Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 156 for the week of Armageddon. Alex, how are things going on your side of the world?

Well, you know, the world has not ended yet, Robb. We're getting closer, but, um, still still teetering. Yeah, I was, I was thinking that we should do the newscast and then I heard that it got shut down. Someone canceled us. But then, you know what?

Let's just do it anyway. We're gonna do it anyway. Screw those, those people and getting groups together. We're gonna, we're gonna get our large group of 2 people together and record this podcast anyway. The governor has banned all meetings of people over 2 or of over 250 people together.

Correct. So if you're listening to this with more than 248 other people, This is illegal. I was supposed to go see the SpongeBob SquarePants musical at the Performing Arts Center, and that was canceled, sadly. So this is not— it's not all bad. This whole, this whole thing has had some positive sides.

It's supposed to be a good show. I don't know. I'll never know. So for anyone who's not aware, there is actually an illness that's running around the world right now. I believe it's a virus.

Actually, it's a virus. It's a, it's a Coronavirus, which is one of a series, a family of kind of like the common, the common cold is part of the coronavirus family, right? You know, this one's really bad though. You know, Robb, I've heard that you can get this virus by drinking Corona beer. Is that true?

I'm confident that that is not true. And if anyone from Corona is listening, that was Alex Wood. I've also heard that you shouldn't eat Chinese food. Is that true, Robb? I actually had Chinese food for lunch today.

Oh, do you have the coronavirus? You're here, so I guess we'll find out soon. Talk to me in 14 days, Robb. Hey, let's stop talking about that. This is, this is really depressing.

Uh, we do have, uh, some housekeeping, uh, Slack channel, blah, blah. Doesn't really matter, Robb. The world is ending. Join the new— let's just give it up. Join the mailing list, blah, blah.

Uh, so we do have a Slack channel. Uh, it's great. You should go there. There's lots of people talking about things including coronavirus and lots of things that are not coronavirus. You can, you can find how to join that on colorado-security.com.

There's a join the Slack channel button. Where there's also a mailing list. If you sign up for the mailing list, you will get the show notes delivered to you in your email every week until the world ends. Rate us and subscribe on your favorite podcast listening application. We would love it if you'd say nice things about us.

But you know, if you say something bad about us, we can live with that too. Also, please tell a friend as long as they're still from 6 feet or further. Yes, you can, you can talk to them about it. But please don't do it. No, do any touching or anything like that while you're telling them.

Or, you know, electronically tell them however you want to do it. Also, if you'd like to contribute, we would love to have you contribute to our Patreon campaign, help cover the costs for the podcast and all the other things we do at Colorado Equal Security. One other thing you could do to help if you want to help do interviews for the show. We've had a number of guest interviewers on the show lately, and we really do appreciate their help. We have another guest interviewer this week.

And so if you're interested in doing that, reach out to us either on the Slack channel or at info@colorado-security.com. Speaking of Patreon, Robb. Yes. We had a new patron this week. What?

Yes. Lauren Barrett. Barnett. Same difference. You know, it's not the same.

Lauren Barnett is a wonderful man who works for Mimecast here in town. And, you know, he's helping support the podcast. I appreciate that. Lauren, at the $10 level, he gets a shout out with his correct name and his incorrect name. And he also also get a Colorado Equal Security t-shirt with the new logo.

I would like to apologize to Lauren, and I would also like to say that we appreciate your support. Thank you for your contribution. We look forward to giving you your t-shirt. Awesome. We do appreciate it.

Why don't we go ahead and jump into the news? Strangely enough, there's actually a little bit of news that's about coronavirus, or COVID-19 as it should be called. COVID-19, which is in the coronavirus family. So there were 35 Colorado tech leaders who signed a statement saying these are things that we should do to help spread or to help stop the spread of the coronavirus. Yeah, this is pretty cool.

And what was so shocking to me was how quickly this whole thing came together. So at 8:30 on Friday morning, the CEO from Ibotta, right? CEO from Ibotta reached out to his network of other local tech CEOs and said, hey, I think we all need to make a stand together on how we're gonna help stop the spread of this here in Denver. And they very quickly came up with their statement. Yeah, and it was, uh, I don't wanna say there's anything, uh, earth-shattering or groundbreaking here, you know, things like, uh, working from home, uh, limiting contact to people, all those sort of standard things.

But I think that it's important that they, they said this and, and emphasized it to make sure that people are taking this seriously. Yeah, and really the goal, of course, is to flatten the curve. Uh, if I'm sure lots of folks have heard this, if you haven't yet, just go look at, look up flattening the curve for coronavirus and that will give you the guidance for why they're doing these steps. I think it's great to see many of the companies that we know here in town as a part of this. Yes.

Including, uh, StackHawk, CyberGRX, um, and then a few other, uh, security and local technology companies as well. Yeah. 35 total. Pretty awesome stuff. I'm glad to see those guys taking the leadership for the, for the whole area.

Next, we have a story speaking of COVID-19 around the attorney general really trying to get in front of price gouging, even though Colorado doesn't actually have a law against it. Yeah, I thought that was actually the most interesting part of this article, Robb. I guess I hadn't realized that there was no anti-price gouging law in Colorado. Well, that's why you can spend $100 per sheet of toilet paper right now. Right.

Because there's no law stopping it. So now we know why there is a run on toilet paper, because people want to sell it for more than it's worth. So there apparently many states do have price gouging laws. In Colorado, we do not. But our attorney general says he wants to have any of these occasions of price gouging brought to his attention so he can take appropriate actions on it anyway.

Yeah, it sounds like there are some other laws that are not exactly price gouging laws that they may be able to prosecute people under in any case. Next, there are some tech CEOs that were on a panel talking about why it is that they were expanding in Denver. So we had the CEO of Scoopus, which is a marketing analytics company for convenience stores, the CEO of Evolve Vacation Rental Networks, who I guess does rental network stuff, and the CEO of Four Winds Interactive, and they do the digital signage. And all 3 of them were talking about why they came to Denver and really what they look for in terms of the talent they're trying to hire here in town. Yeah.

Again, I don't think there is anything particularly shocking here. These are similar things that we've heard from other articles about the talent pool and the reasons why people want to live in Colorado in general. One thing that I did think was interesting is that one of the CEOs said that it's 45% less expensive to run a business in Colorado than in the Bay Area. It's cool to see a number. I don't know if that's a, you know, random gut feel number or if there's some data behind that.

But still, it's pretty cool to see that number. There was another thing that I think was a theme in the, in the panel, which isn't quite as good news, which is that they were having a hard time finding the technical talent here in town. They were much happier with the non-technical hires they'd have. And, you know, it's just hard to find technical talent just about anywhere right now, unfortunately. Indeed.

All right. Next story we have is around Sophia Genetics and why Sophia Genetics chose Colorado to build its 100-person R&D hub. Speaking of of companies coming to Colorado for talent. Yeah. And I was thinking, you know, the name Sophia Genetics, I was, you know, imagining a female founder.

And, and then you open up the article and there's the picture of the founder who is clearly not very beardy. Yes. He has a lot of hair. One shaggy dude. A lot of beard.

And, you know, in here they were talking about why it is that they were expanding to Colorado. Um, they have a— their US headquarters in Boston, but they wanted to have a, uh, an R&D hub, and they wanted that somewhere, you know, more central in the US to serve more US customers easily. And what— we beat out Texas, and I can't remember what the other spot was. I don't know, but screw you, Austin. Well, good for us.

Um, anyway, they're a biotech firm. A lot of— there's a lot of good biotech companies here in town, so it makes sense that that we won this one here as well. So good for us. Yeah, one of the things I thought was interesting also is that usually when you hear these, that someone is coming and putting their, their office in Denver, they're actually going to be in Aurora, which, you know, when you think about it, makes sense. They're going into the, the biotech campus that is down by Lowry.

