Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 218 for the week of July 19th This is Alex here, co-hosting with our special guest, Andre Gaeta. Welcome, Andre.

Thanks for having me. Great to see you again. Good to see you as well. 3 times, 1 week. It's like old times again.

I know. It's like the world is back open. It's crazy. It's awesome. I hope everyone's enjoying being out and being mask-free and being safe.

Definitely be safe. I know that you and I did something that was, you know, probably a little more risky than most would be up for still at this point. On Monday, we got to go to the Home Run Derby. Yeah, that was a blast. It was great to see so many people out at the stadium.

Downtown was packed, restaurants were packed, the energy is in the air. The city was electric, and it's a national event. Yep. And it was great to have it here. And, um, yeah, it's good to see local businesses starting to pick back up after the past, you know, 18 months, which has been so hard and taxing on so many people and local businesses.

So it's great. Yeah. And, you know, we're, uh, we're in my office right now. I'm downtown And on Monday, which was the first workday of the, the All-Star stuff, downtown was almost as busy as it would be on a normal pre-pandemic workday. So that, that was good to see too.

People around, the buzz back in the city. You know, during the pandemic, it was pretty much a ghost town down here and it was weird. So it's good to see that, that coming back around and being a little more normal. It's, it's great for everybody. I think it's great for businesses, but it's also great for human interaction.

Yes. I think we, we are ready for some more human interaction. So glad for that to happen. Yes. I'm glad we're not doing this over Zoom.

Yes, exactly. All right. Well, let's jump into the news. Uh, but before I do that, I've got a couple of pieces of housekeeping here. Uh, first, if you didn't know, we have a Slack channel.

Uh, it is wonderful. There's lots of people on there. Uh, it is now invite only. So if you want to join, go to the website and submit a form to get added. Or if you want, if you know somebody that's already on there, they can request through Slack to have you added as well.

Website, of course, is colorado-security.com. While you're there, we have a mailing list. You can sign up and get the show notes sent to you every week in your email. We'd also love it if you rated us and subscribed on your favorite podcast player. If you want to go even farther, let somebody know about how great Colorado Equals Security and all the stuff that we're doing.

And finally, if you want to support us financially, we do have a Patreon campaign. We take all of the money that comes from the Patreon campaign and use it for the costs of Colorado Equals Security. And thanks to all of our current patrons, definitely appreciate the support and belief in us for the movement that we have created. All right, so for one week only, for this month, I will match any new Patreons that join, just for this month, not for the entire year. Okay, so if we get some more folks that join between today the 16th and the end of the week, what is it now?

Is it $10? So yeah, so if you do the $10 a month level, then you get a t-shirt and a shout-out on the show. Those are the canned levels. You can do whatever level you want though. You can do between 1 cent and infinity.

So somewhere in there, that would be great. I'll limit to the $10. I'll match. If someone does infinity, that's great. I hope you guys get infinity.

That would be wonderful. That would be great. And just to be clear, I'm not opening it up to all of your hacker types out there that listen to this that want to try and hack Patreon so that it can show infinity as the amount that you're giving. I'm not encouraging that. No, absolutely not.

Anyway, all right, let's jump to the news. First story, I think we talked about this when it happened, but Air France is now doing a nonstop flight from DIA to Paris Uh, and this story is just talking about why it is that, that Air France chose to do that. So some interesting stuff there. Yeah. So do you know, is that reciprocal?

Is it Paris to Denver and Denver to Paris? Is that now a regular route? Yep, on Air France. So, so clearly, I mean, for us, right, we are a great destination location for all the summer activities, all the winter activities, uh, from a leisure perspective, right? With travel opening back up, I think for Air France it's a no-brainer to say, hey, let's open up a new market, let's go to Denver.

Yeah, and that was— it sounded like was one of the things that they considered, right? So they said sometimes it takes them a few years to figure out if, if a market is right to jump into, and it took them less than 6 months even during the pandemic to decide that this was the right route for them, uh, partially because there was going to be the business aspect. You know, Norwegian, which was a budget carrier that had a direct flight from here to Paris, they pulled out of the market. But then secondarily, there's all that leisure traffic. You know, people coming in the winter for for skiing, people for doing other things in the summer.

So it seemed like the right thing, and I'm glad that they've got that. Right now there's, I think, only 3 weekly non-stops back and forth, but it sounds like depending on how those go, that may increase. Yeah, that's great. And for those that want to start traveling internationally again, right, France is a beautiful country, lots to do there as well. So let's go back and reciprocate.

Yes, also a great jumping-off point for other places in Europe. Yeah, absolutely. Cool. Well, jumping to our next story, this is talking about the real estate market in Colorado, and we hit yet another record, but the data is looking like maybe things could be cooling off just a little bit. I don't know what to make of it, and I don't know what cooling off means.

I live up north, and as I look around up north, the building just seems to be happening exponentially. Folks who are moving into new build homes now are on waiting lists for 2022. And I've heard, probably like yourself, stories of— I believe the article that I read talked about it being the great reshuffle, right? With the pandemic, with remote working, people moving out of high-cost cities into lower-cost cities that are more centrally geographically located.

I've heard some crazy stories about home buying and people coming in above asking and waiving inspections and waiving appraisals. So the market here is great. I don't know what cooling off means. Yeah, right. Cool when you're still this— how does the sun is still pretty hot, right?

One of the things that they mentioned here is that the median price of a single-family home hit a record again, going over $600,000 in June. And also the average price also was a record at $728,000, which is just insane. But the things that they saw that they think may be leading to things cooling a little bit was a much larger inventory on the market. You know, and that is— that's something that's been driving the prices up, right? If there's no houses to buy, you got to bid higher on the ones that are there if you want one.

And also some anecdotal things here. They have a couple quotes from realtors saying for the most part they are seeing people that are getting their asking price, not necessarily a giant amount over the asking price anymore, or even a few that have been below asking price. So again, while that still seems, uh, pretty hot, maybe not as scorching hot as it was previously. I, I think that'd be great for it to come down a little bit. It does seem a bit ridiculous of where the market, where it is.

And, you know, for all the listeners and myself, and probably you included, it's like kicking yourself, like, man, I wish I just bought like one extra piece of property like 5 years ago. And right, but here we are. Here we are. All right, next story. Lumen is reportedly considering the sale of its consumer operation business for $5 billion.

