Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 136 for the week of October 7th. Alex, how are you?

I am well. How are you, Robb? Great. It's been a few weeks since we've been able to get together for this. I know.

We're like perfect strangers. Perfect strangers. We had to spend all this time hugging and making up for all this lost time. That's right. Well, and now it's fall.

I haven't even seen you since summer. I know. It's crazy. It's like a whole nother season. It's chilly out there.

I've had to wear a coat a couple of times this week. I walked out the door and I, and I did pick up a coat when my wife shamed me into it because she said it's going to be cold. And I said, okay. Yeah, I was— I think it was Monday or Tuesday this week. It was really, really cold for this, what we've been used to.

Yeah. And I was, I was very glad I had a coat. Yeah. Well, uh, speaking of things I'm really glad about, we have a Slack channel and I am awfully glad to get to talk to the security community over there. It is a great Slack channel.

You know what else we have, Robb? No, what's that? We have a mailing list. If you go to the website, colorado-security.com, go all the way to the bottom. There's a spot where you can put your email address and sign up for the mailing list.

And if you slowly go to the bottom on the way down there, you'll see the link to join the Slack channel. Yeah. And there's a, there's a lot of good stuff. There's, there's also a calendar of events on the mailing, on the website. So you can see, you can see that.

You can also see like our Twitter feed because the best place to see our tweets is on our website. Yeah. You know, it's a perfect vehicle to view them on the left side of the web webpage. You know, um, while you're there, um, since you're in a web browser, why don't you pop over to, uh, iTunes or Google Play or, or somewhere else where you're getting your podcasts and rate us, um, on those services. And, uh, also you can subscribe.

And so you get this downloaded for you. Say nice things. Yeah, that note in there that talks about Alex's shiny head, he does not like that. So, so please, no more notes about Alex's shiny head. We would love it, though, if you, if you want to help us out to go tell a friend about what we do.

You know, you can get your coworkers listening, you can get random strangers on the road listening. Really, anyone who has ears can listen. I think you should go to libraries and just shout, Colorado equals security. But if that's not enough, if, if telling your friends and shouting at strangers in the library is not enough, you could support us financially. We are so thankful for the patrons we have right now who help fund the show.

And we would love it if you're listening and you're so inspired to help keep paying for the expenses of the show, if you'd kick in a little bit of money for that. All of the funds we get from that do go back out to the community and we try and make things better here in Colorado. We sure do. And finally, speaking of the community and the podcast, If you would like to do an interview that shows up on the podcast, please let us know whether you want to interview someone or even if you just think you're awesome and want to be interviewed. Either way, let us know.

We've never had someone interview themselves, though. Oh, interesting. Well, you know, we've done the news section by ourselves. It'd be interesting to have a self-interview. I would say that you're running a little bit of a risk if you interview yourself, that maybe we'll think you're crazy.

But send a note. We can, we can see what we think about it. Yeah, I'll take the over on them being crazy if that happens. Hey, let's jump over to the news now. Alex, there's some pretty good news coming up in about a week.

On the 15th of October, Coloradan students can apply to many Colorado colleges for free. Yeah, that is pretty cool. If you have a child who is about to go to college and they're going to apply in-state, I think that is the day to do it. Most college— state universities, community colleges, trade schools. Obviously you want to check to make sure that is the case for wherever you're going to apply, but many places are free on the 15th.

32 schools throughout Colorado. I didn't even know we had 32 colleges in Colorado. That is pretty cool. Yeah, pretty good. So 32 schools.

They said that in 2018 they had 23,000 applications on that day. I don't know what percentage of applications that is for the year, but it seems like a big number to me. It's a lot of kids. Robb, speaking of it being fall, did you know that Denver has the 3rd earliest average first snow of any American city? I did read the show notes ahead of time, so I am aware of this.

I also know that the average first snow in Denver is October 18th. So it's just a few days after Free Colorado College Day. I did see something a little bit earlier today that we didn't include in the podcast. Uh, saying that, you know, maybe in a week or so, which is even before that 18th date, we could see our first snow. Oh, fantastic.