Fantastic. All right, next story we have is— it feels like we just talked about them recently. We have another story about Misty Robotics and kind of what is the next stage of their company look like? Yeah, we had talked about, um, recently how they were— they had the, the robot that could be a check-in at, um, uh, hotels, hotel or other businesses like that. And, uh, and now they have multiple flavors of this type of robot that you can use.

It sounds to me like they just, you know, made a more basic edition that's a little bit cheaper, fewer, uh, features to get some folks in the door for you know, some other potential applications. Well, I love to see the progress here. I do think that most of our jobs will be robots eventually, and hopefully that means we can spend more time on the beach while the robots make us our money. Is that how it's gonna work? Yeah, exactly.

You know, this coming week is when that starts, Robb. Since everyone's gonna be working from home, we are now starting our beach vacations where we're gonna do our work. I don't think you can go to the beach right now. The beach is not safe. I heard it's closed.

Speech. Oh, okay. All right. Boo. Uh, next, uh, there was a blog post by Zvilo, uh, talking about a recap of SnowFROC 2020.

So SnowFROC, we've been talking about it on the show for the last couple of months, right? SnowFROC is the big OWASP annual conference. Um, I did not get to make it this year, so I was really excited to see a write-up about the show. Yeah. Also, uh, congratulations to SnowFROC for slipping right under the wire and having your conference right before everything gets banned.

Yeah, they, uh, and I think they were close enough that I was kind of wondering, oh, I wonder if they're gonna have to cancel. They didn't. It looks like it was pulled off well. Um, and now, you know, the rest of us are now stuck at home. Um, so interesting, uh, story.

I don't know how much you got to read, but, uh, we do have a couple of, of the sessions that they called out, including, uh, threat hunting on active countermeasures, um, and about how to patch production. Just a couple of interesting, uh, sessions that were called out, and it's it's great to get to know what was talked about at the show. Definitely. So if you couldn't make it, check out the blog, or even if you could and wanted a recap. Next, there was a blog post by Mary Writz.

Mary, of course, has done some guest interviews for us. Last year, she did a series of interviews with female security leaders, and she wrote this blog post entitled Take My Daughter to Work Days. It's not necessarily directly about her taking her daughter to work, but it's about being a woman in security and ways that we can make security more friendly for women. I love it when we get a list of actionable things, and she did a good job in the show— or excuse me, in the blog doing that. Number 1 on her list is inclusive networking.

Be more inclusive and find ways to do networking that includes women as a part of it. Also, making space for women. Uh, sometimes, you know, I think it gets overlooked, uh, space for, uh, whether it's, uh, breastfeeding or pumping or other things that, uh, that you may not have a normal space for. Uh, the third is empathy and really to, to give women and really everyone, I'm sure, uh, the emotional space needed to open up about what they needed and make a space that will be effective for them. And then the final one was about setting an example.

You know, she gives an example here of, of being a mother and having a young daughter and, you know, doing the things that she thinks people should do to show that it's all right to say, you know, take your daughter to a dinner or something like that. Yeah, that's awesome. All right, thanks, Mary, for writing that. We certainly need a lot more women in security. Moving to our next story, Ping Identity had a blog this week.

It's about work from home, how to keep employees productive and secure. Obviously timely considering what's going on in the market right now and a lot of companies sending their employees to work from home, including Ping. Um, they— this, this article just has a few tips for how to do it. Um, really thinking about, uh, how do you, how do you reduce passwords, getting MFA on those resources, trying to move away from just using a VPN as a choke point. Um, some good stuff on there examining your, your BYOD strategy.

So you guys might want to take a look at that. Yeah, perfect. Uh, next we had a blog post from Chris Rothi at Red Canary talking about what F1 racing can teach us about telemetry. Alex, what can F1 racing teach us about telemetry? Well, so, uh, Chris makes some parallels between, uh, cybersecurity and auto racing here.

Um, I think in, uh, the big takeaway is that, you know, in both cases there's a whole lot of data. Uh, you don't really think about that in racing, but their, uh, race cars produce a whole lot of data and you need to be able to sift through that data and figure out how your race car is performing or not. Kind of like how you sift through the data to make sure your networks are being kept safe. So they don't have a NOC analyst reading every line from the logs from the race cars? Is that what you're telling me?

I'm sure that they have some guy in the pit who is looking at the matrix and picking out the one thing in the data scrolling by that they need for making the race car faster. Yeah, I think it's great anytime we can draw analogies from security to other interests. And of course, Chris did a good job doing that here. Final story here this week is it's a top 5 security tips for setting up a new device by Webroot. Yeah, and this is one of those articles that Webroot does that is aimed at sort of users, at, you know, your general user, not at your IT folks.

And these are, you know, 5 tips that you can do if you buy a new device. So you could pass this on to family or friends. Um, and it's, it's pretty good device or pretty good advice for your device. Yeah. Send this over to your, to your family.

Uh, so number 1 is to update software. First thing you do. Number 2, enable your firewall. Number 3, install antivirus. Number 4, back up.

And number 5, wipe your old device. Don't wipe your old device before the other steps. Right. That's a catastrophe. Uh, also you need to wipe your device so that it doesn't get coronavirus.

2 different kinds of wiping. Yes, both important. So that is it for the news. Why don't we move over, Robb, to the Slack Message of the Week? Sure.

Big thanks to Andre Gaeta. Andre is our sponsor for Slack Message of the Week every week. And as a result, we're able to pick one person who put it— who contributed something to the Slack channel that we want to point out and hopefully made our lives a little bit better. They get an item from the Colorado Equal Security Store worth $25. Uh, so Robb, who is our winner this week?

Mike Truss. Mike, uh, Mike had, uh, put a link in here. We had spent the whole week talking about COVID-19, uh, and Mike did a good job giving us a link to a joke of the day website to lighten the mood a little bit when I think we could use it. Um, I do have to say Robb does like bad jokes. So, um, anything that you do around bad jokes, there's a good possibility that that could win Slack Message of the Week.

There's a good possibility. I do love bad jokes. That's true. So congratulations to Mike. We'll get you hooked up with Andre.

Awesome. Let's go over to events. I would like to caveat our event section by saying these are events that we know of right now that are potentially happening. Since we are limiting people's gathering, it is very possible that any and all of these events will not happen. And maybe you shouldn't go to them even if they are happening, because we don't want you to go get infected.

Uh, so yeah, take that with a grain of salt. We will talk about what's happening here in the next couple of weeks though. Uh, first on the 18th, DenSec is doing their March meetup. On the 20th, uh, there's a couple of events scheduled. There's a lunch and learn.

Actually, I think that this just got moved virtual. There's a lunch and learn, um, for GDPR, CCPA, and the extreme importance of data protection today. Click the link to make sure it's happening. Uh, and then also on the 20th, SecureSet is doing a capture the flag for beginners. Yeah, I will say all of these events, if you go to the website, colorado-security.com, there is at the very least a link in the calendar invite so that you can get more information.

So I'd say definitely check those before you go to these events. On the 24th, there are 2 events. Emerging Tech Fan is doing their March meeting and CSA is doing their March meeting. On the 25th, ISC² Pikes Peak is doing their March chapter meeting. And also the 25th and 26th, the Colorado Springs area has their 7th annual ISSA Cyber Focus Day on the 26th.

You can, uh, soar with Swimlane at the DTC Tap and Burger. Yeah, go ahead, I'm not ready. Oh, okay. And then, uh, and then I think this is our final event, uh, DC303 is doing their March meeting on the 27th. Yep, awesome.

Let's go ahead and jump over into jobs. Uh, a lot of, a lot of jobs available at Ping. If you want to jump out to our career listings, I'll just call out the one we do have, a manager of security and compliance. And that person also does help with our privacy program. Holy cow, Robb.

Empower Retirement is hiring a director of security data science. That sounds like an awesome job. Yeah. Vail Resorts is hiring a network security engineer. Elastic is hiring an information security risk management analyst.