So of course, Lumen is formerly CenturyLink. CenturyLink is the combination of CenturyLink and Level 3 and, you know, about 27 other telecoms over the years. Let's not forget US West. US West, Quest, right? TW Telecom is rolled up in there.

That's right. A few other of those. But, you know, I think this is a little bit interesting. I guess it's not super surprising to me. You know, you had Level 3 and CenturyLink that came together.

Level 3, which was essentially just an enterprise-facing company, And then CenturyLink with both consumer and enterprise facing. So now you've got this big enterprise footprint, which is probably more lucrative these days than the consumer footprint. So maybe you sell off that consumer footprint and focus on the enterprise, take that cash and plow it back into the business. I think it's a smart move. The consumer business, right, is so highly competitive, and with the increasing mobile and Wi-Fi options that are becoming available, there are neighborhoods now that are including the last mile for free as part of their new builds.

It's smart. Still, $5 billion is not a small price tag. It's good for the enterprise business, to your point, and potentially could see some additional reinvestments there. I think that consumer business, it's going to drive a lot of fairly consistent revenue for a long time. You're still going to have some people that want telephone service and some people that want internet service delivered in the traditional ways to their houses and that kind of thing.

You're going to have some good revenue there. But it's not going to be on the cutting edge, I'm going to imagine. So, uh, you know, it— there are companies that like that. Hey, we want a certain amount of revenue, and then, you know, we'll play it out, and whatever happens after that happens after. It's a mature asset, right?

It's an annuity, right? It's going to produce some degree of revenue for some period of time, and it'll slowly dwindle down. I mean, if you look at AOL dial-up, that business really wasn't EOL'd even after Verizon bought them. There was still, right, um, I think the number that I heard was like a $5 million annual national recurring revenue stream from people all over. So I mean, it took a while to wind that business down.

So this will have a long tail on it for sure. Yeah. And so it seems like a good idea for me, and we'll see if it comes to fruition. Do you still have a phone in your home? We do not.

No, no physical phone in our house. Yeah, we don't have a physical phone either. It's been a while. I know. Yeah.

Yep. All right, moving on. Next, the Colorado Economic Development Commission offered $20 million to 4 different companies that are looking to add 1,000 jobs in the state. So a couple of interesting projects in here. The biggest one was a $12.5 million potential grant to a company that they're dubbing Project Windward, that they are looking to do an R&D center here that will help them build up a new digital commerce team which would give 625 jobs up in Broomfield with an average wage of $112,000, which is pretty cool.

There was some excitement in the story that this is a lot of jobs for the Broomfield area, so, so pretty cool for that. There are a couple others in here. One that they were talking about, uh, an aircraft design company that helps improve the range and endurance of virtual takeoff and landing. That sounds pretty cool. I think that one was got aimed for El Paso County.

And then the last one, which is the smallest one, which they dubbed Project Baseball in honor of the All-Star Game, uh, was— is going to a Maryland-based company that provides crime and fraud intelligence solutions for mobile devices that include law enforcement carriers and insurers. That, that one looked interesting to me in terms of what it is. Again, they don't tell us what these companies are. They give them code names until someone either accepts offer or go somewhere else. So we'll have to see what happens.

It's great to see the state offering up $20 million though to draw in more companies, right? We're continuing to see the, the landscape down here change. Um, you know, 5 years ago we didn't have companies like Exactly, right, with a giant billboard, and we didn't have companies like Gusto showing up here. So Slack is moving in, right? We're just seeing continual companies moving here, and the fact that the state's willing to offer incentives to get more business here, I think is great.

It certainly will help support the housing market. Yes, if we want to keep the housing market hot, let's keep doing this. Yeah, let's keep doing more of this. I also thought it was interesting in one part of the article, I think it was for that first company, the company spokesman, again, who they don't name because they don't tell you who the company is, Project Windward, but Project Windward had said that the offer that we gave them was not competitive with some of the other places where they were looking. Interesting.

But I like the fact that it's not competitive because there are those places where they'll essentially mortgage the farm to get a company there and then they're there. But it doesn't really provide you any benefit because you've, you know, given them tax-free, you know, whatever for however many years. And then it's like, well, what's the— yes, we've got— now we've got more people here and no benefit from it. So I like the fact that we're giving incentives. But we're not mortgaging the farm to make sure that people are coming here.

Yeah, yeah, and again, right, it depends on who you're competing against as well, right? I mean, if you're competing against New York, it's gonna be very, very tough. And yeah, you certainly don't wanna mortgage the farm, increase stress on resources and infrastructure, right, whether it be water, whether it be roads, and not have any benefit on the other side if we do that. So, smart. All right, moving on.

Next article we have is a blog from the Bite Back blog and David Stause. Talking about the fact that the Colorado Privacy Act has been signed into law by the governor. Yeah, so we are now number 3. Yep. California, I believe Virginia was the second, and now Colorado.

So we are ushering in a new era of privacy in Colorado. We've got a law now that's going to be similar to CCPA and GDPR and things like that. Obviously some differences to it, But we've talked about this on the show in the past, about some of the details around it, so you can go back and listen to that. Or if you check out this blog, they have a link to a webinar that they did talking about the Privacy Act. I think one of the interesting things here is that we do have plenty of time because the Colorado Privacy Act will not go into effect until July 1st, 2023.

So we've got a couple years before we actually have to worry about it. Yeah, unlike California, which ushered it in very, very, very quickly. Right? We're gonna be a little bit more thoughtful and pragmatic about the approach, but the bottom line is it's coming. It's designed to protect consumers, right?

And I think it's a good thing at the end of the day. You know, it can be a burden in a lot of ways to businesses that are trying to operate, but it's important that we have these privacy laws in place, especially when you think about things like healthcare. You know, that to me, that would be an area of high concern. For sure. Good stuff.

Uh, next we have a press release from Quantum Metric talking about a new hire that they have. Reza Zaheri is now the Chief Information Security Officer for Quantum Metric. And I don't know Reza, but we put this in here because you don't often see press releases for new CISO hires. So I think that's pretty cool. I think it's very cool.

And, and hey, Reza, hopefully you're listening to this and hopefully you, uh, drop us a note and join the, uh, Join the community and maybe even join the Slack channel. It'd be great to chat with you, maybe even have you on the show one day. That would be cool. Yeah, so if you are Reza or if you know Reza, have them come check out Colorado Equal Security. Send them our way.

