Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 215 for the week of June 21st. Alex, happy Father's Day.

Happy Father's Day to you, Robb. Of course, if you're listening to this, Father's Day has actually passed. So if you didn't call your father, you probably should do that now. Well, I mean, they could be listening this afternoon on the Sunday, Sunday afternoon. I guess the real go-getters could be listening on Father's Day.

Yes. Especially if they're not celebrating with their fathers. This could be the reminder that they needed at the beginning of the episode. Well, maybe hit pause, make a call. There's your public service announcement.

Go talk to your dad. Good stuff. Hey, we do have some housekeeping. Uh, as a reminder, we have a Slack channel with an awful lot of our favorite Colorado security professionals. You can join that conversation by going out to colorado-security.com and clicking on the Slack link.

There's also a mailing list. Sign up for that. You'll get the show notes sent to you in your email every week. We'd also love it if you rated us and subscribed on your favorite podcast application. Uh, that way people know that this is a good podcast and you'll get it delivered to you every week.

And we would love it if you would help us become viral. And how that works is you tell 2 people about the podcast and then ask them all to tell 2 people who will then tell 2 people. And if like 2 of you do this, we'll have like a million of you in like 15 minutes or something like that. Is this the same thing like when we were kids and somebody would be like, okay, you put a dollar in, you know, 10 envelopes and send it to people and ask them to all send a dollar, send a dollar back to you, plus the next person has to send a dollar back to you. And then like all of a sudden you're a millionaire.

Would you like a penny a day for a month or a million dollars? Which would you like? Oh, wait, wait, I messed that up, didn't I? A penny a day doubling every day for a month. Anywho, we'll keep this moving.

Robb, I'd like a penny a day for a month, please.

You might have missed an opportunity there. All right, that's what happens when we record at night. Yeah, also, uh, tell a friend. Be a patron. Oh yeah, Patreon.

Big thanks to our supporters who financially support the show. We appreciate you guys. If you want to also help the show keep, keep the lights on, go out to the website and click on the Patreon link. All right. Let's jump into the news, Robb.

As evidenced previously, talking about the housing market, it's on fire right now. And you could own your own little slice of hell in Colorado Springs for only $590,000. Yeah. So you say it's on fire. This house looks like it might have been set set on fire.

It wasn't literally, but apparently the story here is a tenant was going to be evicted by their landlord and decided on the way out just to be the biggest jerk in the world. And they, they ruined everything, right? Well, it sounded like reading the article that maybe they were the biggest jerk in the world before they were evicted. And while they were being evicted, other things like they, they had the roof replaced, and basically took out a lien on, you know, a loan against the house to do that so that the landlord then owed money on the, a new roof that they didn't ask for. Uh, all kinds of great things that this tenant had done, including as they left, putting all, all kinds of profanity all around the house and, and left a, a, an unplugged freezer full of meat in the basement.

So I guess if you go in the basement, it's, it's hell in the basement. So the point here is this house is on the market now and available, and I don't know if you caught a an update to the story, it's received multiple cash offers above their asking price. That's just insane that a house that disgusting would be going for $590,000. And so this is the— this is national news at this point. You can catch up on CNN if you want to read more about it.

That is crazy. So anyway, that's our fun story. Moving into the tech area, Dish Network is now actually launching signups for their 5G wireless network. We've been talking about this for years. Yes.

So we're one step closer. They're not actually launching the network quite yet. Um, but you can, you can sign up to get notified as soon as they have it ready. It sounds like it's getting close though. So, and there's also another allusion to, um, oh man.

Um, help, help me. The head, the head of Dish, what's his name? Charlie Ergenstam. Charlie's kind of shots he takes at T-Mobile for being, uh, petty for turning off the CDMA network. Um, from, from one of those providers that they brought over to Dish.

Yeah. So Boost, I think, which is what now part of Dish and I think Boost rides on the former Sprint network that now T-Mobile is talking about turning off. So yeah. So Charlie's taking shots at them. You know, this isn't the kind of vindictive behavior I'm used to seeing.

Interesting stuff in there. Billionaires fighting billionaires. Good times. Fun times. All right.

Next. We have talked about this in the past. The old Greyhound bus station in downtown Denver was up for sale. It obviously— it did sell a while back. And now there are some early plans that have been revealed for what it's going to look like.

This is an interesting piece because it's one of the few full block lots that is left in downtown Denver. And apparently the zoning is very good too. And you can build up to 400 feet. Above that lot. Yeah, so they're, they're gonna be building— it's 1.7 million square feet that they'll be building between 2 buildings.

There's a residential and a commercial building. The— was it the residential is 28? No, the residential is 38 stories, and the office tower is 28 stories, right? And at the bottom, there's gonna be a whole bunch of retail and like an open courtyard in between to have like a socialization place place at the bottom there. Yeah, sounds pretty cool.

Another indication of Denver becoming a big grown-up city. Have you had a chance to see McGregor Square yet? I haven't actually been down there. Sounds very similar where there is this really nice courtyard in the middle served by retail on the outsides, basically creating a hangout spot. I did check on here as well.

They're going to have a rooftop pool and a patio. So nice. You can go if you can get there. You can go check, check out a view from the top of the building on the 38th floor pool. I would imagine so.

