Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 191, uh, the week of December 21st. Alex, uh, end of the year is upon us and, uh, things have slowed down quite a bit, huh?

Yeah, you know, it's that time of year when everyone starts to take off for end of the year. So, uh, I think this past week was my last week of work for the year, um, and, uh, I am going to try and disappear too. It's been fun. So, um, I was speaking ironically because the last week, it's been like the busiest week of the year for me, all the stuff going on out there, uh, in the world. But we'll get, we'll get into that a little bit in the news.

Um, and then of course, this is our last show for the year, so we'll, uh, we'll address that, I think, in the end as well. But for now, why don't we jump into some housekeeping? Uh, the Slack channel is, is actually booming this week. We've had a lot of interesting conversations going on. We have, and we are well above 1,700 people in there as well, so it keeps growing.

Um, if you want to join that Slack channel, go to the website colorado-security.com and click the Slack link so you can join the workspace. Also, we have a mailing list you can join there that you will get the show notes mailed to you every week in the mail. We would also love it if you would go to your favorite podcast application and rate us and subscribe to the show. That way you get it every week automatically, and you also let other people know that it is a great show.

We also would love it if you would support the show either by going to our Patreon campaign, which you can financially support the show through, or by doing interviews for us. We love to have interviews with folks in the community. There are are so many interesting folks to talk to and we just don't have the time to meet with all of them. So if you want to help do that, record your interview, get it out there, and a few people, you know, will make you very modestly famous. Um, we'd love to have your help doing that.

Yeah, that's, that's good stuff, Robb. Uh, with that, why don't we jump into the news? First, uh, a 21-year-old CU Boulder senior is working on a project to 3D print a school in Madagascar. That is a pretty bold initiative there. Yeah, so her name is Maggie— I hope it's Groot, but it's probably Grout.

But let's call her Maggie Groot because I don't know either way. Maggie Groot is a senior at CU Boulder, and she's actually the daughter of one of the co-founders of MapQuest, interestingly enough. She came up with this idea for a nonprofit when she was 15 years old, so she's been at it for 6 years. But, but they're now ready in the next year to to actually do the 3D printing for their first school in Madagascar. Her organization is responsible for raising the funds and kind of like identifying the site and all that.

And then she's partnering with Studio Mortazavi to actually do the architecture. And then they have a local company that's gonna do some construction for them. Yeah, and I think, you know, one of the reasons of, 3D printing is that it would— it's going to be much quicker. They should be able to get it printed and put together in a couple days. And also, they're going to do locally sourced construction materials for the other pieces besides the walls, the roof, the doors.

I would imagine windows if there's windows, things like that. Robb, you mentioned that it's her responsibility to find the site. Do you think that they're just going to use MapQuest to find a spot? I suspect they're probably using Google Maps at this point, Alex. But, but anyway, this is obviously just an amazing accomplishment for anyone, and especially for a 21-year-old who's just figuring this stuff out.

The school— a couple more facts about the school— is going to hold 30 to 40 students. The intention is they're planning to do a lot more of these in the future as they, as they kind of prove out the concept. And, and frankly, they just are impacting the lives for folks in these kind of underserved areas significantly. Yeah, uh, it's a pretty cool thing, and, uh, glad that there are, um, motivated young people out there doing good in the world. All right, to go from, uh, you know, unknown 21-year-olds to, uh, uh, much better known— I don't know what, 30 or 40-something-year-olds— let's go to our next story.

Yeah, so, uh, there's a new fitness startup in Denver, and some of the investors are people you have heard of, like Pitbull and Jay-Z. Yes. So I, I had never heard of any of the facts about this story till clicking this link. Uh, so number one, there's a man, Avram Elmakis, uh, who, who moved to Denver, uh, back in 2017. He was the, um, was the head of a company called Best Bully Sticks, which I guess is a pet treat company.

And he came to Denver really looking for his next good big idea. And he thinks he's found it with this new exercise technology. So we've all, you know, I'm sure we're all familiar with Peloton and the idea of, you know, kind of doing this cardio exercise in a group setting. Well, they've created a new type of machine and this is a, it's called Climber. Um, and it's basically like a climbing machine where the way they describe it is it's crawling except at a 70-degree angle, basically standing up crawling.

Um, and they say it does, uh, what would they say? It's like 50% more calorie burn than you'd get from running, rowing, or biking, something like that. Yeah, I think it was, uh, 60%. Um, But yes, supposedly a better workout. Like the other machines of this type, it has a, you know, a big touchscreen that you can, you know, be on with other people.

