Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 167 for the week of June 8th, 2020. Alex, 2 weeks in a row we're together.

Good to see you. It's almost like it's becoming a habit. It's becoming a habit. Like we maybe are going to stick with this whole thing after all. I heard you had a little bit of weather at your house last night.

We did. You know, the little storm front that came through. This is Sunday. So yesterday was Saturday. It was only like 5 minutes, but it really caused some havoc down to tree limbs and trees and just tore everything up.

A microburst, you called it? Yes, a microburst. You make this up? Or is this a real— it's a real thing. It's a real thing.

A mini tornado, pretty much, as you summarized for me. So just so everyone's aware, everything's fine. Well, other than my power is still out, but hopefully that'll be back on soon. Yeah, well, that won't matter during the whole stay-at-home thing. That's right.

It'll be like Little House on the Prairie, you know, everyone's up at 5 in the morning and go to bed at 8. Churn some butter. Yep. Good stuff. Well, I'm glad that your house survived okay.

It looked like from the pictures in your neighborhood that some people's trees were A little worse for the wear, maybe a shed or two. A shed or two. People are going to be spending some time cleaning up today, that's for sure. Well, I, I walked around yesterday during some wind, but not nearly that much wind. It was very windy, though.

We played tennis. My, my 10-year-old and I played tennis in the wind, which you'd think would be a big deal. But when you're really bad at tennis, doesn't really matter. Not that big a deal. We don't know where the ball's going anyway.

When you shank it, oh, it's the wind. All right. Let's talk about a little bit of housekeeping. Um, we do have a Slack channel with, uh, almost 1,500 of our favorite security people here in Colorado. Come, you can join that by going to colorado-security.com and clicking the Slack button in there.

Uh, there's also one person in that Slack channel we don't want. Uh, and you know who you are. You know who you are. Uh, we also have a mailing list. If you go to colorado-security.com, scroll to the bottom, there is a form you can fill out and, uh, put your email in there.

We will get you the show notes every week in your email. That reminds me of Jim Gaffigan. And he's like, my wife and I have been married for X years. We've got 3 wonderful kids, 4 total. I love that joke.

Speaking of jokes, we'd love it if you'd go rate us on your favorite podcast listening app. Give us 5 stars, maybe say something funny. Put a dad joke in the rating. You know that. Why not?

Also, tell a friend. Let them know how great Colorado Equal Security is, that you like the podcast, and that people should come hang out with us. If you've noticed the last couple of weeks, we have not had an interview on the show. It's because we aren't We haven't seen any people and we haven't done any interviews for a while. Yeah.

Um, so if, if you want to help get some more interview content on the podcast, we'd love it if you'd be a volunteer to go meet with people. Um, so reach out to us if you want to do that. We'll, we'll give you some instructions on how to get going. Uh, also, uh, thanks to those folks that are doing our Patreon campaign. It does take a little bit of money to run this and some people are supporting us, uh, with their hard-earned money and we appreciate that, especially in these challenging times.

And speaking of Patreon, we have a new patron this week. A big thank you to John Helixson. John is coming in at the $10 a month level, which is fantastic. It's really as much as we'd ask anyone to do. So thanks so much, John, for doing that.

As at that level, he gets a Colorado Equal Security t-shirt and he also gets a shout out on the show. Shout out. So John is a CXO advisor, which I assume means he talks to the chief extreme officers for their customers. I think the X actually means that he'll talk to any CXO. Level person.

I'm sure that, uh, people could think of other things that that X might mean, right? Oh man. Uh, he's the CXO advisor at Coalfire Systems here in town. Yes. Uh, I saw a news article, I can't remember if we talked about it or not, that they started up a new sort of CISO advisory program not too long ago.

So, uh, I'm sure he's working with that. And that's awesome. Yeah, congrats to John and thanks. I mean, we've known John here for years. Uh, he was the CISO for First Data in, in here in town for quite a while.

That's where I got to meet him. And then he's, he moved over to working for a different consultancy and now he's moved back into town to work for Coalfire. Good stuff. Also one other sort of announcement before the, we get into the news. If you've been on the Slack channel this week, you may have noticed there's a new channel.

