Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 196 for the week of February 1st, 2021. 2/1?

Is that the date? 2/1. That's pretty exciting. 2/1/21. 2/1/21.

And Alex, we were just talking, we're within shooting distance of our 4th anniversary. Next week's going to be 4 years for us. I know. It's pretty incredible. You know, I knew we'd go for a long time, but, you know, 4 years still seems like a long time.

Yeah. I haven't done anything for 4 years. That's pretty, pretty long time. Big commitment. Yeah, I'll let Kristen know about the, uh, 4 years.

Um, but yeah, she doesn't listen to any podcasts. Good thing, good thing. Um, you know, some exciting news for me, Rob. Um, this week, um, I purchased a pop filter for my mic. So, oh, maybe people will notice there's not as much hiss or, you know, me smacking or, you know, other things like that.

So I don't know. Well, I'd love to hear people contribute in the Slack community. Let us know, is Alex's mic doing better? Does he sound less poppy? Yeah, is that a good thing or a bad thing?

We'd love to hear from you. Yeah, exactly. Speaking of other big news, we have a Slack community where people can talk to us. We do. Not only can they talk to us, but they can talk to each other.

There's lots of people there, great conversations. If you're not in there, you should be there. So go to the website colorado-security.com and join. Yeah, there's, there's now 7,772 people. Wow.

Yeah, that's way more people than I can keep track of. We might get to 1,800 by our 4-year anniversary. Hey, let's see. Bring a friend or two. Invite them to the Slack community.

Speaking of things that we do, we have a mailing list. While you're on the website, colorado-security.com, you can sign up for our mailing list and get deep thoughts from Alex Wood sent to you every Saturday or Sunday or Monday. Yeah. Also, we'd love it if you rated the podcast and subscribed wherever it is that you get your podcasts from. You know, that helps people know that this is a good podcast, not just, you know, 2 schmoes talking.

And, uh, then, and you get the, uh, the podcast delivered to your player every week without having to do any work. That's our new tagline: not just 2 schmoes talking.

Do you think that we could get more people to sign up for the mailing list if you did offer to put like poetry in there each week? You know, I could like hide something in there and You know, like Where's Waldo, figure out what it is I put in there. I think, I think we're onto something. I think we are. Maybe for our 8th anniversary we'll do that.

Good idea. Put that down as a note. We'll do that in 4 more years. If you're thinking to yourself, man, this content is so good, I can't believe I get it for free. Well, you don't have to get it for free.

There are people out there, there are patrons who help support us and keep this whole movement going forward. If you want to join that, that crew, you can go out to colorado-security.com, click the Patreon button in there, and and help support us and offset some of the costs of doing this, this fun podcast. Yeah, and after this intro, uh, clearly all of them are regretting their decision, but thank you to our patrons who are sticking with us. Thank you anyway for our terrible performance. Yes.

All right, well, with that, let's get into some news. So, so Alex, every week we get this lineup of news that we're like, man, how do I pick the best 10 stories out of all this great news? And this week, um, this week it was even more difficult than ever to pick the best 10. It was, it was very difficult to pick the best 10. And so difficult, in fact, that we only picked 9.

Um, the only 9 that I wasn't embarrassed to talk about today. Uh, so first, uh, you know, Rob, did you know that Colorado is one of 2021's top 5 states to retire in? So I'm, I'm not surprised because I know it's awesome to live here. I was a little surprised by some of the other top 5 though. So number 1 is Florida.

Which I think everyone would say, yeah, of course, Florida. That's where people retire. Number 2, where everyone retires if they don't go to Arizona. Number 2 is Colorado. Arizona doesn't make its way on the list.

Number 3, I mean, we all know this was coming. Delaware was number 3, followed closely by Virginia, and of course, the number 1 retirement community, North Dakota. So, you know, I'm gonna keep this family friendly and not curse, but F no. We are not retiring in North Dakota.

Not happening. Every time I think of Delaware, I think of the Wayne's World skit where, where he's, he's all of a sudden put in Delaware. He's like, I don't know what to say. We're in Delaware. Look at me in Delaware.

I have nothing to say about Delaware, good or bad. Yeah, well, you know, if you live there, it'd be easy to form your corporation there. Because that's where everyone forms their corporations for some reason. Well, so because the law is there, but we will say this is a story from the Denver Post, uh, and it's going through some of the criteria that was, that was used to pick the place to live. Denver did great on the healthcare side of things.

Um, uh, good, uh, number 6 for life expectancy, number 6 for death rate of population age 65 or older, uh, with number 10th for COVID positivity test rating in the past week. So some good healthcare stuff. This whole list seems a little fishy to me. But hey, we needed some news to talk about this week. Yeah, me too.

You know, how can you have an annual survey that one of the criteria is positive COVID-19 positive testing rate in the past week? I mean, like, every week of the year you're gonna have different ratings. It's a point in time. Point in time. Yeah.

Hey, let's look at our next big news this week. You guys are all familiar with Purina. They're the, the company— it's actually owned as a part of Nestlé. They're headquartered out in St. Louis, although they do have a big Purina plant here in Denver. But Purina does a startup accelerator Investment Program.

I had no idea. Or as a part of its Pet Care Innovation Prize contest. Yeah, pretty interesting. You know, you got to have some innovation in the, the pet care field. And one of those folks that they just announced to be part of the, the new startups in that class was a Denver company called ClueJ.

They have developed an online diagnostic platform to help dog and cat owners order lab tests without going to the vet. Um, so I can tell you, having recently gone to the vet for lab tests, they are expensive. Um, I really hope that ClueJ, because of their online platform, makes those a little bit cheaper. I would be totally down for that. I, I love it.

It's— congratulations to ClueJ for getting there, and we look forward to covering them for many years as they make lab tests for pets all the better. You know, Rob, uh, the second most interesting thing in the story is I had no idea that Purina was owned by Nestlé. Um, I think, you know, I think I might have heard it somewhere, but if you put me on the spot, I wouldn't have remembered earlier today until I read the story. Yeah. Uh, next, uh, some other startup news.

Conga has appointed Grant Peterson as their new Chief Product Officer. Uh, so Grant had a spectacular career where he was the CTO for DocuSign for 12 years, and then in 2019 he retired and had been doing some consulting work for Conga. And the mission there at Conga was so compelling to him, and he came up with some great ideas. They said, hey, why don't you come on and be Chief Product Officer? So do you know what Conga does?

Could you summarize that?

I think that they— I don't know what they do. So I have some ideas. I'm not positive, but the commercial operations suite, I think it's basically helping, you know, with CRM-type work, interactions with customers, kind of a customer-facing platform, something like that. And we've had a couple of friends of the show as security folks over at Congo over the years. Sure.

I don't know that I ever really like dug into what they actually do. It does sound like they have a good culture over there though. They have something they call the Congo Way, which is how they do everything. And so Grant is very excited to be part of the company and figure out how to be part of the Conga way. Uh, good stuff.

Congratulations to Grant and to Conga for finding their new Chief Product Officer. Next, we have some not quite as nice news. A local Denver-based, um, dating site called MeetMindful, um, had a— I don't know if it's fair to call it a breach, it doesn't quite feel right, but there is a, uh, a leak of 2.28 million registered users on their dating site who have been leaked out into the web. So I'm just curious, if we're not calling it a breach, what do we call it? Well, I thought, you know, I'm not sure if I read it right.