And I assume see who is climbing more and push each other to climb faster, that kind of thing. This is— they're doing an Indiegogo project for this, and it's got $850,000 in funding. Um, with their original goal was $100,000. Uh, the machine itself costs $2,000, and, uh, that's for, for the Indiegogo. But, uh, once it's released, it's expected to be about $5,000.

So, uh, I, I assume— I don't have a Peloton or any of those things— I assume that that's on par with what those other things cost as well. And but I think they said it's a $40, $39 per month service after that. So I think, I think it's roughly on, on par. Um, so they talk about the high-profile investors: Jay-Z, Pitbull, um, Novak Uh, Djokovic. Djokovic, thank you.

Uh, the tennis player. And then YouTube, uh, co-founder Chad Hurley, which, uh, kind of interesting. Now, but now when they're talking about crowdfunding, what I wonder is when they call it high-profile investors, does that mean $2,000 on the GoFundMe? Is that what that means? Uh, that would be pretty funny if that was.

I, I have to imagine there's some other funding going on there, but who knows. Yeah, I mean There's another place in the article where they say that they haven't, that this is the only kind of funding they've got. So I don't know, at some level they're getting support from these folks. They're not, they made that very clear, they're not paid endorsement folks, they're actually investors. Uh, we don't know what level that they're investing in.

Anyway, it's awesome. This looks like a pretty cool thing. It's going to be the next, uh, the next Peloton. And, uh, and I'll tell you, I was, I was slightly tempted and then I thought, oh, $2,000 maybe Maybe not that tempted. Maybe not.

Yeah. And it— this reminds me again, probably Robb, you won't get this reference because you don't watch regular TV, but there was a commercial. I can't even remember who it's for now, but, you know, the new exercise fad, you know, was log rolling. This guy invents a log rolling machine and, you know, then they show him in, you know, classes like this doing the log rolling stuff. So I guess this is the next fad.

So are we talking about log rolling like in your log management tool? What kind of log rolling is this? No, like lumberjack log rolling. Oh, my bad. My bad.

Yeah. Very similar though. Let me take us to our next story before I say anything else dumb. We have a story this week about Larimer Square being sold. Officially, they've been sold to a company called Asana Partners out of North Carolina.

I, you know, I, to be totally honest, I didn't know that all of Larimer Square was even owned by one organization. So it's actually one man, it looks like. So this is a— This is interesting. Yeah, and so Jeff Hermanson, who is the previous owner, uh, has been in control of Larimer Square for 27 years, uh, and has helped make it what it is today, um, including bringing restaurants like Rioja, uh, Tamayo, Osteria Marco, and others there, um, and, you know, has made it probably the most recognizable spot in downtown Denver. Um, it's actually— Larimer Square was the first historic district protected by ordinance in Denver back in 1971.

And it has had some ups and downs. There's been talk about what would happen there, the amount of work that needs to go into restoring some of the buildings there and that sort of thing. So I think it is good that the sale has happened because it sounds like Asana Partners does a lot of these kind of things where they own historic areas and continue to keep them up. So I think that's a positive. Yeah, they— the article mentioned that there was like $120-something million worth of renovations required to restore things and keep it, you know, usable and modern.

And it sounds like Asana Partners is willing to do that. So that's pretty great news. I said one other note from this article I found was interesting, that some of the buildings in Larimer Square date back all the way to the 1880s. So, you know, 140-year-old buildings in Denver. You know, I might think of that in Boston, but I personally just don't think of Denver as being quite that old.

So it's pretty cool. It is pretty cool. All right. Next, Denver ranks in the top 10 for most moved-to cities during the COVID-19 pandemic. So, I guess during COVID nothing has changed.

People still want to move here. Yeah. Bloomberg did some research on LinkedIn, basically looking at profiles to see where people moved. So, I would imagine there's some kind of bias toward, toward people in the tech industry. But we did come in number, number 8.

Number 1 on the list was Austin, Texas. Yeah, yeah. I don't even know what to say about that. But that said, we were actually the only one on the list, or at least high on the list, that was in a state that doesn't have no or really, really low state income tax. So, the expectation is a lot of folks are fleeing places like New York and California because why would you bother paying the income tax in those areas if you're not going to take advantage of going into the office and you don't have to be there?

