Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 190 for the week of December 14th. Alex, we are not only in the last, uh, month of the year.

We're in the last second half of the month, basically. Yeah, we've only got a couple weeks left of this awful, awful year, Robb. And then we're on to something bigger and better and newer and brighter. Well, it is literally bigger, you know, 2021 versus 2020. And better, I'm, you know, fingers crossed that we're gonna see a year that it really can't be much worse, right?

It's gotta, it's gotta get better. That's what I was gonna say. I think it's a pretty safe bet to say it's gonna be better. Yeah. Well, hey, let's, let's talk about some housekeeping.

You know, I'm gonna just do a few of these all rapid fire and I'll let you do a couple. Slack channel, we'd love it if you join our Slack channel. It's a great community with over 1,600, almost 1,700 people as a part of it. You can go, you can go get the link to join that on colorado-security.com. While you're there, scroll to the bottom, join our mailing list and you'll get the show notes delivered into your inbox.

We love giving you show notes because I don't know why we like doing that, honestly. There's not a lot of incentive for us in that, but do it anyway. We do it anyway, you know. We'd also love it if you'd rate us and subscribe on your favorite pod catcher. That's a great way for us to get new listeners.

If there's lots of folks downloading it and commenting on us, people will find the show, and we love to get folks into the community. You know, this is a big part of what we do in our lives here is trying to help the Colorado community become better known and amplify the voice of the cool stuff going on here. Yeah, and we'd also love it if you would be willing to support us financially. We have a Patreon campaign. Again, you can find that on the website colorado-security.com.

And, you know, we also have interviews as part of these podcasts. And, you know, we don't always have time to get interviews done. So if there are people that want to volunteer to do interviews, we'd love to have you do that too. If you're, if you're listening this week and you're like, man, this sucks, there's no interview, that's an option for you to help solve in the future because there is no interview this week. Uh, Robb, I also, I have some, uh, late-breaking news about the Slack channel.

What's that? We are at 1,699 people on the Slack channel. Oh my gosh. If you want to be number 1,700, as soon as you hear this, go out and join. Maybe you can be number 1,700.

I'll give you some kind of fancy meme— not meme, what do they call the reaction things in the— I don't even know. I don't know what those are called, but we'll make sure that we celebrate you when you join in a Slack, uh, a Slack variety of celebration. Maybe we'll even send you something fun. Hey, we have a, we have a Patreon campaign if you want to help financially support the show, uh, pass some, some bucks along. Uh, we, we would love that.

You know, that's— that all goes back to the community helping us amplify the good stuff going on here in town. Um, and of course, we have some awesome news this week. We have a new patron in the last week. He asked to not have his name mentioned, so I will not mention it. But thank you very much for, uh, for supporting us, and we look forward to, to many years of, uh, giving you lots of good content in exchange for your sweet, sweet money.

Well, um, I, I apologize, Robb. When I saw the note here, I thought that the, uh, the new patron's name was Anonymous. So I guess, uh, thank you for clearing that up for me. I think he's a member of Anonymous, but That's all I know for sure. All right, well, with that, let's get into some news.

Uh, first up tonight, the iconic Denver bookstore The Tattered Cover has been sold to a new owner, or ownership group, that is. Um, pretty exciting there. Uh, that Tattered Cover had been owned by the, the original owner for a long time, and, uh, 2015 sold to, I think, a couple folks that had worked at the bookstore for a long time. Um, and now they've been sold to a an investment group called Bended Page. And actually, the, the folks leading that are people that are from Denver, one who their first job was at the bookstore, uh, back when they were 15.

Alex, you know this, most people don't know, you know, we, we use Trello as our, as our note-keeping, um, technology for this. And generally when we have stories, I'll put a couple of notes in the Trello card like, hey, make sure we talk about this. There's a lot of notes on this one. I thought this was a pretty interesting story. Um, David Back, who's the guy who you're talking about, whose first job was at the Cherry Creek Tethered Cover, he founded Zoomcar, which was the first, they say, legally operated car rental company in India.

So he got really loaded doing that. And basically, he's coming back to do what he loves in a company he really liked working for. There's a quote here. Our vision, this is from the owners, our vision includes growing opportunities for community engagement, connection, and conversations. We see this happening within our walls, but also more directly in the community, and we're eager to bring this vision to reality over the coming months.

