Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 137 for the week of October 14th, 2019. Alex, how you doing?

I'm well. How are you, Robb? I'm doing fantastic. It's, uh, it's It's a long weekend for us, which is kind of strange because it's one of those holidays that I'm not so sure we should be celebrating anymore. It's Columbus Day on Monday.

You know, someone said to me yesterday, hey, you know what? I totally forgot it was Indigenous Peoples Weekend. And I'm like, I forgot it was too. So I assume you do not get Monday off then. I do not get Monday off.

I do. I'm going to enjoy the day and celebrate all of the people. Yes, all of the people. All right, let's go ahead and move over into some news. We have a Slack channel.

We've talked about this once or twice on the show, I think, with over 100, excuse me, over 1,100 folks in the channel right now. If you wanna join into that fray of conversation, go out to colorado-security.com and click the Slack button near the top. We also have a mailing list. If you'd like to get notified of new podcasts via the show notes in your email, Go to colorado-security.com, scroll to the bottom, put your email in, and sign up for that mailing list. And since you're listening now, if you, if you had to go through a bunch of process to go like, how do I find this episode?

I've got good news for you. You can subscribe and have the podcast delivered into your favorite podcast player on your phone every week at about noon on Sunday when we post it. And if you like what you're hearing, we'd love it if you'd rate us on and review us on your favorite listening application. Also, please tell friends. We want more people as part of the Colorado Equals Security ecosystem.

So spread the word, let people know all the great things going on. And there's a couple of things you could do to help continue supporting us even beyond that. Number one, if you want to help pay— help us pay for the, the cost of the show, we would love it if you join our Patreon campaign. Help defray the costs of this that Alex and I have been, have been paying for the last 2 and a half plus years. And the other thing you could do for us is you could help do some interviews.

You know, we do— we'd like to have the newscast and then an interview with a local person on the show. Alex and I, you know, we have full-time jobs. It's not always easy for us to find time to do these interviews. It's fantastic for us when we've had a few different volunteers who've gone out and done interviews for us that we'll play at the end of the show. And, and of course, we get to meet some new people that way as well.

We love it. Exactly. Well, let's jump into the news. So, Robb, this week we set some records. Yeah.

Last week you told me that the average snowfall for Denver was what, the 18th of October? The 18th. And we shattered that average, blew it right out of the water. Yeah. First snow of the year came on— was it the 14th?

I believe it was the 14th. Uh, I think, yeah, Thursday the 14th. No, no, today is the 13th, Robb, so it's not going to be the 14th. Let's, let's do better math. Let's do better math.

So I believe it was the 10th. The 10th, yes. So the 10th we had our first snow of the year, and it was a pretty good one, right? It was pretty good. Uh, we had a few inches at my house.

Um, nothing incredible, but just the fact that it was snowing was pretty incredible. And the big news was the temperature drop. So we were at a high of 83 to down to a low of 13. That's a gigantic drop. That is the, the, uh, second largest, um, 2-day drop that Denver's ever had.

Um, and that was the first one was actually in 2008 when the drop— the temperature dropped 76 degrees, uh, between December 14th and December 15th. So pretty good, but it was definitely the largest drop ever in October. That definitely, that definitely record-setting in that way. Next, if we're going to talk about some kind of seasonal news, there's a story that we found kind of interesting about one of the local haunted houses here in Denver called the 13th Floor and how they use science to help make their haunted house more scary. Yeah, this is actually a video story, so it's something that you can go check out from 9News.

Talks a little bit about using psychology and how it is that people actually have it get a better mood from being scared. Yeah, pretty good stuff. So there's a little bit of a theme here for the first few stories. Scary temperature drop, scary haunted houses, and scary for beer drinkers. The, the Boulder Brewery has actually stopped distribution after nearly 40 years.

Yeah. So let's not go too crazy. They're not going out of business. They're just stopping their distribution. They're not putting stuff into cans.

You're not gonna be able to find it in stores anymore. Um, but Boulder Beer has been around for an awfully long time. Um, when I was, uh, first out here, I worked at IBM up in, uh, up in Boulder, and we would go to happy hour at the Boulder Beer Company. And, uh, while I'd still be able to do that, it's been always been fun to see their beers in stores. Um, so I was, I was super surprised to find out that this Boulder Beer Company is actually the oldest craft brewery in the United States that's still open.

They weren't the first to open. There was one or two right before them, but those guys have long since gone out of business. It was started by 2 CU professors back in 19— oh, I'm looking it up here. I think it was '79. 1979.

Yep. Uh, they got to be, uh, much bigger in the 1990s and the 2000s with, you know, favorites that I'm sure you know, Alex, like the Buffalo Gold and Hazed and Infused Dry Hopped Ale. Yeah. Um, always enjoy a good Buff Gold. Um, so yeah, sad that they're not gonna have those on store shelves anymore.

