Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for October 21st, episode 138. Uh, this is Alex Wood and I have guest co-host Brian Bear with me.

Hey, Brian. Good morning. How you doing? I'm well. How are you?

Wonderful. Robb is off on another whirlwind global traveling excursion, so Brian has volunteered to step in and be co-host again for today. So thanks, Brian. Hopefully this time— the last time Brian came, we actually recorded the newscast, and then I screwed it up and had to re-record it by myself. So hopefully I don't do that this time.

It wasn't you. I made a joke about blockchain. Learned my lesson. Never gonna do that again. Yeah.

Yeah, the blockchain gods, they were not favorable to us that day. Anyway, let's get to it. We've got a couple announcements before we get into this. We, of course, have a Slack channel, awesome place for you to come and talk to folks in the Denver security community, Colorado security community, that is, not Denver.

You can get there by going to colorado-security.com. We've got over 1,100 people in that Slack channel, lots of great conversations that happen in there. We also have a mailing list if you want to get notified when we have new episodes out and get that in your email. Go to the website and sign up there. We'd also love for you to subscribe so that you get the podcast downloaded in your favorite podcast player and rate us while you're there.

Let people know how great the podcast is. If you also want to tell a friend about Colorado EcoSecurity, that would be wonderful. Spread the word, get more people interested in the community. And if you want to go even beyond that, we would love it if you signed up as a patron through our Patreon campaign. Give us a little money to help defray the costs of putting this together.

All of the money from Patreon goes back into Colorado Equal Security. And finally, both Robb and I, and I'm sure Brian also, are very busy people, and it is getting harder and harder for us to record the interview portion of the podcast. So if anyone out there wants to do interviews for us, we would love that. We actually have one of those interviews this week coming up after the newscast. So good stuff there.

If you are interested in doing one of those interviews, please reach out to either Robb or I. You can get to us at info@colorado-security.com, and we will help you get going on that. So Brian, what do Generation Z and 5G have that go together. Definitely an interesting article to learn about how the United States' workforce is changing over time. And what I thought was most interesting is how that compares to other countries, especially those over in Europe.

It turns out that in the United States, our Generation Z, which is— I think they listed as people who are 22 years old or younger and currently graduating from college, That is a larger group of future workers than even Generation Y or us so-called Millennials have been. And that's great news for the US economy because as the Baby Boomers and next generations continue aging and draw more on government benefits, we need really strong workforce to help keep up with that. Yeah, definitely. It was interesting to see that both Millennials and Generation Z— I'm waiting for whatever their actual name becomes, are similar in size and both bigger than Gen X. So, we've got the big base of the pyramid there still.

As you mentioned, some of those other countries, you know, their birth rates have dropped. So, there are— they don't have those bigger generations that are coming forward and they're going to be in trouble when they have an inverted pyramid and you have a whole bunch of older folks that need to be supported by those younger folks. That is going to be tough. Yeah, it definitely is. And I think the tie-in to 5G was that when surveying that new generation and asked about what things were most important to them, they were big fans of wireless connectivity.

Yeah. Well, I think also, you know, talking about, you know, growing GDP and things like that, you can do— you can get more workers to continue to work, which we seem to be doing well at, or you can increase productivity. And I think that the 5G part plays into that as well, right? If we can have our, you know, wonderful ever-connected world, then potentially that can make productivity go up as well. Yep, absolutely.

Uh, next, Ball Corp is expanding with a $220 million aluminum cup plant in Georgia. So, uh, we've talked about this on the show before. Uh, it started at CU as sort of their first pilot, having aluminum cups to replace plastic cups, because we, we of course know now that disposable plastic things are bad. And having aluminum cups, aluminum is much more recyclable than plastic is, and so the thought here is that aluminum can be much better for the environment than plastic. Yep, very cool to see.

Good for them. We also have the continued Californication of Denver. We now have satellite offices for 22 of the major Bay Area tech companies. So think companies like Google, Apple, continue down the list. I think we have Slack coming in across the street from us downtown.

Facebook. Exactly. All those companies are coming to Denver, and it's drawn a lot by the fact that culturally we're very similar to Northern California. And it tends to be— I think it helps a lot that we're a good short flight away from those headquarters and easy to get to. We also have a very educated workforce, which helps.

People that are good at the types of jobs that they are looking for. And also, for a long time, it was much cheaper here than it was in the Bay Area. And while it is still cheaper, one of the things that is noted in this article is that costs are rising in Denver, and it's possible if they get to a point that it is no longer cheap enough for people to come here, then, then those Bay Area tech companies may start going to places like Kansas City and Minneapolis where it is even cheaper than here. We'll see. Yes, we will.

Also, our discussions continue to be the Colorado Equals Real Estate podcast as well as we keep talking about real estate and tech companies coming here. Exactly. Speaking of Bay Area tech companies coming, Concord, which is a contract management company, has signed a lease to put a headquarters here. They are, I believe it was about a 100-person company. That has doubled in the last year and they're looking to double again.

So actually, I think it said that they are based in the Bay Area and in Paris. So very exciting for them. Looking forward to having another company here to employ some more people in the Denver area. Absolutely. Very similarly to that, we have the Office of Economic Development offered additional incentives to another Bay Area tech firm running under a code name of Project Bolt.

Who is also looking to expand inside of Denver. Yeah, I actually, I like these EcoDevo articles partially because there's usually another thing that is stuck in there somewhere, not just the tech one. They're also talking about a company down in Wald County that is a chemical company that is doing chemicals for microplastics to aerospace And that one is listed as Project Lighthouse. So another interesting one there. Moving on to the next article.

Speaking of jobs, there could be 3,000 Medtronic jobs in Louisville. This one, I think that they already have, they're already planning, or sorry, they already have 2,000 and they're planning to bring another 1,000 jobs to Boulder County. They are potentially going to be redeveloping the old ConocoPhillips site. This was one of those sites that they put forward for the Amazon HQ2, which of course we did not get. But that would be pretty cool to have another 1,000 jobs up in Louisville.

That would. It's been almost 2 months since the Regis University cyberattack, and throughout the Denver campus, they're still putting all the pieces together. They've made it through reimaging hundreds of those machines so far. And, you know, one of the ways that one of the staff members described it as, we are rebuilding in days and weeks what took us originally years of infrastructure to go create. So definitely a tough situation to be in.

Yeah. I'm really looking forward to when the details come out about this one. I mean, looking from the outside, it seems pretty obvious that this was a ransomware attack. But there haven't really been any details about what exactly happened there. So I will be interested to hear as soon as Regus can talk about it.