It's called Book Club. And what in the world is a book club channel about? I know it's strange, but we are starting a book club. Yeah. So the first meeting is going to be the 15th of July.

To talk about Start With Why. Uh, big thanks to Douglas Brush for coming up with the idea of doing this book club. Uh, you know, I, I'm always looking for, for reasons to read, uh, especially good, interesting books. Um, and, and he came up with a good list of books we could start off with and Start With Why is right at the top of the list. I'm going to participate in it.

I hope, I hope Alex, you participate and I hope everyone listening does as well. I have already purchased the book, Robb. It is at my house. I have an actual physical book, not an ebook. I got the ebook.

It's sitting on my phone. I haven't yet cracked it open. Yeah, I haven't opened it either. But, but, but, but I have a month. So I did.

I did just get it yesterday. So, so there you go. And I didn't have any power last night, so I couldn't read. Yeah. Like Abe Lincoln.

That's your excuse not for reading. I like that. Right, exactly. All right. Let's jump into the news.

First story here is that there is a Denver earbud startup that really wants to motivate you to listen to podcasts longer. It's really kind of speaking to our people here. Yeah. The company is called Butterflies with a D like earbud, you know, Pun there, Butterflies. Get it, Robb?

Get it? And, uh, you know, their, their whole pitch is that there are more and more people listening to spoken word audio such as podcasts, and that earbuds generally don't have a good fit so that it prevents people from wanting to use them. So they are, one, making earbuds that fit better, and two, focusing them so that they sound good for people that are listening to spoken word kind of music. And entertainment. So they have a couple interesting stats in here.

There are 62 million people in America who listen to podcasts on a weekly basis. That's a pretty big number. That's a good number. That's up from 19 million in 2013. And then they say that there are 800,000 active podcasts.

So we are one in a million. We really are one in a million. You know, just about all of those 62 million people are subscribers and listen to our show, Robb, right? I'm disappointed when that one person doesn't listen on a weekly basis. But anyway, they are going to be releasing their earbuds soon.

So congrats to that and look forward to those. Hopefully, you know, we could get a pair maybe and check them out, see how they sound. Yeah, if we'll— if we can get a pair, we will review them on the show and we'll let you know what we think. Exactly. Butterfly, there's your opportunity.

Next, there's a Colorado company that has created a tool to help store— help stores manage their lines because now Everywhere has a line. Yeah, so this is an Erie-based company called Latitude Digital, and really they're just now coming out with this idea basically that, what I liked about it is it doesn't require you to install an app, 'cause I don't wanna install another app on my phone. I guess it must be browser-based, and it doesn't require you to put a bunch of personal information into it, so it's, you know, an app after my own heart. Yeah, pretty cool, but businesses can use it to, you know, help manage the lines that they have at their store, 'cause they're, you know, they may only be allowed to have a certain amount of people in there. Also manage the number of people that are in the store, So if you're using the app, you can tell, um, oh hey, this many people have come in, this many people have left, these many people are in line.

And if you're sitting in your car, you go to the, you go out to this system, you put yourself in and it'll tell you when to come in the store and get your service. So good stuff. Sounds good to me. Looking forward to seeing that thing hit all over the place. And I think they also said, you know, while they'd love to get big box stores and stuff right now, they're, they're actually giving free, um, usage of their system to the small companies and nonprofits that just have one location.

Pretty cool. All right, next we have, uh, another startup company here in Denver. Um, we've talked about TeamSnap on the show a number of times in the past, but there's a little bit of news here. Uh, in the last week they have raised $5.5 million. Um, and, and, you know, as a result of that and really a result of an uptick in business after COVID first slammed them pretty heavily, they've been able to hire back some employees that they had to furlough at the beginning of this.

Yeah, if, if you have a kid who has been in youth sports, you've probably used TeamSnap. You know, coaches can use it to, and, and parents can use it to manage the team and, and do things like that. Obviously, when there was a sudden stop to all youth sports, it's not good for business. But it sounds like things are starting to pick up a little bit again for Team Snack— Snap. They've hired a few people back and looking forward to them using this money as they go forward.

