Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 247 for the week of May 8th, 2023. Yeah, Robb, this is awesome.

Hopefully, as people are listening, we don't sound like robots. We had a little technical difficulty there, but I think we've worked through it. We were like on the border, like, do we just cancel the podcast forever or do we figure this out, this technical issue? You know, 10 minutes later we solved it. Right.

You know, we just were back to recording. You know, troubleshooting 101. Robb rebooted his laptop and now we're good to go. There we go. That was literally the solution to the problem.

All right. Well, let's jump into some housekeeping. Alex, we have a Slack channel. If you don't know that yet and you're listening, you're missing out. The Slack channel is a great place to meet local folks.

We have 2,500 or so people who are in the community. You can Talk, talk to our groups that are going to schedule lunches in Boulder and the DTC, find out about events coming up, look at jobs, talk about GRC, all kinds of great stuff. Yeah, if you want to join the Slack channel, you can go to the website colorado-security.com. There's a form there you can fill out. We will add you to our Slack workspace.

While you're there, you can also sign up for our mailing list. You will get the show notes delivered to your inbox from every podcast that we make. I love it. We would also love it if you would rate us and subscribe on your favorite podcatcher and maybe tell a friend. We'd love to grow the community.

You can get them involved with Slack, get them involved with listening to the podcast, maybe come to some local meetups. We would love that support. If you want to support us even more than that, we do have a Patreon campaign going on to help cover the costs of the things that we do at Colorado Equals Security. You can sign up for that, and depending on the level that you sign up for, you'll get some cool stuff. And speaking of Patreon, we have a new patron.

Oh yeah, who's our new patron, Alex? Yeah, uh, uh, Michael Nugier, uh, who is our, uh, newest patron. Yeah. Um, and he, uh, oh, he's at Richie May. He's at Richie May now.

Yeah, Michael, thank you so much for sponsoring. He sponsored at the $10 level, so he gets a shout out and some cool Colorado Equal Security swag. Yeah. Um, I have, I have known him for a while. He was one of the, uh, the implementation engineers for me when I, when rolled out silence a few years ago.

I don't think I knew that. Yeah, well, it's because silence doesn't really exist anymore. Right. Well, BlackBerry security. Exactly.

Good stuff. Well, that is that. Let's get into the news now here. Alex, there's some breaking news for those of us who have been in Colorado a while. Maybe if you've driven the 470, the C470 route up to the mountains, you might see that there's a racetrack on the side of the road kind of just north of Red Rocks, right?

Bandimere. What's going on with Bandimere? Yeah, uh, the, the Bandimeres who own Bandimere Speedway have, uh, sold the land that the racetrack is on and they're gonna be closing at the end of this season. Um, it's sort of been rumored for a number of years that this was gonna happen as, uh, you know, as the development around Bandimere continues to creep closer to it. I think that there was the, uh, the realization that at some point they weren't gonna be able to operate as a racetrack there anymore.

You know, it's a drag strip, so it's really loud. When they're going on and there's more and more houses popping up around it. So I think that they realized someday they were going to have to move and they've decided to do that. So they've sold their land and closing the racetrack and they're going to be looking for a new place to go. If you are interested in, in getting out there before they close, the last event will be the 2023 Dodge Power Brokers NHRA Mile High Nationals.

That's going to be July 14th through 16th. If you want to see some drag racing in the Denver metro area, this could be your last chance for a while. It is a lot of fun. I know there's probably one happening here pretty soon. We always used to go with the kids because they did the Race to Read event at schools, you know, and you would win free tickets there.

And they have like the, the jet dragsters with a jet engine in them and stuff like that. Anyway, it's fun to watch. Good stuff. Looking forward to seeing what they put there. Probably condos.

That's probably— yeah, probably condos. Yeah. All right. Next, Colorado passed a pretty cool new law becoming the first state to have a right to repair law for farmers. This is a fairly simple idea.

You know, hey, I buy a piece of equipment from someone, whether it's a tractor or an iPhone or a printer, I want to have the ability to fix it when it breaks instead of having to pay for the manufacturer to come be the only approved fixer of this thing. And this has been a big contention between the tractor equipment or the farm equipment and the farmers themselves. And Colorado is supporting the farmers here. Yeah. As this equipment gets more and more advanced, The, the idea from these equipment manufacturers was, you know, it's too complicated for you to fix, fix it yourself.

We don't want you to break it essentially. So we're gonna have to fix it for you. If you try and fix it yourself, then you're voiding the warranty. And essentially, you know, you're not gonna be able to use this tractor anymore. So with this law, it now allows farmers to be able to do simple things to be able to fix their equipment and make it better.

It'll be interesting to see where this goes. You know, there's all kinds of other examples of companies that don't want you monkeying with their stuff that you bought. I'll be fine. It'll be fun to see if the consumers get some more rights here for sure. All right.

Next, I think we've talked about this startup in the past, but some more news from the Colorado startup that's doing refueling for satellites in space. Yeah. So it's called Orbit Fab. They, they just secured a $30 million round to expand their operations. This is their B round of funding.

Um, this is gonna be used by Orbit Fab to, uh, to build a network. Well, they're gonna be building a network of refueling depots in low Earth orbit. Basically the idea, if, if you're launching a satellite, um, and you know, there, it's, it's really hard to get, you know, all the weight you need into space, right? Like every, every ounce makes a big difference. So what they're thinking is you can bring less fuel on your, on your satellite and refuel with them, and as a result, be able to, to accomplish missions that would otherwise be impossible.

Yeah, I think also, no matter how much fuel you put on your satellite, at some point, it's going to run out, right? And that doesn't mean that the useful life of that satellite is done. So if you can refuel it, then you— that satellite can continue to operate for longer. So it seems like a great idea to me. Because you don't want this to be— you don't want there to be non-reusable space junk up there, right?

Like, let's launch less satellites, but, you know, keep them up there for longer and make them work for longer. Yeah, I feel like this, this story just typifies what Colorado is really becoming, a space-centric industry, or it's one of the big industries here. We have 3 stories this week that are kind of space-ish. Number 2 is this story that Maxar, who, you know, used to be called Digital Globe, or was Digital Globe was merged into, I think they were recently purchased by a private equity firm for $6.4 billion. Yeah, that seems like a big number.