So if you're gonna want to want Boulder beer, you're gonna have to go up to Boulder to get it. Awesome. And for those who are kind of suburban type folks living in Denver, we have one more scary news story for you. Yeah, you're gonna get some, some new neighbors, I guess you could call it. There are permits out for many new 5G cell towers in Denver.

So these are going to be— they're not the giant cell towers like you think of, you know, huge poles with big antennas on them. These are a smaller version. They look sort of like a light pole. I actually thought that the one picture they had in the article, you should look at it if you're, if you're worried about these things being your neighbors. I thought it was kind of an attractive looking pole.

Like, it looks like for a pole, it looked all right. Yeah, it really was. Like, I wouldn't mind having that in my front yard, you know. And honestly, I don't think I would have a problem with having it there. You're gonna have light poles and stuff anyway.

It's just, it's one more pole. They are putting these at various places on the curb lawn in Denver. So I think if anything else, the— some of the, the, the problems people are having is the fact that with curb lawns in general, you know, if you live in Denver, the city owns that curb lawn, but you have to make— maintain it, take care of it. So if all of a sudden somebody comes in and puts a pole right in the middle of whatever you've done on your curb lawn, maybe that makes you angry. Yeah, I can definitely get that.

So just to be clear, it's actually not just in Denver that they're doing this. The headline says just Denver, but there's an interactive map in the story that goes into the suburbs it's happening in. It's, it's actually happening in quite a few suburbs around Denver. So take a look there and see if you're going to be impacted. And if so, maybe don't stress out until you look at it because it really didn't look as bad as I expected.

Or maybe you'll be excited because you'll have really good cell coverage at your house. So that, so that ends the scary portion of our, of our newscast. Moving over to some kind of good news here. Galvanize has So Galvanize is the local boot camp for training developers here in Denver. They have announced a partnership with the VA, the Veteran Affairs Association, to increase veteran enrollment.

Yeah, pretty cool. So this is through a new partnership called Vet Tech, Veteran Employment Through Technology Education Courses. And so vets can enroll in remote learning as well as campus learning using VA benefits to get some of these programs. It's a pretty cool program where the VA pays— well, I think they said they pay 25% of the cost at enrollment. They pay 25% when they— when this person completes it, and then they pay the other 50% when the veteran gets a job within 6 months of completing the training.

So incentives are really well aligned that the school wants to help these people get jobs. Right. And I really think it's a pretty nice program to use. It also sounded like there were some potential living costs that would be included in the program too, if you need them. So that is also cool.

Speaking of training, Ping Identity announced a technical certification program. Yeah, so this is a long-awaited, uh, thing that Ping's been working on. I've got to see the insides of this. Uh, we really wanted to create— we've always had technical training and ways for folks to, to learn how to use our products and so forth. However, now you have the ability to, to get tested and assured to say this person actually knows it.

Great for those folks who want to be able to put it on their resume and, you know, as they move to new companies, or for partners who want to have some kind of validity behind their professional services claims about working with Ping. Yeah, good stuff. Uh, next we have a post from Webroot around what are the online gaming risks for kids. This is written for parents, and I, I actually, you know, as a parent with kids who want to play games online, I, I took some time to read through this myself. Yeah, there were a couple interesting topics in here.

Uh, first talking about online bullying and harassment. Um, you know, while we know that happens in general, I think there may be a bigger opportunity for it to happen with online gaming because there are, there's chats involved, there's competition. They're so anonymous as well. Anonymous. Yes.

So there's that part of it. Um, I think as security professionals, we all know that there's a lot of viruses and malware associated with games, you know, whether you're, you know, downloading, you know, third-party cheats or something else, you never know what's gonna be in those. Um, also we, we've seen a lot of, uh, scams and account takeovers related to online games. Recently. I think it was, uh, was it Epic Games that has had something recently where they've had, they've had to reset people's, uh, passwords a bunch because of people doing account takeovers?

Um, so yeah, you just want to make sure you're keeping your kids safe and talk to them about these things. Yeah, good stuff. I especially thought that the online bullying had some pretty good tips in there and recommend you guys take a look at that and come up, come up with a strategy for how you're going to handle it if you do have these things pop up. Exactly. There's also a blog post from Zavilo talking about the conundrum between privacy and security.

Can you have both? Yeah, I don't, I don't feel like they really like solved the problem, but I am glad that they brought this topic up because this is something I've been thinking about a ton, is that in order for us to get more risk aware, more context aware, you know, reduce the, the burden of security, you really kind of have to move toward a less privacy-centric view of things. You're gathering information, you're getting behavioral information, you're getting all these things that put you you at odds with the push toward more privacy. Yeah. And I think both of these drivers are really moving forward full steam ahead, privacy and more context-based security.

And how do you really kind of balance those 2 things? It is a great question, Robb. And there's always going to be that balance. I agree with you that we didn't solve it in the several paragraph blog post that Zivilo put out, but it is an interesting topic. He does.

