Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 178 for the week of August 31st. We've made it through August, and Alex, I kind of feel like that means we've made it through the summer.

Yeah, and it's been a little bit cooler. So it almost feels not quite fallish, but almost fallish. Yeah, Labor Day is a week away. Kids are back in school. And, you know, it's— I didn't have the AC on turned on at all today.

So really, things have been, have been getting a little bit different. Honestly, we had some rain. I don't know about your house. We had some rain at my house. And man, the air was so much clearer.

The smoke was way less impactful. Yeah, I went for a mountain bike ride earlier and it was a little bit before sunset and it was fairly clear except looking out west, there was more rain coming in. But yeah, air definitely much clearer, nice and cool. Can't beat that. Yeah, things are getting better.

All right. We're on the way up now, Robb. Everything's on the way up. Everything's on the way up. You get low enough, can't get any worse, right?

That's right. Speaking of can't get any worse, let's talk about our housekeeping. We have a Slack channel with 1,500+ of our favorite folks out there in the Colorado security community. If you want to join us there, we'd love to have you. Go out to colorado-security.com and click on the Slack link there.

We are getting dangerously close to 1,600. Are we really? I haven't even looked. I knew we were over 1,500 and I kind of stopped paying attention. You know, Robb, we also have a mailing list.

When the show comes out every week, we publish the show notes to that mailing list. So, if you want to sign up for that, go to the website colorado-security.com and sign up for the mailing list at the bottom of the page. And of course, we would love it if you would rate us and subscribe on your favorite podcast listening app. That helps us get new listeners. And of course, another way you could help us get new listeners is if you would tell a coworker, a friend, a star-crossed lover, really anyone who you run across, just mention, hey, Colorado EcoSecurity is the best security podcast in the state.

And also If you'd like to support us financially, we do have a Patreon campaign going on that helps us to cover the costs of the podcast and all the other Colorado Equals Security stuff. So again, you can find the link to that on the website, colorado-security.com. If you sign up for certain levels, then you get free stuff like a shout out on the show and a free t-shirt. And then finally, we would love it if you'd help do interviews for the show. We've, you know, we generally do news and an interview.

This week you're gonna see we actually don't have an interview 'cause we've kind of worked our way through the ones we had in the backlog. We'd love it if you want to help us keep that content coming and get to introduce the Colorado security community to someone cool and interesting that's worth knowing here. Speaking of not having an interview, Robb, last week we ran into a little bit of an issue as well. Yeah, our editor putting the show together really dropped the ball. And just initially, if you downloaded the podcast the first day or so, you just got the newscast.

You didn't get the feature interview with Matt Alderman. Just so we're all clear, the editor is me. So So I'm not throwing Alex under the bus, nor any nonexistent interns that we don't have. So anyway, we did get that fixed, I think Monday morning, get reuploaded. And if you didn't get that, the version with the interview, I think you have to go back out and just redownload it, and you should be able to see that very interesting interview with Matt.

As a reminder, Matt is the CEO of Security Weekly and really had some interesting stuff to say about the industry and the experience of running one of the largest security podcasts in the world. And, you know, usually it's me that screws something up by not sending out the mailing every week or things like that. So, you know, good for Robb to have his turn. Turnabout is fair play, I guess. Indeed.

Also, we are running our 2nd annual Colorado Equal Security Salary Survey. We would love for you to participate in that. So you can go to co-sec.co/salariesurvey, and that will take you right to the salary survey. This is an anonymous survey. Once you submit your information, you will go to a different place to submit your contact information so that we can send you the report after it is complete.

Yeah, this is super interesting stuff. You know, we, you know, we've thought— we're talking to folks in the Slack channel about, you know, what we could do to add more value, and consistently folks would love to have a source for salary information. Information that they can trust. I will say it's a lot harder to do salary surveys than we expected coming into this. The nuance in terms of, okay, how do you correlate years of experience and different focus areas within security?

And then even within those, the range, the statistic variation between salaries is just massive. So it's a lot of learning for us, and hopefully, you know, you guys will find value in what comes out of it. Well, and then the other things like, you know, how do you put a value on certain benefits or, uh, you know, options or other things like that that maybe are not part of your salary? So yeah, interesting stuff. It is interesting and good learning for us, and hopefully, like I said, value to the community.