Maxar went public a few years back. This seems to be the trend in the way that companies operate. They go public, maybe they do well, maybe they don't do well. If they don't do quite as well stock-wise, you know, some PE firm purchases them, rehabilitates them, and then at some point in the future they'll go public again. But I think the good thing is that, you know, we still have a a company that's here in Colorado doing the satellite mapping that Maxar does.

Yeah, they're still going to be US-controlled and Colorado-headquartered. Not a lot of big changes. This trend you're talking about, I think the PEs, they recognize when a company's inherent worth is higher than the stock market thinks it is. They figure they can buy it now for, you know, $0.80 on the dollar, go sell it for $0.120 on the dollar in, you know, 2 or 3 years. And that's how they make their 50% back on their money.

Yep. All right. Next, moving away from space for just a moment, Colorado is launching a program to give away some grants to help jumpstart the quantum tech industry in Colorado. Yeah. So the number here for the grants is relatively low.

They're talking about $1.5 million that's going to— that the Economic Development Commission has approved to be used to drive quantum here. But I think directionally it's important. You know, we've talked a lot about cryptocurrency, you know, having a good presence here in town, quantum computing, having a lot of research done here. There's just a lot of desire for Colorado to be better at these emerging techs. And obviously, this is, this is part of moving in that direction.

Yeah. And the grant, you said the whole, whole amount is not big and the grants themselves are not that big. They're going to be $50,000 grants. But it also includes some money for, for someone to oversee the grant program, as well as some money for a quantum computing, quantum technology conference that's going to happen here in conjunction with CU. Yeah, between the education, the, you know, the venture capital support, and kind of the buzz that's happening around quantum, I think Colorado really has a chance to be, you know, one of the few hubs in the state— in the states that's focused on this.

All right, getting back to space, I think our last space story, there's some veterans from the Space Force down in in the Springs, which is amazing that there can be veterans from a force that I remember us talking about being created. Right. Like, but people who have been in Space Force for a couple of years have left and have gone on to launch their own startup that's focused on helping the US military prepare for space warfare. I feel like this must have never been said in the history of humanity, what I just said. US Space Force veterans have launched a startup to help the US military prepare for space warfare.

The name of the startup is True Anomaly. So this is not an anomalous anomaly. Anomaly. True. It's true.

Yeah, it's not a false anomaly. Exactly. I can't say the word either. Anomaly. Anomaly.

But yes, so the, the goal that they have here is to help beef up the capabilities that we have in space. This also seems funny that, you know, part of the article talks about that They believe that the US is falling behind in our capability to fight in space. We've been focused on counterinsurgency over the last 20 years, basically since, you know, since 9/11. You know, the US has been much more focused on terrorism than they have been on something like space as a new frontier. Well, this company is here to help drive that forward.

They have a couple of stats here. They raised $30 million, and they've already hired 57 employees. And they just came out of stealth on April 6th. Yeah, a month ago. But they built a warehouse in Centennial, Colorado.

So really where we're recording from right now. And they're using that money to hire those folks to start manufacturing. They have 2 different things they're building. One is they're building what they call the Jackal, right? The Jackal Autonomous Orbital Vehicle, which is a vehicle that's designed to study space objects at close range, take pictures of those things and just kind of figure out what they are and basically start to figure out with the help of humans and AI, like what's happening in space.

Right. And also they are creating a software platform that can take spacecraft pilots with the Space Force through wargaming and training. But simulations, teaching them what would I do in this situation? I mean, obviously that much better to learn through simulations than when it happens for real. So it seems like cool stuff.

2 really separate 2 separate products, right? You're actually manufacturing a hard thing. And then my hunch would be that they think of the software side as being a way to quickly start getting some revenue and some relationships while they build this much slower hardware that's gonna, I imagine, will take a decade to, well, a few years at least to be out in space. Right, for sure. All right, moving on to our next story.

There is a press release from Red Canary. Announcing the Red Canary Readiness, uh, exercise product. So this is basically, uh, a way for, for teams to train and be better prepared for real incidents. Didn't occur to me as we were putting the notes together, but this is actually really closely related to what we just talked about. It's, it's about helping, um, security analysts simulate different types of attacks and determine if they're ready for it.

So, you know, you think of your typical tabletop exercise where you're gonna say, all right, pretend an attacker just did this thing. Well, this readiness gives really much more specific scenarios based on attacks that are seen in the wild. It helps folks figure out, like, do they have the technical controls to detect it? What would they do? And it'll help people, like, know what their coverage is across their environment.

So if it was really analogous, Robb, then Red Canary would also be making a, um, an autonomous vehicle for cyberspace. I can't comment on that. We, we do have another press release about a different Red Canary release here coming up. The next story though. On this story still, I think that this is a super important thing.

Readiness and preparation obviously is a key. And if you're not good at anything else, you need to be good at incident response. So I think this is a really important announcement and product. It's been a neat thing to see develop. You know, as a company, Red Canary has always been focused on detecting threats and responding to them.

This really moves kind of left of boom, as we call it, earlier in the kill chain. Instead of saying we have to wait for someone to attack to detect it, this is us creating that simulation so you can see if you're ready for those attacks. So it's a cool change. But speaking about detecting things, Robb, the second announcement we have is Red Canary announced a new product called MacMonitor. So it's actually not a product.

Sorry, a new software. New piece of software. It's a free thing. Yeah. And that's cool.

One of the things that really drew me to Red Canary, and I know we both appreciated what they do for years, is they just give stuff away. So this is a piece of software that you can install on your Mac. It's called MacMonitor. And think of it like Sysinternals is to Windows, MacMonitor is to Mac. Yeah.

You get that visibility inside your system, a much level, deeper level of visibility than you can get from something like Activity Monitor. And like I said, it's free. It does not take the place of EDR because it's not monitored. It's just not— it doesn't have telemetry like that, but it's a good foundation that you could build something like that on. Yeah, for sure.

