Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for the week of July 30th and episode 77. Once again, Robb has left us in the lurch, and we have another special guest host with us this week.

We've got Brian Beyer, CEO of Red Canary. Welcome, Brian. Good morning, Alex. How are you doing? Doing well.

Happy to fill in for Robb. Awesome. Thanks, thanks for doing that. For those that don't know you, it means that they don't listen to the podcast because you've been a guest before. But maybe why don't you introduce yourself and tell the audience who you are?

Yeah, absolutely. So I'm one of the founders of Red Canary, a security company in Colorado here, and we hunt through massive amounts of data to identify security threats and all the problems that are gonna face your business today. So, been here for about 4 years now, Colorado native company, and get to work with many of you and your fine listeners. Awesome. Well, appreciate you being here.

Not trying to be too fanboyish today, but I am wearing my Red Canary t-shirt. You are. Thank goodness I decided not to wear mine, but I do have my Built in Colorado shirt on. So I think we're covered. We're covered.

All right. So before we jump into the news, let me do some announcements. First, as you all may have heard, we have a Slack channel, some great discussions going on there. Encourage everyone to join. You can find information on that on the website, colorado-security.com.

Also on the website, there is the ability to sign up for our mailing list. We will get you the show notes every week. We would love if you subscribe to the podcast. Either Google Play or iTunes. And if you like it, please rate us.

We love good ratings. And finally, we are doing a Patreon campaign to help support the podcast. All the money that you donate goes right to the podcast. None of this is money to pad my pockets or Robb's pockets. You know, maybe we'd give a little bit to Brian to help, you know, pay for his travel down the street to come do this.

But anyway, So let's go ahead and jump into the news. Great, so starting us off, Denver ranks among the top cities to live in according to a new report. Yeah, it's a great time to be in Colorado. I think we know that. But this report looked at 62 cities with populations over 300,000 people, and Denver was ranked 12th overall.

Overall. We were 5th in economy, although not surprisingly it ranked 30th in affordability. I guess we all know that with, uh, with all the good things we have here, we have experienced some of that, uh, that affordability problem. I think it's still worth it to be here though. I think it's one of those challenges, right, as you get more popularity and as you move up the list More people come, affordability goes down.

Exactly. Stuck in rank number 12 forever, right? Well, you know, I think that's probably, you know, I don't want to call it a sweet spot, but it's probably a good spot. You don't want to be, you know, 1 or 2, uh, because that means everybody wants to be there, and, you know, your affordability is probably like, you know, 117th or something like that. That's true.

And then you're San Francisco or something like that. Uh, all right, uh, next, Target unveils a new urban storefront in downtown Denver. So, Brian, have you had a chance to go to the new Target store since your office is downtown? I haven't been to the new store yet, but it definitely seems like this is a continued trend of more and more development in downtown. I've been in Colorado for almost 10 years now, and it's been wild to see how much downtown has been built up and really become this epicenter of most things that are being built in Colorado.

I mean, we see it from Target stores apparently all the way to more and more tech companies are all being built downtown and even moving up from the tech center and down from Boulder. Yeah, I remember when I first moved out here over 20 years ago now, we— you had Lodo and stuff around Coors Field, but, you know, a lot of downtown was parking lots and, you know, just sort of a wasteland. So it's pretty amazing what downtown is like now. Yeah, I mean, I give a ton of credit to the team who built Union Station and everything around that. That's obviously where our offices are, but that area compared to all the cities I've been to really is one of my favorite places to be.

Awesome.

All right, and Denver has broken into the top 10 list of North America's top tech talent cities. We are number 10. We are ahead of cities like Dallas, Chicago, and Los Angeles. And we've also moved up from being number 12 on the list last year. That's awesome.

Not surprisingly, the Bay Area ranks number 1 for tech talent. I am shocked. Shocked, I say. Also on that list ahead of Denver, Seattle, Washington, D.C., Toronto. You know, that one's interesting because you don't usually— well, did it say U.S. cities?

Toronto doesn't happen to be in the U.S. It said North America. It says North America, okay. Many times it's US lists, so Toronto gets excluded from that, but definitely a tech town there. And of course, also on that list, our rival and nemesis, Austin.

But it's pretty cool. 6.2% of the total employment is tech-related. Again, kind of cool, well above the national average of 3.5%. And the annual tech wage now, average annual tech wage now tops $100,000. So again, pretty cool stuff.