Pearson is hiring a cybersecurity risk and assurance analyst. Maxar is looking for a cybersecurity architect. DISH needs an information security business partner. Centura Health is looking for a security engineer. InteliSecure needs to hire a vulnerability management program lead.

And Twilio is looking for a senior IT internal auditor. Fantastic. Indeed. That is it for the end of our show this, this week. We do have an interview coming up here momentarily.

Alex, I know there will be no March Madness this year. I'm very sad. And, you know, instead of that, people can just come back here and listen to us again next week and maybe we'll give them the same quality entertainment they're looking for from a basketball tournament. I will say, even though there is no March Madness, we didn't talk about it as a story this week, but we've talked about it previously. There is the Tech March Madness that is still going on.

I think you can go out there and vote. Go back a couple of weeks in the show notes and you can find details about that. They haven't canceled as far as I know. They've got— there is no live audience, nothing in person here. So we can keep going.

All right, well, unlike your Denver Nuggets, your Colorado Avalanche, and just about everything else, we will not desert you. We will be here again next week. So listen to us in the privacy of your own home, not near anybody. All right, that's it. We'll talk to you again next week.

Thanks, Robb. Hi, this is Rich Schliep, the CISO for the Colorado Department of State. This is Colorado Equal Security for Colorado Security professionals by Colorado security professionals.

Colorado equals security. This is Jason Jaques, host of Emerging Tech Fan. This episode's conversation is with George Gerchow, the chief security officer for Sumologic. There's a lot going on in the world with COVID-19 right now, and we talked about that among other things. Here's the interview.

Enjoy, George. Thanks for being here, Jason. It's my pleasure. Been looking forward to this. Yeah, this is, uh, when we scheduled this interview, the world seemed normal.

The world does not seem normal anymore. So just as for the listeners of this, we are recording this on March 12th, 2020. What's going on with the world? So just reflecting, the last time I saw you, my biggest problem work-wise was FedRAMP. You know, and now the world has turned upside down.

You know, I've probably been working about 20 hours a day, my team as well too, for the last, you know, week or so because of COVID-19, you know, and the impact that it's had, you know, across the world. So it's been, it's been interesting. It changes by the minute. Yeah, it's been crazy. It's been a wild week.

I mean, yesterday was the day the NBA postponed their season. So a lot has— and every event and conference is pretty much canceled. People are being told not to shake hands. It's wild. It was an awkward moment even when I saw you.

It was like, OK, what do we do? Now, I opted to shake hands. But this is becoming a thing with social distancing, right? Like I was telling you, Jason, when I walked in, I had a guy yesterday that kind of stuck out his hand, kind of stuck out his elbow, and then ended up sticking out his foot and wanted to foot tap me. You know, but I, I'm, I'm trying to stay in the middle.

I, um, you know, obviously I'm just not a judgmental person. I try not to be. Um, but everyone's level of comfort with the social distancing is, is just different, and we got to respect it one way or another. Yeah, for sure. What are some of the things that, that, um, that you're doing to take kind of, uh, precautions?

Can you, can you, can we explore what you and your company are doing? Yeah, yeah, absolutely. I mean, I think the first thing is, and this is kind of like a lesson learned in reflection, we haven't been perfect. Is to move quickly. I'm finding that a lot of folks are being more subjective instead of prescriptive.

And I think just making decisions, getting information out there quickly is important. So for example, work-from-home type policies, are you gonna make it mandatory? Are you not gonna make it mandatory? If you do that, what's the impact to the business? Is your VPN ready to handle that kind of workload?

Are your Zoom or GoToMeetings or Citrix or whatever you wanna use, are they prepared to handle that? I mean, there's just so much behind it. Been incredible peeling back the onion and just living it on a daily basis, doing calls, you know. So like last night, yesterday, we did a 9:00 a.m. Pacific call for half of our leadership team and then one at 9:00 p.m. Pacific for the other half worldwide. And staying on top of the news regionally when you have a global company is just so hard to do, right?

You have shut down your office, right? So that's, that's one of the— everyone's being forced to work from home. How many people worked from home, I guess, to, uh, to begin with? Yeah, that, that's actually a really good question. It wasn't many, you know, so I'd probably say it was, you know, a company of about 1,000 people.

Um, I'd probably say it was somewhere between, you know, 80 to 100, mostly sales. But even the salespeople, which is a whole different challenge we can get into, are usually working out of like a WeWork-type building in like areas like New York or London. Um, so we have main buildings which we run and operate, but a lot of these are leased type facilities, you know? Yeah. And I'm assuming those facilities are staying open.

Which ones? For now, the WeWorks and— Oh man, we're pulling out of those because those— Oh, you are? Yeah, yeah, because look at it this way. We're responsible for our own facilities, okay? So who comes in, who comes out.

Um, one of the first steps that we did was, you know, of course in a world of software, you know, we're a little bit spoiled, um, but we have like catered type lunches. Where you lay food out and then people would serve themselves. Well, a few weeks ago, actually a while ago, we were like, eh, that's probably not a good idea. Let's have people serve people the food. So we could control things in that aspect, the cleanliness of the building, again, people checking in, checking out.

At a WeWork, you don't know what you don't know. You know, who's coming in, who's coming out, who's touching what, and it opens up. We have found that most of the people who've been potentially exposed at Sumo Logic has been in those types of facilities so far. Okay, I know the one thing that, uh, I've been aware of, I guess acutely aware of, is how often I touch my face. Totally.

I just did it. I mean, yeah, I mean, I do it constantly. I'm constantly rubbing my beard. Yeah, I don't know what to do. Yeah, I know.

And it's really gonna— it's gonna change the way that we do everything. I, I mean, I, I was telling Jason before I came in here, I went to the grocery store And for me, it was a simple shop. My son drinks Arizona green tea like it's going out of style. And we actually just needed about 8 rolls of toilet paper. But what I found was the way people were looking at each other, the way people were looking at merchandise, especially because usually when you pick up a piece of fruit, you want to touch it, right?

Because that's a lot of times you can base the selection off of color and touch. It's not happening anymore. And it's a highly paranoid type environment. And my sense is telling me that we're going to continue to go down this path. And there was no toilet paper, no hand sanitizer.

Are anywhere. It's, it's funny, I actually went to the grocery store yesterday and I was just doing kind of a regular shop and I turned the corner for the toilet paper aisle and I burst out laughing, like actually out loud, because the entire aisle was obliterated. There was, there was like nothing in that aisle, not even— there was only a few paper towels and it just, I don't know, it struck me as funny that people are Loading up on toilet paper. Why? I, I don't get it, you know, because for me, look, if I ever go down— and, and again, I could completely change in 24 hours.

I'm trying to live my life, okay? And I'm encouraging my children. I'm a father first. Like, if anyone ever describes what kind of person are you, I'm a father first. So we're trying to live our lives, um, and I'm one of those people too that usually goes to the grocery store and has my groceries pre-ordered and they bring it to my car.

That's just out of pure laziness and saving time. But I just needed to go in and get a couple of things. But I don't get that one. What about non-perishable goods? Beef jerky, canned Like if I ever go down this path, that's what I would do.

Very similar to what people did, you know, Y2K-wise. And yes, I just described how old I am. Yeah, no, it's a wild time. When do you think we'll get out of this? I think we're at the very beginning of this.

You know, just a couple days ago when you looked at the fact that we've only done 5,000 tests total in the US versus China doing 10,000 a day to get out in front of this, this is the very beginning. Since, since I got in my car this morning, the NHL shut down. Yeah, NCAA regional tournaments all shut down. PGA Golf Tour pulled everyone off of the course as far as fans attending. So things are just changing so rapidly and by the minute that I, I think we're just at the very beginning of this, right?

