Episode 1: College, Exec Comp, and New CISOs

Welcome, everybody, to the sealed security podcast. My name is Justin Liebling, and I'm joined by Rick Yocum and Joe Wynne. We're glad to have you here. We're doing a little bit different format where we're doing more conversational base in around interesting security topics while having a little sip of, some good refreshments and everything. So with this, type of format, what we're aiming to do is just get into, you know, good discussions, maybe some arguments along the way.

Yeah. So I've been doing security and compliance stuff for, like, 20 ish years. Okay. I actually, started the my the high school I went to hired me to do computer stuff, which was pretty cool.

After you hacked them.

Wow. There's a little bit. A little bit. I think there was a bit of, hey. This kid likes computers. Let's harness this energy towards something less destructive than breaking everything.

Isn't that all the boys? Like, you have to direct them to something worthwhile. Yeah.

So there was a little bit

of shenanigans upfront, and then

a lot of me stopping other people's shenanigans, That's cool. So yeah. And then went to Duquesne. Did kinda like a combo IT business degrees. After that worked for Deloitte for a handful years, both on the audit side and then on the kind of security consulting side.

am today. Okay. Great. Yeah. Joe you wanna go?

Yeah. Absolutely. So, I too went to Duquesne, and we've been friends

with the community right now. Yeah.

Yeah. We'll get in that later when we hit the topic of, you're

right here. Right.

So, yeah, I've, I currently run a cybersecurity engineering firm. And Yeah. That's not

No. We'll get to that.

Yeah. And and

but years ago, I've always kinda when I was a kid, it was like, you know, I want to have a company. But did I really even know what that meant? I had no idea. And so I went through everything and had an affinity for computers in in middle school and high school as well. I remember one time I was sitting there writing this stuff on a piece of paper and my 8th grade teacher came over and asked me what I I was doing.

You

open it up without a key and all this stuff. So I always enjoyed that and got into high school, just kept learning more and more about computer stuff. Went to Duquesne for I wasn't gonna go for computer science, but I was gonna go for physics and engineering eventually and ended up having my, yeah, my, my comp sci teacher for one of my classes talked me into switching over because I was, you know, I would I took to it. I'm not a coder now, but I did okay then. Mhmm.

I remember working in the computer labs at Duquesne. A lot of opportunities to both do and shut down shenanigans that

you do. Yeah.

So that

was, that was cool. So I got out of Duquesne, got a job and I worked there for, like, 20 years. Kinda went up through the ranks of being on the help desk to doing sysadmin stuff.

That's what we do. Rebate admin stuff. Yeah.

Yeah. Eventually. And, that was I was probably there for, like, 10 years by that time.

Yeah. Probably. Yeah.

And so, but nobody was there didn't even have, like, a specialized security department. It was just something people did Yeah. The best they could. And so things have come along, and eventually I was able to, create a one man shop and move out of, like, traditional IT into still an IT, but it was a security department. Yeah. And then was able to grow that up. Sarbanes Oxley was the trigger for them, the one to invest in it. So then eventually, you know, got a

If that's security time the rigor that we have to go through today for regulation and compliance.

Right. At the time, it was it was a Peter of pitchforks and fire.

Right? Absolutely. And and that stuff was crazy back then, but there was no, like, control frameworks that people were trying to intentionally follow.

Yeah. Yeah. So standard like like what are these

access control reviews? I have no idea.

Right. Yeah. An audit meant, you know, a deep audit meant Anderson Consulting coming in and running some stuff on your Nobel server. I remember that.

I'm like, why

are we paying this much money? How do we do this ourselves? Let's just do this. Right. And so anyway, so that's how, you know, kinda got into official security and then kinda grew up from there. And after working there for a while, got recruited away, went to another company for a year, and kinda started thinking back about how I always wanted to start a company.

Yeah.

And, like, what am I gonna do? How am I gonna do this? And so the, you know, the piece I had to figure out is, well, how do I leave and also go do that and get it started? And I started a company called WinSecure. It was just me. And then name. Yeah. That's

a really good name.

And, and then eventually, we, I met up with my cofounder John Ziola, and we formed CISO. And I met him during, b sides, Pittsburgh organization meetings. And so, which which you're on now.

Yeah. Yeah.

And anyway, so long story shorter as, kinda always always doing something security related Yeah. And finally got into leadership and then wanted to really bring that to other companies and companies that can't afford the luxury I had of being able to build a, you know, dozen people or so team. And that was a lot of fun. So now we can do that for lots of companies that just can't do it.

Yeah. And then you don't have the all the politics above you to do some of the stuff. You still have to report to the customer, but sometimes it's a little less on, like, if you think it's the right way, you just kinda

And sometimes, sometimes you don't have customers anymore, that you choose to hire.

Right. Exactly.

And you

go find a voice. So So alright. My turn. So, yeah, so I started off I think tinkering in around, high school. So, my dad actually started up an ISP.