That'd be pretty cool. I wonder if they will also do a hotel like they have in McGregor Square too. I don't think— I didn't say hotel. I saw condos and office space. Yeah, that would be cool though.

All right. I think my turn, right? Sure. So this is a new company I had not heard of, Nihilus. So it's an API platform.

It's a California company, but they have invested a whole bunch in Denver and they're planning to invest more. So Nihilus just raised $120 million in Series C funding and they're going to be investing here in Denver. Yeah, I think that they're based in San Francisco but already have an office here. Um, and obviously they're going to be growing with that, uh, that new $120 million in funding. Uh, when I first saw that they're an API platform, I thought maybe like, uh, you know, like API management or something like that.

But it sounds like they're more like a Twilio or something like that where they have APIs that you can use to do tasks like send emails and maybe texts or calls or probably lots of other stuff too. Yeah, the way they summarize it here, they are a future of work company. I don't, future of work, what that means exactly, I'm not clear, but they provide developers with out-of-the-box tools for building communications, scheduling, and automation tools for their business, which does sound an awful lot like a Twilio, to your point. They have their API connects to email servers to allow businesses to automate emails to customers and not to have to do manual stuff. So yeah, very, very similar to a Twilio.

Yeah, I thought it was interesting that they, in the article it said they started out actually as an email client platform, like they were building an email client and then they realized this is a bad business. We shouldn't do this. Yeah. But then they also figured out, oh hey, um, you know, as part of this we had to develop a bunch of APIs to get the emails sent. Yeah.

So we can now use that and create a different business. Yeah. Good stuff. They're currently about 150 employees. They're gonna be using this investment to grow to 250 to 300 over the next year.

They have 38 here in Denver, and they're going to be hiring across a bunch of teams here in Denver: product, engineering, sales, marketing, and customer success. Very nice. I thought that was funny. Also, it's they're going to be growing basically every area. Like, let me list all of the areas of a business we're growing there.

Right. They didn't say security, Alex. They didn't. Oh, they didn't say security. All right.

All right. Next, a Boulder autonomous mower startup. Scythe Robotics has emerged from stealth. So this is not Left Hand Robotics, which is the other lawnmower company we've talked about that was like somewhere late last year got bought by Toro. Right.

This is a different company that does automated lawnmowers and it sounds even cooler. Yeah, because clearly Colorado needs 2 automated lawnmower companies. One of them is now not a Colorado company. So that's true. So, you know, there can only be one.

Apparently Left Hand's head was cut off and they've been replaced by Scythe. They was cut off with a scythe. I could be, could be. So yeah, they, they built, this is, I think they said the 4th or 5th iteration of their mower that they've built while in stealth. But one of the interesting things about them is that they built it from the ground up, obviously iterated on it just to do autonomous mowing.

And they also did it with, you know, looking more at a commercial as opposed to a residential. Yeah, they have a couple of stats about it. 4 feet long. The battery lasts 8 hours. With that, they can go 2 acres per hour.

So if my math is right, that's about 16 acres on a single charge. That sounds like a lot to me. You know, it's a good day's work. I don't want to have to mow 16 acres. Better to have them do it.

It looked interesting. They do have 8 cameras on each mower that gives it sensors that can identify and respond to humans, animals, and other obstacles along the way. Yeah, sounds interesting. One of the other things that I thought was interesting is, uh, their business model. Yeah.

They're, they're not selling the mowers, uh, in terms of like you pay for the mower and then, you know, service contract or something like that. Uh, essentially it's like a mower as a service. You, you pay them based on the amount of acreage that you mow. Yeah. You know, I, I did, I saw that in there and that was super interesting.

Obviously, I, I think that's a, a very valuable, uh, business plan when you can do it, right? Um, you know, perpetual— you basically— better than perpetual, you're getting the subscription revenue going on an ongoing basis, although seasonal in this case. Um, but then later it talked about them fulfilling orders, and it sounded to me like shipping products. So I, I do wonder if maybe there's a mix of the two going on here. But really interesting stuff.

Uh, they talk, uh, currently they have 30 full-time employees. Uh, they expected to have up to 40 here this year, and Um, and then they talk about the future. They're, they're looking to address other outdoor needs including leaf pickup, seeding, and maybe even crop management. And when I read crop management, I'm like, holy smokes, like how big a market is that? Right?

That's right. You're talking about like this tiny fraction with mowing lawns and you start crop management. That's, that's basically the whole world. That's pretty— yeah. I, I wonder how much room there is in those with the, you know, the giant Monsanto is going to come step on you, whatever.

Right. Well, yeah. Or the, the farm implement Companies, right? That are already— yeah, whoever those are, whoever they are doing those things. Cool stuff.

All right, moving on. Next, this is an interesting article in that it was in on the NASDAQ website. Title is CISO Challenges as Hybrid Work— Working Leads to Top Concerns. The reason we're talking about it is that this was written by Lucia Milka, who's here in town and is one of the global resident CISOs for Proofpoint. Yeah, we love Lucia.

I think we've had her on the show in the past and She was formerly the CISO over at Polycom. Anyway, this is talking about a survey that they had run around what CISOs are concerned about, what's keeping them up at night. You know, a couple of stats that popped out: 66% of CISOs believe their organization is not prepared for a major attack, which sucks. Yeah, yeah, that does suck. I wonder what— if there's nuance to that question, right?