I do too. I think it's going to be interesting to see where, uh, where things go, probably 2 or 3 months from now, hopefully we get back to normal. Yeah, you know, I'll tell you where my heart really goes out. We're lucky, you know, you and I and people in our industry, you know, in tech, we're so lucky because we can get a lot done virtually, right? But when you think about people who cannot, you know, mechanics for example, people who are working at the grocery store, people who are pilots and flight attendants, which, you know, I usually travel quite a bit, those people really aren't going to have a choice.

So it's going to be a tremendous impact on our economy. And a tremendous impact on families, which is just absolutely heartbreaking to me besides the disease itself. Yeah. Do you think there's gonna be some companies that don't survive this downturn over the next couple of months? I do.

And I also say this too, any company who doesn't put people first, they're gonna be the ones that really suffer from this, you know, because my gut is telling me that there's still a lot of old-school type industries out there that are forcing people into the office, that are acting like this is gonna go away. And again, it doesn't matter if you're on the far right or far left, it just— you should be prepared for any kind of scenario. And this is exactly what happened to us. We saw what was happening in China and we said, eh, it'll never come over here, we'll stop travel over there, that'll solve the problem. Just being in security alone, you always solve problems within, you know.

Uh, back when I was coming up in this industry, everything was all about perimeter-based security, right? If you secure your perimeter, you're going to be be just fine. It's proven time and time again that that just doesn't work. You've got to start great security hygiene from within. And it's the same thing with something like this, with some kind of virus or outbreak like that.

Control what you can from within, and it doesn't matter what comes from the outside. I mean, to me, that just seems to make sense. Yeah, that makes sense to me as well. I just don't think a lot of companies or people are prepared for, uh, for a pandemic. Yeah, they're not.

And then, you know, I think the way that people behave. So for example, I don't know if you saw this or not. And by the way, Rudy Gobert, who's the basketball player that tested positive, I'm a huge basketball fan. You know, my son is a basketball player. We go to Nuggets games religiously.

You know, anyone at Sumo or anyone who knows me will tell you we're just Nuggets fanatics. This poor guy, 3 days ago, and this is how careful you have to be. I don't know if you saw or not, but he did an interview and he started rubbing the mics afterwards as a joke. This guy's a good guy, but he was just making a joke like I would, like you would, and people who don't know him, people who don't know the sport, are absolutely crucifying this guy today. So you've gotta kinda be careful with what you say and what you do, and especially when you're a leader.

So our CEO did a great job, Ramin Sayre, earlier this week of saying, hey, I'd like to see any jokes about this cut down, because it's gonna make people panic and it's gonna be used against you at some point. Even RSA, think about this, how crazy it is that when you and I met in person in Casa, Rock. It was right before RSA, and you were like, hey dude, are you going? I'm like, yeah, I'm going. And I went, and then look at all the stuff that's happened since and what happened at that conference with people getting exposed and actually being confirmed that they have COVID-19.

Yeah, yeah, we didn't see that coming, or at least we didn't hope that that was going to be the, the outcome of that. Yeah, and then you look at even here in our great state of Colorado what's going on with CTA, you know, like having to move back that event, which I applaud those folks, you know. I think think Franny did a great job of making that call. You just don't want to put people in an uncomfortable situation until we know more, until there's more test kits, and then eventually, hopefully, there's going to be a vaccination out there as well. Yeah, yeah.

What's, uh, any other advice you could give on this topic for, uh, companies to, I guess, implement or prepare for? Yeah, so, so I think the main one, like, like, so let me just give you kind of a high level of some of the things that we did. So a consistent message out there about these are the best practices, this is what you should do, these are the people that have credibility out there. So in the US, things like CDC and WHO, for example. We also empowered our regional leaders, so in India, in Poland, for example, to make calls based off of what the government was doing there.

So I mean, they shut down their offices first because they were like, look, there's travel restrictions here, we're starting to see people get exposed more here, we're going to make that decision. So empowering your leadership is very important to do from the beginning. We also opened up an inbound Slack channel around COVID-19, which, yeah, there's some noise in there, you know, like people panicking and everything else, but that's okay because it gives you a pulse of what the people are doing, what they want, and an area to be able— an opportunity to be able to lead. We also put together an emergency management committee to discuss it on a daily basis. So these are like my peers, you know, on executive staff with regional leaders where we meet for a half hour every morning, we go through an agenda, and then decide on plans of execution.

And then I think the work from home thing with, again, like I mentioned VPN before, being able to have things virtually set up was absolutely key. Now the challenge comes in though, when you put something like work from home is, okay, how do you make sure people stay engaged? Okay. You know, are they following best practices? How do you make sure they don't overwork?

Because I think you work from home too. And sometimes, dude, you know how it is. Oh, I never turn it off. You never turn it off. And next thing you know, you've been in your pajamas or sweatpants for like 18 hours.

Yeah. So, so we're getting some of those guidelines out there as well too. Um, and I think that constant communication, you know, uh, people want to be heard, you know, they, they want to have a safe place to be able to talk. And, you know, like, as much as I love Sumo Logic, as much as I've loved my other jobs, they're jobs. And we have to stop and think about that sometimes, that people come first and people matter first.

So being empathetic, I think, is probably one of the most important things we can do as well too. Yeah, great advice. Switch, uh, yeah, man, I'm ready to do this a little bit. Yeah, yeah, look, you know, like, one, I do like talking about this because it's what's happening now, and it's gonna be so cool to reflect on this later just to see, you know, like, what's transpired. Um, and I don't mean cool like in a comical way, or were we right, were we wrong, but it— to me, it's just the velocity that things can move at.

You can always learn from— so I like to learn from myself. But yeah, let's talk about something else for a little bit. Uh, it'll be, it'll be refreshing for sure. All right. Yeah, perfect.

Let's talk about you then. So you are not originally born in Colorado, correct? Nope, I was not. Where were you born? I was born in Panama City, Panama.

So Central America, Spanish is my first language. Yeah. So yeah, talk to, talk to me about your travels and where you've been, where you've lived, how you got here to Colorado. Yeah. So, um, I was lucky enough that my mom got remarried to the greatest guy on the face of the earth, you know, so Here, you know, here she was, single mother of 5 kids, and she meets this American soldier who's in the Air Force while she was working civil service for the Panama Canal.

She wasn't a US citizen. So she meets this guy, and imagine this, Jason. So he's 26, and my older brother is 16 at the time, 10 years apart, and there's 4 more kids, you know, to go along with this guy. But he's such an amazing man that he fell in love with my mom, fell in love with us. And within 3 years, we were moved from Panama to the Air Force Academy.

Yeah, so Pine Valley, shout out for anyone who's ever lived on the Academy. But that's how I got here. And it was the craziest thing I'll never forget as long as I live. Like, we got to Colorado at night. And I had never— I'd been outside of Panama to the US one time for a visit to Disney World.

I wake up in the morning, and I walk outside. And it's July, and I'm freezing my butt off, right? Because I'm from the equator, pretty much. And I see all these mountains and everything. And what a trip that was.

I mean, just mind-blowing to end up in Colorado. Yeah. Do you hike in those mountains? Like nowadays? Oh, totally.

I mean, I'm a Colorado guy through and through. I've been here on and off since 1980. I've lived a few other places, but I always come back home. And I've been here permanently since 1998 when my oldest, my daughter was born. Yeah.

So you're a native now? Yeah, totally a native. And, you know, like, being outdoors for me is everything, whether it's, you know, doing the incline or hiking. I snowboard quite a bit, you know, so it's a big part of— it's a big part of who I am and who my family is, for sure. So you were in the military, correct?

That's correct. Okay, what was your, uh, what was your job in the military? I heard this was perhaps your worst job ever. It was close. Um, so I went into the Navy And I was a boiler technician.