So, you know, we're— what we're so used to on these lists is Colorado or Denver being like number 3 and Austin being number 2. Uh, good news, folks. Austin did not get ahead of us on the list of earliest snow days. Uh, not San Francisco, not New York City, none of those. Uh, number 2 was Billings, Montana.

Yeah, Billings, Montana makes a lot of sense. You know, it's, it's, it's a little bit further north. It's also high altitude. I do feel like the number one city's kind of cheating. It is kind of cheating.

That is Anchorage, Alaska. Just hardly America. It was interesting that it's, you know, it's, it's Eastern Russia. Barely America. You can see Russia from your front porch if you live in Anchorage.

Yeah, that's true. I've heard that somewhere. Somebody said that sometime. I thought it was interesting that Anchorage, the first snow date is actually only 48 hours on average before Denver's. Yeah.

So apparently all we have to do is keep an eye on Anchorage weather and we'll know when our snow's coming. Yeah. Yeah. That's how, that's how averages work, right? Okay.

Weather alert out for that. Get notified. So our next story, interestingly, there is going, there is a proposal and what looks like a plan to do a whole bunch of construction on I-25 right through central Denver. This is especially worrisome for me because they specifically say it's going to be between Alameda and the 20th Street exit, which is like exactly where I drive when I'm going to work. You know, I look forward to it.

I love construction. More time on the road is better for me. More podcasts. Get to listen to more podcasts, Robb. It did sound from the article like we're still in the planning stages of this.

You know, they're not going to be breaking ground tomorrow or anything. Also that they still need to find the money to actually do this. But just that people are talking about it is a bad sign for travelers. So a couple of things that— I mean, it's good in the end, right? A couple of things that would come out of this.

The first phase, the easiest phase, looks like they would add an express lane both ways. So not useful for me, but good for other people. They also were talking about actually buying— CDOT was looking to purchase most of the Union Pacific Railroad's Burnham Yard, which is several blocks away from the freeway. They really think that they can use that space to, to improve the surface roads around the freeway. Yeah.

And also maybe get some more space for the freeway. Yeah, it, I think, is part of that. If they can get certain parts of the, the railway right away, they can move one of the lines that is closest to I-25, which would allow for some expansion. Um, the other thing that I thought was interesting is some of that area between Alameda and 20th is still part of the original construction of I-25 from the '50s. That's pretty crazy.

That, that seems really crazy. 60-something years old. Yeah. Good stuff. On a less positive note, I don't know if, you know, road construction is not a positive note.

Less positive note, Colorado business confidence has dropped into negative territory for the first time in 8 years. So, you know, This, this story or a story very similar to it has been kicking around in our news feeds for the last, like, what, 3 weeks or whatever. And I've mostly just been ignoring them because there's not really any news here. This is the first time I'm like, yeah, there's actually a little bit of news where the— what they do is they survey executives, I think mostly CFOs for this, right? To ask what do they think of the future of the economy in Colorado over the short term?

And what they, what they want to see is positive sentiment is, you know, a number over 50 and negative sentiment is a number below 50. So if everyone thinks things are going great, you get 100. If everyone thinks it's going to be terrible, you get a 0. Well, for the first time, we are down below 50. We are at 46.9, which is a drop of 7.7 points from the— from a year ago.

Yeah. And digging into the numbers, not all of them are negative there. I think there are only a few measures that were negative. There were still things that were positive. Agriculture was pretty negative and manufacturing were the negative ones.

Right. And I think this just goes along with the, the general uncertainty that we have right now, whether it's the potential impeachment of the president or trade wars, trade wars, or, you know, next year is an election year. People just don't know. And any time that there is more uncertainty, people have a negative attitude. Yeah.

You know, I'm, I'm definitely like the last thing I want to do is be a fearmonger. And I don't think that there is a lot of reason to be scared in the security community in Denver. I think things have, you know, we're still at like basically zero unemployment. Companies are still investing more and more in security. You know, the industry we're in, it's still a pretty good time.