So they're not— there doesn't sound like there's any, uh, expectation that things are going to get worse for The Tattered Cover. You know, it's always scary when a beloved organization gets, uh, acquired, um, but these guys sound like they really are part of keeping this thing moving forward. Yeah, I think this is much better than, you know, them being bought by some other big book chain and maybe keeping the name or something like that and basically hollowing out everything that they were. So Glad to hear that it's going to continue on in the way that it was, just with a new ownership group. A couple more things I want to call out that I thought were interesting here.

The organization, Soup to Chowder Cover, was founded in 1971. So actually, next year will be its 50th anniversary. Pretty cool. They have a 5th location scheduled for, or planned for Westminster. And in May, I didn't— I feel like maybe I heard this, but I don't remember having heard it.

In May, they announced that they're going to be moving out of their current headquarters, not headquarters, but their their flagship store in Lodo, which is on 16th Street and Wine Coop. They're going to be moving over to McGregor Square, which is a massive multi-use project that's going to be happening just west of Coors Field. So, they're planning to be there in the first quarter of next year. So, not that far from now, they're going to be moving the big store. Yeah, that's pretty cool.

I think that McGregor Square is going to be a cool development. I think a story that we didn't end up putting in for this week is that Red Canary is going to be moving their headquarters to McGregor Square as well. Sounds like it's gonna be the place to be. Place to be. Um, so the next story is actually a little bit less fun about a, uh, kind of a cultural, um, cornerstone here in town.

Um, so I'm gonna try if I can say this right. Um, El Chupa— oh, El Chapultepec. Yep. El Chapultepec, uh, is a jazz club. It's been in Denver for 87 years and they are closing down for good.

Yeah, it is kind of sad. It's been there, uh, since the day after Prohibition ended in 1933, uh, which is a, a cool milestone. Um, but yeah, I mean, 87 years, that, that's a pretty long run. And, uh, you know, it has been, you know, sort of a mainstay for, for jazz clubs here in Denver. Yeah, it definitely bums me out.

Not that I'm— I've never been there, to be honest. I've walked by it many times and, uh, never been inside. But from, you know, reading about the folks who loved it, sounds like a place that that really provided a nice service to Denver and had a lot of big-name artists come through over the years. Definitely bummed that we're not gonna have that kind of a place in town anymore. Now I wish I could go.

Yeah. As part of their statement, they said that really Denver has kind of outgrown and sort of maybe moved on from them. So, they felt that it was just time to pack it up and move on themselves. So, sad, but I guess with everything, it has to come to an end. All right, well, let's take a turn.

Let's talk about some tech stuff. Um, there is a, a Boulder-based startup. It's a— oh man, tech might not be the right word here, huh? This is a lawn care startup called Sunday. Um, basically what they do, they, they do use technology.

They analyze climate and soil data to create seasonal subscription packages for a customer's yard. And when I read this, I'd never heard of this company, I'm like, holy smokes, I need this. Um, basically they're going to send you the right chemicals to keep your lawn healthy healthy and safe, or not safe, but healthy and growing, you know, all year round. Yeah, pretty cool. I mean, I have seen some ads for Sunday before, but I've never used it myself.

I think one of the other things that they tout is, you know, the things that they use in their fertilizers and other things that you put on your lawn is, you know, they are safer. It's not, you know, made from natural ingredients. It's not toxic and things like that. So It's locally sourced, all organic manure. Yeah, exactly.

Yeah. From Boulder. So, they'll send you stuff in the mail. All you got to do is hook it up to your hose and spray it on your lawn. So, they did just raise a $19 million B Series.

And this is— it's interesting. It is coming from Sequoia Capital. That's one of the— that's the leading firm. Tusk Ventures, Forerunner Ventures are a part of it. So, It's not tech, but those are tech investors obviously seeing this subscription business based on the internet as just an extension of what we've been doing with all kinds of other tech companies.

Yeah. And I think as you mentioned, while the end product is something physical, I think that there is a lot of tech that goes into it to get it to you, to make sure you're getting the right stuff and all that kind of thing. So last note here, they are going to use the money that they raised to grow the team. They expect to go from its current 40-person staff to another 25, 65 people in the next year. Um, that's a pretty significant organization, so really good for them.

Yeah, good stuff. All right, uh, next, a report offers plans for the Colorado Front Range passenger rail, um, which is, you know, been talked about for a long time, and I think this, this report is giving more details to what could happen there. So, uh, the planned first incarnation of this is rail service along the Front Range between Fort Collins and Colorado Springs between 2 and 6 daily round trips. And the initial phase of getting that set up could be somewhere in the range of $1.5 to $2.5 billion. Yeah.

