Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 151 for the week of February 10th, 2020. Alex, we got some snow.

We did get some snow. It's a winter wonderland, Robb. Yeah, I got to do some, some shoveling. My kids got to do some shoveling. They complained a little bit more than I did.

Just a little bit. Just a little bit. Yeah. Yeah. Snow days on this in this past week for some schools, so kids were happy.

It's like it's winter or something. I had one kid who was super happy and one kid who was really disappointed. Oh yeah? Yeah. You know, everyone so not everyone loves snow days equally.

We'll say that. That's true. That's true. Hey, you know we have some housekeeping. Why don't we talk about our Slack channel?

We have a a great community out there you can talk to. It is a very vibrant community this week. Lots of conversation. If you want to get joined into the Slack community, you can go out to colorado-security.com and go near the bottom for the— or actually near the top for the Slack button. We also have a mailing list.

If you want to be the first to know about a new episode, get the show notes in your email, go to the website colorado-security.com, put your email in there, you will be added to the list to receive those mails every week. And if you also want to receive the podcast, you can go out and subscribe on your favorite podcast listening app. We'd love it if you would rate us out on that app as well. Ratings apparently help us find people. This is what other podcast people tell me, so I assume that they're telling the truth.

So I'll tell you to do that for us too. If you don't want to tell people by rating us, you can just tell them directly. Please go out, find some people who might be interested or people who are not interested and just tell them about Colorado Equal Security, all the great stuff that's going on here. It might be the more secure way to refer us, right? Yeah, maybe.

Yeah. More anonymous, at least private. We also would love it if you want to support us. We have a Patreon campaign. This is a way for you to help financially support the show.

So Alex and I are not shoving out too much money for this. We are— a big thanks to our current patrons. You guys have been awesome and we, we definitely appreciate what you do. And for those who do support us, you'll get a gift based on the level you go at. So take a look at the, at the Patreon page and you can see what free swag you can get.

And finally, we would love to have folks step up and volunteer to be interviewers for the podcast. We are happy to help hook you up with people who might want to be interviewed and give you some pointers on getting those interviews done. But it is tough for Robb and I to, to get to all the wonderful people in Colorado to interview them. So having that help is great. We're trying to rectify that a little bit, but still need some interview volunteers.

All right. I do— we do have a new patron this week, a new supporter out there. James Westbrook has supported us. Thanks so much to James. We appreciate you doing that for us.

James, at the $10 level, gets the shout out on the show, which is this right here. And he also got— I think you got the first Colorado Equal Security new logo shirts other than me and you. That is awesome. Yeah. So congratulations to James and congratulations on the new job.

Hopefully that goes well over there. So let's jump into the news. Robb, it's interesting when we get to talk about national news in a Colorado context. Usually that means something went badly. And this is no exception to that.

This is no exception to that. The problematic mobile app that was used in the Iowa— in Iowa's Democratic caucus was produced by a firm here in Colorado. Yeah, so for those who don't follow any national political news, this last week was the Iowa caucuses, which is their way of choosing a presidential candidate from each party, and the Democrats' caucus did not go super well. They decided to, you know, go through the digital transformation process and bring their election process into the digital world, and as they did it, they engaged with a company that would allow the precinct what do they call them, like precinct heads, commanders to send their results into the central group. And apparently that app did not work very well.

Yeah, this seems like it's a good idea in principle, right? You know, make the reporting easier. They were actually collecting more pieces of data than they did in the past so they could have a better idea of how the caucus process went. But it seems like with most technology projects, they did not plan correctly, did not do appropriate testing. And things kind of fell apart.

And what does that have to do with Colorado? So glad you asked, Robb. Shadow, which is the company that produced the app, is, is based here in Colorado. That's fantastic. So Colorado is putting out the low quality— so there was also some reviews here of, of the security of this by Veracode after the fact, and apparently not, not good.

I can imagine. I'd heard that they had run out of time, and so instead of being able to push the app to the App Store, they had to have people sideload the app onto their phones. And yeah, yeah, just all bad news all around. Not good. And you know, that it doesn't surprise me too much that a technical, you know, project like this didn't go well.

What's really disappointing is the way that the, uh, the Iowa Democrat Party, um, kind of covered up in advance. They're saying, oh, we had world-class security people review this. We don't wanna tell you who it is because that would be a security concern. Right. We don't wanna show you what the app is cuz that's a security concern.

