Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is episode 127. Thank you, Alex.

You're welcome. This, uh, the week of August 5th, um, and you know, it's, it's the heat of summer. Black Hat DEF CON is next week. Are you, are you going to be heading out to the desert? I'm afraid that I won't be able to go, Robb.

Originally I was planning to go, but I ended up having a family conflict and will not be able to make it. What do they call it? Summer, uh, Hacker Summer Camp? Yes, Hacker Summer Camp. Yeah, I'll just be out there for like just 2 days, maybe 2 nights, something like that.

Uh, well, let's go through some housekeeping. We, we have a Slack channel and it's, it's, you know, robustly grown to a It's booming. It's booming. I think that's fair to say. I can't really keep up.

It's so booming. It is. It is hard to keep up now. Yeah. We're going to have to start a smaller Slack channel that we can keep up with.

Start over from scratch. Slack 2. We also have a mailing list. If you go to our website, colorado-security.com, you can find the form to sign up for the website at the bottom. Put your email address.

You'll get the show notes in your email. You can also find a button on the website to join the Slack channel. We would love it if you would rate us and subscribe on your favorite podcast listener for this podcast. Know, the more people who are subscribed, the more people who are rated, the better we do on search results and so forth. So if you type in the word Colorado to your podcast player, hopefully we'd be on the first page.

That would be great. Maybe even one day we'll be a featured podcast. Holy smokes. I don't even know what that means. I don't know either, but you probably have to pay for that or maybe some more ratings or something.

Are you greasing enough palms, Alex? Are you bribing people? I'm a little short on the grease right now. Speaking of, if you want to help us grease some palms, we have a Patreon. You could help support the show and, and we, we can't guarantee that your money won't go towards bribing people.

But we cannot guarantee it won't. Also, if you don't want to help bribe people, you could just tell a friend. That is a much more ethical way to do it and also cheaper. It's not more— it's not more ethical than giving us the Patreon support though. That's the— that's the highest.

That is the most ethical. Yeah, except for the bribery part. We do guarantee that we will not bribe ourselves. That, that at least where we will guarantee that the money would never go to us. It would go to you know, whatever podcast person makes those decisions.

All right. Enough about bribery. Let's talk about some juicy stuff. So this week there were some Democratic debates. And, you know, we never really talk much about politics on the show, but I thought it would be interesting to talk about how the Colorado— the 2 hopeful Colorado presidential candidates did on the debates.

I'm going to cut to the chase. Not well. Not well at all. But I will say Both former Governor Hickenlooper and Senator Bennet are very strong on cybersecurity. Yeah.

Governor Hickenlooper helped start the National Cybersecurity Center. I've actually been to a couple meetings with Senator Bennet regarding cybersecurity, getting input from the community. So they're both up on cybersecurity and are pushing for that. I don't think it's going to be as the president of the United States, though. Yeah, I don't think so either.

It looks like, you know, according to most recent articles that— what did they say? President, or excuse me, Governor Hickenlooper's on a death watch for his campaign. So not, not a lot of hope there. Unfortunately, you know, it looks like we'll have to look for the, what would it be, the 20— holy smokes, the 2024 election for our next, for our presidential. I don't know though, Governor Hickenlooper was pretty excited that they, he was polling at 2% instead of 1%.

That's 100% increase, Robb. That was before the debates where he got the least, the least time speaking, kind of generally didn't have a great debate performance. Yeah. All right. Next, Dish Wireless is going to be starting a wireless network.

And I mean, like telecom wireless network, like, like you can move your cell phone over to the Dish cell phone plan. This is interesting. As a part of the FTC approving a merger between T-Mobile and Sprint, they said that there had to be a new telco out there and Dish becomes the recipient of that good news. Yeah, it's funny. Hey, we have 4 major carriers.

2 of them are gonna merge, but we've decided that we still need 4 major carriers, so we have to start a new one. Yeah, and they're giving Dish the ability to use— was it T-Mobile's backbone, right? Right, for a little while. There's also some— Dish is buying some of the value carriers from T-Mobile, like the prepaid plan kind of providers, also some spectrum. And then this is all while DISH builds out their 5G network, which they expect to be, I think, 5 years to completely build it out and like $10 billion.

Once that happens, they will be on their own network and truly on their own. Super exciting. Really neat to see the local company making such a big change. You know, was it just like last month they started talking about their in-house services they were going to offer around IoT for the home? This is another really big change for them.

So kudos to DISH. Yeah. Next, Denver company Dominion Voting Systems was awarded the contract to install Georgia's new voting system. This is a $150 million deal that they won. And so Dominion Voting Systems, they do computerized voting systems.

And really the whole press release here about this is talking about the security of their system and how important that is. It's obviously top of mind for everyone involved. Yeah, it does have a paper trail, which is nice. I think that's one of those things that is recommended if you're going to be doing digital voting machines. So congratulations to them.

All right. Next, we have news about yet another big company coming to town. This is not a company that I had heard of before, but it's a top 25 tax consulting company called— I'm going to say it right— Armanino, probably Armanino. And they're going to be coming in at 18th and Curtis downtown to Denver. Not only are they going to be coming in, but Robb, they are looking to take the market by storm.

This is a great strategy if you're going to go take a market. You know, by storm is probably the best way to do it. I prefer by siege, but, you know, by storm is okay too. Yeah. Good stuff.

Next, the Denver Business Journal revealed their 2019 C-Suite Award winners. Congratulations to all the winners. We, you know, we're always looking through these for familiar faces. There's a couple of folks who I know a little bit, but, you know, a security company was able to get one of the recognitions this year. So Optiv's CIO, Paul Lehman, was recognized as one of the winners.

Congratulations to Paul and congratulations to Optiv. Next, we have a new release from Layerz. So Layerz is the local security penetration company, kind of red teaming pen testing run by Chris Nickerson, and they released their first ever annual report about pen testing. Yeah, pretty cool. It's always nice to see press releases from them.

We don't see a whole lot of releases from them. You do have to go through a registration process to get the actual report. The press release basically just says that there is a report and then directs you to their site to download it. But I'll give a little snippet, a little, a little preview. Robb, did you do some homework?

Did you read the report? I actually got the report in, and I'll just tell you what are the 5 key findings. And they said these are not necessarily based on severity, but based on how, how prevalent they are and what they're coming across in pen tests. They said brute forcing accounts with weak and guessable passwords, that's number 1. Number 2 is Kerber roasting.

Number 3, excessive file system permissions. WannaCry/EternalBlue. And finally, WMI lateral movement. Well, those all seem like good finds. Um, not surprising to me for Windows environments.

Good stuff. Uh, next there is a blog post by Coalfire talking about healthcare being slow to adopt the NIST identity guidelines. So this is I mean, not necessarily news, right? I think it's kind of obvious. And my guess is the reason that they wrote this is that so when people who work in healthcare are Googling things like NIST identity and healthcare, that this blog post would come up.

What's interesting about it to me is they do it yet another kind of going through what is the new NIST guidance around passwords and some of the assumptions that people make when they first read it. Like if you read it the first time, you might think, oh good, I don't ever have to change passwords anymore. Well, that's not quite right. Right. Right.

The actual requirement is you have to change a password as soon as it's been known to have been in a breach. Which is different. You can't just go do one without the other. And they kind of clarify some of those misconceptions and, and talk about how you can do these things more effectively in a healthcare environment. Yeah, some good content in there.

