Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 146 for the week of January 6th, 2020. We made it!

2020. What do you see coming up this year? This is 2020. Bobberwawa.

I do feel like we have clearer vision this year. Uh, I can't even continue after that. We're doing our best here, right? Uh, you know, this is also, um, a big year for alcohol. This is— oh, is that right?

This is the year of Mad Dog. Mad Dog 2020. Holy smokes. So for those under 21 listening, just pretend like we didn't say that. Yeah, or those that didn't live through the '80s and, and or '90s and have to drink that horrible stuff.

70% of our audience right now doesn't know what we're talking about, right? But that's all right. What did you do for your holidays? It's been 3 weeks since we last recorded. It has.

It's, it's been a long time. You know, had some good family time, skied a little, tried to relax as much as I could. How about you, Robb? I went out to California, spent the week of Christmas with family out there. That's where I'm from, in the Bay Area.

New Year's week, I was here in town. My kids stayed up and enjoyed the ball dropping for the first year. This is the first time they've made it all the way to midnight. Well, nice. Nothing all that special though.

How about you? What do you do New Year's Eve? We went to a party in the neighborhood and also had 3 teenage boys at our house. Holy smokes. Which was a whole lot of fun, let me tell you.

I stayed up until exactly 12:01 and then I was in bed. Yeah, that's good stuff. Well, why don't we talk about security? You good with that? How about some housekeeping first?

Housekeeping, what do we got? You know, Robb, we have a Slack channel and there's some big news in the Slack channel. What's the news? We are now over 1,200 people in our Slack channel. Wow, how many of those are good participants in the Slack channel?

All of them. All of them though? 1,200 high-quality people? Yes, lots of good discussions happening in there. Please come check out the Slack channel.

Go to colorado-security.com, click on the button that says join the Slack channel, and that'll take you right there. And while you're on that website, colorado-security.com, scroll to the bottom and join our mailing list, and you can get these show notes into your inbox every week, all of the news that's fit to print, and that'll be in your email. We would also love it if you subscribe to the show, get this downloaded into your podcast player every week automatically, And please rate us on whatever podcast service it is that you use. You know, if we have better ratings, more likely that people are gonna discover us. And we feel better about ourselves too.

Well, that's good too. And if you're like, man, rating you would take literally seconds, I don't have time for that, what could I do instead that would be less effort? You could tell a friend, you know, whoever you're sitting to right now, be like, you know, this is a really good, funny security podcast only focused on Colorado. You could even tell random strangers. It doesn't actually have to be a friend.

We don't care who you tell. If you're in Starbucks, just, you know, go up to somebody and say, Hey, Colorado Equals Security. Yeah, good stuff. If you would like to support us even more than that, we do have a Patreon campaign that we've been getting folks, patrons, to help support us financially. You know, we do have costs that are associated with running Colorado Equals Security.

And if you would like to help contribute to those, go to our Patreon page again, colorado-security.com. You can find the link there and sign up and support us. We'd love to have you there. And the final way we would love your support would be if you are interested in helping interview folks for the podcast. So we love having a feature interview each week on the show.

You know, the last couple months we haven't been consistently getting the feature interviews. Alex and I's schedule has been a little bit too busy to, to set that aside, that time aside. So if you want to be one of the volunteers who helps us do new interviews, we would love that. Reach out to us at info@colorado-security.com and we'll get you plugged in to do that. And Robb, speaking of Patreon, we have a new patron this week.

Oh my goodness, that's the best news, Alex. Who do we have? Pete Schaefer signed up at the $10 a month Um, well, that means he gets a shout out on the show and he also gets a Colorado Equal Security t-shirt, right? Indeed. Indeed.

And, uh, he is working at TrackVia, um, which is actually, they're a startup here in town. They do, uh, low-code, um, you know, programming. Mm-hmm. Um, which is, sounded interesting. Um, that, that is a growing space in the industry.

So pretty cool to see that. Um, also, uh, when we talked to Pete, he mentioned that he's gonna be hiring people soon. Oh, so if you're looking for a security job, this might be a good place for you. Well, yeah, we'll definitely get those shows on the podcast when they come out. Why don't we jump over to news now?

You know, we've had 3 weeks off, so there has been a lot of articles accumulating in our queue. I know we have to hone them down to the 10 best. I think we have the 10 best stories to talk about this week. You know, it wasn't too hard, Robb, because many of the stories over the last 2 weeks have been, you know, recap articles and predictions and other things like that. People— we got some good ones.

People have really mailed it in the last couple of weeks. You know, they really have. You know, in good news, our first story, business confidence bounces back in Colorado. If I remember, we actually talked about this a year ago when they did the survey of business leaders in Colorado who, you know, what was the outlook for 2019's economy in Colorado? And it had dipped below positive, right?

I think it was down. They have like the rating where anything above 50 is positive, anything below 50 is negative. It was down below 50, right? Yeah, I think this was maybe even a little later than that. Might have been like going into fourth quarter or something like that.

But the, the survey that just came out looking at the towards the first quarter of 2020, we are back up over 50% at 51.5%. So more people are positive than negative. That's great. The same survey also showed the, the optimism around the national economy and it was not nearly as positive. So the last survey had shown optimism at being 38.5%, but it has jumped up to 45.9%.

So really not too far from being kind of a neutral sentiment for what the future looks like nationally. Well, I think that you know may also have something to do with the fact that you know we get all the sun in Colorado and we are still happy people in the winter when everyone else is well in the winter they're pessimists they're skiing right everyone here in Colorado skiing and enjoying it loving life yep next story we have is is actually I thought this was interesting we we've already covered the fact that Schwab has merged with TD Ameritrade and they're going to move their combined headquarters into into Dallas area but this article talks about a pitch that was made to Charles Schwab before this merger to to give them incentives to move the headquarters for the entire company to the Lone Tree campus. Yeah. And the headline talks about how this is a failed pitch. And I mean, I think that's, you know, it's going a little over the top.

You know, it was sort of an unsolicited pitch to Charles Schwab saying that, hey, you know, we love that you're here. We'd love for you to bring your headquarters here. And, you know, you can— we've got potentially incentives that will help you bring more people here. And this pitch was made to them prior to the announcement about the TD Ameritrade acquisition. And, you know, both companies had people in Texas, which is the speculation for why they ended up in Texas.

But there's a lot of interesting stats in here additionally. Basically, they said that if you brought another 1,500 jobs into Colorado at the average salary for the previous jobs, there was going to be about $20 to $25 million in, in tax credits that they would get for the company. So a lot of savings in that way. Yeah. They also mentioned that they currently have 4,600 employees in that Metro Denver, that Lone Tree office, which is way more than I would have guessed.

It seems like an awful lot. I'm sure some of them are spread out. You know, they do have Charles Schwab offices, you know, retail offices and things like that. But I would guess that most of them are in that campus there in Lone Tree. And then finally, they do talk about the fact that they remain confident that they're going to continue investing here in Colorado.

They're planning to continue growing their presence here. And the reason they said is that Denver's talent pool has far exceeded the original estimates. So, wow, kudos to the talent pool in Denver. We are talented. Next, there was a story on Colorado Public Radio talking about the National Guard and how it is changing and changing towards recruiting folks for cybersecurity and for the Space Force.

So you had found this article, but I actually listened to this story on one of the podcasts. Yes, I did as well. I was— I found it really interesting. I think the point they made was You know, if you're, if you're thinking about creating a, a real practice around cybersecurity, um, and you're trying to hire at government salaries, it's really tough to compete, right? But the National Guard, it's a part-time thing.

People who believe in serving can get involved there without giving up their, their public sector job or private sector job. Um, and this is really a way that the government can get really good at security without having to totally dismantle the way the, the government works in general. Yeah, not only do they not have to give up their private sector job, but they will probably bring skills into the government that they can't get otherwise, right? So it used to be that, you know, the top skills in cybersecurity were, you know, were in the government, in the intelligence agencies, in the military. But now it's kind of flipped and there's much more outside of that.

So they're really looking to bring that back in through the National Guard. So it's pretty cool. I loved it. And I think that, I guess I'd put a call out there for anyone listening who might be interested in giving back to the government. To our country, this would be a good way to do it.

You know, National Guard's not that hard a commitment to get into. And really, you can, you can use your skills you've created in your career to help the country be better. Pretty cool. Next, the town of Erie ran into a little problem where they accidentally sent $1 million to scammers pretending to be a construction company that they'd been working with. Yeah, someone filled out an electronic form on the Erie website asking for SEMA, which is a construction company, to be paid via electronic funds rather than check.

And the town did not confirm with SEMA before approving the change and sent out a couple of different payments for just over $1 million. Yeah, it does say that they have insurance, that they're working with insurance to potentially get some of this back. I also thought it was interesting that in the article they said the scam happened just after the town approved the addition of 2 new positions, accounting manager and finance manager. Yeah. And it also had a risk manager who was going to go from part-time to full-time.