I think it's another good thing. There really wasn't anything in the market like this. You know, the Sysinternals products have been great on the Windows side for people for a long time, and it's cool to see that there's something happening on the Mac side too. Pretty cool. I love— that's one of my favorite parts about the company, just giving away the stuff.

All right, next story we have. We haven't talked about Coalfire in a while, so we figured we'd grab this story. It's kind of a typical, hey, your local company wins a bunch of awards, right? But a good, good chance to talk about Coalfire, you know, who is one of the biggest security companies in Colorado and has been for, man, 20 years, right? Like, they, they've been doing a good job and have really become the default choice for things like FedRAMP.

So they won some awards. Yeah, and the awards that they won are things that I know that they do, but are probably not the first thing in my mind when I think of ColdFire. Uh, one is the Editor's Choice for penetration testing. The second is Hot Company for vulnerability management. And the third is Most Innovative for vulnerability assessment, remediation, and management.

Yeah. Uh, cool stuff that they're being recognized for that, what the work they're doing. And it's not just, hey, we're doing ISO and SOC audits and getting you ready for FedRAMP. Right. Some other useful security, uh, practices that they have there.

Awesome. Uh, next we have a blog from Zavilo, uh, talking about phishing detection in depth. Um, this is actually a fairly long and in-depth article. Yeah, I was surprised. I thought I was gonna open up like 5 paragraphs about phishing, but no, no, no, no, no, no.

They, they go pretty deep here. Um, there's at least, I don't know, a dozen categories of phishing that they say here. Um, Some of them that I hadn't really heard the name of before, but like makes sense. You know how it is that you you detect it. Yeah, I mean, we've all heard of business email compromise, right?

But and we've all heard of smishing. But have you heard of pop-up fishing or farming or search engine fishing, social media fishing, tab napping, tab nabbing? Yeah, really. I mean, I there was a lot of interesting stuff in here if you're looking for a. A pretty in-depth description of phishing, this is it.

Yeah, I mean, they go all the way into use cases for threat detection around phishing and things like that. It's a really good in-depth blog. I would recommend a read on this. Yeah, good stuff to take a look at as you're building your own controls around phishing, which is probably the number one way bad guys get in, right? Probably.

Last story we have in the news is a partnership. LogRhythm has announced that they are partnering with Zscaler, and they say that they're partnering to address cloud access security security challenges faced by the modern SOC. Yeah, um, I think some of this is a, uh, a telemetry integration, you know, to get better signals in a LogRhythm. And then some of it is also, um, to be able to take actions in, uh, Zscaler's— what is it— uh, Private Internet Access, PIA, Private Internet Access, uh, component. So, uh, from LogRhythm, if you see an issue, you can um, take an action in, in PIA to limit someone's access.

Yeah. All I wonder is, is was this partnership created because Sarah Avery, our longtime friend who was the, you know, a sales rep for LogRhythm for a decade and has been at Zscaler for the last few years, did she say you two teams need to work together and make it happen? I'm— I will give all credit to Sarah, whether it's due or not. Due or not, Sarah, we appreciate you. All right, let's jump over to events.

Uh, start off with a reminder that we have a calendar of events on the website at colorado-security.com. You can see all the cool stuff coming up in security over the next few months. But over the next month, Alex, what do we have? First, uh, ACIS Denver. Oh, you know what, this, this one, sorry, you can't go to this one.

This was a couple days ago. Um, we were a little bit late. Uh, the first one that you can go to, ISSA Denver, is doing their May chapter meeting, How Cyber Insurance Drives C-Suite Decisions Around IT Strategy, Infrastructure, and Planning, on the 10th of May. Yeah, that's gonna— there's actually 2 of those meetings. That's one that's downtown in the Tech Center and one Sorry, one in the tech center and one downtown.

Tech center's in the afternoon and downtown's in the evening. Also on the 10th, OWASP Denver is doing their Back to Basics: How to Mature Your Security Program. On the 12th, we have the Let's Talk Software Security group doing a talk about software security. What are we missing? You know, I actually, I attended the last Let's Talk Software Security meetup.

It was good. I enjoyed it. I would recommend it. On the 16th, ISSA Colorado Springs is doing their May chapter meeting. On the 18th, we have a couple different meetings.

We have the ISACA Denver May virtual meeting, and we have CSA Colorado doing their May meeting, which is focused on the future of cloud security, embracing CNAPP to protect cloud-native applications. Ooh, exciting. On the 20th, ISSA Colorado Springs is doing one of their mini seminars. It's a great way to get a few hours of CPEs on a Saturday morning if you're looking for it. On the 24th, ISC Pikes Peak has their May meeting.

On the 25th, ISC Denver is doing an event, Cybersecurity Is Not a Game?

Is it? Now I'm intrigued. The event is at Dave Buster's. So I think it's probably related to that. And then finally, we have the RMISC conference coming in on June 7th through 9th, 3 full days of events.

Alex, anything you want to say about the conference coming this year? Yeah, I mean, normally this is the time you would throw it to me, and because I'm organizing, I would tell you something cool. But this year I'm not really helping, so I don't know that I have anything cool to say. You can still say something cool. Um, I know, uh, the opening keynote on the 7th, um, uh, David Spark is doing a live recording of his podcast, the CISO Series podcast.

Well, that's fantastic news. So, uh, you should go see that. I know John Strand is also keynoting. I'm not sure when. Yeah, that's great.

Yeah, there's lots of good stuff. That's good. All right, jump over into jobs now. We like to put a sampling of jobs into the podcast every week to point out cool stuff that's going on in the community. And let's start off with BI Inc.

They are hiring a senior security engineer. RingCentral is looking for a security trust data analyst. There are also— I don't know what that means, but there were multiple jobs open at RingCentral. DISH is hiring a security threat response manager, and DISH also has multiple jobs open. Yes, DISH has multiple, multiple jobs open.

Jeffco Public Schools is looking for an executive director of enterprise architecture, information security, and identity. That's essentially the CISO for Jefferson County Public Schools. Yeah, be a good position. Frontier Airlines is hiring an engineer on application and cloud security. Banner Health is looking for a cybersecurity IAM architect.

