Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 245, the week of March 13th. Alex, we missed our birthday last month.

We did. Happy belated birthday, Robb. Happy belated birthday. We turned 6. Yeah, it's hard to believe that we've been doing this 6 years.

That's, I mean, that's like 15% of our lives. Yeah. Well, and you know, you and I were talking earlier in the week and, you know, you asked when I started volunteering with ISSA and that's been like 15 years. That's an awfully long time. Yeah.

It just goes, it goes so far back. Um, anyway, it's been, it's been a great ride. You know, hopefully, you know, 75 years from now when we, when we finally celebrate our 81st Colorado Equal Security birthday, we'll, uh, will think, man, we sure are healthy right now. Yeah. And not as fun of a celebration, but because we don't really have a story about it.

But, you know, we heard some bad news yesterday. Silicon Valley Bank is— well, they're in receivership now. They're now being controlled by the FDIC. And while that doesn't necessarily have direct Colorado ties, I know, you know, any of the startups that are around, they might have ties to Silicon Valley Bank and could be causing some problems. You know, in my world, working in the security startup space, Silicon Valley Bank is a huge part of that ecosystem.

And, you know, we're fortunate at my company not to have been impacted by it. But I know many, many other startups who have their money there. And, you know, I worry about payroll getting paid on time. Yeah. You know, the FDIC only insures $250,000 for any individual account.

That said, Silicon Valley Bank had a good number of assets. Hopefully their depositors end up doing okay. Yeah, I'm personally pretty confident that people will eventually get their money. I think it's more just about liquidity, right? Like if that's where your main bank account was and you're using that to fund your payroll or, you know, do your accounts payable or whatever it is, that it's probably going to be a little painful for a bit.

But they might turn off the power on you or something. Yeah, that's not good. Yeah. All right. Well, let's get into our housekeeping type stuff.

We do have a Slack channel and it feels like Slack channel has been pretty active lately. We've got, you know, well over, what, 2,500 members over there and great conversations. I saw some interesting jobs get posted and some fun memes, all kinds of good stuff recently. Yeah, and I think we've had a steady stream of people asking to sign up too. So thanks to everybody in the community that's referring people to the Slack channel.

That's good to join. If you do want to join, go out to colorado-security.com and click on the Join Slack button. We just have a couple of little questions on there to make sure folks are actual members of the Colorado Security Community, and then they get on in. While you're there, we do have a mailing list too that you can sign up for. Fill out that form as well, and we'll get you added.

You'll get the show notes as part of that every time we put out a podcast, and maybe occasionally a, you know, a random other email too, but mostly just the show notes from the podcast. Speaking of podcast, we'd love it if you subscribe to the podcast in whatever podcast player you use, as well as rating us if that's the thing that you can do in that particular player. Good stuff. We'd love it if you would help the mission of Colorado Equal Security by telling a friend about what we're up to. Help us, help us broaden out our impact.

And if you want to do even more to support us, we have a financial program with Patreon. You can help pay for the costs of the podcast. A huge thanks to our current patrons who, who help keep the lights on here. Not, not literally, but metaphorically. Thanks to all those folks.

We need that Patreon money so that we don't have to take any of our money out of Silicon Valley Bank. Right. This is good timing to not do that. Actually, wait, does Patreon use Silicon Valley Bank? That could be an issue.

They very well may. Well, that's it for housekeeping, but kind of a related-ish thing. I'll mention that we are in the midst of our annual Colorado Equal Security Salary Survey. So officially, we were going to have closed it at the beginning of March. However, we're all volunteers here, so the volunteers haven't yet started aggregating all the information or haven't finished it at least.

So I think if you go out and do the— and complete the salary survey now, you'll still be able to get your data in there, and we'll still make sure we get you a copy of the finished report when it's done here sometime later this month. And just to be clear, you have to put your data in to get the report out. If you're not going to participate, you're not going to get the report. So if you If you want the link to the survey, you can head over to the Slack channel and find it in general there. Yeah, I'll actually— I'll throw it in the show notes too.

So it's— so it sounds good. Good. All right, let's jump into the news. A story that we've talked about numerous times, but finally sort of coming to completion. Carvana and their car vending machine at Evans and I-25 is now complete, Robb.

So you can go put in a giant commemorative coin and get your car out. Yeah. So, so this has been fun to watch. I drive by that space on a regular— on a regular basis and, you know, seeing an empty tower there for, for really quite a while was, was a little strange. I don't know how much you have paid attention, but Carvana has been in the news over the last couple of years for potentially financial problems and even concern that they might go bankrupt.

It looks like they've, they've kind of come out of that a little bit. And as a part of that, they have been able to open up the vending machine here and it's filled with cars. The way this works, if you're not aware, is you could, you actually generally buy the car online. And you have a couple of choices for how it gets delivered. Either they will take it to your house, which seems pretty convenient.

Or if you want the drama, they'll put it in the vending machine. They'll give you a really big coin, and you can pull a lever to get your car delivered out of the machine. I mean, while that sounds cool, Robb, I have a feeling most people probably just have it delivered to their house. Still, it's a cool gimmick. And if I ever buy a car through them, maybe.

You know, why not? Maybe I'll go get it out of the vending machine. There was a couple other interesting things to me. It said in this article that they were the number 2 most valuable car brand in the world behind Ford, which doesn't make any sense to me because I would have thought Toyota was ahead of that. Well, and I mean, I guess— and wasn't, wasn't Tesla number 1?

I think that might be stock value. And what maybe— what is brand value? I don't know. Yeah. Anyway, here myself.

Yeah. And I mean, I think also You know, the, the, the used car market, which of course is the only thing that Carvana is in, has been interesting with, you know, during the pandemic, prices being extremely high for used cars and now things coming back to earth. So hopefully they continue to do at least okay because of those crashing used car prices. Yeah, well, it's good to see that thing open. And it sounds like they might even do more in Colorado, kind of depending on how this goes.

We are the 34th around the country. Years. I think that sounds right. 34th. Anyway, good stuff.

Our next story here is kind of another thing we talked about regularly, but fun to have the report for the completed year of 2022. DIA, we, we've had the largest number of passengers ever to go through there, passing the pre-pandemic numbers. Yeah, that is great. So we're back up above 2019.

The, the new record represents a 17.8 percent increase in passengers compared to 2021. And 0.4%. So basically the same as 2019. Some other interesting numbers in here, though. One element to point out is last year was on track to beat it by a good bit until December timeframe.

Southwest and some other airlines had a horrible time with cancellations around the snowstorm. So that, that kept the travel numbers down a little bit. But they also had some interesting stats in here about the percentage of these passengers who were either starting or ending their travel in Denver, which answered a question that I didn't know I had. You know, what's— you know, is this mostly just like a checkpoint on the way somewhere else, or is this a place people are going or coming? And it says that 50— 59% of the people who traveled through DIA either started or ended in Denver.

So a little higher than I would have guessed that most of them us or we're there. I thought that paragraph in the article was pretty funny, though, because it— the stat was 58.8%, to be specific. And then several sentences later, they're like, however, 41.2% of the passengers connected. Well, if you add the 2 numbers up, it's 100% because there's only 2 options. Yeah, you're either going through or you're stopping.

Yeah. And that— what was interesting there is that that was a significantly lower percentage of those people. In 2019, it was 64% of the folks who had started in Denver. So I guess that means we're more of a waypoint now than we used to be, which I don't know, I mean, is that turning us into more of a hub for other cities? Anyway, interesting stuff.

I don't know if it matters, but it's interesting to me anyway. Yeah, it was definitely an interesting article. Glad, glad DIA is busy so we get better flights. But I hope they figure out the the TSA situation here pretty soon. Anyway, next, we have a story about microgrants.

There is a, a organization, I guess, that's coming to Colorado that is going to help businesses get started with microgrants. It's called the Good Neighbor Fund. And they actually started in Buffalo, which I guess is considered the good neighbor city. But as the person moved to Denver, they decided to move their, their, their organization here as well. And MicroGrant is not real big.

No, it's about $1,000. $1,000. And what they're doing is they have a handful of investors who put money— I guess it's contributors. It's not really investors. Donors.

Yes, donors put money into this and they will— they'll get applicants from companies who will say, you know, why they want these grants. And then they just give this money to those organizations. This is not an investment. This is not a, you know, there's no strings attached. They're just giving it to folks who seem like they need it.