That's great. Next on the list, there are some cyber classes that are going to be taught in Colorado Springs to help small businesses with their cybersecurity. So this is in conjunction with the National Cybersecurity Center down there, which we have talked about numerous times. On the podcast, but the Pikes Peak Small Business Development Center is doing their Cybersecurity Simplified: What Your Small Business Needs to Know. So pretty cool.

That's great. Are you familiar with the curriculum of what they're going through? I am not. I haven't looked into it, but I would say for small businesses, anything is better than the nothing that they are already getting. And if you don't know what to do there, just turn on multi-factor authentication.

Exactly, yes. If If you brought everybody together for that class, sat them down, explained what multi-factor authentication is, and then walked them through how to do it for their organization, you'd be doing God's work. Yes, that would be incredible. Incredible. So also, we have Logarithm was recognized as one of the Gartner Peer Insight Customer's Choice for SIEM software.

This is, if you're not familiar with Gartner's program, They actually built this Peer Insights organization where they go to actual customers of security products, solicit both written feedback as well as scored feedback, and use that to determine from the people, from the people actually using products, how do they rate them. And this is something we've actually been involved in and seen how they go through this process, and I think they do a really good job. I mean, you have Gartner analysts who are really smart on the academic side and how these products work, and now you get to mix in the side of people who actually use them. Yeah, I think it's a little funny. I've taken some of the surveys before for various companies that I've used their products, and one of the questions that they have on here is— I don't remember exactly how they word it, but it's essentially like, why did you come here and vote?

And some of the answers are like, you know, the company offered to give me something if I voted, or, you know, all the way to I just really like the product or something like that. So, you know, even with that, again, to your point, I think Gartner does a good job because they realize that this still can be sort of a salesy kind of function that, hey, let's push you to come vote for your product in Gartner. And they want to at least have an idea of, all right, are you doing this on your own? Or, you know, is someone sort of pressuring you, encouraging you to come do this? In any case, I think it's good stuff.

And to all the vendors out there, if you do offer someone a reward in order to do that, make sure you say— and when you fill out the form, tell them you did it of your own free will. That's right. Yeah, clearly the people that mark that box, that, you know, the salespeople that are telling the people to go vote are not doing a good enough job. Next, Overwatch ID introduces their dynamic web UI engine for PAM. So of course Overwatch ID, identity company here in town, they have now released a, a module that allows you to do privileged access management for web-based entities.

So many times PAM solutions are, you know, you have to install an agent on a machine and it's sort of OS-based. This really takes that sort of to the next level, allows you to do PAM on web-based authentication. So pretty cool. And I saw you joined their board of advisors, isn't that right? I did join their board of advisors.

So, um, and so what does that mean? Because that's seems like they're a little bit competitive or moving in the dimension of where Ping is going. So, is there trouble in paradise with you and Robb? You know, I think Robb and I are technically competitors in some ways. So, you know, we usually, you know, have our death matches on mornings when we're doing this.

But, you know, luckily both of us have come out alive so far. So, yes, we are now technically competitors. Although that is just, you know, a part-time job for me where Ping is a full-time job for Robb. But I do like Overwatch ID. I think that they're doing good stuff.

Good. That's great to hear. And then we have actually 2 articles about ProtectWise. One of them, first of all, is that they have joined CrowdStrike's Elevate partner program. That's really exciting, you know, being very much in the endpoint space and working with the ProtectWise team as well.

This actually brings together the ProtectWise network detection and response capabilities more tightly partnered with CrowdStrike's endpoint detection and response capabilities. Should be a really good partnership. We expect from that team, Scott Fuselier, who had led sales over at CrowdStrike, actually is over at ProtectWise now. Oh, nice. So that's really exciting news for everyone here, building a great security sales team in Colorado.

And then we also had James Condon, who's the Director of Threat Research and Analysis at ProtectWise. He was on the Immersive Security Future Tech podcast, and I thought did a great job summarizing what ProtectWise does and how they see what they're doing as a new way of approaching the network traffic analysis problem. Yeah, and James has been, uh, active on the Slack channel, so appreciate him doing that. And if you want to hear more about him or ProtectWise, go and check out that episode of Future Tech. Absolutely.

So next We have a blog from Red Canary. Never heard of those guys before. 3 areas to consider when looking for a managed detection and response partner. So Brian, what are 3 areas that you want to consider when you're looking for a managed detection and response partner? You'll have to go to the blog to find out and learn more.