They just tried to, tried to hide all the facts. So of course when it goes live and it's a train wreck, um, you know, they, they, they just look really bad. So bad choices. I, I wish people would learn that transparency's gonna get you a lot further than trying to hide it. Yeah.

I also read that they did not want to provide the app to precinct captains, um, early because they didn't want the chance for it to be out there. And for people to be able to hack it. So it's security by obscurity, which again, we know never works. So, so this company Shadow here, here in town apparently had sold to Iowa and they had also sold to Nevada. And after this debacle, Nevada has canceled their order and they will not be using the app.

That's awesome. Nevada is not usually known for good choices. Well, you know, they do love a gamble out there. They do love a gamble. All right.

Next story we have is the, the Gaylord Rockies, which is, you know, that huge resort over by DIA. They, you know, they've only been here for a couple of years and they're already expanding the resort. Yeah, not even a couple of years, Robb. They opened a year ago and they're already adding several hundred new rooms to the hotel, just over 300 new rooms. Yeah.

As of today, it's already the largest hotel in Colorado at 1,501 rooms. And they're going to be at 1,818 when the expansion completes in 2022. Pretty cool. I also read that they have about 1.2 million room reservations on the books. Yeah, those are the upcoming group reservations.

Their CEO had a statement in the, in this news article that said that they have already exceeded expectations for the property in the first year of operations. And as a result, they just need more room. So pretty awesome. It's, you know, I don't know if you've been, I think you have been out there. I've been out there a couple times.

Yep. Pretty cool. It's a huge facility. It's a I can't believe that they're going to make it another, what, 30% bigger, right? So that's pretty great.

Yeah, definitely cool. Next article, Maxar Technologies wins a $142 million NASA contract to demonstrate construction robotics in space. So Maxar is the new name for what was formerly known as Digital Globe. We've talked about them on the show a few times in the past. This is pretty interesting.

What they're going to be doing is they're going to build a 16-foot robotic arm that's going to be attached to a satellite. It's going to be designed to refuel and repair satellites in orbit. Kind of amazing, right? That does sound pretty cool. Yeah, this is the kind of thing that we thought we'd be doing in 2020 when we talked about it in like 20— in 1980.

Right. It also sounds like, you know, some kid's Lego project that they're making an arm on something that'll, you know, refuel things in space. And it's not like we're talking about something being done in the year 2030 or something, like the electric charging that's going to be at all the truck stations around the country. This is actually gonna be done in 2023. So just, you know, just a few years away before we actually have this guy out in space.

Pretty cool. Pretty cool. Congratulations to Maxar. Another local corporate piece of news. We've been talking about the saga around Zayo and maybe them getting bought by one company, and then they finally get bought by another.

Well, the recent acquisition of them by a private equity firm has received FCC approval, so it will go through. Yeah, congratulations to them. Uh, this is a $14.3 billion buyout, uh, to make them private again. That works out to about $35 per share. Uh, there was a previous buyout attempt by a different group, and I believe that was around $30 a share.

So sounds like a better deal for investors. Yeah, it was interesting in the article it said It was 30 versus 35, but then the values were $14.3, whatever this is, versus $6 billion for the other one. Right. Which is confusing. It is.

Because that doesn't equal $30 a share unless we had some kind of a split going on or whatever in there. Some odd math. Anyway, interesting math. Anyway, moving on to our next story. The SEC has cleared Riot Blockchain after nearly 2 years of investigation.

Alex, we've talked about this, I think, a couple of times on the show. Yeah, lucky for us, Robb, we've been doing this for 3 years so we can follow an entire SEC investigation from start to finish. So Riot, previously they had a different name, Bioptix. They were a medical device company and then sort of overnight they decided, hey, let's, let's throw away that medical device stuff. Let's start doing blockchain.

And that process was strange enough, right? Right. But then their stock price went from $8 all the way to $46 and then right back down to $7.30. Right. And I think when that kind of a spike happens, that's when the SEC kind of perks up and says, let me go figure out what happened over there.

Something strange is going on here. And of course, they did that during the time when you could put the blockchain in the name of anything and immediately people were very keen on it. So I think you were going by Alex Blockchain Wood for that. I still do, Robb, but now, now my share price is back down to $7. Yeah, you got the big raise, and fortunately for you, they didn't, uh, they didn't take that raise away.