Uh, definitely check that out if you want more clarification on the NIST Identity Guidelines. Yeah. Um, so next there's yet another piece of news from Coalfire, a press release they've released. They have actually created what they call the Cloud Security Client Advisory Board, which is really meant at kind of— it's their own creation of security thought leaders to help give some feedback out to the industry and provide some research around What does good cloud security look like? Yeah, and there's some, uh, some great names on the list, uh, specifically Gail Curry, who's local here in Denver, used to be CISO for Oracle Cloud, uh, Matt Sharp, who formerly of Denver, now lives in, in New York, and Mark Weatherford, who lives down Castle Rock, I think, towards Colorado Springs.

Mark was previously the CISO for the state of Colorado, and, and now he's a CISO over at Booking, which is like hosting.com, or excuse me, um, Booking.com, hotels, different hotel stuff. I can't remember what hotels.com, hotels, like those maybe sorts of things. All right. Uh, anyway, congratulations to, to the folks on that list. Some other names that we know, Twilio's CISO, and he's not in town, but Twilio just bought SendGrid.

So he's, he's running that company. Um, congrats to those guys. And I'm looking forward to seeing their research. I'm sure when it comes out, we'll be able to share some of that here on the podcast. We've got a blog post this week from Virtual Armor, uh, talking about airports.

Are hackers' best friends. Yeah, I read through this. Really, this looks to me like a really nice article for you to share with your less security-focused folks, or if you listening to the podcast, you know, are maybe newer to security, it might be some good introductory stuff for you. Most of it's relatively obvious, I think, for us that, you know, there might be a Wi-Fi network called free airport Wi-Fi that isn't on the up and up. Right.

And maybe the charging cables, the charging docks that they provide in the airport might not be totally safe. Maybe obvious for you and me, but there's a lot of our loved ones who that wouldn't be so obvious for. Yeah. The point that they make is in the airport, you have to go through security to get to the main areas. So people by default think that it's more secure.

Doesn't necessarily mean that these other things can't happen there. So still got to keep your eye out while you're there. Good stuff. Uh, finally, last news here. LogRhythm had a press release this week that they have aligned, um, their, uh, their SIEM to the ATT&CK framework, the MITRE ATT&CK framework, to really help you figure out where you have coverage across the kill chain or the threat chain, I guess.

Yeah. So they have a module now. You can look at all the TTPs that they have listed there in LogRhythm, track both on the red team side and the blue team side, see what's going on. Pretty cool to see that they are aligning with ATT&CK, which is something that is getting to be pretty standard in the industry now. Also, there's, there's a great quote in here by James Carder, the CISO at LogRhythm.

I hope you're listening, James. So he says the ATT&CK matrix is the most comprehensive list of TTPs available to the industry today. Not only does it aid in quick threat detection and response, but it also enables security analysts to attribute those threats to specific actors. It's no surprise that modern SOCs have quickly embraced the matrix. So I think what Alex is saying is, James, we know that a marketing person wrote that for you, and we're gonna give you a little bit of a hard time.

That is it for the news this week. Let's move over to the Slack message of the week. Thanks, big thanks to Andre Gaeta, who takes care of this for us each week. So we're able to recognize someone in the Slack community who's helping keep conversation moving forward and really, you know, making the community what it is. Yeah.

So this week we would like to recognize Sarah Roper. Congratulations, Sarah. Sarah posted an article about Equifax and the, uh, the FTC settlement that they had, um, getting either money or credit monitoring from them if you were affected by the breach. The article was talking about how the FTC came out and said, please stop asking for money. Equifax is going to run out of money.

Yeah. So, so a week ago there was lots of articles and stories saying, hey, make sure you go claim your $125 right now. All the stories are, hey, you're not going to get that money. Right. So more likely you're going to get $1.25 instead of $125.

But they were encouraging people to take credit monitoring instead of taking the money. For me personally, I was affected by the breach. I put in a claim for money because I already have plenty of credit monitoring from several other breaches. So you're saying you just took a little bit of money from me by, by doing that? I took a little bit of money from everyone.

Everyone listening, please don't claim the money. You don't drive my $125 down to $122. All right. That's right. All right.

Moving over to upcoming events, there are quite a few events coming up in the next couple of weeks, and then, you know, flushing out the rest of the year, things are getting pretty busy in the area. We do have a, a calendar of events on the website if you want to go out and look further into the future. colorado-security.com, take a look at the calendar and you can see all, all the things through the end of the year. First, SecureSet is doing a capture the flag cybersecurity hackathon on 8/6. On the 13th, there's a Splunk meetup.

It's a brewery tour and hands-on workshop making your own Splunk visual visualization app. You know, I've been pretty impressed with Splunk lately doing brewery tours, Topgolf, all the stuff. Good stuff. So they actually just, I don't know, in the last, in the last week put a recurring event on their page for Topgolf. It's going to be every month.

Yeah, the first Thursday every month. Every month. If you guys want to go golf 3 to 6 the first Thursday of the month, that's pretty awesome. Should definitely do it. ISSA Denver is doing their August chapter meetings on the 13th and 14th.

On the 15th, SecureSet has a Hacking 101, an intro to data visualization. So if you went to the Splunk event and you wanted— you learned about how to use Splunk for visualization, you can now go to SecureSet and get an introduction to it more generally. On the 17th, is this the ISSA Denver chapter? There's a CISSP boot camp session for Domain 1, Security and Risk Management. These are over, I believe, 6 or 8 weeks.

I think it's 6 weeks. And you can sign up with the link that is on the website. A very affordable cost for CISSP training. Yeah, it's awesome. They're, they're gonna take— was it— I think it's 9 to 4 on each Saturday, uh, and it's either free if you're a member of ISSA or it's $25 for non-members.

You're gonna get to go through all of that content, and if you're looking to get your CISSP, I highly recommend you take a look at this. Yeah, definitely. That is it for the events for the next 2 weeks. Jumping over to jobs, you'll see that there are way fewer Ping jobs that we've been pitching lately. So we've been— does that mean you hired somebody, Robb?

We've been hiring. Cool. So I do have one opening right now though. We have a GRC analyst role. This is an intro— introductory, intro type role.

Someone who's really looking to get into security, wants to learn about compliance, policy standards, help with our ISO certification, our SOC certification. This is an opportunity for you to join us. Next, the City and County of Denver is looking for a CISO. And we actually talked to the CIO at the City and County of Denver. Who is the person hiring for that job.

What he said, this is David Ettinger. He said he is looking for someone that is a strategic leader and also has change management experience. Also, the job posting is expected to be open through the 12th of August. So if you're interested, apply before then. Good stuff.

It looks like a really good opportunity, obviously helping the biggest city in Denver to improve the security across, I think it was 17 different departments. It's a lot of agencies. You know, Denver is the biggest city in Denver. Oh, did I say Denver in Denver? Shoot.

I meant Denver is the biggest city in Colorado. Thank you for pointing me out. Happy to. Moving along, Comcast is hiring a senior principal cybersecurity architect. Coalfire is looking for a senior manager in healthcare.

Did we just set a record for Coalfire references during Newscast? Lots of Coalfire references. Yeah, good for Coalfire, huh? Next, Twilio, speaking of Twilio, we just hired— is going to hire a senior manager on physical security technology. Kind of interesting, right?

That sounds like an interesting mix of positions. Western Union is looking for an information security engineer in encryption key management. That sounds like a lot of work. It does. Maybe you need to know math.

