Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 231 for the, uh, the new year. It's January, the week of January 10th, 2022.

Alex, happy New Year. Happy New Year, Robb. How's it going? Great. You know, I guess I should also say, um, uh, happy Thanksgiving and Merry Christmas and happy Hanukkah and— yeah, all that stuff.

Other stuff, since we haven't recorded a podcast since, uh, we were just looking, the late, late November, the 22nd of November. I'm thinking our listeners might have given up on us and thought we weren't coming back. Oh no, no, no, you can't get rid of us that easily. No, we are, uh, we're like a fungus, you know. There's a fungus among us.

It takes a lot more to get rid of us. Any, any highlights that you want to call out for anything that you've done over the, over the holidays? Um, you know, did a lot of relaxing, um, did a little, little quarantining, uh, but, you know, not a whole lot, uh, super exciting. How about you? Yeah, we, we, after Christmas, we went to New York City for not quite a full week and did all the sights, saw the Statue of Liberty and all that good stuff.

It was a surprise present for my kids. They've both really wanted to go there and now we got to do it. So that was fun. I'd say going during COVID is interesting, but you can't— my option, I don't want to stop everything in life for multiple years. So I'm glad we got to do it.

Yeah, that's great. We took our kids a few years back. We kind of did the opposite of you. Instead of going at a really cold time, we went in the middle of summer where it was disgustingly hot, uh, but I think the kids enjoyed it. We did the same kind of stuff, uh, so I was gonna ask you, Statue of Liberty, um, World Trade Center, all those kind of things.

Which weather do you think is worse, my— the one I went to or the one you went to? Well, at least when it's cold you can put on more clothes. When it's hot, uh, you can only take off so many. Yeah, until you get arrested. Yeah.

All right, uh, well, let's jump over to our— some housekeeping. You know, Alex, you may or may not be aware we have a Slack channel that is a great place for people in the security community to, to get to know each other, to, to discuss jobs that are open, to ask for advice, all kinds of good stuff. And if folks want to join it, they can go to colorado-security.com and click on the Slack button. Yeah, we also have a mailing list, which if you're listening to this podcast, you probably have just gotten a mailer sent out to you. We send out one email a week and that is the show notes from the show and all that kind of thing.

Um, we'd also love it if you are listening to the podcast to go to your favorite, uh, podcast player or store and rate us and subscribe so that you get this delivered directly to you. Um, you know, if you want to help us grow as a community, really as a movement, right, with the Colorado Equal Security Community, we, we have a, an intention here, a mission about making Colorado be known nationally as the, the premier place for security jobs and talent. You know, if you, if you buy into that vision, if you want to be a part of that vision You know, go tell a friend. We don't— we would love you to help us grow and, and really extend the reach of this, this movement. While you're at it, if you want to help us grow, we know there are costs to this show.

We have a Patreon campaign if you want to join. We appreciate that. But I mostly want to just say a big thanks to our current patrons, our patrons, our sponsors. We really do appreciate you guys. Thank you for those who help pay our hosting and our website and all of the different things that go into this, which is, you know, it's not cheap.

Um, thank you very much for what you guys do. Awesome. Uh, with that, let's jump into the news. Robb, Colorado's pay equity law is 1 year old, and, uh, here's how many complaints it's produced as well as what it's about. Yeah, I, I was super interested.

You know, usually as we prepare for our podcast, um, well, you know, you'll— we'll aggregate a bunch of stories over the course of the time between podcasts. And, you know, if it's 1 week, there's not that many stories. If it's been 6 weeks, There's a lot of stories. This one really popped to the top of my list of ones I was interested in. You know, it was a, you know, I think unique across the country law that was passed in Colorado a couple years ago, 2019, and went into effect last year that requires that employers post salary ranges and a couple other requirements for any jobs on the internet.

There have been 250 complaints against companies for violations of this law in the last year. And it's really interesting to just read the details on on what those— you know, some of them are because the jobs didn't come with a salary posting. Some of them were because jobs weren't posted before they were filled, and that's another part of their requirement. And then some of the complaints became— came from companies that posted jobs with the line that says open to anyone remote except Colorado. And, and, you know, that's been some of the, the blowback on from companies who didn't want to have to post their salaries.