Yes. I'm not sure exactly what a risk manager means in this context, whether that's financial risk. Yeah. Cybersecurity, financial, whatever it is. But yes, this is something that would help in that area for sure.

And then I saw one other snippet here that I thought was interesting was there was an employee who has since resigned as a result of the incident and kind of of two minds on this. You know, I know that You know, we certainly have to have some kind of teeth into security policies, and presumably there was a policy you had to call the, the vendor to confirm this kind of change. On the other side, you know, that person might have become the best advocate for security in the company based on what they've been through. Um, I, I find that hard. You know, we have no insight into that person's background.

Maybe this is their 3rd incident or whatever, but, uh, but anyway, it makes me a little bit sad that that's the, the outcome here for, for that person. Yeah, definitely. All right. Next, there is a story here about an Air Force Academy graduate or cadet who is still, still at the Air Force Academy, who was the winner at a cybersecurity competition. Yeah.

So the President's Cup, which was a DHS cyber competition in December, this had more than 1,000 people and 200 teams. I couldn't believe that number. I was really surprised by that, too. I was reading the article that was kind of buried near the bottom. Yeah.

And there's lots of good information in there. And then all of a sudden they say that. I'm like, wow, this is a really big competition. And this Air Force cadet, Sears Schultz, took first place in the individual competition at the Cup. You know, I was imagining something like the CCDC, which I think we've both— I know I've observed a couple times at Regis over the years, which is, you know, dozens of people involved.

It feels like a big competition. And, you know, there's regional CCDCs that kind of get, you know, tournament style up to the winners. But this sounds like it was just a massive organization. And it wasn't just a bunch of students either, right? There was actual employees of the government who were participating as well.

Yeah, it sounded like a big effort, you know, to just get people interested in cybersecurity throughout the government and the military. Definitely seemed like a cool thing. And also pretty cool that an Air Force Academy cadet won the whole thing. Yeah. Congratulations to Sears.

We're looking forward to seeing you kick butt in the Air Force for, for years to come. Next, the— you may remember that several years back, Chipotle had a decent-sized data breach, and there has been a data breach settlement that has been approved by a judge here in Colorado. And the good news is consumers who were impacted can get $250 as a settlement for the data that they lost, which is what, like 25 burritos from Chipotle, right? Yeah, something like that. So, I mean, that's not bad.

If you get extra steak, it's a little bit less. I, I would actually, I would take $250 in free burrito cards as opposed to $250. I think that's the way. I wonder if they offered like, hey, you can have your $250 or we'll give you this store credit. I bet you, I bet they get a lot of people taking it up.

Totally. Because you don't even have to give a credit card in that case. You're just, you're just giving the gift card over. Of course. That they can't lose it.

What's always, what's always scary here is, is not only, you know, lots of consumers got their $250, but then Attorneys get significantly more. Right. Right. And that's, that's how class action suits work. It's just a little bit sad.

And I wonder, I mean, it does say up to $250. I wonder if this is going to be like a Capital One kind of deal where, you know, oh, the most you can get is $250. We've had enough people that you're going to get, you know, $0.23. So a side of guac. That's right.

That's your winnings. Everyone gets a postage stamp and a side of guac. All right. So the next story we have here is about 20 Colorado startups to watch in 2020. So this is not a list of security startups.

This is just startups across the board. Yeah, it was an interesting article. I actually discovered this, this site, and I've been starting to read the news there a little bit more. So we'll probably have some more news from them in the future. But it's a site called Colorado Inno talking about innovation and startups in Colorado.

And these are just, you know, 10 or 20 general startups to watch in 2020. There was one security startup on there. Yeah. Friend of the show, Scott Gerlach, who was the CISO at SendGrid. He's one of the founding team.

I think he's the CTO over there. That sounds right. And what they're doing is a dynamic scanning of code really early in the development process. So I've worked with him quite a bit. I've actually got him working with some of the developers at Ping for kind of looking at his product, trying to figure out how it works.

I think it's an exciting thing. And, you know, the further left you can shift security into dev, that's the better we are. So I think that's a promising young startup here. Yeah. And I don't know that we mentioned it, but it's called Stackhawk.

Oh, yeah. And yeah, it sounds really cool. I talked to Scott a little bit about it. So, you know, one of the other ones on there that I thought was interesting, there's a startup called Validate. It is a platform built for CPAs, litigation, and financial professionals for collecting evidence to automate verification and investigation.

Sounds like an automated audit kind of platform. Which, I mean, I don't know about you, but I can't stand audits. They're a pain in the ass. I love audits. So, you know, having anything that can help automate those sorts of things would be pretty cool.

So I, you know, when I first saw this article, I was tempted to just breeze over it and look for security companies and move on. But I ended up reading about every company on the list, all 20 of them. There were actually a lot of interesting things on there. There was some, some mom stuff on there. There was healthcare on there.

I actually pulled out 3 that I was especially interested in. One's called Help. It does ticketing systems based on Slack conversations. So you have a thread in Slack, you turn it into a ticket, and actually keeps the, the context from the, the issue, um, in the ticket. There was one called Integra Ledger, and it has the word blockchain in it.

So I was pretty excited about that. Yeah. That made it out for me. Yeah. I figured that you would never talk about this, but it's a blockchain, uh, an enterprise blockchain designed to help legal.

And it also addresses integrity, security, and interoperability. Other than the blockchain part, it actually did sound interesting what they were trying to do. Blockchain and you like buzzed out. I'm sure that they could do it without blockchain, but if they can solve it with that, it would be fun to ask whatever question. Why do you need blockchain?

They say because that's how we got VC funding. Right, exactly. But my favorite one, Alex, is the last one here. It's called The Last Gameboard. Did you look at this?

I did. That sounded pretty cool. Did you like look at their video? They have a no, like a description, almost like a Kickstarter video. I clicked through.

I actually like. Spent way too much time looking at these guys. So it's a, it's kind of like an iPad, but it sits down and it can register game pieces set on the board and it, and it could play like hundreds of different games. So they have like a kind of an app store with a subscription. You pay the subscription, you get access to all the games.

And it's, it's lots and lots of different games from like games that we know. Like they had Dungeons and Dragons on there, which I didn't understand how that works on a game board exactly. Yeah. Uh, but they had lots and lots of games and I thought it was pretty cool. It was priced a little higher than I was guessing.

It was like $700, I think, for the, for the like middle-of-the-road package. Um, but it looks like a lot of fun and, and I, I guarantee that a lot of, a lot of, uh, gamers will really enjoy this thing if it takes off. I think it's a brilliant idea. Um, I think you would probably have to get the price, you know, pretty far down from $700 for it to be widely accepted by people when you can go out and buy a, an actual board game for, you know, $20, $30 or something like that. Uh, but if you're competing with PlayStation 4, an Xbox, like it starts to be a little bit more reasonable, right?

Yeah. It's roughly the same price point, I think. I don't, I don't really know, honestly. $500. It's, I think it's a little more, but still.

Okay. Um, brilliant idea. Hopefully that they can make a go of it. And if they, so just so you know, The Last Game Board folks, if you want us to talk about this on the show, send one over this way. Hey, yeah.

We'll play some games on it. We'll play some games. We'll, we'll have some Colorado Equal Security game nights for sure. All right. Happy to do that.

Uh, next, There was an Optiv blog. This is one of those end of the year predictions for 2020. This is what happens when you take off 3 weeks, right? We get the December blogs coming up. I will say, so we've got a couple prediction blogs in here.

This one, they were, I'll say, a little bit wishy-washy. Like every one of their predictions, it has may or should or could. Yes, anything might happen. Anything could happen. Well, they don't want to, they don't want to be locked down or anything, right?

So first one, hybrid threat actors may become more commonplace. Yeah, they may. What is a hybrid threat actor? Someone who's gas and electric both, right? Yeah.

This is in their description. It's talking about a threat actor who is, you know, maybe a nation state actor that, you know, pretends to be someone else. You know, to throw you off the trail or something like that. I personally don't see how this is super important. If someone's attacking you, they're attacking you.

And to think that a threat actor only acts in one way, no matter what, I mean, I think it's pretty naive anyway. So yeah, not the best one, maybe. Next one is Apple's Privacy as a Human Right campaign should cause others to follow. I agree, it should. It sure should.

I think that there probably will be you know, moves forward in terms of privacy this year, if nothing else, for CCPA. But I don't know that it's going to be thought of as a human right for anyone. So I didn't notice this kind of wiggle worms in all of the predictions, but now that I'm reading them, it's pretty funny. Election misinformation campaigns could proliferate. That one, I think, is the worst because the worst, they definitely will.

That is one where you could have said this is going to happen this year and you would have been right. We're already seeing it. Yeah. Yeah. We might see the first cases of deepfakes used to manipulate stock prices.