Yeah, I mean, and the idea here really is for, for people that are just starting up a business, other things like that. You know, if you're very early on, maybe you need, you know, a very little bit of capital to get going. And that $1,000 can help you maybe bridge the gap for something, maybe get you started. And, and they're just, they're trying to essentially just pass it on, right? Like, help, help people and pass it on.

Yeah, the— if you're interested in this, or you know someone who might be, people need to apply for the grants with a 60-second video video pitch. And the process looks like it's relatively easy. You can go to goodneighbor.fund to check out more information. That sounds awesome. All right.

Next, there was a recent report that came out talking about the state of Colorado tech. And there were 6 key points that came out of this. And Robb, I know you particularly are an expert on this. Yeah. Alex says this because I was at the CTA's event where they released this and I was on a panel that got to discuss the findings from this thing.

So it is an interesting report. It was 30-something pages, I think, with lots of, with lots of stats showing how Colorado compares to other states in terms of our tech, size of our business, the growth, the growth rate, the percentage of jobs, the kind of remote element of jobs, diversity around jobs, lots of interesting stuff. But this article did a good job summarizing some of those key key things you want to— you want to share? The first one, the state's tech industry punches above its weight in terms of wages and salaries. And that really means for the percentage of jobs that are tech jobs, there's a much larger percent of the salary paid versus the non-tech jobs.

And I don't think that's a surprise. Yeah. This also shows that relative to other states, that our job growth has, has been growing even better, you know, throughout You know, COVID, a lot of states were hit. We were hit less, and our recovery has been faster and more significant than most states. So our job comeback has been fantastic.

Also, tech jobs are slowing, but many companies are still planning to expand in 2023. Yeah, it's related to the economic downturn we're seeing here. The 4th one here was one I think we spent a lot of time talking about because we actually have a really significant diversity problem in Colorado. This is, you know, not, not only like it's both ethnic and gender diversity in the tech field compared to other states, not just based because Colorado is less diverse, because we're actually, you know, we're actually significantly worse than Colorado's diversity numbers would show. That's, that's a real problem here in our state.

And then next, tech positions span industries, excuse me, and more people and require more people to fill them. Yeah, we don't have nearly enough folks across all those industries. Finally, the cost of living is a challenge for Colorado in these talent wars. You know, it used to be that folks would want to come here from more expensive places, which was most places with tech jobs. And now there's great tech jobs in some other states that are less expensive.

Austin, Texas, well, that one's more expensive now. North Carolina, like Nashville, there's a bunch of other places that that have good tech industries that have a significantly lower cost of living. So it used to be an advantage for us. It's not so much anymore with the significant increases we've had here. Yeah, I mean, I'd say it's even a detractor at this point.

You know, 10 years ago when California companies started shipping their, their workers and hiring in Colorado instead of in California, that was the reason why they did it. Now I think it's as or more expensive here for cost of living. Than anywhere else. So, all right, uh, interesting report, maybe worth taking a look at, or maybe we just summarized everything you need to know. Up to you guys.

Uh, next story we've got here, you know, because we only do this podcast once a month, this story has evolved. And, you know, we, we started off with some articles saying, you know, hey, it looks like Dish's websites are down, potentially there's a cyber attack involved. Um, you know, now we've got to the point where they have issued an SEC filing confirming that cyber attack was involved, and it looks like it was some kind of a ransomware attack. Obviously a big impact to a loved local company here. Alex, what do we think?

Yeah, I know that there were many problems and outages related to this. I think call centers were offline, support systems. Many DISH employees were unable to access the DISH corporate network and do their work via VPN because of things being shut down or disrupted. And I, you know, I honestly haven't heard anything in the last week or maybe even more than that about what the current status is. Even going so far as part of this as, you know, some of the Sling customers getting their TV interrupted and other things like that.

It sounds like for the most part, the, the TV service and other things like that were able to continue. But a lot of the sort of ancillary pieces around at Dish were not working. Yeah. And I can say I am a Ting customer, which is their internet, their fiber company. And mine has never been disturbed.

It wasn't disturbed as a part of this. So at least that was working throughout. Obviously, you know, our thoughts are with the security team over there who I'm sure have had just a horrendous couple of weeks trying to work through this. And hopefully they've come out on the other side or they're about to come out on the other side and get back to the fun stuff. Yeah.

Hopefully things are contained. I would imagine it'll still, based on the size of what this seems, it'll probably still be a bit before we hear you know, maybe the details and the, you know, the final reports of what happened here. All right. So moving over to our next story, we have a press release by our friends over at Coalfire. This is a little bit of chest thumping, but I think it looks like it's well deserved.

They've had a great year. And I think, you know, they are number 1 in FedRAMP compliance and cloud pen testing last year. Yeah. Congrats to them. They apparently have been number one in FedRAMP services for a couple years now, and they extended that.

One of the things that I thought was interesting was that they were engaged with 70% of all FedRAMP ATOs. That's a, that's a pretty big number. You know, maybe not the only person involved with them, but, you know, still 70% of all folks trying to or having achieved ATOs is pretty cool. Yeah, they were, they were the number one and they bought the number two. Maybe like 5 or 6 years ago.

So it became, they were definitely the default choice to work with if you're looking for like a really experienced company in that space. They have also released and improved their Compliance Essentials platform, which sounds like a sort of an automated GRC evidence gathering platform. I have not used it personally, but they seem to think it's pretty awesome. And you mentioned cloud pen testing. Yeah.

That's a space where they've been investing a whole ton. Um, you know, obviously people are moving into the cloud and they don't always know how they're securing it. So there's a big demand for companies that can come in and validate that security is right. And Coalfire has built a good program around that. So congratulations to them on all that great growth.

Yeah, I think finally the last thing on here, they do have a couple things about, um, some sort of workplace recognition they've, uh, they've received, including, um, 4 Women's World winners. Tied to mentorship, DEI, and women's advocacy, among other things. So, so pretty cool. Good stuff for them. Yeah.

All right. Next, we have a blog post by Ping Identity by Herb Goodfellow talking about the financial ecosystem supply chain risk. Really, I think the gist of this article, though, is about the API integration and kind of the rise of APIs as a part of financial systems. Yeah, a little bit talking about how instead of being sort of more static web kind of applications, financial applications have moved more towards APIs, which is not shocking, but then, uh, talking a little bit about why, um, you know, how that kind of works, and then, you know, what is it you should be doing, uh, in order to secure your APIs. I think Ping has been hitting on API security hard for maybe 5 years and have a number of different solutions they offer in that space, but I think that a lot of this content, including this one, is stuff that you can just use to get better educated on how API integrations work and, and what you might want to be thinking about as a CISO.

Good stuff. All right, next we have a blog post from Red Canary. Uh, this is one of those great in-depth technical blog posts. It's called Gatekeeping in macOS: Keeping Adversaries Off Our Apples. Yeah, I love it.

I, I'll be super candid, I did not know what Gatekeeper was. Gatekeeper is a technology that's on Apple to, to stop, uh, inappropriate software from being installed on there. So if you, if you're trying to drop malware on a Mac, you got to figure out your way past Gatekeeper. And that's what this article is talking about, is, is How is that possible? How does Gatekeeper work?

What does that whole interaction look like? Yeah, again, very in-depth. If you are someone who cares about the technical details, definitely go and read this blog. Good job by Brandon writing this up. Next, we have just a very short article.

We actually have 2 related stories coming up here. Number one, they're both coming from the Colorado Technology Association's APEX Awards, which that's where they do kind of Company of the Year, CEO of the Year, CIO of the Year, CISO of the Year awards. Well, this year, the Technology Company of the Year in Colorado was given to one of our local friends in the security industry. Yeah, Logarithm named Company of the Year. Congrats to them.

And they were— the other competitors were— oh man, and I'm blanking. Wasn't Rule 4 one of the 2 competitors for that as well? I believe so. And I can't remember who the 3rd one was. I don't think it was a security company.

2 of the 3 finalists being security companies was, was pretty cool stuff. Yeah, that's awesome. Uh, the second announcement as part of that was the, uh, the annual, uh, CISO of the Year Award as part of the APEX Awards. And, uh, Julie Chiquillo from Guild was named CISO of the Year. Congratulations to Julie.

Congrats to Julie. She was a finalist last year, um, just did a fantastic job, uh, has, you know, she's worked over at Guild for quite a bit and built a great program there. Our other 2 finalists, uh, we had Joe McComb, our friend from, uh, Holland and Hart, and DJ MacArthur, another long-term friend of ours over at Children's Hospital of Colorado. And both— I got to go to the awards and see all 3 of them there. And neat to see, neat to see the community come out for that award.