I thought maybe that they— it wasn't someone leaked it, but someone just shared it inappropriately. Oh no, somewhere down there they talk about a— that they were attacked by a well-known hacker. Oh, so I would call this a breach. Okay, fair enough. I was thinking it was one of those like, hey, I put it on a public file share on accident type of situations.

In any case, there was a lot of data that was put out there, however it may have happened. Um, I think one of the positives is, uh, there weren't plaintext passwords. However, there were encrypted passwords and other credentials, uh, last names, emails, some account details, addresses, that sort of thing. Uh, so, you know, all in all, not a good thing. Yeah, so this is interesting.

I don't know if you got all the way to the end where it stopped talking about the technical details, and then the, the writer was just like— he just like started hammering the company, man. Yeah, so it was really interesting. He's like, hey, this is an interesting breach, you know, details about the breach, blah blah blah. And he's like, and by the way, like, I can't tell anything about this company. And are there actually people dating on this site?

As far as he could tell, there was like no movement on the community, no one talking about it. Like, where did these 2.28 million people come from? Yeah, well, he also said that he wasn't sure if the site— if they were still active, right? That they hadn't posted on social media in several months.

They no longer allow you to create a user ID using Facebook. Some other things like that. But I think that there was some statement that, uh, you know, apparently they still are active even though they're not promoting themselves very well, apparently. Yeah, maybe this is like the, uh, a laundering site for, for whatever. It's such a front.

Uh, good stuff. Hey, but that's the end of that kind of news. Let's jump over to our, uh, to our security news. Well, I think we have some— I'll call it good news for, uh, for some Colorado-based companies. Uh, we got a couple stories in a row here.

Uh, the first one, Route 9B down in Colorado Springs, has been acquired by Deloitte, um, and Deloitte is going to be bringing them into the fold with their, their current cyber operations, uh, to help bolster their cyber threat hunting capabilities for their clients. I think it's a, it's a perfect fit. Deloitte has, you know, they have a great practice, especially in the defense side of things. Um, Route 9B has a really strong defense background. I think it's going to be a good fit for both.

Um, it always felt like Route 9B is kind of a little squishy about existing exactly what they do, and I suspect that within Deloitte they're going to get some really nice definition on that, and those folks are going to be able to serve their customers all the better with lots of resources. Yeah, that'll be pretty cool, and I know there's a lot of quality people at Route 9B, so I'm sure it will add to the capabilities that Deloitte already has. The next article does also talk about this story, but also a second acquisition Uh, but unrelated, uh, Chairwell, which is an ITSM company based down in Colorado Springs, they were also acquired, uh, with a little bit of a security spin to it. They were acquired by Ivanti. Um, they're an IT automation platform, but Ivanti is the company that not too long ago acquired, uh, who was it?

I know it was Pulse Secure and, uh, It was one of the device management companies. Anyway, MobileIron. MobileIron, yes. Yeah. Um, so, you know, Ivanti is apparently on a buying spree and, and picked up Sharewell.

Yeah, congratulations to them. Sharewell, you know, they, they're a big competitor to ServiceNow. I think ServiceNow is the one everyone knows, but Sharewell has really done a good, good job growing, and, you know, we'd love to see those Colorado-based companies, um, doing well. I'm excited for this news. I'm hopefully that it doesn't yank too much of the talent out of the state.

But, but I think it shows that they're winning. You know, Sharewell had raised more than $225 million in capital. So they, you know, they obviously grown pretty big. And hopefully this is a good exit for both their, both their investors and their employees. Yeah, there wasn't a price noted in the article.

So hopefully it was a good exit. I feel like sometimes when they don't put the the buying price, then maybe it's not as good as they wanted it to be. Yeah, having, you know, having been through a couple of acquisitions, I can say that there's, there's all kinds of reasons, both good and bad, for why you can't share those numbers. Um, yeah, uh, and, and it's just, it's just hard to know for sure, right? Uh, next we have a blog post from Red Canary.

This was an interesting one. Um, it's the, the headline is, uh, Hindsight is 20/20: Gearing Up for the Threat Detection Report. Um, and when I first read it, I'm like, well, what What do you mean you're gearing up for this report? You have it or you don't. And really what they're telling us is, hey, this threat detection report is a big thing that they do on an annual basis.

They take all of the malware or, you know, attacker notifications that they have through their EDR solution, MDR solution, and they put together some metrics and some reporting around what are the trends, how are things been changing over the last year? And they're basically letting us know in this blog post, number one, that the way that the taxonomy that they're using is changing as MITRE is changing MITRE's taxonomy, but also they gave a little bit of a preview onto what, what some of the findings are going to be this year. Yeah, it's a— it is a pretty interesting article. Some of those preliminary findings are talking about scheduled tasks, which apparently were big on their list of threats for last year, as well as PowerShell, which, you know, the second one is definitely not a surprise to me. If you're attacking a Windows system, you're probably going to use some sort of PowerShell as part of that attack.

Um, but, uh, but yeah, that was interesting. And then they talk about some specific threats, uh, that are out there as well. Yeah, I, I would say, you know, this blog post to me, it's, it's not only just about the threats, it's also kind of about the way that Red Canary has evolved over the last couple years. Um, they have invested a ton in their threat intelligence building, and they're, they're really working hard now to, to not just be the, the people managing software, but to but to give insight into the bad stuff that's happening with these attackers. So I found that really interesting, and you know, they're, they're doing a lot of good stuff.

So I'm excited to see the report. I'm looking forward to the report whenever it comes out. All right, next we have a Ping Identity blog post entitled The Enormous Costs of Identity Theft, and this is by Richard Bird. Some interesting stuff in here talking about identity theft in general, and you know, his chat with Eva Velasquez who is the CEO of the Identity Theft Resource Center. It sounds like Ping now has a podcast, Rob, called Hello User, and this is part of that.

Yeah, it's, it's an industry podcast. Richard's, Richard's been running it for, you know, kind of helping Ping run it, but, but really it's an industry podcast. It's definitely not a salesy thing at all. This is just his way of trying to get, you know, more involved with the identity space and hopefully bring some interesting interviews around identity to the larger group. If, if you have any interest in identity, I think it's a pretty good thing to take a look at.

For sure. All right, our last story here this week is kind of a follow-up from ISC². You know, the ISC² Denver chapter had been pretty dead for what, like, you know, basically a whole year during COVID and they've come back with a vengeance over the last month or so. You know, we mentioned that they were coming back and they were having a meeting. I think their meeting was last week or the week before, and they posted a blog in the last week kind of giving a summary of that meeting, and now they're also giving a blog post around these new ISC² communities, which is a function, I believe, of ISC² International that you can use to really socialize with other folks both internationally and within the Colorado community.

Yeah, and I think one of the interesting things there is that these— the ISC community is not just for ISC members. So non-members, if you're a certification candidate, and others can join those communities and, you know, collaborate, exchange knowledge, things like that. So sounds like a really great resource that ISC² provides, again, not just to members but to the general community. So ISC² has been a big topic on the Slack community over the last week too, but, but I hear you laughing because it's mostly been people complaining about how bad their CPE process has become. Yeah, maybe they should spend more time fixing their CPE process than building communities.