Yeah. And, uh, you know, a There were a couple of things related to that. One, you know, they say that there haven't been many of those, and, you know, the agency that oversees this has sent out notices to many saying, hey, you know, that essentially that's not cool, don't do that. But in the first year, there hasn't been a lot of enforcement, but more education. There was only one fine that was doled out, and that was to a repeat offender company who didn't apparently listen to the warnings.

Um, you know, one of the other, uh, things that I thought was interesting, and I— and maybe I knew but didn't remember, was the law also bans employers from asking workers what they made at their previous job, which is interesting. Yeah, I actually had forgotten about that element too. Um, they say specifically that the point is to, to get better salary equity. Um, the article specifically mentions for women that, you know, once someone gets behind at one company for salary might be very difficult for them to ever catch up because the next employer says, what did you make previously? Well, let me just give you a, you know, a 10% raise on top of that, or whatever the number is.

So this getting rid of asking people about previous salaries is meant to get, um, better equity in terms of pay. Yeah, there was also some feedback that they listed from, uh, from companies in the area, and one piece was, uh, that because you list the salary range, many times, uh, you know, people come in and ask for a salary at the top of that range. Um, and, you know, many times it's, uh, it's people who experience-wise or whatever, you know, may not be at that range yet. And so by having that information, now everyone want— of course wants to make the most they can. And if the, you know, top of the range is it, then that's what they're asking for.

Yeah, I think that that's, that's a dynamic that is especially difficult in security where, you know, there are fewer candidates than folks would like in general. So folks feel know, more obli— more obliged to, you know, ask, ask for the moon.

Definitely good, good, good topic. Um, really interesting to see that follow-up there. You know, next we have a new company coming to town, and man, the most interesting things, right? It is a, it's a company that makes snow bikes. Um, the, the company is called Moon Bikes, but you guys have got to click through in the show notes to take a look at this article.

Um, this thing that looks like it Man, maybe kind of a cross between a snowmobile and one of those like Star Wars, um, landspeeder things. I'm not sure what to call it. It does— now that you say it, it does look very Star Wars-y. Um, the company is called Moonbikes, and, uh, they're based in France, and they're opening their headquarters in the US in Boulder, um, partially because, you know, Boulder is very outdoorsy and you're close to the mountains. Um, this is a story that I had flagged, and, you know, when I first looked at it, I was intrigued because, you know, they, they do have snow bikes that I, you know, at ski resorts already, but they're essentially like bicycles kind of bikes, you know, where it's a bike with skis instead of wheels.

Uh, so to, to see this, it's really cool. The other thing is, uh, these are electric, so they're, they're battery operated, um, and, uh, they go for, I believe, about an hour and a half. Uh, on a single charge, which is pretty cool. And sorry, between an hour and a half and 3 hours, probably depending on how awesome you are on it. The more awesome, the less, the less you get to use it.

Exactly. Um, the thing, it does look like a lot of fun. The, they, they're going to produce about 1,500 snow bikes here in 2022. Uh, did it say, I don't remember seeing, oh, here it is. They started at $8,500, uh, for a preorder on one of these bikes.

So, uh, you know, it, it's. Not, not cheap, but it's also not like the world, right? To someone who— if once— if you want a toy, this might be a toy for you. Yeah, I mean, uh, I probably wouldn't pay $8,500 for it, but that doesn't seem like out of the realm of possibility. Yeah, if you, if you live in a place that's snowy all the time and you're, and you're someone who, who likes getting out in it, it might be perfect.

Exactly. All right, uh, next up, Colorado is the top-ranked state for women-led startups for the 2nd consecutive year, which I thought was pretty cool. That's pretty amazing. I feel like this kind of came out of nowhere a year ago, and to see us maintain our place at the top of that list for a second year, that's really neat. And the article says we easily maintained it.

And even though COVID was crazy and obviously investing last year was a little strange, really neat to see Colorado as the only state to rank in the top 10 for all of the 5 metrics that are used as a part of this study. Yeah, I thought that was cool too. Um, one of the things that I noted was that the data shows that 29.2% of Colorado's employer firms are led by women and female business owners. Uh, that seems like a— I mean, obviously you want a bigger number, but that seems like a, a pretty good number. Yeah, what would be really neat would be to see like the trend line on that over the years, you know, If you just had that information out of nowhere, 29%, you might think that's not so good because it's not 50%.