AMR, American Medical Resource, I think it is, the ambulance and Flight for Life people, they are hiring a cybersecurity GRC analyst. FireEye is looking for a senior information security consultant. Zvilo is hiring a head of cybersecurity product strategy. Sounds like a really fun job. Yeah.

If you've been doing security and you're looking to move to the product side, this might be a good opportunity. And finally, SANS Institute is looking for a manager of instructor development. Awesome. Don't know what that means exactly, but I don't know either. Sounds exciting.

But it's SANS Institute and it's here in Denver. They've got to be rolling in cash too, because their trainings are expensive. Did you just say that?

Hey, I didn't say overpriced. I just said expensive. They are expensive. And maybe you get all the value you needed for that. Exactly.

That is it for the newscast. We have a special treat. We're able to go back and play for you guys a keynote from the Rocky Mountain Information Security Conference. Yeah, we've, uh, sort of not on purpose been saving these up. Uh, we got all the recordings from the keynotes there.

As you know, we already played the keynote that Robb and I did with Debbi Blyth, but now we're going to go back and play the other keynotes as well. So Michelle Dennedy is the former chief privacy officer for both McAfee, Intel, and Cisco. And she came and talked to us about privacy, and I know you did the intro for her. I did. Anything you want to say before we let it go?

Michelle's awesome. It's a great speech. I think everybody will love it. Well, that's it for everybody. We'll talk to you guys again next week.

Thanks, Robb. This is Michael Glenn. I'm Vice President of Security at CableLabs. This is Colorado Equals Security for Colorado security professionals by Colorado security professionals. Alright, so enough of me talking.

Let me go ahead and introduce Michelle and get her up here to talk about what she is talking about. So Michelle Finneran Dennedy is recognized as one of the world's leading privacy experts, a unique visionary in the field of privacy in the IT industry. She brings together multifaceted approaches that provide sincere privacy protections and drive business value. Throughout her career, she has worked to raise awareness and create tools that promote privacy, quality, respect, trust, and asset-level possibilities for data. So with that, let's welcome Michelle to the stage.

Is that on now? I did forget one thing. If you have a question for Michelle when it comes time for Q&A, there are microphones strategically placed in the aisles over there, so please go to those to ask your questions. And if you don't, you have to do karaoke to The Rocky Horror Picture Show.

And for our juniors who are under 21, this is apple juice as far as you know. Cheers. So I'm going to kind of do an overview today because we've got a really, really great group of people, and thank you so much for having me. This is, and I say this only to you, my favorite ISACA chapter of all the chapters. And it's true because it's fascinating the discussions we've been having today.

We've been talking to a father-son team auditing and computer science and electrical engineering, lawyers, security people, business people, entrepreneurs, large companies, old companies, new companies, companies, and this really is the ethos, right? Eventually there will be a day when it no longer will be called privacy engineering. It'll just be called engineering. Right?

We're in the beginning stages of the sister, and sometimes the little sister and the redheaded stepchild, although I'm not a step. And privacy and security. So for the many, many years of my career, for a long time, I've been really sort of looking at what security did to become relevant, to become embedded, to become a multibillion-dollar industry. And I think that's really the beginning of where we are with privacy and privacy engineering and the next great buzzword that you're going to hear that we hope to put some substance behind, which is ethics engineering. So I'm really thrilled too also to have multi-generations here, even though they're talking to each other on their phones.

And yes, I can see you. I got you. But we want everybody to be— who loves to use these platforms, who really just grew up as a digital citizen, to be as cautious but as optimistic and excited about the buildout. The new careers that are available. So I'm going to kind of give you a hodgepodge and hopefully start to see people coming to microphones, and let's have a dialogue.

I know it's a large room, but we're all in it together, and I am willing to do Rocky Horror Picture Show karaoke, so you have been forewarned. Let me give you a brief history lesson, and this was actually drawn on my whiteboard in 2000 by my co-author Jonathan Jonathan Fox, and longtime business partner. Jonathan came— he was one of the early digital pioneers in digital licensing of written content, ebooks. And the publishers at Random House told him there will never be such a thing as an online book. No one ever will read a book on a tablet.

No one wants to read newsletters online, et cetera. And suffice it to say, that boss was a little bit off base. So when Jonathan and I got together, he was the editor of Sun.com, and I was a hapless intellectual property attorney focused mostly on patent law, and so what is circumscribed by the ownership of intellectual property. And Jonathan was sharing content using digital assets and was the editor of Sun.com at that time. So we were discussing in my office which is now the campus of Facebook, so there's irony abounds.

What— where are we, and how do we actually look at and think about protections? And this is before I invited my father, Tom Finneran, who's the 3rd author on the Privacy Engineers Manifesto. Now, he's been around. I always say that I was raised on a raised floor. He was around early in the '50s and '60s in the Navy working on compute.

And so I would come at it from a legal perspective, Jonathan from a business and licensing perspective, and my father from what indeed works in industrialized compute systems. I think I need longer arms. I'm not sure. The microphone feedback. So this is what we drew.

And, and so this is another deep dark part. It's part therapy and part keynote for me, so be forewarned. Within the firewall, I'll tell you, how many of you are CISOs in this audience? Or security? You don't really have to be ashamed.

Raise them high. Have you ever witnessed an incident or any sort of incursion on your systems?

She's laughing. Yes. Guess who never ever had a single breach? This girl. The world's first chief information security officer, self-titled.

I was 15. And I was the part-time receptionist at ExxonMobil. And the reason I say I was the first information security officer is I had the key to the closet that held the Wang. Do you remember the Wang? These guys are like, what's a Wang?

It was a computer that did not do very much, and once a quarter we would pull out the Wang, we would plug it in, and we would close the books for ExxonMobil for a lovely old gentleman named Arthur Gachet. And so Mr. Gachet would come up, and we all were Mr. and Miss back then, and we all had pantyhose, and maybe even Arthur, but I'm not sure. I never asked. Sorry, Arthur. And he would come and he'd say, can I have the key?

It's that time of the quarter. And I would hand him the key, and he would hand it back to me. So we had facial recognition. We had key management. And the information was within the business unit.

We really didn't share much. So you go to the next stage of the net, the opening of the internet, and so there I was, a young girl fresh out of college, not sure what I was going to do, so I became a paralegal in New York City. When you had to share documents with another party, particularly production documents, they would hand the kids myself, big litigation bags of documents, and you would have to either take a taxi or get on a subway, go downtown, go to the courthouse, relieve yourself of the documents, and come back with a pink receipt. Challenge, acceptance, procedure, protection. And documents were protected by the fiduciary care that a lawyer and the people working for a lawyer would have, and the ethical code of sharing an attorney-client privilege.

Procedure, technology, hardware, software. Then you get into the extranet, and this was the age of the portal. And this is probably early, we're getting to be like the early aughts at this point, late '90s, early aughts. And every marketing person would come in all excited and go, I know what we need, a portal. Like it's the first flipping idea.

There are children here. Let's do a portal. And so suddenly this firewall concept started to degrade because everyone needed access to our networks. So I know that I'm— this is ancient history to a lot of you, but as we talk about privacy engineering and the impossibility of the task of thinking about privacy in our modern world and IoT and ML and AI, think about where we've been and how impossible it seemed to make sure that the right person had access to the financials, that the right documents were received in the right place, in the right integrity and time. So as we move all the way to the age of intelligence, we hope— look at all of these dynamic connections.