Exactly. Let's jump into the news. Uh, the first story this week is, is not security or tech related, it's just interesting. Um, there is an annual thing called the Art Drop Day where, where artists would drop their artistic works around the Denver area and generally I guess it looks like it happens on September 1st, so coming up here in a day or so and they are gonna be doing it this year but it's a little bit different during COVID Yeah, so it sounds like there will still be small handmade works of art hidden around the metro area but of course no one goes out so you're not gonna find those but there is also going to be an online version of this where artists can submit their creations to the website and people can get them there, as well as certain artists being highlighted on the website. Yeah, I say, while it's true that people are not getting out a lot, this actually might be a really good way to get out.

If you're looking for an excuse to leave your house, you know, it's all out of doors. You're not having to, you know, go into an art gallery to see this art. And it's kind of cool places hidden around town. You don't have to just randomly guess. There are tips and hints that are given by the artists on their social media platforms.

So, you can, you know, go figure out who's a part of this thing, go stalk them on social media and go see some pretty cool new art locally created here. Yeah, that is pretty cool. I've got a couple sort of anecdotes about that. We were a couple years back down in Salida, and I don't know if it was specifically part of this or not, but they were doing a similar thing. And we found a couple pieces of art around town as we were exploring.

And that was, that was pretty fun just to find that stuff. And then also during COVID we had people in our neighborhood who were painting rocks. So, you know, we'd take the dogs on a walk and every couple days there'd be different rocks around with things painted on it. So, you know, not things we would take with us, but still fun to see. We actually had folks in our neighborhood doing the rock thing too.

Maybe that, maybe that was a trend that was not locally created. Could be. All right. Next story. We have a story about crisis innovators, how 8 Colorado startups are fighting COVID-19.

So this is pretty interesting, talking about some different startups here in Colorado and what they were doing to help folks during the pandemic. Yeah, initially, I was looking through it and thinking maybe we'd want to just go through the list pretty fast. But there's some interesting stories here. I recommend folks who, who really want to know more about local companies, you know, click these kinds of links because you just don't find this exposure unless you're intentional about it. I did want to call out one of the stories that I found pretty interesting.

Is it Puro Light? So they're They're a company in Lakewood, and they have partnered with MTA, the Metropolitan Transportation Authority in New York City, to use their UV technology to disinfect public transportation for riders across New York City. So, you know, obviously we've heard that UV light can kill viruses and kill mold and some other things too, and specifically it can kill coronavirus. They've created technology that can be used in an automated, you know, no-human fashion to make sure that those surfaces are safe when, you know, when riders get on there. Yeah, I mean, and I think we all know that, you know, the subways in New York City are absolutely disgusting at times.

So, you know, having that on there is another side benefit. One of the ones that I wanted to highlight, there was an organization called Make4COVID that was a statewide volunteer network where people could volunteer to basically make PPE during the the crisis. There were a number of different companies that contributed to that, but they put together over 81,000 pieces of PPE through the network of over 2,000 community volunteers. I thought that was pretty cool. When you say PPE, do you think OPP?

Is that just me? Who's down with PPE? Yeah, you know me. Yeah. All right.

I do now, Robb. Good. And now, now so will many other people who are listening to this. I apologize to all of you and anyone who loves you. Moving forward, there's an article here from the Denver Business Journal.

Can a group of 14 white Colorado tech leaders change the state's startup diversity scene? That's the headline. And as you get into it, I think it's more nuanced than that. I don't think it's a great headline. Really what it is, it's a group of, like it says, these 14 white, but they're not just tech leaders, they're actually investors, they're equity investors.

Private equity or venture capital folks. So like Brad Feld and a bunch of other of those people who bring money to startups. And really what their focus is, is making that startup capital available to people of color. Yeah, and I think also just some learning through this to figure out what else is necessary to help those of color who are doing startups, right? Because money is great, but there are— I think there's other barriers as well, right?

I think you're right. I do find it— there's a lot of interesting stuff in this to me. Like, they're not just saying, hey, we're going to dedicate some money to people of color. They specifically signed up— each of these 14 people signed up for an 8-week training. That's kind of part of their work with this group, where they're going to— each member is going to learn about their own personal biases, how they can be more anti-racist versus, you know, not just being not racist.