But yeah, there you go. If you got your CISSP, you know what we're talking about. Exactly. All right, that's it for news. Jumping over to the Slack message of the week, I want to give a big thanks to Andre Gaeta.

You know, Andre has been sponsoring this for us for forever, and we really do appreciate it, Andre. Thanks for doing that. Each week, he— I did— we identify one person who contributed to the Slack community who we want to, uh, who want to recognize, and Andre will buy that person one item of Colorado Equal Security swag from the store, up to a $25 value. Yeah, and our winner for this week is Grant Sturgis. There's actually a discussion that was started, I think Douglas Brush might have started it, but it was about strategic planning and leadership.

And in that discussion, Grant posted an article that was about 12 leadership lessons to learn from Navy SEALs. And there are actually, you know, some pretty good takeaways in there. So I thought that was a good part of the discussion and wanted to reward Grant for that. So congrats, Grant. Awesome.

Congrats, Grant. Hopefully we see you wearing some swag next time we run into each other. Most definitely. All right. Moving over to events.

I'll remind you we have a calendar of events on the website and things have been filling in lately. You know, the first part of the year things were a little bit quieter, but now there's quite a few things going out there to maybe April or so. And we, you know, we'll go through the few items that are happening in the next 2 weeks right now. First on the list, Colorado Springs Cyber is doing their First Friday. This is a virtual event on February 5th.

I think you can just come to that and, and meet some folks doing security in the Springs and not— no expectations that you're a member of anything or you're paying anything. Might be a good time to go to that since it's virtual and you don't actually have to go to the Springs. There you go. Next, ISSA Denver has a February chapter meeting that's happening on the 10th. That's also virtual.

Of course, everything is virtual on the list. ACES is doing their Women in Security Coffee Chat with Chris Frucci on February 11th. You see how I made you say ACES this time so I— yes, so I couldn't do it. ISIS is having their meeting for— anyway. All right, that's it for events.

There are more events coming up, like, but those are the next 2 weeks. Let's jump over to jobs. You know, each week we like to highlight some of the jobs that we think are interesting in the community, or self-servingly, jobs that we are hiring for at our organizations. And speaking of that, at Ping, I'm hiring a few positions right now. I want to start off by talking about my security program manager role.

This is the role that, frankly, I work the most closely with in the whole department. We get together just about every day and go through what are the initiatives we're working on and making sure we've prioritized appropriately throughout the department. Looking for someone who's got some project management, program management, BA experience, or, or one of those 3 plus security background. That's what we're looking for. That person will also be a manager managing the business analyst for the department, and that's another position we're hiring right now.

We're hiring a BA focused on security. Reach out to me on either of those. And finally, we're also hiring a couple of product security engineers, so looking for folks who have a background in development and a passion for security. Kind of more important that you have development chops than you have security experience, although we definitely want to see someone who has an interest in security and wants to help bring security to the SDLC. Good stuff.

All right. Laras is hiring a principal penetration tester. Nordstrom is hiring a director of vulnerability management. Clean Shelf is looking for a junior security/IT operations analyst. The CISO over there, Michael Lyons, has been really active on the Slack community, so if you wanted to learn more about that position, I think you could probably send him a note directly on the, on the Slack community.

Good idea. JumpCloud is hiring a security engineer focused on incident response. It seems like JumpCloud is hiring like crazy. They've had a lot of job posts. They have, and they are, they're raising a lot of noise in the fact that they are also paying really, really well.

Those who are looking might want to take a look at those. Check Point Software is hiring an AppSec architect. And finally, Arrow Electronics is hiring a cybersecurity systems engineer, uh, slash eDiscovery analyst. Yeah, that one looks interesting as well. Um, this one partially made the list because when it was posted in the jobs channel on Slack, uh, the poster called it an eDisco analyst.

I would love to do eDisco. It's the new version of disco. All right. Yeah. You know, it's, it's COVID disco.

It's virtual, virtual dancing. I love it. Hey, well, that is it for the news. Good news is we do have an interview this week. Um, big thanks to Jason Jaques for, for getting this interview.

But we have, uh, we, we have a follow-up interview with Chris Roberts. We haven't had Chris on the show for, um, it's almost been the whole 4 years. We had— he was one of our early, uh, early guests back in 2017, and we have him back on talking about all the many things that have changed since the last time he was around. And Chris is always very exciting to listen to, so this is one you should definitely check out. Yeah, good stuff.

Well, Alex, I think that's it for this week. We'll look forward to the big celebration next week, and hopefully when we get together next, we'll all be wearing party hats and drinking champagne and celebrating being 4 years old. We can real disco instead of eDisco. I think we should do some real disco. Yeah.

All right. Thanks, Rob. Have a great week.

This is Henry Yu. I have security for Red Rock. Welcome to Colorado Equal Security, the podcast for security professionals by security professionals.

Hello, Colorado Equal Security. This is Jason Jaques. I had a chance to interview Chris Roberts for his second appearance on the podcast. Here's the interview. Enjoy.

Thanks for joining me on the podcast. It's great to have you back on the Colorado Equal Security podcast. It's— you were episode 14. Oh, no way. Holy smoke.

Yeah, 3 and a half years ago. Sheeey, what a lot has changed since then. A lot has changed for sure. The, the interesting thing about this particular follow-up interview is that I have crowdsourced almost every question. So, yeah, so it's kind of cool.

Oh, this will be interesting. Yeah, yeah. So it's got to be, it's got to be cool that, uh, you know, people are interested in what you're up to and, and how you're doing these days, and, and they've got questions for you. Oh, that's kind of cool. I always like that.

It's fun. It's, um, it's really interesting. I mean, you know, it, it, I've done a lot of stuff. Obviously this last, you know, year and change has been interesting because for all of us But it's, um, I spend a bunch of time on LinkedIn. LinkedIn, less Twitter these days.

Bunch of time on LinkedIn just hanging out, talking to people, throwing a lot of stuff up there on a pretty regular basis. Yeah. And I spend so much time on Q&A. Hi, how can I help you? You're talking to your dog?

Oh yeah, totally. That's awesome. Yeah, he's pretty much so. He just comes and sticks his head in. And let's face it, he's almost at eye level half the time, so I've almost got to pay attention to him.

Yeah, yeah. Well, it's interesting that you bring up social media and LinkedIn because we are connected up there. You've got a ton of followers on LinkedIn. And, you know, I see a lot of the content that you post up there. It's really creative and interesting.

And thank you. My question is, how do you come up with the stuff you come up with for LinkedIn? I— whatever. And it literally is whatever muse is looking over my shoulder. I am eternally grateful for.

More often than not, you know, I'm very fortunate. I get to talk to a lot of people even still today. So be it things like this or be it like the Security Shit Show stuff that we do or just general talks with people on email or even just over LinkedIn. And more often than not, something will trigger, you know, an idea, a thought will trigger, something will happen. Perfect example, we were talking last night and we had a long conversation about certain bits and certain topics.

And so I'm like, you know what, I'm going to put something together on this one. And I said to them, I said, hey, do you mind if I just run with this a little bit more? Because the 3 of us came up with that. I said, do you mind if I run with this? And they're like, no, have at it.