Speaking of CISOs, the next article was a Q&A with the new CISO of Centura Health. Sanjeev Shah started, I believe, beginning of the year, maybe a little bit before that if I, if I remember right. But this is an interview that was done with him talking about his role and what he sees in security around healthcare. Yeah, I can't wait to listen to it. I haven't yet, but Centura as an organization is a phenomenal organization providing great healthcare to lots of patients.

So I'm excited for Sanjeev and that organization. Yep, good stuff. Definitely going to have to listen to that interview as well. Next, another CISO article. There was an announcement this week for the CISO Connect inaugural list of the top 100 CISOs.

And we're talking about this, no doubt, because there are some Colorado CISOs on that list. So there were 2, Randall Frietzsche of Denver Health and Sam Masiello, now of Beckage, which is a law firm. He was previously at Gates and Teletech and Sorry, what's the— what's Tel-Tex new? Anyway, he was at MX Logic before that. MX Logic.

He's been around for a long time. Both those guys, great CISOs, great members of the community, and we're very excited for them. Also, a couple other people that were on the list that we wanted to note: Christine Vanderpool, who used to be here in Colorado, was CISO at Molson Coors. I was trying to remember if it was— it was the Molson side, not the Miller side. Yep, it was Molson Coors.

And then over at Deputy CISO at Kaiser before she left and moved to Florida. And Ken, and I apologize to Ken, I have met him before, but this is going to be tough. Athanasio, who is the CISO for VF Corp, which is of course a Colorado-based company, but Ken is actually based in North Carolina still, I believe. But anyway, at least a sort of side part of our community. So congratulations to all the folks that were on that list.

Yeah, what a great list to be on, and congratulations to all those those guys and gals. Speaking of lists, we have another one. LogRhythm was recognized as a leader in the Gartner Magic Quadrant for 2021 for SIEM for the 9th consecutive time. That, that's impressive. I know right now that that space is as competitive as it's ever been, and to have a Colorado-based company continue to land in the upper right-hand quadrant 9 years running, they're doing a great job over there.

Yeah, congrats to LogRhythm. Good stuff. And we look forward to other good stuff from them as well. Keep doing what you're doing. So next we've got a couple security blogs.

One is from Zavilo. The title is Malicious Office Documents: What Is Old Is New Again. And I think, Andre, you were saying earlier malicious office documents, what's old has never gone away. Yeah, I don't think it's— I mean, Yeah, it's not what's old is new again. It's been here forever.

It's not anything new from an attack vector perspective. And as we were chatting about, and this is probably worthy of a conversation at a roundtable or a next get-together, but the question is, as Microsoft continues to grow, the target on their back has never been bigger. Now, is that good or is that bad? We talked about some of the things in the news lately.

Microsoft is a very reputable company with lots of security people and lots of security professionals, but as they continue to be at the center of all things, I think there's cause for maybe deeper inspection around all things. Yep. I think agreed, and also on the flip side, Microsoft is one of the biggest companies that's out there, lots of security resources, so I think that if somebody was going to have to handle that problem, I think they're a good candidate to do it. Yes, yes, absolutely. Back to the blog itself, one of the things I like in here, it does a good job of talking about the ways that people are weaponizing Office documents today, some tactics that they're using, some ways that they're trying to exploit people.

So if that is of interest to you, check out that blog and get some of the details around that. And then finally, our last news article comes from Red Canary. They are talking about the fact that the Atomic Red Team testing framework has added new tests for cloud and containers. More specifically, these are Linux-based items. So pretty cool there.

For those that aren't aware, Atomic Red Team is an open-source testing framework that you can use to— that maps to ATT&CK techniques so that you can test your defenses and make sure that they work correctly. Traditionally, a lot of those tests have been focused on the Windows endpoint, right? That's where Red Canary's sweet spot is. You know, they're trying to protect your endpoints, and so that's really where the tests that they have developed have been. But now they're moving beyond that, so into Linux, into cloud, into containers, and I think that's definitely a good thing.

Yeah, to your point earlier, right, there's commercial tools that are available. I think the fact that Red Canary is making this available for free and expanding beyond solely Windows is a great resource to the security community. So hats off to those guys for developing it and making it available to anyone who wants to use it. Yep, great stuff. All right, that's all of the news stories for this week.

Let's move on to the Slack message of the week. I would like to thank Andre, who supports our Slack message of the week every week. So thank you, Andre, for doing this. You've been a wonderful member of the community, and we appreciate your financial support of this. The winner of the Slack Message of the Week will get one item from the Colorado Equals Security store.

So we will, we'll be in contact with you and you can work with Andre to get that. And so the, the winner this week is— there was a lot of good candidates this week, but, but I think the one that hit home with me this week was in the Random channel, which is a great channel. If you're not checking out the Random channel on a regular basis, Pop over there. There's some good stuff. But Colin Grady, great job.

The robot vacuum grabs me a beer video was fantastic. I actually went online to see if there was a robot vacuum that I could get to do that for me in my home. I haven't found the commercial application for it yet, but anytime a robot vacuum can be converted into a beer retrieving machine, I think that's fantastic. So congratulations, Colin. Reach out to us or we'll reach out to you and You get to pick out something from the Colorado Equal Security store, and there's lots of good stuff out there.

So there is for sure. I was pretty impressed by the robot vacuum, and if I could get that— if I get mine to bring me a beer, I would definitely do it. Oh yeah, absolutely. Alright, moving on, let's talk about events. As you guys may know, we have an event calendar on the website.

Check it out at colorado-security.com. On the podcast, we talk about the events coming up in the next 2 weeks, and we're still a little bit light. We've got 4 events that are coming up. First of those is the ISSA Colorado Springs chapter is doing their July chapter meeting on the 20th of July. And on July 22nd, Data Connectors Denver Virtual Cybersecurity Summit.

On the 24th, ISSA Colorado Springs is doing their July mini seminar. And then rounding out our 2 weeks on the 28th, ISC² Pikes Peak July hybrid meeting. Yeah, so it looks like we got a good amount of Colorado Springs stuff and then the Data Connectors virtual event there. So I think we do have a few events that are coming up after that, and I would imagine coming into the fall we'll start to see more events popping back up on the calendar. Yeah, we're starting to see that happening for sure.