Its speed is different. The business models have changed somewhat. But the concepts of integrity and quality, ethics, fiduciary care, sharing of information, those have remained stable quality factors. And that's where we begin our journey, with a look back to the past. Now, privacy is an inflection point simply because it has grown so exponentially important.

I've been in the privacy industry for well over 2 decades. And the themes repeat again and again. But what's changed now, particularly in light of GDPR and all of the activity in Europe and all the echoing types of GDPR-like laws out there— there are criminal penalties in Mexico, there are criminal penalties in Asia, there are reputational harms all over the world in privacy breaches. But GDPR is most interesting to me as a former IP attorney because Because if you look at things like food safety, antitrust, drug distribution, and the ethics around those things, and then you look at the quantum of harm and GDPR's fining authority up to, to 4% of global turnover, and you're seeing that same quantum of harm. So that says at least one major region of our world has decided that data protection, privacy, integrity of information is worth at least as much as businesses colluding to fix prices or food degradation or the supply chain of drugs.

That's interesting. That's a business. That's not just us doing the right thing because it's the right thing. That's us changing our culture and changing our world and allowing our laws to start to adapt. To where we're going.

So we need a strategy and we need a business. So this report is something that, that my team put together when I was at Cisco quite recently. You can find all these materials for free at trust.cisco.com. We actually for 3 years have done what we call the Privacy Benchmark Study. Now there's a lot of studies out there talking about how much is— does it cost and how much disruption in case of a breach.

But I think it's more interesting to look at the day-to-day, what will happen if we do our businesses right. So we do have some information about breach, but what we ask the question is, what has the investment in privacy done for you lately? And the answer is quite interesting. And I'll tell you where I sort of— the spirit behind this was in a prior company when I was more consumer-facing, whenever a client or a customer or salesperson would come to me and say, hey, you know, we've got this deal that we want to do, but the customer is concerned about privacy and/or security, that's time zero. And I would count the days until that issue was resolved.

Sometimes it was resolved because they wanted to know what the product did, what kind of data it processed, what kind of protections were in place, what kind of certifications we had, what terms we were willing to agree to, on and on. And then I would, I would track that over time, and I call that number data friction. So when someone says to you that privacy and security are simply bumps in the road preventing good business, I ask them what the privacy friction number is. How much time are you wasting on highly trained staff, knowledge workers that you're not gonna substitute with people who don't know what's going on, to answer these questions and close business. And the results were interesting.

The first time we did this study was the year before GDPRpalooza last year. And the outlying number was about 16 weeks of delay. How many of you have salespeople that work for your companies? How jazzed are they to wait over a quarter after they've gotten their client to say yes? Not so happy.

So what we found was when you do the protections, when you do the math, when you do what everyone has advised today— know your data, know where it is, know what terms you're willing to agree to, implement the basic security requirements— you start to reduce that, and it becomes statistically very relevant. So last year when we measured before the GDPR deadline, we found that we went from companies that were doing nothing about data protection, maybe some in security, but nothing really in protection for privacy. They could take their data friction number from 16 weeks down to about 7 weeks simply by getting to a modicum level of maturity, having a couple policies in place and doing the bare minimum. Last year we repeated the study and And we found that the data was even faster. So friction went down.

Here we go. Give you some real data. So we asked the question in a different way. We said, are you GDPR ready? And the question is kind of a tricky one, right?

Because if you ask an old hag like me, I'm never going to say I'm data ready because I'm always looking at the next nuance. But generally, people who are pretty new to the game saying, I feel pretty confident that we are at least at that compliance level, we found 87% of the organizations were saying that they were having delays due to questions or data friction or sales delays based on security and privacy. The 13%, I still am very skeptical about. I think it's like that security number where the people that say they haven't been breached yet just don't know. I think that people that are saying that they're not having delays just don't know, and they're not talking to their lawyers enough to know, or they're not talking to their procurement staffs enough to know.

But what we found is really interesting. So even though the weeks are already shortened by just the mere exercise of awareness of GDPR and its likelihood of being extraterritorial in its risk, so we saw that the outliers, the least ready, the ones who did the least work to get ready are still at about 6 weeks of delay. That's still shorter than that long 16 weeks that we found the year before, but the ones that are GDPR ready, they did not invest to make their businesses go faster. They did not invest to make the sales cycle increase. They thought they were investing in compliance, but look at this: 5.4 shrinks to 3.4 weeks in delays.

That's an appreciable business improvement. So just by looking at different kinds of data and tracking what happens— this is a correlative study, not necessarily causal, but I think over time we're going to find more metrics like this. So instead of saying, how many PIAs did I perform, how many audits were performed on my products and my services, if we start asking in the day-to-day operation, what did we do better, faster, stronger with the way that we handled and managed and thought about our data? I think we're gonna find some interesting metrics. John Chambers told me that the most important metric for him as a board member is a trend.

So give me an absolute— have we been breached or not— and he's scared, but it's an operations number. Give him a trend, and that's That's something that people who are sitting on public boards in particular, private boards and investment bodies, are looking at over time because that's something they can control through management, through training, through positioning, through product mix. Creativity starts to creep in when you start to understand your data. So you can see why as a privacy engineer, I start to get really excited when I think about business, and it's not because I've sold out and I don't care about human rights anymore, and it's not because I don't care about compliance. It's when you become relevant to the core of our organizations, you start to see some really interesting things happening, and you also start to build allies from across the business that can really get excited about what our mission is here shared collectively.

I thought this is one more thing from the study that I'll quickly share with you. My countdown clock is not working, so So we're just going to keep going. I'm looking back at Lon back there. We also asked them, did you experience increased benefits in other ways? And really there's a— oh, look how fast he goes down as soon as I said anything.

Thank you. We found that people were reporting things like agility as something related to their activities and understanding where their data is their flows were, competitive advantage over their colleagues, operational efficiencies. These are things, just as in the 1920s when we started having dual booking accounting for money, suddenly even if you had $0 at the end of a year, but you had 3 factories, people were able to invest in you more wisely instead of just saying, who's got more cash at the end? This is the dual book accounting for data that we've been looking for all these years. Operational efficiency, product mix, how are you dealing with your agile creation of products and services?

This was a— so the first study I showed you was something that we did to research using survey-based information, and it has its flaws like anything else does in methodology. So we went a little deeper, hiring a firm that does— is not a privacy or security firm, they're a business firm and a market-shaping firm. And I thought this was probably one of my favorite quotes out of that study, was that companies must be good data stewards. If you're not, we will not do business with you. This was a hospitality company.

We will not do business with you. So it's not just a slowdown. Customers are looking for a way to reduce their risk. Risk, and not by being very specific about what type of certification you've got, what type of firewall, are you doing advanced firewalling, do you have a role-based access system, have you pen tested. They're looking for data stewardship.

They're looking for the story. They're looking for the strategy. And they're looking for companies to do business that they can trust as they thrust themselves forward into this new information age. So this is that kind of tipping point yin and yang that I'm talking about. Having a customer market expectation, having a competitive differentiator, not just I'm better than person X, but I'm better because I'm beating myself at this trend.

Looking at the risk landscape holistically in data. And then finally, but not exclusively, looking at your legal obligations. If you're only looking at compliance, you'll find this teeter-totter desperately out of balance.

