing at KSE and growing that, is using business intelligence skills, scripting skills, big data skills, skills with a focus on machine learning and AI, just to maybe utilize those kinds of technologies to help improve our efficiency and productivity. Number 4 is kind of a fun one. I think a CISO of a Fortune 100 company will be hit with a sexual harassment inappropriate behavior claim and probably will lose his job, his or her job. So I don't want to go there, but this environment is just one of those kind of fun ones. But, and the 5th one I think is like Some company out there is going to try to build or sell a blockchain-based security product and might raise a whole ton of money because it's using the word blockchain in the title.

So that's my 5 predictions. So those were some good predictions. We got a couple of Nostradamii out there. Robb, what's your prediction for 2018? So I don't have a lot of predictions for 2018, so instead I'll give you my predictions from somewhere between 2018 and 2022.

How about that? A couple things I see coming up. So in Europe, open banking has been a regulation that's really requiring financial institutions to create APIs to allow consumers to get their banking information out to other services. Think about how you have something like Mint that tracks your spending across all your accounts. Well, in Europe now, the banks are forced to expose APIs that allow you to give consent for those kind of services to get your data and aggregate it and really get your data other places, right?

So open banking, while it's hitting Europe right now, I believe it's not just going to hit European banking. It's going to come to the US, and it already is, in a market-driven way. But it's also going to go to other industries.

Open finance is going to turn into open healthcare and open energy. And any place where you have consumer data, people are going to want to be able to share it. And it's really going to become a force for for sharing and good interoperability on the net. Second prediction I have is around quantum computing. Obviously, it's the idea of quantum computing, for those who are listening, is basically the idea for a computer to try every permutation of something at once versus having to try and brute force something for a million years of cycles to break cryptography.

You can try every potential outcome at the same time. So, if you think about the impact of that, it breaks all known current cryptography, right? Everything we use on the internet for data at rest, data transit really becomes obsolete. So it's not just that quantum computing is coming. Well, we know it's coming.

It's how do you prepare for it and how do you start to get your organizations ready for this thing that's, you know, 5, 10 years out in the future? I guess I'm going to have to go upgrade those Windows 98 boxes that I have so that we can get ready for quantum computing. Good news about your 98 boxes is probably not a lot of folks trying to attack those right now. That's true. What are your predictions for next year?

Well, you know, I'm predicting the rise of the Terminator. So, you know, I think we've already talked about that a little bit. But by now, if you look out the window, there's robots flying around taking over everything. But seriously, for the last few years, I've been trying to espouse the benefits of the NIST Cybersecurity Framework. You know, Robb, you and I are both big fans of security programs and standards around security programs.

And, you know, we latched a little bit onto the Cybersecurity Framework when it came out. And I think in 2018, it's finally going to get the traction that it's been working towards. Yeah. We've seen some of this come from the government. You know, Cybersecurity Framework, which was originally designed for private industry, for critical infrastructure, is being pushed into the federal government.

And I really think this is going to be the standard that people are going to use for for doing security programs. So I think really this year we're going to see that really take off. Good stuff. Good stuff. I'm looking forward to it next year.

All right, let's throw it back over to the interview questions. What do you appreciate most about the Colorado security community? I think how inclusive it's been. Being a K-12 security analyst, typically we're, we're black sheep or a rare breed. And so being able to go to an event and actually be treated like a true security professionals has been great.

What do you appreciate most about the Colorado security community? Well, it's just that, um, I, I feel like it's almost kind of like a family. Um, everyone seems to know each other, and when I've turned to the community for help, it's, it's always there. Um, they're always there to help me with any questions or needs. And, uh, you know, we can't do this alone.

Um, in order, in order to fight the good fight, we're going to have to come together and do it together. And I think that this community, uh, does that in, uh, more than any other communities I've been part of. What do you appreciate most about the Colorado security community? Oh, this is an amazing community. It is.

We have tonight, when we've gathered, I've seen the full spectrum of all the people that you bring together. Most people here are coming on a very friendly basis. There's no high pressure from vendors, although we appreciate the vendor support as which you organize. And I feel like it's one that has allowed me to connect with peers in my community such that I felt that the mentoring award should have gone to both you and Robb, but you guys must have disqualified yourself from the, from the voting. Well, we appreciate that.

What do you appreciate most about the Colorado security community? The collaboration. You don't see this in most industries, you don't see it in most areas, and certainly not security in Colorado. I love it. What do you appreciate most about the Colorado security community?

We're so tight. I mean, there are— people are active in the community. And I think that Alex, you and Robb have been doing a fantastic job just getting to know, you know, people to know other people in the community. I mean, we were already having a pretty good community, but now it's so strong and so tight. It's, it's fun to be around.

What have you most appreciated about the Colorado security community at large? I think the thing that I appreciate the most is just the real-world experience of everyone that's here, how friendly everyone is. If there's a group of folks talking, you can just walk up and just be involved in the conversation. Everyone's really open with both the technical solutions that they're going— the technical problems they're going through, the social problems they're going through, issues they're having with, you know, C-level executives down to, you know, really solving technical problems. Everyone's really open.