Really cool stuff to see, you know, a guy like Brad Feld, who's a billionaire, right? Like, a guy like that who's willing to put his own time and resources behind this, I think it goes a long way towards, you know, adding credibility to these types of movements. And after this 8-week program, their plan is to unveil some findings and a framework for making this more sustainable for the community going forward. So I think that's pretty cool as well. Yeah, it is really cool stuff.

And, you know, I know, Alex, you and I are both white males, and I hope— we hope that we can also be positive and move things in this direction. You know, if there's folks out there in the security community who have ideas how we can help with our platform, let us know. We'd love to participate and move those things forward. Agreed. Next, we have some news about an acquisition.

Denver's Brandfolder was acquired by Smartsheet for $155 million. So Brandfolder is a digital asset management platform. Meaning something that manages the digital assets that you have, like logos and maybe videos or other things like that. And Smartsheets is a company that does more workflow and things like that, and they feel like there could be some synergy with the 2 companies together. Yeah, it's really cool stuff.

So, number one, awesome for Brandfolder to have an exit like that, $155 million. Hopefully, presumably, a really nice exit for their owners and those folks who spent a lot of time there. It's pretty cool. Smartsheet is, I think they've become really successful in the recent past. A lot of companies, especially I think those companies who are kind of cloud-first for their productivity apps, have moved to using Smartsheet for their project tracking type work.

I know we use it at Ping, and I find it really cool to see them continuing to invest and innovate and adding that work workflow element to it in addition to the portfolio of logos and branding stuff. I think it's gonna be interesting. I'm curious to see how they take this in the future. Yeah, it looks interesting as well. I did see in the article that Brandfolder through their history had only raised $11 million.

So, a $155 million exit from $11 million is pretty good. Man, that's like a billion dollars profit or something. Some almost a billion dollars. You're right. And I had another point too.

And you— I think it might have been this, to mention that they're going to maintain a Denver presence. They're not going to— they're not moving outside Denver. Brandfolder is still going to be here. And Smartsheet says they intend to grow here in Denver as well as a part of this. Yes, I did hear it was a different article that sort of said, you know, part of the reason for the acquisition here was that Smartsheet wanted an in to Denver.

And this was an easy way to do it. It's hard to get in here. It is hard. Yeah, we're popular. All right, moving forward.

We've talked about Sphero a lot on the show over the last few years. They're the ones who— they got their initial popularity making that BB-8 robot. But they have a new global challenge. They call it the Sphero Global Challenge. It's the ultimate STEM robotics and design competition.

And it's just opening now and it looks really cool. I gotta get both of my kids to take a look at this. It looks like they have sort of 3 different missions, tracks, programs. I'm not sure exactly what you want to call them. Competitions, depending on ages and focus.

But, you know, one is just a STEM competition, one is around coding and robotics, and one is around programming and engineering. So lots of things that you can do with your kids and help them move forward in STEM. And, you know, it's pretty cheap too. It's $75. Am I the only one who doesn't know the difference between coding and programming here?

Help me. Yeah, well, maybe they wanted different words because it's coding and robotics and then programming and engineering. I, you know, I don't know. I'm not even sure I know exactly the difference there. I do know that robots are different than engineering, but like, by the name, I don't— I'm not sure what the difference is.

And I assume STEM is just a little bit broader. Well, actually, there's a little description here. So the STEM competition is a hands-on event to allow students to solve problems facing the Earth right now. So I assume climate change and nuclear disarmament or something like that. The coding and robotics is take flight on the Bolt space mission.

During this event, students are going to put on their programming engineering skills to work. And then the programming engineering is students are going to design, build, and engineer solutions using RVR and LittleBits. So it's probably that last one is just more technically on a certain platform. Yeah. Anyway, cool stuff.

Yeah. So if you have kids, you should definitely check it out and register. Oh, it was ages 8 to 14, I think. I think that's— yes, I believe there might even be even younger in some of the platforms too. Very cool.

Next, this is pretty big news. A data analytics unicorn also known as Sumo Logic, is planning to file their IPO. Yeah. So, really cool stuff. Sumo Logic, if you remember over the last couple of years, they have opened what they call an HQ2, a second headquarters in Denver, actually in the same building that Ping's in.