They still don't have a whole lot of details because they say they're still working with law enforcement. But it does seem like a pretty tough situation for the people at Regus who are trying to, you know, do their jobs throughout this. Some big news on the Denver startup front. Overwatch ID was acquired this week by SailPoint, so congratulations to Cam and all the folks over at the Overwatch ID team. SailPoint does identity governance, and so I think that the Overwatch ID product will fit in nicely with the suite that they have over at SailPoint.

So good stuff to them, and hopefully they will do well with SailPoint. Yeah, great, great congratulations. Awesome to see. They didn't announce the exact sale price, but in the article, they— SailPoint also announced they were acquiring another company called Orcus, which I wasn't particularly familiar with, but it looked like they were doing some sort of SaaS identity management something. And they said that the total for both of them was $37 million or $37.5 million or something like that.

Anyway, congrats to Overwatch ID. Big congrats. We have a good article from Webroot on cookies, pixels, and other ways advertisers track you online. And especially how that then intersects with the privacy constraints and world we live in with GDPR and other systems. I thought it was an interesting article.

It's one of the many things that was very, very interesting to me as we started Red Canary and started to learn about how does online advertising actually work. Yeah. And the, you know, at first blush, the incredibly creepy way at which you can target the people who you think you can best serve with your company and how retargeting works and all these systems down to the point where I remember talking to one of the Bay Area tech company security teams and they said that as a joke they would actually use targeting on Twitter and LinkedIn to send direct messages to people at other security teams that they knew personally because of how finely they could target those advertisements. So that gives you an idea of how well you can actually target a saying. If you follow so-and-so or if you post on things like this, then you specifically should see my message.

So levels of it, I kind of went through the cycles of this is really creepy, okay, I can see how this is actually very useful so that I don't like— I'm trying to send you a message, right, and I'm not accidentally sending it to my mom instead, right? Like, Advertising is important. That makes it a lot more efficient. Yeah, for sure. Yeah, good article there by Webroot.

There's also a blog post by Manage Methods talking about 5 easy ways to detect a cloud account takeover. Some of those methods are login location, failed login attempts, lateral phishing emails, malicious OAuth connections, and abnormal file sharing and downloading. I think both this article and the Webroot article. Managed Methods a little bit less, but are more aimed towards your consumer type as opposed to deep technical articles, but some good points there on finding cloud account takeover. Very good.

Then we had a fascinating article from Optiv about just how big cybercrime actually is. We talked about this quite a bit before jumping on the recording here. According to this research, the cybercrime overall is at least $1.5 trillion in profits every year. Which seems to me like a lot. It is a lot.

It says it's significantly more profitable than the drug trade, which probably makes me now, as I think more about it, when we think about the profits of it, there's a lot less cost of goods sold, there's a lot less infrastructure you need, right? Like, you don't need the planes, you don't need all the bribes, Right. It is probably a much more efficient business. Yeah, you don't actually, you know, need to grow the coca, you know, none of that stuff. Exactly.

It's all right there for the taking. It's like everything you love about a SaaS business and tech companies that's infinitely scalable. There's also an infographic in here talking about if cybercrime were a country, and it would be the 13th largest economy in the world behind Russia, which is kind of crazy. This is based on gross domestic product, which of course led Brian and I down the road of figuring out how exactly gross domestic product is calculated. But anyway, you know, Russia is at $1.52 trillion for their GDP and cybercrime being $1.5 trillion.

It just edges out cybercrime as the next largest country. But, you know, I think it is interesting that, you know, some cybercrime happens in Russia and, you know, those numbers are awfully alike. So is— are we just saying that Russia's GDP is just made up of cybercrime, Brian? We don't know. We really don't.

We don't know. We learned that gross domestic product can be increased by government spending and is not offset by debt. So yes, there's a lot more to learn here. There is a lot more to learn here. All right.

Uh, that is the news that we have. Uh, let's jump over to the Slack message of the week. Uh, quick thanks to Andre Gaeta, who sponsors the Slack message of the week. He does this out of his own pocket, so we appreciate him doing that. He's been doing it for an awfully long time.

The winner of the Slack message of the week gets $25 towards an item in the Colorado Equal Security store. And this week's winner is Oliver Bagelman. Congratulations, Oliver. He posted an article. It's actually a little— not quite a new article, back from late September, about how the US hacked ISIS.

And I hadn't seen this story before. It was an NPR story, and it was just talking about the Special Joint Task Force Ares and Operation Glowing Symphony. It was actually a really, really interesting read, so I'm glad he posted that one. So we will get Oliver in contact with Andre so he can get his free stuff. And thanks to Oliver for being a part of the Slack community, and thanks again to Andre.

So let's jump over to events. We have got a metric crapload of events over the next 2 weeks, starting with on October 22nd, SecureSet is doing a beginner's capture the flag. Also on the 22nd, we're having an emerging tech with NVIDIA. Event going on. On the 23rd, the DevSecOps group is doing an event, How Fast Can You OODA Loop?

Also on the 23rd, ISC² Pikes Peak is having their October chapter meeting. Another event on the 23rd, ACES is doing a Security Officer Appreciation Night. On the 25th, down in Colorado Springs, we have the 2nd Annual Cybersecurity Summit for Small Businesses. Nice. On the 29th, Prologis is hosting a discussion around the China cybersecurity laws and how they will affect US companies.

That should be interesting. Very interesting. Also on the 29th, SecureSet is hosting their speaker series, An Introduction to Software Security with Tremaine Island. So on the 29th and 30th, the annual SecureWorld Denver conference is happening. That's a pretty big event that's going to be at the Cable Center.

Robb and I are actually going to be doing a live version of the podcast as one of the keynotes, so that should be fun. I am also moderating a panel on the afternoon of the 30th, I believe, so everyone come down and check that out. Great. What's the topic of your panel? It is on privacy, so it's going to be a security leader discussion on privacy.

Nice. That's great. IAAPA is having their KnowledgeNet updates and the top 10 things companies should focus on to comply on the 30th. The— oh, we— I just talked about this, but we also have a placeholder here for the SecureWorld keynote that we're doing. It is on the 30th at 9:30 AM.

So if you guys want to come to SecureWorld, the second day is when we are doing our keynote. All right, that's the day to be there. Yep. Colorado Springs is holding their Cybersecurity First Fridays on November 1st. And finally, SANS Security 504 mentor class with Mike Harris is happening on the 1st of November.

Also, this is a 6-7 week class, but they're doing it on Fridays, and this is the first one of those. So if you are interested in doing the SEC 504 class, this would be a great chance with someone local. So let's jump over to jobs. First job on this list, Brian, are there any Red Canary jobs that are open? We're going to talk in particular about the Senior Governance and Risk Compliance Specialist we opened up.