It's actually written from Mike Haag on our team, who was one of the great ex-Carbon Black customers who had actually operated one of the largest Carbon Black stacks out there in the community before he joined our team and has a tremendous amount of experience with EDR as well as integrating that into Splunk and shares a lot of his insights working in a security team and then coming over to the vendor side as well and seeing how those compare and help people make good decisions. Cool, good stuff. Next, the one modern thing third-party cyber risk management management programs do. I think the key here is modern, and when you think of modern, think of mature or other things like that. And this is by CyberGRX.

I thought this was a really good article talking about that third-party risk management and how complicated it can be, especially when you start realizing that your third parties also have third parties. Yes, if they can solve this problem, fourth parties, fifth parties, exactly, many, many down the line. I think sort of that the summary there of that one thing was that the modern programs use exchanges, and surprise, surprise, CyberGRX is an exchange for third-party risk management. And I don't dispute that either, that, you know, having an exchange where instead of everyone going out to do their own assessments and come to their own conclusions, If you have a centralized place where you can have either third parties or share assessments, it makes that so much easier and so much more robust. And if that doesn't work, we'll stick with the spreadsheets, but one giant shared Google Doc to do that.

That's right, exactly.

There's nothing I'm sure you or I love more than lots of spreadsheets for vendor risk diligence. You know, I prefer spreadsheets, you know, none of this other stuff. None of this complicated applications. None of this technology stuff. No, no, no, no.

Just give me a spreadsheet. We're all good. Exactly. And then we have 6 Steps to Build an Incident Response Plan from Webroot, and I thought that was a really good take on how to build an incident response plan targeted a bit toward managed service providers, and still may have some nuggets in there for everyone to learn from. Yeah, it was a, a very good high-level overview.

So if you want to know the, the high-level steps of things that you should do around incident response, uh, great little blog here. As you mentioned, Brian, you know, Webroot, they've— I don't wanna say they've pivoted, but, you know, they focus more towards, you know, reselling their product to service providers and embedding it in other solutions, as opposed to, you know, I sort of still think of them as just, you know, as an antivirus provider to consumers, which they still do, but that's not their bread and butter. So this was really aimed towards those service providers and how they should build out their incident response programs. So that's it for the news. Before we get out of that section, the voting for CISO of the Year at the CTA's APEX Awards is still open.

So if you know a CISO that deserves to be CISO of the Year, you should go out and nominate them. Also, all of the other awards at the APEX Awards are still open as well. CEO of the Year, Project of the Year, so on and so forth. So check that out. We'll have the link in the show notes.

The voting on that, I believe, is closing in a week, so you don't have a whole lot of time left. Brian and I are actually both on the committee to help choose some of these awards, so we would appreciate the more nominations the better. The bigger pool of nominations means more data to really tell who the right person should be. Please do nominate. We'd love to have many great candidates to choose from.

Exactly. Uh, let's move on to the Slack message of the week. Um, again, we would like to thank Andre Gaeta, who sponsors the Slack message of the week for us. Uh, this is money out of his pocket, uh, because he, uh, wants to help support us. So I really appreciate that from him.

Um, and this week, um, I chose the Slack message of the week for actually to be multiple messages. So, uh, Douglas Brush, who is the host of the Cybersecurity Interviews podcast, also has been on the show, was very, very, very, very, very active in the Slack channel this week. Either Douglas had too much coffee every day all week, or, you know, maybe he just wasn't doing anything, but he— some great insights this week. One of those was we had a great discussion around hiring, talking about, you know, how people can interview, what hiring managers should look for, and he had this insight. He said, you know, I'm usually looking for a shortstop, you know, essentially someone with a specific skill set, and I get resumes of baseball players.

So, you know, if you have specific skills and, you know, you're trying to find a job for those, make sure that you make your resume look like a shortstop as opposed to just a general baseball player. Funny for me, most of the time I'm not looking for shortstops, I'm looking for baseball players. So I guess it's sort of a catch-22. All right, so moving on from the Slack message of the week, let's talk about events. We do have our event calendar on the website, so check that out at colorado-security.com.

We're actually starting off with an event on the 31st. SecureSet is hosting a Hacking 101 for application security, and, and that's actually at their Colorado Springs location. So they've started to host events down there as well. So now if you are down in the southern regions of Colorado, you can get some great stuff too. That's great.