Like, a major attack Are you prepared for other attacks? Are you, you know, anyway, yeah. Also, the biggest concerns were email fraud, like business email compromised and cloud account compromise. My guess also is that since this survey is being released now, you know, it was taken sometime in the recent past. I would bet if you took the survey now, ransomware would probably also be one of the ones at the top of the list.

Anyway, good article. Appreciate Lucia's doing this. And of course, love to highlight what local folks are up to. I wanted to point out one other thing in here, Robb, if I can figure out where it is. I like this sentence.

The majority of global CISOs expect budgets to increase by at least 11% in the next 2 years, and 65% believe they will be better able to resist and recover from cyberattacks in 2022 and '23. It's an optimistic group of security leaders, right? Yeah, it is. I will say 11% is probably not enough, Probably, you know, that might be inflation with the way things are going right now. But definitely, you know, in order for us to keep up, we're probably gonna have to be more investment across those departments.

But I am glad to hear that they think they're gonna be able to keep up with the challenge. Yep. All right. Now we'll move it over. We have an investment for one of our local security companies.

I feel like we have not talked a ton about ThreatX recently. Yeah. We talked about them a lot. Maybe they haven't had a bunch of news recently, but here they just raised, oh my goodness, they raised a bunch of money, right? I don't think I have the money, the number in front of me, but ThreatX just raised a new round to triple their headcount.

They— $10 million. So $10 million for— and this is interesting. So Gene Faye took over, if you remember, that was probably the last story we talked about with them. Probably. He took over last April as their CEO as Brett Settle moved into a different role in the company.

But with this extra $10 million, they are planning to increase their their revenue and invest in building out a new office also in Boston. So they're going to have the Denver office and moving a new one into Boston. Nice. They're also planning to increase revenue by 150% this year. And they're also looking to grow their employees from 35 to more than 100 in 2022.

Yeah, there was another note late in the article about— as a part of this, there's a new member of the board who's going to be joining Um, talking about the, the opportunity here. And my take as I read this is, is everyone knows that web application security is only going to become a bigger deal as, as more and more things move to the web. And, and a company like this who has a good technology and has a good customer base is going to be in a good place to take advantage of it. So yeah, it's exciting to hear, and I look forward to seeing these guys keep growing. Uh, and just like in the, uh, Nihilus— what was their name?

Nihilus, is that article earlier. My list, that sounds right. Um, ThreatX is going to focus on growing engineering, security operations, sales, marketing, and finance. There you go. So, so they're going to grow, like, they're hiring like 15 employees or something this year.

I think it was going to 35 to 50 this year. Yeah. So like 2 per department. Exactly. Each get 2.

All right. Uh, so speaking of growing, we have a, a press release this week from CyberGRX who's hired 3 brand new executives to join their team. Yeah, so John Mayhall is coming on as the Chief Revenue Officer. Carrie Nagle is coming on as Chief Operating Officer, and Peter Finter as Chief Marketing Officer. Yeah, I don't think I know any of those 3 people, but they had interesting backgrounds.

John Mayhall has a background really working at LinkedIn, where he was one of their business unit kind of presidents, it looks like. And then previous to that, he was over at Yahoo. Carrie Nagle, previous to being the COO here at CyberGRX, had been COO for a company I hadn't heard of, but also Chief Human Resources Officer, kind of a different path, I think. Right. Yeah.

And Peter Finter, who is coming on for the Chief Marketing Officer, in here they talk about that he was CMO at Couchbase, which is a database company, and Gigamon. Which— so some security experience. Good, good to see those guys joining the team, and hopefully that means CyberGRX is up, up and away. Yeah, and then we have, uh, another announcement for some new people. Uh, this is slightly different.

Coalfire announced, uh, that they have, uh, appointed someone new to their board. Uh, yeah, so we have— oh, it's Nefkins. What's his first name here? I've got it. That's why I paused, Robb, because we don't have the first name.

It is Mike, Mike Neffkins is joining the Coalfire board. When I first read it, I'm like, well, who is this guy I've never heard of? And I should have heard of him. He's pretty impressive. Pretty impressive background.

Former president of HP Enterprise Services. He's currently an advisor for Boston Consulting Group and he is a featured speaker at Davos, the World Economic Forum. Yeah, that's a pretty good resume there, Robb. So sounds like a pretty good board member for Coalfire. Obviously good to see them.

You know, they do mention in the article, I think you guys alluded to it when I was gone, Um, that, you know, Coalfire had just recently acquired Denim Group and, you know, are, are, and are better equipped now to, to handle the cybersecurity consulting than they ever have been before. Yeah, I think, you know, expanding, right? So now you're not only a, uh, consulting company, but you're also a product company too. Good stuff. All right, jumping over to, uh, to the last security story, we have a, a blog by Ping Identity, and this one is called Uh, what is zero trust?

It's one of the, you know, kind of nice primers into how something works. I think it's a decent summary of zero trust. You know, they give it 5 bullets here. Number 1, the network is always assumed to be hostile. That's a really nice starting point for zero trust.

Number 2, external and internal threats exist on the network at all times. Seems a lot like number 1, but, but, you know, Andrew Goodman's a friend and I, I give him a little ribbing that those seem the same to me. Number 3, network locality is not sufficient for deciding trust in a network. Number 4, every device, user, and network flow is authenticated and authorized. That kind of, kind of goes hand in hand, right?