So this is a program that I've now— I feel like it's Groundhog's Day. I've worked for many, many infrastructure companies over the years. Jason and I were talking about it earlier. I build good programs. It's kind of what I do.

I walk into burning buildings and go, oh my gosh, you don't have a program and it's been 20 years? Where have you been? This is what I'm going to walk in and say to you. If you're in this position and you don't have a data program. You need your policies and standards.

You need to identify and classify where your information is. Data risk, organizational maturity— where are you? What's your appetite? Incident response. All of these things are absolutely table stakes, but not alone.

So I'm not going to go into this whole thing. This, again, is my most recent company, Cisco. I left a couple weeks ago. What I like to say about this slide, when I was still there, is I said, you know, I came in 2016, there was no privacy office at Cisco as of 2016. It's pretty astonishing.

But I bet there's a, there's a lot of companies out there that are similar that say, we're B2B, we don't collect people's credit cards, we don't hold information. But you do have over 100,000 employees 95% of your information does flow over Cisco systems at any given time, anywhere in the world. It was a wake-up call. They were shocked. The thing I like to tease my former boss about was that in 2016, the stock was at $25.

When I left, $56.

Just saying. Just saying. I know it might not be causing causation, but it's a good correlation, isn't it? I like it. This is also— I like this graphic because it also makes an illustration literally about the creativity that you can bring to your privacy practices.

Because I was all over the place doing podcasts to educate my sales force. I ran a sales team at Oracle for 11 months, 3 weeks, 2 days, and about an hour. Not that I was counting. If you're at Oracle now, I apologize. So much drinking.

Water. Drinking water.

What I realized when I was in sales, I started reducing all the lawyers' names to one word: legal. Like Bob, Sue, Jan, and legal. And why is legal holding up my deal? And what I realized is that even I, who am legal, never took my own trainings, and I never sat still long enough to get all these benefits of risk and reward and security and so on. And we were selling security products, but I realized I spent a lot of time in airports.

So I launched the Privacy Sigma Riders podcast because I needed to meet my sales guys where they were, and I realized what they need most is to have a new conversation. They need a reason to call and pester you to sell you more things. And so what I decided to do is invite different guests who are manipulating data in different ways onto the show. And I found that the most popular use of the podcast was by sales guys trying to really understand what that C-level conversation looks like. So just because you're in compliance doesn't mean you can't be creative.

It doesn't mean you can't do business studies. It doesn't mean you can't be deeply, deeply technical, especially for my young friends out here in the audience. Whatever your interest is, you can be theatrical, you can be solitary, you can be deeply technical, you can be it all, sometimes at the same time and sometimes in serial. All of that absolutely has to happen in this rising marketplace. For data.

And sometimes the stock doubles. Again, just saying. So getting a little bit deeper, and I won't go terribly, terribly deep into privacy by design and privacy engineering because we had a great panel today talking about it earlier, but basically, you know, so now the law says— I was very helpfully— what's a non-mansplain word? How do you say mansplaining without saying mansplaining?

Bullshit.

That's a good one.

There was a gentleman who happened to be cisgendered male, and then he said, but privacy by design isn't the law. And I thought, I'm so weary. It is the law, as it turns out. So what I said to him at the time, which was kind of a— and the word for this is bitch, sorry. I did that.

And I just said, well, is your problem with GDPR Article 25 or 35 or Recital 39? Because what? Privacy by design is the law. The problem that we all have with privacy by design and this fine young gentleman, we'll call him that for now, his reaction to privacy by design is not a law, is that privacy by design is not a well-defined law. There isn't a great best practices, only practices, punch card kind of-esque thing to say what this thing is that is now required under the law.

And if you don't have it and can't demonstrate it, you could be putting your company at terrible jeopardy, at least in the European theater, and coming to a theater near you. I just came up with that on the spot. I'm kind of pleased with it. Thank you. I like that.

I wish I was there for that— the real comedian later this week. I'm excited for you to see her. So this is what I do with privacy by design. This is an exercise that you can do even if you haven't been drilled and skilled in privacy by design. Really figuring out the what, why, where, how, and who of any other design project.

So anyone who's got skills in this room in walking a client through new legal paradigms, you are a privacy engineer. Anyone who's done a technical requirement setting, you are a privacy engineer. Anyone who's run a business and needs to know where their customers are and how to sell to them, you are a Say it with me, privacy engineer. Why? Because you need to understand what the business rules are to manipulate data.

And that's where this all begins. So rather than being terrified by this brand new thing that's just started and we don't really have any rules and aw shucks, we can all dig in and start with what, how are we prioritizing these requirements? What, how much data, where data? Where in the world? Geographical questions.

Who, what, why, when? Be a reporter on your own business. So what is privacy? I probably should have answered this earlier. And there's— this is, I think, a particularly tricky thing with the word privacy, particularly in the US.

It's not about wearing pants or the lack thereof. That's good humor. Come on, pants joke.

But in China, the word privacy means embarrassing secret. It's rude to not share information in certain parts of the world. Saving face and presenting a certain face is privacy in certain parts of the world, right? So what we really needed was an operational definition to be able to share and break down what we were asking for when we walked in, particularly into technical environments, and said privacy by design. So what is privacy to a privacy engineer?

This is my definition. Privacy is the fair and legitimate processing of personally identifiable information. Super easy, right?

No. Not so easy. But you can break it down into its components. So personally identifiable information. I have had argument after argument in countless companies that IP address is not really private.

Gentlemen, ladies, I know that it is the addressing system of the internet. I feel you. However, some of the folks that write the laws, they're not technical people. So in many instances, even something that is exposed to many, many people and all who would and could look might be personally identifiable. The trick is to understand, will information be pushed or pulled from a recognizable human being?

If the answer to that is yes, then it's in scope. That does not mean you can't use it. That does not mean you can't run your business on it. It. That does not mean that you can't have a business plan around it.

It simply means it's in scope. So don't panic, but think very expansively about what is in scope when we're talking about privacy engineering. Legitimate and legal basis for processing. This is where laws may vary around the world. And so you have to make sure your lawyers and people who are very well versed in the nuances of where you're doing your work and where you're targeting your business are in the room.

And this, this all applies, by the way, for government instantiations as well. I'm using the vernacular of corporate private speak, but this works as well for agencies or other sorts of governments who are dealing with citizen data rather than customer and employee data as well. The fair information principles go back at least into the So there's a lot of information, there's a lot of checkboxes about collecting only that what you need, minimal data, understanding that you have a purpose for that information, you've specified it in advance. These rules sound an awful lot like really good engineering rules. You would never build a bridge by going out and buying a bunch of steel girders.

You probably would measure the materials that you needed. You'd probably measure the span. You'd probably figure out what licenses and safety codes and neighborhood standards and artistic requirements you needed. This is the same thing. We're talking about building bridges for people.

Let's build with the same amount of care that we build physical structures. And then finally, I put processing up here because so often in the privacy dialogue in specific, we get so stuck on consent, notice and consent, notice and consent. That's like saying, hi, my name's Michelle, let's get married.

As enticing as that may seem, talk to my ex-husband.

Woo! He's like, you think she's crazy for an hour? Try 20 years. It was really— I think that one needs another. This is apple juice officially.

Bless you, Tom, father of my children. Anyway, what were we talking about? Oh yeah, privacy. Sorry.

Consent. Lots of consent. So processing is something that we forget about. We do the collection and we think we're done. Because we're thinking about compliance.