Open. I love that about this group. What do you appreciate the most about the Colorado security community? So I'm just getting started from the consulting side to the business side of the Colorado security community, but I've been really impressed on how open the security community is and how they're willing to help each other. It's like there's a new book out called The Tribe of Mentors that they list a bunch of wisdom.

It's like everyone's been open and helpful. I've had many good sit-downs over beers Drew Labbo and just trying to learn from each other and see, this is what I'm seeing, this is what I'm seeing, how can we make our businesses and our, uh, just kind of our experiences in security better? And so that's what I'm super happy about this community with. Tell me what you think about the Colorado security community. Uh, how— what's your experience been?

To me, it's been awesome. You know, I, I've been, I've been in Colorado for a long time now. I've been in the security community engaged in various ways for a long time now, whether it's through OWASP or whether it's through, you know, the various security groups that come through, the industry associations, the expos and shows and things that come through. It's such a tight-knit community around here. You know, Denver's a— it's not a big city, but it's getting bigger.

Certainly when you think about all the various buildup that's happening around Denver and Broomfield and Boulder and Colorado Springs and all areas in between up to Longmont. So the community is getting bigger, but it's still, it's still very small, very tight. I think we have a lot of strong relationships that we've built within the community, and so From that perspective, you get a lot of information sharing amongst security leaders, amongst everybody who's in the community, right? Whether you necessarily have to be a security leader, but anybody who's involved in security who gets involved in these various events gets to know each other, gets to know what each other is doing, gets to know each other how they're doing it. And so from that perspective, the community I think is extremely strong, extremely tight.

I've seen some other communities as I've worked in other roles and other jobs and gotten involved in their various cities, communities, and nothing, nothing I found has been as strong or as tight-knit as what we have here. We're lucky to live in a community where security is so valued and we have such a great community. So I'll throw the question to you, Alex. What do you most appreciate about being here? You know, I really love the openness and the friendly attitudes that everyone has.

It doesn't matter who they are. People are willing to share their time, their expertise. They're willing to go have lunch with you. Everybody is open, welcoming. That's really what makes the community so great.

Yeah. What about you, Robb? You know, I say, you know, obviously I echo all that, but I'd say one thing I've got to realize over the last couple years is the people who have founded security companies in town, you know, from, you know, Chris over at LogRhythm and Dan at Optiv and Andre at Ping and so many others. And I don't mean to discount anyone on the list. There's just such a great group of people who are heading up those companies who really want the best.

Obviously everyone's you know, trying to build a successful company and they're whatever that means for them, but they also really want to be a part of community. It's, it's not in isolation. It's not at the expense of the other guy. It's really trying to raise the, the level for all the ships in, in the ocean here in Colorado. And it's been a great place to, to get to be part of a security company.

Yeah, that really is important in, in helping the community and fostering the community. All right, we'll throw it back over for one last, one final question. Very important, the most important question. I think this is Definitely the most important question. And finally, who do you like better, Robb or Alex?

Ooh, this is hard. Alex meets with me on occasion, so I have to say Alex right now, but Robb invites me to like really nice events, so I don't know. I'm 50/50 right now. And finally, most importantly, who do you like better, Robb or Alex? Who?

Who's Robb and Alex? I think the most important question here though is Who do you like better, Alex or Robb? Yes, that's true. And last but not least, who do you like better, Robb or Alex?

I can't answer that question. I'd say Alex right now because of the very cool Christmas outfit, but Robb and Alex are probably equal most of the year. And now the most important question, who do you like better, Robb or Alex? You know, That's a tough one. But being that I'm sitting right across from you, Alex, and you are in this matching suit, a snowman, reindeer, red Christmas, and then Christmas tree suit, it's got to be you.

Great answer. Who do you like better, Robb or Alex? It's got to be Robb, hands down. There's no competition. If you've ever seen the way that Alex dresses, you'll know what I'm talking about.

Most important question, Sam. Who do you like better, Robb or Alex? Oh, wow. Let's see. Well, since you're sitting right in front of me and you're within punching distance, I guess I'll say you.

But I will say that Alex is a very snappy dresser. So I think those are all great answers. But I mean, seriously, who are these guys? Tim Coogan had it right, right? Tim Coogan had it right.

I don't know. I don't know what— why anybody would think that we're important or anything like that. Well, it's been an awfully fun year. It has been a great year. We're 10, 11 months into— well, 48 episodes into this whole thing.

We've got over 300 people listening the first week. We've had over 500 people per week listening to all the episodes. Pretty cool. Building a really cool community here around this. Next week, we'll be back to you guys with a new episode with a feature interview.

All the news that would have broken over the holidays. Don't forget those trivia questions. So we've got last week's trivia question about the reindeer. We've got this week's trivia question about the presents. We'd love to get answers for both of those.

We've got a mailing list. Go ahead and review us on iTunes or the Android, whatever, Google Play Store. And we'll look forward to talking to you guys in 2018. Don't forget that Slack channel. Go sign up.

We'd love to have you chatting in there. It's been a great year, and we'll talk to you again in 2018. All right, have a good one. Thanks, Robb.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.