And so boiler technician is the person that kept the— the boat's been decommissioned then, but for those of you who are familiar, it was an LPH called the New Orleans. It was stationed out of 32nd Street in San Diego. And so you got to keep the engine running. So that's pretty much what our job was, was checking gauges and everything at the bottom of the boat. So we're talking about like 115 degrees at all times while you're wearing coveralls.

First one's on, last one's off. Um, it was, it was quite an experience for me. Um, 2 years on, 2 years out. So career-wise, everything's been uphill since then? Everything's been uphill.

But I'll tell you this, I, I don't think that I was a person that was cut out for, uh, to be a lifer in the military, like, like my, my stepdad— well, he's my dad, so I call him my dad— was. But I learned a lot of discipline, which, by the way, going back to COVID-19, yeah, it became useful because of that operational awareness and that capability to to lead or be led in times of trouble. Yeah. So it was good for me in that sense. But yeah, I had nowhere to go but up from there because it was definitely a challenging job, no doubt.

The good thing is towards the end of my career there, I started doing some intelligence because I did have a computer science background. Yeah. So how did you get into the tech industry and cybersecurity? Yeah, so it's one of those things where, you know, you kind of always have fiddled around, whether it was with coding and and computers, like if you think about people my age, it was the beginning of when people first started getting home computers. And any job I ever had, it just seemed like I was always the guy that was called to fix the printer or to help someone fix their laptop or load— I mean, not laptop, but desktop back then, load software.

And I got lucky. It's just amazing if you're nice to people, what happens. Because the biggest break I ever got I was going to, to Regis College, Regis University here in Colorado, and the teacher in a networking class was like, you know, hey George, would you like to interview to be a network engineer with my company? He goes, I think you'd be really good at it. I had no idea, Jason, what this job was going to entail, but I knew that it was something IT related.

And I went in and interviewed and got the job, and it changed my entire life. And the funny thing was, is like, I think my daughter was like 6 months old You know, and we were struggling. You know, we were happy, but we were struggling. And it just changed— it changed my life. Yeah.

And then from there, you went to where after that? Yeah, so from there I ended up going to— which, by the way, this was a great job. It was really cool what I did. Let me just describe that. So set up NT networks, which is weird, NT all over Air Force bases and Navy bases throughout the US, and then really got involved in Cisco networking.

And that's where I really started doing a lot of security behind that. Okay. Then I went to Federal Credit Union, you know. So, um, as the project was wrapping up there, you know, just like me in typical fashion, I wanted to challenge myself. So I went to Federal Credit Union, and that was challenging because they were moving their data center, which was massive, from the south part of Colorado Springs to the north part.

And by the way, they weren't anywhere but Colorado Springs at the time. Okay, that had to have been a while ago, right? Oh yeah, this was 2001. Oh wow, when I first took that. Yeah, and look at it now.

I take credit, by the way. The CEO, Chad Graves, CEO of Ent, is the one that hired me there, and now he's CEO. And so a lot of the work that we did together back then put Ent, you know, a great financial establishment, in the position they're in today. You see them everywhere. Awesome.

Yeah, all because of you. I was a contributor, you know, but I'm one of those guys like I think I'm the biggest pain in the butt to have working for you, um, but at the same time, it's because I'm gonna push and I'm gonna challenge as much as I possibly can. And so that's one of the things that I did there. I pushed a lot, you know, I made them think outside the box. Like, like, for— I'll give you a great example.

Voice over IP was non-existent at the time. I mean, we're talking 2002. And so I was like, look, while we're bringing up these centers, why are we bringing in like these PBXs into every center for like $25,000 bucks. Let's just drop a switch and a router in there and hook up voice over IP and eliminate that cost and provide better service for our customers. And it took a lot of pushing, but we ended up doing that.

But anyway, that's like an old war story. Yeah, yeah. I was one of those guys implementing those voice over IP phones. So yes, that's kind of funny. The world has changed.

The world has changed, man. And then now you see them everywhere. So yeah, so from Ent, um, From Ent, I got into my first software gig, which I always avoided, you know. So Microsoft, Cisco, they had all offered me jobs, but I always thought I wanted to kind of remain local, you know, and minimize my travel. But then I ran across this company called ConfigureSoft that was founded actually in Divide, Colorado, okay, and eventually moved to Colorado Springs.

And I, I just loved what they did. It was a configuration management solution. And so I took the job there, and you want to talk another about another massive change. That was a big change in my career. I've never heard of the company.

Are they still around? They're still around. So let me give you the legacy because this is a fantastic story. So, you know, worked there for a few years and then we got acquired by EMC. Okay.

And then we got acquired again by VMware. So it's currently known as vCOPS is the name of the toolset. So VMware Configuration Operations, I can't even remember what the P stands for anymore, but it's still part of that suite, and it focused heavily on configuration management, security, and compliance. So yeah, the toolset's still around. I see it every once in a while.

Interesting. So this is how you got into VMware then? This is how I got into VMware twice, by the way. So I worked for both EMC and VMware 2 times. Okay, because I know you were telling me that you almost acquired or bought Sumo Logic when you were at VMware.

Was that your second time? That was my second gig around. Okay. Yeah. What's that story?

So what happened was, um, after— I, I, I'm, I'm just gonna be honest, I loved EMC, you know. So EMC was one of those companies where the people there, the culture there, it just suited me. Um, you know, it was kind of a rough period in my life too for multiple reasons, and I just felt very comfortable there. So when we got Before we got acquired from VMware, I was actually getting ready to leave my constituents of people with ConfigureSoft and stay permanently in the office of the CTO at EMC. And then I got a call one day from this guy, Boaz Chalamish, who, you know, he ended up having a fantastic career.

He was a GM at VMware. And in his Israeli voice, he's like, I need you to sign NDA. You know, we're going to acquire your company. I was like, oh, wow. So I stayed with VMware because it was in their heyday, right?

But then EMC came calling again. And when EMC came calling, it was around, you know, their whole cloud-in-a-box vBlock platform and doing security around that. And I liked the culture, so I went back. So the guy who's currently my CEO at VMware, one day, in the way that he does, because he's just a fantastic person and leader, invites me to his suite during VMworld. And I walk in and he's like giving me this whole breakdown of what they're doing now.

And he's like, And I need someone to run security. I'm like, oh, here we go. So then I ended up back at VMware again. Yeah, so it was pretty crazy transition. Interesting.

So this is not somebody that you can say no to? It's very difficult to say no to him. It really is. And we all have those people, you know. Um, and, you know, and even like throughout this whole COVID-19 thing, him and I have been at odds, you know, a few times, which is something I appreciate about him is, um, Um, he, he definitely takes my opinion under consideration, and sometimes I have to say it many, many times.

Um, but he's very difficult to say no to because he's just flat out good at what he does. Yeah. So to that spirit, what you asked me about, um, yeah, so this was about 2011 or '12. Um, he calls me up one day and he says— because I've always been out of Colorado, like, I love the Valley, working out of the Valley, but I'm not leaving Colorado. Knock on wood, you know, life changes as we know, but I'm a Colorado guy through and through.

So he, um, he's like, hey, there's a little company out of Mountain View, California that's getting ready to come out of stealth that does logging. He goes, they would make a really cool sim. He's like, do you mind checking them out? So I'm like, no, not at all. So I got my, my guy, his name is Dobby Altenheimer.

He's a fantastic security guy in his own right. So him and I went to go visit Sumo Logic And we walk in, and it was the funniest thing ever. Everything's white, all feng shui, white bamboo, running water, white desk. I mean, there was no color in this place. And then these 3 dudes come out wearing all black.

And it was like, what? Am I at a Depeche Mode concert or what? It was just hilarious. Yeah. But they said no.

They had a vision about building this cloud-native analytics platform 100% in AWS. And they weren't going to veer from it, you know, which was also attractive to me at the time too. And I was like, wow, I hope I run into these guys again one day. Yeah. And how did you run into them again?