All great potential choices, and congrats to all 3 of them. A special congrats to Julie for winning. All right, let's jump over to our events. Just a reminder, we have a calendar of events on the website. You want to know what's happening, where you can get to network with people, mostly in person, occasionally virtually.

Go out to colorado-security.com and click on the events button. First up, ISSA Denver is, uh, doing From Private Sector to Academia: Women's Gains in Cybersecurity on the 14th. On the 16th, ISACA Denver is doing their March meeting, and this is a virtual meeting. On the 17th, uh, the Let's Talk Software Security group is doing It's Time for a Vendor Intervention. That's awesome.

Uh, the 21st CSA Colorado, that's the Cloud Security Alliance, is doing a March New Threats Means New Tools. This Isn't Your Dad's Cloud Anymore. Oh, my dad had a cloud. That's awesome. Yeah, I don't know what that means exactly, but interesting stuff.

On the 22nd, ISC² Pikes Peak is doing their March meeting. And our last one we were going to chat about here is on the 6th or the 7th of April, ACES Denver. That's the physical security group. They're doing a coffee chat with Lisa Buckley. That said, we wanted to pause here and mention we're going to be doing a Colorado Gives Back event.

I meant to mention this just a little bit earlier. This is, you know, as a part of the mission of our group, we, you know, obviously we love doing the podcast, we love the community we've got together with this, the Slack channel, but we also love to find ways to organize this group to help out with Colorado more generally. Thanks to Ben Fellows, who's a local security leader here, for stepping up and helping organize our first Colorado Gives Back Day. We're looking at April 29th, getting together at a park in Denver and, and doing just some park cleanup, getting the park ready to be, you know, prime time coming up in the spring here, right? So, so if you're interested in getting involved, we would love to have you do that.

The details on that are going to be coming out soon. We'll send it out to our mailing list so you guys can see it. But just be ready, put that on your calendar, the 29th of April. It'll be in the morning, I think officially starting at 8 AM to 11 AM. We'd love to have you there.

I will say that it's a very— we're limited to a very small audience. So I have a feeling this is going to fill up quickly in terms of how many people we can have. I think it's only 20 people. So if you are interested, respond right away. And we also apologize if by the time you respond, it is full.

We'll have more stuff like this in the future, assuming it— sure, if it's just me and Alex and Ben, right, with our, with our shovels, maybe that'll be the last time. Well, that's true. I'm sure we'll get more than 20. I think we will too. All right, let's talk about jobs now.

First up, Jefferson County is looking for a Chief Information Security Officer. TIAA is hiring a Director Business Information Security Officer focused on integration. Awesome. Dish Network is looking for a Senior Manager of Network Security Infrastructure. Our friend Michelle Wilson is now the CISO over at Movement Mortgage.

She is hiring a Product Owner for cybersecurity. It's kind of like a program manager type of role. Crocs is looking for a senior manager for IT internal audit. Charles Schwab is hiring a cybersecurity advisor. CHI is looking for an IT cybersecurity senior analyst.

CoBank is hiring a senior IT security analyst. Marathon Petroleum Company is looking for a cybersecurity analyst in endpoint security. And Xcel Energy is hiring a security analyst. Job. Job.

The word job shows up there. Security analyst job. I mean, it's, it's a job, right? Yeah. Uh, well, that is it for the news.

We do have an interview this weekend. In fact, our interview is with one of the finalists we just talked about from CTF. How about that for timing? Um, so Joe McComb, um, over at Holland and Hart sat down with, with our friend, uh, Frank Victory recently. And Joe has been on the show, man, maybe 3 or 4 years ago now.

Yeah. Um, and since then, he's— he actually, at the time, he was the CISO at Janus Henderson. He went over to Ball Aerospace, and now he's at Holland and Hart. And I'm sure he'll, he'll give some of those great details in the story here. I look forward to it.

All right, Alex. Well, that is it for us. We will circle back again in April, and maybe, maybe we'll get together. I'll play a practical joke on you when we do the podcast. Oh, that will be fun.

Or not. Thanks, everybody. Thanks, Robb. Hi, this is David Stapleton, Chief Information Security Officer with CyberGRX. This is calling Colorado Equal Security, for Colorado security professionals by Colorado security professionals.

Good morning, good afternoon, and good evening, Colorado Equal Security. My name is Frank, and I am here today to do an interview with Joseph McComb, or I believe he prefers Joe McComb. Yeah, yeah, Joe McComb. He is a CISO for Hollander and Hart. And has been in the position since August of 2021.

Welcome, Joe. How are you today? I'm doing well. Yeah. Thanks for having me on the show.

Yeah. Yeah. So you've been in Colorado. You are currently, again, the CISO of Hollander and Hart. What is that like?

Can you tell me a little bit about that? Hollander and Hart is pretty much a law firm that's spread across the West, and their tagline used to be the law in the West. We've got 13 offices from Anchorage all the way to Denver. There's one in Washington. That's the only one that's not West.

And we're in like Boise, Salt Lake City, across the board. And it's broken out into several different what are called practice groups. So we practice like environmental law, employment labor, tax, corporate litigation, intellectual property, and a few other disciplines. There's even one that does cybersecurity and privacy. Wow, that's cool.

Yeah, it's amazing how many companies that are out there that have picked up cybersecurity sometimes even as a service, even though that's not their core business. What are your thoughts about that? I mean, do you think that that could give them an advantage? Because being a law firm and being surrounded by lawyers, do you think that would give them advantage in cybersecurity from a legal sense of view? I think it's very good that they have this practice in that.

And the reason why is because, I mean, they represent clients across the board that are household names. And I, I can't mention any of them. That's client confidentiality. But The fact is that you see breaches all across the board. And one of the nice things about this is if a lawyer in one area of the company says, hey, I have a client that just reported a breach, they can then reach out to their colleagues in the cybersecurity and privacy area and say, okay, so how do we handle this from the legal sense?

How do we respond? And so they can actually offer that service immediately without ever having to even involve with a secondary firm then. That's right. They'll still bring in instant response like Mandiant or FireEye or somebody like that, and they'll recommend those pieces, but they can still advise also on the legal aspects, which is a huge advantage. Awesome.

Awesome. So you've been in leadership for a while. I see that you've worked for Ball Aerospace as well and Janus Capital. So you've gone to, well, what, building rocket ships to, from financial to building rocket ships and then back to legal. And then back to legal.

Yeah. Yeah, I've been in a lot of industries. I started off in pharmaceuticals, actually before that was really academia, but then academia, pharmaceuticals, then government and local state outsourcing that area, then went into the financial areas with Janus Capital. When they merged with Janus Henderson, I was the CISO that led them through that. Then I moved to Ball Aerospace.

I was with Ball Aerospace for a couple of years as the CISO there and then moved to Holland and Hart in 2021, right at the end of that. Okay, well, let me hit you with a deep question then. Compare and contrast being the CISO for each one of those companies. Was there a major difference when you're thinking rocket ships versus financial versus legal? So I'm gonna, I'm gonna tell you one thing that I tell the lawyers, which surprises the heck out of them.

I tell them that they're actually more reasonable than some of the other people I've worked with in other industries, and they start laughing. They just don't believe that. So, but I'm going to start laughing at that one because I know some lawyers and yeah, it's true. The lawyers, the ones I've worked with, understand risk very well. Cybersecurity is really important to them.

When I look across all of these industries, a lot of differences. When you look at all in that kind of area, there's a lot of classified material there. So there's a lot more segmentation off the network. And a, a lot more isolation than what you'd see. Whereas if you look at the legal area that I'm in right now with Holland Hart, the lawyers have all of their emails posted.

It's on the website. People are constantly emailing them. I mean, they do huge amounts of email. Email is really a primary system. And so when you kind of think about that, you've got phishing attacks that are kind of constantly coming in that way.

Financial industry had some similarities, much more locked down. When I worked for Janus Henderson in that area, more regulatory pressure in that area, although Holland Hart does have a lot of regulatory pressure too. When I look at pharmaceuticals, pharmaceuticals was probably kind of one of the early areas that I saw that was really getting heavily into security, and that was really to protect IP. Big contrast between all these different areas. You think more protecting IP or more protecting client data, or is there a difference?