If you don't trust the network, then you have to look at each individual flow to trust it. And finally, the policies should be dynamic and calculated from as many sources of data as possible. Yeah, decent summary. Yeah, so I think that, uh, one of the things I liked about this article is it's, it's very long. Um, and there's not really anything groundbreaking, nothing earth-shattering in here.

If you know about zero trust, you probably know about all of the stuff that's in here and the concepts that are talked about. Um, but it goes more than just those 5 bullets that you talked about. You, you know, you might read some articles and it's like, all right, here are the 5 things you need to think about for, you know, this is what defines zero trust. And then it's kind of like, you know, talk to us for consulting or whatever. Right.

Um, this goes into much more depth. Uh, you know, talks about, uh, you know, some of the, the things you might need to implement zero trust and tools and other stuff like that. And, and so if you're really looking for a good primer on zero trust, it's a good blog. All right, good stuff. Let's go ahead and jump over to our calendar of events.

As a reminder, we have a calendar on our website. You can go out to colorado-security.com and go to the calendar there. There's not a lot on the calendar right now. Summertime has shut down a bunch of these groups who are taking off to enjoy time off with their family, especially I think after they're getting out of the house after COVID. We do have a couple of events this week to talk about though.

First one, um, the ISC² Pikes Peak chapter is doing their June hybrid meeting on the 23rd. Uh, also on the 23rd, we have the in-person Denver Splunk meetup. So Douglas Brush has been talking about this on the, on the Slack channel. Uh, it's increasing value and managing costs with Splunk DSP and workload pricing, and it's at the Wynkoop. If you want to go drink a brew and talk about Splunk, that's a good opportunity.

I'm trying to think, is this the first completely in-person event that we have promoted on the event calendars post-COVID. I remember hybrid. I can't think of any completely. It might be. Yeah, might be.

So as of June 23rd, the pandemic is over. And then after that, we have a few weeks off, I think, as everyone's leaving for 4th of July before we have our next event. Yep. All right. Let's jump over to jobs.

First on the job— first on the list this week, we have a job from American Ag Credit. They are looking for a director of cybersecurity. Got to tell you, when I'm looking for jobs, If I see a company I've never heard of before, it makes me so much more interested in putting them on here. For sure. American Ag Credit sounds like a real company, right?

And apparently they're hiring a director here in town. If you talk to them, I'd love to know what you learn about them. Next, Dish is hiring a manager of information security risk management. Alteryx is looking for an analyst for cybersecurity operations. KPMG is hiring a manager cybersecurity FAANG.

And when we say FAANG, it's F-A-A-G. A-A-N-G. So I, I assume that this means that you would be supporting the large tech companies— Facebook, Amazon, Apple, Netflix, and Google— or companies in that genre at least. Oh, I, I thought maybe you'd be supporting vampires, or this is like a Cobra G.I. Joe thing going on. That could be, that could be that too.

Don't know. Uh, Ball Aerospace is looking for a governance, risk, and compliance cybersecurity professional 1. Dice is hiring a manager of information security. Elastic is looking for an information security product security lead. Speaking of new companies, we have eBacon.

eBacon is hiring a security engineer. Uh, I don't like eBacon. I do like regular bacon though, Robb. Coinbase is looking for an enterprise security engineer. And finally, Spectrum is hiring a senior manager of security.

Cool. We made it through the, uh, the news. There, there is a feature interview this week. One of my favorites from around town, Sheri Ricardo. Oh, nice.

The CISO from NREL sat down and was interviewed by Courtney Chenault, who's— I think this is Courtney's second interview with us now. I think that is correct. And I'm looking— I'm really looking forward to these ladies dropping some knowledge on us all. I am looking forward to it, too. All right.

Well, everyone have a happy Father's Day. Or if you have— if you've already gotten through it, maybe call your dad even after it's over and say, happy Father's Day. I appreciate you. That's it. We'll talk to you guys again next week.

Thanks, Robb. This is Jay Wilson, CISO of Healthgrades. Welcome to Colorado Equals Security, the podcast for Colorado security professionals by Colorado security professionals. Hello, Colorado Equals Security. My name is Courtney Chenault, and today I have the pleasure of interviewing Sheri Ricardo.

Sheri is the CISO of NREL, the National Renewable Energy Laboratory in Golden. Hi, Sheri. How are you doing today? Hi, Courtney. I'm doing well, thank you.

How are you? I'm doing well, thanks. Thank you so much for joining us on the podcast today. I'm really excited for it. Before we dive into your background, I would love to hear your take on recent cyberattacks as the CISO of NREL.

Sure. Well, attacks on energy systems are, of course, top of mind always for NREL, and we have a couple of different ways that we approach that. One is with our internal cybersecurity, which is my team. We're focused on the laboratory operations. But 2 is also on, most importantly, helping critical infrastructure entities like utilities protect themselves against these types of cyberattacks.