Love the work they do. Next, SecureSet at the Denver campus on the 3rd of August is doing a beginner's intro to capture the flag. On August 7th, we will be having another Hacking 101 for application security. And that is at the Denver SecureSet location? Exactly.

Uh, on the— also on the 7th, uh, the NCC is hosting their Cybersecurity Simplified, which we mentioned in the story earlier. That's, uh, training for small businesses on cybersecurity. And on the 10th and 11th, the Cloud Security Alliance is holding a CCSK training. Yeah, and this is actually a paid training. It is reasonably priced, but I do know that those CCSK trainings from the Cloud Security Alliance, there's a minimum cost, so it's not like they're, they're trying to charge a whole bunch.

But they, as part of that, I believe you get the token to take the certification test for the CCSK. That's great. So that's actually all we have for events. So let's move over to jobs. The first job we have, S&P Global is looking for a Director of Information Security and IAM Product Manager.

DigitalGlobe, one of my favorite companies coming from the former satellite world, is looking for a Director of Cybersecurity Operations and Engineering. Awesome. KPMG, which actually had several similar positions to this, is looking for a manager of cybersecurity services in privacy. There were also a couple others. I think one was IAM and other things like that.

So if you want to work for a consulting company, check that out. Also back in the defense and research space, Lockheed Martin is looking for an embedded cyber hardware researcher. Doesn't that sound cool? I generally know what those types of people do, and yes, that is going to be very cool. Aetna is looking for a senior information security compliance consultant.

Amazon is looking for a security transformation consultant. Again, very cool sounding job, right? Very cool. I want to do security transformations. Chairwell Software is looking for an IT security architect.

Of course, Chairwell does ITSM, ITIL kind of software, kind of like ServiceNow. We used to share an office with them. Oh, nice. Tri-State Generation and Transmission is looking for a cybersecurity analyst, either 1, 2, 3, or senior. Yeah, so I think that they have multiple positions there.

Uh, Reed Fudge is the security leader over there at Tri-State, and I know that they're building out sort of a security operations center, so I'm guessing that they have multiple roles here of multiple levels that people could get. It's a great opportunity. Uh, Nelnet is looking also for a security operations center analyst. And Sumo Logic is looking for an enterprise sales engineer in the security space. So if you want to sell security software, log management, sort of SIEM in the cloud, sign up for that one.

That's the place to be. Awesome. So that's the, the jobs for this week, and that takes us to the end of the newscast. We will now move over to our feature interview, and that this week is with Nathan Mondrow. He is the CEO of a company called LockState.

And they make smart locks, and they also do a platform for managing smart locks and other smart devices. So it was a good interview that I had with him. So Brian, thank you very much for coming in co-hosting. I'm sure we'll have you back another time, but great job. Great, Alex.

Thanks for having me. Awesome. Thanks. We'll talk to you next week.

Hello, this is Stanton Meyer, CSO of CoBank. Welcome to Colorado Equals Security. For Colorado security professionals, by Colorado security professionals.

This is Alex Wood with Colorado Equal Security, and today I have a very special guest. I'm here with Nolan Mondrow. Hi Nolan, how you doing? I'm great, thanks for having me on. Awesome.

This is a little bit of a departure from what we normally do because we are, you know, normally talking to companies that are directly in the information security space, but you're the CEO of a company called LockState. And so you guys are more in the physical security space, but it's also, you know, by nature, since you're a connected device, you're also in the information security space. What we normally do is we'll talk about you and your background, so why don't we get into that first? Sounds good. So how did you get started in your career, and what'd you do to get to being CEO of a startup company?

Yeah, well, I'll give you a quick arc to save some time, but after I graduated college, I started my first business actually in Japan, ran an import-export company, moved that back to the States and did that for about 7 years. And I went back to school to get an MBA, mostly because I needed to learn how to think inside the box. And, you know, I've been thinking outside the box my entire career up to that point. So in business school, they like to brainwash you and make you think you need to go back and work in a large corporate organization. So I was obedient and graduated and went to work for— doing business development in larger companies, what was then US West Quest, local telecom firm, then some software businesses until I jumped back out to be an entrepreneur at around 2002, and that's when I I sort of got onto this path.