Remote. HSS is hiring a biomedical device network and security field technician. Get out in the field. I saw that one. I thought, wow, that sounds really cool.

I would imagine it's for a sort of specific skill set, but cool nonetheless. Avanade is looking for a global security advisory lead, someone who can help them build out that practice that they have around cybersecurity advisory. It's a big job. I actually read the whole thing because it looked really interesting. If you're looking, you know, you probably want to be at the director or CISO level to look at this role, or, you know, maybe a V-CISO type of a person.

Really interesting role though, and probably worth taking a look at. Block, which I've never heard of. Block is hiring a vulnerability research analyst. They also were hiring multiple jobs. Workday is, which this one is actually being hired in Colorado.

I didn't realize there was a Colorado workforce for Workday, is looking for a principal cybersecurity engineer for analytics and automation. All right. Well, Alex, that gets us through the newscast portion of the podcast. But good news, we have an interview. We do.

Robb, who is it? We have Larisa Thomas, who's going to be speaking with us. Larisa is the CISO for Nox Health. Previously, she was the CISO for the city of Lakewood. We've known her for quite a few years.

I did not know nearly as much about her before this as I do now. Super interesting background. Did you know she was born in Russia? I did not. Did you know that she was an extra for the movie Rocky And I just made that up right now.

But if you listen, maybe you'll find some other interesting facts. Ooh, I am intrigued, Robb. I will definitely listen. All right. Well, we'll look forward to talking to you guys again next month in June.

Thanks, Robb. This is Artie Wilkowsky, CISO at Dish Network. Welcome to Colorado Equal Security, the podcast for Colorado security professionals by Colorado security professionals. All right. Well, for the interview portion, portion of our podcast this week, we are fortunate enough to have Larisa Thomas with us.

Larisa, you are— you're currently the, the CISO for Nox Healthcare. Like, did I get that right? Yeah, I'm a CISO for Nox Health, which is a company that is specializing on sleep, sleep medicine. And there's like a little catchphrase that we use is, all we do is sleep. So we have a company— I like it.

Yeah, it's actually kind of cool. We, we had a little catchphrase when I first started a little bit over a year ago. That was wake up to the brighter world, which is awesome, because that's what we do. And this is, we help people sleep better so they can actually have more productive and healthy life. But I really love the all you do is sleep.

Well, I think, I think that this, it will be a mistake to leave this topic without asking for a few tips for our listeners of how can they sleep better. Actually, this is kind of funny. When everybody's, all of the employees start, our awesome CEO is giving everybody a book called Why We Sleep. And it goes into the science behind the sleep and different, how we sleep differently when we are babies, when we are teenagers, when we're like adults and when we're older adults. But the, the, a few tips for that I've heard so far from our really awesome medical professionals is, of course, caffeine has a huge impact on your sleep.

It messes with the circadian rhythm. Also alcohol, which I think all of the security professionals are kind of We all, we all kind of have to do this. And another big tip is consistency. So I know sometimes we like to sleep in on the weekends and maybe go to bed late on the weekends as well, and that messes us up. So consistency is like if you're following the sunrise or sunset or whatever your circadian rhythm is, going pretty much the same time.

So, if you're going to bed at 10 o'clock during the weekend, waking up at 6, try to do this in the weekend as well. Yeah. I think the bummer is you just gave me all of the tips of the things that I either can't or won't do, right? Like, I'm happy not to drink coffee, but I'm not that happy to not get to drink alcohol. And like, it's just so hard to be consistent with my go-to bedtime at least.

Like, I could do okay getting up at the same time every day, but You know, some nights I got, I have just things that keep me up and it, I definitely, I definitely noticed that like on those nights, especially if I had a drink, like I do not get the same quality of sleep and I suffer for it the next day. Yeah. And I think all of us are going to have those, like we're going to go out and have a drink every once in a while. We're going to have a cup of coffee with, with our supper every once in a while and it will mess us up. But I think moderation is kind of the key here.

Yeah, I, I think that makes a lot of sense. And yeah, the most— the more consistent we can be, the better, right? And I'll do my best. Yeah, that, that is very true. It's gonna be hard.

All right, all right, let's, let's go back to the beginning. Larisa, you have a little bit of an accent. Where are you from natively? So I am originally from Russia, born and raised. Um, I moved here, gosh, 28 years ago.

So I worked really hard on my accent and there is— it's still there. It's not as bad as some of like my family members, but it's still, it's still there. I remember when I first moved to the US, I'm like, I'm going to— damn it, I'm going to learn English. I'm going to like speak like a native. And I did really try.

I limited my contacts, not really contacts, but like my social interactions with my fellow countrymen. So I can like speak with somebody who is either from US or somebody, some other immigrants from other countries. So we can at least be forced to speak English. Yeah. But that accent, I can't do anything about it.

Well, I mean, I don't think you need to, right? Like, I actually, you know, I've met you many times in the past and I did not know you were from Russia.

You know, frankly, until we started talking here, I didn't, I didn't really notice it much at all. But, uh, yeah, there's a little bit of something there. Um, so, so you were there in Russia, and we talked about this before we recorded, that, um, you were there like as the Soviet Union, uh, went from, you know, one of the 2 world powers to, to dissolving as an entity altogether. And I would just love to hear, you know, your thoughts, you know, growing up through the '80s. You and I are roughly the same age, growing up through the '80s with, you know, Cold War stuff going on.

What was it like on the other side? And then kind of coming through that Let's just start off by talking about your, your, your Cold War experience. What was that like to be on the Soviet side? Was it as big a deal there as it was here? Um, yes, but it's also, uh, there was a lot of propaganda, so a lot of people just didn't even know anything about it.

And they— one thing I would say, ignorance is bliss. Um, and growing up as a kid, I was shielded from a lot of things. Um, Like I didn't really, how should I put it? Like my parents did a really awesome job of giving me a childhood where I don't have to worry about different things. I'll tell you a little Russian joke.