So the interesting mission that I have inside of NREL is helping the researchers that are helping the utilities keep their infrastructure safe so that we can continue to do world-class high-quality research. As far as the attacks are concerned, I think we're only going to see more of those. I had worked previously with critical infrastructure myself directly, and one of the things that I encountered quite frequently was suppliers' or manufacturers' reluctance to provide good cybersecurity features within their software or hardware components that they provide for operational systems. And until the consumer demand catches up, to the point where folks are starting to produce technologies that can help us, that we can leverage to become more secure or to practice better security, we're always gonna be kind of running behind in the operational technology area. So having basic good practices is right now par for the course, and I think is where we're going to be at for quite a long time as we try to fend off these different attacks.

Yeah, that's so interesting. I feel like this can be especially challenging for older industries and companies that may not have the most modern systems as well, so it's critical to take an aggressive approach to increasing cybersecurity investments in those industries. Absolutely, and there's still a lot that companies can do, but it requires a lot of diligence and it requires a lot of creativity in order to achieve a really good security posture in operational networks, especially with their complexity nowadays. Yeah, totally. Well, that's just interesting because it's, you know, top of mind and in recent events, but I guess tell us a bit about yourself and your background.

Sure. I started in cybersecurity around 2004. I used to be, a long time ago, a technical writer, and the way I got started in cybersecurity was, uh, I used to work for a big company, and at one point one of my colleagues picked up a security policy there and said, I'm not sure if we need to do this, but here it is. Maybe you can read over it. And so I read over the requirements of the security policy and said, I think this means that we have to be doing something additional.

And they had said, well, yeah, maybe. Well, maybe you can be in charge of that. So that's how I kind of ended up starting my career. I read the policies and helped other folks kind of interpret what needed to be done and then kind of became in charge of it somehow by some magic. Well, I don't think that it's 100% magic.

I know that you have a super diverse background and that you've had a lot of pretty amazing life experiences along the way, and I'm guessing that those have helped form you into a person that is especially well equipped to sort of influence people and bring people on board to actually want to adopt better cybersecurity practices. So could you tell us a bit about your background prior to going into security? And maybe we can parlay that into what has helped you be so successful along your career path. Sure, sure. Prior to being in security, and I've been in security for quite a long time now, but prior to that, I did a lot of different jobs.

I actually have a very quixotic history. I was a park ranger. I used to teach composition at a college. I really wanted to be a professor of literary theory for a while. It was a, it's, I have a pretty diverse background, but I think having that diverse background helps me relate to people that have different objectives.

And that's one of the things I really like about working in security, and I really like about security management specifically, is being able to relate to people with different backgrounds and different goals is super important to getting their buy-in to doing good security practices, to practicing good risk management. And I think that's central to my philosophy for how I actually operate my security team, what I try to teach and mentor my staff to do, and what I find effective in environments that are not super rigorous, that require a lot of creativity and flexibility. I am a very hearts and minds focused person. I really like to teach other people how to protect themselves as opposed to imposing rules and strategies on them. No one wants rules strategies that are going to make their job harder.

But if you can teach somebody how to do something well so that they can get done what they need to get done but also be safe in the meantime, I find that that strategy tends to be really effective. It also helps you to build a bigger team and leverage the capabilities of your entire organization so that you can protect risk at many— protect against cybersecurity risks at many different layers. Yeah, I think that that's very smart, using the carrot instead of the stick mentality. And I think in some ways that's a culture shift that's taking place for security in general right now when, you know, there might be a 1 to 100 ratio from security to developers or R&D folks. So figuring out how to change hearts and minds seems like a very good skill to have.

It takes some development in order to be able to get to that level. Not a lot of security people are really focused on the communications aspect of it and on what your, your user community or what your customers internally or externally need or want. And sometimes it takes spending time with them, listening to their stories, understanding and seeing what it is that they're dealing with to come up with strategies that are not only effective security-wise, but that they're willing to adopt and support. Because you can tell somebody to do something, but if they don't understand why or how to do that or what the benefits are, it's likely that it won't last. But if you can help them understand how and why, it's more likely to stick, and they're likely to build other advocates for you as well.

Totally. That makes sense. So as you've built out your organization at NREL and, you know, previously at RTD, when you go to hire folks to your team, what qualities are you looking for and what type of program are you trying to build? I really look for people who know how to communicate well. And that also have a lot of perseverance.

Flexibility is another thing I look for, and creativity. What I, I, I'm glad when I know people that know, or when I find candidates that actually know the rules really well, that's one thing, and they know how to execute like all of the NIST controls and where to find them all and so on. It's one thing to know the skills of the job, but it's another to be able to translate that into action. So I try to look for people who are really open to learning. I try to look for people who are really flexible and creative in how they implement those things, and not so much people who are stuck on, I need somebody to tell me what to do.

Um, if depending on what stage you are in your career, you might need some extra coaching or you might need some extra guidance, but if you're willing to take that extra step and put forth your own idea in there, that can help you to build those relationships with other people that will make for a very effective security program. I've been really fortunate to have met a few unicorns, folks that do security, that know the technical security really well, and really don't like to live under a rock. They're also very good communicators, and I think sometimes those skills, they don't always go hand in hand. A lot of times people go into a security role because they like to work with the technology more than they like to work with the people, but the security is really about people and technology. You can't separate one from Otherwise, you wouldn't have security problems, issues, or techniques, right?