So that's one area is typically where it sparks from somebody else. And I'll be like, hey, do you— from riffing back and forth. So I'll come up with it that way. Sometimes, honestly, simply the news. I'm looking through the news.

I'm watching the news. I'm seeing what's going on. And I'll see a focus or an area where we're charging down. My junk inbox. Is another source of, of media material.

You know, the everything from, you know, the, the Nigerian prince who's trying to continue to give me money, and bless his little cotton socks, all the way through to the other one I put up the other day, the, hey, uh, you've been nominated for the CISO of the Year Award, we'd love to continue this if you wouldn't mind a small donation of $1,200 towards the cause. I'm like, you know, and Any of that kind of stuff is a huge one. Um, some of it honestly just comes from just sitting down and thinking, you know, casting the mind back into all the stuff I've done in the past, things that I like in the industry and things that drive me nuts. And I, you know, it's— I'm whatever the— whatever it is, I mean, I'm ridiculously fortunate for whoever's keeping an eye over the shoulder on that one. Good stuff.

Um, but you, you mentioned you don't use Twitter too much anymore. I I've found it fascinating, the evolution of Twitter, especially over the past just couple of weeks.

Yeah, what's your thoughts about where Twitter ultimately is going? And oh man, it's a shame because it used to be just a really cool— it used to be nice. It used to be collaborative. We used to have a lot of fun on there. There used to be a lot of good feelings and good thoughts and good interactions.

I mean, there's still interactions. And I think behind the scenes and in direct messages, I still have some good conversations with people. But I mean, for the most part, I mean, it's almost, it's almost like one of the most depressing places to go on to these days. Yeah. You know, I have literally gotten to a point where I won't post any exploit stuff on there ever anymore.

Rarely, if ever, will I post anything that I'm doing that way. I reserve that definitely for other channels these days, not even LinkedIn. I typically won't even talk about any of the exploit stuff I'm working on on LinkedIn. Rarely will I say too much about the industry apart from, you know, when we're doing podcasts and shit shows and stuff like that. I'll say some stuff on there, maybe a little bit about the industry, politics, whatever your belief and flavor or anything else is.

I mean, talk about a battlefield slash minefield. That's a tough one. I've posted a couple of things up, but not a huge amount over the years. Most of the time nowadays, it's bloody dogs. You know, I'll post pictures of the dogs.

Or, you know, I put it— I put a nice one up on the car. I was out in one of the cars the other day up in the hills, and, you know, I just took a picture of that. And I tend to keep it very, very, very non-confrontational because too many people have taken too much advantage of the level of anonymity that Twitter gives you. Yeah. And you can't fight back.

I mean, there's nothing you can do. And unfortunately, I do take shit. I take it to heart whether I should or whether I shouldn't, and I take it to heart, which is you know, I tend to like these kinds of interactions or the things like LinkedIn where, you know, I can see people coming and I can block them and do the things and, you know, I can confront them if they've put a legitimate ID or a legitimate account up there. But yeah, my, uh, my thought on Twitter is, and I'm curious your take on this, is, uh, you know, if they forced everybody to be a verified user and everybody to have their real name there would be a lot less trolling going on. And a lot— oh my gosh, yeah.

I, I mean, this is the interesting part about it, and, you know, this is— the last couple of weeks have highlighted this. You know, I've been part of a— I've been, I've been digging into, to the folks that, that stormed the Bastille, let's just put it that way. And anonymity— I mean, we all, we all know that anonymity was on shaky ground as it was anyway. And your ability to remain anonymous, especially when you're in the physical world conversing with the digital world, has pretty much all but disappeared. Freedom of speech does not exist in the digital world because you're always on somebody else's property.

And to your point, I mean, it's huge. It's— I am of the opinion this day and age is if you want to have a conversation with me, I kind of want to know who you are because I don't want people hiding behind behind— we do again, same thing, we do the podcast on YouTube and there's people on there I kind of recognize the name. But again, same thing, I really wish they had their legit real names because I kind of want to know who's making comments. And thankfully everybody there is pretty damn civilized. But I want to know, you're going to insult me, I want to know who the hell you are.

You don't get to hide behind a shield of anonymity from halfway around the world anymore. It's like, you know, it's the F you kind of mentality. Right. That's— the internet, for one bad thing, has given us the ability to hide and insult and run away without any consequences, and I have no love for that part of it. Yeah, I also find the bot issue to be a problem.

I really wish Twitter would disallow the usage of bots. Yeah, God, same thing. The only thing I think would be useful, and I've messed around with it a little bit, Um, we've looked at, uh, we've looked at like Hootsuite and a couple of those other things, the ability to like post stuff in advance, which is useful if I know I'm going to be heads down on something, to be able to actually drop something ahead of time. That I kind of like the ability to do. But again, it's still got my name associated with it.

So if I come up to you and I, you know, I call your, you know, I insult you in the, you know, your mother smells of elderberries and you've, you know, that kind of stuff, then at least you know who the hell it is. Right, right. Well, so my question to you, again, almost everything's crowdsourced, but I do have a question. So you, you and Rob were talking about on the previous episode, you know, your lengthy adventures of taking off and traveling and hiking. So in the past 3 and a half years, have you done any more of that?

Not a huge amount, unfortunately. Mostly, I mean, just normal work-related travel. I mean, I've been fortunate. I obviously this last year discounted somewhat, um, but for, you know, 2018, 2019, I was bouncing all over the world, literally. Um, I mean, there were a couple of times when I would fly from like here to— I'd go from here to San Fran, San Fran out to Japan, Japan down to Saudi— oh, not Saudi, um, to like Oman, Oman to Dubai, Dubai to Kuwait, Kuwait to India.

India. And I'm doing these kinds of trips on a ridiculously regular basis for various folks. So I mean, a ton of that. I mean, I think last year before last, so 2019, I ended up 50, just over 50 trips, of which about a third of them were international trips. Wow.

Yeah, it was pretty busy. 2020, I, in 2020, I mean, I was on track for 50 or 60 conferences. I ended up doing more. I think even just in like the last 7 or 8 months, I did almost 60 because a lot of the podcasts kind of stuff and a lot of these kinds of things, which is actually way easier. Yeah.

Um, but I was on track for another, you know, 50 or 60 trips last year. Um, do you miss traveling?

I miss seeing people. Um, you know, I, I have some amazing friends, you know, I've got some amazing friends, family basically, you know, in Israel, in Japan, you know, in Dubai, in Kuwait, all over the place, you know, the African continent, some amazing folks over Europe, obviously a family over in Europe as well. So I miss seeing them. Um, I miss seeing people in this country. I mean, there's so many people I've been fortunate to get to know and get to talk with in this country.

I mean, you miss getting a hug from somebody, to be perfectly honest, right? I don't miss, you know, hours sitting in a tin can. You know, there was— I was very fortunate on— I've pretty much put my foot down, anything international is business class these days. Sometimes I've got to pay for it, sometimes the organization pays for it, or whatever else it is. So I'm pretty fortunate that way.

So at least when I do have to travel a long time, I get at least get looked after. So I kind of miss the pampering. I gotta admit, there's, there's something nice about to walk onto a plane and, and, you know, be sat down in one of these pods and just be able to just kick back. But there's also— and, you know, especially when you're in the Emirates, when you get up and you walk towards the back and there's this big bar area and all that crazy shit, I mean, that's, that's something surreal as well. It's kind of cool, it's slightly surreal.