He actually, or the author of this Zillow blog post actually put a link into Daniel Meesler talking about these 2 things as well. So kind of an interesting, uh, tie back to another, another podcast and article we— or writer that we like to enjoy as well. For sure. Uh, Red Canary also had a blog talking about using visibility to gather context and find persistence mechanisms. Yeah, I love— I mean, they do such a good job really getting into the weeds.

And I think if you're in a SOC, if you're someone who's actually having to handle and investigate incident response. The Red Canary blog should be a regular on your to-read list. This is yet another high-quality, you know, actionable blog post. Yeah, they go super deep. Um, so that is pretty cool.

Um, talking about how, uh, using the, uh, the services, um, service in, in Windows to get persistence and some other things like that. So pretty cool. Yeah. Our last story of the week is from Coalfire. It's a blog post, FUD is Dead.

So if you're in security and you don't know what FUD is, Well, that's probably good. FUD is fear, uncertainty, and doubt. And basically what it means is, you know, Alex and I go into the executive meeting and say, whoa, well, if you don't give me that million dollars of new investment, you know, all the bad guys are going to get in and they're going to steal everything, right? That kind of like that binary idea that like you have to do it or else, right? Or the sky is falling.

We really need to do this now because the, you know, the end is near if we don't do this. And it's such an easy way for security people to fall in to make their case. And frankly, it's almost impossible for the business to refute because, you know, you're the expert. I have to trust you. So it is a, it is a dangerous thing, but it only works for a little, a little while.

Right? Right. Yeah. If you keep saying the sky is falling, asking for things and the sky never falls, well, pretty soon people are going to realize that maybe the sky isn't falling and maybe you're someone who they shouldn't listen to and shouldn't be at the table. So this blog post is written by Doug Hudson, senior director over there at Coalfire.

He's also a friend of the show. Interesting story. Really, I think that the question is, how do you— and what Doug talks about is how do you reframe these conversations in the language of your business, the risks that your business is dealing with? How does this kind of slot in versus, you know, time to market, competitive analysis, uh, you know, turning profitable, whatever it is that your business is trying to achieve, this needs to slot in versus those other objectives. Yeah.

And what are the good things that are going to come out of this? Right. So if, There is some risk you're bringing to them. We need to do this thing to help lower the risk. It's going to, you know, help us do these things because we are lowering that risk.

Yeah. So, good blog post there. I think another thing that's worth reading, especially if you're new to security and you want to avoid falling into this trap, I think it's probably a good blog post to get through. And that's the end of the news. Let's move over to the Slack message of the week.

Thanks to Andre Gaeta for sponsoring the Slack message of the week. He does this out of the goodness of his heart. And every week we pick someone who has had an interesting contribution in the Slack channel, and Andre will provide them with up to $25 in free swag from the Colorado Equal Security store. Awesome. This week's winner is Janelle Hsia.

Janelle, she won, she won a few months ago, but I loved her post so much that we got her back in here. She shared a post that anyone who is a member of ISSA, including ISSA Denver, ISSA Colorado Springs, or Northern Colorado chapter, can get a free membership to the I— struggling here— IAPP, the International Association of Privacy Professionals, for 1 year. So you can get into this privacy team as well as security if you're a member of ISSA. That is pretty cool. I have taken advantage of that offer and am an IAPP member thanks to ISSA.

Awesome. Well, Janelle, we'll get you your note. You can get your swag. Appreciate you doing that. Cool.

Let's move over to events. Uh, of course, uh, we do have an event calendar on the website, so, uh, check that out on colorado-security.com. Um, we have events all the way through, I know, at least March next year. I think March is where we're to, maybe farther than that. Um, I, I spent a bunch of time this weekend getting it updated, so there are a lot of new events.

If you, if you think you've looked recently, take a look. There's actually a bunch more stuff out there. And on the podcast, we like to highlight the, the next couple weeks of events. So first, on the 15th the Northern Colorado Cybersecurity Professionals are having their October meetup. Also on the 15th, the Cloud Security Alliance is doing their October meeting.

That's downtown Denver. On the 15th and 16th, ISSA Colorado Springs is doing their October chapter meetings. The 16th is a popular day. ISSA Denver is doing their, their special interest group around cyber threat intelligence. And what I heard is that they're also doing a little bit of a career fair at the end of that.

So if you're coming and looking for a job or you're looking to hire someone, maybe come to that event as well. Cool. SecureSet is doing a Hacking 101 Introduction to Linux also on the 16th. Also the 16th. DenSec, that's which is a kind of a less formal, just kind of a hangout folks for or hangout for folks who are interested in security.

They're getting together at a new location. They're meeting at Society Sports and Spirits. I think that's 7 p.m. on Wednesday the 16th. Nice. On the 17th, ISACA Denver is doing their October meeting.