What was so interesting to me about this is whenever I heard people talking about a Front Range rail, I was always thinking, all right, we're going to put in a new system kind of the whole way, and it's going to be, you know, faster and, um, you know, higher tech than what we've got currently. But this, this proposal here is actually talking about using existing freight rail tracks, and they say that the, the average speed, um, going from, um, what is it, down Fort Collins down to the Springs is only going to be about 45 miles an hour. Yeah, um, I would imagine that some places it's faster, but I, as they get into other areas, I assume it's slower too. But But yeah, I mean, that does seem like it would not necessarily get you there as fast as you would want it to go. Also, they talk here about other possible phases, a second phase that could go between Colorado Springs and Pueblo for much less, but also a smaller span there.

And sort of a follow-on to that, the hopes to build a faster and more frequent line, which basically would go all the way from the southern point of Colorado all the way up to Cheyenne. And that would be a much faster rail line going from 90 to 110 miles an hour. And this is more of what you were thinking of, Robb, is building a brand new track to do that. Yeah. And that looks like that would cost somewhere between $8 and $14 billion.

So a lot more expensive. Frankly, it just kind of depends on that as a state, what kind of appetite do we have for this? And I honestly have no idea how big our appetite is. I hope we eventually get there though. Yeah, I mean, it seems like something that would make sense, but yeah, I have no idea how many people would actually take it.

But with the amount of traffic we have up and down the I-25 corridor, uh, I would imagine that there is some appetite for this type of thing. All right, next story we've got here, another interesting one. Um, this is about Denver's Range Ventures. So we have a new, a new venture capital firm in town. You and I, we, we spend a lot of time on the show here talking about, um, Techstars and Foundry Group, um, as, you know, can I say, probably the primary players in terms of investing here in town.

And this new venture company, Range Ventures, um, has raised a— or they've closed a $23 million fund for early-stage software startups, really to, to fund those tech companies as they're popping up across the state. Yeah, and, uh, they talk about some of the folks that started this, uh, Adam Burrows and Chris Erickson, um, Adam had roles at Angie Home Services, Angie's List, as well as Guild Education. And Erickson, sounds like he was in the Bay Area and recently moved to Denver, but founded Apartment List. So, both have some, definitely some big chops in terms of startups. It's interesting.

They talk about those 2 as the primary partners, and then there's like 100 limited partners from just about every company here in town. I try— I couldn't find that list of individuals who were a part of that. I did spend a few minutes trying to look for it. But, but they definitely have a lot of connections across the state. And frankly, in any, any tech company that's been successful in town, looks like they've got some kind of connection to those.

Yeah, I do notice that they have somebody who is identified as being from, from Ping An here. So Pretty cool. There's a connection. Yeah, I was trying to figure out who that was. I couldn't figure it out.

Yeah.

They also say that they've— they have made some investments already. They expect to make 20 to 25. I'm missing where it was that they said the couple that they already— oh, they've already made 3 investments in companies like Suna and Comet Chat. Yeah, I am excited to know we've got a new company in town that's going to hopefully give it— continue giving us interesting news to talk about on the show. Yep.

Uh, all right, uh, next we have a story about Denver's favorite application security startup, StackHawk.

Thank you, Robb. Yeah, thanks for waiting for me there. Um, the, the news this week is that StackHawk has released a new free plan, uh, for folks to, to use the StackHawk stack, um, you know, without having to pay for it. So You know, this is available directly to developers. You know, it doesn't give a whole lot of details on exactly, you know, what the criteria for the free stack, free service of their stack is, but my assumption is it's, you know, probably single user or something like that.

But, you know, I think a great way to get people familiar with the application and using it and helping make their applications more secure. Yeah, you know, since they're using ZAP as the foundation for it, and that's open source software, it makes a lot of sense to, you know, kind of experiment on making their stuff free and basically just make it, make it so easy to go from using that open source Zap to using their tool that, you know, when you get to the point that you start to scale up, you want to start spending money on it, it makes a lot of sense. I love the model. Of course, it makes it easy for us to get security rolled out, and hopefully they can make a little bit of money on that as it scales and as people find it really convenient. Yeah, and when I saw this story, I forwarded it on to some of my developer friends so that Hopefully they can start using it themselves.