So, I've seen those guys a lot. Really cool that they've invested in Colorado and now they're going to be going public. There's not a lot of information yet. We don't know when it's going to be. The article hints to the fact that there's been a glut of recent people filing for IPOs.

They think because people are trying to get out before the election and there's kind of uncertainty around what's the economy going to look like and how free will capital be after the election. But anyway, they look like they filed and they're trying to raise $100 million as a part of that. Yeah, and congrats to them. Sumo Logic has been very, very successful. It seems like they are in most cloud-first companies doing logging and security monitoring and other things like that.

So hopefully this goes well for them. And a reminder, we had George Gershaw, who was the CISO there, on our show a while back. Congrats to George and other folks have been, you know, through the company over the years, and we love to see those guys be successful. I did have a couple other things that I noticed here. They have about 700 employees right now.

And they had revenue about $155 million with a net loss of $92 million last year. So they're kind of built like one of those VC companies built to grow quickly, a very expensive way to grow with the intention that as they get to scale, they'll start to get towards breakeven or profitability. Flip that switch, stop growing and start making money. Cool. All right.

Next article we have is one of the Red Canary blogs. You know, I love what they do in their blog where they're just adding a lot of great value, a lot of context for someone in security operations. This one is the Ransomware Survival Guide. It's a holistic approach to detecting and mitigating ransomware. And I read through this.

What I loved here is they give a couple examples of really clear ways to know that you have ransomware. Like, hey, if you see rapid-fire access, create, delete, or you see people running VSS dman.exe to delete your shadow snapshot, that's a clear sign of ransomware. However, like, by the time you see those, it's really too late. You're now in incident recovery. You're now trying to restore your data versus trying to stop stuff.

So this blog post is really about, okay, how can you— how could you detect it earlier and stop it before they start to actually encrypt your files? Yeah, I thought this is a really good article as well. It's a good mix between technical and not technical, you know, a really good description of what's going on and things that you may see, but also digging a little bit into those more technical details for the people that are interested in that part of it. So definitely a good article there. All right, next, Ping Identity had a blog this week talking about 4 ways to make more intelligent workforce authentication decisions.

Yeah, so they, you know, we're not going to go through the entire article. I will say what the 4 things are, though. The first is using UEBA. That's the User and Entity Behavior Analytics. Basically figure out when do people normally log in, what does a normal login look like from a user, and you kind of get a fingerprint for, you know, what Alex's behavior looks like.

And when Alex is more risky, if Alex usually logs in at 8 and logs off at 5 and all of a sudden he's logging in at 4:30 AM, well, let's do a step up, right? Let's require an additional factor of authentication. They do anonymous network detection. So if you're using a Tor browser, you know, the Tor network to connect, you know, that's, that's a sign that clear— that sometimes people are trying to do some shady stuff. The criminals often use those networks.

So maybe that's another situation where you might want to do step-up authentication. IP reputation— if, if I'm connecting now from, uh, the, the same IP that's been, you know, launching DDoSes all over the world, that's a really good time for us to either block or require a step-up. And the final one is impossible travel, right? If you just signed in from Denver and an hour later you're signing in from New York City, well, we suspect that that's high risk and we want to do some kind of a step-up or notification or something. I love impossible travel.

It's my favorite. Well, it's especially right now, right? So anything about outside of about, you know, 30 miles from where we live is just about impossible travel, it feels like. Exactly. All right, next we have a blog post from LogRhythm talking about monitoring and defending medical devices.

Yeah, this was an interesting article. I think, you know, first part of it talking about, you know, the challenges around securing medical devices as you have more and more medical devices that are connected to your network, not just standalone devices performing some sort of health function. And also because of that large amount of devices as well as The way that devices many times are operated, you have less control over those devices than you do, you know, sort of a typical IT device. So they talk about some ways that you can get visibility and control around those medical devices, including a great way, which is LogRhythm's NetMon, which is part of their platform to, as you might guess, monitor networks for suspicious behavior. Yeah, it's good stuff.

You know, and we do cover some of these stories that are, you know, they're kind of a sales pitch, you know, both for Ping and for LogRhythm. They're kind of sales pitches, but, you know, part of the reason we do it is, you know, what they're putting, the content in these is true regardless of what platform you use. You don't have to use Ping, you don't have to use LogRhythm in order to get value from these stories. So hopefully you guys will take a look and whatever your IAM or SIEM is, you can use these ideas to make it better. For sure.

