Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is your newscast for episode 222. That's all twos.

Two, two, two, two, two. For the week of August 23rd. 2021. It's back to school time. It is cooling down a little bit now.

We're not in quite such a miserable spot. The, the air quality is better. At least this last few days has been quite good. Yeah, I'm not wheezing and coughing and itchy as much. That's a positive.

I worked from home a couple days this week. And for lunch both days, I sat on the front patio and like enjoyed the fact that it wasn't gross outside. Yeah, that is nice. I don't know if that means the winds have just shifted or maybe the, the western US is not as much on fire anymore. It's on fire.

Yeah, I have some friends who live in like the Sacramento-ish area and there's big, big fires over there. Yeah, it's definitely a bummer. But Colorado doing better than some places. Yeah. Well, you know, if we keep exporting that smoke to Canada, it's fine by me.

I'm sure they're happy for it. Smoke, eh? All right, let's, uh, hey, why don't we talk about some housekeeping? We can. You know, Robb, we have a Slack channel there.

We're getting really close to 2,000 people in there. So if you want to join those almost 2,000 people, head over to the website colorado-security.com and fill out the little form there to get us to add you. That would be wonderful. We also have a mailing list while you're on the website. Find the mailing list section, put your email in there, and we will send you an email every week with show notes.

We'd also love it if you would rate us and subscribe on your favorite podcatcher. Let people know that Colorado Equal Security is the number one way to keep on top of what's happening in security in Colorado. We'd also love it if you would just tell a friend, find a friend if you don't have any friends. That's probably step one, make a friend. And step 2, get them involved in the community.

Step 3, discard them. Right. They've served their purpose.

We also have a Patreon campaign if you would like to contribute financially to support Colorado Equal Security. We would love that. We have a lot of great patrons already, but we're always looking for more. The, uh, the money that comes in through Patreon is used to, uh, fund things like the website hosting and podcast hosting and other things like that. Uh, you know, other cool swag and things like that.

So, uh, thank you to all our patrons. And if you want to sign up, uh, go again to the website and get more info there. And if you ever see a Colorado Equal Security car or helicopter around town, we've had a new patron and we hope that that person signs up soon. Whoever that person is going to be. All right, let's jump into the news.

Number one, Alex, I know you like to gamble a little bit. I like to gamble a little bit. There is a new large sportsbook who's eyeing moving their tech headquarters here to Colorado. Yeah, so this is a European company called Tipico Group, and they are— they have an East Coast office in the US, but they are looking for a tech hub, and they're trying to figure out where to put 441 people, and it looks like Denver might be that place. Yeah.

So, you know, we've— we have a lot of the— what is it, the Office of Economic Incentives or whatever they call that group that is always trying to give incentives to companies to come to Colorado. They always have code names for these. And generally we get the code name but not the actual company. In this case, the code name is Project Palace. But the— but the Tipico Group CEO spoke up and said, hey, that's us, right?

And we're interested in coming into Colorado because it looks like a cool place to come. So we get to know who the company is. All those crazy Europeans.

You know, but usually that's like where privacy is, is focused out there is in Europe. So interesting that they're discarding their own privacy. Anyway, it sounds like we are competing with 3 other places. And I think that they may have only mentioned 2 of them. I don't know if I saw the third, but it was Atlanta, Dallas.

Yeah, some other random place. And Denver. So, so clearly, if you had to choose between those 3, you would choose Denver. Yeah. And as part of the article, the, the CEO said, hey, we really like Denver.

We'd like to come to Denver. But it sounds like, you know, they still want to pressure us for a little bit of cash to come here. So hopefully it happens, but we'll see. 441 new tech jobs sounds like a nice little thing to get. With an average salary of around $100 grand, so that is good.

Good stuff. Hey, so it was last year, or excuse me, last week I mean, or maybe it was 2 weeks ago, we were talking about all the local companies that had started, food companies here in Colorado. And one that we didn't mention is the subject of this article, TCBY. I didn't realize TCBY was the country's best yogurt. Indeed.

Colorado company headquartered in Broomfield. I did not know that either. I was excited to learn that the, the town that I grew up in, we had a TCBY growing up. Yeah. The only ice cream shop in town, even though it's yogurt.

And, you know, fond memories of TCBY. So you grew up in Ohio? I did. I grew up in California and we had a TCBY in my hometown, too. Yeah.

And as part of this article, they talk about the number of locations that TCBY has has gone down over the past 20 years from about 1,800 in the early 2000s to about 250 now. I mean, that is a just a massive decrease, right? You're talking about, you know, 80% decrease. Interesting to know that, that they're still doing okay, right? Even with that level of decrease.