There is a difference. And one of the pieces that you're hitting, so when I worked for Merck, I was working for the research division, which would go all the way from developing a compound all the way through clinical trials. And what you'd see on those ones is you would see heavy protection around information of people that were in the clinical trial, but you'd also see a lot of protection around protecting the IP. So the new compounds that were being developed, because if you look at pharmaceuticals, the way they operate, it's all about what's in their pipeline and that affects their stock directly. What they do is they they develop a compound, they patent it, and then they want to protect where that, that is in that cycle.

And pretty much, and then they get into clinical trials and they get to a point where they can, you know, actually file after all that. So they, they do protect a lot of their IP. Okay, well, let's shift gears just a little bit, um, kind of at a transitional stage. When you're trying to protect IP, describe how you can possibly use a dungeon or a dragon to protect some of that IP? Because I know that that's something in your profile about that, right?

There is. So yeah, so kind of, we'll do the reference on that one first for everybody, which is that when COVID hit, my kids were playing Dungeons and Dragons. I hadn't played since high school. It'd been a long time. And so you can imagine we're all sitting here isolated.

What I found is that there's a lot of people that were are my age that basically went back online and started playing D&D again, which was a huge surprise. This all relates because I tend to be more of a walking CISO. I like to get around and talk to people, and I'm not as much the introvert. I needed some of that contact. I put in a new hobby that got me to actually talk and interact with people, went back to that, and kind of— it was a good hit because when you're stuck basically in a basement room and you you can't really go out for fear of COVID you try to figure out what's the kind of hobby that I can do besides run around the block, which I also did, that you could actually be creative with.

And so that was it. I ended up writing, I think, about 8 dungeon modules during that period, which are all online for free. So that was kind of a surprise. Wow. 8 modules, uh, writing and how to play.

And do you think though that when you're walking through those, you could apply those to your life within cybersecurity, or do you think that's a totally separate life from you? So that's an interesting thing because I, I would actually incorporate little bits of like code and I mean like coded messages into my adventures and have people solve those as, you know, like riddles and pieces like that. So there was a code breaking aspect in a lot of the stuff I wrote. And so that's, that's tended to be where it came in more than anything else. Well, I mean, I think that's great because, and, and the reason why I bring that up is that when we're working with IR or possibly even digital forensics, it is some code breaking as well.

We're trying to figure out how to defend, we're trying to figure out that code, and that's really where the reason why I brought that up. Yeah. Yeah. And you know, you kind of look back and another, another question that I often get asked is, you know, how did I go from a PhD in anthropology to what I'm doing now? And there's, there's kind of 2 answers to that.

One was really leave, it was salary was one of the things. Fact was, is I knew that if I'd continued in anthropology, the salary levels were not going to be similar at all to what I was making in IT. I, I knew that. So that, that was one of the pieces. But the other piece was, is that I come out of an area in human population genetics.

I used to run a DNA fingerprinting lab and I did all of the statistics for that. And so when you look at threat analysis, What are you doing? You're taking in a bunch of data and you're correlating stuff and you're looking at how it operates and you're looking at patterns and it ends up being really a similar kind of study. And so I do a lot of data-driven, a lot of data-driven analysis for computer defense right now. And you think that your experience though with your anthropology and everything else, do you think that feeds into what you've done like to, to help you fingerprint cybersecurity attackers?

Absolutely. Yeah. So you look at the last presentation I did for the management committee at Holland Hart, and what it was is across the top was here are our different practice groups. So intellectual property, corporate litigation, and then also here's some specific business functions like HR, payroll, accounts payable, that area. That's all across the top.

And then along the side, I've got a column that says type of attack. So is it one of those silly gift card scams where somebody's saying, hey, are you in the office and can you send us gift cards? And that, that kind of hits across everybody. And then you see other ones that say, I'm looking for an intellectual property lawyer to help me out with blah, blah, blah. And that typically gets targeted to, of course, the intellectual property group.

And I've actually charted out like the frequency of those attacks too. And that, that was beneficial because I could say, okay, so when you look across the board, This is how we're getting attacked. You're seeing requests to change salary. They're going to HR. They aren't going to other people.

For accounts payable, you see the typical ACH attempts, ACH attempted transfer fraud kind of stuff. But then this is what you see across practice groups. And it's, it's that same statistical analysis. This is about how often it happens. And this is what we're seeing across the board.

And so essentially though, you're taking your fingerprinting skills and you're turning it into customized threat intelligence for your own firm. Yeah, absolutely. And then from there, which makes sense, is turning that into awareness campaigns. So depending on what I'm seeing, I will send out targeted awareness campaigns sometimes to specific practice groups. Sometimes it goes across the firm depending on what I'm seeing.

And so I'm able then to change our security awareness to better adapt and support the company so they're better protected for the scams they're going to see. I mean, one of the things that you'll see, I'll give another one. If you look at like our real estate practice, What happens a lot there is we get title companies that get compromised and then they'll send from that compromised email something that'll say, here's our documents, please click this. And so, and if you go and click through that, of course it brings up something that's a set of credentials. It looks like Microsoft 365.

And what they're doing is they're trying to phish the credentials from there. And so I'm able to go back to real estate and say, you need to watch out for this. If you are not expecting to get something from this title company, And I know you've worked with them. If you're not expecting to get something from them, send it to us. We will check.

We will look and see, is this a compromised account? Wow. Yeah. And you have to be so careful because I know that when we start looking at awareness campaigns, one of the biggest things is like, look for misspellings, look for bad language and grammar. But in reality, I've seen more mistakes in true business emails and true things versus— and then I've seen the phishing campaigns where they're pretty much perfect up to the point where I've actually taken one of the, the, the texts from a phishing campaign and used it in a real document because it was better than what I wrote.

Oh yeah. Yeah. And I've seen scams that really go the whole 9 yards. They've scraped code from another website. They've doctored up a site that's as their own.

They've set up a recent domain. The, the reason that you tend to spot those is because the domain has appeared in the last 3 months or something like that. But you really have to dig to get down into that. And I mean, they've gone through and set up a whole fake company down to, okay, so the building they're in is actually really postbox, et cetera, or something like that, usually in Mexico City or somewhere like that. But you have to dig that far to find out that it's a phishing scam.

And the one positive thing is I've got a good enough awareness campaign that I've got attorneys that are contacting me and sending me this stuff and saying, I'm not certain about this. I wasn't expecting it. Could you take a look at it? And I've also gotten the ones you're talking about. I have gotten people like, it's usually accounts payable, strangely enough.

I don't know why it happens in that area a lot, but I will get somebody in accounts payable that will use all caps. They'll say, I need to change this routing number for some reason, all caps. I don't know why they put that. And I'll go through and be like, okay, this is legitimate, but you should call them. And I don't blame the accounts payable people because I mean, those are the things that we normally tell them is that grammar looks off.

It's, you know, trying to be urgent or something like that. And they'll send it to me and I'll be like, okay, I've traced all this through and this is an actual person. This is actual phone. They're just, they look like a phishing scam. So I recommend you call them, confirm that.

But as far as I can tell, this, this one looks legit. So I think it's kind of funny that it's always accounts payable that typically has those problems. I don't know. So that at least, do you think now, do you think that's specific for the legal firm or going back to your Janus Group? Or do you think that's wider than that, that accounts payable people will be the people that we're looking at?

Like maybe they, they're targeted across the board to other companies. They are targeted across the board. I saw account payable problems in pretty much every phishing attacks in every company I worked at. So, okay. Yeah, that's, that's not uncommon.

Do you think that it's specific to maybe the type of people or would you think it's because every company probably has an accounts payable department? I, I think it's because every company has an accounts payable department and usually they do the research. They've already figured out who are the upper people if they want to send one of those scams where it's like, hi, this is such and such. I'm the CFO. Please transfer X. I've seen scams against every AP department of every company I've worked at.

Wow. Okay. Well, I'm going to step out a little bit from where we're going because we've been talking about analytics. We've been talking about how to look at scams and items along those lines. You have a very heavy educational background.

You— I see you have a doctorate, a master's, and a bachelor's degree. All right. 2 from the University of Kansas, one from Boulder. Do you think that helps you? Or I know that a lot of cybersecurity people don't have degrees, and I know I'm putting you on the spot here, but I think it's a very interesting subject of how strong those educations— do you think that helps you?

Would you think that cybersecurity people need to have degrees, or do you think that they can go away, get board certifications, those kind of things? Yeah, I do have a big opinion on this. One of the things that changed my opinion on this was an analyst that I had, a person named Todd Garrison. And he was at— yeah, I don't know if you know him or not, but I know Todd very, very well. So good.