Yep, good stuff. All right, let's jump over to jobs. We got some interesting jobs this week. First on that list, Drata is looking for a compliance manager. Ross Hosman is the new CISO over there and is looking to hire a compliance manager.

Uh, Ovintiv, formerly Encana, is looking for an IT security analyst. Pulte Financial Services, my former employer, is looking for an information security intern. And Zoom, a company we all got very familiar with this past 18 months, is looking for a senior privacy analyst. CyberGRX is looking for a security risk analyst. And Lumen, who was mentioned earlier, is looking for a product software development security Senior Lead Information Security Engineer.

I think that's going to win for longest, most confusing job title of the week. NREL is looking for an Information Systems Security Manager, Manager II. And Denver International Airport is looking for a Senior IT Security Analyst. Graybull Companies is looking for a Chief Information Security and Privacy Officer. I think that's interesting in that you have both roles combined.

Absolutely. And to compete with Lumen for longest title, the Southwest Fire Rescue is looking for a senior systems and information security analyst. Yeah, so if you always wanted to be a firefighter but, you know, decided it wasn't for you and instead wanted to do IT and security for them, got a job for you there. Perfect. Awesome.

Well, that is the end of the newscast for this week. We do have a feature interview. Jason Jaques got together with Nigel Thompson who is VP of Product Marketing at BlackBerry. I think that the title is a little bit misleading there. Nigel is somebody who's been around the security community, so I think this is going to be an interesting interview, and I look forward to hearing it myself.

Yeah, absolutely. Look forward to it. Awesome. That is the end. Andre, I appreciate you filling in for Robb, and I believe Robb will be back next week, although I think I will probably be gone, so maybe someone else will be filling in for me.

Next week. All right, well, enjoy your time off and thanks for having me. It was great to be back on the show and I'll see you soon. Awesome. This has been Colorado Equal Security and we'll talk to you next time.

Hi, this is Vincent Grimard, CSO at Nelnet. Welcome to Colorado Equal Security, for Colorado security professionals by security professionals.

Hello, Colorado Equal Security. I'm Jason Jaques. I had an opportunity to interview another very interesting individual in the community, Nigel Thompson. Nigel is the VP of Product Marketing at BlackBerry. Here's the interview.

Enjoy. Hi, Nigel. Thanks for joining me on the podcast. Great. It's my pleasure to be here.

And you are coming to us on the other side of the world relative to Colorado Equal Security, because the other side of the world is the other side of Colorado. You're coming to us from Aspen, right? Correct. Actually, just to be precise, Snowmass Village. Oh, okay.

Okay. Yeah, I don't know that there's a difference. There's, there's a difference. There's a difference. Usually if you're in Aspen, you own a plane.

If you're, if you're in Snowmass Village, you own a truck. Okay. Okay. You just have to rent your planes. Is that what it is?

That's right. Yeah. Okay. Right on. Right on.

So let's start off with your background. Can you tell me where you're from? Sure. Um, South of— I like to make fun of the Texans also because there's a lot of Texans here. I say I'm from south of Texas, um, and they get confused by that.

But actually in the southern hemisphere, uh, a couple of islands, uh, that makes up New Zealand. Yeah, that's where I was born and raised. And, uh, I, I originally got to Colorado, um, right out after university. I was going to do a backpacking trip, so I thought I'd go to Colorado, go ski a season, and then I was going to head to Europe. And, uh, you know, to do that sort of thing.

And actually in New Zealand we have a name for it, it's called your OE, your overseas experience. And, uh, partly is, you know, when you're, when you're sort of the last stop before the South Pole, um, when you travel, you, you know, back in, you know, in the '80s, it was a pretty big deal, uh, to leave. It's a long way to go and it's a, you know, big, big investment. So usually you travel quite a bit. Um, so that was, I was on the beginning of my OE and I think, you know, 30 years later, I'm probably still on it.

Um, so I got to Colorado and, uh, enjoyed my first season there, then discovered summer in the Rockies and fell in love with that. And then suddenly it was winter again. So I thought, what the heck, might as well do another ski season. So, so that's kind of how it went. It was a little bit of a rinse and repeat for a while, um, you know, being, being the, the proverbial ski bum and then realized I should probably do something else besides that.

And, uh, and then, you know, the internet was just getting started. In the mid-'90s. So I sort of got curious with that. I thought that was really kind of interesting and, you know, played around and, you know, did some stuff. And then at some point I got asked to join a company in the tech center in Denver.

The company was called Navidek. It was back in the day when websites were magical. So, you know, we were building websites for, you know, for large companies, you know, we'd be classified as a system integrator and And that was a great experience. It was super fun. You have to put it into context of the timing.

It was like we were inventing things. The web was still early. Nobody really knew how you did things. So there was a lot of experimentation. Some stuff worked great.

Some, maybe looking back, maybe that wasn't such a good idea. So it was really great. It was a great group of people in Denver. We had so much fun building that. And then, and then I transitioned, I ended up moving to a dot-com startup in Silicon Valley.

And that was more on the sort of, it was when Java was a big deal. So we were sort of doing Java connectors and things like that. And that was great. And, you know, really charismatic CEO, you know, we traveled a lot, we went all around the world, you know, pitching our products and, you know, you learn a lot. You really do learn a lot when you're, you know, when you're a little bit bootstrapped and, you know, you're out there with the customers and you're on cutting-edge technology.

It's a great way to learn. And then after that, I ended up back at a company again in Colorado and it was sort of the beginning of the mobile revolution. So mobile was becoming more important. It was still pre-iPhone.

Uh, you know, I think that's probably a— that's probably a significant timeline in the mobile world. Um, so, you know, BlackBerrys existed, uh, you know, there were Windows mobile devices, and the company I was working for, um, did a lot of work with, um, with sort of more the rugged side of things, you know, the rugged scanners that you might see baggage handlers have or, you know, UPS, you know. And at the time we were building software and we were, you know, pushing it out to these devices. Um, and actually, when I say pushing out, you literally had to get the device in your hand and you had to load it and then you send it out. And, uh, after a while I was like, you know, this is kind of crazy, you know, because we'd send out all these devices and then we're like, oh my goodness, we need to make a change to the software.