And they've really had to shift their business model a lot. You know, what was it? A decade ago, you know, soft serve— excuse me, self-serve frozen yogurt became like the coolest thing. And by the way, like my favorite fad was self-serve frozen yogurt. You know, every corner had a frozen yogurt place.

Well, at the time, TCBY really shifted and they moved from their, you know, employees do it for you to doing it yourself. And, and they really looked a lot like all the rest of those yogurt companies. Are you one of those guys, Robb, that you go into the self-serve, self-service yogurt place and just stick your, your face underneath the the thing and you like it, open it up right into your mouth. There's a reason for the sample cups, Alex. There's a reason for sample cups.

Yeah. Anyway, it seems like while they are not in their heyday anymore at, at 40 years old, TCBY is still humming along and there are, you know, plenty of people that still like frozen yogurt. So I imagine they'll keep going. Yeah. A couple of interesting factoids in here.

Basically, the article was about the fact that they're turning 40 years old, which is pretty amazing. They said that they have brand awareness that's 50% higher than their competitors, which doesn't surprise me because, you know, I could think I can think of a couple other frozen yogurt places, but TCBY is definitely at the top of the list. They have moved over 50% of their locations in the last decade. I just think of moving a location to be a massive enterprise, and they've been doing that across the board, trying to get into the right spot for more foot traffic, and they've also added contracts with third-party delivery platforms to get sales from delivery, which, I had never thought about delivered frozen yogurt. Maybe not at the top of my list, but they're definitely looking to innovate and see how they can improve, including a new 100-square-foot kiosk that they're looking to put in malls and airports and places that have maybe lost other tenants and get nice foot traffic going through them.

Well, Robb, now that I know that TCBY is a Colorado company, I will only eat frozen yogurt from TCBY. I don't believe you. Well, You'll have to just watch and find out. I will. All right.

Moving on. The Denver region has seen a rise in super commuters, and I don't know that that's necessarily a good thing. Yeah. When I first read super commuters, I'm like, yeah, I'm a pretty good commuter. I don't know if I'm a super commuter, but I know what I'm doing getting to— but that's not what it means.

What is your commuting superpower, Robb? I mean, I can get there and back pretty, pretty well, know the way every time. I listen to my podcasts. I know how to do this, but a super commuter is actually one who has a 90-minute or longer drive each way to and from the office. Yeah, which sounds like something I would not like to do and also sounds like something that a good amount of people do do in Denver.

About 2.1% of Denver region's workforce, or about 37,000 people, face a 90-minute-plus commute in 2019. I guess these numbers are a little old. We probably don't want to go with 2020 because there are probably zero supercomputers in 2020. Yeah, but that's up 45% from 2010. Yeah.

So interesting. There's— they do a lot of talking about, you know, what the demographics breakdown look like here in Denver. What was really interesting, you called it out, is what, 40% of the supercommuters live in downtown Denver. So they're obviously driving somewhere else, like, like maybe taking public transportation to Boulder or going to the Springs, going to Fort Collins. But the rest of it made a lot of sense to me where, you know, if you live, if you live an hour and a half away from Denver, yeah, that's, that's where a lot of supercommuters are going to be, right?

Yeah. One of the things they say is that, you know, the rising housing costs have probably helped lead to this. You know, people have to live farther and farther away from the city in order to, to afford their living situation, which then again leads to longer commute times. Yeah. They have a couple other regions that are significantly higher percentages of supercommuters.

But I don't find these all that interesting because they just match exactly what you'd expect. So Stockton, California, California and Modesto, California, which are about an hour and a half to 2 hours away from the Bay Area. They have a high percentage of super commuters. And Poughkeepsie, New York also has a high percentage, you know, driving into New York. So, so it's kind of a, you know, maybe not that interesting a stat.

Um, I did find one other interesting part of this article though, which was, as they talk about what does it mean with this shift to remote work? And maybe we'd expect that less people on the roads, fewer people on the roads means, you know, shorter commutes. The article suggests that this actually might increase the super commuter percentage because people are going to be willing to live longer, further from their office if it's, if it's going to be fewer drives in, if it's once or twice a week. You know, that 90-minute drive doesn't sound so terrible to get, you know, sprawling acreage somewhere. Yeah, for sure.

All right. Moving on. We have a new version of the Inc. 5000 list. We've talked about this list many times on the podcast. And so the, the way that you get on the Inc. 5000 list is the fastest growing companies.