So this

was a t one of phone lines, not a t one of network or Yeah.

T one was a direct line coming in, but it was 1.44 megabytes. I think it was the speed and everything. It was a direct line, you know, with that. But we were serving customers through modem, so they were dialing in through their POTS lines Oh, to connect. To get out. And then the pipe out was that t one line, and everything. So but we've got to obviously be on the t one line. Yeah.

All those phone lines plus the t one line. Exactly. Okay.

Yep. Yep. But, yeah, it was really cool. It definitely left an impression on me. Just, you know, the, you know, the successes and struggles that having your own company and everything.

There you go. So youwarbill.com? Newwarbill.com.

Yeah. Exactly. Right? But yeah. So, and out of high school, like, I had some programming classes like C plus plus actually, Mars Area High School had that, growing up and everything.

That's awesome. Yeah.

So why don't we dive into some topics here?

Well, I know we're gonna talk about one topic, but you brought something up in your intro. So maybe we just switch right to that. And it's the career. Is college worth it? Wanna hop into that one first?

Sure. No. No? Okay. Slightly biased into this, but there are so many topics nowadays that you really don't need a college degree on.

So that wasn't the right answer.

Yeah. Yeah. In an open ended nothing's wrong answer, that was wrong.

No wrong answers, but there are some not great

answers. Yeah. But it just goes to show the curriculum was way outdated from that. So, you almost have to kind of retrain. It's like, hey, the email is a bigger threat than, you know, than, you know, than any worm nowadays, you know, type of thing.

And we should talk about threads later and what the biggest ones are.

Oh, okay. Let's go

back to arms. Yes. So so it's so with respect to college or jump right into it, what's some pros for going to college?

So I think there are some, academic learning that you have to do to go through that. So you can't get out of college to become a lawyer. You can't get out of college to become a doctor. Those are licensed things that require degrees into that. Now, you could do an argument of whether a degree is actually, you know, word like you need a degree to actually do that.

do that on video call now.

Yeah. It's probably They're essentially an operator.

It's probably just a, you know, a deep fake It's just AI? AI now doing

it too.

You have to go

through a doctor.

Right. Yeah.

And and so I guess, you know, into that context there, you know, you can have an argument whether it is you know, that's required, but you need that.

It's legally required now.

Exactly. You need

it that kind of level of training.

Right. Right. Now Obviously, you know, somebody going into open heart surgery, like, they better have training at the Wazoo, you know, type of thing. I'm not putting myself on the table. You know?

But you did you ran yourself through a series of, like, focused studies when you knocked out all those search. I

mean, yeah. And Barnes and Noble was my friend. If I didn't know a topic, I went to go buy a book and learn it, you know, that type of thing. Yeah. You can't just stay still and say, okay. I'm not gonna get educated. Like, there are almost like that personal MBA or whatever they call where it's like,

well, I'm just gonna, you know, go read all the MBA books.

Well, and that's what was it, Goodwill Hunting, when he gets in it. It's like, you know, there's 2 certain days. 1, you're gonna realize that you wake up and you could have had, you know, your entire education for a dollar 50 late charges, you know, with that, which is true, you know, like there's nothing needed to be sitting in a classroom. I mean, I think and we've had losses from the educational system. I think it was really there to test you from a reason standpoint, and we've really lost that.

Ability to execute logic and patterns

to think through. Yeah. And, go up against adverse challenges of your thought process, you know, and I don't think that's really there anymore. Like, it's not that you're challenging, you have to defend yourself or make up good arguments on a premise or a thesis or whatever it is. Like that's what I think college was like a 100 years ago, you know, type of thing where they basically made you sharp and honed on utilizing the knowledge that you had you know, come up and defend it well.

Well, very interesting is a 100 years ago, the only place to go to collaborate like that was either university or the bar. Mhmm. And and so you couldn't just get online and have a meaningful discussion Or the information. Discourse on anything. But today, you know, you can you can have those without having to go to Right. To school.

I I will say, what going that what the degree did for me had very little to do with the degree itself and a lot more to do with, some professors and relationships with them who I still maintain relationships with. Yep. And other students who I'll pull on not necessarily for anything related to my degree. Right? But if I have a weird question on government stuff, I have a friend who is in Pali sci and I'll ask you all that weird question about government stuff.

more important. Of relationships is really what you're Yeah.

The social aspect of it. Mhmm. Because I think a lot of people, that part of their lives, if you take kind of a typical route in terms of where when you

go to school Yeah.

You're at the you're in these sort of formative years and a lot of people are out of the home for the first time or partially out of the home for the first time, all that stuff. So I think there's some can be some good stuff there. But from a career perspective, what it did was I think it it got me the internship at Deloitte, which to a large extent for me was that formative apprenticeship, you know, truly through the ringer for the first bunch of years. And and that's what helped sharpen my thinking. And I don't know that I would have naturally got, like, say, that internship had I known I don't think he

would have at the time he went because Deloitte was, like, 4 year degree. Right. In fact, I I experienced that. You know, it was I graduated 1999.