This company was founded in its original form in 2005 as an import company and an e-commerce business. We sold those assets off in 2011, and that's really when the current state of LockState and our Remote Lock brand was launched. So that's the real quick arc. So we were talking before the show, you mentioned that you're from Colorado. How did you end up in Japan?

Well, I ended up in Japan because in college I studied Japanese for a couple years, really wanted to learn the language, and the only way to do that with Japanese is to go over there. So I spent a year abroad junior year, loved it so much, and got really excited about the business culture at the time. So I came back, graduated, and then right after graduation I convinced a very gullible friend of mine to go over there and start a business with me, and, you know, and the rest is history. Did that gullible friend know Japanese also? Uh, no, he didn't.

No, he didn't. A treat for him. It was great. He, he left me a few years after that and, and went to work for the CIA, so I must have twisted his mind. So he was actually a spy over there?

Maybe. Yeah, I never really did the background check before we started business together. I should have. Nice, nice. So So why don't you tell me a little bit about Remote Lock and LockState?

Yeah, Remote Lock is a platform that— it's a software platform, SaaS platform, that controls door locks. And we partner with companies in certain verticals, like in the vacation rental space, Airbnb, VRBO, Expedia. The way those work is if you book on Airbnb or VRBO, They'll dip into our system, and then we give the guest the door code that will only open their rental door when their vacation starts, and it'll expire when their vacation ends. They can't get in early. They can't overstay.

It's a really huge problem that we're solving in that vertical space. The software was architected in a really extendable— with a really extensible architecture. Lots of other verticals have really come to us and asked if they could also use the system for other business problems that they found in, in their vertical spaces. And so we spent a lot of time both addressing business needs and also developing a really robust API so that not only can you use our application to control any kind of access in the physical world— locks, elevators, parking garage gates, what have you— But you can also take our API and control locks from within your own software if you so choose. So it's very, very flexible.

And so are the locks that you're controlling, are these your own locks or are these any brand of locks or how does that part work? It's both. So it's our own locks because we were the first company to make a Wi-Fi controlled door lock. Back in 2012 is when we launched that. That.

And we did that because nobody had it on the market, and some of our vertical spaces really needed something that didn't have any other equipment required and just connected to the internet. And, and yet what we realized is there are all kinds of different doors to a building that we needed to address and control from the internet. So we started onboarding all these other locks and other access control systems to be able to handle any door in any building from, you know, using remote control. Yeah, that's really cool. I, I do have some home automation products and other things myself, and it's always a pain in the ass when you get something and it's like, oh well, I have, I have to go to this one app to control my, uh, you know, my camera and this other app to control my thermostat and this other— and you've got this whole ecosystem not just of products but of control points and software and, you know, all that kind of stuff.

It is probably still one of the predominant problems, certainly in home automation, you know, the one you just brought up, because there's just not a very good, in the home automation space, consolidated app that just controls everything. And people are moving in that direction. We focus— while we sell thousands of locks in the residential space, our real focus is in the commercial space. Yeah. And We've got some very large customers who have recognized the value.

Some of them would be like, you're familiar with the chain of Target stores. They use our system. There's the largest company in Oklahoma, a company called Love's. They have, maybe you've heard of them. Now that I mention it, you're going to see them all over the place if you haven't.

They run these truck stops all around the country. They have a really funny application. That they use the system for, but it's all along the lines of what you're talking about, consolidating different locking technologies. But they use our system to control all their showers that they rent out to the truck drivers. So now, it was a problem.

Managers were renting out showers, giving them away for free, keys were getting copied or lost, showers were locked out, and they were losing revenue. They lost millions of dollars of revenue on an annual basis. Right. So now they're able to— it's all automated, and they use this system to make sure that the truckers roll in, select a shower, they get a time and a code, and then they get in. And when they're done, we notify the janitorial staff to go clean it.

So it's a really— it's a real problem-solving technology. So was this a conscious effort on your part to go down the enterprise business side as opposed to the consumer side? We are definitely trying to solve a problem. I think what happened in the consumer side is a lot of people got enamored with gadgetry in home automation, and maybe the original early adopters were more about, you know, look what cool thing I can do with this, rather than, gosh, I really, really need to get this thermostat, or I really need to get this lock. So what we found is when there's a business problem, the, the buying obstacles and selling obstacles are almost nil because we're actually solving a business problem for these folks.