Yeah. So Todd worked on my team when I was at Janus. Fantastic guy. And Todd, I don't think he ever finished his degree, but he was one of the smartest people I knew. And he really was, still is.

So when you look at that, one of the things that I did was I did get Todd to get, go out and get some of the certifications. And that was kind of one of the things in the group. And that's for the same reason you're describing. So for me, when I, when I look back at my education, it's really adaptability. I mean, I, I start off and I get, I get a bachelor's in biochem and then I go off and go into anthropology and I combine those 2.

And so I start doing DNA fingerprinting, but it's really adaptability. And then because I'm doing a bunch of statistics, I start going into IT work. People actually want to pay me for IT work, which is kind of, kind of a surprise, but worked out. And so I, I see it more that it's mindset and adaptability, and that tends to be what I look for. And, and when I'm interviewing people, one of the questions I'll ask is, what are you passionate about in information security?

And usually there's kind of 3 different types that I run into. There are people that are very passionate about penetration testing, and that, that's kind of where my focus originally came out of. There are people that you'd kind of call network defenders. They, they often start off in networking, used to making firewalls and stuff like that. And then there are also some compliance people that come in also that are kind of interested in the regulatory aspects.

You got kind of 3 different types. And the, the one that, the thing that I'm usually not looking for are the people that say, I'm interested in everything. And I have to dig to try to find out what that means. And some of those people I'll find are really just kind of looking for a job and not really in cyber, and they just know it's hot. And that's, that's not what you're looking for.

You're looking for somebody that has a passion somewhere in this discipline, and then you're looking for some adaptability from there. Because for me, I went from kind of penetration testing that area, ended up doing a lot of compliance work and then management and CISO and Yeah, you can end up doing a lot of stuff and that's, that's all about adaptability. Yeah. Well, I definitely agree with you about the passion part. As some people that know me, I work a lot with students and people, entry-level people trying to get them into the business.

I ask them why they want to be here and when they tell me because of the money, I said, that is the absolute wrong reason to be in this. If you do not love what you're doing, You're just going to be miserable and you will make everyone around you miserable. And I mean, I, I had a guy that I worked with, best guy I've ever talked to. Go out and have a beer, fun. It was the best time.

When he was at work, he was miserable. And he was surprised. And one of the times that we had a beer after work, I said, I've lost count of how many times I wanted to run down the stairs and punch you in the face because you were that horrible to be. So, I definitely get that passion part. If you do have a passion in one of these places, whether it's penetration testing, network defense, compliance, maybe even digital forensics, how do you think they should go forward?

I mean, should they be looking at trying to get a degree? When you and I started in this industry, the degrees weren't really there. But that's changed now. I mean, and of course, now 2023, There are degrees, there are useful degrees. What would you do if I came to you and I said, I just got out of high school or I just started looking at a career change?

I am passionate about network defense. Where do you think that you would start somebody out at? Yeah. So if they can get a degree and I've had a number of people that have gone through and they come up and they say, listen, I have— I've even had people that have had like a master's in cybersecurity or something similar. And the problem that I've noticed that they're running into, and this is something that we have to address within our industry, is that they realize that all these jobs out there ask for a certain number of years of experience.

And there's some ways that we have addressed them in terms of that we've done internships and other pieces, and we really need to do a bit more of those internships. And that's, that's the area that I kind of see has been That's been really one of my focal points is that I, I do have a lot of young people coming to me right now that are saying, I'm interested in this area, getting— it's usually it's computer science with a concentration in cybersecurity or something similar. What do I do? And I'll be like, okay, so we need to start looking for internships. And then one of the other things is once you get that experience, I do recommend earlier on to get a certification that, you know, if it's a CISSP or something similar, because That's still what people are gonna be looking for initially in the job when they're hiring out there.

And that says that you've got, you know, a certain amount of experience. So I, I do still believe in certifications. Yeah. Robb, Robb Reck and I have talked a little bit about this and it's, it's been a good, it's been a good discussion. And so I still practically am saying, okay, so still set your sights also on that certification.

And my biggest recommendation right now is if you are at a company and you, that there is a cybersecurity department there. Definitely, and you're interested in it, make contact with them if you have an interest in that. Because I, you know, I bring people in from the service desk and the like, and I will develop them. And I think we all should be doing that. Well, I think that you bring up a very good point.

When I was teaching at the community colleges and even at the universities, I had people coming in from different industries. Not all of them, though, are coming in from high school. A lot of them are coming in and being career changers. And one of the pieces of advice that I always give them, like, well, I've had 20 years of concrete experience and my body can't physically take it anymore, so I've got to do something that isn't so much. And I agree that systems, you know, either it's IT, whether it's cybersecurity, it's a great place to be.

But I said, try to stay actually in the industry that you're in. For the student that was in the concrete industry, I would talk to them, it was like, what about doing some cybersecurity work for a concrete industry? Because for me, when I talk about concrete, I'm like, well, it's rock, right? Yeah. Yeah.

But you understand the supply chain. Yep. And you'll be able to pick out certain parts. If I— we teach you how the supply chain works, you can apply it to that specific industry, get a huge advantage over anyone else because you understand what the job is, or at least what the business is. Yeah, yeah, that, that is one of the, the areas too.

I totally agree because you've seen I've skipped around industries. Merck, I was there about 6 years, so I did understand the pharmaceutical industry. Janus Henderson was almost 11 years, so really began understanding the asset management. Ball Aerospace was a couple years, and so I, I would say I just kind of skimmed through that area. And the legal industry has had its, its own different pieces that I've had to work through.

And one of the things that you'll find too is that there are certain industries that it's actually hard to find somebody with cyber experience in. So if you already have experience in that industry and you want to be in cyber, I mean, that's a big pull. Yeah, it was. It's actually been kind of difficult to find people that have cyber experience in, you know, at a legal firm. It's, it's unusual.

But do you think that would give them that, that advantage being able to? Oh yeah. Yeah, absolutely. Yeah. I mean, there's, there's a lot of things that they, they know about.

So like most industries, the legal industry has its own set of IT services that are pretty, pretty common to it. You know, document management systems that are pretty common to the legal industry. Certain things around preserving chain of custody for evidence. There's a bunch of things like that that are really more specific to that area. And then also understanding how practice groups function.

So, so if you look at Holland and Hart, Holland and Hart is a partnership. So I've got 400— I don't know, around there actually. I'm trying to remember if it's between 250, and then if I include the associates, I think it's like 450. But there's 200 partners out there. And so they— and they all own part of the firm.

And so instead of having a single CEO, you know, I, I have to think about all of those different practice groups and how they operate. Wow. So a very wide range of skills and industries that you have to deal with. We've been talking though about education. We've been talking about your experience.

One of the things though, let's shift again a little bit on the gears. I always tell when you get into the cybersecurity industry or even IT, you need to have at least one non-technical hobby, something where you're not in front of a computer. What do you feel about that? I totally agree with you in a lot of ways. One of the things that I realized, and this was really when I was working for, for Janus Henderson, when I was working for Janus Henderson, I was spending a lot of time flying between Denver and London.

Because the headquarters was in London. And what I realized is that all the C-levels, they had some kind of exercise-related hobby. In other words, they were biking, they were running, they were swimming, they were exercising like crazy. And I think that's really to kind of keep that stress level off. So that's one of my bits of advice that, you know, when you get up into that executive level, Find a hobby, at least a hobby that keeps you exercising.

I bike, I walk, do everything that I can. So that's one piece. The other piece too is something that gets you out to talk to people. I've kind of switched hobbies around. You just talked about Dungeons and Dragons.

That's, that one in particular gets me in front of a lot of other people that are interacting. That kind of helps. I do know a lot of people that play golf also. I admit I don't play golf. I'm not any good at it.

So there you go. But I do recommend something that at least gets you out and interacting with other people. There's some people in cyber that tend to be, they tend to be kind of isolated and a little more introverts. Not all of us are like that, but when you're actually handling an incident, you often have to interact and talk to people and you have to find out, okay, so what happened? How did this happen?

And in a non-accusatory way, because the fact is you probably clicked on some kind of phishing attack from somebody's email account. At a firm that was compromised. And so they, they were normally in contact with that person. And so it's just another email. We know that phishing attacks are designed to trick people.

And so getting out and interacting, you know, with other people and being able to speak is really important. And it's one of the things that, yeah, I work with that on any kind of deputy CISOs I've got. And then also any of the other staff that I've got, I'll get them to get up and you know, speak at all hands and the like and say, what are you doing in this area? Well, I agree with you, although I think that from the physical part, I would extend that out to pretty much anybody in the IT industry. Get out and do something.