And then the last story that we have this week actually was in Hedge Week, a periodical that I've never heard of. But the article was by JT Gayedo, a friend of ours, friend of the show, talking about artificial intelligence and proactively detecting threats. Yeah, this is one of those that's maybe more interesting for the fact of where it's published than based on the content. I don't think there's a lot of surprises in here for us, but it's really cool to see I mean, I looked a little bit into HedgeWeek after never having heard of it either, and really, they're for hedge funds. They're not a security publication.

They're really a financial publication, and it's nice to see a group like that who actually cares about the kind of stuff we care about. Yeah, and JT does a good job of explaining it here more to an audience that is not necessarily technical in nature. Very good with that too. Cool. Well, that is it for our news this week.

Let's go ahead and jump over to the Slack message of the week. Big thanks to Andre Gaeta. Andre is the, uh, the personal sponsor of this so we can give people each week one item from the Colorado Equal Security store. They can get some swag. Yeah, and this week's winner is Bern Carney.

Congratulations, Bern. Uh, he posted about a good thing Slack our Slack workspace, helping him find a new job fast after he was laid off. So that's pretty cool. It's really cool. You know, there's, there's very few times that we get to see, you know, really impacting someone's life for the positive in such a way.

And that's one of the ways you get to do it, right? Helping someone who got laid off find a job quickly and not have him and his family get impacted too much. Really cool stuff. So not only does Bern have a job now, he gets a free Color Equals Security piece of swag. Yeah, and, you know, hopefully whenever he gets to physically go to his new job, he can, you know, take that swag with him and put it on his desk.

Love it. All right, moving on to our upcoming events. We have a couple of events this week. Number one, ACES has a webinar on de-escalating dangerous situations. That's on the 3rd.

Also on the 3rd, the Colorado Springs ISSA chapter is doing their September online series. On the 4th, the Colorado Springs Cybersecurity Group is getting their virtual First Friday Cybersecurity Social and Mixer, which is a serious mouthful, but hopefully a good way to get to meet folks in the Springs doing security. Yeah, I mean, and they had been doing this in person. I think this is the first time I've seen them trying to do it virtually, so that's pretty cool. Yeah.

On the 8th, Denver ISSA is doing an event about Secure Access Service Edge Framework, or SASE. Sassy. On the 10th, the Northern Colorado ISSA chapter is doing their September chapter meeting. Of course, that's also virtual. Also on the 10th, uh, the— is the Cybersecurity Summit Denver, uh, which I assume is also a virtual event.

Yeah, it is virtual this year. Uh, that's the last event here in the next couple of weeks. I'm looking out— or excuse me, going jumping over to jobs. Uh, we do have a job at Ping Identity. It might be filled here very soon.

We had— we've had a couple of interviews that went pretty well, but it's still open as of today. If you're interested in becoming a GRC analyst at Ping, this is your chance. Give me a note on Slack if you'd like to talk about it, or just go ahead and apply on the website. If you don't want to be a GRC analyst, Robb, Honeywell is looking for an information system security officer. Bank of America is hiring a cybersecurity analyst.

Facebook is hiring a network security engineer for detection. Sounds like a pretty cool job. You get to work at Facebook and maybe stop the Russians from taking over our election. That'd be pretty cool. The Colorado Judicial Branch is hiring a system security engineer.

NREL is looking for a cybersecurity analyst. NBCUniversal is hiring a cybersecurity platform engineer focused on DNS. Zoom is looking for a senior security analyst for threat hunting. Strive Health is hiring a cloud security engineer. And Pearson is looking for an intern for security engineering.

Pretty good stuff. Well, Alex, I think that is it for our news this week. And we, like I said, we don't have a feature interview. So do you, do you have any monologues you'd like to give in the time we have left? Um, fourscore and seven years ago.

Yeah, that's it. That's my monologue. You have 4 fathers? Yeah, is that what comes next? Something like that.

Cool. All right, well, good stuff. We're looking forward to getting another interview here in the next week or two. And of course, reach out to us if you have anything we can do for you. With that, we'll talk to you guys again next week.

Thanks, Robb.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, calendar of upcoming security events and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.