Yep.

And when I was trying to hop around, like, I was getting stuff like, oh, yeah. You're well qualified, but you forgot to put your college degree on your resume.

I didn't forget about it. Yeah.

Yeah. Yeah. It's like, oh, well, it's required, you know, type of thing. But I

wonder if it's a but I wonder if that's changed now. Right?

I don't I wonder if it has. Yeah. At least for a lot of tech jobs. Every position that I hire for, I throw that degree out the out the window and everything. Now it might be a good, like tie breaker, you know, type of thing. Like, people are basically equal and one's on the college, one hasn't.

And then I want to

know, like, what did you do with those years? Right?

Yeah. That would be my question.

That's true. But I'm looking for anything that'd be a tiebreaker at that point. But there's usually never, like, a one for 1, you know. There's good quality and bad, you know, or worse qualities. I wouldn't say bad, you know, but yeah.

And I agree with you, and I wanna hear your thoughts on this too. But, like, me me having had hired a number of people in the past, when I'm advising people on hiring practices, I basically tell them the same thing you do. I said, look, if your HR department will let you do it Mhmm. Right, Get rid of the degree requirement or potentially certification requirements because there's a lot of people out there that are potentially super skilled. Now you need to have some education.

So Yeah. Yeah.

No. Actually, I agree with all of that. And, I wanna get to the cons of of going to college as well in a second. But you know well just to sum up some of those things well rounded. I don't know that I've encountered people who haven't gone and immerse themselves in, like, that college environment.

a number of college parties, and I've never went to college.

See? Yeah. Yeah. They'll let you in. Yeah. Right. They'll let you in.

And, opportunities to collaborate. You were hitting on that that you never would have gotten any other place. And in some places, just some jobs require it.

Yeah.

But the other part is, unless you're a unicorn, and I was doing a little bit of, like, superficial research on this before, we got here, was, you know, higher earning potential. Unless you're but I I think there's unicorns out there who, will do that. When you look across the general Yeah. Populace, I think people who come out of college will get a higher level. They'll they'll won't hit a certain signal. Other people

You'll yeah. That that that early start at a higher thing, assuming you make the jumps at regular intervals Right. Is gonna get you to a higher place overall, potentially. Yeah.

But that leads into my first con.

Well, especially the government. They have a very strict, you know, qualification hiring process. And they're

not a small employer.

You know, they aren't Like, 1 fifth of the economy or something

like that. Also get capped at a salary range there really fast. So you've got to go to college, which costs a ton. Plus if you go to the government job, then Mhmm. Yeah, you may not get as high of an earning potential.

Right.

Now you kind of break that, that mold. What do you think?

I think that's probably true, but it's probably also true that we are all weirdos and that we've been doing, like, IT and security stuff, like, almost from the jump. And I do think there's probably a large number of people that try a thing in college and then go, this isn't for me. Well, to to an extent, you know, that that I think that was your host for me. Right? Right.

Well, even before the jump, like, you were saying in high school and in high school, we all took, like, some sort of computer stuff. Well, nobody else was.

Because there's people like, oh, yeah. I'm going into biomed and then all of a sudden, now I'm gonna do landscaping instead or whatever. Right? It happens all the time because people start doing the formal training and whatever that discipline is and then they shift. So, yeah, I could see that

A promise of money and then they're like, I can't do 8 hours of business either way.

You could theoretically figure that out doing the actual work too, potentially.

That's the argument for apprenticeship. Yeah. You know, like, that's a low risk tryout. Right. And you don't have to sign up for college to do that. I mean, most college, you spend 2 years just doing general courses and then you start getting into whatever your elective degree is, you know, type of thing. The apprenticeship is like, okay, do I like it or not, you know, and then you can drop out with the like, and you get paid. You know? Like Right?

Well, can

I ask you a question that I was asked just today? I was talking to somebody, another professional executive, another company, and he said, schools, college is leaving out. My, he said his son's roommate is coming out with a security degree. Yeah. What should you do? And this is always a perplexing answer because you think you went to school for all these years in cybersecurity. You should come out and get a job in cybersecurity.

I know.

But I wanna know who's hiring a job in cybersecurity for an entry level person coming right out of college. No.

I don't care what you're doing.

The vast majority of people are starting to help.

Is that an overnight SOC, position? That was one

of the things I said. There's companies that'll hire you to be a SOC analyst so you can figure things out. And and part of the answer I gave was relating it to, you know, would you hire somebody who's never lived in a house nor build a house to come and put a home security system in? They'd have no idea. No concept. Right?

Mhmm.