Again, this is one I think where if you would have been less wishy-washy, I think it could have been fine. It's actually a really good prediction. I hadn't thought about this. I don't even know that you need to use deepfakes because with all the computerized algorithms for training, for trading, you know, even bad news that's fake, you know, someone hijacks a Twitter account and stocks go crazy. Yeah.

Why go to the trouble of doing a deepfake? But I had never really thought of deepfakes being used for that purpose. Now we've talked about ransomware being used for stock manipulation. So deepfakes, it makes sense. It's a good idea.

Next, there should be widespread realignment of IT and security organizations. I think that there probably should.

No comment. Finally, cybersecurity basics may continue to vex consumers and enterprise organizations. All right, that one's just— there's nothing there, right? Yeah. Should we, should we talk about another list of predictions?

There is another list. Uh, this, this one is from Webroot as opposed to from Optiv. Um, it's actually a combined Webroot slash Carbonite prediction. Oh, sorry, I missed that part. Yeah, so now that they're part of Carbonite, my guess is that means this was cross-posted to the Carbonite blog, but we don't follow the Carbonite blog because they're not a Colorado security company.

That's right. Uh, highly targeted ransomware will continue to devastate businesses. That's, that's pretty obvious. And if you are in the business of doing backups for people's home computers, you're going to do pretty good. Long-awaited privacy legislation will finally arrive in the US.

So this sounds really interesting. And I read this with like expecting them to say, finally, we're going to have a federal privacy law. But it doesn't say that. All it's really talking about is the CCPA. Right.

And which is— we know that is happening. That's not much of a prediction. Right. Something that is 100% guaranteed to happen and has already happened at this point. Will happen.

Um, and then small and medium-sized businesses will bear the brunt of cyber attacks. Um, I wonder, I know that there's been some trends over time where I, I remember we've even talked about it where like the best security is in enterprises or the best security is in SMBs. And I think midsize was the Coalfire report from last year. They said, right, midsize companies had the best security. So this is kind of an interesting prediction.

They, they think that in 2020 it's going to be the midsize companies that they could beat up the most. Yeah, I think that seems reasonable. Those are the kind of companies that these people seem to be attacking with ransomware recently. So I could see where that could be true. All right.

Well, we have one more story this week, and this is a blog post from Ping. This is not a prediction. This is just talking about, I think it's really a new capability they're talking about, which is tapping NGINX for AI-powered API traffic insights. Yeah. Um, it is, it's been increasing that, uh, people care about APIs and their security.

Um, and that it is, it is not always the easiest to figure out what's going on with those APIs. Strangely, Ping has an API security product, um, which is— I think that's just coincidental. It is just coincidental. Um, but, uh, in the blog they're talking about, uh, NGINX, which is one of the most popular web servers, um, on, on the internet these days and how um, you can integrate with NGINX to get some of that API data. There's— in this case, they're talking about a sidecar that you can put in along with NGINX to sort of grab some of the metadata associated with those APIs and make it easier to do API security.

So pretty cool. So I, I feel like this is one of those things that it is self-serving because Ping sells that product, but it's also really true. When we go to our dinners and stuff, the CISO dinners that we're a part of, we'll hear We'll have conversations about API security and every CISO in the room's like, yeah, it matters. And no, I have no idea what my APIs are doing and how many I have and how to secure them. It feels to me like 4 years ago, so I've been at Ping for 4 years now.

When I first got there, there was a lot of talk, you know, Ping was talking about how you need MFA on everything and everyone's like, sounds like self-serving, but it's really true, right? And now 4 years later, I feel like we've come a long way on MFA and A lot of folks have done that. I think API security is going to be the same way over the next couple of years. We're going to realize that it actually does matter, uh, and people will probably make some big investments there. For sure.

All right. So that is all of the news, Robb. I feel like we just crammed in 3 weeks of news into 15 minutes. I can't, I, it's so good, man. It feels so good.

Hey, you know, why don't we talk about the Slack message of the week? Robb, what is the Slack message of the 3 weeks here? Um, but the first thing we have to do is we have to thank Andre Gaeta. Andre is, just an amazing supporter of the show over the last couple of years. He's been sponsoring this Slack Message of the Week where we recognize one person from the Slack community who gives a real nice contribution to the, to the discussion there.

And that person gets one free item from the Colorado Equal Security Store. Uh, don't forget that that item can be valued up to $25. So this week, uh, the, the winner here is Steve, is it Ziembach? Um, and I love this post and it's a little bit late. Sorry if you guys weren't in Slack to hear this, But he posted saying that there was a day where The Phoenix Project was free and anyone could go download from, I think it was both from Amazon and from Android.

You get a free copy of The Phoenix Project. Are you, you've read that book? I have. And I was in the Slack channel and I downloaded my free copy as an ebook. I have a hard copy, but I don't think I had the ebook before.

I didn't just download it. I also sent an email to my entire company and said, you all should get this book because if you're not a technical person, this tells you what broken IT processes can do to a business. Yeah, it was a great post and I really hope that people got to take advantage of that. If you didn't, you really should be in the Slack channel so you can hear about stuff like that. Yeah.

Next time there's a free Phoenix Project, you'd find out about it. I think what I realized was that the reason for the fee— the free Phoenix Project was that Gene Kim and others had created a new book called The Unicorn Project, which is kind of a follow-up to The Phoenix Project and is— that's a new book that's out. So you know, generate some buzz by giving away the old book for free. One of the things I think that is cool about The Unicorn Project, which I have not read yet, is it actually happens in parallel with The Phoenix Project. So it's a, it's a story told from a different perspective.

I'm like 70% of the way into it. And, and when I read The Phoenix Project, I was struck like, oh my God, they wrote this book about my company. And this new one, once again, I'm like, oh my God, like process getting in the way of agility and security not always being the enablers we want to be. It's really convicting and it's really good stuff. Uh, and I hope— I recommend it for, for all those folks listening.

I'll have to get that one too, put it on my list. All right, well, let's go ahead and jump over to our calendar. As a reminder, it's a new year, but we still have a calendar of events on the, on the Colorado Equal Security website. We do. Uh, first event for this year is happening on the 8th.

SecureSet is doing an all-levels capture the flag. Uh, that's the only thing for this week. I think everyone's kind of recovering from the holidays. But next week on the 14th, SecureSet is also doing an intro to data visualization And I think that sounds really good. That does sound good.

On the 14th and 15th, ISSA Denver is doing their January chapter meetings. And those are the CISO meetings where they have some CISO panels if you want to hear from the local security leaders. On the 15th, Colorado Springs has the Cybersecurity Summit and Industry Day. Sounds exciting. Also on the 15th, DENSEC is doing their January meetup.

I think that's at Reinhaus again. I think they're back to Reinhaus. And the last for the next couple of weeks is on the 16th. ISACA Denver is doing their January chapter meeting. Pretty cool.

Uh, gonna get back into all those events. So, uh, with that, let's move over to jobs. Robb, are there any jobs at Ping Identity? I got 2 jobs to talk about. Number one, we are hiring a Senior Director of Cloud Operations.

I'm super excited. This is a, a really important job at Ping. This is running all of our SaaS applications, basically being the head of the SRE team that runs those. One of the people I work most closely with at the company. The previous head of cloud operations is moving over to join the security team.

I'm excited about that as well. Sweet. And anyway, you can send me a note if you're interested in this, and I'm happy to help you get into the process. And then the second job we have at Ping is a security intern, kind of the opposite end of the experience spectrum. We're looking for someone who wants to work with us this summer, and this is a— our internship program is a little different.

We actually have the person cycle through each of the teams within security. So we have our product security team, our infrastructure security team, our security architecture team, and our GRC team, and our interns spend a little bit of time with each. Pretty cool. Charter and Spectrum is also looking for a senior manager of network security operations. Twilio is hiring a senior information security compliance analyst.

Arrow Electronics is also looking for an information security intern. This is for sophomores only. Isn't that interesting? It's just sophomores. Yeah, I wonder if that— yeah, I wonder if it's just sophomores, that means no first-year students.

Oh, maybe sophomores or greater, basically. Could be. I don't know. It does say sophomores only. It does.

The Colorado Judicial Branch is hiring a network security engineer. Dish is looking for an information security business partner. SugarCRM, which is a competitor to Salesforce and I have actually used in my career. It's a nice open source, much less expensive to get support for version. SugarCRM is hiring a senior information technology and compliance director.

Yeah. So it looks like someone in charge of their security program there. HomeAdvisor is looking for an IT risk and compliance manager. And finally, Huron is hiring a manager of software security architecture. That's in healthcare.

Cool. All right. And Robb, I think that's it. That's it. That's it for the news.

Yeah. I feel like it's been so long, I forgot how to end. Well, we can just keep going. Should we, should we talk about the interview that's coming up? Why don't we do that?