There's a, so the scene is in kindergarten, like little kids, like 4-year-olds. And the teacher in the kindergarten says, kids, where is the, Where are the most beautiful toys? They're like, in USSR. So everybody says, in USSR. Um, and the teacher asks kids, where are the happiest kids in the world?

And the kids all in unison, in USSR. And all of a sudden she turns and there's a little boy in the corner and he's crying. And she asks, why are you crying? And he says, I wish I would live in USSR.

So it's yeah, there was a lot of ignorance. There was a lot of propaganda.

We like growing up, I didn't know what was happening until like I got a little bit older and started to listen to BBC and some other things. And my relatives started. Started moving to, um, other countries. So my aunt and uncle, they moved to, you know, United States, gosh, probably, I don't know, 40 years ago, maybe more. And, uh, it was actually kind of comical with, uh, um, how much surveillance was there.

So I had my— my dad was followed by the KGB when he was meeting with his cousin because they thought that they be like some big secrets between Russia and, and United States. Um, all of the correspondence, all of the letters that we received from U.S., they were, uh, opened and everything was, uh, read. Um, so, and in the beginning it was kind of funny, um, they were very sneaky about it. So you'll get a letter and it would be open, but then they would close it very carefully. So you could tell that somebody opened it, but it still looked pretty intact.

And as the time passed by, they would just like rip it open, sometimes don't even put a, like a tape on it. And they'll be in our mailbox, opened, open letter. So it was, it was kind of funny. So what drove— you know, obviously I have a very US-centric view of Cold War and Cold War Soviet Union. So I try, try not to bring my own biases to it.

I'd love to hear from your perspective, like, why did your family choose to leave? You know, what were the economic opportunities, like social opportunity? What was that? What was the driver for that? Yeah, so it's a better life.

And also there was a lot of prosecution. So I'm, I'm Jewish. Um, so, uh, growing up in Russia being a Jew is not a happy place to be. Really? Okay.

So there are a lot of opportunities that are denied to, uh, um, who are anybody who's, who's Jewish. I think maybe now it's a little bit different, but when I was growing up, that was not a, a happy, happy place. And that's it also depends on the community. There's a lot of, um, kind of persecution, not from the necessarily from the government perspective, but also from people. Uh, so some— like, I was very, uh, fortunate that I had really good friends who, like, they didn't really care I'm Russian, I'm like Jewish, or whatever my religion is, but, uh I know quite a few, uh, people who, like, their neighbors or their co-workers or their, uh, like classmates, they would be like, they would be brutal.

And yeah, um, so there was a lot of that going on. And this was really my, my parents' decision. They just wanted a better life for, for their kids. And, uh, um, we've been kind of joking about it that we we would go to United States and my dad had a chance to come to US and for as a tourist and visit his, his cousin. He came home and he's like, pack your bags.

We're gonna, we're gonna go. So it was, he saw what kind of life we could have had. Because, for example, I went to school for computer science, and my kind of prospect— I didn't go to like Moscow or some other prestigious university. I just went to my hometown. And my prospects as a job with no connections and being Jewish was like maybe a secretary somewhere.

So it was not a— you had to be either connected or you had to like, you had to know somebody. Otherwise you can't get ahead on your own merits. And when my dad came to US and he saw how, like they say, US is the land of opportunity and it's for a lot of people who grew up in US and they haven't really seen much of the other world, it's just a phrase. But for me, this is like, this is the truth. Because I moved over here and I'm like, I could be a doctor, I could be a, I don't know, brain surgeon, I could be, um, I don't know, working for NASA, I could be a lawyer, uh, anything I, I want.

Just I have to go to school, study for it, and then figure it out along the way. Nobody's gonna stop me. So it's, it's a slightly different perspective. Did the Soviet Union allow people to leave if the country was willing to receive them? Like, just could anyone just go?

It's a, it's a process. Um, I was at the time, um, I was at the university, um, when we decided to, to leave, and we, we actually asked for for asylum. So there was a special program between Russia and U.S. where you could ask for asylum and, uh, you can get granted, um, permission and, and get a visa to come over here, uh, get a green card. So, but I had to ask my university to actually let me go.

And, uh, it— yeah, you're— you probably will be like cringing just, uh, just hearing this, but, uh, yeah, there's a— you have to ask, um, Russian officials that you have permission to go and live somewhere else. Wow. I mean, I, I, I, it doesn't surprise me too much, but, you know, I'm sure, you know, barriers there in place, right? And then there— and we're not going to spend too much more time on this stuff, but I'm super interested, and hopefully our listeners are all interested as well. Um, I know that you were there like as the Soviet Union started to dissolve into its separate member states, you know, Russia and Ukraine and Belarus and so forth.

Any, any insights to share from that experience?

Um, it was— there was a lot of talk about it, and there was a lot of pluses and minuses like we were talking about the UK doing the Brexit thing, and there's like a, a lot of benefits of smaller countries to be part of something bigger, uh, from the economical perspective. So we had a lot of discussions of like Ukraine or Belarus would be, uh, separating and becoming their own countries. Um, are they going to have the same— are people actually going to have the same economical, uh, benefits. But, uh, those countries, they were just so happy to be on their own because, um, they could speak their own language. It's— I mean, it's a, um— there's a lot of, a lot of benefits to them besides just being part of something bigger that will give you like a, a, a bigger advantage from the economy perspective.

All right, well, like I said, I don't want to spend all our time on this, although I'd love to like go take you out to drinks and like get more. But, but for now, let's do it apparently. But we will not get drinks too close to bedtime because I don't want to ruin our sleep, especially. All right, we'll just do brunch and do like mimosas and stuff. We'll get hammered over breakfast.

Perfect. All right, let's— but so you moved to the US. Where did you come over into the US? So I actually moved to Minnesota. So my family's still there.

Um, there was, uh, so back when I was telling you that my aunt and uncle moved, uh, uh, here like 40 years ago. Yeah. Back then there was a really good immigration pro— uh, program for people in Minnesota. So they kind of made it home and little by little everybody kind of like the rest of the family started coming over and there's like a big, huge community, um, out there. That's really neat.