So would you bring somebody into your company and have them jump right in? Well, if it's a PNC level, cybersecurity team with 100 and 100 of of of people, well, then there's probably a place for somebody to come in because they actually have the Right. The training program

Yeah.

The apprenticeship program. And so it's built into the companies. You can get the companies to do that, but I'm not gonna be able to bring somebody in right out and make them super productive right away. But Right. Have you seen too much of that?

And that's the thing. Like, yeah, smaller companies, they can't afford bad employee not even necessarily Inexperienced. Well, it could be bad and or inexperienced because even if you're like you know, an employee that doesn't do anything, you can mix into a larger crowd and not have that much of an impact. It really it depends on your immediate manager to kind of supervise, but it comes down to the culture with that. But, yeah, if you're with a small company, a team of 10 people, and somebody's not pulling their weight, it's very apparent, you know, like it's like, I've asked this person 3 times to do this, and they haven't done it yet, you know, type of thing.

Well, experience on the job also means a couple different things. Right? Like, there's these core security skill sets. Right? Maybe a bunch of nontechnical patterns and then, like, some technical knowledge that supports that and all that, and that's fantastic.

That was easy. Understand how the world works a little bit.

Yeah. Exactly. Exactly. I was working with a client, client earlier on, and, they have a culture of meetings, you know, 9 to 5 meetings, wall to wall, and everything like that. And, you know, I was onboard doing a long term project, and I blocked off my calendar, you know, when you know, don't schedule stuff during this time and everything.

you saying that's attributed because that person didn't have experience with, like, the way things ought to work?

Or didn't care, you know, type of thing. But, you know, that we have a normal etiquette, like, you check they're free busy. You try to avoid lunch. You try you know, there's You don't schedule stuff at 4 o'clock on a Friday. But these are my kids.

You know? But insecurities is one of those things. It typically makes things more difficult in some way, shape, or form. Right? It's it adds friction intentionally. Yeah. Right? It can solve some things, but that's a a bunch of different conversations. But if you're in that position where you're like, hey. I need to slow down the business a little or make sure people are doing things safely or tell someone, no.

Yeah. Good. So as we wrap up this topic and let's could we give some advice? And the advice is if you're going into college or you're coming out of high school and you want to get into cybersecurity, it actually just there's probably 2 different answers. If you're going into college for cybersecurity, you just got accepted at one of the great programs. What should you be doing along the way that makes you hireable or somebody wants to hire you as you're graduating?

Network. So go to the conferences, all the free the chief conferences, meet people, invite them to LinkedIn as soon as you meet them, start to get your network kind of, up there and everything. If you graduate or come to graduate or just you're now looking for a job and you've met somebody and you've had a good impression on them, you will get an interview. Yeah. You know, whether you get the job or not will be another thing, you know, in the interview, but you will get an interview through relationships, you know, with that, so that's one thing I always tell, you know, with mentors and graduates is like, you know, just getting a degree is not enough.

That's great. What do you have, Ed?

I would say, and I actually think I don't think there's anything I could say that would be more important than networking, so I'm gonna throw that out first. But as a secondary thing, I'd say find a secondary topic of focus that you also study or that's important

to you. Plan.

No. But as a to relate things. Right? So, like, I did, like, IT and security, Sloan plus accounting stuff. So one of my superpowers right out of school was, oh, yeah. I can talk to all these finance people and their ERP, you know, about security because I speak that language too. Right? And it could be anything. It could be health, and now you're talking to doctors. It could be whatever. It could be hospitality, and you're talking to hotel owners.

Like That's a fantastic idea. I didn't even think of that one.

It's just it's just find a secondary domain of study so that if you really wanna do security, you're, like, carving out an initial niche. And you don't have to stay in that niche, but you're always gonna fall back to certain the relationships in that niche or patterns that you get from that niche. Because I'll also say, every time I, like, find myself thinking about something new, I'm like, oh, how does this apply to security? Right? Yeah.

Yeah.

Yeah. Just real quick on that. One of the things I thought was really cool, it was last year or the year before coin Coinbase was hiring a whole bunch of people, and they had a number of things that was guaranteed to get you a job, and one of it was if you're anyway titled with chess, you like if you're a FIDE master, international master, or obviously a grand master, but like if you're anyway titled, you get an interview, you know, like we we want an interview. Like, how you think. It's like and that gives you, like, secondary skill, like and that's a very Yeah.

But yours.

Yeah. Well, I I still wanna I'm still fixated on you said because it ties back to something I was thinking about earlier as well. But it's the you don't just do security because it's a thing to do. You do security because you're securing something. What is that something?

Yeah.

But the other things I would say that if you are a if you're starting college now, several things I would do to be hired coming out with a cybersecurity degree is, 1, before you get to college, set up your LinkedIn and start bragging about everything you're doing. That means you have to do some things to brag about. So don't just go to the conferences, but I tell people just submit to a talk. Eventually Mhmm. You might get a talk.