So good stuff. Good stuff. Congratulations to, to them for being able to bring their folks back. That was pretty painful. Next, the Boulder-based company Bonusly also closed on a $9 million round of funding.

So I'm actually pretty excited about this article just because the company itself, I don't think I knew Bonusly before this. Yeah, but the idea is really cool. Yeah. So you can use— what is the idea, Alex? The idea is, Robb, company companies can use Bonusly and their employees get to then essentially make, I guess you can call them like micropayments, like, you know, reward things that they can give to their employees.

Um, you know, hey Robb, you did a great job. Let me give you, you know, 10 Bonusly points or whatever they're called. As a coworker of mine, you have a budget that you can give out to people for bonuses, right? Right. And so it's, it really is employee-based recognition of, you know, who's doing what well.

And then, uh, eventually you can take those points and then redeem them for things that have actual value, not just bonus Bonusly points. Yeah. Amazon gift cards, other gift cards. And it looks like you can actually get cash out of it too. Cash money.

That's pretty cool. Yeah. So that is cool. I like the idea of it. Obviously the company can set whatever budget they want.

So, you know, they're not going to be surprised by how many bonuses are going out. It's pretty cool. Yeah. So, you know, that could be a hiring thing, right? You know, someone comes in, what's your, you know, Bonusly to your point value versus the amount of money in the pool?

I need to know how much money I can make from Bonusly at your company. I like it. All right. Moving over to the next story. This one is interesting.

It took me a little bit to figure out what was going on here. So Getty Images, they, they are a big provider of like stock images and other kind of images out there. They have chosen the Denver-headquartered Brandfolder to power their new media manager. Yeah. So that's pretty cool.

Brandfolder, they provide services for people to manage their brand's images. I think most of the time it's, you know, sort of in-house, like PING could use it to manage all of the images that they have that are PING related. Yeah, but obviously Getty has a lot of images. And so this is probably a pretty big deal for Brandfolder. Yeah.

You know, Brandfolder looked like— I did a little bit of searching for them on the web. It looked like maybe about a 50-person company downtown. So getting to partner with Getty, the biggest in this or right at the top? Yeah, I think one of the two at least. Yeah, it's a pretty good deal.

And now we got to learn a new company in town, which is always one of our favorite things on the show. That's right. Next, into the security news, Coalfire had a blog post this week talking about security assessments for healthcare organizations during and after COVID-19. Yeah, that's the headline. I didn't really feel like that's what this was about.

It was kind of a weird article. It's talking about the Health Sector Cybersecurity Coordination Center that's that's basically giving some guidance on what do healthcare companies need to do during this time. And all they really did was reiterated previous guidance, it seemed like. Is there anything in here that seemed unique to COVID? Well, I think maybe because people don't pay attention to guidance, that they can say, hey, here's the new guidance.

And when people go and see, like, oh, I guess I should do this stuff. It's funny because probably this is better for search engine optimization, right? When someone's like, what should I be doing around security during COVID They're like, Here you go. Now it says during COVID right? So it's the same guidance, but you know, basically it's, it's, you know, you're going to be shocked by some of these things, guys.

It's, uh, you know, do a, a assessment of your team, look at your policies, look at your app, make sure you have a database of IT assets. Um, look at the vulnerabilities, what vulnerabilities you have, what's the impact, what's the likelihood of these things, and plan for controls to put some controls in place. Hey, weird. I know, very COVID specific, right? Very.

Yeah. Um, additional security measures include, uh, cyberattack simulation tests, scanning, uh, supplier compliance, uh, business associate agreements. Hey, you're a healthcare provider. You probably should have a BAA. Yeah.

So, so all you guys out there listening, you should know, you know, we try pretty hard not to have COVID after COVID after COVID story on this show. And the fact that you see any COVID stories getting through means there's no other news. Everything says COVID right now. Speaking of that, Webroot had a story this week around the future of work, how to be successful in the COVID era and beyond. Robb, was there anything new of interest in this story?