I bet all of you have a dirty little secret. It's like that card trick where you're like, oh my god, how did they guess the card? You are storing data for too long. How did she know?

Because you're all doing it.

Processing is everything you do with data, even if it's sitting still. How many, how many STK alums are in this room? StorageTech? All right, we have at least one. We bought those guys at Sun many, many years ago, and we had this ongoing dialogue that was just adorable with many of our customers talking about end-to-end encryption.

This is about circa 2008-ish, something like that. And they would say, well, we want— we demand in our contract end-to-end encryption, and, and yet half of their data was on a storage array on tape. I'm a psych major and I know that's impossible. So think about all the ways that you're processing. Think about all the dirty little habits and secrets that we have in the IT world in particular, and then figure out how you mitigate.

So if you don't have a data destruction plan, if you haven't figured out how to cleverly abstract the information that you're storing about individuals, the California laws are coming for you. There's going to be more and more of these types of laws that are figuring out what do you have. And suddenly those quiet little Iron Mountain instances that we try not to think about, it's like a show of Hoarders where the cameras are coming in and showing all the things. So think about very broadly, and I know I'm only on the definition and we're halfway through the talk, but that really should be the proportion, right? When you're thinking about getting ready for a privacy instantiation and privacy engineering, spend at least 50% of your time getting ready, if not more.

Spend a lot of time thinking about what are the pros and cons of the outcomes rather than the features that you'd like to build, and I guarantee you're gonna have a better result. So privacy and ethics engineering is today's answer. And I believe that, and again, this will just turn back into engineering, solving problems with the materials to hand. And if you read the old-timey professional engineering codes, it's really interesting. There are— there's so much on ethics and doing the right thing and not doing any harm.

And we've really forgotten that in the technical world, haven't we? We kind of forgot it was there in the beginning. But it was really fascinating going back and looking at the ethical codes for lawyers. I had to take a separate ethical bar to become a lawyer. Now, all lawyers' jokes aside, and aside from some of the ones you see in the tabloids, lawyers are actually quite ethical creatures.

And we stand on the law and we respect the law and we serve the law. And engineers are actually quite ethical creatures. They build within certain standards. They respect math as the universal language and certain truths that can be inalienable. And I'm not talking about blockchain, but I have to say it at least to make the bingo cards work.

So think about privacy and ethics engineering as process innovation and data centricity when you're building out your solutions. It's a functional requirement as well as a nonfunctional. And this was a sea change. When we first started doing private engineering work, gosh, 15 years ago, it was kind of like there were all of the real things. You know, are you going to use AC or DC power?

Are you using parallel? Are you using containers? Are you using this type of OS or that kind? That was all legitimate conversation, but when I would come in and talk about separation and role-based access and segmentation and minimization, somehow that was delegitimized as something something that belonged in a legal document or disclaimer rather than as a functional requirement. Put it in as a functional requirement and you'll find all of the pieces and parts start to make a lot more sense.

We need multiple players, and particularly for people who are thinking about switching in career or certainly young in career, your career will never be linear in this field. I have been in sales, I've been in public policy. I've been in engineering, which is remarkable to everyone in my family that knows I'm a flashing 12. I've definitely— I've been in law. Thinking about yourself as a multidisciplinary sort of Swiss Army knife and getting with people that are really, really dug in and devoted to their one career, their one specialty, makes every one of these projects better.

It gives you that diverse outlook. It starts to make your audience look a lot more diverse too, because if you're looking for who is really using the system over time to figure out how are you going to road test it for quality, you're going to find a lot more young people in your conversation loop. You're going to find board members that you're not afraid to talk to because you're asking very specific questions about strategic trends. You're going to find the directors who run everything in our companies. I always tell people in my speeches on leadership that once I became a vice president, I had to learn to get really dumb.

And my team is like, that wasn't hard, which isn't nice. But you have to learn to trust, right? So once you get to a certain level, you look at the people who are the ones who are doing the things and measuring the things and holding true to the things, and you have to ride on top. So a privacy engineer and a leader of those teams has to understand and feed those teams and those needs. The words people, the math people, the process people, the finishing people, the strategic people, the artist people.

All of those people come together and make a really solid system.

So this one I'm just gonna flash kind of quickly 'cause it's a little bit of a word salad. Most of the privacy policies that you see written today focus on that little tiny bit, which is the law. All of these other things that go into a real privacy policy— your privacy policy, if you're an old-timey computer science-y type of person, they are your business rules. Just let that sink in. Your privacy notice is your business plan for data.

It should tell your users the risks that you're willing to take, how you're investing, where you're investing, and what your intentions are with that data. Realistic technology capabilities— some things you're going to process with automation, some things are incapable and you're going to have a human doing intervention, some things are going to be your ethical obligations. So even if you can in today's technology, and this will become an increasing question for every young person in this room. We can do so many things that we could not do, the technology could not do universal surveillance in everyone's homes. The technology can do universal surveillance in our homes today.

The question, should we? Is that the society we want to live in? These are the heavy, heavy questions that you should be asking when you write your privacy policy. What is the should? What is the line that we will not cross?

What, what kind of government is a bad government? And is it a foreign government anymore? Does your policy need to change with your politics every 4 to 8 years? I don't know the answer to these questions, but I think you need to ask them. Because it's amazing to me, particularly as I travel the world, the perspective on what is ethical and what is not ethical.

In a collective society, patents are selfish. You have the answer on how to cure some drug and you're going to charge $1,800 a month to people that can't afford it? That sounds immoral to them. To us, it sounds like capitalism. And to other countries, we go in and we say, you're stealing.

Why are you copying all of our intellectual property? They think they're sharing. I'm not saying one's right and one's wrong, but you have to understand how you're designing in the context in which you're designing when you're sitting on a little planet as small as the one that we're sitting on. And I'm not making any judgments, but I'm saying this goes into the hard stuff, the brand identity, the industry standards, the, the long list of things is much harder than the law, and the law is hard. So the law is very gray, and you have to stake a claim.

The other sides of stuff are things that you decide. Decide for yourselves, decide for your business, and just draw them out and write them down and look at them for a few minutes and go, hmm, can I live with that? That's how we do the bigger privacy policies. And then if you can communicate them with music, with cartoons, for McAfee, back in the day, I did a graphic novel using ninjas to act out our privacy policy. We graphed it line by line.

It was a 16-page single-spaced document that was our privacy policy with all the required legal gobbledygook, and it was about an 11-page graphic novel, and every single concept was reflected in art, in an activity, in something that you could interact with. And I felt it was really important, not just because it was kind of cool and fun, but because that was a consumer business doing something very invisible, which was mobile phone surveillance in many ways. And to actually communicate to our customers at a level they could actually understand needed something radically different. And so that was the decision we made at that time. So think about all the different ways your privacy policy is sitting there and not being— it's kind of a fallow asset.

Every single one of you should be writing a privacy policy or having a partner that's writing a privacy policy. Think about elevating it to the brand. The requirements, I think I've, I've beaten this, this horse rather desperately, but across all things, it's not just a technical requirement, business data system. I'm going backwards. Oh, I am going backwards.

All right, let's, let's not go that way. So once you get through all of the business cases and you've decided to write your privacy policy as a series of business rules, you can select a number of different known paradigms. This happens to be the Fair Information Principles framework that's kind of listed as this little stack here. You can use GDPR and the notions in there. You can even use the California law if you can decipher it.