You know, like, give me a nap song to write about somebody and give you, you know, all the bullet points there. You know?

Oh, sure. Sure. But still, agree.

We could talk about something that stumped you. And then, okay, now you're past being stumped whether you succeeded or failed, and then write about that. Right.

Yeah. And do a talk about it. Yeah. I saw a b sides, Harrisburg talk where a gentleman, he was pretty new and everything, but he talked about how he learned and shared that out on LinkedIn and how it got an audience out

of hacking 1?

No. Oh, a Derral. Yeah. It's a Derral one and everything. Yeah. And it was, like, really cool. He'd said, like, I came at it as a novice, but I shared my experience. He went into, you know, did some, like, bug bounty stuff for a bunch of different, websites and everything and talked about how he got stuck and how he got passed on stuff and how he, did a number of things, which led to other networks, which led to, you know, eventually his career into the industry. Yeah.

So you talk about some things. You go to the meetups and the networking. Yep. The networking again. And you start logging all this stuff. So if you're an interviewer and you're looking at 2 different candidates, they both have 4 year college degrees in cybersecurity. During college, one of them interned at a bunch of places, wrote some papers, got published on whatever because it's not difficult to get stuff published. You can self publish. Mhmm. Has them a couple recorded talks.

I I'd actually throw in a wrench into that. Uh-huh. You got somebody with college degree just with that and somebody with no college degree with all that stuff.

Absolutely. That's why I clarified

Yeah.

Because I knew that you would go there, and I would a 100% agree with you. Yeah.

You know what it sounds like too? And I've never thought about it this before this way before, but it's almost like, 2 kids in art school. Right? And one of them is building their portfolio Mhmm. And the other one, you know, whatever. They're throwing it out or burning it. It. Mhmm. Right? And they get to the end of art school, and they're like, oh, you wanna be an artist? Okay. Why would we hire? You know, here's all my stuff.

I'm pretty good.

Yeah. That's really good. So the concept of build a portfolio Build a portfolio. Yeah. Network and document your portfolio in your LinkedIn because that's what all the business people are gonna look at when they're doing hiring.

Yeah. Cool. Secondary thing.

And secondary thing.

Learn a secondary thing. Yeah. I I think that's cool. I like that. So here we we plugged b sides a little bit. Let's officially plug b sides.

Okay. Yeah. That's all.

So, I think this might come out before b sides, but b sides is on, July 12th at the Rivers Casino. We have a number of people who are organizers. We'll get you hooked up to be an organizer one day. No. No.

I've I've talked a number of times but yeah. No.

There are many organizations. Did you submit a talk this time?

I run the lobby con. Okay. I make sure What are you making sure? Care position. I make sure everybody's behaving in the lobby.

I never seen somebody go to more conferences and never see a talk.

Yeah. But I'm

just kidding. You've seen Slack. Have you submitted a talk? I haven't. No. Talks, submissions closed last week, and I know I was just reviewing a couple of the, a couple of the, CFP submissions and some I was looking at were AI related, respect to some open source testing tools and, how to do, like prompt engineering security.

Okay.

There's some some talks I looked at, that were good for developers. So your hardcore developers. And I was reading this thing, you know, like, well, that's a little bit above my coding level. So I'm sure people understand it, but I was on a verge. And then there were some hardware hacking including cars and medical devices in the ones I've read.

Oh, okay. That would be that's a good group of diverse

I only looked at 10 of them, and I think there were, like, 20 to 30 submissions, maybe more.

Maybe more. Okay. That's a lot of submissions.

Let's see Cool. Yeah. What's the is it, like, 15, 20? How many are you accepting?

3 tracks. About 16. 2016. Yeah.

Yeah. About 2 tracks of, 8. That's right. Okay. Got it. Yeah. So do you see any other topics that jumped in mind in this submission? I think

I think maybe we saw some very similar ones.

Okay.

I think there are a couple, a couple less technical, more like governance ones that

I saw from other stuff.

Yeah. Yeah. Yeah. And there there are a couple, even sort of, like, entry level 1 on 1 things that I think were really good.

Oh, really? I didn't get to see that.

Yeah. There were 2

of those that

that I

There's something for everybody. Yeah. Yeah. Yeah. Yeah. It's awesome. So besides, it starts around, show up around 8 in the morning and prepare to go. If if you're like us, you might prefer to go until 2 AM.

Yeah. Exactly. Yeah. Cookie table Should definitely go. Yeah.

Cookie table was a major topic recently too. Uh-huh.

I'm excited about that. Yeah. Yeah. If you're, from Pittsburgh, you know what a cookie table is.

At the weddings. And if

you're not, come find out.

Yeah. It's not a big mystery. It's it's it's in the name. Alright. So what's next? Yeah. What's a good topic here?