So Jason Jaques, Jason did some interviews for us last year. Fantastic job. He's got a new interview for us. With Steve Simski. Steve is a professor at Colorado State University and an all-around very interesting guy.

Um, I look forward to listening to the interview. All right, well, welcome to the new year. Happy New Year to everyone listening. Hopefully we'll get to see you soon, and we'll— if nothing else, we'll talk to you again next week. Thanks, Robb.

Hello, this is Jeremy Cooper-Leavitt, Managing Director of Assurance at Charles Schwab. This is Colorado Equals Security for Colorado security professionals.

Hello, Colorado Equals Security. This is Jason Jaques. I had an opportunity to interview a fascinating thought leader of Colorado. This man is a writer of books. He has over 160 patents to his name, and he's a professor of cybersecurity at CSU.

Here's my interview with Steve Simski. Enjoy. Hey Steve, thanks for, uh, thanks for joining me today. Uh, I'm glad that I was able to catch you here at NREL. And, uh, no, I, I'm joking, of course.

We're not at NREL. That was supposed to be last week. I, uh, I couldn't make it out there. Um, for those that aren't aware of NREL, National Renewable Energy Laboratory. Yeah, spot on.

Yeah. Yeah. So, um, why were you out there? Just out of curiosity. That's a good one.

Thanks, Jason. And, and first off, thank you for inviting me to you know, talk with you on this podcast today. So NREL, the National Renewable Energy Lab, big surprise, is really interested in cybersecurity. So I was actually down there for that part of what I do here at Colorado State. Why are they interested in that?

Because energy is becoming more and more distributed, more and more of a community of providers. I mean, I've had friends out in California who for 20 years have been all day long watching money go into their bank And then when the sun went down, the money went back to PG&E, but it came out to basically a rough balance over the year because by law, PG&E has to allow people to put windmills, to put solar panels onto the grid, add that energy to the grid, and then PG&E has to find a way to distribute it. And so, NREL is really envisioning a future where all of the big energy companies are really just about managing how people get paid and how they put energy onto a grid that other people take off or even themselves take off. So that's super cool. And when you think of cybersecurity, that's a threat surface the size of the entire nation because every single person's got a battery, it's got a solar panel, has got who knows what, a rat running around in a little maze, and they're producing energy and they go, I want to get paid for this.

Oh my goodness. So it's, it's a huge problem because it's got all of everything from micropayments all the way on up to trusting that somebody is putting energy on the grid that's not going to blow a transformer or is going to attack the power system. Right, right. It's interesting to me that that's kind of their focus. I always thought of NREL as something that I guess wasn't too concerned about cybersecurity, but mostly focused on developing technologies either via wind or solar.

The technologies themselves, but maybe I was just misunderstanding that. Do they not get into that level of technology towards renewable energy? No, that's spot on, and that is what they are about, but it's like everything else, it's evolving. And so for NREL, wow, we've gotta handle solar, we've gotta handle wind, but it's not all coming from farms. It's not just from wind farms.

It could be from Joe Blow, who's got enough of it going on that says, hey, I wanna put this on the grid. I wanna take 10% off my energy bill, and I can stay in my house. That type of thing going on. So it's naturally what we see going on. And this is part of why systems engineering is now a department here at CSU where it wasn't a year ago.

Right. It was a program. Now it's a department. And the reason is, is because complexity is getting greater every year. Yeah.

And so even something as simple as renewable energy, now it's tied into what data is being produced, who owns that data, where does the data go, who has access to it. All of these things that we worry about traditionally for cyber accounts. Well, now it's there for physical accounts because when you think about it, everything is really cyber-physical, otherwise it has no value. And so what's going on now is NREL is saying, wow, what do we do with this? Do we wanna be left out of the lurch when microgrids become the normal way by which renewable energy is placed on the system?

And it'll get more complicated. So you look at it, there's great work here at CSU by other professors, Dr. Prieto and others, working on batteries. What if a room this size— and we're in a room about maybe 20 by 10 by 8 feet— what if a room this size could hold all the energy Fort Collins would need for a day? That day is coming. And so you're going to have these sites, these physical sites that are providing all of the power to make everything cyber happen, and they're going to be able to store more and more energy so that we've got this, you know, this sawtooth waveform that we've got in renewable energy is a real threat as well, because people can look at that, predict when people are going to need energy, and they know when to make an attack.

So right now, Fort Collins, it's in the summer. The hottest time of the day is 4:45, 5 o'clock PM. Everybody's getting home from work at just that time. What happens? Every air conditioner in the city goes on, and boom, energy use goes up by a factor of 2 or 3 if we're not careful.

And so that's a real— that's a real incentive, if you will, for a place like NREL to figure out it's not just renewable energy, but it's storable energy that can be then renewed by the same people who produced it. So they can use it when they want to and produce it when they can. So are they proactively thinking about these attacks or are in— I guess, are they being driven by kind of a reactive nature where there's actually been some attacks? Yeah, that's a great question. And the answer is both.

I mean, as you would probably anticipate, The folks that I met with down there are pretty proactive and they're scaling up fairly quickly. I believe there are a couple of dozen folks already in cybersecurity there. I predicted talking to them, one day you guys are going to probably have over 100 people in cybersecurity and no one batted an eye. Yeah. So they are definitely looking at how do we build out the next grid?

There is something, as you well know, called the Security Plan of Operations or SecOps. They want to be part of how that is done for the energy. Sector. And so there's all that proactive, and these are security professionals, they know what they're talking about. They wanna be able to build that out.

Have there been attacks on grid? Well, you know all about Stuxnet. So there've been attacks on energy providing, nuclear energy providing in that case, facilities, and they go on worldwide. And their belief is that pretty much every energy sector in the US, in some ways is protected because it has 3,200 largely disconnected energy providers at the level of Poudre Valley, at the level of REA or whatever we've got down in Denver. You've got those 3,200 providers and they don't all talk to each other well.

When they do all talk to each other well, all of a sudden that whole threat surface that's there becomes unified. And so we have this weird situation where we have very large threat surfaces, but it's minimized by the lack of communication between them in some cases, that's going to go away. And so they want to be prepared for that. We know facilities like coal plants, they're getting hit every day. I mean, servers here are getting hit, whatever that means, by targets millions of times a day, right?

So we know that's out there. I mean, a big portion of the internet, and certainly a large— larger portion of the darknet, is just looking to see, do people have— is this been hardened, right? And what happens there? So, so they're concerned about that, and they're saying What's the physical analogy between your, you know, your 3 basic choices, whether you prevent something from getting in, you attack it the moment it gets in, or you redirect it into a honey net? What does that mean for energy?

I think there's some pretty neat analogies that come out of that. And so those are the kind of things they're thinking through, which is pretty cool to see. Yeah, that, that is definitely very cool. And it's cool that you can actually spend some of your time down there with them and help them out. So we're, instead of being there, we're here in beautiful Fort Collins at CSU campus.

Yeah, I love it up here. It's, uh, it's beautiful. I've always enjoyed coming up here when I, when I get the chance to, which is not nearly as often as it, as it should be. But, uh, let's talk a little bit about your background. So you're a PhD, you're a professor here at CSU.

What, what kind of inspired you to become a professor? Well, that's an interesting story. I mean, there's a number of stories. Some of it is political, just kind of seeing where the nation was going and I wanted to be part of a future where people were more educated, could make better educated choices. I also— yeah, it's kind of a weird story, but look at it from going all the way back to Plato, right?

And looking at Plato's Republic, and he had this sort of trick where he had you say, we don't know who you're going to be, but if we could pick the ideal person to be our politicians and to run the government, who would it be? And of course, he was a philosopher, so he ended up with the philosophers should run the government, which was probably self-serving. But I think a more interesting step forward on that tradition was actually with John Rawls in the '70s. And he had a book on the state of nature. I forget the name of the book, but he's a very top-level philosopher from the 20th century.

And he had a book that took the state of nature and said, all right, Forget Plato's Republic, what should each person be compensated for for what they do in society if you don't know who you're gonna be? So what should you do for a janitor? What should you do for an engineer? What should you do for a podcaster, et cetera, if they were gonna be there? And so he came up with this very interesting scenario where everybody was basically, I wouldn't say it was communist or socialist, it was more utilitarian, but it was like, honestly, if you don't have a lot of needs and you need access to data or you need access to books at that time, that's where you would be.

And so a lot of it for me really drives the fact is where should I be? Where should I be doing the most good? I'm not a communist, right? But I am a utilitarian and it's like, we all wanna be where we think we can make the most positive impact. And so for me, a couple of years back, I thought I could probably make a more positive impact going out and being part of the university after 23 years of working in the, in, in industry.