How do you do that? And we take that for granted today that there's an app store and there's automatic updates and all that stuff. But back in the day there wasn't. Um, so I thought, well, that's really crazy, you know, we should be able to do that. Um, and that was sort of the beginning of You know, it's the curse of the entrepreneur who gets an idea in their head and it won't leave.

You know, it just keeps nagging at you. And, um, and the— and you're probably, you're probably a little bit arrogant, like, I, I could solve that problem, you know, that's not that hard. Um, and then you decide to do something about it. So, um, started to build, build some technology. Um, and at the time, you know, there were some other products out there that could— and by the way, this is the emergence of a market called mobile device management.

There were some products out there, but they were sort of— they relied on, you know, a device to be on your network. So if you can see it on your network, you might be able to push it out. But we were sort of in that new phase where the devices weren't on your network, they were on Verizon's network or AT&T's network. So it took a different type of technology. So at the time, I thought it'd be cool to use the cloud and use the cloud to push out, you know, applications and files and things like that.

Yeah. There is a whole lot to unpack there. Yeah. Hey, I lost the— Hey, Jason, I just lost the screen. Can you still hear me?

Yeah. Let me go ahead and interject here. It was at this point in the interview, about 6 minutes in, that we had some major technical difficulties. A computer crashed, and it took us about 10 to 15 minutes to regroup and restart the conversation. The problem is we didn't know where we left off in the conversation.

Now, the interesting thing is the remainder of the interview, I think, turned out quite fascinating. So without further ado, here is the second part of the recording of the interview. Enjoy. I have no idea where we left off, but I do have some things that that I still want to explore. Sure.

Yeah. Yes. Yeah. So, so growing up in, in New Zealand, whereabouts did you grow up? And what was, what was it like growing up in New Zealand?

Okay. It's, so not to age myself, but well, first of all, for those who aren't familiar with New Zealand, It's a couple of islands conveniently labeled North Island and South Island. And about 3 quarters of the country lives in the North Island.

And then about half the country lives in one city, which is— we call it Auckland and Americans like to call it Auckland, which always sounds really funny to us. But it's actually a little bit like San Francisco for those— it's on the bay. It has a Bay Bridge and it's very hilly and lots of Victorians. And it's beautiful. I mean, for those who love sailing, we had the America's Cup there earlier this year.

It's a very outdoor orientated place. I think Coloradans would probably gravitate to it. And then the South Islanders, where the North Island is very sort of, you know, rolly, lots of farms and things like that. And, you know, obviously hundreds of miles of beach. The South Island is more mountainous.

The Southern Alps, they're actually bigger than the Swiss Alps. And, you know, for those who like The Lord of the Rings, you know, a lot of the dramatic scenes where they're kind of, you know, traversing across the ridges and the peaks and things like that, that was all filmed in the South Island. And, and actually, there's a big film industry there now, um, because of Weta Workshops, because of Tom Jackson and, and, uh, and that. So that's kind of cool. Um, and then growing up, it was, um, you know, I grew up in a small little suburban town, um, and, you know, went to high school there.

And, you know, we, we all played rugby. That was, you know, you know, like we— you have football here, for us it's rugby. Um, and that's sort of what the country sort of rallies around as a sort of a primary sport. Yeah. And, uh, no, it was good.

It was a good lifestyle. Um, you spend a lot of time outdoors on the beaches, and I think, you know, if you talk to most Kiwis, um, your lifestyle is important, you know, finding that balance. I sometimes find it with my American colleagues, um, it's not neither right or wrong, um, is it? We, we do value our lifestyle. And, uh, you know, sometimes I see some of my colleagues, you know, from a professional standpoint, that that's how they identify, identify as just with work and it's only about work and, and then everything else sort of, you know, ladders down from that.

Yeah. And, um, yeah, it's different. Uh, so consequently, I like to, you know, I'm living in the mountains because I like to find that balance. And I think it helps a ton, really. Like, from— everyone's different.

Um, you know, whatever your outlet might be. You know, for me, I enjoy, you know, being in the mountains doing something, um, you know, whether it's biking or skiing or whatever. And it's a great way to process too, you know, like if you're struggling with some stuff at work and sometimes you get so caught up in your head, it's kind of nice just to get out and suddenly what seemed complicated could, could be, you know, solved quite easily. So, right, so that's nice. And, and I think a lot of people that live in Colorado sort of share those, share those values.

Yeah! And then you had a term for it for, I guess, for— am I allowed to say Kiwis or is that just a term that only you guys say? No, that's fine! Yeah! Okay!

But I should qualify that a lot of times when Americans hear the word Kiwi, they think of the fruit. Oh, I totally think of the fruit! Yeah! See, that's a double-edged sword. That was like the marketing was overly effective.

No, actually just Just as a data point, a kiwifruit— do you know what the original name of a kiwifruit is? No clue. It's the Chinese gooseberry. Oh, okay. So, um, somewhere in the— I think it was the '80s, um, someone, some entrepreneurial, um, horticulturalists realized that these things grow really well in New Zealand.

Um, so that became a big thing. It was like people were investing in kiwifruit farms. Yeah. Um, And, uh, and then we started exporting it to America. Wow.

Um, actually, actually one of my jobs in, you know, in university and high school was picking kiwi fruits, which is a horrible job. Yeah. Um, because the, the very— all the fur comes off and you get it up your nose and all that sort of stuff. But, uh, anyway, the reason we called it a kiwi fruit is the kiwi is our national bird. Yeah.

Um, and, uh, and you can't make fun of us because our national bird is flightless and blind. Um, but, and it's nocturnal, and it's, uh, it's kind of, um, it's probably the size of a, of a small, like a smaller than a soccer ball, and has a very long beak. Um, and, uh, and, uh, yeah, it's our national bird. You guys get, you know, the bald eagle. I won't even ask how that became the national bird, but yeah, yeah, yeah.

Well, we have a lot of birds. New Zealand never actually had, um, That was the only mammal on the islands was birds. There were no other animals. There's no— there were no, you know, cats or bears or whatever. All of that was introduced, you know, we actually still don't have that.

Everything was introduced. But anyway, yeah, so the Kiwi, you can call us a Kiwi, but just don't think of us as a fruit. Okay. All right. Fair enough.

And then there was another term though that you used for the Kiwis who travel and go overseas for for a long time. Yeah. What was that? What was that term again? It was, you know, we all, we all called it the OE.