Yeah, so this is again, you know, how small this world is. Um, so Ramin decided to leave VMware. He was the GM of the business management unit, which he took to a $2 billion business in 4 years. And, you know, one day we were gathered in Barcelona after VMworld Europe, and he was like, hey guys, I'm leaving. I'm gonna go take over as CEO for this, you know, company called Sumo Logic.

And I'm just like, wow, I can't believe that, like connecting the dots, because this was probably 2014. Okay, so he left, um, and then I started looking for another gig, um, because at the time, you know, I had been working on a skunkworks project with developers to create a, a SaaS-based cloud solution for VMware around security and compliance. And I just thought, yeah, that project's gonna fizzle away, so I better start looking And again, this is how small this world is. So I take a job at HP. I literally accepted a job at HP.

I was celebrating that night in San Francisco with my daughter and a good friend of mine, and all of a sudden I look down at my phone, and it's Ramin calling me. I pick up the phone, I'm like, hey dude, what's going on? He's like, you're not taking that job at HP. I'm like, what? It hasn't even been 24 hours yet, man.

And so he talked me into coming in and interviewing, And of course, it was a, you have to move to Silicon Valley tone to this whole thing. And I was like, I'm never moving to Silicon Valley unless I have to, knock on wood. But that's how it all kind of transpired. That's a great story. A month later, you know, and that's how I ended up.

Yeah, I ended up there. Been there ever since. Been there ever since. You know, have you had different roles there? Yes, I've definitely had different roles there.

So when I came in, I actually had more of a product-focused role. Okay. And this is something that I want to say as well too. It's really funny because I think a lot of times people look at like my LinkedIn or whatever else, and they're— and many of you out there, you know, we've held a lot of different kinds of jobs, but nothing should stop you from where you need to go to make an organization better or what you want to do, you know. So I came in as a security-focused PM, the first one they had ever hired, which I love a PM role because you're the CEO of your own product line.

Yeah. But then eventually, you know, ended up transpiring into taking over as the CISO for the company. VP of Security first and then CISO. And I wouldn't change anything about that lineage because understanding the product first to the detail that I did has allowed me to do my job even better. Yeah.

Yeah, that's great. Yeah, it's craziness though, because a lot of people are always like, well, you've been in sales before, you know? And because I did, I led it, you know, I started off as a federal SE and then I led a team of worldwide SEs and I've been in business development before, you know, so I've taken a lot of different roles. And I'm— I think I'm always going to probably be in security because I do a lot of stuff outside of security, IONS, you know, and ISC2 SANS, stuff like that. But I'm always also going to do whatever it takes to move the needle for a really good company.

So you don't use the, uh, the CISO title though? You go by Chief Security Officer instead? That's correct. Um, a few reasons for that. I mean, I think It also allows, number one, let's say the team continues to expand and grow and I want to promote someone.

Yeah, I could always promote someone to CISO. Okay, you know, and then still keep my role. Or there's always talk too of CPO, which is a big title now too, which is Chief Privacy Officer. There's always an argument about whether that sits with legal or sits with security, but I have a DPO currently on my team because privacy is big, you know, which is— I love doing this podcast right now because we're getting to talk about so many different things that I haven't had a chance to chat about in a while, but Privacy is massive, and with CCPA coming down the line, the effects of GDPR, you know, CPO could always be something too, but I'm very content being CSO right now, you know? It's a good place to be.

With CCPA, with some of these changes that are happening, what do you— how do you think that's gonna impact ultimately you guys, Sumo Logic, but, you know, the world in general? What are some of the things people need to start doing and preparing for? Yeah, so that's a great question, and let me make a couple of clarifications. I think for B2B businesses, it's not gonna be as much heavy lifting as it will for B2C. Yeah.

Because the nature of a B2C is the amount of consumer information that you take. You gotta get consent, you know, and then you also gotta let them opt out of selling any of their information. So privacy is gonna be even harder on them, but it's been hard on us. Us too, because, you know, if you think about just winding back the clock with GDPR, it was amazing on how May 24th, 2018, we all got a paper DDoS attack of sign my privacy statement, sign my DPA, all these underprepared people, you know? So the impact for us, I think, is going to be minimal.

We're still going to get that root canal whenever we go to do business with people starting June, but we already put together a CCPA addendum to our master service agreement and on top of our DPA. So I feel like we're well prepared. You're never perfect, but the thing is, is be transparent with people. Yeah, tell them exactly where you're at, where you suck. By the way, we love doing that, you know, and that was a— that's kind of a culture change.

Like, when we're bad at something, I tell people, I'm like, this is one area where we're not so good, you know, but we're going to get better over time at that area. And I think that kind of transparency in a roadmap is really going to help people with privacy because you have the right size privacy, your privacy program built on your company's capabilities, what they are and what that budget's gonna look like. Yeah. And when you can identify where you're, where you do suck, like you're, like you're saying, that's how you fix it. It's how you fix it.

You know, like, like my, my executive level reporting is, is hilarious almost when you first look at it. 'Cause that's what it does. It doesn't say, you know, wow, we've done a great job. 'Cause 4 buckets that, you know, report into me. And it's not like, wow, we've done a great job in Fed, or God, our SOC is just kicking butt, you know, or our automation team is doing great.

It's like, we suck here, here, here, and here. And it takes a different kind of mindset for the people that work for you to buy into that. Um, because yeah, we're all different. Some people like to be stroked a little bit more. And the people on my team that, that are like that, I make sure they get that.

But at the same time, I want to highlight the importance of showing where we're weak to be able to solve those problems and drive attention to them at an executive and at a board level. You try sweeping those skeletons back in the closet, and it does no one any good. And that's what's hurt security my whole career, by the way. And I find that we're starting to change that a bit to where security professionals are openly talking about where they suck and vulnerabilities and when you get hacked, and that does nothing but help the community, you know. Yeah, for sure.

Tell me about the structure of your team at Sumo Logic. So that is a great question. I'm glad you asked it because it's a little bit different, um, you know. So I may have mentioned we have 4 different buckets, you know. So the first one is our SOC, or Security Operations Center.

The second one is our compliance and audit team, which by the way, shout out, most of them are in Denver. Okay, sitting in HQ there. Yeah, the third one is a very interesting part of it, which is the automation team. So it's security architects, but they're full-blown developers. Okay.

Yeah, which is new for a lot of people and a lot of people in security. And then the last one is federal, you know, because of our FedRAMP initiatives. But I think what makes it really interesting is that third bucket, you know, the fact that 2 years ago we were able to see that we were going to need good engineering talent on the security team. They automate absolutely everything, and we lend them out cross-functionally. What I mean by that is, like, for example, we made a switch from WordPress to Craft last year.

Most of you are familiar with WordPress when it comes to blogging and supporting www sites, and the guy who runs my automation team became the webmaster for like 3 months. And led the project. Okay. In every aspect, whether it was the coding, running bug bounties against it. And people were like, why are you letting one of your resources go down that path?

And the reason why is because our website, number one, is important to us, but number two, I know that it's now done in a very secure manner. Another example of the value of this team— and by the way, the whole team's valuable, don't get upset with me, people— but this is just something a little bit different. Nice caveat. It's like, because of FedRAMP, we had 28 days to change things like our identity structure. Okay.

So we ended up having to move to Azure AD in 28 days. And this affects like GitHub and HashiCorp and Zora and Slack. And the list goes on and on with the impact to 1,000 users. Well, this team led that effort, working with IT. And so their capabilities capability to understand complex problems and make them simple and deliver solutions.

And then also working with development, because there ain't no way that a developer is going to be able to BS one of these guys, right? When it comes to dynamic or static code scanning, or even our Kubernetes and Docker deployment, like, they're all over it. So it's, it's been interesting because in the early parts of my career, I never saw that before. I never saw developers reporting to security. Yeah, that's, uh, that's definitely a shift, isn't it?