But in Denver, we still have income tax. Texas doesn't, Florida doesn't. So, obviously, folks are coming here because they like it. They're going to Austin because, you know, it's the best place where they can save some money. Well, I also think the top 5 there are all in places that had less strict COVID regulations than Colorado too.

So, you know, 2 cities in Florida, Tennessee, Phoenix, and Austin, Texas. So I think that could play a role as well. You know, people try to get somewhere where they don't feel constrained. All right, next story. We have a new aerospace company coming that's gonna be making Denver their US office.

Feels like every week we've got a story like this. Very clearly, Colorado is, you know, at the hub of aerospace and investments in spaceflight. This new company is called Kleos Space. It's a Luxembourg-headquartered company. And really what they do is they use satellites to collect and analyze intelligence data for world governments.

So they're basically the ones spying on all of us. Yeah. And we love people spying on each other. Palantir is here now too, so we could be the spying capital of the United States also. Didn't occur to me that that's true.

I guess Colorado equals intrusion of privacy. Colorado equals not privacy. Yeah. I like that. Yeah.

The other thing that occurred to me with this is we had that story a couple weeks back talking about how they're trying to brand Colorado. What was it? Aerospace Alley or something like that? That's right. This seems to play right into that as well.

I think one of the good things here is that, you know, this will be their US engineering hub for Clio Space, and there's gonna be about 20 more jobs here in the near future and likely to be 100 or more as the company continues to expand. So that's good stuff. And that's just building from their current 4 employees. So they, you know, obviously right now it's very minor. It's gonna be getting a lot bigger.

Looking forward to seeing that. 25 times growth, Robb. Oh man, that, that would get you onto that Inc. that Inc. biggest growers list or whatever. Maybe. All right, uh, next, uh, we have a blog from, uh, David Stauss, uh, talking about the fact that the, uh, Colorado Privacy Rights Act— California, what did I say?

Colorado? Yeah, uh, California Privacy Rights Act. We don't believe in privacy here, we already talked about that, uh, goes into effect Uh, now. So they have certified the election in California, and that means, uh, that CPRA is now in effect. Yeah, so while the, the act doesn't actually like get operationalized fully until— well, actually for a couple more years till 2023— the law is now in effect.

And what that means is that the new California Privacy Protection Agency, or the CPPA— we better get used to saying CPPA— that's been— that's now been created. And the expectation is this, this agency is going to be one of the most influential regulatory privacy agencies in the world. You might think it's just a state in the US, but California does have the 5th largest economy in the world, comparing it to all the other countries. And the way that these folks choose to regulate and enforce the law is probably going to set the tone for how a lot of our companies have to act elsewhere in the world. Yeah.

And I think that the new bureau, the CPBA, I think is very important as well, because previously it was the attorney general that had to enforce the privacy laws. And they were not given any, you know, additional staff or money or any of that kind of stuff to help do that. So there were not many actions taken by them because of it. So, all right, so moving on, we have a story this week from Zwelo, who, you know, do DNS and kind of intelligence security here in town, and they're talking about their response to the SolarWinds attack. I'd say 2 things.

Number one, I think it's great. Number one, the actions they took are fantastic. And it's nice, you know, it's nice for us to have a local reason to talk about some national news like this. And the second thing I'll say is I really wish they didn't pound their chest about how well they did on something like this, 'cause I feel like it's a little bit, I don't know, it's a little bit tacky to brag in the middle of like maybe the biggest security event that's ever happened. The headline on the story is, ZVLO's early response to the SolarWinds attack protected its clients and partner network of 200+ million endpoints and users Yeah, I'd agree with that.

But I think, you know, on the positive side, you know, they don't sell directly to consumers. They sell to, you know, other people that consume this, you know, managed service providers and things like that. So, you know, if you are a small or medium-sized business and your managed service provider uses Zillow's products and intelligence, you are protected, at least to some extent. So I think that's a positive thing. You know, I think in some instances, maybe you might not have as, you know, some enterprise-grade type products if you're a small or medium-sized business.

So maybe you might not have gotten protection as fast. So I think that is a positive. Yeah, for sure. But I think this, you know, also gives us an excuse to talk about this if we want to, Robb. So specifically what they did is they, you know, I don't know how much we want to get into technical details.

It's worth going just a little bit, I think. You know, the malware that the SolarWinds backdoor dropped, the malware is called Sunburst. That malware had to call back to some domains in order for it to be effective, kind of command and control systems. And Zvilo, basically as they got those signals about what the malware did, they were able to block access to those domains. That's the action they took.