And that's why we focus our marketing and our messaging in that area. Yeah, no, that makes sense. Um, so since this is an information security focused podcast, let's pivot a little bit. Enough about showers, right? That's right.

No problem. Uh, you know, you know, you have to have security in your showers, but there's, you know, one would hope. But, you know, if I'm in the shower, I don't want someone on the internet to be able to open my shower door while I'm in the middle of a shower either, right? Absolutely. So I wonder if you could just start in general to talk about what you guys do to make sure that your devices are secure from an internet security perspective as opposed to a physical security perspective.

Yeah, and obviously we get this question all the time because because it's one of the first things that pops into people's heads. And you're dealing with multiple technologies, right? You're dealing with security on the internet, you're dealing with hardware security, and then you're also dealing with a human factor of security in support and people who might have access to the system. So we, we have had to take steps at every one of those levels to make sure that the platform, the data, the locks are all secure. I can give you kind of a couple examples.

We're using bank-level 256-bit encryption to make sure that when messages get passed back and forth that those are not hackable. We have on the hardware side some— and obviously I'm not going to go in detail all the things that we do, but I can give you kind of a flavor of some of them.

We have a method of identifying packet sequences so that if something's already arrived at a lock, for example, we will not allow that same packet to be accepted. And so that prevents— even if you get through all the encryption and you sniff something and replay it, it's still not going to have an effect in the end. And then, of course, we encrypt it all the way up and down the stream to make sure that there's no point at which anybody could hack into that. Then back to the human factor side, we do multi-factor authentication for our users. We have very sophisticated logging inside the application.

If somebody has sent a code to an end user, we log exactly whose account was logged in, from where, that kind of thing. We're very holistic about how we approach security. Yeah, and I'm thinking a little bit too on the, on the hardware side too with the locks that you guys build. Um, do you feel like the, the ones that you guys build are more secure than, uh, than other vendors' locks? Are there steps that you take on that, whether it's, you know, choosing the, uh, you know, the, the wireless protocols that you use, or, you know, making sure that the locks themselves are tamper-proof, other things like that.

Maybe if you could speak to that, the hardware side of it too. Yeah, and I should highlight also that we control many other people's locks as well. So the security that we have on our own hardware may not be the same that another company uses, so we'll match the security that's possible on the hardware that we're using. And the software in the system can rise to that level, and that can go all the way to things like— there are different ways to open a door. We call it credentialing, but it basically means you can use a PIN code, you can use an RFID badge that many of us have probably carried around if we've worked for organizations that use access control.

You can even use biometrics like fingerprints. And if the lock is capable of that kind of authentication, we can match that in the system to be able to require it. So we really try to rise to the, you know, I don't want to say least common denominator, but whatever is possible in each of those areas. Nice. Yeah.

What do you feel about the overall state of security for not even just security devices, but, you know, IoT or other things like that in general? General. So there's lots and lots of devices out there that are connected that we want to make sure that they're secure. You know, you guys play in this space every day. What do you feel like the overall environment is for the security of devices in general?

Well, as you know, security is really not a question of 100%. It's a matter of how much. And usually the equation has to do with how much do I want to spend on security versus how much security do I want. There's no end to the measures you can put in place. And so the real trick in the things that we do in the business application is to match what we think is the right amount of security with the application.

For example, if you are trying to protect a storeroom with nothing very valuable in it, then you probably don't want to have multi-factor authentication both in the, you know, on your mobile app every login and as well as at the lock because the convenience that you're looking for with access control is more about allowing people in than it is about keeping people out. Now flip that when you're talking about an external building, maybe at an office where you do want to have a higher level of security. So I think in terms of— you were asking about IoT in general. It's going to depend on what application the products are developed for. And so we'll go back to your home automation comments earlier.

If I'm looking to use home automation as a real nice convenience and I want to do that, do things like turn my lights on in my home, I'm probably not going to be as diligent about what kind of security is involved versus if I'm actually putting it on, let's say, a door lock or something like that. So I think the application is really important when we start talking about what, you know, how is IoT in general, what's the level of security in the current state. Yeah. As part of folks using your software, do you also, you know, either advise or consult with them on the on the hardware devices that they should be using? So, you know, you said you can support a lot of different hardware devices.