Um, I don't miss— I don't miss some of the airport experiences, you know. There's sleeping on the floor in airports because of things not going right, or, you know, all that kind of crazy shit. I'm like, my ass is getting too old for that, you know. I crossed 50 last year, so I am getting to the point where that's, that's getting a little bit old. Yeah, yeah, I'm right there with you.

Congrats on, uh, crossing 50. Yeah, so it's, you know, it's, it's a mixed bag, you know. Probably like a lot of us, we miss, we miss the closeness and the camaraderie that physically being together. You know, like GherCon, perfect example. I mean, that was, you know, we were lucky we got to do the Rocky Mountain InfoSec one February last year, and I think that was the last big one.

I'm not sure if it was before or after RSA, I'd have to remember. So that was really, I think it was one of the last ones. Um, and after that, it's, you know, it's all been virtual stuff. The other thing I do want to ask you about, so On the, uh, on the previous episode, you were with a company at the time called Alcalvio. Yeah.

And a lot's changed. You're now with, um, there was something called Hillbilly Hit Squad and also Cyber Ed Board. What are these? Can you— Yeah, so actually Hillbilly Hit Squad's been behind the scenes since, God, 2014, 2015, something like that. We've So it's actually— it was, it was— it's 3 or 4 of us, um, but it's actually more of us now, which is kind of scary.

So there's 3 or 4 of us that have always had it, primarily Jesse and I and Swede, and Brett was in there as well. Brett's taken a step back just because Brett's taken a step back. But you've got Jesse, who literally is the hillbilly of the group. You've got Swede, who's the Native American, um, who if we need to, we can literally throw him over a fence because I think he weighs maybe 100 pounds soaking wet. I mean, he's an amazing and So you've got these 2 counterbalancing, you know, the great— the window-licking lunatic that I am.

So we're running this, and we've been having it as research. So all the research stuff that we've done on, like, shipping and the aviation stuff from years ago and cars and pretty much anything along those lines has all come out of, like, the Hillbilly Hit Squad side of the world. Now, what we ended up doing when I left the Calvi, I went to Ativo, which was an interesting one because I go from, you know, one deception company to another deception reception company. Um, and, you know, Ativo, a little bit more organized, a little bit more sorted, kind of got the shit together. Tony Cole was a good, very, very good friend, and he's, uh, he was my boss over there.

Fantastic guy. Um, but I hung out with them for around a year and a half or so, but honestly, in the end, it just— I came to blows with the marketing department too many times. Um, they were focused on basically chasing false trophies. And all that shit. And I don't believe in that.

And I called them on it more times than I care to. Got to a point of friction. I'm like, okay, I don't need to be dealing with this. I don't need the stress and hassle. So I popped smoke and exited.

And that was, you know, I did the great thing. We— Tony and I talked late 2019 about it. Uh, I got to RSA and I'm like, I'm done. And, you know, so we got quit March or April or whenever it was, right, right as the pandemic was hitting. So that was a smart move on my part, not, but, um, walked straight into HHS because we basically, we moved it out of the shadows basically into more mainstream and started doing virtual CISO work, some assessment work, a lot of consulting work.

Um, yeah, and doing some high net worth clients. And, and now we've got the Dave product. So we just launched that pretty much so very, very recently, and we're just running it into a bunch of of places. So it's kind of cool. We've got Dave.

Okay, so was it always called Hillbilly Hit Squad? It was always called Hillbilly Hit Squad. Yeah. Okay, so what happened is after all the Al debacle and that shit show, um, I had Sentinel Global. So Sentinel Global was one that, again, same thing, it had been hyping behind the scenes.

Well, we fired that up officially, and then, uh, Calvio came calling wanted to buy Sentinel Global. Literally, it was like 8 months after, after all that shit, Accalvio was like, hey, we want to buy it. So what they ended up doing is they bought the assets of Accalvio, and I went along and a couple of other folks kind of came along. That kind of worked out, kind of didn't work out. And then obviously Ativo.

But behind the scenes, we still had all the research stuff going on, so we ended up forming Hillbilly Hit Squad, and off it went. I mean, we have, uh, just, uh, it hasn't sprung yet, but we're talking. So might as well have some fun with it. So we've decided also, I like my watches. So I've got a fair few nice watches.

And I've gotten to know the folks in town here called Right Time. For any of you that are up on your watches, there's an amazing— they got 2 stores, one on Colorado Mills and one down south on County Line. Freaking fantastic people, family-owned, family-run, seriously effing cool stuff, used and new stuff. And so we've been talking with them and other things, and I got to the point where I'm like, you know what, I'm going to start up a watch rental business. A couple of places have done it.

So we're running out of Hillbilly Hit Squad, and we've taken horology, the study of watches, we've shortened it down, we've H-O-R-O, and we're going to start up the Horror House.

So horology house, but we're going to call it the Horror House. And so we started up the Horror House, and you can come along to the Horror House And you can rent Ruby for a month. And Ruby is, you know, like a Rolex or a Daytona. Or, you know, you can rent Star for the week or for the month. And that's the Omega.

And we're going to basically— we're going to have some fun with this shit. Oh yeah. Just going to have some fun with it because there are a lot of people that enjoy watches. Buggers can get expensive. So you can rent it for, you know, you can, you can do the subscription model or you can rent it for, you know, 3 days, 7 or 14.

And yeah, we're just going to have some fun with it. It also justifies the watch collections, kind of how we look at it. But yeah, so again, lighthearted, you know, this industry is too serious on itself too often. It's like, let's, let's have a little bit of fun but still get the point across. Yeah, yeah, yeah, that's, that's interesting.

Yeah. So tell me about Cyber Ed Board. I see that as well. Yeah, so they approached me. There's some really good people, there's some really, really good folks on it.

And again, it's, it's really about getting education to our industry. There's a lot of conversations that we have, you know, so Steve King is one of the founding drivers of it, and there's just some amazing folks on it, and I've done a lot of stuff. Cyber Theory is part of it, and they've just been driving this whole concept of education. There's another one I'm on which is like the mentorship project as well. JJ Snow and a couple of others dragged me into that one.

And for me, it goes back to this education thing. It's like, look, how can, how can people learn from my mistakes and not make the same ones? How can, how can we get more people into this industry in a way that they are more useful immediately rather than, rather than a lot of the stuff that's coming into the industry, unfortunately? How do we help people understand that, you know, there are apprenticeships out there, that you can come in here without having to spend $100 grand on a degree or $20 grand on a training course? How do we do this?

And so that really the cyber, the cyber stuff is a lot of what can we do to help people around us? What can we do to help new people come in? How can we talk to schools, all that kind of stuff? So it's really collaboration. There's a lot of us have got feet in other places.

Like I do a lot of stuff with Wiser and Wiser Training, so I can bring the Wiser Training because a lot of it's free. So, you know, my mom wants to learn about why the hell I do things in this industry. I can kick her off to Wiser and she can go, oh, well, that's why I shouldn't click shit, or that's why I do this. And so we're all trying to bring pieces of the industry we already know, bring it together, and just kind of glue everything together and give people more opportunity. Okay, yeah, very cool.