I love it. All right, next story we have this week is actually an announcement from Coalfire. They have been named the grand winner in the, I don't know what SVUS means off the top of my head, but the SVUS Women's World Awards. Yeah, pretty cool and congratulations to them.

They linked this to the accomplishments of 6 women at Coalfire. Divya Jayachandran, uh, man, uh, Bhavna Sandhi, Cassie Cat, Anja Medising, Mandy Pote, Jennifer Velnosky. So, uh, congratulations to all of them. They, they do also talk here about the, uh, RISE program at Coalfire, which we talked about several months back in an earlier article, uh, which is the internal program there at at Coalfire to help develop and promote women internally. Yeah, it's really cool to see, you know, Coalfire leading in diversity and equity here, at least, you know, investing and making this a priority.

I know that in the tech industry it's not easy and it doesn't happen if you're not intentional, so good to see them doing that. Yep. Next we have a blog from Ping talking about how everyone loves Ping and that they have an industry-leading Net Promoter Score of +65. Pretty cool. Yeah.

So I mean, I don't know how much everyone knows what Net Promoter Score is. I will say that within Ping, it's a really big deal. We basically— the idea is, I'm sure everyone's received a certain, like, a one-question survey that says, how likely are you to recommend this service to a friend? And basically the idea is if you say 9 or 10, you are a promoter, you're likely to go out into the world and say nice things about that product. If you say 1 through I think it's 1 through 6, then you are a detractor.

You're out in the world saying negative things about the product. If you're a 7 or an 8, you're a neutral. And the way you get a Net Promoter Score is you take all of the 9s and 10s and you— that's 100. If all of them were 9s or 10s, you'd have 100. Then you take away from them all of the 1s through 6s, and that gives you your score.

So, you know, Peng, we take it really seriously. We want to make sure our customers are happy and really cool to see this kind of industry-leading 65 score basically means the customers are pretty happy with Ping as their IAM provider. Yeah, and I also appreciate the fact that you guys have a nice chart in there showing many of your competitors and their Net Promoter Scores. Some of them do really well. Microsoft has a pretty good Net Promoter Score on there.

Not all of them do real well though. One of them at the bottom with a negative score, so— Yeah, we don't need to talk about them.

All right, uh, next, next we have a blog this week from LogRhythm. Um, they're actually— and I think one of the big reasons we put this in is, uh, is they're talking about a big piece of news this week. Um, they're, they're showing how can you detect the exploits from that FireEye Red Team tool, uh, breach that happened this week if, if those tools are used inside your environment. Yeah, so obviously, uh, LogRhythm, their bread and butter is to, uh, detect people attacking you, so now that these tools have been stolen and are out there in the wild, if someone is using them to attack you or potentially has used them to attack you in the past, you now have some IOCs from this article that you can go in LogRhythm to look and see if you can find evidence of those tools being used. Yeah, and they walk through specifically like what those IOCs look like.

And if you are a LogRhythm customer, they specifically, you know, talk about how you can do it. And frankly, there's some good tips in there that I'd say are not even necessarily like LogRhythm related, just, know, hey, make sure you've got all your logs going to a central place. Make sure you're, uh, make sure you're really staying on top of, of monitoring, um, activity. What, what's nor— what's good look like? What's bad look like?

You know, those things that are, are good tips for just any of us. Yeah, and I think that that's one of the, you know, the positives to come out from this is, you know, just a reminder that, you know, when you hear about breaches, when you hear about attacks, you should be looking for those IOCs if you can find them and get them into your tools so you can make sure to detect them yourselves and, and not fall victim to the same things that other people did. So yeah, I think just talking about the, the FireEye breach for just a minute, uh, you know, not Colorado-focused, but man, it was a big story this week. I, I think that it's kind of a wake-up call. You know, FireEye is probably the people most, most of us call in when there is a breach.

You know, they're known for being great at, uh, at being able to analyze incidents and, and really tracking down stuff. They, they were pretty pretty upfront about when it happened and talking about what was stolen and giving us those IOCs to track down if someone's using their tools. But what they haven't shared yet is how the bad guys got in. I'm really looking forward to seeing the details on that, 'cause whatever got into FireEye is probably something that the rest of us should be aware of and certainly, you know, add to our own defenses to make sure we're not vulnerable to it. So definitely encourage those guys to share as soon as they can.