Anyway, uh, so for, for Riot, you know, good news for them. It looks like no one's getting a fine or thrown in jail for what happened here. Um, it does still seem awfully strange, and if anyone knows someone at Riot Blockchain, maybe we should talk to them on the show, you know, make an intro. And well, we'd love to figure out how you go from medical device manufacturer to, to blockchain experts, uh, cryptocurrency experts. That'd be interesting to know.

Even better, if you want to interview somebody at Riot Blockchain and put that on the show, we would love that. Uh, next, there was an article in the Colorado Sun, very in-depth, uh, talking about how SamSam ransomware took down CDOT and how the state fought back twice. Oh, twice. Yeah. Uh, so was it last week, 2 weeks ago?

Debbi Blyth spoke at a Regis University security event and really told the story of SamSam. We've had her talk about it. We actually interviewed her at RMISC last year and she gave that story. We've had We've talked about it a couple of times on the podcast. This was maybe the most in-depth coverage I've seen of the Samsun event.

And I pulled out one nugget that was especially interesting to me was they actually added up the costs of the event, the direct costs, and it was about $1.7 million in overtime, meals, and equipment. Yeah, I assume it was like $1.6 million in meals and then the overtime equipment was the rest because they did have some fancy meals during that. That's a joke. I'm sure they had very reasonable meals. Yeah, you know, only Little Caesars pizzas, you know, so that doesn't quite add up to $1.6 million.

The— there was also a little bit of talk in the article about Regis and the ransomware attack that they had. This was part of this data was gathered as part of the Regis Cybersecurity Conference. They were talking about both there. And And a little bit of, uh, of contrast there between the response that CDOT had versus the response that Regis had. Well, they, I mean, one obvious one is they were both ransomware, but CDOT didn't pay and Regis did.

Um, CDOT, uh, they, I know they were able to get a whole lot more resources on the, on the situation. Yeah. They brought in a lot of different vendors. Uh, really interesting. Those are, and the National Guard comparing contrast.

Yeah. A lot of different, a lot of different resources they were able to pull in. Colorado National Guard, right? Yep. Yeah, so definitely check it out.

It's a great in-depth article on that whole process. All right, our next article is Ping Identity's press release showing the 2019 Partners of the Year. So every year at Ping's sales kickoff event, which was last week or 2 weeks ago, I can't remember, they recognize the partners who really helped Ping be successful in the year. And in 2019, they identified 6 partners. So delivery partner of the— excuse me, channel partner of the year was Optiv.

Local hometown Optiv. Congrats. Congrats to them. The Delivery Partner of the Year is ProofID, which is, is sort of kind of local because, uh, ProofID was a UK company that bought a Colorado Springs company called, um, called Pegwright, which I think we've talked about on the show. Um, so that's kind of a little bit close to home as well.

Technical Partner of the Year is CyberArk. I think that's because, uh, sorry, that's the Technical Alliance Partner of the Year. Ping and CyberArk, uh, go into deals together where, you know, CyberArk will do the privileged identity management and Ping will do the rest. Um, the breakthrough— they also had a new category here this year called the Breakthrough Partner of the Year, which are those who have had a great 2019 but, you know, they weren't the top but really came up the stack a lot. So for the channel group, that was Identropy, which I think is a more East Coast-based partner.

Uh, the Delivery Partner of the Year is CTI Global, and the Uh, the Technical Alliance Breakthrough Partner of the Year was Iovation, which does like risk engines and stuff kind of tied in with Ping. So you can use the risk stuff to make your access decisions. I like to have a nice engine to drive my risk, Robb. Um, next, uh, there was a Red Canary article from Katie Nichols, uh, talking about a preview of her 2020 RSA talk. Uh, the talk is going to be about attribution And she gives a little preview here about what sort of things you can think about in terms of attribution.

So there's what, there's 5 whys in journalism? How many of those whys matter for attribution, Alex? Well, according to this article, Robb, it is 2. It is really the who and the how, and not necessarily both of them, but in some cases one or the other really makes sense in terms of attribution. Yeah, well, it's an interesting article.

I know that attribution is a little bit of a controversial subject for us. Do we care? How much do we care? Can you trust it? It's never simple.

To attribute a cyberattack back to the people who did it, but interesting enough to know, and certainly looking forward to seeing Katie's talk at RSA conference. Definitely. All right. So our next— this is actually— we broke this news last week, and, you know, the mainstream media is now catching up to us about Automox raising their B round with that $30 million investment. Yeah.