As we continue to grow, we do more and more risk and internal security and compliance. Would love to have great people join that team and help lead those efforts of making sure all of our customers know all the great work we do to defend their data we process and keep us in compliance. Awesome. Respond Software, which is a startup with a presence here in Colorado, is looking for a customer support manager. Guild Education is looking for a head of information security.

Aero Electronics has an IT risk student position available. Recharge Payments is looking for a security engineer. DaVita is looking for an IT security engineer, as is Front Door, looking for a software engineer focused on security. Johnson Controls is looking for a global information security awareness and communications manager. Our friends up at LogRhythm are looking for a principal threat research engineer.

And CenturyLink is looking for a software engineer in information security. I believe this is in their Black Lotus group. So you'd be probably working with Mike Benjamin over there. Very cool. And that is it for the jobs.

And that is it for the news portion of the podcast. We are now going to go over to our feature interview this week. And that is with Mitch Tanenbaum, who is a partner with CyberCecurity. That is CyberCecurity with 2 Cs. I've known Mitch for a while, good guy, and this should be a good interview.

Again, this interview was done by Jason Jaques, so thanks to Jason for doing the interviews. I think this may be the first time we've had him do an interview on the show, so listen to that. Look forward to how he does with it. So thanks again, Brian. Appreciate you being here.

You bet. Thanks for having me. And we will talk to everybody next week. This is Brian Becker, Director of Information Security at Cronky Sports and Entertainment. You're listening to Colorado Equals Security for Colorado security professionals by Colorado security professionals.

Hello, Colorado Equals Security. This is Jason Jaques. I had an opportunity to interview one of the leading experts of security and privacy. In Colorado. This man is well known in the community and he's a prolific blogger.

You can find his blog at the website cyberscyrity.com, replacing the S in security with a C. Here's my interview with Mitch Tanenbaum. Enjoy. How you doing, Mitch? I'm good, thanks. It's, uh, it's great to see you.

Oh, thanks. It's good to be here. Yeah. And you're, uh, you're coming to us from, uh, where again in Colorado? Well, I'm outside of Littleton.

I'm in the mountains, which I really love. I grew up, uh, just outside New York City, so for me, uh, being in the foothills outside of Denver is, is a great, uh, change. You know, you have this, you know, one of the most populous cities in, in the world, and you compare that to, um, you know, the foothills where your nearest neighbor is, you know, a mile away. It's a really different world. Yeah, that is.

I can't imagine having a neighbor that's, uh, that's that far away. I'm a city boy myself. So how did you go from New York City all the way to, uh, to Colorado? Well, I came by way of Texas. I, um, out of college, I went to work for Texas Instruments Defense Systems, which is now part of Raytheon.

And as I like to affectionately say, we built better bombs and missiles. We actually built the electronics, hence the software background. And so we were effectively a software company before software was the cool thing to go do. And we built some really incredible software systems. For example, one of the things that I did was I worked on the very first global positioning system before there was a GPS satellite launched.

So we had to wait for the Air Force to launch the first satellite in order for us to test our handiwork, which is pretty cool. You know, our objective was to take a fighter pilot who's going supersonic speeds, doing barrel rolls to avoid being shot out of the sky, and still be able to tell him where he was located. Wow. So was it, was it even called GPS? It was.

Oh, okay. It was. And this is, this is back when? This was back in the late 1980s, early 1990s. Oh, wow.

Yeah, that's pretty incredible. So one of the things we had to do was we had to figure out which side of the plane was pointed towards the sky at any point in time and reacquire the satellites we were looking for depending on which antenna we were using. Wow. Okay. Yeah, that's, that's hard to— it's very different than trying to find your local Starbucks.

Right. The other thing that was pretty interesting is, you think about your GPS right now, it's a little bitty chip on your phone that, you know, the whole phone fits in your hand. Our GPS was 2 equipment racks like you'd have in a data center, 6 feet tall, and fit in a bay of the airplane. Now granted, we weren't going for size at that point. We were trying to prove the fact that we could actually do it.

And given the amount of— think about the difference in the amount of compute power that you have now versus what you had in the late 1980s and early 1990s. And we were still able to tell a pilot who was doing evasive maneuvers where he was in 3 dimensions to within a meter. Wow. Wow. So why— that's why, by the way, an airplane can land itself now.

Yeah. Because you can tell an airplane where it is to within fraction of an inch. Wow, that's incredible. And that's, that's late '80s, early '90s. If you think about how they do road construction now, if you ever looked at the bulldozers, yeah, they have GPS receivers on both edges of the bulldozer blade.

Yeah, the driver is not driving, he's reading the comic book or whatever, you know, he's just there in case something goes wrong. The GPS is actually what's driving the bulldozer. Same thing with farmers, right? The GPS is, is plowing the field and telling them where to go plant the whatever, you know, seed he's planting. It's all done by GPS.

Yeah. And so a lot of these autonomous vehicles that we'll be enjoying in the coming decades, largely we can, we can thank you maybe, Mitch. Well, we were certainly the first team to go do that and, and in fact did prove that, that it was possible and it was possible to do it with, with vastly underpowered computer systems. Right. Right, yeah.

And, um, you were telling me, uh, that, uh, your first experience in IT was programming something that's in the Smithsonian. What? Oh yeah, yeah. What's that about? So I started, uh, being interested in computers when I was in high school, and we had a business computing class which was you know, sort of the, the next edition above a typing class effectively, had this really eccentric teacher who was teaching.

And we had some very old computing equipment that we were learning on. And, you know, from, from the purpose of, of what we were trying to accomplish, that was perfect because you're trying to teach, you know, high school kids concepts. So the equipment we had was things like an IBM 402 accounting machine and an 085 sorter. For old people who are listening to this, podcast. Um, and, and the way you program them was you actually put wires in boards that would, you know, tell the computer what to do.

And, you know, you— on a complicated program, you might have thousands of wires. And the way you debugged it was by looking at all these wires and trying to figure out, well, which wire did I plug in to the wrong place? And then you would take these boards You know, this is the version of a stored program computer. You would take these boards, put a cover over the board so no one could touch the wires, and put the board in a rack and put a label on it and say, this is the payroll program, right? Or whatever it was.

And then when you wanted to run payroll, you would take this big heavy board, you know, out of the rack where it was stored. You would physically place it in the computer, and then you would take the punch cards, which represented the data, You put the punch cards in and it would process it, and the way it would go off and tell you what the answer was, it would punch more cards with the answers on it. Yeah. Wow. I can't even imagine.

Uh, um, that's— let me put it this way. So my daughter, very young, um, she's not going to learn to program quite the same way. No, no. It's, uh, yeah, that's fascinating. Uh, and, and, uh I mean, I started my career in programming as well, and, uh, yeah, I, I've never seen anything like that.