Well, in Colorado in general, we are still at near record unemployment. So it, yeah, I think it's gonna be good. You still can't afford to buy a house here. Like things are— still can't afford to buy a house. The things are not, definitely not going in the other direction as far as I can tell.

Yeah. Next we have basically a story here from the Denver Post about the 5G wireless technology that's coming to Denver. Give some more details about it and really what is it we expect this technology to deliver or fail to deliver on. Yeah, I thought this article was interesting in the fact that at the beginning they tried to say, hey, we're gonna, we're gonna look at both sides, both the, you know, the positives and, you know, the negatives. And they spent 3 quarters of the story talking about how amazing everything could be with 5G, and then a few sentences at the end saying there, there could be a couple drawbacks.

Yeah, I mean, it's mostly pretty positive. And, you know, there's— I know like my, my neighborhood actually has like a little email distribution list, and you know, they're talking about putting 5G around here and the neighbors are really concerned about health concerns. It's not proven yet what this is. I kind of feel like it's not in my backyard situation where people just never want anything to be installed there. That said, there's some pretty cool stuff that can come from this, right?

5G is 100 times faster and it can connect 100 times the number of devices as 4G. Like the scale of what it can do is just, is just massive. I also— they talked about how they've already rolled out 5G in South Korea. And what they've seen is some stuff that seems a little silly, like users doing things that like used to be too costly, like wearing camera collars all day long and streaming their entire day on YouTube. Yeah, that seems awesome.

I would watch you walk around all day, Alex. That would be great. I would love to do that. But, you know, they did lay out some, some scenarios that were positive, things like, you know, parking meters automatically, automatically updating when spaces are free. You know, things like that.

One of the things that hadn't really occurred to me is that this can be a potential energy saver because, because you can transmit data so much more quickly, the radio doesn't have to be on as long. So if it's something that is, you know, low, low power application, you know, you could potentially have stuff that the batteries last longer and that sort of thing. So, well, I for one welcome our 5G overlords. And I'm looking forward to it. There was also an article in, I believe this was in the Business Journal this week, talking about what small businesses need to know for cyberattacks.

And this was actually by George Anderson, who is a product marketing director at Webroot. And so he was interviewed for this story. Yeah, really talking about what he thinks folks should do, you know, good backups, being ready for ransomware, kind of what the regular stuff. What was interesting to me about this is it's written, you know, for the general Denver Business Journal readers, right? Not for security folks.

In reading the article at the end, it says that this was edited for space. Reading the answers, I want to give George the benefit of the doubt. I feel like his answers were a lot more detailed and comprehensive than what they have there. I feel like the author took his comments and like chopped out, oh, this is an important point and that's an important point. And here's a few sentences that are— that maybe sound a little choppy.

That makes sense to me because George probably overwhelmed the non-tech readers, would be my guess, if we're talking about a product manager from Webroot. That makes sense. That's potentially true. Speaking of local security companies, we have a story this week from CyborgGRX. It's actually a press release that they have not only hired or joined a new man on their board of directors, they've also hired 3 new executives.

Yeah, so Bob Kerrigan was announced as a board member. He is the former chairman and CEO of Dun Bradstreet. That's like a— I'm sorry, you bet. I think we're about to say the same thing. Yeah.

Well, I was gonna say, I think that's a pretty well-known big company, but they're the company that knows everything about companies. Yeah. It sounds like a really good fit to me. Dun Bradstreet is a B2B that's really working on like company information and CyberGRX. You know, what they do is understand what's the risk of different companies, right?

That B2B relationship. I really feel like it's a pretty good fit and he'll probably bring some useful experience. Seems like a potential acquisition there. Oh my goodness.

Also, Adam Cecil joined as a CFO. Adam used to be the CFO for ProtectWise. So CyberGRX taking the CFO from ProtectWise, who was acquired by Verizon. Was that like early this year, late last year? Something like that.

Yeah, maybe, maybe early this year. They also hired Jennifer Ryder as the Chief Marketing Officer and Frank Price as the VP of Product. And Frank came from Webroot. That's pretty awesome. Yeah, a lot of security folks getting new opportunities here in town.