Congratulations again to them. This brings their total funding to $42 million. They did note that they are adding a second physical location, but still in Boulder, and they've got 80 folks there, but I'm sure they're gonna be hiring some more. And this company was founded in 2015, so it looks like a pretty good pace, right? They've had 2 rounds in 5 years.

They're not burning through their cash too fast. Hopefully they can, they can make a really good return on this next round of investment. Next, there was an announcement for a partnership between Dark Owl and CyberQ. So Dark Owl, as you know, is the local company that does dark web intelligence. They scour the internet for all sorts of different things that, that you might want to know.

And, and CyberQ, they monitor and analyze darknet communities on behalf of their clients. Yeah, I didn't, I didn't know CyberQ. Coming into this, I, I had no idea what the partnership would be like. But what as for reading it, it looks to me like CyberQ actually has a pretty good customer base of enterprises that, that pay CyberQ to do monitoring of the dark web. And my guess is, from the way this is written, that they have a lot of manual processes to do that, and that they're going to be able to use DarkOwl to do— to automate and really get better coverage for the, the monitoring of intelligence than they were previously.

That's obviously— I know DarkOwl, that technology has been you know, what, decade in the making. So it's nice to see that that's getting some traction and hopefully helps them reach some new success. Definitely. And then finally, we have an award ceremony that— or I guess not ceremony quite yet, but some awards that are in the process of being voted on. The Tech Trailblazers, Cody Cornell from Swimlane is nominated for CEO in that category.

Yeah, that's pretty, pretty awesome. Cody, you know, is the, the CEO and founder over at Swimlane. He's been on the show once or twice. Really cool to see that he's being recognized in this national or maybe even global competition. I did notice on these awards there was one other Colorado company called out in the, in the mobile Trailblazers group, which is Valiant.

And I don't know Valiant, but pretty cool to see that Colorado is making the list in a couple of different places. Not only is it Valiant, Robb, it's Valiant AI. You can't forget the AI part. Why? Maybe I need some technology to help me remember that in the future.

Well, congratulations to Cody. We're looking forward to seeing the results here. And, you know, it's an honor just to be nominated, but hopefully he takes down the hardware as well. Awesome. That award also is still open, the voting.

So if you want to vote for Cody, you can go out there and do that. The link is in the show notes. All right. That is it for news. We're going to go ahead and jump over to the Slack message of the week.

Big thanks to Andre Gaeta, who is the sponsor of this. Uh, we appreciate what you do there very much, Andre. Uh, this week's winner is Joe McCallister. Congratulations, Joe. Uh, he posted a, um, an article about Darktrace, uh, which spawned quite a nice discussion around that.

Yeah, Darktrace is, is one of those technologies that I don't think any of us know exactly what they do. They do some network behavioral, uh, anomaly detection, um, really kind of your perimeter monitoring, I think. Um, and, and so that was you know, what one of Joe's favorite vendors, it sounds like. And some of us who didn't know much about it were asking questions. We definitely appreciate that conversation.

Joe, thanks for doing that. And of course, you'll get to pick one of the new Colorado Equal Security logo items from the store. Yeah. Speaking of that, Robb, there are new Colorado Equal Security logo items in the Colorado Equal Security store. Do you have any favorites?

You know, all the sort of standards are there. Yeah, just about anything you can think of. Coffee mugs and t-shirts and other apparel, license plate holders, all kinds of things, Robb. Do we have a Colorado Equal Security skateboard in the store? Oh, I'm not sure if we do.

But if one had their own skateboard and wanted to apply a sticker, we could handle that, right? Yeah, you could definitely get a sticker to put on your skateboard. So really, with the stickers, you can make anything be Colorado Equal Security. Very, very true. I've been thinking about making Alex's new car, a Colorado Equal Security car with 7 or 8 of those stickers strategically placed.

But lawsuits, you know, maybe you don't need that. All right, let's move on to events. First, before we get into the next couple weeks, SnowFROC, OWASP Denver's annual conference, has tickets on sale. So SnowFROC is March 5th, and the tickets are on sale now. Go out and check those out.

And sign up for a great conference. That'd be awesome. I think that they still have their CFP open. At least take a look and see if they do. I know that RMISC still has their CFP open, but it's only open for the rest of this week.