So my, my folks are still there. That's great. And, and I'm just looking at your LinkedIn, um, and I honestly, I, you have 25 years of like legit professional security experience, uh, on here, which, you know, not a lot of, not a lot of folks in the industry go back to the, to the '90s. Um, how did you get your first security job? So I got lucky.

I got really lucky. I'm not gonna lie. I'm not going to say, oh yeah, there was some formula. Sometimes it's like being at the right time in the right place. So kind of going back, my dad really wanted me to be a developer.

So he, back in the day in Russia, he was making modems. He was the hardware guy and he had brilliant developers working with him and he just thought this is like the best thing in the world and he wants his kids to be doing this. So he's like, you're gonna go to do like a computer science degree and you're gonna be a developer. So I'm like obedient daughter and I'm like, okay, I'll, I'll do that. So I went to school, um, halfway through I moved to US and I finished my, um, uh, the rest of college in, in Minnesota at the University of Minnesota.

And I took my first Linux— not Linux, it was a Unix class. And I thought, oh my gosh, I know so much, I'm gonna just kill it. There was a job at the biochemistry lab at the U being a sysadmin. I'm like, okay, I know everything, I took one class. So I went, and my first day on the job, I killed one of the servers, which was kind of a blessing in disguise because I, uh, well, first of all, I learned that I shouldn't be cocky because, you know, and, uh, but it's also been really good learning experience because as I was kind of bringing everything back to life, I've learned quite a bit.

Yeah, I love just tinkering with things and seeing how things work. So being a developer was a dream of my dad, but not my dream. So I kind of went that route. And I took some jobs doing like system administration, network administration. I was working at 3M as a web admin or something like this.

And Um, I was doing like a single sign-on and back in the day, and I got audited. As part of that audit, um, they actually recruited me to come over to the dark side, to the audit side, and head start their pen testing vulnerability assessment program. Because that back in the day, that was— well, it was not that sexy it is today, not like a ethical hacker. But it was, it was new and exciting. And I got to play with hacker tools, and they paid me money for it, which was pretty cool for like somebody who is a few years out of college.

Yeah. And that was like where I learned a lot about more like governance compliance. And I went away from like a siloed just doing the sysadmin type of job to learning more about IT, learning more about the business, kind of getting this broader perspective. And so from doing the audits I even did, like back in when I was working for 3M, I— it was fascinating going to some of the plants and doing the audits there, going to cleanroom and putting on like, like a bunny suit. Um, it was, it was, it was great.

And, uh, kind of after this, um, I came full circle to security with all of the knowledge that, um, I've gotten from being, being in the audit world. And I see just looking at your, at your timeline, you know, I know you had quite a few audit opportunities, including a couple of companies that folks will have, uh, will know— WAMU, Western Mutual, Or Washington Mutual. It doesn't exist anymore, right? Well, we went out during the financial crisis, right? 2009.

Uh, so I worked for Lehman Brothers Bank after Lehman Brothers went bankrupt, and, and I think WAMU got swallowed up in that same snap. I think that's exactly right. Yeah. Uh, and then, and then you were at Target. Um, this— I think looking at the timing, you were there before their— before 2013, wasn't it?

Yep, that was a— that was before the Target breach. Yeah, I think— I mean, honestly, like, for those of us who've been in the industry for a decade or two, like, that was a milestone, like, with the first breach that— yep, boards of directors got really interested after the Target breach. Yeah, I remember I was working for Lifetime Fitness when the Target breach happened, and I had really great discussions with the CEO and The board was asking really good questions, and that was like when I started loving the phrase, never let a good breach go to waste, because, uh, I was struggling back then to get my security program, uh, in place. They brought me in for PCI compliance. They needed to get compliant, and they brought me in as a consultant to kind of look at it.

And I'm like, uh, you guys don't have security program. Yeah, so they said, why don't you come in and, uh, get it going for us? So I took a challenge, and, uh, of course that was just the beginning, and the company was still growing, and the, the budget and the, um, the opportunities were not there yet. And then Target breach happened, and all of a sudden I had really good conversation with the CEO. We talked about risk, and we wanted to keep Lifetime Fitness out of the front line, the front pages of the newspaper.

And all of a sudden I was able to get moving on a lot of things that I needed for a security program. Yeah, it did a lot. It looks like you were there at Lifetime for 6 and a half years, huh? Yeah, close to that. Yeah.

So Lifetime, you know, I know of Lifetime as the gym. We have one less than a mile from my house, I think, that's like, it's like a complex, right? It's like, you know, I don't know, like tennis courts and like 3 buildings including like just massive building, like a country club, I guess maybe. When you joined, I imagine it was much smaller. Did you get to see it have explosive growth during that time?

Yeah. Um, so it was not as explosive. Um, so I think when I joined, they were already— I think they had maybe like, uh, I don't know, maybe 50 or 60 clubs already. Okay. And in United States, um, they were, uh, changing that.

Uh, so they were building clubs in, in Canada, so that was new. Um, but they were kind of really making it not just, um, a fitness club, but it's more of a, like, a destination. So they had like chiropractors and the spa and like a haircut place, and you can drop your kids off and go work out, uh, and they can stay in, uh, in the daycare. So it was— I mean, I'm fascinated by, uh, Lifetime Fitness. It's, it's such such a great company and such a consistency, which is really hard to get.

All of their clubs are actually not— they're not franchises. They're all owned by corporate. Oh, really? Yeah. And back in the day, the CEO was really active in making sure that those clubs are really acting the same way, looking the same way, and feeling the same way.

Yeah. For anybody. So, if you are a member and you are in a club, I don't know, in Colorado Springs, I don't know if we have a, there's a club in Denver. And then you go into Atlanta and you go to the club, it should be the same experience. Yeah.

Well, I know when I was looking for a new gym, like it was almost a decade ago, it was quite a while ago. I went to the gym the closest to my house that's like like, you know, special $10 a month deal. And then I went to Lifetime and like, oh my gosh, it's like $200 a month. And, you know, like, and like the set of things, like I'm not even comparing to like, yes, they both have stacks of weights and treadmills, but in no other way are these similar experiences. Yeah.