So, you know, when I was out of college, of course, we were programming using, you know, it was really interesting. So, um, one sort of, and I think, I think he's passed away now, but, uh, the chief information officer of Texas Instruments at the time was a guy named John White, who's really pioneer in a lot of things that TI did. They were a very high-tech organization at the time. And we in the defense systems were the most compute intensive because we were like 10,000 engineers developing software. So we had to go build an environment to go support that.

And we did things which were really unheard of. We brought in virtualization. Yeah. And, you know, back then virtualization was an unheard of thing. You had the Cambridge Management System, which was built out at MIT, which was considered a toy by most people.

And CMS ran under VMware, which was an IBM operating system, not a VMware operating system, an IBM operating system that existed back then. And we were doing development in VM360 and CMS. And it was, it was really antithetical to the corporate computing mandate in terms of how TI, the rest of the company, did computing. And John White kind of turned his head and said, you know, leave Mitch alone, let him go do this because he knows what he's doing, which was, you know, I was very, very thankful for because, you know, politically it was, it was not a very popular thing for us to go off and be these renegade upstarts and, you know, build all these data centers and do what we were doing. But, you know, we had mission to be able to develop mission-critical software for, you know, various government agencies, defense agencies, and we needed a very different computing environment.

And just think about it now, everything is VMware, right? That's kind of, you know, the universe. And we were doing that back in the 1980s and 1990s. Yeah, it was unheard of back then. You guys were— it really was.

Yeah, pioneering things. Um, so what, uh, what What made you leave TI? Or what was— because you, you— that was in Texas, right? Right. Uh-huh.

And then, and then you left there to come here to Colorado. I came here to start a consulting firm. Okay. And that's really where I got into the security— well, that's not true. So let's take a step back.

I got into the security and privacy game at TI because we were a defense contractor. We were doing a lot of classified work. And even back then, the Department of Defense was very concerned that the— in that time, it was not the Chinese, it was the Russians. The Russians were trying to steal all our stuff, which they were. And we still had the problem back then, just like we do today with spies and people who can be motivated by money or can be blackmailed.

I mean, it was really no different. And so I was the guy who was picked somehow to go off and implement the Texas Instruments Defense Systems security strategy, what would now be called the CISO. But of course, that title didn't exist back then. And we were literally breaking ground because even the DOD at that point didn't really know what they should be doing. Of course, some people would say the DOD doesn't know what they're doing today, but that's a different conversation.

But back then, for sure, nobody knew how had to deal with this, and we were dealing with this. And there was some fun stuff. There was one point where there was a discussion between 2 different parts of the DOD as to cybersecurity, and the prime contractor on the program couldn't get these guys to play nice together, so they brought in a couple of folks from industry that weren't involved in this particular project. And they said, okay, you guys, we'll let both sides argue for the point. And it's actually a really— it's germane today without going into any details of what was going on there.

The issue was, can you bolt on security or do you have to design it in? And one side, one government agency, you can probably figure out which one it might be, one government agency said, No, you can't bolt it on. You must design it in. And another government agency said, well, gee, that's inconvenient and it'll slow us down and we won't be able to meet the schedule that we'd like to be able to meet. Sounds familiar to anybody in the software business or IT business.

Nothing has changed, you know, that whole conversation. And eventually, you know, we came up to the conclusion that, no, you really can't bolt on security. So that was, that was really my introduction to the world of reality because inside of TI, we were very focused on the mission and protecting the mission. If that involved security, then so be it. We just did that.

But in the bigger picture, and DOD is still wrestling with that today. They've just implemented the cybersecurity maturity model that they're just rolling out right now to build third-party certification of Department of Defense vendors because they're seeing that the defense industrial community is not implementing cybersecurity correctly and to the level of compliance that DOD needs to stop the— and now not the Russians, now the Chinese and the North Koreans from stealing our stuff. Right. Now, when you were working on this, Um, so you were working with another agency. Are you not allowed to say the name of that other agency?

I noticed you skirted around that. Yeah, it's probably better off that way. Okay, okay. All right, fair enough. But there's just different parts of the defense community.

Yeah, yeah, gotcha. So we'll, uh, we'll just kind of leave that, that as is. Um, so that's, that's fascinating. That's how you actually got started then in security and privacy. Then you asked me how I moved into Colorado.

Yeah. And we were— I started a consulting firm, a little boutique consulting firm that did software development and did organizational development consulting. And our main customer base was community banks, those small banks, locally owned banks that are, you know, dot the landscape in small towns in Colorado and Kansas and Nebraska. And those were our customers. And, you know, like today, You know, those guys do not have any cybersecurity capability.

Right. And they still don't. You know, they're dependent on outside service providers. And we were one of those service providers helping these small community banks protect themselves and implement their software systems. And yeah.

Yeah. So starting up that company then brought you to Colorado. I'm guessing at that point you became a Broncos fan. Or no, I, I am sort of sports agnostic. Oh, I'm not big into sports one way or the other.

I've got to throw that out because we are doing an interview for Colorado Equal Security, and, uh, since it's Colorado, you know, it's— oh, absolutely, it's Broncos. So, um, I've always got to ask people, you know, if they support the local team. Um, so let's talk about, let's talk about how you got into privacy because I know that you've kind of shifted gears from just security, and you're really going heavily into privacy these days. So what, what are your thoughts on that? Why, um, why is that the case?

Well, we, we believe that security and privacy are really joined at the hip. They're really two sides of the same coin, because in order to go off and protect people's privacy, you have to have security in place. Security is the implementing technology. And for most states, you know, all 50 states now finally have a cybersecurity law, although the laws keep changing from year to year. But basically the laws are, you know, all in place.

And now what we're seeing is a backfill of the privacy laws. Probably the most radical of those in the United States is the new California law, Assembly Bill 375, which is the California Consumer Privacy Act, which goes into effect in January. And if you think about what happens there, so that law says that, um, kind of like what exists in Europe now, that consumers have privacy rights. These are new rights that are written into state law. And if, uh, you know, the— there was— there were 2 alternatives in terms of how that CCPA came about.

One was a ballot initiative and the other was a law, and they opted for the law. It was a ballot initiative. It would have been actually enshrined in the Constitution of the state of California. In a ballot under the law, it's now just a law. But they, they have laws which say, for example, you have a right to tell a business that you don't want them to sell your data.

You have a right to go off and say, I want a copy of whatever data you collected about me over the last 12 months. I have a right to non-discrimination for services if I tell you that you can't sell my data. So how do you go implement those rights, right? Well, first thing is you got to go protect the data. That— and one of the other things that's in the California law is a private right to sue companies that have a breach.