And so there's a lot of other reasons as well, but I've had them rewarded since I've been here. I mean, it's been, it's been pretty interesting. I mean, I've already— I think what happens for you if you're a visceral person, if you like to see the tangible output of what you're doing, you get it very quickly in a university, whereas it may take half a decade or a decade to see an engineer really, you know, grow at, at a, at an industrial job. So I've been involved in basically trying to make STEM universal, making opportunity to STEM available to everyone. And I'm a white male, so it's not self-serving or anything like that, but we are overrepresented.

White males and Asian males are way overrepresented in the tech world. I think at Google, for example, it's 55% white male and 39% Asian at Google. And that may just be white and Asian. And so you end up with weird things like a racist soap dispenser. And their soap dispenser, of course, doesn't know anything, but it's been trained only on people with light-colored skin, so Asians and Caucasians, 'cause 92% of people who work at Google are that way.

And so you end up being concerned because I have a lot of data that shows the value of diversity. The more diverse your teams are, and I can come back to that data later, but I have a class here that teaches people how to develop intellectual property. It's not just patenting and trade secret and all that, but it's also how do you work with somebody who's a biologist to create, you know, IP or intellectual property of value? How do you work with a physicist? How do you work with a chemist?

How do you work with a systems engineer, mechanical engineer, biomedical engineer? And I think the last one is electrical. So I've got like each of those covered in the class. Well, I had some guest lectures and there were a couple of lawyers who've run a female law firm for, I don't know, at least for 15 years. I've done, probably done 60 patents with them myself out of Detroit.

They were guest lecturers. They talked about what it's like to be running a law firm that does patent law as its primary. One of the students in my class is a chemical and biological engineer, and she said, you know, I'm interested in, I'm interested in that as a profession. They called me a couple months later and said, Steve, you got anybody from your class who can come in here we need a chemist. Yeah, I said— so I went back to the student, said, are you interested?

She interviewed with them and has the job now. Okay. So it's very visceral. It's like you can affect one person at a time in a way that is difficult to elsewhere, right? And that's what I like about it.

And we are at a— we're at a tough time in the world. You know this. I mean, being a podcaster, you're— you've got a lot of technology you carry around with you everywhere. We're driven by technology. Yeah.

And so that state of nature Coming back to— there was a point to that. Coming back to that in the story, if I'm in the state of nature now and say, who do I want to be our politicians? I want engineers. I want technology people. I want somebody like you or somebody like the engineer in my class, because we're in a state now where technology is definitely the tail that wags the dog.

And in every profession, people are dependent on computers, on the internet, on mobile phones, on everything else for— to just get their job done. Even if they're technophobes, even if they're Luddites, they still have to know how to do that. And it's funny to think about because I'm old enough that when I went through college, we didn't have laptops, right? So we went to class, you took the lecture notes, etc. You went to the computer lab and you typed it up.

I didn't have my own PC until I was, you know, at near the end of college. And so you look at those things and you go, wow, that's a different world. And you look at a computer now and you go, wait, what did it do before the internet? There's also that whole period of about 10 years where we had laptops and the internet really wasn't big until about the mid-'90s, '94, '95, right, when it got big. And so I look at it now and go, this is unprecedented.

We've never had technology permeate the way that we do everything. And I really think that we need to have politicians who are going to be technically savvy. And so I'm trying to find students. Yeah. Who are, you know, you know what I'm talking about, those entrepreneurial students with that spark, you know, the spark in their eye and the spark in their brain, and you go, have you ever thought about leading a country?

Because we need you. We need people to go into politics who can do this. And I think that's how we, that's the new Plato's Republic. Plato goes, wait, we've got a world where robots are working side by side with people. How do we get that to work properly?

So we still need ethics, we need people who are ethical, we need people who think You know, we need poli-sci people and everything else, but I think we need technically savvy people leading us in the future. And we're not really— no, we're not really there yet, are we? Not at all. Not now when you look at our politicians. So that's my grand plan, and I know it is not just grand, it's probably grandiose, but that's where I'm hoping we get because we're going to need it.

You know, the smartphone came out in 2007, essentially. The iPhone, exactly, July of 2007. You know, back to your point, I was just thinking recently, what did I do at night before I went to bed? Before— I mean, that's only 12 years ago. The concept of, I guess, not having a smartphone that I'm playing with for 30 minutes before I go to bed is foreign to me now.

And for the younger generation, this digital world, this is all they know. That's a— that, and, and, you know, we see a lot of intergenerational stuff going on. We see the, you know, the younger generation being— basically they feel harassed by older generation who says, you don't know how hard I had to work, blah blah blah, going up. And yet the opportunities that people had with a high school degree or a college degree many years ago was much more than it is now. And so we really have a lot of intergenerational strife going on now that really is silly.

I mean, because what's going to be adopted by technology is literally what makes life better, and you'd be crazy to deny that a cell phone makes life better. Does it have to have some checks and balances? Absolutely. But I mean, it is absolutely wonderful. You know, we've got a Discord server for my family.

Everybody contributes to that. It's basically private, unbelievably effective for showing what's going on, and we still use, you know, instant messaging or texting and email on Times, each of them has a place. And I think what we're missing here is that every generation has a place in technology. Now I'm fortunate enough to have grown up having to do assembly language and machine language and know really what fetch execute was on systems that are a joke now, right? I used to go into, when I did my master's at RPI, it was on impedance tomography.

And impedance tomography is pretty de rigueur now in hospitals. You strap them on a patient when they come in, make sure they don't get pulmonary edema. So I was really fortunate to be on the front end of that and got some good stuff out of that. But I had to basically go into the computer room. They had a Cray on campus, and this is Rensselaer Polytech.

It's a pretty advanced university for the time, and bring my Dead Kennedys and Sex Pistols and blast them as loud as I could to chase all the foreign students out so that I would have unlimited access to that Cray. For an hour or two to do my imaging. And that was really the only way to do it because I didn't have a PC or anything. And now this— I've been carrying a phone around in my pocket for at least the last 6 years. The iPhone has had more power than that Cray did in the late '80s.

And so you go, this is, this is nuts, but it's also wonderful. And so I think what we're looking at is folks like me who've had to kind of walk— we— I mean, I was so fortunate, right? Right as I'm going into college, right as I'm deciding I want to be an engineer is basically when we're moving from assembly and machine language over into C and C++. And you're like, wow, these are amazing, object-oriented programming and all that. But again, like everything else, it went too far.

People are like, oh, every database is going to go to an OODB, and that's all going to rule the world. And it's like, well, I would just— you know, I was at HP until less than 2 years ago. Vertica is fantastic stuff. And it's not an object-oriented database. It's your same relative database.

They've just tricked it out so that it's— it just screams. And it's like, wait, why would you throw that away for an OODB? So OO went too far in that case. And we see that for a lot of things. And that's really what's going on in this intergenerational stuff.

It's like, wait, wait, why don't you— if you're, if you're a millennial, go talk to one of those boomers. Yes, they don't know how to use computers as well as the Gen X and the millennials, but they've got something to say, and let them say it. And then don't— you know, and it— you know what I'm talking about. There's, there's something, there's a value there from everyone, and we're missing that. And I think that's where we end up being more afraid of technology than we have to, because I'll be honest with you, the technology that scares me the most is CRISPR-Cas9.

It's not in the computing industry, it's not robots, it's not AI. It's actually CRISPR-Cas9, because we know Once something can be used, it will be used. And we've had embryos being messed with CRISPR-Cas9 in China already. So there's human beings out there who've had their genes spliced by CRISPR-Cas9 technology. That's scary.

Because only 5% of our genome is actually expressed as proteins. That's the exons. And then the introns, the other 95%, what's going on with those, right? So we've got these issues going on. And I think actually some of the other technology can help us with that.

Cybersecurity. What type of— how do we have monitoring of that? And it's a disturbing thing to think about. How do we? Yeah, how do we have monitoring of that?

Well, you think about it, we've got this trade-off, and this is the classic trade-off in cybersecurity between privacy and security. And so you'll see a lot of stories, I'm not introducing these, these have been around for years, of people talking about the medieval village was the norm, right? If you're in a medieval village, everybody knows everything about everybody else. I mean, they know when you're in bed with your partner, they know when you're having dinner, they know when you're burping. You don't have any privacy because everyone lives in the same little village that's got a big wall around it for security, etc., etc.

So security was there because the village needed it, and privacy was surrendered. And right now, I think we're in a state where we have a lot less privacy than most people think. Yeah, for sure. And so we've really given up all of that privacy already. Once people realize that and accept that, they're going to understand security is actually a bigger deal.

How do we, you know, 'cause I'm more worried about from a security and privacy standpoint that this isn't even me sitting here. This could be a Steve bot. Remember, I do robotics. So maybe I made a robot that, it wouldn't be hard to make one with more personality than me. So I did that.

It's sitting across from you. I've 3D printed its face. You don't know me from Adam, right, until you meet me today. And so with that sitting across from me, what are we really dealing with there, and why is it a robot? And this is, I think, what really people extrapolate out into the future.