If you're curious, Robb's cheapskateness won out over Robb's interest in all of the bells and whistles. Yeah, their membership prices are like extremely high, but the experience that you, you get there is pretty incredible. I had a withdrawal. So when I left and I didn't have my free membership anymore and I started looking around which clubs to join and I went and checked out some other more kind of like cost-conscious places. And I'm like, I can't do this.

They don't have towels. They don't have like marble floors. They don't. Yeah. So it's a different experience.

Yeah, that's great. Well, let's keep moving and we're going to run out of time if we don't get— see, I told you, but like so much to talk about. So you and I met at your next stop, right? So you took the position as the CISO for the City of Lakewood. Um, back in 2017.

I'd love to know, like, what made you make the decision to do that? Oh, did you see that? Was it because you were moving, or was it because you just wanted that opportunity? Talk to me about why you, why you went over there. Um, a little bit of both.

So I, uh, I moved over here, um, to Colorado from, from, from Minnesota because, um, life is too short. So, uh, my husband and I had been talking about moving to Colorado for a while, and that never came to fruition until like, uh, one time, um, it was, gosh, 6, uh, yeah, 6 and a half years ago. I, uh, I had a health scare, and that was like, everything's fine now, and, and it was fine back then. But it kind of makes you think and puts things in perspective for you that life is too short. And if you're going to be delaying things and saying, oh, I'm going to do it some other day, some other time, that day may or may not come.

So we just decided, you know what, life is too short. We wanted to move. Let's move. So I told my company that I'm going to move, I'm going to look for a job. And I was actually able to move and still work for Lifetime.

While I found a different opportunity. And, uh, um, I was not even thinking, um, public sector, but then when I came across the, um, the job for CISO at the City of Lakewood, I was, uh, really intrigued because, uh, it was another opportunity for me to come in and actually build the information security program from ground up. There was nothing there. So I like the challenge and I love working for different industries. If you look at my LinkedIn profile, you've probably seen that I've been pretty much everywhere.

I worked for manufacturing, I worked for insurance, retail, health and wellness, public sector.

So I love different experiences. So And knowing that you're gonna go there, you do something really good for the community, is a huge motivator. So I was very lucky to get that job and have that experience for me. Yeah. So you were there for over 4 years.

I think that's pretty good. And you got to, like you said, you got to build the program from scratch. And I know you got to get to know a lot of the other folks in the area through that role as well. What was, what was the impetus for making a change after, after you've been there for quite a while? Well, I had a goal that I'm not gonna stay there forever.

So I gave myself like 4 years. That was my, that was my limit that I'm gonna check it out, I'm gonna try it out. And then I'm gonna probably go back to the private sector. So that was, that was the impetus for me to go back. And I love the health and wellness industry.

So when I found the Nox Health job, I'm like, oh my gosh, this is so, so cool. And is Nox Health, is that all remote? Or do you, do you go into the office? Yeah, I'm remote. We have an office in Louisville.

So I can go in the office every once in a while. But I'm mostly remote. Our headquarters is in Atlanta, so I do go there every once in a while. And another exciting part is our other headquarters is in Iceland, in Reykjavik, which is really amazing and beautiful. I was there just at the end of March, and it is such a beautiful country.

So why are we not recording this podcast in Reykjavik? Whatever you Good question. A very good question. I just don't know why you didn't suggest this to me because I would have said yes. Maybe next time.

Next time. All right, we'll get— we'll come back for part 2. Uh, so what's it— what's the challenge been like there? I know you and I chatted a little bit earlier. I'd love to hear, you know, Nox, you know, obviously you guys are providing services in the healthcare industry.

What's it been like to come in and help them with their program? It is extremely interesting. We have like 3 businesses within Nox. So, we have a medical device side of business. So, and that's actually what's in Iceland.

We make those sleep testing devices that are, that people can use at home. So, instead of going to a sleep lab somewhere and sleeping in a foreign bed and maybe not getting a good night's sleep or even have a good test, you can get one of our devices, hook yourself up before you go to bed and sleep in your own bed. And actually, they are like super comfortable. I was originally thinking, I actually went through the program myself to kind of see how, what it's going to look like and how it's going to feel like for a patient. And when I saw the device and all of the setup and how it's going to be, you have to like put like electrical sensors on your head, which, by the way, my husband got really excited because he was helping me place those, those sensors and using a lot of glue and not glue, but some adhesive and tape He, he loved it.

It's actually kind of comfortable sleeping in all of this stuff. Didn't, didn't really bother me. So, so we have that side of the business and then we have a big kind of like employer business where we partner with self-insured companies. And we started in like a trucking industry where the safety is a big thing. So we have truck drivers instead of falling asleep behind the wheel and getting accidents, they can actually get in our program.

And if we go through the sleep test with them and we identify that they have like a sleep apnea or something like this, we actually have healthcare professionals who will work with them to make sure that they are on therapy and they getting a good night's sleep so we don't have any accidents on the roads. And we also have a third business, which is like a more traditional sleep clinic, where you would come in and get tested in the clinic and do some of the diagnostic that way. And it's mostly just in Atlanta area. Well, that sounds great. Um, and so what's your role been coming in?

What are you trying to help them get better at, and, and what— how can you enable them to succeed? So, um, cybersecurity is actually— it's kind of interesting and, uh, exciting that cybersecurity is, uh, you probably heard it many companies say cybersecurity isn't, uh, make it cybersecurity as business enabler. And in many companies, it's just the words. In Nox, I feel like it's actually the case. We are growing.

We're a pretty small company, and we're hoping to acquire larger clients, be as a kind of like a sleep— preferred sleep provider for larger insurance companies like Cignas of the world. Um, and, uh, for us to be there and achieve it, we need to make sure that we have security and compliance in place. Not just HIPAA because we're in a healthcare space, but, uh, I'm right now going through and, uh, trying to schedule our HITRUST certification, which is like, it's a beast. So anybody and everybody I talk to about this, they're like, oh my gosh, I, yeah, do you even sleep? I'm like, yes, I am asleep.