Good for CyberGRX. Uh, next, there was a blog post this week from Ping Identity talking about, uh, 4 ways that self-service single sign-on is a game changer. Robb, what's this all about? Uh, so this is actually self-service IAM. So we— it's actually— it's announcing a new product for Ping called Ping Central.

Um, they are, uh, uh, so this Ping Central product allows us to orchestrate our various products to do things much more automated and self-service fashion. So, you know, they give the 4 things. Number 1, it allows to accelerate digital transformation with rapid app onboarding. So instead of having to do a bunch of in-app changes for your IAM, you can have one central place that you just call a library there and push stuff through. Sweet.

In automated fashion. Second feature, it bridges the IAM knowledge gap among developers. Basically, the point is not every developer is going to know how to do this. You give them a simple way to, to do it, you know, a similar way that we can say you're going to use a common library to, to do it in the same way. We don't have to make them know what the stuff is, right?

It's all obfuscated from them. Third was that prevents shadow IT and technical debt in identity security. And I think what we're referring to here is by giving a standard platform that folks are going to use, there's really no reason to go around and use shadow IT, right? Anytime something is easy and self-service, you would much rather do that than figure out an alternative. And finally, the last one, which I, I would actually maybe say is the most important, is this building a bridge between the central IAM teams and the app teams.

And what we've seen at Ping over the, the last several years is these, these central IAM teams sometimes become a bottleneck where, hey, everyone wants to get onboarded in the IAM solution, but the IAM team just doesn't have the resources to do it, right? Providing the same, the self-service to the app teams allows them to get stuff onboarded much more quickly. You know, we've had some big customers that can do thousands of applications quickly, and this This is a way to make that faster and more streamlined for, for everybody. So that's the, that's the story there. Pretty cool.

Uh, last 2 news stories that we have are both awards for Colorado security companies. Automox was named as a high performer in patch management software by G2 Research, and Coalfire was recognized as a best firm to work for by Consulting Magazine. So pretty cool to, to get to see both of those local companies recognized in some national or global lists. Yeah, pretty cool. All right, that is it for news.

We can go ahead and move over to the Slack message of the week. Big thanks to Andre Gaeta for continuing to sponsor this. I don't know when he's going to cut us off. Eventually, I'm sure he will. Uh, thanks for what you do, Andre.

We appreciate it. Um, and the winner this week is Aaron Ott. There was a question in the Slack channel, uh, just asking about what's the best platform to use for pen testing. Um, you know, everyone was familiar with Kali, but is there some other options? Aaron responded and, and talked about a platform that I don't remember off the top of my head what it was called, but it was another option.

And it was a little bit of conversation about that. And it was interesting to me to get some new education. Well, congrats, Aaron. What does he get for that again? He gets $25 to the Colorado Equal Security Store for an item of his choice or some multi-items, I suppose, if you want to get up to $25.

Absolutely. You can get some— maybe a bumper sticker plus a mug. Yeah. You know, a hitch cover plus a phone case. Yeah, there you go.

There we go. All right, well, let's go ahead and jump over to events. As we talked about, there is a calendar of events on the website. You can go see all of the stuff, but we're going to just go through the next couple of weeks worth of events. On the 8th and 9th, Denver ISSA is doing their October chapter meetings.

On the 9th, Presidio is doing the Red Sky Security Conference that is down at the convention center. They've done a really good job with this conference the last couple of years. I appreciate the fact that You know, they've brought in— it is a vendor conference, but really compared to most vendor conferences, it's, it's pretty agnostic. Lots of different technologies and a lot of good folks there. Agreed.

Uh, SecureSet on the 10th is doing a Secure Your Future with SecureSet and Denver Women in Tech. On the 12th, ISACA is doing their CISA and CISM review sessions, Domain 5 for CISA and Domain 4 for CISM. On the 15th, the Northern Colorado Cybersecurity Professionals group is having an October meetup. This is a relatively new group. It is.

I think this is our second meetup. Yeah. So, you know, for those of you guys in the Fort Collins area, I recommend you get hooked up here and maybe meet some other folks from the area. If I remember the meetup details, this is actually— they're having someone speak at the meetup as well. Also on the 15th, CSA is doing their October meeting.