So let's, uh, let's dive into some, some questions, shall we? Yeah, so, uh, who do you look up to in the security industry? Oh, a lot of people, actually. A heck of a lot of people in this industry. Um, I mean, there's this— that— oh God, I mean, there's so freaking many.

I think I look up to a lot of people. Uh, Gary Hayslip is probably one great example. Um, we'll talk about Gary for a second. He and I are actually going to be on a talk in a couple of weeks' time. Um, I look at what— I look at him and how he's been able to very successfully build his career, build himself as a CISO, write a couple of books as well, all while balancing one heck of an awesome career.

I mean, he's the CISO over at SoftBank, and I mean, they're freaking massive. And so you look at— and he's still a complete goofball when you want him— well, when he wants to be, he's a complete goofball, and I love that. He's got that balance really well. He is somebody I would put, you know, you could send him into a board of directors and they would listen effectively without any of the— you know, I walk into a board of directors and they think half the time they think I've walked off the freaking street, and, and, or am I going to eat them? You know, the big hairy thing, is that again about to get eaten, or are they about to get leg humped, or, you know, what's about to happen?

Whereas Gary walks in and he's very civilized, very eloquent. And so it's, it's really interesting that way. So you've got somebody like that So I look at Gary that way. Then you look at— I mean, there's so many other people. So Limor is another one.

She's over in Israel. And you look at her and what she's been able to do inside IBM and around IBM. Single parent, you know, this amazing lady just burning with passion and with fire and always seemingly always out there. And yet she's, you know, she's got the rug rug she's dealing with at the same time. And so You know, you look at everything that Limor's doing.

Kathy Ullman is another one. You know, she came into this industry not a crazy amount of time ago and has steamed an amazing path. I mean, there's, there's so many. I mean, you know, that my 2 co-presenters on the Shit Show, you know, I look at Evan and Ryan. Evan especially, I mean, he's had FR Secure for more years than I care to think of and successfully hasn't bloated up.

Hasn't screwed it up, has remained true to who he is. You know, that, that's tough in this industry. The lure of money, the lure of investment, the lure of all the shiny shit. He's trodden a very true path. And, and so you look at that, you know, Nickerson is another one.

I mean, you look at Chris, um, I mean, you know, Chris can be a polarizing figure, kind of like most of us, let's be honest. You look at what Nickerson's done, you look at what Chris has been through from personal and family and everything else, and he managed shit he's gone through as well. Yet you look at what he's done with the company, you look at how he's done on the personal side of things. Luke is another one, you know, you look at Luke and I mean, there's so many amazing people in this industry that not just have been out there, have gone through the amazing amount of shit, but are also able to look back and learn from what they've done and are amazing at actually giving out so much information. I mean, there's— yeah.

I feel like you could go on for all day. Oh my God, I mean, this— I'm so— I'm fortunate because there are just so many amazing people I'm around. I mean, okay, actually another— JJ Snow, perfect. Actually, there's another one. So JJ Snow runs— she's the C-Something over AFRL.

Just this amazing lady. Just, you know, you've got somebody who is career Air Force, has been there, done that, seen it all, deployed all and everything else, has an amazing, amazing insight into our industry, has so many good people that you can talk with, has some fantastic conversations with her, and yet half the time she's posting goofy fun shit on LinkedIn. Yeah. And you're like, okay, that— just knowing what that takes to be that way and do that way, and I mean, yeah. A ton of people have that.

I follow her as well. Yeah, yeah, yeah. All right, so next question: did you have any mentors early in your career?

Okay, so probably I had a couple of people that I was— I was fortunate. So, hi! I had a couple of people that I was fortunate to have conversations with. Um, I had a really good boss in the UK, uh, really, really good boss in the UK who put up with me for who I was. Um, that was a big part of it.

But I think, you know, if I look US side, um, really, uh, you know, there's probably been a couple of good folks that I've been able to rely on, I've been able to have conversations with. Um, so there's one that he's, he's former agency, and he's actually the reason I'm in the US. And a few others. So Ed Schlicht is one, uh, former Intel and various other things, shall we say. Get out of my biscuit!

Sorry, Milo has decided that my chocolate biscuit looks interesting. Bugger off, it's chocolate! Um, oh my God, interested in something? Yeah, tell me about it.

How big is he? Yeah, he's about 100, 180, 190 pounds. He hasn't, um he gets his checkup and everything else. And thankfully, we haven't had to take him in for anything else. So there's one.

Dave Kaminsky was another good one. So Dave is over at Limited Brands, uh, in Columbus, which is— I was out there years ago. Dave was another one where, you know, he, he was one of those early InfoSec managers. Um, so we're going back, oh, uh, prior, 15, 16, 17 years or so, give or take a bit. So Dave had like myself, Clyde, and a couple of others.

They had like 5 or 6 of us in the team, and we were all a bunch of fucking goof oddballs, no two ways about it. Dave managed to make it work. Dave managed to glue us together, managed to get us to think commonly, managed to take some fairly raw people and present us to a very, very conservative company in a way that worked. So I took a lot from him, whether he knows it or not. You know, I've talked with him afterwards a number of times, but I took a lot from him and just watching and learning how he interacted with us, how he dealt with us, the good, the bad, and the ugly.

And then also how he dealt with the company. Dave's boss's boss's boss was a guy by the name of Rob Myland. And Rob's actually based out here now. Rob's the reason I'm in Colorado. Rob left Limited, came out to Colorado and worked for another company.

And literally I got a phone call from Rob going, how's it going? I'm like, yeah, he's like, I got problems. I'm like, how bad? He's like, bad enough I'm calling you. I'm like, oh, that's just not good.

So Rob flew me out and he was the CISO at another pretty awesome-sized retail organization. I got flown out and, uh, ended up coming out and helping them for a period of time. And yeah, so Rob and I have always kept in touch. And again, he's another one of those that has almost that Jekyll and Hyde side. You know, he's an amazing kind of goofballish, really out-there thinking individual, just amazing to sit and talk to and listen to.

Yet I think he's now with Gartner, so you've got somebody who's got to button it down, somebody who's got to be very eloquent, very deliberate, very— just really be able to navigate their way around leadership and everything else. So to watch that balance and how that works has been fantastic. Yeah, we're all goofballs though, really, when you, uh, you dig into it. So, but I mean, we have to navigate, you know, and I think this is the big thing that we, the security industry, has had to learn is we've had— we understand our tech, no problems. I mean, we can code with the best, we can do the crazy shit, we can break shit and fix it and do everything else, but unless you can explain it Unless you can have those conversations and communicate effectively, it's all for nothing.

Right, right. All right, next question. What's something you wish you had known earlier in your career?

Oh, well, let's start with the easy one that's still, that's still honestly a noose around my neck, which is don't sign legal documents without getting your own good lawyer. I mean, that's For anybody, anybody in our industry, especially anybody that's going and forming their own company or about to work for a company, never ever ever ever ever fucking sign a document without your own legal person going, I agree with it, or you're fucked if you sign this thing. Um, I mean, that has cost me probably over the years a million or two at least. Wow. And currently it's costing me, you know, $2,500 to $5,000 a month.

And I have an $800,000 nut that I have to crack in 2023 because I signed a document I should never have signed. Yeah, yeah, that's probably the biggest single most important piece of advice I could ever give anybody, which is never ever sign anything unless somebody's explained it to you in a way that you understand it and you know the consequences. Because I did and I didn't understand the consequences. So attorneys can be useful, is what you're saying? Yeah, good ones.