Um, but my guess is that we're going from a trend line somewhere down in the single digits starting, you know, a decade or two ago, um, and, and the, the progress that's being made there. And, and I'm sure it takes a lot of, you know, concerted effort to make that progress. So, so I love it, and hopefully we continue to, to push in the right direction. Yeah, hopefully we'll be able to see those numbers in the future, um, as, you know, this is the I think a recent, uh, survey that they've been taking. So, uh, if they keep going, then we'll have data over many more years.

All right, next we have an article. This is— this article is old, Alex. The— this next one, it's an article from ZDNet about a Colorado energy company, the Delta Montrose Electric Association, and the impact of a ransomware breach they had. I was actually thinking before we recorded, I should go see if I can find an update to the story. I didn't.

So, um, there we go. We have, we have a December 2nd story about, um, about this, this, uh, energy company that was impacted by a breach. And man, it sounds like it was absolutely devastating for them. It took down 90-plus percent of their internal systems and caused them to, to lose 25 years of historical data. Yeah, that is an astronomical amount of data.

And maybe maybe the most, um, at least in terms of, uh, you know, years of quantity of data that I have heard about a company losing for, um, I'll say a suspected ransomware attack because they never used the term ransomware, but everything that they talked about indicates that it is actually a ransomware attack. Um, this also, it took down their billing for a good bit of time, and, uh, I guess that would be another thing. They say that they were going to be, um, beginning, uh, beginning to middle of December have that billing back up Um, it would be interesting to see, uh, when that was that that actually happened. And another couple interesting things— I'm sure everyone will be heartbroken to know that as a result of this, they were unable to, to assess late fees or, or shut off people who hadn't paid their bill. So, you know, real hardship there for, for the company.

That's irony for anyone who doesn't, uh, doesn't read between the lines. It is. However, um, DMEA is a, is a co-op, so it's actually Um, you know, it owned by the, the people that use it, um, as opposed to a, a for-profit company. So, um, while you still don't want, uh, late fees if you're someone that is, uh, that is late, it, it sucks because that goes to everybody. So yeah, plus, you know, being a co-op, this hurts all of the individual consumers that use this as opposed to just hurting the, the energy company itself.

So I don't know enough about, you know, this, this organization to know how they've, how they've recovered. And frankly, you know, are they investing in security to avoid this in the future? Um, as a, as a nonprofit co-op, it seems, seems like it might be a hard thing for them to get good at. Uh, very well could be. Um, I think, you know, utilities and those sort of things are notoriously bad anyway, right?

Um, all right, speaking of nonprofits, uh, there is a nonprofit that is coming to Denver that provides cybersecurity apprenticeships. And it's expanding from St. Louis to the Denver area. Robb, I think you maybe know a little bit about this one. Oh, you know, actually, Alex, this is not the same one. So you're probably referring to one that, that I have been talking to recently called Activate Work.

This is a different nonprofit that's, that's coming into the Denver area. This is called CyberUp. They're from St. Louis. And really what they do is work with local, local higher education to create a path for people to get education in, in the classroom for cybersecurity and then work with local companies to create apprenticeship programs so they can get hands-on in those organizations and really create that talent pipeline directly from schools into companies. Yeah, and I thought it was interesting here that they are, uh, they're working with Arapahoe Community College down here in Littleton, uh, not far from both of us.

Yeah, uh, to get this program going, um, which is cool. I, you know, it's been several years now, but when Arapahoe Community College was starting up their cybersecurity program, I had, I had been working with them with them a little bit, and they had been talking about apprenticeship programs, uh, even back then. So it's good to see that they're, uh, sort of formalizing that and coming out with one of these. Yeah, so CyberUp, they— looks like they currently have 6 employees in St. Louis. They're, they're planning to hire their next employee here in Denver in the next month or so.

Um, that person is going to be responsible for building relationships with the local employers to help, you know, get those apprenticeship programs built out. And, um, and then obviously I, I would assume, although I don't think it says it in here, also look for other community colleges other universities to, to, to work with for students. Pretty cool. Glad to see the apprenticeship programs coming in. You know, I think if there— if we have listeners here who want to get involved, man, I just got to recommend you guys do.