So if there was that backdoor installed in your environment, it would be unsuccessful reaching out to take commands. And as a result, you probably break the kill chain and they're not able to keep moving forward. Yep, and that's a good thing. Definitely. All right, uh, next we have a blog talking about how to mitigate container security risk.

This is from LogRhythm, um, and this is a good overview talking a little bit about Docker and containers, uh, what they are, how they differ from virtual machines, and, and that sort of thing, and, uh, some things that you can do specifically in LogRhythm but also some Just good general ideas of things you can do to look for potential bad activity in terms of your containers. Yeah, I actually thought that this was great because I guarantee that there are hundreds of people listening who still haven't really got a lot of exposure to containers. And if you're still thinking to yourself, but really, isn't a container just the same thing as a VM? Read this blog post and I'd say frankly the answer is kind of, and in this blog post it'll explain to you exactly where the difference is. And I would say that while the intention of a container is it should be significantly different, I have seen some individuals who use a container as though it was a VM.

If you pack all kinds of pieces of the OS inside the container, it's now no different than a VM, but that's not the intention of it. For sure. Uh, I mean, it is nice that, um, part of the blog is talking about LogRhythm and their, their SOAR capabilities and, uh, how you can automate some of that stuff as well. So nice to see that they, they can do those actions as well. Hey, speaking of automation and SOAR, let's jump to our next story.

Uh, Colorado's own SOAR company Swimlane announced an integration this week. They are partnering with Stellar Cyber. Stellar Cyber is a a security operations organization, and they're going to integrate between their SOC functionality and Swimlane SOAR functionality, basically to give you the best of both worlds. Yeah, that's pretty cool. I wasn't familiar with Stellar Cyber prior to this, but cool that they are going to be using this.

I think anywhere where you can do automation is a good thing, and I think especially when you have integrations like this, it makes doing that automation as the end user much easier. Yeah, I think, I think if you, if you're going to use a SOAR system, which I think is starting to make more and more sense for more and more companies, you better make sure it integrates with your SIEM or you're just going to be frustrated. So good, good stuff. Glad to see them, them investing, but glad to see both sides investing in this. I think that's probably the only way to be successful.

All right, and our final news story for the week, uh, Coalfire has a blog talking about Azure policies. So this is actually a multi-part blog series Talking about Azure, and today they're talking about the policies that you can set within Azure and within a Blueprint deployment, and the different templates and things you can do with that as part of it. So if you are using Azure, I think this is a pretty good blog for you to check out. Yeah, and this is yet another situation where, like, even me, I've had a lot of cloud experience over the last, you know, 5, 7 years, but mostly AWS. So this is a good chance for me to really understand how Azure works differently and start to kind of get my head around how that works.

So I definitely recommend for anyone who's not already in Azure, take a look at this whole series and use it as a way to get familiar. Good stuff. Alright, with that, let's move over to the Slack Message of the Week. Thanks again to Andre Gaeta for sponsoring the Slack Message of the Week. He's been doing that for a long time now, and the winner of the Slack Message of the Week will get one free item out of the Colorado Equal Security swag store.

And Robb, who's our winner this week? James Brown, not the singer, but the security professional from Colorado, from Invoca, I believe. James reached out to me to suggest we start an outdoors channel in the Slack channel, and by golly, that's a great idea. So not only are we having this channel basically to talk about whatever outdoorsy thing you want to discuss, but he's promised to deliver secret camping site information. So if you're, if you're wondering where are the good camping sites, you better get in there before all the other Colorado security people have filled in those sites by stealing James's good ideas.

That is true. They won't be secret much longer. I think also this goes a little bit to the vibrancy and how much has been going on in the Slack workspace. I think we've had 3 or 4 requests for new channels in the past week or so. Lots of people with great ideas and things they want to talk about.

So pretty cool. It's nice to have a place to do it. Yep. All right, let's— we have no events. This is the portion of the podcast where we, where we tell you that, hey, it's just about Christmas and New Year's and people don't do events around those holidays.

So spend time with your family. Maybe, maybe catch up on some old versions of Colorado Equal Security. And we'll definitely look forward to catching— telling you about the events that are happening in January. So Robb, does that make this the most uneventful podcast of the year? Wow, I like, I like that.