OE. So, okay, OE, which stands for overseas experience. And it was, it was almost, um, sort of a given rite of passage that, you know, sometime, you know, in your 20s, you would get a backpack and you'd go to the airport and your family would all wave and say goodbye to you. And, um, you'd be gone for a couple of years. So it's just a thing you all do?

It's a thing we all do. And I still, you know, I, I think if every single Kiwi who went on OE, like, if everybody just came back, the country would probably double. Um, because there are, there are, you know, there are Kiwis everywhere around the world. Yeah. And a lot of them are on their proverbial OE.

They just never go back. I'm 30 years into it. So, um, yeah, no, but yeah, yeah. So, so anyway, that's, that's the— and I think, you know, I think, uh, it's, it's a fascinating social experiment, um, because what if you sent all your young people overseas to travel around, um, and then, you know, a good portion of them come back? It's kind of like the greatest hits.

Like, if you get— everybody leaves and they find, you know, wow, this, this cafe in France is amazing, or this, you know, restaurant in Turkey or whatever, and they start to bring a lot of that back. So You asked earlier what it was like growing up. When I was originally— when I grew up as a, as a young person, um, we were still sort of post-colonial, so things were still very simple. And, you know, a lot of our heritage was sort of more from, you know, England and Europe, so it was meat and potatoes and nothing very— and, you know, tea. We didn't really drink coffee.

Yeah. Um, and now if you go to New Zealand, it's, it's like It's 100% cosmopolitan. And I think, I think that's attributed to this whole OE thing of you sending young people off and bringing back. So it's actually a very diverse place. Even, even you go to a rural little town and people are wearing their gumboots and they got their pickups and dogs in the back, you know, they're ordering a, you know, a, a cappuccino with biscotti.

It's totally unexpected. Um, so So yeah, and it's a very friendly place. I think most people would say, you know, New Zealand is a very friendly— so yeah! What do they think about the people like you that never come back, never come home? Well, they make fun of you.

It depends where you go, you know? There was a period of time where they'd make fun of me based on what's going on with American politics, you know, whether, you know, whatever your perspective is. And then, you know, you may not notice, but, you know, I have an American accent as a New Zealander. See, I don't notice. Exactly.

Yeah. New Zealanders do. So, okay. So then they'll make fun of me, right? So, but it's all, it's all good fun.

Yeah. And sorry about that. And yeah, so yeah. Yeah, that's, that's, that's awesome. The The other thing I want to talk about that you got into, it was, I think the company that you started, was it— what was it called again?

It was called CloudSync. Okay. Yeah. What got you into that specifically? What, you know, what led you to start up that company?

And let's explore that a little bit, if you don't mind. Yeah, I think, well, actually, I know it was really based on frustration.

As a technologist, we were trying to do something completely different, right? In this particular case, we were sort of building mobile applications and we're doing enterprise-type applications and there wasn't an easy way to load applications. And then the you know, the devices are out in the wild and they're all over the place. Um, this— in this use case, it was at airports all around the country, um, in the hands of baggage, you know, scanners and things like that. And, uh, and then we wanted to do an update, and it was like phone calls and FedExes and sending devices back to be up, you know, to be reloaded.

And yeah, I was like, that's, that's just crazy. That makes no sense. So that was sort of the beginning of it. Um, and then, you know, then there's the thought that I can solve this problem, like, you know, and that's, uh, you know, I think that's sort of the entrepreneurial curse is you see something and for you it's obvious, um, and it needs to be fixed and you, you think you know how to do it. And then, you know, clearly once you get into it, um, you know, you sort of get to that point of no return.

Like once you've committed, you're doing it. Yeah. You know, if you're you're bootstrapping it, you're starting to, you know, burn through your credit cards and you're, you know, you quit your main job and, you know, you're trying to make this thing happen and, you know, you think you can do it in a few months and it takes really more like 2 years. Yeah. And, uh, and, and, but then once you get, get it going, it's, it's, um, and I don't know, I mean, I think it's different for everyone.

I think for me there was around about The first 2 and a half years were, was ups and downs. Like you'd start to make wins and progress, you'd get some customers and then suddenly things were going badly or whatever. In my case, I always found that whenever I went on vacation, my servers would crash. Okay. Yeah.

This is sort of early cloud days when you have to, you know, there was no Amazon AWS at the time. So, so yeah, so, so lots of ups and downs. And I think probably by about year 3, things really started to stabilize, you know, Your revenue became predictable. It was sort of the magic. And then by the time we hit the 4th year, we were making really good ground and we started to pick up interest from other companies.

We were starting to step on people's toes. And in this particular case, I ended up selling the company. And it was at that point where you as an entrepreneur have sort of some decisions to make, which is if we want to go to the next level, you know, we're, we're probably going to need to take it, take in some more money, you know, which is fine. Um, and then, you know, you're going to dilute, you can do all that sort of stuff. Um, or, um, you know, you could do an exit, right?

And in my case, um, we were working with a customer. It was a large multinational pharmaceutical, even though we were a tiny little company in the Highlands area and district and in Denver. And I guess they call it Hi-Lo now. Um, and there was just like 5 of us, you know, stuck in this sort of essentially a large cubicle. But we were working with these sort of large companies and we were doing some pretty cool stuff.

And, um, and this pharmaceutical was also working with another company that was doing something very similar except they liked our stuff better. Um, so they— and this company was called Good Technology. They were out in the Bay Area and Um, so then, so, so the— so they were like, well, you guys should, you guys should integrate with CloudSync. And that's sort of how that conversation started. So, um, so then, you know, they immediately went into, this is a small company, we, we don't want to talk partnerships, maybe we can just, you know, buy them.

Um, so then that sort of started that conversation. And then, you know, world is funny, like once something like that happens, yeah, sometimes there's sort of a synchronicity. Then suddenly we got approached by another company at the same time. So I don't know exactly how that happens, um, but it does. And suddenly you've got 2 companies that were interested in buying you, and, um, you know, then you have to make a decision.

And then, you know, and it's a good problem to have, right? Like, yeah, do I pursue the, you know, the— do I pursue, you know, getting more funds or whatever? So, so that's kind of how it came about. So that was sort of a little, you know, snippet of being a sort of small startup. But the 4 years felt really good.