So if a company doesn't protect the information successfully, consumers without showing any damages can sue a company for up to $750 per consumer who is affected by a breach. If you think about that, you know, a— you know, let's not talk about like a Capital One breach with 100 million records. Let's just talk about, let's say, 10,000 records, which, you know, many small businesses even would have 10,000 records. At $750 per record, that's a $7.5 million potential liability as a result of a breach that you have to pay out to consumers. And the only thing consumers will have to prove is that their data was breached.

Well, that's pretty easy. That doesn't require a rocket scientist. The big thing that has been the challenge in terms of in the courts is proving that you've been damaged. And in fact, some companies have argued, Well, how do you know it's my breach? There's so many breaches.

Maybe it was one of these other breaches that caused your data to be compromised, which of course is in fact hard to prove one way or the other. So the legislature in California just said, you know, if it was breached, you know, then you've been harmed by just by the fact that it was breached and you can sue for between $100 and $750 per record. You know, 100,000 records. Now we're talking about a $75 million potential a risk and a million records, which still in today's world is not a big breach. No.

You know, that's $700— potential $750 million liability. Now, what our law firm partners are telling us is they anticipate that this is going to generate a whole cottage industry in California. Yeah. And every time there's a breach, you know, some law firm that's in the business of, of, you know, being a plaintiff's class action firm, is going to go off and sue that company. So all of a sudden, people have a strong— people being businesses— have a strong motivation to go protect the data, to secure the data, in order to comply with the privacy law.

Right. Yeah. So on the GDPR side in Europe, did that also spawn kind of a cottage industry like you're talking about? Well, if you think about it, Yeah, I think the answer to that is yes. But the longer answer to that is, you know, we're starting to see the agencies, what are called the data protection authorities, are starting to sue organizations.

We just saw, you know, a $200 million, you know, whatever that translates in British pounds, fine against British Airways for credit card skimming. Breach, right? We saw a $125 million fine. I may have those backwards, but I think that's right. $125 million fine against Marriott.

And the Marriott was a very interesting thing, right? That was they acquired Starwood and apparently did not do adequate cyber due diligence. You know, companies will go off and do massive due diligence on things like, you know, the executive team, the employees, the, um, the customer list, all the financials, but they're really just beginning to learn about how to do due diligence for the cybersecurity of an organization. The net result of that was, right, the— in the case of Marriott, they had, you know, hackers were inside the Starwood system for 2 years prior to the acquisition by Marriott and for 2 more years after the acquisition. So for 4 years they were running wild inside the system and nobody detected it.

So we're, we're seeing, you know, from those large guys, the Polish Data Protection Authority fined, as an example, fined some local taxicab company something like €400,000 for not deleting data that they were keeping beyond the point where they could show they had a reasonable business interest in keeping it. So, you know, this is, this is just beginning, but we're definitely seeing much more interest. One of the things they said, and I don't remember the stats exactly, but the, the number of reports to the authorities of breaches went up like 8 times between the month before the GDPR went into effect and the month after. I mean, it was just an enormous increase. Now, you know, you're obviously not going to say that that was because of the fact that all of a sudden there were a whole bunch of breaches the month after the law went into effect.

No, what was happening is that people were reporting because now under GDPR there was this threat of a large fine, right, up to 4% in case of maliciousness on the part of the company, right, up to 4% of your total global revenue. Revenue. So all of a sudden now people were being, well, gee, we can't sweep this under— the risk of sweeping this under the carpet is greater than the risk of, of turning ourselves in and self-reporting. Now, they said, the, the Brits said that what they were seeing was roughly 2/3 of the reports were valid and 1/3 of the reports were overreporting. So from that perspective, this is, you know, okay, we're seeing a fairly significant number of these events, which the data protection authorities were considering legitimate events, and people are self-reporting that.

Now, does that mean that everybody's compliant with GDPR? No, it doesn't mean that at all. But it certainly is now all of a sudden on people's radar, right? Because they realize that the risk— and we're seeing, you know, the number of reports, because anybody, you, me, assuming we lived in the European Union you or me could go report a company, their, their bad behavior to the local data protection authority. And, and then, you know, the data protection authority has to figure out, you know, who are they going to go investigate and who are they not going to investigate.

But, but in the, like the first year, the, the, the DPAs collectively had received something like 60,000 or 70,000 complaints. Wow. From people. Now, obviously they have no way to go investigate, but they can go see trends out of that. And if they see that they're receiving a lot of complaints about a particular company, you know, separate apart from whether there's a breach involved, they're likely to investigate just because, well, you know, if there's smoke, there might be fire.

Right, right. Okay. So what I've always been curious about is, is how GDPR and now, you know, the California— do they call it the CPA? CCPA. CCPA.

How does that actually impact us here in Colorado? Great question. All of those laws are based on where people live as opposed to where the company is doing business. So if you're, you know, on the way up here, I stopped at the, at the local bakery that's down the block. Right.

They sell all of their baked goods in Colorado. Right. It's highly unlikely they ship their baked goods to Nebraska or California or anyplace like that. Most companies don't have that luxury. Yeah.

Most companies, their customer base is pretty global. I mean, I was in Lithuania a couple of months ago working with one of our clients there. So, you know, the concept of locality doesn't really exist anymore. If you assume that every one of these states view their purview is to protect their citizens, if you are a software company, for example, and you have a web-based product, it is likely that you have California residents who are buying your stuff. Yeah.

If you are, you know, an online company that sells whatever you sell, it doesn't have to be an Amazon. It could be you know, I'm selling, you know, baby dolls. It doesn't make any difference. You know, you likely are shipping to customers in California. And we are seeing, you know, in this past legislative session, there were 10 states that had bills that were, you know, similar in nature to GDPR or CCPA.

And, you know, different ones got passed. Nothing, nothing as extensive as California, but It's likely that other states will do that in the next year or two. So it's really a function of where do your customers live? Okay. So do you, do you think Colorado will pass a law similar to that?

It was interesting. I was, I was listening to the, the interview with Dan Petrigallo that was on Colorado Equal Security a couple of months ago. And he said, no, I don't think Colorado is ready to do that. And he might be right. Yeah.

Although I don't know that, you know, Dan can certainly provide advice to the legislature, but, you know, he's not passing any laws. Right. So it's really up to the legislature. You know, Colorado did just pass House Bill 1128, which interestingly enough, one of the things that House Bill 1128 did is it specifically called out local and state governments for having to comply with the privacy and security law that, that, that is. So, you know, what, what Colorado did was, was, you know, and I sort of get perturbed by this.

It says, you know, you have to have reasonable security given the risk that's involved. And for a legislator, that's a, that's an easy cop-out, right? We don't have to go figure out, you know, what, what should, we tell people they need to do and what should we not tell people to do. In California, under CCPA, the, the, at least the legislature forced the Attorney General, although he wasn't very excited about it, forced the Attorney General to, uh, provide a set of rules, which he just, uh, published last week. Under, uh, House Bill 1128, the Attorney General is not required to give any guidance, although Dan says that their plan— they are working on, uh, uh, guidance, as is, uh, the CISO Deb Blyth, who was on this podcast a while back too.