And they look over the, I think, the past 3 or 4 years, and they are looking at percentage of revenue growth over those times from 2017 to 2020. Yeah. So this is— it's always interesting to us to look at the Colorado companies, especially to look at the Colorado security companies. Yep. The number 1 Colorado company on this list is not a security company.

It's It's called Brewmate, and they were number 71 on the list overall with 5,000% growth over the last— what is that, 4 or 5 years? But the second Colorado company is a security company. Yeah, CyberGRX is number 97. They had just under 4,000% growth over that time period. Some other familiar names.

No more security companies on this list in the top 5,000, but Pax8 makes the list. Shoot, I thought there was another one or two that I don't have on my list here. RX Review, I think we've talked about them in the past, maybe once or twice. Yeah, anyway, a couple other things, ones on here that I recognize, so good for all of them. Well, we are gonna talk about a different list of fast-growing Colorado companies in a minute, so we'll hold off on revealing those details.

First, we have a blog from Red Canary this week. It's called Remote Access Tool or Trojan? How to Detect Misbehaving RATS, Remote Access Tools. And this is, uh, this is one of their great articles that starts off with, you know, something for Alex, for me and you, where it's like high level, hey, it's important to figure out the difference between, right, you know, a managed tool that is used by your internal IT and that same tool used by bad guys. And, and it's not necessarily easy to be able to tell that difference.

And then they go into some real good technical detail on what you can do in your environment to, to be able to see the difference. Yeah, uh, and of course, you know, we're talking about 2 different kinds of RATs here. You know, one is a remote access tool, things that are legitimate. The other is a remote access Trojan. Uh, again, I, I like on here how they're going into the very specific details around detection, you know, looking for file locations, registry keys, other things like that.

If you are interested in trying to detect these for yourself, there's definitely a lot of information here that you can use. All right, moving on. This is our next list. Swimlane has been named to Colorado Startup's fastest growing company list. Yeah, this was interesting.

And, you know, I didn't know that this list existed until Swimlane had their press release. So I'm like, well, I wonder if there's any other familiar companies on this list. Hey, there are. Lo and behold, there's a bunch of them that we know in here, right? Yep.

So Swimlane is on the list. They are number 15. But before them, JumpCloud is number 2. AMP Robotics, who we've talked about a number of times, is number 7. Pax8 coincidentally is number 8.

Uh, ThreatX is number 12. Red Canary 13. Uh, Shapeshift, which is a crypto company, is number 16. Automox is 17. CyberGRX is 29.

And DeepWatch is 34. I mean, we talk about the, the significant impact that security companies have had in Colorado, and this list is just, it's great proof of that. That's, you know, representation in the top 30. That was like 12 or 15 companies you just mentioned there. Really cool to see those companies be well represented.

And I'm excited to see, you know, what the next iteration looks like. We've talked to a couple on here, right? You know, Heika and Phylum recently. I'm excited to see other companies take off. Trueno, another one.

Yeah. Hopefully they make that list and, you know, next year or the year after. All right. Good stuff. We have a press release from Zvilo about a new product they're releasing.

It's called their Malicious Detailed Detection Feed. Yeah, it is a highly accurate, fast detection of malicious threats plus associated metadata and IOCs for blocking them. Yeah, well, so I'm excited that these guys who, who already do a good job giving intel to companies is, is getting a little more nuanced list, and hopefully this is something that folks will find useful and subscribe to. Yeah, and I think, um, one of the other interesting things, you know, most of the time the Zavilo stuff is, you know, piped into devices and it sort of happens automatically, but I think Uh, you can also get this as an analyst as well. And so now you're gonna have more details as an analyst.

Good stuff. I think, uh, next article is a blog from CyberGRX. So this is a blog post from our friend Kevin Ford, who's the CISO over there, talking about the future of— it's called The Future of Cybersecurity is Collaboration. But really what he's talking about is this trend over the last decade or so where companies, CISOs and CIOs, are moving from a default deny talking about anything around security, right, to being much more willing to share what are they doing around security practices and using that to help each other. Yeah, definitely.

And I think the more we can share and the more open that we are, the better it's going to be. And that is a little bit of what he talks about in the article, not specifically related to the article, but I was hearing something recently and there was there's been the trend now where incident response reports are probably going to be more admissible in court. And so there was the fear that now people would not be doing as much of that or doing it as well because they don't want that to be discoverable in case something happens. And someone else was calling for a, like an NTSB for cybersecurity, right? So, you know, more open and Right.