I, I don't have a good connection over there, but if you reach out to me, I'm sure I can— between us, we can figure out a way to get in touch with the CyberUp folks. Or maybe Alex, you can help with the ACC side. Yeah, I think, uh, I think we probably can. Um, I, I believe, uh, Frank, who had done some interviews for us, was teaching over there too, so he had some info. Maybe, maybe Frank can help us get a Anyway, cool stuff, and I love to see this kind of creative solution for the ongoing problem of finding the right folks for jobs.

All right, next we have a— moving over to the blog side, we have a blog from Layers which is talking about the top 3 security program tasks you should tackle here in the new year. Alex, what are those 3 tasks? Yeah, so, um, if you have run a security program before or running a security program, this will not be, uh, news to you, but I think that this is, you know, a good article anyway, and things that people should think about. So the first one of those is, you know, review your security program in general, making sure that you're continuing to align with the requirements of the business, that things aren't obsolete or no longer relevant, and that what you're doing is clear, concise, and meaningful to the target audience, which is, you know, the, the folks in your organization. Uh, the second one, conduct a risk assessment, which I think is great, um, something that you should be doing at least on an annual process anyway.

And then also, uh, prioritize the remediation of things that you have going on, uh, sort of an outcome of that risk assessment, but it could also be related to other things that you already have on hand. And, you know, make sure that you're working on the things that are most important to you and your security program. Yeah, I think to your point, there's no surprises in here, but it is just good advice and, and probably just a good reminder for those who, you know, come into the new year and You know, maybe you're so stuck in the mundane dealing of with work that comes to you, you know, you need to get a little proactive. And this is a good list of proactive things to go tackle over the next quarter. Yeah.

You know, you spent your, your December dealing with the Log4j fire. And so now, now it's time to take a step back and reevaluate and make sure you're doing everything right. So, all right. Moving on to our next story. This is a Red Canary blog from somebody I don't know over there.

Uh, it's called Trust Issues: Proactive Transparency Drives Good Business. Um, Robb, maybe you know a little bit about this one as well. Yeah, so as you are so subtly alluding to, I wrote this, and, and this is, this is really a part of my, you know, coming on board and building out a trust function. And I'll be honest, I think of this as much broader than just building out a trust function for Red Canary. I think of this as, you know, how do we, how do we show the, the security and larger technology world a better way to, to engage on security practices and show it in a, in a way that becomes repeatable for other companies to take on.

So, you know, I wrote a first blog back— it was October or November— you know, introducing trust. And then this is my first deep dive into one of the key components of what building trust looks like, which I'm, you know, calling proactive transparency. And, and the idea is, you know, if you're going to partner with someone— and I'll take this from the perspective of someone who's offering you SaaS services, if you're going to partner with a SaaS provider, you want to know that if something is going on that you're interested in, they will tell you about it. They're not going to do some calculation in their head that says, well, are they going to find out about it? If they're not going to find out about it, maybe I can just keep it to myself.

You want someone who's going to tell you about it. And that's what proactive transparency is, is building this cadence where you just by default share the news, whether it's good or bad. And there's one example that we came up with inside the article that really defines the difference between transparency and proactive transparency. And it's a mother who lets their kid borrow the car. And when the kid comes back with a scratch on the car, does the mom find out by looking outside and seeing a scratch and then going back and saying, hey, why didn't you tell me that you scratched the car?

And the kid says, well, I'm sorry, I didn't think you'd notice. Or is it the experience where the kid comes home and that night says, mom, I got some bad news. I scratched the car while I had it. And you think about the difference, you know, that kid who might be trying to avoid that tough conversation in the long run, avoiding the tough conversation just reduces trust. Right.

So that's the art, that's the idea. And you know, there's a bunch of other examples during the article, but that's what I'm, that's what I'm really focusing on and hopefully able to share with a larger audience.

That my monologue's over, Alex. Monologue done. I think that's great, Robb, and appreciate you doing what you're doing and contributing to the community with that. So, all right, let's jump over to Coalfire. Coalfire had a, had a blog post around the secure development lifecycle, and since I just talked, I'll let you talk.