You wouldn't need them because the technology would always do what it's supposed to do. So I really look for people who are good at being on a team, who are creative, who are flexible, who know how to speak for themselves and know how to speak to other people in a respectful way and one that garners their attention and their interest. That's really interesting because I think from the outside, a lot of people think of security as being very black and white, where you're either compliant or you're not, you're doing things right or you're doing them wrong. But the fact is that it's humans that are building these services, and it's critical to take a human-first approach to empowering folks to operate and ship securely. Yeah, it definitely helps.

And, you know, at its heart, security is kind of, in my opinion, it's a people issue. Everybody tackles it in their own way. Some people tackle it like technology issues. And you'll hear people say, well, if only we didn't have users, we wouldn't have any problems on the network. Or some people really say, well, security awareness can only get you so far.

You have to implement all the technical controls. And all of that is true to some extent, but I think those of us that work in security and have worked in security for a long time, we have a kind of flavor that we gravitate to. It's either your people, your process, or your technology, right? And my flavor happens to be people with a sprinkling of process. The technology part, I am fortunate to work with some very smart individuals who really know the technology well inside and out.

And so we, we split up those duties. Right. When we were talking before, you mentioned the, uh, the Serenity Prayer of security. What is that? The Serenity Prayer of security.

I have 500,000 things to do. Please help me accept the things that I can't do, do the things that I can. You know, that's kind of how, how it goes, right? And the reason that, the reason that we were talking about that had to do with kind of my history over the past several years working with smaller organizations. I used to work for a very big company when I started my career where everything was kind of spelled out for you.

It's a great place to go to learn, but it's not a great place to exercise your flexibility because they have a very robust program and everybody kind of knows what the rules are and you have to stay on the rails or you fall off essentially, right? But when you're working for a much smaller entity, you have a lot of flexibility in what you can do, but you also have a lot of uncertainty about what can't— what has already been done. Sometimes there's nothing that's been done. When I first started working at RTD, we had no security program. I was the first cybersecurity professional that worked there, and it was my job to develop the program.

Now, unbeknownst to me, when I came into the position, I actually thought I would have a team and all these things. So, you know, job hunting lesson learned, always ask. But it happened to be just me, and I had to go around and ask people like, well, what is your— where's your information security policy? And how do you classify different types of information? And, you know, who do I talk to if we have an incident?

And then their response was just like, well, oh, I'm so glad you're here to figure that out. So the Serenity Prayer of security comes into that. When you look at an organization that has a lot of growing to do, or is, you know, operates in a very flexible manner, you can kind of take a look at all of the things that you have yet to do, or that are not going exactly right, or all of the controls that haven't been implemented. And you can really, you know, send yourself on a nervous breakdown trying to look at all the things that haven't been done. But if you can accept that the organization is just at a certain point in its maturity, it's at a certain point in its growth, you're not there so that they can find a person to fire when you have a cybersecurity incident.

God willing, but you are there because they want help. They want expertise. They want somebody to help them understand what it is that they need to do. And if you can accept what's not going right about the organization as a to-do list, as opportunities of things to do, and focus on those things among that, where you feel like you can make the most traction, then you're exercising the Serenity Prayer. You're not spinning, you're not spinning up about all the stuff that hasn't been done.

You're really looking at the things you can do and where you can make a difference and looking for those opportunities in other people, in conversations that you have, in events that occur. Doesn't necessarily have to be a crisis. It can just be a, hey, somebody's interested in working with me on this topic, and start there. But the most important thing about the Serenity Prayer is not to just accept that nothing will ever happen. But to accept that some things the organization is not ready for, but you need to pick a place where you find it fruitful and start.

That's awesome. That's a very good concept. And I hope that a lot of people listening, that that brings them peace and that they can adopt that themselves. So are you happy that you started your career at such a large employer and then went on to be in smaller companies with more flexible roles? I think it just depends upon the individual.

I mean, I, I really appreciate that I grew up at a big company because it gave me a really good picture of how things could be. The company where I started was IBM and it's very, very process-oriented. So if you wanted to know how to do something, there was probably a process and a class on it. And everyone has read it and trained in it about 400 times. So it was very rigid in that way where you had instructions follow.

But when you're a new cybersecurity person, you're not quite ready to kind of make it all up on your own. I said earlier that I appreciate when people take initiative and ask questions and are creative and flexible in their approaches, but sometimes you're just not ready for that. It's like, you know, you're going— you're being asked to draw a picture, and they're like, well, you know, just draw a picture of something. What do you want a picture of? I don't know, just something, and make it good.

You don't really— that's not a great way to approach things when you're very brand new in the field. You want to model after people, you want to mentor with people, and so on. So working at a big company to start with really gave me that structure. I think the detriment of that is then when I went to a much smaller company that did not have the same organization, I'm looking for the same patterns at that smaller company. And then, you know, therein we're back to the Serenity Prayer, right?

How do you avoid burnout when everywhere you look You see things that are not done. You have to really look for those opportunities to do the things that, you know, are worthwhile and good. And you have to spend a lot of time thinking about what's worthwhile and good in that organization and not just what you did in the past. So there's a pro and a con to having come from a big company. In my case, it was definitely a pro.

Would I go back? Probably not, simply because I enjoy the freedom, the flexibility, and the creativity and the challenge of working for a place that's smaller and more flexible. Right. In that vein, what is your favorite thing about being the CISO of NREL? Oh gosh, my favorite thing about being the CISO of NREL.