Don't be— I mean, we— I think that a lot of the people, especially maybe even the younger generation, they like to play video games and things like that. Get off the couch, get out in front someplace, do something that doesn't have a screen on it, do some exercise. Actually, we're talking about Todd earlier. Todd, if you didn't know, is an excellent musician. I do know.

Yeah, I do know that. I actually brought my wife, my family over to one of his concerts. Yeah. And it was amazing. I mean, he was amazing at it.

Yeah. And my last interview with— in the Colorado Security, uh, Dustin, he's actually— I think you believe he was a rock band. He was not Rock Band the video game, but actually in a real rock band. And I thought that was amazing. He had some guitars and just get something where you get your mind— because I will have to tell you, I do things like— well, one of the things, I have a dog and I got to be careful because if she hears me hear the certain word, she's going to go nuts.

But I walk my dog and I do some of my best thinking while I'm walking the dog, and I solve a lot of my problems when I'm— when we're out there. Yeah, yeah. And it, it's funny because I've tried to put 2 different hobbies. The exercise one is where I do all my thinking And then I also try to do some kind of intellectual hobby that actually stops me from thinking about information security. I know that sounds really funny to say that, but what I, what I found kind of earlier on in my career, and this is where I want to talk about the, the, this problem that plagues our industry, especially the upper levels, which is burnout.

And one of the things is you get in this profession, you're very passionate about it. And so you keep working on problems kind of constantly, right? And, uh, and then you're, you're constantly also looking at your phone and then, you know, you see somebody's reported this or working on that and they're always kind of on call. You end up being on call kind of 24/7 and it just, it's just a kind of a constant thing. And so what I realized was that I, I needed to find a hobby that would force me not to think about work at all and actually just stop.

And this is really hard to do. I mean, one of the things you do is you have to build a good team that can support you. And I've got a great team at Holland Heart. Say that. They've been fantastic.

And the way I judge that is, have I been able to take vacation? And Holland Heart, I've been able to take vacation. So that tells me a lot. And when you look at it, I've tried to find a few hobbies that force me to change my focus. You know, intellectually to something that is not necessarily InfoSec.

And so then it gives my mind a break and I emerge much more fresh when I do that. And like Dungeons and Dragons. Yep. D&D did that. Yeah.

There were some card games and some other— I've noticed that a lot of the gaming stuff that I did, I was a gamer all throughout high school, also through college and not video games, but you know, the kind that you're moving pieces and stuff like that on a board. And those ones tend to absorb so much of my concentration when I'm doing that. I, I, work is just kind of dissolves in the background and it's not that long. It's, you know, it's usually like 3 or 4 hours at the most. So that's in an afternoon, right?

You know, after work or something like that. But I found that I'm a lot more fresh after I've done that. It's, it's like my mind just wants to take a break from all this. And that was one of the things that I found that, you know, kind of helped with that, you know, that burnout aspect. And this, this is a problem that we know is a problem in our industry.

That we do, we get on call, we're on call pretty much 24/7. You know, we're constantly getting alerts. You know, we're constantly in that. And if you don't take that break, you find that you, you work constantly all the time. And what I found is when, when I'd go out exercising, I was still getting people calling me.

It was so funny. You know, I'd be on a bike path in Boulder, you know, biking up the, the path on, I've got a recumbent bike. And I'd have people calling me and I'd be like, hang on just a second. Yeah, I'll take it. And then, okay, I'll be able to solve this in, I don't know, a couple hours if I can get back, but it's got to go back to my team.

So when I look at it, it's finding a hobby that also takes you out of the day-to-day work. And it took me a while to figure that out. I'd say probably, you know, I figured that out maybe about 4 years ago. I agree with you. And I think that burnout really affects the defenders, especially like the ones that are sitting in the SOC.

Absolutely. Yeah. Because even though there's a lot of things that happen within whatever business we're in, whether it's Holland, whether it's aerospace, whether it's even in education, there are a lot of bad things that happen. But, and there's also good things that happen, but the defenders, the people that are in the SOC, 100% of what they see is going to be bad. Yeah.

That's because they're only seeing the attacks that are coming against them. They may not see all those good things that you're doing within. And definitely agree with you. They need to find some kind of hobby that, especially something that really makes you happy, like brings those good endorphins in. Yeah.

Yeah, I agree. It's originally I had tried exercise just like you had, but I realized that when I was exercising, I ended up just thinking about work the whole time and I'd come back and I'd be, it was good. My body was doing great, but I was coming back literally going to solve another problem at work. And so I had to find something that would shut off any thought that I had to InfoSec at the time. And that, that took a while to actually get there.

So, okay. Anyway, but yeah, and I agree with you on the defender piece. And that's, that's one of the things that I monitor more than anything else is monitoring how is the team doing? Are people able to take vacation? That's a big deal for me because as long as you can get out of the office, not answer your phone and actually unwind, it does help tremendously.

Cool. Cool. Yeah. I can tell you what to do in legal. They don't.

So for us, we don't get this. So the staff don't get this, but lawyers will take a sabbatical. So they'll take 3 months off. Wow. Yeah.

Wow. That's, that's, uh, that's a pretty big sabbatical. I mean, I've heard people taking 2 weeks, maybe in a month's sabbatical. I've, I've actually never heard anybody except for maybe someone like J.J. Abrams take a 3-month sabbatical. So that's, uh, that's awesome.

Yeah. Yeah. Not, not all of them do that. Some of them take partial sabbaticals, but I mean, I, I know some of them that have taken 3 months. Wow.

Yeah. Wow. I want to step back a little bit. We were talking earlier about trying to get into the industry, and one of the things that I face when I'm teaching new people coming into the industry is like, how do I get experience? I'm trying to get in the industry.

Here's an entry-level job, and in my entry-level jobs they want 2 years of experience. Yeah. How do I deal with those kind of challenges?

So I see in 2 ways for me, and I think also we don't do a good job of doing this. I mean, that we often post positions out where we're looking to replace somebody or find somebody that already has this experience, but then we're just kind of fighting among ourselves within the information security department, departments at other companies. So that's not the best focus. So one, I do believe a lot in interns. I've had It's kind of bad because we talked about that passionate aspect.

And so I've had some very good interns and I've also had some interns that I could see that, hey, you're really getting into this because of the money and you probably— this is probably not the job that you're going to look for in the end. And then the other aspect too is if you find somebody that is kind of lower down and there's a number of people like this that are like on the service desk or a technician or something like that, and they're interested in cybersecurity, give them the chance if you have an open position within your department and give them the chance to train them because that's one of the best ways that I know to actually get people that experience is you actually say, okay, so your experience in the industry, your experience in our company, let me start working and getting you experience in InfoSec. And I know that you're gonna come in and make some mistakes and I've had some really amazing people come through that way. You know, either from, you know, networking, service desk, applications, one of those areas. And the reason why is they, they had some kind of passion somewhere for cyber and they just came up to me and said, hey, I'm really interested in this area, what can you do?

And so I've kept track of them. Well, one of the things that I advise, because a lot of the people that I work with don't have any connections in the industry, don't have any real way in, But one of the things I say is, well, I've been through the TriHackMe or I've been through these labs and I said, yep, how many times have you done your lab? Well, I did it once. I did 20 different labs. No, I think it would actually be more beneficial for you to do 5 labs, but you've done 'em 3 times each to the point where you can do 'em without having to refer to a book, without having to refer to something else.

Because in reality, that's one of the things that we're looking for, that we don't have to look up certain things. Right. And then when you're done with the TryHackMe lab, can you go to, let's say, your parents, your mom, your dad, your friend, your wife, etc., someone that's non-technical, and explain to them how they benefit, right, from what you just did? Yeah. And I tell them, well, this may take a lot of time.

And you may lose or you probably will lose your motivation while trying to do this. But before you ask that, when you ask that question and I say it's a when, ask yourself this: why am I investing so much time in me? Right? Why am I investing this much time? And if you can't answer that question, you need to rethink why you're here, right?

Yeah. Yeah. And I look back on that. It was kind of funny when I started in InfoSec and sounds like you're kind of the same time period. So I was 21 years years ago.

And yeah, there weren't programs except for, you know, there was SANS. So SANS was kind of, they were starting out, CISSP existed. And I invested huge amounts of time actually in the GSAC initially, that was SANS, also in the G— let's see, it was the 7799, I think at the time or something like that. And huge amounts of times in writing the paper and all that stuff. And I realized that I was putting in, you know, massive amounts of time to put into this stuff.