I mean, they're few and far between, but there are some good ones out there. You just gotta hunt high and low to find them, unfortunately. Yeah. Next question, how do you avoid burnout?

I box, so I'm very, very— I'm deliberate. I haven't been, which is— I'd hit burnout a couple of times. I'd actually— I've taken taken 3 breaks from this industry over the years.

These days I timebox and I'm pretty brutal against it. Like at 6 o'clock at night, I down tools. Maybe 6:05, but at 6 at night, I down tools. I then spend time with the family and with the dogs. I will, you know, we'll cook, we'll eat, we'll relax, we'll kick back, we'll veg out in front of a movie.

But 6 to about 9:30, 9, 9:30, maybe 10 o'clock at night, I will not touch any of this shit. Yeah, 9:30, 10 o'clock at night, I come back, the household is settled, dog's down here with me, one's in the gym, that kind of stuff. And I get back to doing research or catch-up or anything else. I normally work till maybe 2, 3 o'clock in the morning, give or take a bit.

Saturdays, you won't find me anywhere near this shit. Nothing. I might have my Twitter with me, I might have my phone— I'll have my phone with me But I will not be doing any of this shit unless the world has literally burnt down to my doorstep, at which point I'll pick up and maybe I'll do something, but probably not. Yeah, Sundays I will ease back into it. I will get caught up.

I'll see who's hit me up on LinkedIn. I'll kind of do the email stuff so that when Monday morning rolls around, I'm mostly prepared. But I box very carefully, and I don't do mornings. It's as simple as that. You know, we started this 11 o'clock Mountain Time.

I got out of bed at 10 15. Okay. Because I'm your first— I'm your first meeting. Totally. Yeah, I will not do meetings before 10 o'clock in the morning unless I— unless, again, unless the world's burning and I have to.

Because I know that I finish at, you know, 2, 3 o'clock, 4 o'clock in the morning, then I take an hour to unwind. So I'll sit with the dogs, I'll relax, I'll read a book. I still read a lot of books. And, you know, so it's 4 or 5 in the morning, maybe by the time the light goes down. So I want, you know, at least 5 hours of good sleep.

So I won't do anything. You know, I will avoid at all costs doing anything until at least 10 in the morning. You mentioned book. That's another question. You got any good book recommendations?

Oh my gosh. Well, I obviously have to. So I obviously— Hagnatty is another one of those crazy individuals. So I am going to plug his book because I've just read the thing. It's awesome.

So this is Chris's new book, Human Hacking: Win Friends, Influence People, and Leave Them Better Off. I've actually— I read this one. It's very fortunate. Got an advanced copy, all that kind of stupidity. Love the book.

That one's pretty awesome. I am actually in the middle of— I've got to find it. I can't even remember who the hell the author is. I'm in the middle. I just— I actually just bought the darn thing because it was actually totally cool.

It's called Zeus Is Dead. I do— I read a lot of stuff that is not in our industry deliberately. It's a little bit of escapism, let's face it that way. It's Michael Muns, M-I-C-H-A-E-L Muns. Unfortunately, 2 of my favorite authors have passed away, Douglas Adams and Terry Pratchett.

Also Terry Pratchett and those things. I still reread all of my Discworld series. I still reread a lot of the Hitchhiker's stuff. But I've also picked up Tom Holt, A. Lee Martinez, and a few of the other ones. I tend to read like Ian Hutchinson's another one, you know, The Cat Who Wore Electric Goggles is freaking awesome.

Another one that I absolutely love, it's— I do a lot— part of my background is science and mathematics for a whole bunch of different things. So there's a really, really cool— well, there's actually a fantastic book. It's called We Have No Idea, and it's actually written by Jorge, J-O-R-G-E, Jorge Ojoray-Cham, and Daniel Whiteson. Um, and it's all about the unknown universe. It's a fascinating book.

Um, I love it because it's just kind of the geek side of me. So that's another good one. And then obviously, you know, XKCD, he's got a couple of fantastic books out as well. And a lot of those are fun if you've got kids of any age, being able to sit down and actually logically explain what happens if the moon leaves, what happens if the planet stops spinning, what happens. Those are— I mean, again, I, you know, I take a lot of how I write things from a lot of those people.

I've been stupidly fortunate that I've read every single one of the Pratchett ones back to face and sideways. I own like 4 copies of each of them from different countries, for fuck's sakes. So my writing style, I take from a lot of those types of people. So yeah. Um, so many good books out there.

So many good books out there. Yeah, that's awesome. Scotch and whiskey recommendations. Oh, somebody wants to know about that, man. I've actually posted out there on LinkedIn, um, a number of times.

I've actually got— I'm actually going to see, you know, I've got— that person needs to follow you on LinkedIn. That would probably help a little bit. Yeah, actually, you know, when you— let me— I've actually got Maybe you can put it up on the, on the channel or something. I actually had a couple of things. Yeah, whiskey posts, there we go.

I've actually got 2 posts out there. They're older posts, and one of them, what I ended up doing is I did a post on bourbon, um, like top 20, top 30 bottles of bourbon that were like under around about $100 or less. There were a couple of exceptions in there. And did the same thing on starter whiskey as well, you know. And, uh, I had to get rid of Oh shit, what'd I end up auctioning?

500 and something odd bottles. Again, you know, mistakes we make. Um, lawyers cost money, and when you're having to fight an $800,000 noose around your neck, those lawyers cost a lot of money. And between that one and, uh, unfortunately the fight I had to have because I wanted more time with my daughter, those 2 lawyer fights cost the best part of $100,000. So 500 bottles of whiskey went to auction, lawyers got paid.

Yeah, I was gonna comment on that. What do you do? Oh, I mean, there's— and it came— I mean, the, the my daughter thing came out because my daughter wanted more time with me. You know, when the ex and I split up, it definitely obviously wasn't nice by any stretch of the imagination. And, um, you know, Colorado, like Ohio and like some of the other states, it's definitely a not a father-friendly state, shall we say.

And so it's always an uphill battle. And in the end, my daughter said to me she wanted equal time with me. Her mother would not listen. And so we went to battle, you know, $40,000 later, my daughter gets equal time with me. And, you know, I'm like, why the hell do we just have to spend all of that money to get the same fucking result that we knew we were gonna get in the first place?

But whatever, most happy. That's really all I care about. Yeah. All right, so what, uh, here's another question. What are some of your favorite events to speak at?

Oh well, we have to give a plug for the Rocky Mountain one. Let's be perfectly honest, I think that's— I love that one. That one's kind of cool because again, it's local family, um, and I love it. Again, we were fortunate 2019 to be able to go down and just hang out with everybody, and that literally is probably one of the last security events like on the planet that probably happened.

I love Gherkon. Gherkon is Grand Rapids. Gherkon is probably my home. Chris Payne and the team up there, you know, him, his wife, the kids, the team that's around them up there— I mean, I don't know how the hell they've managed to keep it the way they've done it. I don't know how they've managed to not fall into the unfortunate same traps that some of the other ones have fallen into, shall we say.

However Chris and the team have done it, I have the utmost respect. But I've attended every single one of those. I've always been up there. I love it. It's like a home.