Like, it felt like a good amount of time. Yeah. You know, I, I have some other, you know, I know some other entrepreneurs and But, and they sometimes you can go too long, um, where suddenly you're in year 9 and 10 and you're like, uh, and then suddenly your market's commoditized and the magic's gone and now you're just, yeah, you know, it gets scrappy. So, so it's interesting. So in hindsight, what, uh, what would you do differently, do you think?

I would have sold to the other company. Oh really? Okay. I mean, it was, it's, you know, you look back on it. So actually, you know, um, in hindsight, um, I would have done exactly the same thing because the whole experience was great.

And, you know, Good Technology was a fantastic company. You know, it was probably about 400 people when they acquired us and, you know, they'd been through, they had been restructured sort of a couple of times. And then we sort of found our sweet spot, which was around, you know, application management and it went exponential. And we had a great management team. You know, we brought on a younger CEO and she was great.

A lot of energy and we had fun. You know, we would, we would do these road shows and we'd be traveling around the world and, and, um, it's just, it's a great experience and I wouldn't, I would never, um, say that I wouldn't have wanted to do that. You know, I really enjoyed working with, you know, what, what is, what's better than working with really smart people and doing something innovative, having fun? I mean, that, that's what it's all about. Yeah.

Would you do another startup? Uh, well, currently I work for, for a lot, for, for a reasonable size large company. I just mean in the future, like down the road. Well, it was a lot of fun, you know, it was a lot of fun. Yeah.

So I wouldn't say no. Okay. I'm not trying to get you in trouble. Yeah. Let's actually talk about your current gig.

So what is your role and tell me a little about it? Yeah. How'd you actually come into this too? Well, it's the— I feel like I'm sitting in the same seat at the same place and doing the same thing, but suddenly the company names have changed. Yeah.

So I kind of went through— so after I sold Cloudflare, So, you know, we were based in Denver, sold it to a Bay Area company called Good Technology. Uh, Good was planning on doing an IPO and then, you know, it was sort of during the markets and things got a little weird and then they ended up getting acquired by BlackBerry. Um, and, and part of the reason was, uh, you know, BlackBerry had been through a massive pivot. Um, you know, talk about an iconic brand, right? Right now it's a meme.

It's a meme brand right now with AMC and GameStop. But, um, It's, uh, so BlackBerry, um, you know, clearly when the iPhone came to the market, it changed everything. Like BlackBerry was the iconic mobile device to have for enterprises. Oh yeah, the technology even today, uh, from a security standpoint and an architecture standpoint, it's still, uh, probably better than what you're going to get with consumer-grade devices today. There's a lot of, you know, and I should be clear, we don't build devices anymore.

We don't make handsets. You know, clearly when iPhone came out and Android came out, like that market just took off like crazy. And it was also, you know, I don't think BlackBerry at the time could rationalize it, you know, because from their lens, they were like, well, The reason you use us is because of security. And, you know, V1 of iPhones and Androids were absolutely not secure, um, but people love them, right? They love the user experience.

And I think that was part of that. It was a difficult rationale because it's like, you know, we do— we've got 400 things of security and they've got like 3. Um, there's no way, you know, a major bank or a government is going to switch. But they did. Why?

Because, you know, the CEO was like, I really like this device. IT, figure out how to make it work. Right?

So Good Technology was working on iPhones and Androids and they were basically doing the same sort of BlackBerry type end-to-end encryption for communication and email and messaging and all that good stuff. So when BlackBerry sort of was at its low point, John Chen, who's now the current CEO, came on and he needed to turn this thing around. And at the time, BlackBerry was like a Boeing 747 pointed straight down to the ground. It was going down hard and fast, burning massive amounts of cash because it was a very large company. And he turned it around and he did something that not many people have done in technology is to pivot from being a hardware company to 100% software company.

And that's hard. That was a really hard thing to do. And he did it. And he did it through a number of acquisitions. So you asked me, how did I get to BlackBerry?

So I was with Good Technology and they acquired BlackBerry— sorry, acquired Good Technology to really solve that software-based problem for iPhones and Android devices. And since then, we've done a number of acquisitions. You know, BlackBerry is a— on the— since, uh, and you asked me what I do, I'm, I'm, I'm responsible for product marketing at BlackBerry. And the hardest thing is, is shifting perception with an iconic brand, um, like, like BlackBerry, because almost everybody, um, at a— from a certain age point, um, knows what BlackBerry— you know, knows that a BlackBerry is this device. And usually I love my, you know, I hear it all the time.

Oh, BlackBerry, you guys still around? I love my device, you know, or, and that's the sort of perception. But in reality, you know, we're a security company. Yeah. Um, and we're solving a lot of the same problems.

So the same customers, the same banks and governments and defense contractors and, you know, high security, uh, um, uh, compliance, you know, highly regulated industries, uh, use us because we just have that extra layers of security that's important for them. And, you know, we did a couple more acquisitions. We did a big one about 2 years ago, a cybersecurity company called Cylance. And that was a great acquisition. You know, Cylance was really— if you talk to the founding CEO, you know, he would say that we're a data science company and we just happened to choose to do security.

You know, we could have done anything. So basically, it was all around you know, using AI to solve a problem. And this particular problem was, can I dynamically figure out if something— if a file or a piece of code is good or bad? Yeah. Can I use AI to do that?

And that was sort of the beginning of what's often referred to as next-gen AV, you know, like CrowdStrike and Carbon Black and a few others have similar, similar types of technology. Oh, excuse me about that. Oh, it's okay. Stop that. Bear with me.

I'm just glad the birds in the background have stopped.

It sounded like you had a lot of birds back there. Yeah. Sorry. The Mac eco— the Apple ecosystem sometimes doesn't work properly.

Yeah. So that was really— that's really fun. So we've got sort of this, you know, this AI engine that can do a lot of stuff that's pre-execution. And I know we've got a security group here and people are familiar with that. Of thing.

And, and since then, you know, we've really expanded it. You know, we've taken some of that technology, you know, some of the AI, you know, capabilities, and now looking at things like behavioral, um, you know, looking at human behavior, not just, uh, you know, looking at whether a file is good or bad. So determining if something, you know, like insider threat and all those sorts of problems that people, you know, struggle with, um, being able to look at the behavior of the human, um, and determine if something's out of behavior and then be able to do something about it. So to me, that's really exciting, you know, sort of that we're sort of in this new wave of where we're using the machines to help protect our machines, which is kind of crazy. So I do want to ask you a question.