It's a shift. And then even my reporting structure— so it's something I don't talk about often, but I report to the CEO day to day, but my strategy is with our CDO, our Chief Development Officer. Okay. And boy, did I push back. No offense, Andy, but I pushed back when I first— when that idea first came to me.

And again, this is my capability not to be able to say no to Ramin. And he's like, listen, dude, he's like, I'm your boss, I'm your manager. He goes, but you need to tie in more to development because your FedRAMP needs, you know, all of your security needs in a cloud-native type environment. The engineers are the ones that are making most of those changes. So if you can drive your initiatives and bake them in, not just from a technological standpoint, but from a process standpoint as being part of the engineering org, I think it's going to move the needle for you.

And it has been nothing but true. It took a minute to get there for, for me and the CDO to learn how to really work together, but he was the last call I made before I walked in here. Okay. You know, because we were talking about like a lot of our work-from-home policies and single points of failure and redundancy throughout, you know, the COVID-19 stuff. So I just think that as security people, instead of forcing our processes on development, we have to understand how they work and then see how we can adjust and align to what they're doing and just not be that blocker, you know?

Yeah, that makes a lot of sense. Yeah, it should be like when you get in your car. Like when you get in your car, you know, first thing you do after you close your door, you put on your seatbelt. When I was a kid, that wasn't the way we thought. No.

And so by being part of that process, that's the way that they're starting to behave, you know, when they— that they're just starting to naturally do things like their own code scanning, vulnerability scanning, and things like that without even thinking about it. And so it wasn't your CEO just tired of you constantly coming to him? It's like, talk to somebody else. Man, Jason, there's got to be some of that to it. But the thing is, is with the day-to-day, even some of the stuff around COVID-19, the hard, hard problems around it, it's me and the CEO.

But when it comes to the overall strategy of how our company's going to move fast in an agile fashion, it's me and the CDO. And it's been so far a very powerful alignment, and I, I'm looking forward to see what happens down the line. I mean, look, we argue, yeah, you know, like anyone else, and I think that's healthy, by the way. Um, but so far so good. We seem to be getting a lot of things done in a rapid fashion.

I wonder if we'll see other companies kind of realign similarly to, uh, to what you guys are doing. It'll be interesting because you usually this is what happens with a startup, you know. Um, with a startup, usually security starts in development. You have some dude who's a developer or architect that, I know enough about security. And then as the company grows and they start getting investors and they start getting real customers out there, especially publicly traded customers, they're like, where is your security team?

And, and that causes a problem, right? Because then all of a sudden you have a security team that's coming in and they're trying to bolt all the security on. And so I think you might see a trend of that because the tighter aligned you are with development, the more the company can innovate but then remain secure from the beginning. Um, where, where it might cause friction, I think, you know, and even this is the first time I've ever talked about it publicly, by the way, would be if let's say someone wants to be a customer of Sumo Logic, which by the way you should. But if, if you want to be a customer of Sumo and you look at that, you might be like, oh, that means development rules the roost.

It's like, no, I still report into to the CEO, this is actually going to help you because instead of developers running rogue or that, that friction that's always there between development and security, we're actually trying to solve the problem again from within instead of externally. Yeah, yeah, that's great. That's the way it should be. You're a board member for several startups, correct? Yep.

Tell me about that. What are the startups? How did you get involved? Yeah, so one of them is Antivium, um, and it's an ongoing project to where it's security and compliance mainly in an Azure-type environment, 100% hosted in the cloud. A bunch of guys, developers that I worked with at ConfigureSoft.

So it's those relationships that keep that one going. The other one's Avenza Group, which is some folks in healthcare that I met out of Atlanta. So just my role is pretty much advising and helping shape the software and then how they're going to come out and what they're going to do in the future. I also advise for several other companies, StackRock, being one of the ones that comes to mind, which is not on my LinkedIn. I need to update it.

But they are a company that does container security. Cool. So I always keep my eye out for interesting tech with interesting people that are good people to where I could provide value. Because I think part of the mistake that people make is you join a board and are they really going to listen to you? Are you really going to listen to them?

And what's it really going to do? You know, if you can't have a positive effect on it, don't do it. Yeah. Do you feel like you're having a positive effect or impact on them? I am on one for sure right now, which is StackRox.

Um, you know, I have to kind of recalibrate, um, all the time as to that, ask myself that question, and then probably try to minimize sometimes my workload because, you know, outside of that, I'm also with IANS, which is Institute of Applied Network Security, where I'm a faculty member there, and a lot of my time. I probably do, I don't know, anywhere from 12 to 20 different conferences or symposiums a year. And these symposiums, Jason, this is gonna sound painful, but it's not if you attend them. It's 5 hours where I'm kind of doing most of the talking. Wow.

I know, I know. Which, by the way, we just did one virtually because of COVID-19 in Seattle last week. We shortened it to 2 and a half hours, but it could have gone 5. And it was on how to build an advanced Privacy Program. So then I have that, and then I also am an adjunct faculty member at DU.

That one is more about gratification. So it's part of their MBA program, Prospanica, which is where I'm dealing with Latino leaders and kind of helping guide them to executive staff and the board. And I learn a ton from— I learn from everyone. It's so funny because a lot of times I just walk into a room, I'm like, I'm the dumbest guy here, you know? And it just just, I'm just constantly in learning mode, you know.

I think it's because a lot of times I feel that way. You might feel that way, but it's definitely never the case. Well, I appreciate you saying that. Some of the other things that you do in the community, um, there's a charity, uh, Hope for Life, right? Yeah, yeah, about that.

Yeah, yeah. So it's, um, it's actually called Fostering Hope. Oh, okay. Yeah, so it's called Fostering Hope. So there's a few of them there, and I'll hit them all one by one.

So Fostering Hope is the first one. And so before I get— I guess I get into that, it's something clicked in me when my daughter moved out. And you being a father, all of you out there who are fathers, mothers, you'll relate to this. When your first kid, even your second kid leaves home and you're getting more of this empty nester stuff, you start looking at yourself, reflecting on your career, reflecting on your life, and what more can you do? Because we get wrapped up in our kids, which I wouldn't change change anything.

Yeah, nothing about that. That's how I started working from home. It was all about my kids. I mean, I'm a single parent of 2 kids, and so I, I really wanted to start becoming more of a philanthropist, you know. It was a goal that I made for myself.

So there's 3 main charities that I work with today. Um, so Fostering Hope is one where— and I didn't realize this, and I'll probably get somewhat emotional throughout, um, through this podcast talking about it— but it's a, a program where they work with children who are in foster homes and going through, you know, that whole government program. And what happens— and I never knew this— is when they turn 18, no matter what, they're out of the program. So think about this, like, I could be living with a family from 12 to 18. The minute I turn 18, I am no longer allowed to live with that family.

So these kids now, all of a sudden, if they don't get the right direction or if they don't have a future— and by the way, I didn't get started until late in life, you know, they're— a lot of them are turning right to the streets. Yeah. And, and the ratio of this was astonishing. It was like 60% or something like that. And again, this is very Colorado-focused.

So that's one of them. Um, another one is CLC, or the Children's Literally— um, Children's Literally Center and Literal Center. And that's one where they're helping kids get more materials for reading, school, everything else. Um, and then the last one is, uh, the Colorado Springs Children's Hospital, which is focusing more on teen suicide. And being the father of a 16-year-old that goes, you know, to high school, it's just such a rampant problem.

And, and I was astonished again that Colorado is always in the top 5 for teen suicide. Yeah, it doesn't make any sense. It doesn't. And you and I talked about this briefly when we saw each other last time, and I, I think, you know, that the pressures of this— this is again my opinion of what I when I was a kid, if I didn't get invited to a party, and by the way, when I first moved to the US, it was rough. I barely spoke English.