Call me if you can. It's bizarre. Not that I'm judging, but I'm judging.

Pick one and say that you've picked it. That's the most important element in picking your controls.

So this is going to be a word salad, so I'm not going to beat this one to death, but this is basically the existing secure development lifecycle at my last company. And all of this was in place for security. Wasn't always followed with as much vim and vigor as I may have liked. People weren't excited about it. They thought that it was a compliance thing.

But what we did is we took this thing and we said, this is something that follows the entire lifecycle of the data. It's already required all of the PMs that are managing product development and offer development at the company across 124 different countries have to already know this wheel. So why would I try to teach them a new wheel? Let's pull this thing out and let's add on the privacy elements of secure design. Doing a privacy policy review, starting with my business case, figuring out what the data scoping workshop is, what are the elements of data that are required by the business, doing your first privacy impact assessment.

How many third parties are going to be important for this service instantiation across the globe? Really important question to ask before you get to the contract stage. And constantly updating and embedding your privacy impact assessments, having contracts involved. You can see how this is so multimodal, but every single one is a discrete and executable task. Every single one of these things on this wheel is something that I could measure that wasn't just an activity measure.

It was a quality measure, and it could be brought and compared and even competed on within the business. I could show one PM that the competing group that wanted to get to market and be launched at the same big show was not as far along in their wheel. Nothing like a little healthy competition. To get things spicy at work.

So the scoping requirement works for Agile, any sort of secure dev cycle, Agile, Waterfall, anything you want to call your project design. Wherever there are scopes and stages and hallmarks and benchmarks, even if they're incredibly fluid and you've got Scrum Masters who the basics in FAIR principles and can say during the development process that something has gone askew, you can add those in. This goes back to that question seeking again. What is the context? I'm always looking at the context.

So as Jason Cronk was talking about earlier this morning for his example is, what if your landlord put a camera in your home? And everyone kind of went, ooh, that's a privacy violation. Now, let's change the context. What if we put a camera in a home for Alzheimer's patients? Not as creepy, because we have different needs and requirements, but still a very sensitive population with some health needs and definitely some dignity requirements.

But the context makes it go, hmm, maybe that is something that we could work with. Maybe that is something desirable.

Again, outcomes and business rules. Step away from the project. Put your hands down and close your eyes for just a moment. And I know that everyone's got a launch schedule, particularly in tech, and everyone's rushing out the door, or everyone's got a marketing something they have to do. Are we still doing the thing that we should be doing?

Why are we doing this? How am I going to explain this? Does it still make sense? Am I now collecting too much data? Did I overthink it in the first time?

It's like Coco Chanel, always take like the extra bangle off for the most elegant look. Nothing. All right, forget it. Do you guys even know who Coco Chanel is? All right, see, this young lady knows.

She's like, yes I do, queen. I like her. She's got good makeup too. She's already done the duck lips. Twice.

That's going to be my next privacy policy, all in like duck lip. These guys are like— this side of the room is like, I don't know, and these guys are like, oh, she is so uncool. I hate when grown-ups try to be cool. I can feel my 13-year-old eye-rolling me from California. Anyway, the outcomes and the business rules, understanding that if you're talking to teens, you will inherently be uncool.

I think that's the lesson learned. Now these, I hope you can see them better on the screen.

Who recognizes every single one of these types of diagrams? Everyone who's got gray hair or is covering up gray hair, raise your hand. Thank you.

They're like, yeah, it turned gray when I was 25. Give me a break, guys. It was God's way of saying you can pick whatever color you want. I choose red. These are classic, classic engineering diagrams.

This is the language of math. This is the language of technology. The first one over here on your left is something we actually drew on a napkin with my then 17-year-old nephew. Because the question we asked is, can we make privacy engineering available to startups? Can we take a napkin and a box of pizza and design an app in a weekend?

Or have we gotten so off course that we're only thinking about Disney and Marriott and Target and oh my? And the answer is yes. So my nephew, who's now at the Boeing Company, very proud, at the time was just a 17-year-old junior who was interested in computer science, bless his heart. Have not been able to get my girls into it at all. And we said, what do you, what do you want to do?

What are your interests? And he's a long-distance runner, and so he said, I'd like to design a runner's app. Great. So there's some passion around it, and he likes to code. So what are the business rules around this?

What do you want out of this? Let's not think about the tech. Well, I want to be able to share my run even when I can't see with my teammates so I can compete with them during training. Okay, we've got sharing, we've got personal connections, and we probably have some kids that may be under 13, so we've got some legal requirements and limitations. Okay, who else needs to see your run?

Oh, the coach. Okay, who does the coach get to see? Everyone? Is he like our super administrator? So we went down in this, and so we had a security problem because the team across the street should not see the training times, right?

So we've got people we want out, we've got people who we want in, and we have textured sharing, and probably not with the whole world, and maybe not even with mom and dad, 'cause maybe you've got that slacker day that you don't want your tiger mom to know about. So we sat down and we said, okay, these are your business rules, and we're able to design with a privacy component of what are the should do, must do, only have, information-wise, and we did a little user diagram. Who are the players involved? Coaches, runners, other runners, the different team. All the players are literally on the field of the napkin.

So now we know who the users are, and we know what level of involvement they're allowed to have with our data. That's interesting. Now, what's not here is maybe you have an administrator from the school district Maybe you have a lawyer that needs to check it out. Maybe you have an auditor. You know, this can get elaborate.

The second diagram shows the beautiful mastery of a metadata model. We have forgotten the lost art of modeling our data. We need, like, America's Next Top Model for data.

Now these guys are like, she's gone full dork now.

So savage. But if we had a metadata model, we would understand what are the lines and what are the tables, entries that we actually want? What are the related datasets and how do they relate to the activities that are our business rules? This is old-timey stuff. Do you know when we used to model data the most?

Punch cards. In 1973, there was an incident at the Standard Oil Company in Cleveland, Ohio. And one Tom Finneran brought his 5-year-old daughter to work with him. And she saw a stack of pink cardstock sitting in a room that was really nice and cool. It was summer, so they went in this nicely air-conditioned room that didn't have a lock on the door.

So shame on them for physical security. And I thought it would be really good to make paper dolls.

Yeah, no. Corporal punishment was a thing in 1973.

We'll explain all of that to you guys later. When you had to do punch card and you had one chance to get it right and you were not pulling off tangible pieces of code that were in open source of unknown origin, You had to get it right. These days, it's the opposite. You can build really fast, but your impact of devastation can be forever. Yes, I would cheer for that.

Don't let her clap alone.

That's how we do it in the sisters. So. Now we pull down objects. So what I'm advocating is we go back to the things that worked, and we take a minute, and it doesn't take that long, to do a metadata modeling to understand what are these data elements. And the other thing that I think you'll find very interesting as far as it comes, because I'm always thinking project and budget, because at the VP level, like when you take out that actual functional knowledge, what goes in is how am I going to get the budget?

That's like, I still wake up at night. I've been gone from Cisco for 2 weeks. I wake up at night and go, how am I gonna get the budget? And how I get the budget is by not walking into the CMO and having her say, I don't know what I wanna do. I just need all the data 'cause I wanna make a data lake.

It's gonna be so cool 'cause we're gonna find out stuff about our business and then we're gonna be really competitive. I'm so distressed. It's like a really bad flashback to high school. And you're looking at her going, this is so dumb. Not my CMO, mind you, because she's super smart.