Uh, you know, she says the state's working on guidance for businesses as well. Uh, neither one of those are saying— which is fine, I'm fine with this— neither one of those are saying that you should interpret this as a get-out-of-jail-free card, that if you do X and Y and Z that we tell you to go do, then you know, you're not going to be in trouble in violation of law, but at least it's giving guidance. Right. Right. New York just passed the New York SHIELD Act.

And the reason why I call out all these different laws is because most companies are doing business in a variety of states. Oh, for sure. Now, New York and California represent, you know, tens of millions of people, right? Probably, what, 50 million people between the 2 states? Yeah.

And it's likely that you're going to have customers in one or both of those states. Yep. So the New York SHIELD Act took a law which was probably before that the most proscriptive cybersecurity and privacy law in the country, which is called DFS 500, which regulates financial institutions, and took it to every single business. If you think about CCPA, there's a couple of carve-outs for CCPA that say you know, if you're under $25 million in revenue and you have, you know, this exception, you have that exception, then you're not covered by CCPA. The Colorado law has no exemptions.

Colorado law, you could be a one-person company operating out of your bedroom and you still are required to comply with the Colorado House Bill 1128. Okay. The New York law does have some exemptions, but they're much lower than the California exemptions. And what they've done with the SHIELD Act is they took basically the requirements of DFS 500, which were designated for financial institutions, kind of tailored them and, you know, washed them a little bit and said, here are the 10 things that you must do as a business in New York, no matter what line of business you're in, not just a financial services institution. And literally, you know, you have to have somebody at the executive level who's in charge of security and privacy.

You have to have a written information security program. You have to have— you have to have these things. So we're seeing different states are implementing different ways. And, you know, from a, from a company that is in a multistate business, which I think most of the listeners to this podcast fall in that category, whether they're in all 50 states or they're in multiple states. Right.

The challenge is how do we go comply with that? Now, one suggestion would be that you have a national cybersecurity and privacy law and it overwrites any state and local privacy laws. I think that's unlikely to happen because the political interests at the federal level the amount of donations that can be given to politicians will cause any national law to be watered down. Yeah. If that happens, how do the politicians in states that have strong privacy laws— and Colorado is a pretty strong law, you know— how do the politicians in those states go back to their constituents and say, I basically sold, sold you up the river 'Cause I wanted campaign contributions.

That's a really difficult thing to sell when politicians go back home and run for reelection. I think that means it's unlikely in the short term that we're gonna get any kind of national law. Now what could happen is that the national hand could get forced if enough states go off and implement strong regulations similar to CCPA or something like that, or New York SHIELD Act. And then, then all of a sudden now there's some consensus to say, well, you're doing this anyway, so we're just codifying that at the national level and it's— we're really not causing any more pain. But I think until that happens, it's unlikely that we're going to see a national law.

I could be wrong. Yeah. But I just, I have a hard time, you know, because politicians worry about getting reelected and And how do you justify that? Yeah, I'm with you on that. I think as soon as critical mass at the state level has forced companies to adapt, that's kind of when— Now, that being said, the question is, let's assume that you're not doing business in California because you said, how does this affect Colorado companies?

You don't know what's going to happen next year. Right. So one strategy could be, well, we're going to wait and see. And, and as we saw with GDPR, there were a lot of companies who were scrambling when it came close to May 25th last year when GDPR came into effect because they said, well, you know, we'll worry about it later, right? The same thing is happening right now with CCPA.

You know, CCPA goes, goes into effect on January 1st. Enforcement is starting 6 months after the Attorney General released the guidelines, which was last week. So that will be roughly April 10th of next year. And one of the things that CCPA allows for is a consumer, you or me, if we lived in California, to go ask any company that's covered by CCPA, well, what data have you collected about me in the last 12 months? They could conceivably do that on January 1st.

Wow. And there will be— if you think about Californians, you know that there's going to be, you know, some group of the techies inside California who are going to go exercise the system just because they can. Right. They're going to say, well, I wonder what— now, of course, obviously, who are going to be the likely candidates? It's going to be the Googles and the Facebooks and the Twitters and, you know, those guys.

Right. Those are going to— those are going to be the first. But then they're going to say, Well, you know, there's this other company that I do business— it's easy enough. You know, you're required to provide, you know, 2 different ways of allowing people to go off and ask for it. And oh yeah, by the way, they can ask for a copy of their data, you know, up to twice a year for free.

Yeah. So it doesn't cost you anything as a consumer to go do that. Well, let me go exercise the system and see what happens. Yeah. And then if they don't get a response, because you don't— you have a limited number of days.

You have 45 days to go respond, and then you can ask for an extension. But you must notify the consumer within that 45 days if you want an extension, and you have to explain why it is. Not like, gee, we didn't think about this in time. That's probably not going to be considered a good reason for why you should get an extension. But for example, you know, there's some technical complexities of of what we're doing or something, which, which, you know, means that we need extra, extra time.

So, you know, I think there's going to be, you know, some folks that are, that are moving very— trying to implement very quick. And it's hard to go do. There's a lot of requirements inside of CCPA. There's training requirements for employees. There's processes, there's documentation.

You know, if you don't have a good data map today, You know, how are you going to do this? You know, if you have an incident, a breach, and you want to mitigate the damage, you better have a very good incident response program, which a lot of companies don't have. So you could go off and say, well, California is California and it's never going to go off and move across the rest of the country. But I would not have thought that there would be 10 other states in 2019 that were investigating that. One of the states that was doing that which to me, and you know, I lived in this state for almost 20 years and my wife was born in the state, so I don't mean any disrespect to it, but one of those states was Texas.

Yeah. And it's not, you know, a bastion of privacy that, that I think of. And, and they were looking at, and what they did is they created this kind of interesting blue ribbon commission to go figure out what they want to do, which has to report to the governor next year. But, you know, they were saying, well, why shouldn't we implement GDPR? And I was like, really?

Texas wants to go implement GDPR? You know, the land of free, you know, folks and, and, you know, cowboys, right? Really? They want to go implement GDPR? Boy, that seems like really out of character.

Yep. So you really don't know what state is going to be next and whether that's a state that you're doing business in. So you got really 2 choices. You can wait and then have to react, or Or you can go off and be proactive. Now, the interesting question is, for a lot of companies who are trying to figure out, you're only required to go off and do what's required by CCPA for people who live in California.