I got to think about how to properly ask this though. It's about brand marketing. So, you know, if you look at kind of the younger generation, really the millennials, particularly on the young side, a lot of them they never had BlackBerrys. So in their mind, they're not stuck with this vision of what your company is. But the older millennials, the Gen Xers like me, I had several BlackBerrys.

And so every time I think of BlackBerry, kind of back to what you were alluding to earlier, I see this company as like this this phone company that created these devices, but you don't do that anymore. Like, how do you— for, for like my generation, how do you, uh, how do you get that out of our heads that that's, you know, not what you guys do anymore? Yeah, no, that— we talk about that a lot, um, and, and it's actually a— it's actually really expensive to, to change, change you. Yeah, um, because, you know, you would have to spend a lot of marketing dollars with campaigns and all sorts of things to, to pivot, to globally pivot a brand. And, you know, we don't sell to you, we sell to, uh, the CISO or the CIO or of a large multinational.

And so, so We make the conscious decision to market to those people, um, because that, that, that's who we're targeting. Yeah. Um, would I love to do a brand campaign to change it, to let everybody know that we're, you know, and every major newspaper you pick up or, you know, in airports and everywhere you turn and look, you see that? Yeah, that would be fun. Um, but it's probably not practical.

Yeah, yeah. And I guess that's, you know, it's, it's interesting because it just shows how successful BlackBerry was back then that like it, it was as defining as the iPhone in its time. So it's— yeah. The thing with the brand though is for those who know the brand, even if it's not a device, there is an emotional piece to it, which is Like it was reliable, I trusted it, um, it did what it was supposed to do. Um, so those sort of brand values still exist.

So I mean, you could have changed your name, right? You could have said, you know, we're not BlackBerry, we're now Blueberry. And then people would say, well, who's Blueberry? Yeah, I don't know you. Do I trust Blueberry?

I don't think so. You know, you know, you're gonna have to earn that. So, so there is, there is brand equity with, with, for example, with BlackBerry, around the core values of the brand, and just being able to try to pivot that with the people that, you know, that you're targeting. So yeah, yeah, that makes sense. And I, you know, my, my roles on, you know, product marketing is actually quite different than corporate marketing.

So corporate marketing would be more responsible for the brand and all that good stuff. You know, we focus on products themselves. Yeah. Yeah. Okay.

Definitely makes sense. So what do you see as like your, your big challenges for the next 5, 10 years? Wow.

Go anywhere with that. 10 years as a technologist, 10 years gets really theoretical. Yeah. I would say, so let me put it this way. And you'll see it with a lot of security companies is Like, we all have roadmaps.

Yeah, you know, we all look at the future and we, you know, we all— so right now, you know, if we're talking about security technology, um, probably the next big thing over the next, you know, let's say 18 to 36, 48 months, it's probably about extending detection and response. So XDR is sort of this emerging one that everybody starts talking about And all it is, is bringing in more telemetry. So bring in network telemetry and data telemetry and behavioral stuff and integrate, pull in logs from other third parties and toss it into a data lake and do your magic on it. And then light up, come up with new insights and lower the number of noise and alerts and all that sort of good stuff. And that's sort of where I think a lot of security companies are hitting.

Um, but there's a part of me that goes, but would that help you with— would that— would that have helped Colonial Pipeline? It's like, no, you know, they, they just needed— they just needed good security hygiene, right? They just needed good, you know, um, next-gen antivirus, or they just needed some good procedures and policies and, you know, whatever. So, so, so I think, um, in the near term there's a lot of catch-up to be done with just basic stuff. Um, so I think, you know, when— where I sit from a product marketing standpoint, we're still talking about how do you stop ransomware, um, which is kind of crazy really because, you know, even like last year, like US alone was like $20 billion of US companies were ransomed.

Um, $20 billion. And And, uh, it's not like we don't know how to stop it, you know. So, so, so it's, uh, it's, it's surprising to me, um, that— so, so there's a lot of work to be done just to help, uh, companies today just to, just to make sure they can be as safe as possible. Yeah. Um, and we, we get it, like, you know, we totally get it.

And I think the other thing that will probably be emerging a lot of is, is, um, probably MDR, which is managed detection and response, which is, yeah, I think for a lot of companies, especially if you're a you know, midsize or a small midsize, you're like, I can't afford to have, you know, a 24/7 security operations center. You know, that's just really expensive. Um, and so there's a lot of companies now that will say, look, we'll do that for you, right? So we'll manage that for you. And then we'll, we'll make sure that you have the latest greatest and all that sort of good stuff.

So I think we're gonna see a lot more of that. I mean, if you're a, if you're a security analyst today or you're a professional security person, you're in high demand. There's not enough of you out there today. So I think having economies of scale through managed services will probably be another big thing that we'll start to see. So I think, you know, I'd say the 3 things would be just meat and potatoes stuff, you know, basic, you know, let's just make sure we've got all our bases covered.

You know, let's augment or outsource some of our security services, make sure that we're skilled up. And, you know, we've got someone, you know, another set of eyes that are keeping, you know, helping keep us safe. And then thirdly, you know, for the bigger companies, you know, let's start integrating more stuff and then start to use some, you know, using the machines to, you know, solve sort of the next generation of problems that are coming. So I think those are probably the sort of the 3 areas, and you sort of timeline them depending on on how you want to look at it. Very good.

Very good. Well, Nigel, how do people find and follow you on social media? Well, you know, we talked about this briefly. I'm probably the worst person when it comes to social media. But, you know, I, you know, LinkedIn, you can absolutely find me, connect with me.

I'll be happy if you've got any questions. I'm happy to, to, you know, see if I can help or at least, you know, bring in some people that could help. Yeah, so that's a good— that's a good way to go. Right on, right on. I think the community will enjoy this, uh, this conversation.

This was a fun one. So, well, thanks again for joining me, and, uh, yeah, have a good rest of your day. Go hit those mountains, do some— do some bike riding or something. Sounds perfect. All right, well, thanks very much.

I enjoyed that. That concludes my interview with Nigel Thompson. Be sure to follow and support Colorado Equals Security on Patreon. This is Jason Jaques saying be safe out there. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado equals security.

Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember. Colorado equals security.