I don't know. We we we threw around, Microsoft, started to do some stuff where they, they started to create these physicians, deputy CISOs, and are tying them to a lot of development. And the CEO made a statement that security is gonna be above everything else for priority. I read that in one of the articles. You suggested article. What what comes to mind?

Yeah. So, I mean, just to kinda set up, the little bit of backdrop here. So, you know, Microsoft got breached. You know, their email servers were breached and everything like that, and then CISA decided to basically investigate them because Microsoft does a lot of government work, you know.

And agencies specifically, they

were were there were agencies that were notified that those emails were being read. Exactly. So there was an investigation, and then CISA basically came out and had a report that basically said, Microsoft, do you know security? You know, like, Clifton thing. It wasn't good for them, you know, so they were scrambling to, you know, kind of respond to that.

Yeah. The compliance part of me says, oh, man. That could go wrong in so many ways. Right. Right? Because to your point, like, how do you quantify it? Okay. Is it based on incidents? That's kind of a weird metric. Is it based on, like, the, you know, 1 to 5 score that you get from consulting agency on this framework that you're supposed to align to?

to be. Right. Right? So I there's a lot

of, like, conflict of interest alarms that start going off in my head when it's like, hey. Your responsibility is security, but also you're gonna get measured on how good the security is. It's like, well, you should actually get measured on how honest you are about the security is as opposed to, like, that number. So maybe it'll be measured different ways, but if it's done poorly, it could be really bad.

Right. And, you know, I just thought of something like one of the things, with this compensation, what if you're low on resources? And you said, like, I I don't have the resources to do what you need me to do. How many times, you know, have, you know, visitors say that, and then they get popped anyways or, you know, with that? It's like but I told you, like, I didn't have the resources to do what you wanted me to do. Where where does that even come down?

Yeah. Well, what, so here's a quote, from the article, and Nadella hinted the changes last week in the company's quarterly earnings call when he said the company will be putting security above all else before all other features and investments. So to me that's that's a way to begin to address that

What does

stock do for that?

Constraint. What's that?

What does stock do for that?

Well, I don't know.

I'd be curious on what investors actually thought of that. It could

be an investor thing, or it could just be just, like, competition. Okay. We're gonna ramp up features faster. Right?

Yeah. Well, I'm just curious that if they're not pushing out features is from an investor saying, but did their stop Right. Go up or down or

not lending? That's a good that's

a good question. But, you know, I would hope that, no. Did did the stock even take a hit? How much did the stock take a hit when, there was the incident?

I don't know. Yeah. But it'd be interesting. I remember years ago in, at ShmooCon, somebody did a talk, and I think the name was, like, breaches are good for you, and everything, and they basically did kind of a historical analysis of mainly the stock market and with that, and they looked at major breaches and where there were Oh, yeah. Breach I

know you're talking about.

Where they got hit, and then a year out, and most of them fully recovered, if not more

Oh, yeah.

From where they were at.

DS s it was the the shoemaker. The shoe

DSW? Yeah. DSW. DSW, Target. Like, there's a whole bunch of them that had major major breaches, and a little bit later, you know, with that who was it, Troy, Fine just did a post when, United basically came out and said, oh, yeah. Like, they got based our, you know, our entire database. Like, 1 eighth of Americans were compromised or whatever the number was. You know? I forget what it was. And they announced this, on a, you know, a public, you know, call, and their stock went up that day.

a bunch

of Fact fact check me here, but, didn't the CEO of MGM say that their huge breach

Yeah.

Was not even material in his mind? Right.

The Target one is well,

I remember a 1000000 years ago,

it feels like, the big Target stuff. There are spirited debates about all this.

Every time you say Target, you have a drink.

I know that. But it

very much was like, it was like a mark my words. Right? Their stock's gonna be recovered in a week than it was. So yeah. But I anyway yes, please. But I you know, my my my fear with that like, I I think the intention is good. But like many other things, if the execution is poor, it could create some really bad Yeah.

Well, usually, they bring that security executive compensation on progress toward on progress towards security goals. They're gonna install deputy chief info, info security officers in each product group and bring together teams from its major platform and product teams in engineering waves to overhaul security.

Yeah. So so it sounds more development and, you know, into their products. It could still

go anyway. Like, progress towards goals, you're gonna quantify it. There's gonna be numbers. Gonna be on slides. And if you don't hit a thing, you don't get a bonus. Again, you're Yeah. But Yeah.

That that that's workable and that's 0

being for any goal. But it's gonna be cultural at the end of the day Yeah. Whether or not it works well. Absolutely. I mean, my my big takeaway is I I like it. Financial incentives drive behavior.

And, you know, that's good. And I also like dedicating extra people. So Mhmm.

I don't know if they had

these deputy, CISOs before, but putting them in place and putting them into these groups.

They would. They would. Well, they could've announced it if they did already have it.