I think there's a lot of unique challenges that working in a scientific environment brings to the fore. One of them, in my opinion anyway, is that your scientists that you work with, researchers that you work with, have a completely different and opposite to me approach to how they solve problems. Scientists really need and want access to a lot of things in order to be able to invent things, in order to be able to research problems. It's a very inductive process by which they take all the building blocks and they lay them out on the table and they say, I'm going to make something out of this and I'm not sure what it's going to look like in the end, but it's going to kind of do this thing maybe. And it's going to be awesome.

That is 100% opposite of how I like to do operations, which is I know what my goal is. I need these things to get here and these things only, and I'm going to walk on that path to get to the goal. So the challenge of balancing those 2 perspectives is really interesting at NREL. I think also I really love working with the people at NREL. The environment is awesome.

It's like working inside of a science experiment. Quite literally, it is working inside of a science experiment when you're on campus, meeting the people that are really passionate about their work there. I may not always understand all the science that goes into wind turbines and solar panels, but I'm learning. It's very interesting. And just the culture of the organization is such— and especially within our IT services, is such that people really want to grow and they want to learn, they want to do the right things.

There's a lot of chaos going on when there's scientists involved because of the process that I talked about, but it's not so much a manner of exercising control over the chaos as it is making sure that people are behaving in a safe and responsible manner while they are participating in their experiments, while they're doing things, so it offers some very unique challenges. Right. So how do you— do you just lay out guidelines and say, hey, these are sort of the guardrails that you have to work within, but within these guardrails you can do whatever you want? Or how do you communicate policy and effectively get scientists on board with working within that world? In some cases, there are areas where you can, and then there are areas where you just plain can't.

Being a federal agency, we're bound by FISMA, and we follow the NIST controls as a, as a matter of course. However, we are also overseen by a federal agency, and we can negotiate with them on how we satisfy some of those controls, as long as we can prove and demonstrate that we are doing so safely and effectively and protecting our government information and assets. So you really have to take a risk-based approach to what folks are doing. If they're doing something in a sandbox that you consider risky, and you're confident that they're disconnected from everyone else, Am I going to go and say, well, you haven't completed your XYZ controls in this area? No, it would be a waste of time, right?

But if they're doing something where they're working with another entity's information, or they're working with a utility company and they're dealing with information that's important to that company, am I going to then try to apply those various controls? Yes. The manner in which I apply them needs to be consistent with how they run their operations and what they need to do in order to achieve their mission goals. So to some extent, yeah, I mean, there are areas where I can just give them guidelines and say, okay, as long as you stay between point A and point F, then, you know, you have latitude to decide what you want to do. But there are other areas where there's just no dice, right?

You know, if there's a rule is a rule is a rule, and if it's written into an order, then it's just something we have to enforce. But the creative part comes in when you say, okay, yeah, we need to, we need to do this rule. But let's think about what that means to our environment. How do we satisfy it in a way that helps you get your work done? So it's really a matter of shifting toward that risk-based approach.

It's something that NREL has really spent a lot of time on over the last year, year and a half, and that I think is really helping our operation to become more integrated across all of the agency. That's awesome. So I saw that NREL has a new solar app, and I know that your development teams are working hard to release enhancements and new functionality to that app. From your perspective, what's ideal? Does your security strategy take more of a gated approach, or if you've built security into the development process more organically, what has that looked like for you?

I think it's kind of a bit of both. It's a mix of both. With government systems, there are certain gates that you have to go through. There are certain authorizations that you have to obtain in alignment with the risk management framework. So there's always going to be some gates.

Now, the difficulty of getting through the gates is, in my opinion, a function of how much time you put into your planning, right? So if I had to give advice to anyone on that, I would say always involve cybersecurity early and often. When you're planning a project and let them know along the way the different steps that you're going through, what your timing is, how you intend to accomplish things, if you need to change something. Because then if you get— when you get to those gates, it'll be so much easier to get through them as a group saying we're all on board, we all know what it is that we were trying to achieve, we all made good decisions along the way, this is our plan. And it's done, right?

Whereas if you wait until the last minute to say, okay, well, I've developed this whole thing over here in this box, and I'm going to carry the box over to the cybersecurity person, and then surprise, you've got a new project on your hands. Then the cybersecurity person has to go all the way back to the beginning of the process and say, well, how did this come about? And what did you do along the way? Why did you decide to do it this way? And it creates a lot of extra work in the process that makes getting through that gate really difficult and wastes a lot of time.

So I would say it's kind of a mix of both. There's always going to be the gates, but if you prepare and you go along with the folks that are taking those products through that journey, then the gates just become a matter of course as opposed to a giant roadblock or wall that you have to climb over. Right. So for people that are thinking about their career path, uh, and maybe are considering cybersecurity, What would you recommend? Are you glad that you took the, the path that you did to get to where you are today, or what advice would you share?

Um, I, I think that there's a place in, there's a place in cybersecurity for all types of people, and I guess I would be kind of an example of one of those, right? I mean, if you ask me what, what's my favorite thing about doing cybersecurity, and I told you it's the hearts and minds thing, right? My least favorite thing about doing cybersecurity, maybe ironically, is stuff like looking at logs. It just makes my face melt. I, I don't have the patience for that level of attention to detail.