And I think it's another one of those where it's relaxed enough, everybody gets to enjoy themselves. Everybody gets to kick back. And the night before we have the conference, there's a dinner, and it's formal, it's in a pub and we take out half the pub. I mean, we used to just take out 2 or 3 tables or 1 or 2 tables. Now we take out like one half of the damn pub.

It's kind of crazy. Um, I love that one. That one's a fantastic one. Um, I love the B-sides. I mean, I've been ridiculously fortunate to, to be— to go down and do like the first one in one of the southern Tennessee ones and do the first ones.

I didn't, I didn't do the very, very first, but I did the second B-side at the porn house, uh, Jesse and I were talking about like hacking cars. So, and let's go back a few years now, we end up giving a live demo on the fucking bridge between like Caesars and Flamingo afterwards. It's freaking awesome. So I have a huge soft spot for B-sides because I love the regional, I love the intimacy, I love the fact you just go and hang out at them. Those are always fun.

Um, I've had— oh my, um, actually Turkey, Istanbul. Um, there's some, uh, the, the one over in there is another good one. Probably my other like home is Cyber Week over in Israel. Um, I have such a freaking soft spot for Cyber Week over in Israel. Ronnie, the team, the general, and just the amount of people that they're over in Tel Aviv University.

Um, Kenan is over there, and at the same time they have BSides over there, so you've got the entire like half-crazed B-Sides community from Israel and all the red team and all the folks from there. You've got all this academia stuff. And the fun thing about that one is it's not a huge conference. I mean, it's a decent size, but there's like 60, 70, 80 countries there. And I love the freaking diversity.

I mean, it's just awesome. The ability to sit in this amazing auditorium and look at almost every race race, creed, color, religion, and everything just represented. And you're like, I can have conversations with all of these people. It's just— oh, it's brilliant. I love it.

Yeah, yeah, that's great stuff. So we are not going to get to a lot of these questions because we are, uh, we are already kind of up against the time. Um, that's okay. Maybe, maybe there'll have to be a 3rd episode, um, eventually for you. But, uh, let's end it, um, Let me pick one final question.

Let me, let me actually pick an airplane question since they're— all right, we'll hit it. Okay, so somebody wants your take on container architecture and aircraft control, if that's a path to better security or needless overhead. Thoughts? Oh gosh.

Yes, the game for ultimate protection, bless his cotton socks, doesn't exist. You know, to me, it's Containerization, I actually like. I do like that idea. I like that concept. No two ways about it.

I think it's an effective way. But on its own, it's not an effective mechanism. You know, this is where my background's deception. My background is monitoring. You know, the reason that we— the HHS has built Dave is simply so that we can monitor everything, for crying out loud.

Um, and so I think it's— it has to go hand in hand with understanding that you will always have an adversary, they will always get in, and how are you going to know about it? You know, the fallacy that things are completely separated is a fallacy. Um, there's a lot of stuff unfortunately that happened with the aviation stuff that I'm not allowed and won't ever be allowed to talk about that would have, that would have maybe given a slightly different slant on some of it. So, uh, yeah, I think my frustration there is there is no simple solution on any of these things, you know. It is simply, okay, we'll put this in place, but we'll also put detection, we'll put deception in place, we will actually protect the authentication, you know, with AD and stuff like that.

So there's a lot of things they need to learn. Containers, definitely, I like the idea of it, no two ways about it. But when you think about it, I mean, that's taking the whole concept of separation and segmentation that we've been yelling at people about for, you know, 20, 30+ years and taking a slightly different slant on it, but it's the same concept. So yeah, I'm for it, definitely. Yeah, yeah.

Good stuff. So your ending thought on your original episode was inspiring people to kind of get the word out more and, you know, figuring out how to bring up and include the younger generation. I guess, you know, for an ending thought this time around, I suppose, how is that going? And what is your ending thought? It's not changed much, has it really?

No, I think that mission's still there, no two ways about it. You know, I— we need— I think I want— we would need more people in this industry. I want younger ideas. I want more— I want more diverse ideas. You know, to me, that's the thing.

When, when, when our own systems are used against us, you know, legitimately or otherwise, you know, you look at the search engines and how they hone in and then start only giving you what you think you want, that's when we know we have a problem. That's when we know we don't have diversity and diversity of thought inside a system. So we need, we need some serious changes there. That was another question, by the way, I didn't get to, was thoughts on diversity and inclusion. So you're kind of, you're kind of going that direction.

Yeah, I think it's huge. I mean, it's— I make a conscious effort these days. I hang out— Bridges in Tech is a perfect example. I deliberately make sure that I do my best to hang out with people that don't look like me sometimes, to be perfectly honest. I want to because I want those thoughts.

I want those ideas. I want to know what I can do to help them. One of my— an amazing good friend of mine is Dr. Reem. She's over in Kuwait. She's freaking amazing.

And yet I've never seen her face. The best I've ever seen is a pair of eyes. The eyes look amazing. And I've seen her kid. Her kid is amazing.

She— her kid is under 10, definitely, I think. But her Rugrat has crowned herself the queen of hackers. And I'm like, you got it, you've earned it, you own that.

And but, but I mean, and to me, that's when it transcends that, that whole the facial, you know, I don't want people to freaking look at people's colors, eyes, number of limbs, and all that shit. I want to know what's between your ears, you know, what can you bring to the table to help this industry? You know, and I think that's what it does is it's I think that's all of our— every single one of us has got to look around the room and go, why is this room full of whatever?

I hit it last night. I was kicking around LinkedIn last night. And there was one of the humanitarian companies, or agencies, I should say, was boasting about how it stopped people from— how it stopped Trump, to be perfectly honest, from doing certain things. 12, you know, 12 old guys, um, 10 of them white and 2, you know, and the 2 token colored guys. And I'm like, well, first and foremost, where's the fucking women?

You know, you're missing, I know, half the planet's worth of thing. And secondly, you know, 10 guys white and 2, 2 who are not white, you, you guys need to sit down and think about this shit. Yeah. Um, and so I think that's a big part of it is that we, we've got to get more. We've got to get we have to be different than who we are today.

I think that's going to help. And communication, collaboration is the big one. I love, I love what's happening with the DevSecOps movement. I love the fact that, that, you know, you've got Mark Miller, you've got certain type, you've got so many people who are picking that up, you know, um, so many good people who are picking that up and running with that because it's needed. Yep, yep, for sure.

Well, it has been awesome to, uh, chat with you. Totally fun. And we could have gone on for another hour, but like I say, maybe, maybe 3 and a half years from today we'll do another one. You can have another— it'll be interview number 3 for you. Oh my gosh, we're gonna keep the same pace.

Oh my gosh, that'd be totally cool. We'll have fun, we'll figure it out, I'm sure. And we'll have to catch up when we're all allowed out of the basements again. We'll definitely have to get everybody over for whiskies and stuff. Yeah, yeah, great stuff, Chris.

Well, I appreciate it. Thank you. And have a, have a good rest of your day. Yeah, you too. Thank you so much.

Appreciate it. Take care. That concludes my interview with Chris Roberts. Be sure to follow and support Colorado Equal Security on Patreon. This is Jason Jaques saying be safe out there.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, events and learn more about Colorado Equals Security. Reach out to Alex and Rob by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.