But It's kinda surprising to me if they didn't, that they didn't. Because, like, I mean, most super large organizations I've worked with at this point absolutely do. What and they call them different things. Yeah. The Bezos. The Visa. Exactly. But it's like, look. You're the security chief in this area because, you know, it's it's one of the ships in the fleet, and it needs someone watching this in this specific space. Yeah. So, yep, they didn't have it before. Kinda interesting, actually.

No? Yeah.

Well, that was a good topic. What what do you wanna hear on next?

So what do we do? You're new in a company, head of security. What do you do first? Or what do you do? Like, just start off with, you know, a game plan and everything. I thought about this a lot.

Yeah. I had these conversations a lot.

Yeah. Right?

I mean, oh, you you might as well. In the, I didn't mention faculty of ions as, one of the things on the Yep. The resume now. But the, you know, ask an expert about this.

You're always getting into this. Like, I'm I'm

I'm I'm on the friends and family. Yeah. Right.

There you go. And so you jump into these conversations, but you you give us some thought. When were your what were your thoughts?

So my I mean so first off, you gotta figure out what you're dealing with, you know, going on. Actually, ideally, you should figure that out before you accept the job, you know, type of thing. There's a lot of cultural things that will shoot you in the foot, you know, coming in. So as best as you can, those are the type of questions, you know, if I'm letting don't know if I'll ever take another head of security, you know, position at a company, but in the few that I've had, those are the questions I try to get from cultural perspective. Like, would I be able to be able to do anything there?

Yeah. So I have, like, a very similar in a lot of ways. Maybe framed slightly differently. But there's, like, 4 key things top of mind immediate. And it's, meetings with all the leaders. Mhmm. Right? Like peers and or various bosses, dotted line or straight line to say. And it's part of, you know, getting the feel of things, but also building the relationships. 2, same thing with the team.

Yeah. Because that's gonna give me the best by. Yeah.

That's gonna give me the best sense of, again, building relationships, but also, like, are we good or are we not good? Right? Because if there's a couple jokers in critical positions, I'm already a little nervous about what, you know, what might be there. And maybe they surprise me, but I know there's gonna see be some places I wanna pay attention. So 2 relational things, but leaders and then people.

Season getting the the the

Yeah. Kinda like pick and pack season. Oh, yeah. Exactly. Got it. Exactly. Okay. So but it's paying dividends. So what I typically do from a tactical side then is it's access. I get my arms around access management and how that works almost immediately.

Oh, I like that. I really like the access management, pieces. Your first, like technical piece to hit in on. Yeah. Yeah. So you're basically doing a risk assessment of the access management part. I was going to start with you to do some kind of risk assessment.

Yeah.

As you start going in part of the risk assessment, you're kinda doing it all along. So when you're talking to all the leaders, you're trying to get a sense of what what what could break. I was I was talking to somebody who came in and helped me probably 10, 11, 12 years ago now, and they just went around and said, let's go talk to the execs. Mhmm. It was for a pen test. And

Yeah. And

it was more than a pen test. And they started looking at it and saying, well, let's go ask them. What is the one thing that can happen in this company that shuts it down? Yep. And let's start reverse engineering from them.

I would say what what's your absolute worst Friday night slash Monday morning look like?

And why did that happen?

Yeah. Yeah.

Yeah. That's really good. So risk assessments, I I like that. And then, if you if you think about frameworks, I'm just a huger fan of ISO 27,001 that I am maybe of, some of the other ones. They're all good control sets like CIS is great control set.

They focus on this continuous improvement.

That's exactly why. Yeah. And so the first thing you do is, you know, you understand, you know, what what do you care about and who cares about it and what's the scope they care about and what's in it. And then now let's figure out what kind of risk you have with it. And as soon as you can start setting up so my first step is implement a blank risk register if there's not one already.

Yeah. I was just saying and also the sad thing about that, a lot of your execs won't listen to inside people. They could complain to the moon that, like, hey. We need to do something about this. And somebody outside writes a report about it, like, oh, why don't we do this yet?

Yeah. He was a consultant I was working with years ago, and they were they kept saying, I keep getting asked for the companies I'm helping. Why don't you hire why can't we hire you to come in? He goes, because the moment you hire me, I will be no longer the smartest guy here. You will think I'm the dumbest guy here. Yeah. And I always thought that was pretty funny.

That's a good lesson for the for the anyone that might be listening that's taking that college advice, what to do in college. Just realize that, you know, one of the hardest pills to swallow is even once you get really good at security. Right? If you're on the outside. Right?

Yeah. Yeah. Yeah. I'll pick a point on you. So when you say do a risk assessment Mhmm. Are you talking about actually looking at likelihoods of threats and impacts into that, or are you doing it more from a, like, control perspective? And I think it depends on the size of the company. Right.

I would say that there's no right answer. And I know you had another topic about

Yeah.

Should you do risk assessments?

I'm opinionated on this.