And remember, all extrapolation is a guess, right? Interpolation is accurate, extrapolation is harder. And it's kind of funny because we're coming up to year 2020. So right now I still have 20/20 foresight. After next year, I got 20/20 hindsight.

I'm going to be looking back at 2020. Yeah. So this is my last year to actually have 20/20 foresight instead of hindsight. It's time to switch gears to 2030. Yeah, exactly.

And what's going, what's going to happen if we go to, if we switch gears to 2030, what are going to be our biggest technology-driven cyber concerns or security concerns? And I think the biggest concern we've really got is that people don't, what we talked about before, people don't actually understand enough about what's going on around them in terms of the trade-off of privacy and security. That they probably have misplaced doubts and also misplaced confidence. So for example, a lot of folks were really concerned about social media. Social media is going to take everything away, you'll never get a job.

And it's like, wait, the people hiring you have been on social media their whole life too. They've, they've got their same goofy, you know, images posted from when they were in high school that make them look like a dork. We were all dorks in high school, right? So I'm just lucky enough that the internet wasn't big. When I was in high school, because trust me, I was a dork.

Otherwise it would be on the internet. And so do you think— right there with you. Yeah. Do you think I'm going to go pontificate to a millennial or a Zoomer or a Gen Z person and say, hey, you know, you shouldn't do that stuff when you're in high school? I laugh at it.

I got 2 boys who are, you know, just out of high school age, and, you know, they're, they're much nicer than I was. They've done a lot less to feel badly about. I think that actual— the fact that we have the social internet Now granted, you're going to get echo chambers, you're going to get people who go out there and they just look for bad things to happen, and we know all about the trolls. But in general, it's a normalizing thing. Yeah, it means we're— the average person now who's 25 has shared a lot more of their life than I did when I was 25, and they're getting more feedback.

And yeah, being— getting destructive criticism is never nice, but everything that you and I have got to get where we are in life has been through constructive feedback, right? I mean, all right, otherwise we're just in an echo chamber. And it's really easy for me to sit in a room by myself and go, man, I'm, I'm the smartest guy in the room, because it's kind of a definition. Yeah. But once you introduce somebody else into the room, the first person you bring in there is by definition smarter than you.

They'll be smarter than you in some area, right? You might be— what overall intelligence means is up for grabs anyway, right? So it doesn't We can't really put a name on that, but I guarantee you, you're going to be better at putting together a podcast than I am, right? And that's just the start. There'll be a whole bunch of other things.

So one of the things that we get out of being in this social media world is we know how to find expertise. You know, look at Etsy. I mean, Etsy is beautiful. I don't want to roll back Etsy, right? There'll be people like, oh, well, eBay is just blah, blah, blah.

It's like, okay, what about Etsy? And then the same person would say, well, I don't ever get anything valuable that I want out of Etsy. It's too overpriced. So they go to eBay. But now that you have a choice— and I grew up in small towns, so I was in a little town in Iowa.

It's like you got the Ben Franklin, right? That's it. You want a choice, you choose what you pick out of the Ben Franklin aisles. And it's like, it's, it's a lot better now. Yeah.

So, so there's a lot of— I think one of the things we lose sight of is we have, we have a lot— most of our problems now, and this is— this sounds weird, but this is encouraging. Most of our problems right now are caused by technology, and technology is what we use to solve those problems. So we've got ourselves into this loop where people have just lost sight of the fact that, hey, a lot of the problems that we had before for being able to distribute goods, for being able to cure illnesses and all of that, we've gotten so comfortable with that we forgot that those are actually things that kept previous generations down. It's something like 1 out of 10 or 1 out of 100 chance now of somebody, you know, maybe 20 years younger than me, 10 years younger than you, whatever, of dying in a war, right? And there's still wars and they're horrible and there's all kinds of things going on, but now if some— a police action shows up in Mali, we're likely to hear about it.

That never would have happened 25 years ago. We'd have no idea how much crap was going on elsewhere in the planet. Yeah, we were shielded from it. We were shielded from it. And now it's out in the open and there is a shaming that goes with that.

As long as the average person is decent, transparency is a good thing. I mean, if I honestly thought that the average person was not a good person, that's a different world we live in. And so what we need to do is look out, you know, where are there places like that? There are places where the average person might not be a good person because they're not incented to be, right? They live in a place where there's no job opportunities, so what are they going to do, starve or do bad behavior?

And so I think one of the things that social media and the internet and the transparency it offers is the ability to shake us out of that. Now, we're not there yet. Yeah, we're not there yet. You know as well as I do, a lot of people go onto the internet and they find an echo chamber, and they're like, oh well, this has justified the most appropriate behavior because there's another person on the internet who says that's okay, right? Well, guess what?

Those people aren't really doing that in private. So when we have a country that's run by people who understand technology and understand what it means to use technology positively we're going to have a better set of politicians. And I'm not saying we don't have good politicians. I can give you one right off the bat. John Kefalas here from Fort Collins has been a state rep or a state senator, and I forget where he is now.

He's on like the county commissioner or something, and he's a great person, but he's working locally. And that's how you get it. So we'll have that. We'll understand technologists will be like, hey, I know how to, coming back to cybersecurity terms, I know how to create a partition or an enclave that isn't isolated, but it's just prevented from attack by these other sources. So I've kind of found in my own experience that the younger generation tends to be much healthier on social media and their interactions with it and how they use it and how they communicate to their peers.

They really kind of effectively grew up with this technology. So they learned how to how to use it. And yeah, there's plenty of bad actors, but as a general rule of thumb, I've noticed the people who use it getting something positively out of it are the younger generation. Do you see that as well? Yeah, so I mean, I'm an old Gen X and you're a younger Gen X, and I think our generation is kind of a sandwich generation.

Yeah, where you've got, you know, baby boomers are used to kind of being able to impose their will on things because they were the boom, you know, they were the this and that, and they are lagging a little behind in terms of social media behavior, and it's not because they're bad people. It's because, let's face it, when you were growing up as a baby boomer or as an older Gen X or whatever, before the internet really came big, you made a mistake. It disappeared into thin air. It's gone. It's gone forever.

I mean, it did occur. You can't erase that, but nobody has it on record. You didn't, you know, you did most of your writing on paper. You could burn the paper. Now these things are out on the internet, and I think there is a sense from the, especially the natives, people who've been on social media.

It's not just internet natives now. It's people who've been on social media, which really hit right around the time of the iPhone, right about, I think— Yeah, right around the same time. And Facebook got big about 2007 as well. So people who've grown up, basically their formative years of adulthood, right after they've become 13, 14, and are really prone to it. I know musically, the music that you, our experience between the ages of 18 and 21 are really huge for you later in life.

And I can think about that in myself. It's definitely the case. And so those formative years, having gone through that, they're used to knowing that this could be visible elsewhere. And I think that is a— that's a normalizing factor. And it's also a bit of an ethics-enforcing factor that, hey, this is not just between me and somebody else.

And if I say something I'm going to regret, I might regret it a lot longer. And that's sort of what I would say is the stick, but there's also the carrot. And I think the carrot is that, you know, and give our education system some credit here, especially, you know, middle school and high school teachers. I think they've done a good job of telling a lot of students, hey, this is something that stays with you the rest of your life. Do you want to be labeled as somebody who screams at somebody who does this, or somebody who screams at somebody with this color skin, or this gender, or this transgender.

Is that something you really want to be known for? And with all the other stuff going on, and there's plenty of negative out there, man, if I were transgendered, this is the time in history up to this point when I want to be around because I'm actually able to express myself and I'm actually able to find large groups of people who totally appreciate me for who I am, not because— not in spite of who I am, but because of who I am. And and who are willing to provide that friend protection for me. So there's a lot of positive things that come out of that, and if you don't think that's due to social media, you're wrong. It's definitely a factor.

If we ran a multiple regression on this, we would find a very significant positive impact on GLBTQ and transgender people in general off of the internet itself over the past 10 years, and the 10 years before that, on the more traditional LBG— uh, sorry, LGBTQ folks, lesbians and gays, because people are just like, hey, I'm going to vociferate that this is not tolerable. So we've got a lot of work to do, but social media is working a lot of positives there. There is a negative aspect where everything is visible and it's like hard to un— you know, so you do something that you regret and you post it out on Twitter or on Facebook and you're like, darn. It's really hard to get that out of there, and if you get it out of there, there's Wayback Machine and everything else. But I think we've got, I think overall it's positive, and as I said, with the exception of opioids, most things are trending positive in the country.

Opioids are a horrific thing, and we've gotta address those right now. And I think that could be due to despair, it could be due to the availability of those drugs, it could be that they're being pushed on people. Psychotropic drugs are probably the biggest issue we've got right now. But I would say social media overall— nobody's done a study on this. They haven't shown, they haven't shown any diminution of intelligence by using social media.