I lived on the academy. I'm brown. You know, I mean, I just didn't look like everyone else, you know? And so, but I always felt like I had a community around me. But if I didn't get invited to a party, I would probably find out that Monday.

The party already happened, and you know, it's all good. You know, hey, different strokes. You know, different friends, I'll move forward. Yeah. What happens today is if a teenager doesn't get invited to an event, they're watching it live on Snapchat, they're watching it live on Facebook or Instagram.

Yeah. Oh man, it, it, it, it just hits them to their core because it's real time, you know. And so there's just so many factors with the way that kids think and behave that this one was really big for me. You know, and that was the first one that really pulled me in. So the way that we do it is, you know, through Northwestern Mutual, which is a company that, you know, I do all my finances and stuff through.

Again, I'm not pushing them over anyone else, but they just happen to be deeply involved in this stuff. We, you know, put on parties and charity events and, you know, just bring education to everyone out there as to what's going on. And I'm gonna grow this part of my life. You know, it's been super rewarding, and I'm not gonna stop. Like, I'm planning on having like 10 that I can functionally manage by the time I'm 55.

How do other people get involved in these charities? Yeah, that's a great question. I mean, I had to really search, you know. Um, I asked my financial advisor because I noticed— I was like, God, you're, you know, you sit on a board of quite a few of these different charities, you know. Like, how can I get involved?

And so I think it's just tapping into someone like me. Like, if you want to reach out to me, I can get you involved with any one of the the 3 that I'm in. I'm kind of ignorant when it comes to a lot of the other ones. Um, I do stuff with Wounded Warrior, but that's more from a distance. But these, I like being front and center.

I like giving. I like, you know, supporting them in their causes. So, um, I think that's a good question. You find someone who's actively involved and sits on boards, and then, you know, talk to them about how you can start making an impact. Yeah, that's great.

I think it's good for my kids too, you know, because, um, I want them to, to see that side of as well, that it's not just— because I think a lot of times, which I have no regrets about this, but I always made my world small. It was about me, my kids, my family, my friends. When I couldn't control things, like even what's happening now, sometimes when you dial it in like that, it makes the world have more sense. But sometimes we have to expand that circle just a little bit. And if everyone expands their circle just a little bit, maybe the world could be a better place.

Yeah, that's, uh, great words to live by. Well, it's, it's one of those where it took me a while, you know, because, you know, like, even again, kind of going back to social media, I've pretty much stopped like Facebook and all that because I get on, I just see people going on political rants and everything else, and I'm like, you know, I know you and I know that you have other things that you probably should be focusing on, right? But you're spending— choosing to spend your time here. So I need to be simple because I'm a simple person. Again, I'm something, you know, the dumbest guy in the room.

So when I focus more on my kids and my parents and, you know, my brothers and sisters and close friends, and then I can somewhat control that environment, then I add a layer in like philanthropy stuff, and then that brings some of that goodness outwards a little bit. So I don't know, I think we all do that, and maybe, maybe it'll work out in the long run. Yeah, I like it. Me too, man. Trying to be as positive as I possibly can all the time.

Trust me, I have my moments too, but that's something that I'm trying to live by. Yeah, yeah, great. Do you want to talk about the books you have co-authored? Yeah, um, so it's, it's actually— so one of the things that I've co-authored out there is mainly standards. Um, so I worked a lot with standards, so cloud security standards way back in the day when I was with VMware.

I mean, this was a while ago. But it got me started kind of thinking in that space a bit more. And so constantly helping write articles. And it's not a— the way that I look at it is it's not a promotional thing for Sumo Logic or whoever I'm with. It's more of just trying to bring advice and guidance to people as much as possible.

And for me, it's lessons learned, man. I make mistakes constantly. Yeah, we all do. Work-wise, personal-wise. And I think when you make a mistake, it makes and you talk about it, it keeps other people from making that mistake, and it also makes it more accepting to be transparent.

I can't tell you, throughout my career, some of the bonehead things that I've done, but I've lived with them, I've talked openly about them, and it's worked out in my favor. I'll give you a good one, like when I joined Sumo Logic. When I joined Sumo Logic, I had to send out a patch upgrade to like, I don't know, maybe about 100, 200 security people out there. And so I write up this great email, looked it over 5 different times, and I hit send. And then my Twitter feed goes off.

I look at Twitter and some guy's like, hey, this dummy that works for Asuma Logic, security guy, just sent out an email with a patch upgrade to everyone in the CC instead of the BCC, and then he added SwiftOn Security to it. So kind of exposing my silliness to the world. And I was just like, yeah, you know what, you're right, I did. And I'm like, but you know, then I, then I, I, I owned it. But then I took a really close look at it because I know a lot of people who've done it since who I've talked to about this.

And I'm like, listen, what damage was truly done? Yeah, you know, we shouldn't do that, guaranteed. I'm not saying to do that. But what I'm saying is, so I can see your email address, it takes a lot more information to really compile, because if I know what company you work for, I can pretty much guess what your email address is going to be just by a sequence of putting your name together. It's either your first initial with your last name, or it's your first name with it, or last name.

So there's a whole lot of different things that we can do to put that together, but it's good to talk about it, you know, because I've had so many employees, and even employees with other companies, going, hey, I did this, how did you get through this? And then I got to sit them down and say, look, it's not the end of the world, you know. And if you're working for a company that doesn't encourage or use mistakes as educational type situations, then you might be working for the wrong company. Yeah, for sure. I mean, that's, uh, you got to learn from your mistakes.

Totally, without a doubt. A couple of things before we go. Um, I know that you drive a foreign car and you do not know how to pronounce it. How do you pronounce your car? Oh man, so I call it Porsche.

But it's Porsche, and I get reminded of that on a constant basis. And to really defend myself here, okay, so number one, I'm ESL, we all know that. But number two is like, I really just don't care, you know? Like, like, I, I'm not— I've always bought my cars around my kids, you know? Third row seating, eat whatever you want in here, um, you know, lots of friends, uh, softball, basketball, uh, lacrosse, whatever my kids play.

And so I finally— yes, he's right— I went out and got myself a little bit of a bougie car because I was having having problems with my last one, and I call it a Porsche and everyone makes fun of me for it. So there you go. And I know you got a flat tire, uh, not too long ago, even though it's brand new.

I did, I did. I got a flat tire right when we were supposed to first meet and talk about this interview. Yeah, it's me, man. I don't know, I've got some, some really, uh— it's definitely not the car, but it's, it's me. It just seems that myself and vehicles like that, um, we just don't seem to get along.

And I think it's probably because they know I don't care much. Like, even with this one, my son yesterday was eating Chick-fil-A in it. I don't care. Yeah, the car inside is crying. Too bad, car.

But look, a car— and this is probably a good way for me to close— for me, a car, a job, um, those things aren't going to define who I am. Yeah, you know, it's always going to be, you know, if someone says, you know, hey George, who are you? It's going to be, I'm a father, I'm a son, I'm a brother, and I try to do my best to be a friend too in all those categories. And I'm imperfect, make mistakes, but I try to keep my life simple and go by those things. It's awesome.

I appreciate that a lot. I appreciate getting to talk to you, man. This has been a lot of fun. One final thing. Yeah, how should people follow you?

So the best way to follow me would be on Twitter. Okay, so I I spend way too much time on Twitter, but I'm not really a big social media person outside of Twitter. And I do LinkedIn, you know, I do LinkedIn quite a bit, um, for professional type stuff. But yeah, @GeorgeGurchow on Twitter is probably the best way. And, and I'm always down with DMing people on Twitter too, you know.

So I just find that that's a platform that works best for me. Awesome. It's been great talking to you, George. It's been great talking to you as well, Jason. Thanks for having me.

I really appreciate it. That concludes my interview with George Gerchow. Thanks for listening. Be sure to follow and support Colorado Equals Security on Patreon. This is Jason Jaques saying be safe out there and stop hoarding toilet paper.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado equals security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.