Also on the 17th, the Colorado Technology Association is doing a cybersecurity risk compliance and insurance trends meeting. On the 19th, ISACA is doing their final review session for the CISA and CISSM exams. So if you have been part of that, this will be your last review session before taking the test. Yeah. So that Saturday, same day as the ISACA event, Colorado Springs ISSA is doing a mini seminar down in the Springs.

So if you want to get your education, you can do it in Denver or in Colorado Springs. Nice. On the 22nd, SecureSet is doing a beginner's capture the flag. Also the 22nd, the Emerging Tech Group is getting together for NVIDIA and emerging tech. Interesting.

On the 23rd, DevSecOps Group is doing how fast can you OODA loop? I assume that that is a hula hoop joke, and you're going to get to learn about OODA looping. If you don't know what that is, Google it. Next, On the 23rd, uh, ISC² Pikes Peak down in the Colorado Springs area is doing their October chapter meeting. Also on the 23rd, um, ACES is doing a Security Officer Appreciation Night.

And finally, uh, Colorado Springs has a— the 2nd annual Cybersecurity Summit for Small Businesses on the 25th. So good if you're— if your customer base is small businesses and you want to sell to them, I think you should probably go to this event. If you know someone who owns a small business and wants to learn about security, probably want to be there as well. Nice. So let's jump over and talk about some jobs.

First job is over at Ping Identity. We are hiring a GSI Alliances Manager. This is someone who's got experience working with those big GSIs, like, you know, your Accenture, your EY, Deloitte, KPMG, and helping establish a program between Ping and those companies. Twilio is looking for a Privacy Counsel. Slack is hiring a senior threat analyst, enterprise security operations.

Bank of America is hiring lots and lots of people, but one of those jobs is a cyber exercise coordinator. Cyber exercise sounds a lot easier than the kind of exercise that you have to do in the real world. I prefer cyber exercise to regular exercise. I can type commands all day long. Exactly.

All right. The Community College of Aurora is hiring a regular faculty cybersecurity networking. Glue is looking for a privacy analyst. Johns Manville is hiring a cybersecurity engineer. And good job, Robb, on not putting the S in the wrong place.

I know I always do. Raymond James Financial is looking for an information security systems admin for firewall. Sunflower Bank is hiring an IT risk management specialist. And finally, Mercy Housing is looking for an information security analyst. Fantastic.

So that's it for jobs. That is it for the newscast. We do have an interview this week, Alex. I understand you sat down with Price McDonald. I did.

Uh, Price is a friend and supporter of the show, and he is also a penetration testing director at Rapid7. So we talked a little bit about penetration testing and things that he does, and should be an interesting interview. I am looking forward to hearing the interview. And of course, if you guys have any feedback on it, go to the Slack channel because Price is there and you can get— you can give him a whole bunch of flack for whatever he says. Or kudos if it's good.

Kudos is probably better, yeah. All right, well, that's it. We'll talk to you guys again soon. Thanks, Robb. Hi, this is Colin Mariner, VP of Data Center Operations at HomeAdvisor.

This is Colorado Equals Security for Colorado security professionals by Colorado security professionals.

Welcome to Colorado Equals Security. This is our feature interview, and today I have a very special guest, Price McDonald. Welcome, Price. Hello. How's it going?

Doing well. How about yourself? I am doing well. In addition to an awesome guy, you are a supporter of the podcast, which we appreciate. So I want to get that out of the way and say thank you.

Do a little plug. Everybody should go and join the Patreon campaign, and we appreciate your support for that. Absolutely. So while I know you, I'm sure that there are probably a few people that don't know you, so I guess take a minute and introduce yourself. Yeah, absolutely.

So my name is Price McDonald. I've been in the Colorado area since I moved out here to go to school back in 2002, working in IT, sort of tech, ever since then. Currently I work from my home for Rapid7 as one of the managers of our pen testing team. So nice. Where'd you go to school?

I went to DeVry. Okay. It got me my first job and I stick with that. Did you go for IT or were you trying to be like an auto mechanic or something? No, I went for IT, like a network engineering degree back in the day where I didn't actually realize it was a bad thing at the time, but you didn't actually have to do the work.

They just passed everybody through, which at the time was like, oh great, I don't have to do any work and I get a degree. Uh, but then you realize down the road the work was the important part, right? Yeah, yeah. You know, there are certain lessons you learn when you are young, right? Like, even though I don't have to do the work, maybe I should do the work so that I actually learn something.

Uh, but anyway, yeah, it got me, and it got me my first job, which sort of snowballed into where I'm at now, which is good. So, uh, where was that? Uh, so I worked for 13 years for a public safety company out of Longmont called It was Intrado for the longest time, then migrated over to West Safety Services, and I believe now they're migrating back to the Intrado name after a few years. So it sounds like your degree was not in security. Yeah, no.