Yeah, again, this is one where, um, it's not going to be any surprise if you're familiar with AppSec, uh, what, what they're talking about here in the blog. But again, I thought this was a good article to include just to think about, uh, you know, if you're getting into application security, a good reminder about the things that you should be doing in application security. And, uh, really how you can build that into the, the development lifecycle that you have. Um, so they, they talk about a bunch of things in here, um, you know, embedding security into the secure development lifecycle and the ways that you can do that. Um, things like making sure you have executive buy-in and, you know, also thinking about some of the, the threats that come along, um, that are associated with application security.

Uh, one of the things that I also thought was cool is they have a set of metrics in here that that they believe, uh, based on some, some survey that they did in a, uh, a consumer advocacy board that they have, um, are the best AppSec metrics that they have for, uh, for AppSec programs. So, and then final things in here, talk a little bit about threat modeling and DevSecOps architectures, which also are important around making sure you're doing secure development. Yeah, when I read through this, I, I was really thinking, you know, for some place that doesn't have an AppSec program or you got one engineer who's trying to kind of cobble it together, this would be a really useful resource to think through what you should prioritize and make sure you're not forgetting something. Really very approachable, simple to understand, and I think it's, it's relatively comprehensive as well. Yeah, good stuff.

All right, uh, moving on, we have another Red Canary blog, but this is a little bit different. Um, this is actually written by Josh Rickard, who works for Swimlane. And Swimlane is a big proponent of the Atomic Red Team framework, which started at Red Canary. And Josh wrote this blog about creating a new piece of software called Atomic Operator, which makes it easier to run the Atomic Red Team tests across multiple platforms and just, I think, makes it easier in general. It's a Python execution framework that that he built that you can use to, to run all the, the different Atomic Red Team tests.

So pretty cool. Yeah, that's so cool. I love seeing people, you know, stand, stand on other work done and just make us all better as industry. So big, big shout out to Josh for, for this work here and sharing it with us so we can all, we can all learn from it. All right, last story.

We actually have a second. Laird's blog post, but, you know, whereas the first one was pretty high-level kind of programmatic advice, this one is much more in the weeds, technical, specifically solving a problem that I think, I think we generally know exists but don't have great solutions for. So, you know, we generally, in, you know, the old data center or even now a modern cloud environment, we have a good idea about how to get visibility throughout our systems. But in a Kubernetes environment, microservice architecture, it's actually a lot harder. You can't use the same, well, at least it's maybe not harder, but you can't use the same techniques to get visibility in your infrastructure that you would in a data center or a host-based EC2 environment.

So this blog post goes into how can we get visibility specifically through Kubernetes using a cloud-like deployment of it. And, and really hands-on technology, how they, how they get that, that visibility. Yeah, this is, uh, it's real, uh, technically deep in here. And, um, also I think it's interesting that, um, at the beginning of the blog, the, uh, the person who wrote this, uh, Anton Ovrytsky, um, talks about, you know, the setup that he used to do some of this, uh, this example work. And so that some vulnerable, uh, Kubernetes, uh, things out there like Kubernetes Goat, which is out there Uh, that you can play with.

But, you know, he goes into things like, uh, looking for sensitive keys in, in the code bases, um, some, uh, Docker and Docker exploitation, uh, talking about container escape, which is, um, something that is good for, uh, for cloud environments and other container environments, not just Kubernetes, but, uh, uh, definitely something good there. And then, um, also talking about rogue or malicious containers. So Uh, really good stuff here. Uh, one of those really deep technical blogs, and I think if that's something that's, uh, in your wheelhouse, you'll enjoy this. Yeah, really good stuff.

I think, you know, a lot of good technical stuff this, uh, this, this week on the podcast. All right, let's jump over to our calendar of events. Alex, if you were in the Slack channel on Friday night, uh, you would have seen like 20 different events all drop into the events channel all at once. As you know, we have a a hook that whenever we add something to the, to the website, it shows up in that channel. Man, there's a bunch of new events that have come this year since we last recorded.