On the 15th and 16th, our ISSA Colorado Springs is doing their October chapter meetings. That's the dinner on the Tuesday the 15th and lunch on Wednesday the 16th. On the 16th, ISSA Denver is doing a cyber threat intelligence special interest group meeting. These special interest groups that ISSA Denver's been doing have really morphed into kind of a life of its own with different topics. You know, it's, it's meant to be— some of them are kind of just a point in time.

I don't know if this group's gonna ever meet again. It might just be this one time to, to learn about this stuff. And, uh, if nothing else, it's pretty infrequent. So this is a good chance to go learn about threat intelligence. Yeah, I think some of that depends on how interested the people are in the special interest, right?

Yeah. Uh, on the 16th as well, Secureset is doing a Hacking 101 on an introduction to Linux. I highly recommend if you're like, yeah, I've always wanted to get into Linux and, and, you know, how do I use this technology to help my security career? Just go to this. Like, it's gonna, it's gonna be free.

I think they're all free. Um, go to this thing, you're gonna get great resources, a good introduction, uh, and if nothing else, it'll give you the tools you need to learn on your own. On the 17th, ISACA Denver is doing their October meeting. Also on the 17th, the Colorado Technology Association is doing a cybersecurity risk compliance and insurance trends meeting. Remember, this is the CTA, so they don't do a ton of security-specific stuff, so it'd be a nice different audience to get to mingle with.

On the 19th, ISACA is doing their final CISA and CISM review session. This is an exam prep So, you know, this is the last one. You've gone through all the sessions. Now it's kind of going back through everything, getting everybody ready for the exam. And finally for this week, on the 19th, Colorado Springs ISSA is doing one of their many seminars.

That's a Saturday morning event. Just go get some CPEs and do some socializing. Awesome. Let's jump over to jobs. Um, if you guys were not aware, there is a jobs channel in our Slack workspace.

So if you want to hear about jobs or talk about jobs, go out there. Also, if you are someone that's trying to hire and you post jobs in that, that channel, it's likely that they will end up here in the podcast. So first job, there is a job at Ping Identity for a GSI, a Global Systems Integrator position. That's an alliance. Someone who runs GSI alliances for Ping gets to help establish that relationship between Ping and those big GSIs.

Cool. Trustwave is looking for a Cyber Threat Engineer for Global Threat Operations. Oh, I got to say this word. Is it— is it Equus? Equus?

Equus? E-Q-U-U-S software. I think it's however you pronounce it. You picked this for the jobs list just to throw me off, didn't you? Yeah.

Anyway, that company is looking to hire an IT security compliance lead. Ooh. Encana is looking for a senior IT security analyst. Dominion Voting Systems is hiring an IT security engineer. This company's been in the news a bunch, is doing some good stuff.

Yeah, I thought that one was pretty interesting because they make voting machines. Robinhood, which also has been in our news about moving to town, is hiring a security engineer. Pretty cool. They're bringing security to town too. Arrow Electronics is hiring a security architect focused on database.

Twilio is looking for a senior information security compliance analyst. I'm sure that's at the SendGrid office there, the former SendGrid office. Denver Public Schools is hiring an information security architect. It's very important because that job came through in all caps. Kivu Consulting is looking for a digital forensics and incident response analyst.

And finally, Randori, which is one of the local security startups. We actually had one of their founders on the show a while back. Moose. They are. Yeah, exactly.

They are hiring a security engineer here in town. Cool. And that takes us to the end of the news section, Robb. And so after news every week, we always, you know, we have a little transition and then we go to an interview. But not this week.

Not this week. It's very odd. Yeah. So for the first time in 2 and a half years, we don't have an interview for you guys this, this, this week. Alex, I have both been pretty busy.

Um, so if any of you folks out there are thinking, man, I sure wish we had an interview, maybe you should go do an interview. I think that would be the case. Yeah. All right, well, that's it for, for this week's, Alec. We'll look forward to talking to you again next week.

Thanks, Robb. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Colorado equals security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.