It makes me feel bad and good all at the same time. Yeah, that's what I like. Um, we do have jobs though. No, no events, but we do have jobs. People, you know, in the middle of a pandemic and in the middle of the holidays still need to hire security people.

That is true. Um, even Ping Identity, especially Ping Identity. We got— I have 3 positions to hire. I'm not gonna spend too much time on them this week with the holidays. Let's just say if you're a GRC person and you want to be a leader, or you're an AppSec person, that's a good time to reach out to me on Slack or check our website and see what jobs are there.

I'm happy to talk to you about them. Sounds good. Presidio is looking for a senior cloud— excuse me, senior solutions architect of cybersecurity. Nordstrom is hiring a technical program manager II, governance, risk, and compliance. OpenText, which in this case I believe is Webroot, is looking for a threat research analyst.

Ames Community College is hiring an identity management security analyst. And in case you didn't know, Ames Community College is in Greeley. Uh, Sikorsky Aircraft Corporation, which is someplace I've never heard of, is looking for a defensive cyber engineer. Richie May is hiring a cybersecurity engineer too. And the coolest sounding job of the week, NREL is looking for a graduate summer internship in microgrid control for cybersecurity and resilience.

So you're saying I have no chance? That's what you're saying there? Well, you, you have to be a grad student, and, you know, we know that you didn't even make it out of high school, so that's going to be a little much. Yeah, there's, there's an awful lot of reasons I can't get that job.

All right, well, that, that is it for the end of our jobs this week, um, ending on a highlight. You know, Alex, uh, this is our last chance to record for 2020. I think we should take a minute and, uh, look back at the year and, uh, say some— something profound. What do you got profound to say? Well, I don't know if we'll have anything profound to say, but we can say some things anyway.

Um, obviously this has been a strange and, uh, different and in many ways difficult year. And, uh, you know, I've been thankful that we've been able to keep this going and that we've had a great community both through the, the Slack channel and some other things that we've been doing to make sure we're, you know, keeping in contact with people. I think that that's really helped keep me going throughout this whole crazy mess. I think also, you and I have had to figure out how to navigate this. Previously, we had only— well, I think with one exception, we'd only recorded the podcast in person.

So we had to Audible, we had to figure out how to make it work not doing that. And I think we've done all right. Yeah. It's gone pretty well. I appreciate the flexibility on that.

I also appreciate that now I don't have to shower in order to record the podcast. You shower before? Occasionally. I do want to, you know, say thanks to the community who's been involved and especially thanks to the patrons who've supported us. You know, I know that it's not a ton of money, but it means a lot to have the support from folks who want to see things keep moving forward.

So thanks to those folks for doing that. I also want to just, you know, call back to a quote that was in the Slack channel today. It was Because people— I can't remember which website it was, but some list had asked folks to talk, asked their readers to talk about how they would describe 2020. And one quote was, it's like going to an intersection, looking both ways, and then getting hit by a submarine. The year has just been so weird.

None of the stuff that we were thinking would be difficult is what's been difficult. And you're in the middle of a global pandemic and the stock market's at an all-time high and unemployment's at an all-time high, or not all-time, but at a real high level. Just how do you, how do you kind of put these all things, all these things together? And of course, the nation-states are coming after us harder than ever as well. It's just been a crazy year.

Yeah, it has been a very crazy year. I look forward to 2021 because it has to be better than 2020. Well, it's going to start off with— I saw, I read an article today about the distribution of vaccines to the different states. And we've, as of Saturday at some sometime in the afternoon, Colorado had, I think it was about 12,000 people who had already been vaccinated. So it's out there, you know, mostly hospital workers, but, you know, give it another month or two and it's going to be a lot of people you know who are vaccinated.

And hopefully that starts to bring us back to a normal situation by what, maybe February, March, April, sometime somewhere in that timeframe. Yeah. Hopefully the sooner the better, but I think as long as we can sometime in 2021 get together in person, that will be a good thing. Yeah, we'll make sure we have a nice party, uh, when we get there. Definitely.

All right, well, that's it for this year. We'll see you in 2021, and, uh, hopefully everyone's having— celebrating safely. Make sure you, you do not drink and walk back to your room. Um, that would be dangerous. Or at least watch out for the stairs.

Watch out for the stairs. Yeah, don't trip on the dog on the way back from the party. Right, exactly. All right, thanks, Alex. Appreciate all your time.

You too. Thanks, Robb. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado equals security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.