And, you know, it just kind of said to me, I was like, yeah, I mean, this is— I'm definitely very passionate about this. This is a good way to be going. And it was kind of— you're kind of swimming upstream in that time period because I remember when I, I asked to get moved into a cybersecurity role, I, I was asked, why do you want to go into this? This is a dead-end profession. And this is 2002.

And I was asked that 3 times. Like, this is a dead-end profession. Why do you want to be in this? I was like, this cool stuff. I love this stuff.

And now with such demand, there are enough people with departments and cybersecurity departments and stuff like that, that we're still looking for those people that are very passionate in that. But you don't, you don't have that, you know, swimming upstream kind of effect of, oh, this, this isn't gonna work. I mean, people, people are truly wanted now. And I agree with you. It, it's really, again, looking to see, Are you passionate about this area?

Yeah. Well, I mean, since we're talking about history and we've both been in the industry, I mean, I've only been in cybersecurity for about 12 years now, but I have another, what, 15 years before that in IT. Yeah. But let's go back even further than that. You had mentioned something about most people being born in a hospital, but you were faster.

Yeah. Sorry about that. Well, that's— we're going way, way back, right? Yeah, that's way, way back. Yeah.

So, so the weird weird piece of that story— this is just a weird bit of trivia about me— is I've actually seen the room I was born in. How that happened was I was the third child, and I was a little faster than my two sisters before me, and my mom didn't make it to the hospital. And back in those days, they wouldn't let me, you know, be with the other babies. I had to stay with my mom because potentially they thought I could contaminate everyone. So my dad and I were actually biking one time through Houston, Texas.

And he said, hang on. And we pull over at this house, this little house, and we go up and he knocks on the door. And he says, hi, I wanted to ask you— I started asking questions. He said, did you hear like a rumor about a baby being born in this house? Then the woman said, well, we've lived here for like 17 years now.

Yeah, we'd heard that as a rumor. And he points to me and he says, well, here's the person. And, and so they did. They let me go in and actually see the room I was born in, which was pretty, pretty cool. I mean, that's really unusual.

So yeah, I was a little fast. So the, the crux of all that, why, why we were biking through Texas is my dad, he's retired now as a Texas historian. He, he taught at CSU and one time he said, he's, he's like, I'll buy you a mountain bike if you bike from Fort Collins to Galveston, Texas with me. And I was like, sure, I'll do that. And we did.

It was a great way to get to know my dad. Fort Collins to Galveston for 36 days. Thousands of miles. Yeah, I was just saying, that's, that's well over a couple thousand, 2,000, 3,000 miles, or— Yeah. Wow.

Yeah. Yeah. And let me guess, let me guess, you did it all in 3 days, right? 36 days. 36 days.

36 days. Yeah. Wow. Yeah. Yeah.

Went over Raton Pass. On a mountain bike. So when you talk about that exercise and biking as a hobby, you really took that to the extreme. Yes, absolutely. Okay.

Now, one of the things you just said, you talked a little bit about contaminating. You were afraid they were going to contaminate other babies or something like that. Yeah, because I'd been born outside the hospital, and so I was, I was born outside the sterile environment. So, okay, they just assumed that I was contaminated. And then I couldn't be in with the other babies.

Wow. Anyway, yeah. Okay, so you're, you're kind of like one of those stories I see on the— maybe some of the police crime dramas or something like that, where you're born often, then the policeman has to deliver the baby, or somebody has to— that's not experienced has to deliver that baby. And it was my dad. So was it?

Oh wow, that was my dad. Did he have any training at all? Did he know? Or no, no, no. Uh, all of a sudden there's a baby coming, right?

Exactly. Wow. Oh boy. Wow. Okay.

Well, you know, one of the things I usually normally talk about is what is one of the biggest security problems? What we usually end the podcast with is what is the biggest security challenge today? How you might address it, not usually to solve it. And I know you talked about burnout, but there could— there be other things that, like, if there's— is there another challenge or something that we should overcome? So we should really be aware of.

What kind of advice would you give the Colorado Equal Security audience? Some advice to give, really what to watch out from a security perspective. Yeah, and I know we talked about burnout. That, that would have been my first choice. It's the area that I worry about the most just because I've seen other CISOs, and I'll get in the other answer in just a minute, other CISOs just burn out and they just go out of the industry.

And the fact is we've got millions of open positions, and when we're losing people because burnout. That's, that is a very big deal, especially to me. Yeah. One of the things that I do is I will always try to get an idea of like a successor or deputy CISO and then begin bringing them up for that reason, because then you have somebody that can back you up when you, you're out of the office. The other area is, and this has to do with threat intelligence and security awareness.

This goes back to one of the things that I'm doing at Holland Hart and that I've done and other places, there's a lot of people out there that have no idea what they do, what we do. And so, you know, they, they see movies, they get this really weird notion of how hackers operate and stuff like that. And they have no notion that we're really up against a bunch of criminals constantly. And that, 'cause I'll get questions like, is it secure? Or why haven't you solved this yet?

It's like, well, I, I gotta tell you, here's the thing. These people actually get paid. That's like their day job to break into, into our company. That's how they make their money. And so that comes to the education piece.

And the way that I've, I've worked with that has to do with something we talked about earlier, which was threat intelligence, getting people to actually report attacks in, then explaining how those attacks operate and what, what people are going after and why. And if you can do that for your own company, that is extremely valuable in a lot of— for a lot of reasons. One, you can put in controls in place because now you know what kind of attacks are hitting you. But 2, if you do that awareness, there's kind of like light bulbs that kind of go off because what'll happen is there'll be one person out there that reports the phishing attack into you. But by sharing that out with, you know, other people at the company, they begin to realize, oh, I didn't realize I saw that same thing.

Or I didn't realize that this particular department was getting attacked like that. I, I had no idea, you know, because it's, it's, it's almost like an analogy with a duck, you know, underneath it's paddling its little feet as fast as it can just to move or something like that. On the surface, it looks like it's very calm. And so one person reports a phishing attack when, you know, really, you know, 200 people might have got that same one. And maybe they don't report, maybe they do.

But channeling that threat intelligence with the awareness, that's a big piece for being able to defend. And that's one of— yeah. And explaining it too. It's one of the pieces you brought up earlier. I think the biggest challenge though, especially is when you have a company that is widespread.

I mean, you, you said that in a lot of the companies you worked with, you have business offices all across the United States. You may not interact. As well or be known as well in between, how do you get people to trust you? How do you get people to report to you and maybe even report to you more accurate information? Yeah, yeah, exactly.

And I can tell you also a little bit how I've gone about solving that. You can't do this with all of them. 2 ways, which is, you know, take the time to actually meet with people, especially if there's an incident. Majority of people that you know, with an incident, I mean, they're very apologetic on whatever happened if they clicked on something or something similar. And so you don't go in and immediately punish them.

Just don't do that. Don't, you know, just work on containment, cleanup, the like. And if you can do that more face-to-face, the better. With Holland and Hart, I've actually traveled to all but 2 of the offices. So I've done 11 of the offices now.

And I actually did, you know, kind of a rotation to go do one, some surveys on those offices, including some wireless surveys to look at our wireless bleed, and then 2, to meet with the people in those offices. And, you know, Janus Henderson, very similar sort of thing that I would, I would move between the offices. That was a little easier except, you know, the ones in London. And Ball Aerospace also moved around between the offices. And what you begin to find is people, one, They're more open and they will also tell you stuff that they've seen, some stuff that you, you, you wouldn't get a report of otherwise.

Things like, it could be little things like somebody's printed off some confidential documents and they've been let out, left out. And then you send out awareness, you know, on that and you, you, you basically contain that. They may tell you about phishing attacks. They may tell you about other things that you, you just never expected. And so I, I've kind of found that the more that I can get out and be quiet about everything and just listen to what they're telling me, the more that I hear about what's going on in the environment, the better I can be at threat intelligence.

Well, I think that's their huge advantage of being that walking CISO, being able to talk to people, put a face to the name, or even just be able to talk to them for something outside. And of course, that's one of the advantages of listening to this podcast, right, is to get to know you, to get some of that, that advice. And I think we also got to remember is that we're talking to people, that we're talking to people that their jobs are just important to them as ours is to us. And yeah, we're talking to the account payable people, but if they don't do their job, right? Oh yeah.