The studies are out there. It is changing the way we think. So you came back to it and said, what do we do at night? Before 2006, we read a book. Yeah.

And, and, and we read it linearly and we walked right through that. And if you look at Nick's— I forget his last name— from Boulder, book on The Shallows, he's got, you know, evidence that it's changing the way we think. It's making us more referential in our thinking, right? So we go, oh well, I kind of know what that is, but I'll just go look it up on the internet. Is that right or wrong?

I don't know. I don't know either. Something else will fill our minds. I mean, people were super intelligent and had the same brain sizes before there was radio or TV. What was filling those?

What was filling those brains. They weren't empty, because if a brain's empty, it atrophies, you know. So, yeah, so it's an interesting thought. But overall, yeah, net positive. And overall, yes, the more native you are on social media, I do believe generally the better the behavior is, in spite of what some other folks my age or older might say.

Yeah, I agree with you. So what's, uh, what's your PhD in? So my PhD is actually in electrical engineering, but it was with biomedical engineering emphasis. My undergrad and master's were both in biomedicine. And so, so it's a— it's almost like a systems engineering before there was systems engineering.

And instead of a non-living system, it's all living systems. It's basically applied physiology, everything else. So I did things like making exercise-responsive pacemakers in senior design, doing impedance tomography, doing osteoporosis and immune research. And so you think of the human body as a bunch It's, it's a bit reductionistic, but that's what you do as a biomedical engineer. You reduce the body to a bunch of systems.

Yeah. So, so did you, did you get your PhD here? No, CSU? No, I got my PhD down the road in Boulder. Oh, okay.

And did my postdoc in aerospace there as well. Okay. So bringing your talents up here to beautiful, beautiful, uh, I don't get to be LeBron James. I get to take my talents somewhere else, but I am happy to be here. A lot of good folks The, you know, throughout my career, the thing that's really been a consistency is I've been surrounded by really talented people.

Yeah. And that's the only way to be productive. So I'm always seeking out people who are a lot brighter than me, and it's not hard to find, fortunately. So it's really benefited my career. So you went to school in Boulder.

Did you grow up here in Colorado? Uh, I did. It is the first state I remember living in. Okay. So we lived in South Denver on Federal, I believe.

Okay. When, uh, I was like 1 year old to maybe 3 or 4 years old. So I remember that, but we've lived— wow, you actually— yeah, remember that far back? Yeah, I remember my, my first friend was Pedro. He lived right across the street.

So, okay, you know, I never looked him up because I'd have no idea how to, right? Because that was back in the, you know, late '60s or whatever. Yeah. So, um, but Colorado was the first state I remember living in. I've lived in 10 states overall, so all around the country.

From Florida to Kentucky to New York to a lot of states, a lot more states out west. But my family is from Wisconsin originally, so, okay, kind of a Midwesterner. Was it your role at HP that took you all over the place? No, actually, with HP I've been relatively stable. I've only lived in Greeley and Fort Collins since then.

I actually had lived in 30 permanent addresses by the time I was 30, and fortunately that is only changed to 31 since then. Yeah, that's, that's a lot of moving. A lot of moving. Yeah, I'm guessing you just kind of left stuff in boxes. Yeah, you left stuff in boxes.

You learned how to make friends, but it was— yeah, yeah, I mean, it is what it is, right? I can't undo it. So, but it does have a warped perspective because I know a lot of people who've lived in the same area for their whole lives, and there's really no way to talk to them about how what it feels like to move every year, right? So yeah, but, and there's some benefits like everything else. So you do, you do learn how to make friends.

And I think naturally I'd have been much more introverted overall, certainly phenotypically much more introverted without having moved around and having to make new friends everywhere. Yeah. So outside of, or I guess other than Colorado, what was your second favorite place to live? Yeah, well, you figured out Colorado is because this is where I stayed. I think probably the second favorite place would either have been northern Wisconsin just because I was at the right age to just, okay, run around through the woods and got to do so.

Or possibly Idaho. Idaho was pretty cool. Okay. So I was a minority there. I was in a very heavy LDS community.

Okay. But, uh, it was still fun. Yeah, I'm from originally from Utah myself, so I know exactly what you're talking about. Um, there's a— I've spent a lot of time in, in both Wisconsin and Idaho. The northern part of Idaho is beautiful.

Yeah, Coeur d'Alene and Sandpoint. So But, uh, but yeah, I'm here as well, so I'm, I'm right there with you. I love Colorado. So let's talk about your books. You have written a, uh, a few books, right?

I have, yeah. Working on a couple now too. Yeah, okay, interesting. Um, how many books have you, have you written? 3?

Yeah, 3 books. Um, one of which was actually the primary writer was, uh, Jocelyne Meyer, who's in Florianópolis, Brazil. Okay, so I worked with a couple of Brazilians and that one's on steganography. Probably the least compelling of those 3 just because it's really dry if you're not in that field, but it's— don't talk it down. Yeah, it's how to hide data.

It's how to hide data in plain sight. It's how to hide data in plain sight. Well, it is more specialized is what I would say. It's more specialized and it's a bit dry, but that's okay. Um, steganography is important, so it's one of the ways that we basically either assert trademark or show that somebody ripped off somebody else's intellectual property.

So you can hide information in plain sight. You can do this in video, you can do this in text or documents, and basically you can't really see the data that's there, the information that's there, until a special reader does it. So Digimarc is probably the most obvious company that does things like that. Okay. And so this is a way of actually doing that in a printing process that'll survive the printing.

Gotcha. And so this is a book that you're working on right now? No, that one published, um, can't remember if it was— I think it was 2018. Oh, okay. Yeah.

And the one I finished this year was, was, uh, by myself, and that was on meta-analytics, which is how to build very large systems for analytics that use multiple algorithms at the same time to get more information out. Yeah, that was, that was the book that I, that I noticed actually when— oh, thanks— when I was on Amazon. I'm definitely going to check it out. So Meta-Analytics: Consensus Approaches and System Patterns for Data Analysis. So what are, um, I know it's— I'm going to read it and you're going to spoil some of it, but what are some of the things that I'm going to learn when I, when I read this?

Well, for one thing, you'll learn a lot about analytics because I do try to cover the basics, make sure people understand that analytics is nothing more than a logical extension of statistics that you may have learned as an undergrad. And statistics, for whatever reason, tend to baffle engineers more than calculus, which is shocking. But the data's there, right? The statistics are there that show that. Yeah.

And part of the reason is, is we've been lied to by statistics our whole lives. And so we're used to people reporting stuff. There's a There's a response to that now with the p less than 0.05, which you might be aware of. But the bottom line is the statistics are the starting point for all analytics. So just knowing how to do simple things like a mean, a standard deviation, variance, linear regression, those types of things to be able to say, oh yeah, alright, so I've got data, I've got differences between the data, what do I attribute those to, what do I pool those to?

And then it gets more interesting. What are the types of things we can do to use multiple analytics at the same time to extricate more data out of this and then to compare the data we get one way versus the other. So it's a follow-on to the Meta-Algorithmics book, which is more about designing the systems that allow you to infer information about data, classification, clustering, categorization, kind of the 3 Cs, if you will. And then this one is more about how to actually analyze the data and extract real information out of it and be confident that information is reliable. So there's a lot of— and there's like chapters in there that are about how to retrain your data.

And this is again coming back to what we talked about before with AI and machine learning. Yeah, one of the problems with AI is that we will define a small subset of reality in which we have the AI contribute or compete against a human and go, hey, look, AI smarter than people. And it's like, well, yeah, it is, because you defined it to play a game with a bunch of definitions like chess or Go. Right? I guess machine learning just passed up Go and now they're, you know, beating, you know, they're beating Tex on poker, right?

He's— and he said he's not happy about it, right? Because now you could have an AI playing poker online against him, which is disturbing. But that's a— that's exactly where AI is going to do well because it has a set of rules it follows. Exactly. Put enough processing behind it that nobody, you know, in their right mind is going to want to compete with a computer on that because it's just not fun at that point.

But I was thinking about this the other day talking to one of my grad students here, and we were walking from the other engineering building over here where I have my biomedical students doing their research. And we walked past this and I said, well, what do you think of this? We're walking past that and I said, what do you know about that? It was a bus. It was the same bus.

We could see it was associated with the 7 line. We could see it was pulling out. We could predict from that where it's going to be 20 minutes from now because I take the 7 bus occasionally here. It gets me close enough to home to walk from there. So the 7 bus is pulling out and I'm like, we know it's the same bus.

When we walked by, we had translational velocity. The bus is moving, the background shifting, and I did it without any training. I didn't have any training. All I needed to do is see there was a 7 on the line and it's— and I know what a bus is. And it's like, try to get AI to do that.

And of course AI can't do that. AI is going to be like, what the— I don't know what a bus is. You trained me on these things, you labeled them bus. I don't know what a bus is. I don't know there's continuity in that.