Um, so let's go through the things happening here in January, but if you want to see a more comprehensive list of things coming in the future months, you can go out to colorado-security.com and click on the event calendar and you'll see it all out there. Sweet. Uh, first, ISSA Colorado Springs is doing an open house at Whirlybird On January 11th, Whirly Ball. Whirly Ball, sorry. And I have no idea what Whirly Ball is.

I was, I was hoping that you would know. I, I don't, but it sounds cool. I'm gonna have to look it up. Um, it— so there's something called Whirly Ball, and if you guys are going to do this, uh, open house, I assume kind of a social event there, please let us know what it's like because I'm super curious. Um, on the 12th, ISSA Denver is doing their January chapter meeting, which is their annual CISO panel.

On the 13th, ACIS Denver is doing a coffee chat with Cami Dukes. Uh, also on the 13th, Denver ISACA is doing their January meeting on the intersection of cyber insurance breaches and the Colorado Privacy Act. That actually sounds pretty cool. Uh, on the 18th, we have 2 events. ISSA Colorado Springs is doing their January meeting, and CSA Colorado is also doing their January meeting in person.

I think most of these meetings are still in person, but they specifically called that out on their, on their headline for it. On the 21st, the Let's Talk Software Security group, which is not in person, this is virtual, they're doing a discussion around software security program strategy. On the 22nd, ISSA Colorado Springs is doing one of their mini seminars for January. On the 24th, um, the National Cybersecurity Center, NCC, is starting their adult cybersecurity classes. This is not done on the 24th.

This is just the, uh, the start of a series. Yeah, and if I remember right, these are not necessarily, uh, for cybersecurity professionals but for your average person to learn about cybersecurity. Yes, sir. And then finally on the 26th, ISC² Pikes Peak is doing their January chapter meeting. Fantastic.

Let's jump over into jobs. We have 10 lovely jobs to talk about this, uh, this week. And starting at the top of the list is a Red Canary job. I'm hiring a business solutions analyst. This is someone to help us Um, within the IT department, help, help us really identify what technology we should be using to solve business problems and standardize that across the organization.

If you have questions about that, if you're interested in talking to me about the job, reach out to me on Slack or email, and happy to chat with you. Thanks, Robb. Yeah, I'll say also, in general, many if not all of the jobs that are on the list this week came from the jobs channel on the Slack workspace, many of them posted by the hiring manager themselves, or if not, by people that you would be working with. So if you have interest in these, go over to that jobs channel on the Slack workspace, and you can talk to people, um, over Slack on what these jobs might be like. Um, so, uh, the state of Colorado is still looking for a CISO.

This has been out there for a good amount of time, uh, so hopefully it can find somebody soon to fill that. Yeah, I don't know if it's that they haven't found someone or that their process takes forever or what. I have no real insight into where that sits right now. Bonusly is hiring an IT security engineer. City of Colorado Springs is looking for a cybersecurity analyst too.

YugaByte is hiring a senior security program manager. Dish is looking for a wireless CI/CD engineer. The Trade Desk is hiring an information security analyst. Uh, Prologis had a few jobs. One of those is a senior analyst for IT governance, risk, and compliance.

Hey, while we're talking about Prologis, let's just give a shout out to our friend Tyler Warren over there. Tyler, who he runs the, uh, the Cloud Security Alliance in town. He does. Um, and, uh, and he was just recently promoted to Deputy CISO over there. So yeah, congrats to Tyler for that.

Yeah, that's really cool. Good stuff. Um, Woodward is hiring a Manager of Information Security and Compliance, and Denver Water is looking for an IT Security Architecture and Operations Manager. Love it. That is it for jobs, and that's mostly it for the podcast this week, Alex.

Um, you know, we, we don't have an interview this week, although we do intend to have one starting with our next episode, which will be about a month from now, right? Yeah. So I, I think, you know, we've talked about it. We're going to try and move instead of a weekly cadence, try and do about a monthly cadence. So, um, yeah, look for another episode about a month from now, and we should have a wonderful interview associated with that.

Yeah, we're looking forward to, to getting back into it here in the new year. Hopefully everyone's staying safe and you either have already got COVID or you're not going to get it. Best of luck to you on either of those sides. Exactly. Everybody stay safe out there.

All right. See ya. Thanks, Robb.

Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.