Do you want to, from a perception basis, do you want to go off and say, well, Jason, you live in California, so you're going to get the good stuff, but Mitch, you live in Colorado, so na-na-na-na-boo-boo. Yeah. You know, that, you know, from a, from a PR standpoint, that's probably not a really good strategy. Not to mention which, if you have, you know, if you do business in California and Nevada and New York and Texas and Colorado, you know, do you really want to go implement 5 different, you know, privacy regimes or do you want to just go off and figure out, you know, how do I go, you know, coalesce all of those into one coherent strategy and say, it doesn't really matter what state you're in. We're gonna go give you these rights and permissions, even though we are not required to.

From a sales perspective, that's a great thing. You know, hey Jason, you live in Colorado, and we're not required to go off and give you all these rights, but we're gonna give 'em to you anyway, 'cause we're just a good company. Yeah, so what do you see companies doing on that front to adapt to, you know, like you're mentioning, multiple states doing different laws? Are they, are they taking the standpoint of what laws are potentially the most strict and following those and building their governance around that? Or what are you seeing?

So I think everybody is doing different things, but I think the smart thing to go do and what we're counseling our clients to go do is take the strictest law and say that's the baseline. And then, you know, you may need to do a little bit of tweaking Like, for example, Colorado has a 30-day notification requirement, right? The closest state to Colorado in that regard is Florida. But with Florida, you can ask for an extension. Colorado, you cannot ask for an extension for breach notification.

So do you go off and say, we're just going to go off and make sure that we have our incident response ducks in a row so that we can really respond in 30 days no matter where the the residents are, because it's likely if you have a breach that residents are gonna be in different states. And do you wanna go off and say, you know, we're gonna send out breach notification to people in Colorado and, you know, in 30 days and people in Florida, we're gonna send it in 60 days, people in California, you know, that's like crazy making, right? From a, from a compliance standpoint. So I think, I think the only reasonable strategy in the long term is to go pick the strictest state. And, you know, right now, you know, California is in a fight with the feds because of their auto emissions exemption, which exists under the Clean Air Act.

And we'll see how that winds up in the courts. I have no idea. You know, but, you know, automakers have basically adopted the California regime because it's just easier to go pick one state and say, we're going to go build things pretty much the way that state wants it. And And not try to have, you know, different standards for different states. Yeah.

So do you find that you mostly work with, uh, like the, the CISO at a, at a company or organization, or are you working with, um, like a CPO, or who— like, I guess, whose, whose concern really is this? And maybe it's everybody's concern ultimately. So that's a great question, and, and, and let me answer it this way. You know, if we go back to the conversation you and I were having about governance. Yeah.

You know, really, this is a requirement at the highest levels of the executive team. And if the, if the company has a board, the— it is the board's fiduciary responsibility. You know, if there's one way a board can get sued is for breaching their fiduciary responsibility. The board has a fiduciary responsibility to make sure that the company is implementing reasonable cybersecurity and privacy protocols given the risk that the company faces. And that is a business decision, right?

It's not black and white. You have to go off and say, gee, you know, we could go spend $1 billion to go solve this problem and we could totally cripple the business, but by God, we'll be secure. You know, that's not a reasonable set of security measures. So So from a governance standpoint, that is, you know, what needs to happen. Our relationship is almost always with the CEO or the CFO.

And, you know, for some companies they have a chief compliance officer. We do a lot of work in financial services, so they have a chief compliance officer, you know, but every company has a chief risk officer. Now, the chief risk officer may not have that title on their business cards. You know, it could be the CEO because the CEO is signing the checks. It could be the CFO because the CFO is responsible for making sure that the budget's balanced, right?

And then income and revenue are in line with each other. But every company has a chief risk officer. Yeah. So that being said, every company needs a cybersecurity evangelist. If you remember back to the early days of Apple, there was a gentleman by the name of Guy Kawasaki.

You may remember, people probably remember him. He was pretty energetic personality. Now, Guy was not a, and still is, he's now a venture capitalist, but Guy was not a cybersecurity evangelist, but he was an Apple evangelist. And he was the guy inside the company that was responsible for making sure that the Apple ethos was, you know, imbued in the culture. What companies need is a cybersecurity and privacy evangelist.

This is not a full-time job. It is not a technical job, but it is somebody who has the ear of the executive team and has a passion for, for that particular problem, which is basically, I mean, if you think about it, it's really taking care of your customers. Right. The reason why you do security and privacy, yeah, part of it is because you want to comply with the law. Right.

But part of it is because it's the right thing to do to take care of your customer. Now you've got to figure out, you know, this is, this is not an on-off switch. This is a continuous throw dimmer. Right. You've got to go figure out where that dimmer ought to be for your particular business, given the sensitivity of the data.

And what customers expect from you and what you need to go, you know, be profitable and all that. I mean, it's, you know, but, but, but somebody needs to be evangelizing for the, um, the consumer and, and what the consumer is expecting. And if you think about, uh, both GDPR and CCPA, one of the things that they both say is you can only use the data that you collect for reasons that you disclosed at the time you collected the data to the consumer that you were going to use it for. And in the case of GDPR, it goes even further than that. It says if there are public records, you can only use public records for reasons that the person who gave the data to the public entity expected that record to be used for at the time.

So for example, if you have a public land record, right, a title or a mortgage or something like that that's recorded. You know, when a person went off and got a mortgage, did they expect that they were giving this data to the county for the purpose of somebody trying to sell them some product? Yeah. You know, probably not. When a, a company starts a new business and they register with the Secretary of State as a new business, and if you've ever registered a new business, you know, you get absolutely barraged by junk mail, where companies are trying to sell you everything.

Is that the reason why you went off and gave that data to the Secretary of State? The answer is probably not. So you need somebody who's going to be your evangelist, who is taking the side of the consumer. And one of the things we're seeing— we have a client I was just bragging on this morning. Who is a very small company.

It's 100 people, um, and they are kind of in the contract HR services, sort of vaguely in that, in that business. Yeah. Um, and so they have a lot of contract employees that they're responsible for, uh, who are legally their employees, but that's not part of the core company. Core company is about 100 people. They decided because their customers started asking them about cybersecurity last year, cybersecurity and privacy, that they better adopt a really proactive cybersecurity program.

And we picked a person in that organization who is not a technical person, but she really has a passion for this. And she's done a great job, just an amazing job in a period of one year. Done an amazing job at transforming the security and privacy culture of this company in a period of 1 year. And they have not spent a huge amount of money. This is not about spending— I mean, I'm sure if you went to one of the big, big 4 consulting firms, you could spend a lot of money.

It is not a problem. They'll be happy to go off and cash your check. But this is not about spending a lot of money. In many cases, this is about changing the culture of the organization. Yeah, because if you think about it, you know, one of the things that we recommend that people do is that, um, they have a very, very proactive anti-phishing program where they're sending out phishing emails, test phishing emails to their employees.