There's a couple of things. I actually pulled out a few notes here that were interesting to me. So they— it looks like they're making a series here, and this is like part 1 of a series that they're going to be looking at the future of work. They asked a couple of questions that they came up with answers for. So question number 1 is, What are the hallmarks of organizations that are going to be successfully able to navigate the new workplace realities?

Yeah, I thought this was good. And, you know, one of the things that they mention is that the COVID-19 crisis really has forced employers to think about, you know, how employees are, you know, in general, like their health and, you know, their well-being, not just how that is in relationship to coming to work or things like that. You would think that that's something that would be there all along, but, um, you know, glad to see that that is picking up. Well, for some percentage of companies, it is there all along, right? But then I think the point here is the companies that are thinking about the fact that your employees are also parents and spouses and roommates and whatever— those teachers now, right?

There you go. They're teachers now. Um, so those companies, those companies who are thinking about the whole employee are going to be much more successful. Um, and, and really it's at every level, right? You know, your executives also have these same problems and your entry-level people have the exact same problems and maybe more so.

So it's an interesting dynamic for companies that have to be thinking about. Yeah, one of the other things that they asked was, you know, how will office culture change and what policies should change once everyone is back at work, excuse me, physically? Yeah, so one of the answers there was everyone is gonna become more comfortable with long-distance, you know, conference calls and just not getting together in person. Probably, you know, probably forever. Like all those people who have been holdouts saying, hey, we're never going to be that, you know, kind of virtual office.

They're all, they're all getting a taste of it. So they're all going to be more comfortable with it, even if this goes back to normal eventually. Yeah. The second thing was that personal hygiene will be even more important, Robb. Yeah.

Those conversations about not taking a shower, those are going to turn into conversations about not taking a shower. And also, what's your temperature? Right. And please wash your hands, douse yourself in hand sanitizer, then come back. Yeah, good stuff.

All right, next story we have is from Zvilo, um, talking about the life cycle of a website. And, and when I first saw this, I wondered if it was how a bill becomes a law, and that's basically what it is. It's a very— it's— if there was a catchy tune, this could become a, uh, Saturday afternoon cartoon. Yeah, they're talking about, you know, several different portions: the, the active web, the proactive web, and the inactive web. Robb, I had never heard these 3 phases before.

Neither had I. And— but it makes sense once I get into it. They have a really nice— well, they have yet another iceberg image, which you guys have seen many iceberg images. What's above the top, what's below, and they use that to kind of describe what are the different phases of a website. Obviously up above it is like the website hosts content. The content's the very top of the iceberg, but way underneath is all the stuff like the domain name being procured, the expiration of a domain name, kind of interesting behind-the-scenes stuff.

Yes. Uh, the domain name being parked, that's the proactive web portion. And then of course the normal lifecycle of a website that you would think of hosting things and, uh, then maybe someday it being abandoned or going back to being parked. So if you wanna know kind of the, number one, the, the lifecycle of a website, but number two, what are the security implications of these different portions of the lifecycle? That's what's interesting.

They talk about, you know, a parked website can be, can, can indicate a security risk. And, and they, they, they go through a little bit of detail about why that's interesting. Good stuff. Uh, the last story we have is from Logarithm. Uh, congratulations to Logarithm for the 2nd year in a row they have won SC Awards Best Sim Solution.

2 years in a row, that's pretty good stuff. And it— from, from what I've read during this release, it looks like it was a couple of non-biased panels that picked them over everybody else. Congratulations to Logarithm on that win. Yeah, that's good stuff. Uh, can't beat being number one.

Cannot. Well, unless you can beat it by being number 1 2 years in a row. Oh, hey, that's true. All right, well, congrats to them. Moving over to our next section, we have the Slack Message of the Week.