And and, We

should probably we should spend a

whole episode Yeah. Toward the end of this one. But yeah.

Well, just just to quickly answer your question, I think having so I'm I'm starting to read measure anything in cybersecurity to get my, head much more around. You got the book of it?

No. There's a there's a

bookshop behind. Yeah.

Yeah. Get my head around how to, how to continue to improve on the way I quantify things. Mhmm. But, there is there's a nice to 27,001 news group. And one of the folks in it, and it's a Google group, and one of the people in it, is makes makes a great argument for not getting that specific at least until you're a little bit more mature.

Yeah. Right.

And the reason

That's I guess, kind of my point. You know?

That that's yeah. Exactly. Because the reason is, if you would spend a 1000 hours of collected time Yep. Coming up with something that is super detailed and at the level of like a one of your large worldwide insurance companies level of detail Mhmm. For analyzing risk or And you're not

doing a good job patching. You take a week It's just gonna echo that.

And figure it out. And you give it sure. You can't, like, add high, medium, and apples. Right? So they don't make sense, but you can start to carve a conversation of understanding what is riskier than another thing. And at the end of the day, is it gonna drive a different major change or major output?

Right. And that's where I agree risk assessments do help. When you get to a point where you're mature enough you're trying to decide, do we invest in a new EDR solution or a WAF, or, you know, where where do where's the best place for our dollars to go, you know, into there? A risk assessment will help kind of flush that out, but if you're not doing the basics, like, it's and it may be like a gut, you know, risk assessment at that point, but we all know if you're not protecting against phishing attacks, you're not educating users, you're not patching, you're not protecting your border, you're gonna get popped eventually, you know, that type of thing. You'll probably still get popped if you do all those.

I always want better language in the risk space. Right? Because, like, the risk word is, like, way overloaded, and you probably see probably go see this with different clients. We see it all the time. We're, like, someone's like, I want a risk assessment. It's like, okay. Well, what do you want? Like, the academic risk assessment? Do you actually need a controls assessment? Do you want a pen test? Like, because risk is a whole bunch of different things, and depending on the context Right.

Because and so I I

think our language is really poor here. We're talking about a generic risk assessment. I don't know if they still use it, but there's this thing that E and Y had a a long time ago. And they they they framed it the what could go wrongs, the WCGW. WCGW. Oh, okay. And I always loved that for, like, the initial risk assessment or the high level thing. It's like, look. I seem to know what could go wrong. Yeah.

a really good point. And when we do a more detailed risk assessment, the first thing we actually do is a threat assessment.

Exactly. Right.

And that's what what what what can impact you. Yeah.

Yeah. But So Yeah.

What that's good. We we should dealt we should do a whole session on risk assessments and

talk about why. Of the, methodologies and all the frameworks and everything like that.

And why not throw them all away and just do something that works?

Yeah. Right? For sure. Cool. Alright.

Is this is this a wrap?

Yeah. I think this is a wrap. Alright. This is a good hour and everything. So Cheers. Thank you, gentlemen, for doing this. Thank you, audience, for joining us. This will be released, here, and we're aiming to do a once a month podcast. So join us next month as we dive into a number of these, topics and everything. Don't forget to, like and subscribe and comment, you know, if you really enjoyed it or you have any other topics or questions for us. And that's a wrap. Thank you all. Bye.

You know what I think we should do on a camera? You could clip this part back in since we're all still mic'd and Yeah. Everything on is, we should how about we review with each, with each episode? Yeah. Yeah. That's what I'm thinking. Some something, like, acknowledge what we got sitting here because and then why we picked it, the name of it Okay. And and stuff. And a few

I think it's a great idea.

Read the name, Kentucky straight bourbon and guided by wisdom and craft with knowledge.

Where is it made? I like that. Distilled in Kentucky bottled by Kentucky Owl. And I'm gonna butcher this name. I apologize for everyone who lives here and nearby here. Lacassine, Louisiana.

Yeah. Yep. So this one I bought down in Kentucky. They don't have it in PA here and everything. Hopefully, that's not illegal. Spoiler alert, you guys. Yeah. But, yeah. So I mean, from a notes perspective, does it say oh, okay. It's 91 almost 91%. Yeah. 90.8% proof. This is great. I love this. Yeah. It's nice and smooth. Yeah. Good caramel notes and everything.

And and for anyone who's listening just for the whiskey review, I would describe us as people that drink a lot of whiskey, but in no moderate to low amount about whiskey. Oh, okay.

I think Justin knows more

than that. I would rather I definitely like the the moderate category for sure.

Yeah. Yeah. That's fair enough.

Yeah. We're not we're we're not distillers and we're not the guys that have, like, the bourbon channels that are 50 gazillion videos deep that Yep. Have distilled since they were 2 years old somehow. Right.

In the hills of West Virginia. Right.

Hey. Well, cheers again. Cheers.

Cheers, guys.

This was good. This is great.