And even if you have, um, uh, you know, a, a fairly average failure rate, meaning people clicking on stuff they're not supposed to click, of say 7 or 8%. That says that out of 100 emails that a, that a real phisher sends out, 7 or 8 employees are going to click on it and maybe download malware or lose access, lose control of their credentials. That's enough to compromise the whole company, right? Right. You know, even if you get it down to 3 or 4%, you know, that's still a problem.

Well, one of the things we say is you ought to go off and have a very, very aggressive anti-phishing program. We have, you know, different clients do it different ways. We have clients who go off and say, well, you know, we send out once a quarter, it's good enough, you know. And that's kind of a— in my opinion, that's kind of a check-the-box sort of compliance thing. And we have other clients who send out phishing emails every week.

We have one client here in town where we went off and interviewed all the departments in this organization, a big nonprofit. And they said they were scared to death of these phishing emails that the IT guy sends out because, I mean, they're hard to detect. And yeah, and, and, you know, they're really proud I mean, he's really changed the culture inside this particular organization. They're really proud that they can go off and figure, oh, that's one of his. I'm not clicking on this.

It's not going to happen. And you know what? I'm even going to report it as a phishing email.

But that's a culture change. This last— this organization I was just telling you about that really shifted the culture in the last year, the last phishing test they sent out, they had 0% clicked on it. So now what they're doing is they're upping the ante. They're making the phishing emails more difficult to detect and, you know, to go off and kind of up the ante. And, you know, which is, which is a great thing, but that requires a culture, that requires a governance, that requires an executive team that absolutely supports that.

And in the case of this particular company, you know, we know and have relations with both the CEO and the COO. Of this company, and they are 100% supportive. In fact, at a recent team meeting— and she's listening, she'll know I'm talking about her now— at a recent team meeting, the CEO called her out and said, you know, this person, she's got my back. You know, that's what you want. You need that kind of support from your CEO.

I have other CEOs in financial services say, you know, here's the program. If you don't like it, I'll be happy to write your final check for you. Not a problem. You know, but, you know, those kind of CEOs are unfortunately in the minority and it needs to change in order to change the culture. 'Cause we are fighting a war with people like, you know, we look at, we just saw it, right?

The Fed just published the numbers. North Korea stole $2 billion from the rest of the world over the last year to go off and finance their economy. Their economy is not financed off of taxes, it's financed off stealing money from the rest of the world by cyberattack. You know, so if we don't go protect ourselves, if you go look at, you know, the Chinese version of the F-35 fighter, I think it's called the J-22. You know, if you looked at 2 of them pictured side by side, you would not be able to tell the difference unless you were an airplane person.

You would not be able to tell the difference between the 2. That's not a freaking coincidence. Yep. Yeah, it's crazy. So, uh, I know we're, uh, we're a little bit over time.

I can talk a lot. It's, it's fascinating listening to you. I can listen to you all day long. Um, I, I do have one final question. You know, I spend a lot of time in the emerging tech world, and I try to have my pulse on the startup community.

Great question. And after, really after talking to you, I've, I've, I don't know, I'm a little bit scared about that community and that world and how privacy and some of these laws are going to impact them and whether or not it's going to, it's going to slow down kind of that, that startup culture, that startup world. What's your thoughts there? A couple of things about that. So first of all, From a cost standpoint, if you build in security and privacy from the beginning, it's really not that much more expensive than not building it in.

The big challenge for these startups is going to be if their business model is selling customers' data without telling them, they really need to rethink that business model. Yeah, they're going to go, they're going to be gone. As long, in the United States, I think, As long as you're transparent about it, people seem to understand that there's no such thing as a free lunch. Right. And if you tell— why were people upset about Facebook and Cambridge Analytica?

Not because they stole their data. It was because they did it under the covers. They didn't tell anybody about it. Yeah. You know, everybody knows that Google makes their money by selling targeted advertising.

It's not a secret. Right. And I think even in those cases where companies make their money by selling data, if they are above board about it and they disclose it and they're honest, yeah, some consumers will probably opt out. That's true. You know, but the vast majority of the consumers probably understand.

Well, for one thing, you know, some people actually like getting ads. You know, I don't like getting ads for diapers. I don't need diapers. Right. You know, am I better off getting ads for things?

The thing, the thing that amuses me with ads is I get ads for the most part for things that I've already bought. Yep. You know, what good is that? I already bought it. I'm not buying another one.

So if they can figure out a way to go target ads for things that I'm actually interested in, right, that's kind of a win-win deal, right? I get ads for things I'm interested in. The people who are paying for the ads actually get people who might be interested in what they're selling and the consumers get services for free. Yeah. You know, so that, that's kind of, but you know, I think that the era of startups and I have one more comment after that, the era of startups where they are secretive about what they're doing, what they're doing.

I think that's a mistake. Yeah. But I also say, that these guys need to understand that the security and privacy laws impact them. Because like I said, in Colorado, for example, there is no floor. You're a one-person company operating in your garage.

You're still covered by the law. Yeah, you need to start thinking about that. And I know startups have a lot of things on their plate, but they need to start thinking about it because if you think about it later, it's going to be really expensive to go off and figure out how do I go off and retrofit what I've already done, which wasn't done with, with security and privacy in mind. How do I retrofit that? Right.

Or if they're, they're faced in a, uh, I guess worst case scenario fines and yeah, for sure. Things of that nature. So, and fines are, are an existential threat to small companies, right? You go look at British Airways, right? And they got $200 million fine.

They'll survive. You know, $200 million. Yeah. You know, it's a couple of percent of their revenue and they're not going to like it. You know, Facebook, $5 billion fine from the EU.

You know, that's one month's profit, I think, if I remember right, or one month's revenue, one or the other. You know, so they're not going to go out of business. Yeah. But if you're a startup and you get, you know, a $100,000 fine. Yeah, that's it.

You close the doors. It could. Yeah. Yeah, for sure. All right, let's, uh, let's, uh, let's wrap it up, Mitch.

I appreciate your time. Thanks for, uh, thanks for coming and, and stopping by and, and, uh, talking to us about security and privacy.

That concludes my interview with Mitch Tanenbaum. Again, you can find him at cybersecurity.com, but replace the S in security with a C. His blog and his contact information is up there, and feel free to reach out to him. Also, be sure to follow and support Colorado Equal Security on Patreon and follow on Twitter @CO_security.

I'm Jason Jaques Tech on Twitter and LinkedIn. You can connect with me and I'm always open to feedback. Thanks for letting me guest host Colorado Equal Security. I'll see you around. Learn more about the Colorado security scene at colorado-security.com.

Where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.