If they say, hey, we want to use it for this particular type of application, are you— do you then consult and say, hey, okay, well, this brand over here, we know that it doesn't do X, Y, and Z, and based on your application, maybe you shouldn't use that brand or something like that? Absolutely. I'll give you one example of one of our partners. It's a company called Mercury Security, and they're the most widely distributed access control panel, I think. I guess you have effectively quoted me on that since I'm on record saying it, but I was gonna say don't quote me on that.

But I think they are the most widely distributed security panel, at least in North America. And so if somebody wants to use that panel, then we have, a lot more at our disposal in terms of what we can suggest to them. Everything from how you secure it to how many users you're going to allow to have access and things like that. So you're right, we absolutely follow the application that the customer is asking about and make suggestions about an appropriate lock or access system for that for that need. And going back to the example of the storeroom, that's obviously going to be a much different locking mechanism than something that you're going to put at the perimeter of a building or to a secure floor that you want an elevator to go to.

So it's a— it really is so specific to the application. You're right. Yeah. Do you ever come to a situation where you recommend against using a connected or a smart kind of device for any kind of particular applications? You know, I will say that the majority of access control is about how do I let people in, right, and less about how do I keep people out.

And it's sort of, if you think about it, all of us are sort of guilty of this, you know, this illusion where we might put a heck of a door lock on our front door and right next to it as a big glass window. I think that trying to have the conversation be about what's acceptable in a worst-case scenario, or what are you trying to accomplish? You want to let people in and know when they're in. You want to know when the lock is tampered with, somebody's adding codes in. It's a lot more about the data that you're getting from the devices and the human behavior, which I think is a better way to approach security than trying to have this really hardened exterior.

You know, you'd much rather know if there's a pattern emerging that seems risky, which is another thing you can do with our system to collect that data. You know, for example, I see that the cleaning crew went into the office 3 times after midnight last night. That's not normal behavior, that's unusual behavior, maybe I should check that out. Or maybe I want to configure in our software a notification that says this is a strange event, notify me if this strange event happens. Yeah, that's interesting stuff.

Are you guys doing more around analytics and things like that? In the information security world, people are trying to move to what they call risk-based authentication, right? So if I'm going to a website, maybe I just need to put in my username and password, but if all of a sudden that I am connecting to that website from China, okay, well maybe now I need a second factor or something else. Right, you need 2-factor, right. Are you guys doing anything around that kind of thing?

Absolutely. It's interesting because the physical security world probably to some degree mirrors the cybersecurity world in that respect, and It's just beginning. I won't say that we have deployed it widely yet, but the concepts like you just brought up are totally— they're things that we've come up with and we're collaborating with customers about. For example, if you've got some particular employee who tends to leave at a particular time every day, you identify those patterns and say, That's unusual. I'm going to maybe require that this person has more than one authentication method going forward.

There's all kinds of things you can do now. Now the question is, how do you actually implement them so that it doesn't become too inconvenient, and yet it also enhances the real security and not just security theater? Right. Yeah, we don't want security theater. Everybody hates the TSA and no one wants more security for things like that.

Right.

So what is sort of the future that you see in this space? I feel like we're still— things are progressing, but we're still sort of at the infancy of connected devices. And there's all kinds of gadgets that are coming out. There's obviously new applications of this? What do you see coming up in the future?

Yeah, and I'll answer it in 2 parts because I think there's one, one is just IoT in general, and I see that you kind of hit the nail on the head when you're talking about what do you do with the data. It's been something that the industry has been buzzing about for the last few years, and I think we're finally beginning to see real business applications for collecting collecting data. And when I say data, I'm talking about information that comes from not just door locks but any other IoT device in the field. That can be water sensors or motion sensors or temperature sensors or, or vibration sensors on machinery so that you can move into predictive analytics and, and try to determine when an action needs to be taken. So I think that is obviously the next frontier in this space is making the data valuable enough to the customer and creating business models around that.

On the access control side, I actually— one of the reasons we're diving headlong into becoming what we see as the middleware for access control is because we see that it's really difficult to have an integration with every single connected lock or access system that's going to be out there. And so it's virtually impractical or impossible to control every lock that you might want as an end user. So our real goal here is we want to be that middle layer. We want to be this agnostic layer between all of the connected locking devices out there and anybody who wants to use it either through our application or taking our API. And using it for their own purposes.