Yeah. That's going to cause obviously a very, very large problem for the company. And their job's very important to them. They're probably just as passionate about their job as we are about cybersecurity. Yeah, absolutely.

And again, what I found 99% of the time on incidents, they were tricked. I mean, that's what social engineering is all about and they're incredibly apologetic about it. And it's not, it's not like something they wanted to do. And, you know, I say 99%, all of us I think have had to deal with insiders and that's, those are some of the hardest cases. But most of the time, they're being socially engineered and they made a mistake.

And so you just work on cleaning that up. And especially if they report it early and you can catch it early, then all the better. I remember one case where we had somebody that was working on essentially service desk. And what they did is they took in email from clients and it was coming in through a web portal. And what we didn't know at the time, and we found out this is an architectural mistake, this is not at Holland Hart, this is another company I worked at.

We found out was that that portal bypassed any email filtering we had. And so somebody sent in a ransomware attack that basically said, can you look at this document is what they said. And so the, the client analyst there clicked on it and it didn't open. Nothing happened. And, you know, they about, you know, an hour and a half went by and then suddenly they said, wait a second, That was really weird.

I'm gonna call the security team. And sure enough, somebody had snuck some ransomware through. It was going through encrypting their desktop, encrypting some of the drives, hadn't gotten very far. And, you know, we were able to stop it relatively quickly with little damage and then was able to restore from backup. And it was really just because they said, wait a second, that just, that didn't feel right.

Yeah. So, well, that's good. I mean, walking CISO, getting to know people, then you can get them to report things that don't feel right. Right. But they're comfortable in doing that too.

That's the other piece. Yeah. That they know that I'm not going to say, what did you click on? Why did you click on that? You know, it's really, okay, tell me what happened.

Let's work through all this. Okay. So now we're going to investigate. Yeah. And that's really the key.

Yeah. Don't berate people, right? At all. There's no point. Yeah, yeah, treat them as humans.

Exactly. Yeah, I did come up with kind of a little bit of a— and this might get turned into a little bit of a longer subject, but you've mentioned social engineering a couple of times. Being as isolated as we are, especially not even from because of COVID but just in general, and being a wide range, we want to put a lot of stuff on our social media, being able to get people to know us, get to know other people. But then that of course opens us up to more social engineering because when I work with my clients in my professional job, I spend a lot of time going through social media trying to learn more about them and to— so to better prepare for my role. What are your thoughts of social media versus social engineering?

And let's try to keep this down to about less than 5 hours or something like that. Okay. And it's really interesting too when you look at the industries, right, across the board. If you're a defense industry I knew a huge number of people that weren't on social media at all. And there's a lot of reasons behind that.

But part of that was because, yeah, I mean, there was a lot of stuff that people could use for social engineering. You know, one of the things is that, you know, me personally, I'm cautious about what I put on there. I'll put on, you know, kind of professional resume stuff. There's, there's some other pieces, but I am pretty cautious about that. One attack that I saw very recently, real interesting stuff.

It was the same time that Krebs had reported that there were all these fake profiles on LinkedIn. Well, somebody put a faked Holland Hart profile on there and apparently what they'd done is they'd taken over the account of actually somebody in the security industry, which is really bizarre. And then they had morphed it and were pretending that they were Holland Hart attorney. They said they were personal injury law, which Holland Hart does not do. And so I actually went through and used LinkedIn to track down all the people that I knew that had basically linked in with this person and said, delink with them.

You know, I reported it, went through a number of other things. The profile finally came down. It was exactly the same time that Krebs was doing that. And it began making me realize how vulnerable we really are to that kind of attack. I mean, literally all somebody had to do was put profile that said, I'm this attorney from Allen Hart.

We said, oh, okay, I know the company and the name looks kind of familiar. So yeah, I'll link in with them. Yeah. And we are very, very vulnerable in that regard. And what they did probably with that data was they were able to mine all the connections past that.

It took a while really to get them off. It took about 2 or 3 weeks all in all. And actually I have a post still on LinkedIn about that. Wow. I posted at the time.

Yeah. Awesome. Yeah. I, and I think it's, it's such a, I mean, we could literally probably spend hours talking about this. Yeah.

I mean, because yeah, if you don't have a social media profile, how do people know about you? How do they connect to you? How do they learn? How do they share information? If you're trying to get hired for a job, I mean, one of the things that I always tell people, if you want to get a job in this industry, you must have a LinkedIn profile.

I mean, that's, You're gonna have to have something out there. They— companies want that. A lot of hiring companies want you to have some kind of profile and not only to read items, but post items as well. Share your information, share what you can, especially the more experienced you are. Yeah.

The, the one industry that I've been in that was less like that was defense. The defense industry, a little more isolated than that. And there's, there's reasons that they won't post on social media. You know, one is that they're worried about their privacy because then that's immediately open. And then 2, when you look at that community, they, they tend to be a lot more closed about, you know, what they can talk about.

So if you, you know, if you have a security clearance, you know, you, you're not going to be talking about any of those pieces in there, at least you're not supposed to be. So, you know, that tends to be a lot more closed off. And that's the one industry that I've seen that typically people do not have a social media presence or have a limited one. Yeah, and it gets into some very, I guess, cautious waters. I don't know how to really describe this because your company really can't tell you what you can and can't put.

I mean, obviously in the defense industry they can tell you what you can't talk about, client information, etc., but they can't tell you to not have a social media profile, right? And that gets into some dicey terms at times because could they tell you not to that? So yes, as depending on if it hits the company brand, that's, that's kind of my opinion. But you look at where I'm at right now, Holland Hart, the vast majority of attorneys have a LinkedIn account. And the reason why is because they want to be accessible.

That's part of the business and it makes a lot of sense. So I mean, it's true, your company could go through, see if people are posting derogatory things you know, say you can't post this, they could take legal action depending. But yeah, and I'm gonna have to agree with you too that most people should have a social media presence. I mean, the, the one area that I've seen, again, defense industry, I, I understand why. I, I have to admit that before I was in that industry, that it was, it was a black box to me.

So learned a lot from getting into it. Oh, well, uh, we are coming to the end of our time. Joseph, we've had some, I think, a great conversation. We've talked about education. We've talked about your experience being a walking CISO, learning to treat people, meeting people, some of the challenges we've had in education.

What else can we tell the Colorado— what can we leave as a final thought to the Colorado Equal Security community? So I think everybody's already doing this, but get out to your local chapters. So we've talked about, you know, how can you break into the security industry? So if you're not already doing this, OWASP has a big presence around here. ISSA has a big presence around here.

ISACA has a big presence around here. There are so many good organizations out here that you can get out to. And the one that I haven't mentioned is Colorado Security, which I'm going to mention right now. Listen to the podcast. If you, if you want to break into security, start getting out and meeting these people.

And, you know, that's, that's one of the ways that I actually really began breaking into the community too. You know, I'll never forget that the proctor for my CISSP, after I got my CISSP, he actually sent me a note and said, hey, I heard you got your CISSP. Are you looking for a job? So, I mean, those connections help tremendously. So get out and start using them.

And you've got a lot of great resources. Resources here. Well, absolutely, absolutely. Uh, for those of you that may not know, of course, my name is Frank. I am a board member of the Denver OWASP chapter, and we're actually very proud to announce— very, very, very proud to announce— that we now have the snowfrog.com website up.

Or we have our— we have our conference coming up on March 2nd. Tickets are now on sale. We have Kevin Johnson as our keynote. We've got 3 great workshops that are going on, a CTF, and several awesome talks that are happening. And they're not all about application security.

So definitely please again, check out snowfrog.com and see what we have. Please hope to see everyone at the conference. Hope to see you at the conference there, Joe. Right. And definitely, you're listening to this podcast.

There's some resources out there. Again, I, like you said, ISACA has some great resources. The folks, Robb and Alex, I know they're huge and a part of the RMISC, the Rocket Mountain Information Security Conference. I did hear that their call for papers are now open. So they are.

Yeah. So if you show your stuff, if you are an experienced person, or even if you don't have a lot of experience, go for it. I mean, you can't hurt anything. Write up some stuff, turn in a paper, and maybe meet a mentor, maybe team up with some folks. Put yourself out there a little bit, become part of the community.

And again, this is a great community to be part of, especially here again in Colorado. So thank you again for your time, Joseph. I enjoyed my conversation with you and look forward to speaking with you later. Yeah, thanks, Frank. Yeah, thank you.

All right, thank you everyone. All right, bye now. All right, learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado Equals Security.