And I'm very blessed that I have people on my team who are really good at that kind of thing. But I like the people aspects of it. And I would say that if someone's considering going into cybersecurity, that they focus on what you're strong at, not necessarily on what you don't know or how much you don't know. What are you strong at? What are your talents?

And sometimes your talents are not things like, well, I know how to use PowerShell, or I know how to script in Python or whatever it is. Sometimes your talents are, I know how to talk to people and get them to do things that they might not otherwise want to do. I know how to write documents that describe clearly to people what they should do. Um, you know, there's a lot of different ways to be successful in security. I would say also security is not like the, the one and only end.

The things, the skills that you exercise in cybersecurity, just like any other professional job, can lead you on to other types of opportunities. This is the Working in security is probably not the last career that I'm going to have. I've always wanted to do a lot of other things. I've done a lot of things before I got here, and I just kind of landed here for quite some time. So I would say folks should focus on what they're good at, develop those skills, work where your passions lie, and follow that to some extent because it will bring you better success.

I love that. You mentioned that you were a park ranger in your distant past, what, what types of different things could you see in your future? Would you want to return to something in that area, or what's interesting to you? Well, I really, I loved that job because I worked in the interpretation division, and that wasn't necessarily like language interpretation, it was nature interpretation. So when you go up to— I worked at Rocky Mountain National Park— and when you go up to the park and you see the rangers standing behind the visitor desk and answering the same question about hiking trails like 500 times, or Where are the sheep?

Can you call them today? Blah, blah. That was kind of my job. And I would take people out in the woods and give them hikes and things like that. They used to— we used to have a big section of classes that the rangers would teach.

And people would ask me, oh, wow, when did you graduate? Have you got your degree in geology? And I'd be like, no, I just barely graduated from high school when I first started. I didn't have a degree in anything, but I liked to read. I liked to research.

And I was good at telling people about stuff. And I'd spent a lot of my childhood in the woods with my dad camping and whatever. So I was passionate about it too. I think if I had to look at what that was and how it translated into my career today, that passion for teaching people about things and how to care for things kind of carried over into the career now. And looking into my future, teaching is really still something that I would like to do someday, whether it's elementary or secondary level teaching.

I did it for a while in college. I was a graduate teaching assistant. It wasn't too exciting. I taught composition at a university for a year and it was difficult was grading people. I didn't like grading people.

I had to really learn that skill to become a manager. But I really liked teaching people new skills. And I liked seeing them succeed. And that's the thing I like about my career now. And it's something that I'd like to exercise in future careers as well.

That is so cool to be constantly evolving and curious about other ways to apply your strengths and your interests. I really look up to that. That's really cool. Speaking of reading and enjoying learning, what are a few of your favorite books as an English major? Well, I, I've read a lot.

My job takes a lot of my reading time away, especially with the pandemic, because I used to do a lot of audiobooks. But now that I'm not commuting to the lab every day, I have far fewer audiobooks. I'd say my favorite genre is science fiction. And one of my favorite authors is Neal Stephenson. I really love Cryptonomicon and Snow Crash and those novels.

I like some young adult literature as well. I really like Orson Scott Card's Ender's Game. And I really, I've been really into true crime lately. True crime and historical fiction. I guess my tastes are kind of eclectic in the book area.

Nice. What's your favorite true crime recent read? Oh, let's see. My most recent true crime read was Midnight in the Garden of Good and Evil. And it had been so long since since I saw the movie that I was floored by the book.

I could not believe people that were so eccentric actually existed. I've never read it or seen the movie. I'll have to check it out. It'll be quite the experience.

I just read, um, the Broken Earth trilogy by N.K. Jemisin. Have you read that? I haven't, by chance. It's excellent.

It's sort of a sci-fi fantasy fuzzy in between, and I really enjoyed it. So highly recommend. We have 2 running topics in our team discussions. One is about books and the other one is about food. So I will definitely put that on our recommendation list.

Are you a foodie as well? Not so much. We usually just talk about food because we get hungry. That's— I don't know. And it distracts from the real work.

Yeah, that's fair. I feel like also working from home, it's like a lot of times people are eating at their desks or in their kitchen while you're meeting. So that makes a lot of sense. Well, and throughout the pandemic, you know, when the best thing you have to look forward to is what's in your refrigerator. Yeah, right.

What am I going to make for dinner tonight, right? Totally, totally. Does your family still like going camping? Do you do that? Is that part of your life still?

We did that for quite a while. It's gotten pretty crowded in the mountains since I was a kid. So it's a little bit more difficult to find a camping spot. And we have a small car now. So we really don't go that far.

But I'd like to try to do that again. My son was in Scouts. And so we would go out to Scout camp, and that was a really great experience. I think I loved Scouts more than he did. So, but, but it was a fantastic experience.

We do that. We do try to get out into the mountains still now and then. That's awesome. I think especially for little kids, it's just a very humbling, good experience for a child to spend time in nature. Mm-hmm.

Yeah, absolutely.

Great. Well, this has been such an interesting conversation, and I would love to work for you. You seem like an incredible leader and human being, so thank you for taking the time to meet. Anything— any last thoughts that you want to share? No, just thank you for having me on the podcast, Courtney.

I really appreciate it. Great. Well, it is awesome to meet you, and I hope that you enjoy this rainy weather. Thank you, and you too. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security.

Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.