And so that's where we see the future of access control. Do you see yourselves moving beyond access control to other connected devices, or just, hey, let's stick in where we, you know, our sweet spot is? I'll tell you, we, we do get pulled there, and we keep— we are really diligent about trying to stay focused on being the cloud smart lock access company. That said, we have some verticals, vacation rental is a perfect one, where it's so important, and again, you brought this up earlier, it's so important for these people to be able to control all their devices from a single app, even though it's for business use, that we do do things like thermostats and water sensors and motion sensors. So we do control those things on our platform as well, even though we always lead with access control.

Nice. Yeah. So changing gears a little bit, This is Colorado Equals Security. You guys are a startup here in Colorado. What is— what's your feeling been about the startup community and running a small business here in Colorado?

Well, I obviously love Colorado. I mean, I was born here. I came back to live here, raise my kids here, and we've been very involved in this community because first of all, both Colorado the state and also the city are extremely friendly and helpful to businesses that want to grow here. We've been— we participated. They ran a program called the Denver Scale-Up Network that we were part of, and that's— they select— the city of Denver selects a group of companies that they want to help scale to the next level, and they engage with them, introduce them to various tools, resources around the city, introductions and things like that.

We went through that program as, you know, in the inaugural class, and we stayed so heavily involved. We were actually just— we won one of the spots for Colorado companies to watch that we're really honored to get because it reflects both our commitment to the state and also that we think this is the place to grow. Grow a business. And a lot of people on that score are trying to figure out how you, as a growing business in Colorado, you attract talent. It's one of the biggest topics these days.

Unemployment is, you know, is really low, as all of your listeners will know. And if they're running companies, they'll know it even more poignantly. But yeah, we're— I think that's one of the biggest challenges in Colorado, a lot of people will move here for the lifestyle. And so that's where we also look to maybe draw more talent as time goes on. So I assume then that you guys have had challenges in getting the appropriate staff.

Is that a fair assessment? I would say we are— I feel lucky. We really have— We've had really great success in attracting people. We try to have a culture here that is extremely collaborative.

One of our fundamental values is that you should enjoy what you're doing. If you're not enjoying where you're at, if you don't enjoy getting up every day and going to work, then that's not gonna be a successful company. And so because of the fact that we focus really heavily on that, And we also are pioneering a space that brings all kinds of new learnings for anybody that works in the organization. I think those are some of the things that have helped us become successful. But yes, we see a big difference in 5 years ago and today.

For example, when you're trying to field a position or fill a position, the number of applicants is a lot fewer. The, you know, and I'll tell you one thing that I'm aware of acutely on a daily basis. There's probably not an employee in my organization who doesn't get called repeatedly by recruiters, you know, asking if they want more money or this or that. And so we, we need to, we need to be a place of choice. I think everybody is starting to realize that in Colorado.

Do you see any good solutions to that problem? Is it just trying to pull more people in from other areas? Is it education? Is it, you know, what would solve that problem? Well, education is definitely one of the areas that I think solves it to some degree, meaning if we are deficient in a lot of development talent, then we need more developers.

And so I think organizations, you know, that are working to let people retool are helping the problem. You know, some of it is just basic economics. I mean, we're in a booming economy right now, and, you know, and that'll make it a little more difficult. But I do think that, you know, there are some things that are being done both at the city and the state level that help. Awesome.

Well, we're getting close to time here. Is there anything that we haven't talked about yet that you wanted to make sure that we touched No, I think you've been pretty comprehensive. I think it's been a good chat. I should note, just from the plug perspective, I guess, we are branding ourselves as Remote Lock, the product, even though the company was LockState. So if anybody wants more information about what we do, or even about some of the things we've chatted about, I'm happy to engage at any level, and it's www.remotelock.com.

Remotelock.com. R-E-M-O-T-E-L-O-C-K.

So there you go. So final question, if I'm going to buy a lock for my house, what kind of lock should I buy? It, you know, it really depends on for what you want to use it. Um, so I want to put on my front door, how about that? You have 2 choices.

You could go a deadbolt or a lever. And so you might— what we typically do if somebody wants to get some good advice, as we suggest, pop a picture, email it to us, and then we'll get a consultant on the phone who can actually look at what you've got and then walk you through where— what the solutions are or the options are and get the thing that's best for you. Nice. We could do that with you too since you're here. I'm sure we could.

Well, awesome. Thanks, Nolan. I appreciate your time. It's been great chatting, and this has been Colorado Equals Security, and we will talk to you next time. Great, thanks for having me.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, Remember, Colorado equals security.