Where did the security piece come into your life? So it started even before that, like back when I was in high school. Like the Hacking Exposed books first started coming out in the late '90s, I think it was. And that kind of caught my eye and interested me. And then I ended up going to school at DeVry for like network engineering and building networks, doing that sort of stuff, administration.

Got a job as a call center person, basically taking trouble tickets for circuits going up and going down. And that left me a ton of time to do other stuff. So I basically studied and read and learned everything that I could. I ended up joining their network engineering team at that same company, worked there for about 4 years, and then got an in with the security team and sort of migrated my way up that way. Nice.

So growing up, were you always a computer kid? Were you into breaking things? Breaking things, yes. I still take everything apart that I can. I think we got our first computer when I was 7th, 8th, 9th grade, somewhere in there.

What was it? What kind of computer? It was a Hewlett-Packard. No, Packard Bell. It was a Packard Bell.

And it was like a PC-386. Yeah. Nice. For an insane amount of money. I think it was like $2,500, which for us was like a huge deal.

Yeah. And then we ended up getting the internet. And all that kind of good stuff. Nice. So you joined the security team after being a network engineer.

I would imagine at some point that included doing some pen testing since that is the focus of your job today. Yeah, so I took a SANS class and they were— I'd never really heard of pen testing before that. And then I'm like, oh, this sounds fun. We don't have that role. So I sort of made it.

I was like, we need to do this. That's the best way. And then created sort of a checklist of how to be able to do pen testing within the company, because it's not something we had ever— at the time, we had never like contracted that out or done any of that work. So I sort of built my own destiny, made the job that I wanted, so to speak. And that's where I started doing pen testing, transitioned doing that I realized that a lot of the pen testing stuff drove our architecture and how we were designing and building and rolling stuff out with our clients.

So I ended up working as a security architect after that, and that was the sort of last role that I had at that company before I moved on. Nice. What was either the most impactful or the most scary thing that you found doing those pen tests? The most impactful— that's tough. So we dealt with the 911 systems for 90-some percent of the US in one way, shape, or form.

So a lot of that equipment, literally when I was a network engineer, I shut equipment off. That had been up and running longer than I'd been alive. So I went to school for network engineering and thought I was going to come out and work on fiber circuits and all this kind of stuff, and I ended up working on like 9600 baud frame relay circuits and troubleshooting X.25 networks and that kind of stuff. DTM stuff. Yeah, frame relay circuits.

So I would say probably I mean, everybody talks about how networks have like a crispy outside and then a soft gooey inside. And the 911 network at the time, they've made a ton of advancements since then, it was not far from that. Once you got in, there was very little access control or segmentation by design, 'cause that traffic needed to get through. So just seeing how open it was, especially once when VoIP started to take a big play in the game and bringing internet into that public safety network, that was probably the most challenging thing in making sure that we did that in a secure manner while still delivering those services that, you know, if you pick up your home phone and dial your friend, if it takes, you know, 6 or 7 seconds for you to get that dial tone back, it's not the end of the world, right? If you're dialing 911 and you don't get that dial tone back right away, you start to wonder what's going on and other problems can happen.

And there have been a number of very, very large, broadly impacting security outages not related to security, thankfully, but there has been a bunch of them. So why'd you leave? What made you decide to move, do other stuff? I got tired of corporate politics in a large sense and not being able to affect change in an appropriate manner. I guess I'll leave it at that.

And I like the idea of— well, I guess step back. I was at LogRhythm for a very short period of time. I wanted travel, wanted to get out and do more, interact with more companies. So I left there, I went to LogRhythm, and then shortly after I got at LogRhythm, we found out we were going to be expecting our first child. And then all of a sudden the travel was a burden and not a benefit.

I love to travel, I have no commitments. Oh wait, I don't want to travel at all. Yeah, I'm like, now— and, and I mean, they were— it was actually a really good company to work for and they were very flexible, but I couldn't be the guy that like always stayed in the office while everybody else had to go out and travel. That's just not me. So I ended up going— I had a really good relationship with my boss, who I actually work with again now at Entrado.

So I went back over there for a while and ended up going to Coalfire because I want to do the pen testing full-time and not just have it be a side gig. Yeah. So, so when you went to Coalfire, you, you went over as a pen tester? Yep. Yeah, I started there as a senior pen tester.

Nice. And then I assume from there you made the switch to Rapid7? Mm-hmm. Yep. I joined Rapid7 about 2 and a half years ago-ish.

Main driver for that, I wanted to work from home full-time, and at the time that wasn't something that Coalfire really did. They do now, and actually I keep in touch with all of them quite frequently But they didn't have that option then, and I wanted to work full-time from home. Traveling is a little bit easier when you're working at home full-time, right? So you don't have to worry about, I'm gonna be gone next week, and you don't see me 40 hours a week every week. So I get to spend time during the week, you know, with my kids and take them to school and pick them up and that kind of stuff.