And now you're moving the image and moving yourself. So you've got all this relativity going on. The object's moving, the person who's viewing it is moving. And we do that without thinking. Just walk right by.

It's like, well, I know it's the same bus. We see somebody with a blue shirt driving a bike and they pass us later and we're in our car and we go, darn, the bike's going faster than car. Have the AI do that. The AI is first off not going to be frustrated because it has no idea the car is moving slower than the bike. And it's seeing these at 2 different times.

And it doesn't know, I could use that blue shirt for continuity. It's doing facial recognition, and one time we see the person's face, the next time we don't. So AI has no hope in being a human, but it has hope in appearing like a human within a confinement that we have there. And so that's kind of like the— almost like the flip side of the Turing test, where people are like, oh, what if a computer behind a glass could act like a human being? I'm not worried about that.

We know it could be a computer. We're good with that, right? I mean, we go, we give a call center, it takes us a while to figure out if it's a person or, you know, a bot that's talking to us. That's okay. That's actually a confined set of things that we're going to ask it.

So that's all right. But that living life, you know, day to day and knowing how to string things together, that's not where we want AI. And so those are where— those are the systems that we're looking at that are bigger than AI. And so if we— I think we're going to really figure out how AI Well, AI is already making a difference, but it'll make an even more appreciable positive difference when we figure out the systems around it and how to use AI as components rather than as the system itself. And I think as a system engineer, I'm always thinking, wait, people are using an algorithm as a system.

That's not a system, right? So the analogy there for— is there for invention. What do people invent? They invent systems, right? Our only US president who invent— who has a patent.

You probably know who it is, right? No, I don't. It's Abe Lincoln, of course. Oh, okay. Is there anything he didn't do well, right?

So he's the only US president with a patent, in spite of the fact Herbert Hoover was an engineer, but we won't go there. Herbert Hoover, forget it. Lincoln, yeah, okay, he's the stuff, right? So he invented a system to pull ships off of shoals when they were— when the ship, you know, landed on a shoal in the Ohio or whatever other river. He was on the Ohio River.

And so he invented this little pulley system. It was novel, novel enough to get a U.S. patent. It was never actually put in place practically, but he did have an invention, right? And so if you look at inventions, they're systems. If you've got an algorithm and you go, okay, I've got this new F ma, force is mass times acceleration, right?

Physics 101. You can't patent that. It's not patentable. It doesn't do anything. It's, it's how nature works.

Newton got to find that out. Nobody else gets to find it out. It stays same forever, right? The amount of force I put on you is equivalent to the acceleration of that I'm putting my arm through and your mass, right? I can't change that.

And so those are laws. You don't get to patent those. We patent systems. And so system engineering is really exciting to me because this is actually where we invent things. How do you piece things together?

How do you make them work? Nobody sells components. Well, they do, but the components go into systems, and the people who make the systems make all the money. An iPhone costs $800, right? The components that go in the iPhone, it costs fractions of a cent each.

And so that system value is really key. And that's where we go with cybersecurity. Cybersecurity is about the system, right? It's not like a poison you put somewhere, right? It's a whole web that you put out there.

And if you've ever seen like a garden spider in fall, it's beautiful, right? They're hanging out there. I tried this last fall. There was a garden spider out that had put a web about the size of a trash can lid in my backyard. And I'm like, I wonder what I could do.

I'm just going to blow this little thing into it and see how long it takes it to respond. So I found a little fluff ball, I don't know, maybe off of one of the cottonwood trees or something. Just did a quick puff into the net. That spider, I didn't even know where it came from, bam, wrapped that thing up within 2 seconds. Came out of nowhere.

That's a web. That whole web is a threat surface to that spider, but it's also an opportunity, and that spider can respond wherever it goes because the whole web reverberates when we have it in there. So we will build systems where when there's an attack, the message goes through the whole system. Everybody sees what's happening. We isolate it and we respond to it, and we've had to do this.

I've worked in brand protection and anti-counterfeiting and anti-human trafficking for years, You can't stop this stuff from happening. What you do is you deter it by responding as quickly as possible and shutting it down. And I think we're starting to see a lot of people building these systems, recognizing the fact that, hey, worst case scenario, if they can't beat my encryption, they'll go beat my guard and get the keys. So we know this, we know it's cyber-physical. We need to make many layers.

That layered model is where we get the best out of cybersecurity. These systems are going to be more robust, and you want to be like that garden spider. Wow, it didn't matter. I could have randomly touched anywhere in there. I had to get my finger out of the way very quickly or the spider would be down on me because that spider is that cybersecurity response.

Yeah, I love that analogy. And that's— and that web is its threat surface. And it's like, wow, that's infinite compared to a spider. But right there it comes. Do you teach other classes or just cybersecurity?

Yeah. Hey, thanks for asking. Well, probably no surprise I teach analytics for systems engineers. Oh, okay. So that's another class, and that is somewhat based on those 2 books.

But what's fun is in teaching those, you find new things out. So yeah, um, there will be stuff in the next book that came out of having to basically interpret those books to make it palatable for a class. The other 2 classes I teach are that invention systems one that I alluded to, where one of the students was hired by one of the lawyers, and also where, you know, I basically teach people how to think like an inventor. One type— one place I might point out where stereotyping is valuable, because we try to put ourselves in place of a stereotypic system engineer or biologist or physicist so that we think differently, right? Because I, I have a lot of patents, and almost every one of them has a co-author or co-authoress.

And without that person on there, there's no way I get the invention to be as useful as it was. And so that's, that's the third class. And then the fourth class— and I've been here just under 2 years, and I've put these 4 classes together, 4 online at the same time. So we're talking like 4,500 slides. It's been a lot of fun but also a lot of, a lot of work, right?

Um, the 4th class is on signals and sensing, so it covers everything from, you know, starting off with like how do you do an— how do you do an O2 reader, all the way on, you know, oxygen reader, all the way on up to how you do image analysis and how you find out if somebody's tampered with an image, etc. So, yeah, so fun class. I wish I was a young kid that could take your, uh, your courses. You can take them. Most— no, seriously, you are probably the modal age or the median age for somebody taking one of these classes.

So a lot of the system engineering PhDs that we have are mid-career or early mid-career like yourself, and they've got a, you know, decades in front of them, and they're saying, how do I differentiate in in place. Yeah, right. And so they're doing a lot of the research at Boeing, at Lockheed Martin, at NREL, at Los Alamos. These are folks, you know, out in our government labs, out in our, you know, big, uh, you know, aerospace and other firms. Sierra Nevada down in the Boulder area has several really, really good engineers in our program.

I've had— been fortunate to have a couple of those in my class. So, and it's interesting too, you were mentioning earlier that Um, that like one of your classes, it's all remote, or like one person is here. So yeah, that was the cybersecurity class. Spot on. I had the cybersecurity class last spring, so this year, and one person was local and 26 were remote.

And of those 26, I think one or two were in Colorado and the rest were in other states. So they're from all over the country and using it for everything from, you know, practicing for their CISSP to Hey, I just need to know this to be able to, you know, talk to the cybersecurity person on my team. So one of the things that— and, and again, you'll get a different flavor because it's a very eclectic department— but one of the things that I always say about systems engineers are they will be the second best engineer at everything on a project, and that is a huge responsibility. So they've got to talk to the electrical engineer, to the computer scientist, to, you know, the actual cybersecurity person to the data analyst to, you know, the mechanical engineer and all of that. And they have to kind of know enough about each of those fields to be dangerous.

So you mentioned that I've got an eclectic background, which I am fortunate to have, to have had. I've been able to jump into a lot of different things and had, you know, very talented and patient people help me become proficient in those spaces. But that's really what we want out of the system engineer, because we want somebody Coming back to that AI thing, right? And I'm not saying the other engineers are AI, but they have a much deeper and more specific role in their areas. And you need this one person to be watching everything and saying, by the way, when this interacts with this over here, it's going to fail.

You know, because they've done the risk and reliability, they've done all of the failure analysis, they've done these other things that you might not have expected all to come out of the same engineer. And somebody has to to kind of look at that all together and say, this is going to be a problem for the project. So cybersecurity is a big part of that. It's integral to where we're going in this space because everything now is going to be online and everything's going to be tied. And there's a threat surface now that we never saw before.

This has been a lot of fun. Thanks for joining me, Steve, and, uh, look forward to seeing you around. Well, thanks, Jason. Thanks for letting me kind of go off on a tangent on several occasions, but I definitely enjoyed talking with you. Great stuff.

Thanks. That concludes my interview with Steve Simske. You can find and follow him on LinkedIn. Also, be sure to follow and support Colorado Equals Security on Patreon and follow on Twitter @CO_security. I'm Jason Jake's Tech on Twitter and LinkedIn.

You can connect with me and I'm always open to feedback. Thanks for letting me guest host Colorado Equals Security. I'll see you around.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado equals security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.