You know, I'm in the sleep business. You have to. That's all we do is sleep. All we do is sleep. So, I love it.

And I do want to be respectful of time and make sure we get to a big, another really important topic we wanted to chat about. You've been doing some volunteer work in the community here. So, I'd love you to start off with, I think folks on the on the show have heard of Lyft in the past, and, you know, but I'd love to get your background, how you got involved, and maybe talk— tell us what it is from your perspective. Yeah, sure, absolutely. So, um, women and security, that's, uh, that's kind of like the problem that everybody's been talking about for quite a few years, uh, now, and we are actually getting better.

So, um, Lyft, I know that this organization been or Women in Security, been part of ISSA for quite some time. However, you have to be an ISSA member, and there's a membership cost to be part of it. What Lyft did a few years back, they kind of split up, and it is actually partnering with the CSA, and that allows Lyft to have a free membership. So we can actually reach a lot more women in the community in the different stages of their career growth. So we open to students if we have anybody who is going and getting their computer science or cyber education.

We're trying to get more women in community who are like either mid-level or senior level. And the goal is really to support, uh, women here in Colorado who are in, in cybersecurity community. And it's, um, I kind of been in this, um, situation pretty much my entire career where I would go and I'll, uh, I'll be either the only woman in the, in the room or one of the few. And I really hope that we can, we can change that. So we had, um, so this organization been a while, uh, in, in existence for, for a few years now, but we this year we are re-kicking this off and we are refocusing.

So one of the things that we are changing is, as you know, there are a lot of cybersecurity events, webinars where you can learn how to do identity, how to do incident response, and other things. So we were kind of doing the soul searching, and we figured that this is, uh, what we are missing is we're actually missing the community part. Because there are a lot, as I said, there are a lot of other events that you can learn about everything that's happening in cybersecurity. What want to do is create a community for women in cyber where they would be, um, coming together, supporting each other, empowering each other, and just, uh, being there for, for each other. So, um, there are a couple things that we're doing differently this year.

So all of our events are going to be, um, very different. For example, our event in, um, April 20th is, um, about the imposter syndrome. And the sponsors for the event, um, are women-owned businesses in the area. So we have a, a Stitch Boutique in, in Denver who is going to be— who's coming in and helping us with the styling. Uh, we have Alchemy uh, Face Bar, um, that coming in and doing like mini facials and talking about how to do the, uh, skincare so you can actually be comfortable in your own skin.

Uh, we have, uh, and the event is at the OXB, which is the sweatproof jewelry. So it's like an activewear, um, company. So It's, it's really, um, kind of interesting. We're also going to do an event in, uh, in June, I think on the 28th of June, uh, that we're gonna do hiking. We're gonna go hike.

And, uh, actually there's gonna be, um, one other thing I wanna mention that we are also starting the, um, mentorship program for women. And this is actually, I wanna use this platform to call out to, um, Um, anybody in a cybersecurity space, uh, women who either want to be mentors who have a lot of experience, and women maybe who would like to get some more experience. We are starting this program, uh, and the registration is going to be open, uh, April 20th through May 20th. So I'll just throw in the website, csacolorado.org/lift.

If you go over there and you can learn about what events we have, but we will also have a mentorship application form that you can fill out and we can actually pair you guys up with really amazing mentors. And this is a great way to get to support our community because we have a lot of really experienced, uh, cybersecurity leaders who probably would be able to just give back and make sure that we are growing the next generation who will be able to keep Colorado secure. Yeah. So are you looking just for mentees or for mentees and mentors at this point? Mentees and mentors.

Awesome. So we Yeah, so we are open to, to both. This is the first time, first year we're going to be doing this. So the program is going to be— so the registration will be April 20th through May 20th, and then we will kick this off, uh, in June. And the actual mentorship program will run from June until December.

Um, and our June event, the hiking event, we actually— it might be a really great opportunity for mentors and mentees that are going to be paired up to kind of get together and go to the hike event where they can be not just speaking on Zoom, but they can actually meet each other face to face and develop this deeper, deeper relationship. Great. And so you're looking for female mentors, female mentees? Correct. Anyone who's interested in getting involved, take a look at csacolorado.org/lift.

But even if you are not necessarily looking to mentor or being a mentee, check this website anyway, uh, anyway, because we do have some amazing events. Yeah, um, the hike, uh, we're planning a golf event for, um, for August. We don't have the firm dates yet, but, uh, we're actually gonna teach people. If somebody doesn't know how to play golf, we're gonna have some, uh, some pros who will be there teaching us. And we're also planning an event in December— sorry, in November, maybe around Thanksgiving or before Thanksgiving, and it's going to be more about the gratitude.

So we'll do yoga and possibly follow this by the, like, a 30-day of gratitude type of event. So as you see, it's like not necessarily focused on cybersecurity. It's more about women empowering and getting our community to be really, really strong. That's great. Well, Larisa, I think this has been a fantastic set of topics.

Um, any— anything else that you wanted to make sure we, we cover here? No, I think we— you, you've got it all. Um, I want to be respectful of every— everybody's time and your time. Um, just, uh, one more plug for csacolorado.org/LIFT, and you'll find a lot of great information about what LIFT is doing, what events we have planning. And again, one more call to action to anybody who wants to be a mentor or mentee for, for our community.

I love it. All right. Well, that is it for the interview here. Larisa, thank you so much for telling us about your, your own story, your own journey. Um, I mean, obviously super inspiring and interesting to me, uh, the way you've, you've, uh, you know, really risen super high in a career without, you know, not knowing where it was going to start.

Um, appreciate it. And we look forward to, you know, obviously I look forward to getting dinner with you again sometime soon. Uh, uh, but yeah, hopefully folks will run into you at the, at the Lyft meetings. Absolutely. Robb, thank you so much for having me.

And, uh, I had a blast. Awesome. Well, this is it for this month's episode of Colorado Equals Security. Tune in again next month. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security.

Reach out to Alex and Robb by emailing info@colorado-security.com. Colorado-security.com.

Until next time, remember, Colorado equals security.