It's amazing how, how often people overlook the flexibility part of of work, um, as being a driver for people wanting to be somewhere or not being somewhere. It's like, you know, you could— not that you want to, but, you know, you could put up with a, a less than desirable job if you have the flexibility to do other stuff that you want. But, you know, you might, you might want to leave a great job because you don't have that flexibility. Yeah, absolutely. It's— I learned early on in my career that chasing the money wasn't necessarily where it's at.

Obviously you have to be able to do what you want to do and survive, stuff like that. But when I got that sort of like taste of flexibility and working from home, and I'm like, this is okay, like the worst thing I have to worry about traffic-wise is like my kids' Legos and stuff like that on the floor on the way to my office. Legos are the worst. There is not an object on earth that hurts more when you step on them. Yeah, I would imagine the old-school like jacks were probably worse, but we don't really have those those now.

That's true. You probably put an eye out with those things. Yeah. So, so you're at Rapid7 now.

Do you got— are there any— I imagine you have lots of, lots of customers, you're doing lots of pen tests. Any insights that you can share based on, on what you do today? And obviously, I assume you do some testing still, but you're, you're managing pen testers. So you probably even have a much broader perspective on that than you might have in the past. Yeah, it's real eye-opening.

So when I was an internal security person at Intrado, we thought we were horrible. We thought our security was just trash and we had all these problems and it was the end of the world and nothing was going right. And then now you see into some of the largest corporations in the world and And you're like, we weren't doing so bad. We might have actually been ahead of our time just a hair. That's the biggest thing from that side of it.

I actually don't do hands-on keyboard pen testing anymore. I'm solely working on the management side, business development, and building the teams. I found that I would actually rather take somebody in new that really doesn't know how to do it or has a little experience and then help them grow. I find more enjoyment in helping build teams and people than actually doing the work. And as a part of that and doing that training, I still get to do some of the hands-on work as well.

But that's— and that's a big initiative for us is bringing in the— I don't want to say the new people because they all have some sort of tech schooling or background, but bringing in the new people and then help training them up, sort of hiring for that attitude and not aptitude necessarily, which I really enjoy because you can help build them up and it helps everybody. I do hear from people a lot that are trying to break into security, and it sounds like you have a lot of those positions where you maybe pull someone in that's new to security. What can people do either skill-wise or soft skill-wise or whatever it is to be able to get in to become a pen tester or anything else for that matter in your eyes? So a lot of it comes down, I think we put a tremendous amount of focus on the technical skills and while that absolutely is important, if you can't have a face-to-face conversation or more importantly put it in writing after the fact, although if my high school English teachers knew that I wrote for at least a portion of my living, they would be appalled. But a large portion of, like, our interview exam is not necessarily can you spend 18 of your own hours, you know, banging away in a lab environment to try and show us all this cool, really hard stuff.

A lot of it comes down to can you write a sentence? Can you put together a coherent report? And what kind of effort do you put into it? A lot of the— I hear a lot of the talent shortage or whatever arguments made, but there are so many people out there that, you know, maybe they don't have all of the experience, but they're willing to go out, do the work, do the studying on their own, learn that kind of stuff, and actually apply themselves. I mean, they're such a more ideal candidate than somebody that maybe has a couple of certifications but sort of think they have it all figured out.

And it all depends on what the size of the company is and what the needs are, right? Sometimes we need more junior people and sometimes we need more senior people. It just all depends on, you know, what any attrition that we've had on the team or how we're trying to grow as a company. But a lot of it comes down to, for me, the personal skills, because if We are huge on the, the people aspect of it. We don't like egos and having a lot of that stuff that sort of exists in our industry space.

We like to have people that you want to work with, that you want to hang out with and talk to. And so if you're not a good team fit for our team or any team, that's going to rule you out right away. It doesn't matter how smart you are. If you join the call or the interview or you go on site and you have that air of ego about you, it's probably not going to go very well for you. And I don't think a lot of people quite recognize that.

Yeah, a couple of comments on that. I've seen a lot of really bad pen test reports. So from my perspective, having someone that can write a report and have it be coherent is awesome. Also, you know, my mother was an elementary school teacher So I was always being corrected on my spelling and my grammar and everything else. So I'm, I'm pretty picky about that stuff.

If you write a sentence that, that doesn't make sense or have simple spelling errors— I mean, that one right there, you should never have that because there's a thing called spell check. Whether you can spell or not, uh, that it should get picked up. So being able to write a great pen test report Even a good pen test report, I think, is super important for anyone doing pen tests.

And then I feel the same way about attitude and desire as opposed to having skills. If someone is interested in learning, if someone will do things on their own, granted, I'm not going to hire them to be a, you know, senior cloud architect or something like that, but I would much rather hire that person for something and train them up and get them into a good place than hire somebody that thinks that they know everything already, but obviously no one knows everything. Yeah, absolutely, especially in the tech industry. Even if you knew everything today, in 2 weeks from now you would be behind if you didn't focus on that and make it a priority to learn learn that, that skill set. It changes that fast.