Big thanks to Andre Gaeta, a security guy here in town who's also a— he's a regional director of sales for Mimecast, but we've known him for years before Mimecast, and he's been supporting us for a long time. Andre every week gives us a sponsorship so we can give one member of the Slack community an award for an interesting message that they post, and they can use that to get an item from the Colorado Equal Security pretty swag store. Yeah, good stuff. Uh, this week our winner is Laura Francis. Uh, Laura is, I still think, the president of the Northern Colorado ISSA chapter.

Um, and she was posting about the chapter and, um, what they're doing and her continuing volunteerism for the chapter. Yeah. So really she, she wasn't posting about her volunteerism. We just wanted to recognize her for that. Uh, she was posting about a meeting they have coming up this week, which we'll talk about under events and It occurs to me that, you know, that's a chapter that just got started.

She's been putting a ton of work into getting it going, and we appreciate that. An underserved portion of Colorado that now has an ISSA chapter all of their own. Yeah, good stuff. All right, let's go ahead and jump over to events. Reminder, we have a fairly robust event calendar right now.

You can go out for the next couple months and see a lot of different opportunities to get involved, mostly virtually, I think exclusively virtually right now. But a couple things over the next 2 weeks. First, ISSA Denver is having one of the RMISC leftover sessions, Priyank Nigam Radio Frequency Hacking 101 on June 9th. On the 11th, ISSA Colorado Springs is doing their June online series. As we mentioned, Northern Colorado ISSA, they're doing their June chapter meeting also on the 11th.

ISSA is big on the 11th because ISSA Denver is also doing a meeting. They're doing Zachariah Ululeke Akinpelo doing a practical approach to application security. On the 15th and 16th, the NCC down in the Springs is doing their 2020 Cyber Symposium. On the 16th, the Cloud Security Alliance of Denver is doing their June virtual meeting. On the 16th, ISSA Denver is having Matthew Titcomb, DoD contractors and those supporting them, Are you ready to get audited?

Exclamation point, question mark, exclamation point, question mark. I'm sure this is talking about the CMMC. It's going to be good. And then finally, on the 18th, ISSA Denver is having Brad Rhodes come talk about using big data tools to understand your cyber environments. Yeah, pretty cool.

That is it for the events. Let's go ahead and move over to jobs. Robb, do you have any jobs? I don't have any jobs. What?

I know we, we actually have extended and had our last open position filled. So happy about that, but sad that I don't get to pitch jobs on the show this week. Well, you know what? I could pitch a job. Do it.

I am going to be in the need of a security program manager here pretty soon. So if that is something that would be of interest to you, please reach out to me. There's not a job post for this yet, but the program manager helps me run our enterprise security program, make sure that the entities that we're overseeing are getting their stuff done and sort of project management, GRC kind of activities. So if that sounds interesting to you, please reach out and let me know. And for all of the candidates who want to talk to you, should they just text you?

What's your cell phone number? Yeah, please just show up at my house. That would be the best. And all the recruiters who have candidates that'll be just perfect for you, what's the— what's the right email that they should use for that? At this point, it's, you know, come join the Slack channel, send me a private message.

That's probably the easiest. Awesome. All right, moving on to our next job. Fastly is hiring a senior director of security operations. CenturyLink is looking for a senior manager of information security.

Transamerica is hiring an assistant general counsel focused on privacy and security. Caterpillar is looking for an IT analyst 2 for multi-factor authentication. Oh, I like that. Uh, Kairis Technology, they are, they're the kind of think tank behind Carbon Black and Red Canary and some other, uh, security technology companies. They are hiring a reverse engineer focused on Android applications.

Uh, ULA, the United Launch Alliance, is looking for an information security engineer too. Charles Schwab is hiring a senior security engineer. Twilio is looking for a compliance engagement analyst. And finally, FireEye is hiring a senior information security consultant. Awesome.

That is it for jobs. That's it. We won. We did it. That's it this week.

We do not have an interview, so you all can go back to whatever it is you do when you're not listening to us. Hopefully it is comfortable and, you know, you don't need new butterfly earbuds to, to help you listen. If your ears are aching right now, we know where you should go. Help is on the way. That's right.

All right, everyone, have a great week. Thanks, Robb.

Learn more about the Colorado security scene at colorado-security.com. Where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.