Because I'm independent now, so that was a fictional CMO. But if you ever had a CMO that said, oh, we need all the data. We need a data lake because we're gonna get all this value because I've heard about this thing called big data and they throw in things like blockchain on top of it. If you've got a business plan, you've got players mapped, you've got a metadata model, you can combat that budget bloat conversation and say, this is the target, and if you need to add on more capabilities, we can because we've now compartmentalized the functionality of our systems through privacy engineering. Through the wonders of privacy engineering.

And we've secured our data because we know what the risky targets are, because privacy and security are starting to become so interwoven that you can barely tell the difference anymore, right? Because all you security people are going, why is this all about security? I kind of tricked you. Because it's the same, right? And then the final thing is I put this up here This process flow.

Can you put— Lon, can you put the boring slide back up? I was like, ooh, that's a lot of me. Okay. That's a little bit too much me. But the process document on the end, that was a joke.

You guys are supposed to be like, oh my God, she's so skinny. Why is she making that joke? Thank you for the giggle. I appreciate it. Therapy at 10.

More drinking. But the process diagram here, and you don't have to really grok it to see the majesty of it, all of these are the process flow of the data interactions. Everything is data-centric. What's really interesting is when I have the conversation initially without a process map about where do we think the risk is, we think it's maybe where we're processing the credit cards, maybe it's in the marketing databases that are getting stolen left, right, center, maybe it's in the executive tent. No.

You see where all the crowded activity is? Guess what that column is? Your call center. Your call center. And I wouldn't have thought that intuitively, that that's the most rich interaction of every database.

Someone has forgotten their password. Another person needs to configure their system differently. Someone else is having a problem. Look at how much access that cluster has. Now VP brain goes back onto budget, and I think, where do I prioritize my security?

Ah, where's my surface of attack? It's actually not necessarily exclusively in PCI. We have to invest in that, but there's only a couple touches when the purchase is initiated. Or if it's rejected, where we have to invest in the vendor training, in the rigor of security, in understanding how to limit, lift, and separate our data, in this instance, is in the call center because of the level of interaction. In my head, I would not have grokked that from a written document, but I did grokk that from doing a process flow document.

Now someone else's brain is going to look at that very differently. They're going to say, speeds, feeds, redundancy, how do I keep that system up? That's a 24/7 system. That's the beauty of having these communications between math and drawings. This is why we have cave drawings that have lasted through history.

This is why math is the thing that defines us as probably the last thing that we can all agree on as a society. Geeky, boring, engineering, is probably the sexiest thing you can do for your company.

What's that?

Did Comic-Con break math? Oh, no. Comic-Con didn't break math. Don't do me like that. That's not nice.

I have so little hope left in this world. Don't take away my math. So these are— I'm not going to run through these. These are the same stack of requirements. These are the fair information principles.

When you're building out your requirements list after you've gone back and you've done all of your mapping, now you look at your requirements list. And you've already discussed context. So this is where you discuss— so this becomes how you're going to present to the board. This is how you're going to present to project people who are actually doing work. This is going to be how you're going to to present things cleanly, easily to get auditors and legal people off your back.

Having all of these things broken out, what's the legal basis? How are you gonna be transparent? And all of these have choices. And I think that's one of the most exciting things about this market is it's so undefined and yet it so hearkens back to how we initially thought about compute in the first place. But there still is so much room for creativity and competition and tooling in this arena.

I mean, I think the beauty of all of this is, and I'm going to stop after this one, actually I'll just flash to the last in case there's any questions or just questioning my sanity. Every one of these slides should look really boring to you. That's kind of the beauty of it. The blank canvas of Google is why they won. I actually, the worst financial decision I ever made was they asked me to be their number 7 lawyer to do compliance.

And I was all excited. I was like, ooh, I just started doing privacy. I do IP law. I was doing patent litigation. And I just got into this privacy thing.

And they said, we think this company's gonna be bigger than AltaVista. I said, wow, you think? And I went down there and they said— I said, this is great. I know privacy and IP, and these are your 2 issues. These are your Achilles heels.

And the boys said, nah, we just want you to do socks. We don't have any privacy problems. So I was officially right, but I'm officially not wealthy. If you go for clean screen, as did Google— I'm not suggesting you go for their privacy stuff, although I hear they're getting better.

You will get down to, you will notice at the top of the stack is your enterprise and user goals. That's what we've been talking about this last hour. You will be starting with those business rules. You won't tack them on and get someone to artfully pretend that they're there when they're not, because they're already living in your document. By the time you get down to your requirements setting, you will very clearly understand through your diagrams, through your metadata models, through your understanding of who your users and players are in the field, you've already got this documentation.

What is a procedure and a process, and what is a mechanism or a piece of technology that currently exists or you're about to invent? And then you go back through the healthy loop of quality assurance and adaptation. It should be dead boring by the time you get to product. It should be dead boring because you know exactly which leg of the pants to put on first.

That's kind of an okay-ish joke, right? All right, so I'm not going to go into a lot of this stuff. What I will show you is there is a lot of innovation. This is something I just launched right before I left Cisco. Instead of having a 14-page disclosure of where the data was for each of our products, again, my number is the time to close efficiency data friction reduction number.

Instead, I I went back and I did what they did for the London Underground, and I drew maps, and they're relational maps to say, this is the customer, this is the company, this is the subprocessor. You can see the itty-bitty map on the corner that it's an international database, so that's a conversation we might like to have, and you have a different kind of conversation when you know what you're actually talking about rather than shadowboxing with the boogeyman.

So this is what we've been talking about. Number 1, understanding your data— foundational. 2, you're embedding your controls because you know what the context is and where and how and whom to protect. 3 is this notion of democratization. Democratization does not mean everybody gets some.

That's communism. In a democracy, there are rights and responsibilities, and they're clearly enumerated. So even if people have access to documents, And access to information, it's for a reason. And there will never be a reason that is secret and nobody knows about it and maybe it's to manipulate an election. No.

There's no oops-a-daisy. That's sloppy engineering. Moving up the stack helps to prevent— that's not to say the bad guys won't get crafty. Bad guys will do bad things. That's a given.

But we're going to plan so that the right people get the right data at the right time and understand their obligations. There's no free lunches in data anymore. These drive— woohoo! Yeah, I give an extra woo for that. These drive the business insights that matter and are actually related to your actual capabilities.

So it makes it a lot easier to sell your stuff because you have real value. He's running out to build something right now. Are you afraid of the karaoke? Look, I see all 3 of you. Yes, you.

I love to embarrass the teens. And then 5, you're maximizing your value. And this is where, if you've measured everything and if you've followed trends, you're understanding where your investments should be and how you show your bosses that you are winning and winning hard.

So I like this one mostly because the title of the article was called The Privacy Revolt, and I've always been a tiny bit of a rule breaker. A little bit. But no matter what market you're in, no matter what service you provide or product you sell, from right now until the end of time, you, my friends, are in the privacy game. Welcome to the party. So that's it.

We are on zero seconds. And we're on our way to cocktails. I am the most findable privacy person in the world. Find me on LinkedIn, find me on Twitter. Let's have a conversation.

And welcome to privacy engineering. We need every one of you to pull an oar. Thank you so much for your time, and, and thank you so much for having me at this wonderful event. Thank you.

Learn more about the Colorado Security seen at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado Equals Security.