Yeah, it's a learner's game. Oh yeah, absolutely. Uh, so, so obviously pen testing is only a portion of what Rapid7 does, and I would think a lot of people actually, if you said Rapid7, they wouldn't even think of pen testing as the first thing. They would, uh, they would think of vulnerability scanning or, you know, one of the other things. What are some things that that people should know about Rapid7 that they might not know?

Some things— so services are a big part of it because I must admit when I first started looking at Rapid7, it was, you know, Metasploit. They own Metasploit. That's their thing. And then also Nexpose, the vulnerability scanner. A lot of people don't know that we do have sort of that robust services platform form of, you know, it doesn't matter if it's pen testing, advisory, incident response, we sort of do that full gamut.

I mean, I think our products have been out there for a very long time. We have made a shift here recently to more licensing-based stuff, so it makes owning it a little bit easier, I think, as far as going back to my days where I was acquiring software and having to deal with the maintenance and administration. It's easier when you own your little portion of it and log into the portal to figure out, you know, what things do I need to remediate today, or what new plugins came out for Metasploit that I can help my team leverage, that sort of thing. But yeah, cool. So I think one thing that, that I think I always find useful when either when I have pen tests done or companies that do pen testing put out reports is there's advice around, hey, these are the things that make my job the hardest.

From your perspective, what are the things that people should be doing that would make your job the hardest and as a byproduct attacker's job the hardest? First and foremost, and this is a huge huge pet peeve of mine and of most of the pen testers that I've talked to. Fix what's in the report. Start there. It's amazing whether a company has us come out to do a test and then they want a retest done in 6 months or whatever and the findings are still there, or they come back to us year over year, which is great.

We love to have that relationship, but we like it even more when our job gets it's harder, right? So fix the baseline. And usually when we have a customer that's never had a pen test before, they maybe have a vulnerability scanner that they run, but they don't actually have any internal processes as far as remediation and patching and follow-up. That's the main one. And it's amazing how many times year over year we see the same.

I mean, we still, I think it was January 2022, 12th or 13th was the first time one of our testers encountered MS08-067 on an internal environment. That should not happen. So first of all, just fix whatever, if we're the firm that did the testing or if somebody else, just fix what they say, if possible, or mitigate it. After that, it's the password policy, the same arguments that I was making as an internal security person a decade ago would be the local admin reuse, password, privileged account management, that kind of stuff that kind of like dual factor was at that time as well. Everybody sees that as a huge hurdle.

This is going to be so hard. It's going to break so many things. So they don't try. But having that privileged account management is a huge one as far as making our jobs more difficult, because if we can't laterally move throughout the network using the same set of credentials, it severely limits the speed at which we can do that. And then segmentation is the other thing.

That's the one thing that— I'm not a huge PCI fan, but I think that's the one thing that PCI actually got right, was the segmentation piece. And okay, we can't make it perfect, but let's at least put it over here and reduce that. Sort of threat vector for it. If you can segment your networks between user space and admin space and data center type space so you know where that traffic is traversing. I mean, I should never be able to go from my laptop as a normal user to Bob's laptop as a normal user too.

So having that segmentation and knowing what is anomalous in your network is also another big, big thing. Awesome. Yeah, it's amazing.

You would think that the idea of a pen test is to find things that you can fix, but I still often see times where that is not the case. It's, you know, hey, we have to do this, or, you know, oh, maybe we want to know about stuff, but we're still not going to prioritize this stuff that got found in our roadmap. We already have other things that we want to do. So yeah, I think that that's great advice. If you're gonna get tested, you should probably fix the things that they find because that's what their job is.

Yeah, and to your point, it drives me— we have a lot of people come to us, they're not looking to actually find results. They want that letter saying, hey, we were tested by Rapid7 we're good. And so they'll try and like whittle the scope down to where it's really kind of a meaningless test, which is also a big frustration of ours as well. We want to do meaningful work that actually helps the business and the companies move forward, whether it's vulnerability scanning or pen testing, whatever it is. We want to do something that's meaningful for the client so we can sort of build that relationship and they get better.

We're not just trying to cash the check, you know, every 12 12 months or whenever their compliance is due. So that's another big frustration. I mean, we've actually had clients come to us and say, well, we have this product, we're rolling it out, it's absolutely perfect, trust us. These are the test cases we want you to run, and then you'll get these results, and then we need a pen test report that's clean. I'm like, that's not how that works.