Yeah, I'm sure that there will be an RSA or Black Hat or someone else, uh, talk this year, you know, by someone at FireEye talking about what happened. But yeah, for sure. All right, all right, jump, jump over to our last story. We have a blog from Optiv this week, um, that, you know, this is— this seems more like a blog like we get from Red Canary or Coalfire, a really nice in-depth technical write-up. And this one is talking about, um, how folks are abusing the AirWatch MDM kind of MFA configuration to bypass MFA, even though you might think you've got MFA required in your account.

Yeah, so some good detailed research here. This looks like it was by one of the Optiv Red Team folks, and they must have been doing some vulnerability research on the AirWatch MDM. They noticed that it— even if you have multi-factor turned on, it appears to only use multi-factor at a certain point, and there are some other parts in the process with AirWatch where it is single factor. So They go into a whole lot of detail about, you know, what they found, what they researched, and what I really like is at the end they do have some things that you can look at to potentially mitigate this for yourself. Also talked about how they did report this to VMware, who now owns AirWatch, and their response to the vulnerability being disclosed to them.

All right, good stuff from Optiv. Certainly love to see that, and if we see more of those highly technical blogs from Optiv, we'll make sure we keep including him here because I love seeing the local security companies come up big for the community in general. For sure. All right, uh, that is the news. Let's move over to the Slack message of the week.

Thanks again to Andre Geda for supporting the Slack message of the week. Uh, he has been doing this or something similar to it for, you know, basically the entirety of the podcast. So, uh, you know, thanks again to Andre for being a great supporter of us in the community. The winner of the Slack message of the week gets a credit to get something from the Colorado Equal Security store. So Robb, who is our winner this week?

It's JD Burke. So, you know, we've had for the last several months, we've had a book club going on. It's been started by and led by Douglas Brush. You know, Douglas recently has been unable to keep moving forward due to, I assume, his alcoholism. I don't know.

Of course, I'm kidding. I have no idea how much alcohol he drinks, but I don't think that's why he's not doing it anymore. I— but he's basically handed off the torch. JD Burke has picked that up. We certainly appreciate this as a way for the team to connect and frankly, you know, improve the careers of those who are a part of that group.

So JD has been kind of starting the new meetups and posting across the different channels to get folks engaged. I want to encourage that. So if you want to get involved with the book club, there is a channel specifically for that. Get out there and see what book's coming up next because I think they just finished the, the December one, so you have to get involved for January. But, um, would love to, love to have you guys get involved.

And of course, JD will get to pick something from the Colorado Equal Security store now, um, to show our appreciation for him leading that, uh, that movement. Yeah, the book club, another great reason to join the Slack channel and, and see all the stuff going on there. So, all right, uh, congrats JD, and let's move over to events. All right, we just got 3 things through the end of the year. On the 16th, ISC² Pikes Peak is doing their December chapter meeting.

On the 17th, ISSA Colorado Springs is doing their December meeting and chapter appreciation. And also on the 17th is the big annual joint meeting between ISACA and ISSA doing their holiday meeting. It'll be the first time virtual, so hopefully you guys can join that and and see what a virtual holiday party looks like. Should be good. All right, uh, let's move over to jobs.

Uh, Robb, any Ping Identity jobs? Yep, we've got a few jobs at Ping. We are still looking to hire a product security engineer. If you're a, a developer with an interest in security or a security person who knows how to code, we'd love to hear from you. We're also hiring a couple of managers, looking to hire a manager to run our privacy program and a manager of GRC programs, which is basically someone who would be focused on kind of building those repeatable processes around policies and standards and ISO certification, SOC certification, kind of running that program side of the department.

Good stuff. All right, Pinsight is looking for an IT manager for cloud systems and security. Denver Water is hiring an IT security analyst. Colorado Department of Public Safety is looking for a cybersecurity intelligence analyst. Ballard Spahr is hiring a privacy and data security associate.

FirstBank is looking for a security governance analyst. Is that the Colorado bank for you? That is FirstBank, Colorado's bank for you. Yeah. Uh, SCL Health is hiring a security analyst too.

And finally, Presidio is looking for a senior solutions architect for cybersecurity. Good stuff. Well, that is it for the podcast. Like I mentioned, we do not have an interview this week. Um, I think we should have one more episode right before we we take a break for Christmas and maybe New Year's.

I don't know exactly, but I do think we'll be back next week, won't we? Yeah, we should be back next week, and then we'll have to figure out what holidays look like. Awesome. All right, well, sounds good. Have a great week, and we'll talk to you guys again next week.

Thanks, Robb. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado Equals Security.