You know, being able to figure out what was going on and share it for everyone. And I think that, you know, in that spirit of openness and collaboration, I think that's definitely where we should be going. Well, if the NTSB had to investigate 1,000 plane crashes every day, I'm not sure we'd have the same quality of reports about those either. Like, the scale of what we're doing here with cyber is a little bit different than plane crashes. Fair.

But I still like the concept. I like the concept too. I just wish it was a little easier to do. Yep. All right, moving on to our last story of the week.

This is a Ping Identity blog talking about passwordless, a complete guide to passwordless authentication. Yeah, Wes Dunnington is one of the, one of the smartest guys over at Ping I got to work with for years. Really love him, and he does a great job really introducing you to where passwordless sits. You know, it's not a technology you go implement, right? If someone tries to sell you passwordless, you know, they're they're really, they're probably not really giving you all the details, right?

Passwordless is a goal. How do you get to that goal requires a number of things. And I think he does a good job talking about what are the benefits of it, and then really what are the, what are the steps you take along that path to get yourself to be ready for a passwordless experience? Yeah, I think one of the other things I like about this is that he sets up the blog as sort of a series of questions, right? Things that you would probably ask yourself, right?

Is passwordless authentication safe? You know, how does it work, all those sorts of things, and then gives good details and answers throughout the blog about those things. Love it. All right. Well, that is it for, for the news.

Why don't we jump over to our calendar of events? As a reminder, we do have a calendar on the website at colorado-security.com where you can go see what's happening over the next few months. We have a few things in the next week and then I think most folks took off, are taking off for Labor Day. So this week, what do we have? First up on the 24th, CSA Denver is doing their August meeting.

On the 25th, ISSA Denver has an August special meeting. This is a special episode of ISSA Denver. And then also on the 25th, ISC² Pikes Peak is doing their August hybrid meeting. Good stuff. Let's jump over to jobs.

I have a, I have a few things open at Red Canary, actually 4 jobs. I'm looking to hire directors for both my product security and corporate security functions. I'm looking to hire a program manager to work with me directly on managing the Trust Program, which includes security, privacy, compliance, enterprise risk management, all that good stuff. And I'm also looking to hire application or product security engineers. So any of those folks, you can go out to the website and apply or ask me questions on the Slack channel if you want.

Awesome. Ball Aerospace is looking for an enterprise security director, chief information security officer. Yeah, you get to work with our friend Dan Collander over there, who's the CIO. He was the former CISO. Excited for Joe McComb, who's made a move.

He's gonna be the CISO over at Holland Hart. Good for Joe, and of course, excited to see who lands over at Ball. Next, we have CE Broker, which is looking to hire a Director of Information Security. Crocs is looking for a Senior Manager of IT Security. Western Governors University is hiring an Application Security Engineer/Senior IT Security Analyst.

Colorado Judicial Branch is looking for an information security analyst. Direct Defense is hiring a security analyst. Intrado is looking for an InfoSec analyst. And finally, this was a special request, uh, that came in to me to post this job on here. It's for AirSpring.

They're hiring an associate product manager. So anyone who's looking for a product manager role, this looks like a good opportunity. Cool. Good stuff. All right, uh, Robb, I think that is the end of the news.

We got a little something special this week, though. We do not have a feature interview. But, you know, last week on the show, we talked a little bit about Stack Hawk and we, you know, kind of give them a little, little poke. We ask that all of you, you know, go give them your best caw caw because, of course, you know, we like to hear caws and, and support Stack Hawk and Scott Gerlach and the team over there. They took the challenge as well and they came back to us with some caws.

So it'll be up to you guys to decide, is their caw caw better? Or is our caca better? And if you say their caca, you won't make it on the show. But if you say ours, you get a good chance to be made famous on the podcast. Let us know.

Yes. And if you want to have your own caca to throw into the mix, you know, send it on over and we'll, we'll take a listen to it. See what we can do. All right. Well, that is it.

Listen to, listen to this next clip and then we'll talk to you guys again next week. Thanks, Robb. What's up, Colorado Equal Security? This is Scott Gerlock, CSO, co-founder at StackHawk. Alex and Robb, I hear you out there calling us out for our caca, and if it's a caca challenge you want, it's a caca challenge you got.

Here's mine. Caca! And the team thought they should throw in on this too, so here's the whole engineering team. Caca! Thanks for talking about Stack Hawk.

We love it. Make sure you subscribe to Colorado Equals Security. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.