But that's still some people's perception, and unfortunately there are people out there that will cash that check and do exactly what they say because that's what brings the money in, which is unfortunate. It kind of devalues the whole process in my opinion. Yeah, and the other thing I see a lot, you know, we have vendors that we have to oversee, you know, people that do work for us, and there will be times when I'll say, okay, you know, as part of our oversight, I need to see, you know, a third-party assessment, a pen test or something like that, and they're like, oh yeah, we do pen tests every year. I'll give you my pen test report. And they hand me, um, a, a Qualys scan, or, you know, they hand me, um, you know, something to that effect where it's like, look, we scanned this one IP address, um, it found that there was a port open and there were 3, you know, info-level, um, vulnerabilities associated with it.

And it's like, uh, okay, now we have an issue because you clearly don't know what a pen test is. So you're obviously not doing other things. Yeah, and we see that. I don't see it as much from like the competitive intelligence side of it, but we get a lot of people that will, you know, work for another company and decide they want to change or whatever and come to Rapid7. And we'll ask them like, all right, well, what is your idea of a pen test?

Like, we have our idea, what's your idea? No right or wrong answers, just trying to get an idea for the methodology. It's amazing It's amazing how many people say, well, you run a vulnerability scan and then you validate the results. I'm like, well, that could be a portion of it. That should definitely not be the foundation of what your pen test offering is.

Ideally. How do you think we could make that better? Standards or— I mean, obviously it's— as a company, it's in your best interest to do whatever your clients ask you to do so that you can make money. But in a security best case, that's not necessarily the same thing, right? So how can we get better as an industry in that area?

So I think that is— I think through education, right? All of these testers are going through some level of education, hopefully either before they get their job or after they get the job taking some sort of insert training company X's name's certification. I think the training, making the testers want to do the right thing is how you're going to fix that. Because a lot of companies, you're right, getting the dollar in is the most important and they will do anything for that dollar. We used to joke about that when I was an internal person about like sales, like, oh, they just sold a product they we don't even have that we have to deliver now in 6 months.

And it's amplified, I think, in the testing space because they can think up and find a way to finagle a test in a much shorter time period.

So I really think it's the training and making people want to do the right thing. Because like you said, the business is— a lot of businesses, it is all about the dollar. That was one of the things that I talked to Rapid7 heavily about when I interviewed is like, what, what is the priority of the team? Are we— because I knew, obviously I knew Rapid7 was a software-based company, so I knew that any growth that the company needed to make didn't need to directly come from services, right? So if we need a 20% increase, that doesn't mean we're selling 20% more or running our testers 20% more thin.

And that was a huge thing thing for me because I didn't— I want that— I wanted that opportunity where we got to do that sort of meaningful work. And that's a term that Rapid7 uses, not something I came up with. But to be able to do that work and not have to burn our testers out, because that's— we put a ton of money— it doesn't matter who you are, if you're a pen test shop, you put a ton of money into training and bringing new people on board, whether they're a pen tester or a help desk analysts. It's expensive to hire people and train them, and burnout is a problem. So trying to make sure that we're being as fair to our people as possible.

And when you see a company like Rapid7 where the lion's share of what they do is software, it looks pretty appealing for a services company, which is why we can, we can and do turn away a lot of that business because it's not critical for our success. Yeah. I think while we'd both love to have those people on the low end doing better tests, what do you see on the high end? Do you have clients that are pushing the envelope? I mean, I don't know what is next for pen testing because obviously you can continue to do exactly what you do today, but is there more that we can do to push the envelope in terms of third-party testing?

Yeah, absolutely. I think a lot of it comes down to figuring out a way to either integrate the testing into sort of release cycles or not necessarily staff augmentation, but figuring out a way to get closer to that development release cycle where it's actually going to be impacted so that way we can help a company, you know, right after or right before that release is being made versus 9 months down the road after who knows what's happened for 9 months. And it's really easy to do that from a scanning or automation perspective. It's much harder when you're bringing people into the fold and needing to get them on site. So I think that's probably the ideal of where we get, just shifting closer to that release cycle end.

But also the real sort of adversarial simulations and I hate— it's a buzzword that our company and a lot of companies uses, you know, actually emulating the attackers versus the scan, validate, pilfer sort of model of a pen test, but to actually do sort of be that quiet, have that actual pen test where you have, you know, 3, 4 weeks to do it. But even longer is better. But having the time to do that work so you can actually test their response. What do they see? How can we not just tell them you're missing this patch, but this is how you tell that this activity is taking place on your network and help with the actual training of their good guys, with air quotes, trying to figure out how to make them better as well.

I think that's a step that a lot of people are missing. As far as the internal defender side of things, getting that training sort of baked into that service is a— I think would be a huge step forward. Yeah, I totally agree. So we are just about out of time. Any topics that we didn't hit on that you wanted to cover?

No, I don't think so. It was a good conversation. Awesome. Well, Price, Thanks again. Appreciate your time today.

Appreciate your support of Colorado Equals Security. This has been Alex Wood, and we will talk to you next time. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb. By emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.