I think it closes on Friday, right? Yeah, I think you are correct. So if you've been thinking about talking at a local security event, this is your chance to put in your talk. I will say that I think in both places, and I know in RMISC's case, there's a pretty strong bias toward local speakers. So if you have something you've been thinking about talking about, signed up and we'll hopefully get you in the, in the lineup.

Definitely. All right, uh, first on the event calendar, Graylog, um, has a Graylog Community Denver meetup on the 10th. On the 11th, SecureSet is doing an intro to Wi-Fi. On the 11th and 12th, ISSA Denver is doing their February chapter meeting. On the 13th, ACES, which is the local physical security group, is doing a Confronting Hate and Violent Extremism in the US event.

Also on the 13th, the Northern Colorado ISSA chapter up in Fort Collins is doing their February chapter meeting. On the 14th, the CTA. If you know, if you're thinking Valentine's Day, what would be more romantic than going to a CTA event? Well, there's good news for you. You can level up your tech career listening.

It teaches— this is going to teach you listening intelligence for leaders. Also, if you and your partner are very geeky, The NCC down in Colorado Springs is doing a capture the flag on the 14th. On the 18th, the Cloud Security Alliance is doing their February chapter meeting. Also on the 18th, Emerging Tech Fan is doing a co-event with IoT Colorado. On the 18th and 19th, ISSA Colorado Springs is doing their February chapter meetings.

That's the dinner on the Tuesday and lunch on the Wednesday. Also on the 19th, DenSec is doing their February meetup. On the 19th as well, ISSA Denver has their Women in Security special interest group. This is always popular, and I'm sure it's not just for women. Anyone who wants to support women in security is encouraged to go.

On the 20th, the IAPP Denver KnowledgeNet is doing Mr. Young AI, a case study in designing for privacy. Also on the 20th, there's a— this is— I was actually telling you in IMs earlier, like, this is the busiest 2 weeks I think we've ever had. There's a lot of events. There's a lot of events. We're going to keep going here for a while.

Uh, also on the 20th, ISACA Denver is doing their February chapter meeting. Um, also on the 20th, ISSA Denver is doing a privacy special interest group. On the 21st, SecureSet is doing a capture the flag for beginners. On the 22nd, ISSA Colorado Springs is doing one of their mini seminars. And that is it.

That's it for the next 2 weeks. Yeah, I know, it was more than one event per week. I think it's almost 2. So a lot of stuff going on. Hopefully you guys can get plugged in with a group that's relevant to you.

Why don't we go ahead and jump over to jobs? You know, as you know, we every week try and capture, you know, 10, a variety of different jobs around the community here. You know, not just leadership or not just entry-level ones. We try and get a gamut of stuff here and we try to get all of the Ping Identity security jobs as well as a variety of jobs at Ping Identity. Yeah.

And I do have a variety of jobs that I'm hiring at Ping right now. I'm hiring a GRC analyst. Analyst focused on business continuity and incident response. I'm hiring a product security engineer, and I'm also hiring a senior infrastructure security analyst. And those, those kind of, uh, are the 3 main teams under security at Ping: infrastructure, product, and GRC.

We're hiring one of each, so we'd love to hear from you. Zoll is looking for a director of security and risk management. Vail Resorts is hiring a senior manager of infrastructure— or excuse me, information security operations. American Financing is looking for an information security officer. Invoca is hiring an information security engineer.

TrackVIA is looking for a cloud security engineer. Ernst Young, or EY, is hiring an enterprise technology IT risk manager. You know, I think it may actually technically be EY these days. I think you're right. I think they changed it.

Kind of like KFC is no longer Kentucky Fried Chicken. Right. Not because of the rumor that That you're not allowed to call it actually chicken. That's a rumor. Not true at all.

No, 100% true. Totally true. No, just kidding. You're gonna get yourself sued, Alex. And Automox, who has a bunch of money now, is looking for a cloud security engineer.

I think you can negotiate strong. Say you want, you know, $4 million a year. They got funding to cover to cover it. I would like all of that $30 million, please. I wouldn't do that.

Well, that is it for the podcast this week, Alex. Anything before we tell people to? Go be good and not get breached? Uh, be good, don't get breached. Uh, awesome.

All right, everyone have a great week. Fight the good fight. Thanks, Robb. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado equals security. Reach out to Alex and Robb by emailing info at colorado-security.com.

Until next time, remember, Colorado equals security.