Fireside Chat w/Jack Kaiser, Red Team @ Albertsons Companies

[00:00:00] Hello, hello. We're starting to get everybody organized to have this fireside. [00:00:10] So jump on in and we'll start in a few minutes. [00:00:30] I hope everybody is having a wonderful Wednesday. [00:00:50] Jack, I'm going to make you a moderator as well. [00:00:58] Welcome Hussein. [00:01:00] Good evening Lisa. How are you? [00:01:03] I'm good. How are you tonight? [00:01:05] Good. [00:01:07] Hey, Kesar. Oh, Jack, sorry. [00:01:16] Hey guys, can you hear me all right? [00:01:18] We can hear you great. Soundcheck is fantastic. [00:01:24] And just for anybody who's joining, be aware that this is going to be enabled for replays. [00:01:31] So this will be available for people to listen to at a later time. [00:01:38] So if that's something that you don't want to participate in, you don't need to speak. [00:01:43] But we are excited to be able to offer that to lots of people who might not be able to attend [00:01:48] at this particular time. [00:01:50] Good evening, Russell. [00:01:54] Hussein, Lisa, how are y'all doing? [00:01:58] So good to be here again tonight. [00:01:59] It's good to see you. [00:02:01] Good thing we didn't try to open the room last night. [00:02:06] I know, Hussein, I was the same way. [00:02:08] I thought, okay, I can't wait. [00:02:09] We're going to get to your thing and have so much fun. [00:02:12] And just like you, I thought, oh, wait, it's like a day early. [00:02:16] So, yes, very eager. [00:02:18] Jack, always good to see you and looking forward to getting to know you a little bit better tonight as well. [00:02:23] Good evening, Miss Katie. [00:02:28] Where's Katie? [00:02:31] Oh, hello. [00:02:32] Hi, I just popped into the room. [00:02:34] I was finishing up in the Security Mindset Club room. [00:02:37] So sorry, I usually am. [00:02:39] Hey, listen, 7-0-1. [00:02:42] I mean, that's not bad. [00:02:45] There's no apologies here tonight. [00:02:48] No apologies. [00:02:50] We're just glad to have you. [00:02:52] Thank you. [00:02:53] Yeah, good evening, everybody. [00:02:54] I'm assuming everyone was just going around and just saying hello real quick. [00:02:57] We were just about to get started. [00:02:59] I wanted to give everybody a little bit of time to get here and then we can start kicking off. [00:03:03] But since it is 7-0-1, we will start rolling with this particular round of the Fireside Chat. [00:03:13] A couple of things that you should know about if you're new here. [00:03:17] Welcome, welcome. [00:03:18] It's exciting to have you. [00:03:21] A couple of ground rules. [00:03:24] The discussion topics are our own personal views. [00:03:27] They do not represent views of any past, present, and future employers. [00:03:31] And I know that caveat applies to a number of us here. [00:03:35] Please, please, please keep this a friendly and open zone. [00:03:40] But that means no vendor solicitation. [00:03:43] If you have a great product or service, now is not the time or place. [00:03:48] So that's one of the ground rules. [00:03:50] And last but not least, have fun. [00:03:53] This club is about learning, educating, sharing, mentoring, building new professional relationships. [00:03:59] And the goal is to have fun discussing these topics that we're passionate about and making sure that we have an open and engaging forum. [00:04:10] So if you haven't joined us before and this is your first time, click on that little greenhouse at the top of your screen and join the Fireside Chat Club so that you'll be aware of when things are coming up. [00:04:24] Tonight, I am excited that we have Jack with us, Jack Kaiser. [00:04:29] And the run of the show for tonight is we're going to have the mods introduce themselves, saving Jack for last. [00:04:37] And then we will be asking Jack his origin story. [00:04:41] How did this all come about? [00:04:42] So first, I will say my name is Lisa Beth Lentini Walker. [00:04:46] I run Lumen Worldwide Endeavors, which is a compliance ethics and corporate governance consulting firm. [00:04:53] I teach law school in the United States and Europe, and I've written a book on these topics. [00:04:58] And I'm just excited to be here because Wednesday nights are my favorite nights. [00:05:02] So, Hussein, you want to go next? [00:05:04] Thank you, Lisa. [00:05:06] Hussein Zayed, CISO here in New Jersey at RWJ. [00:05:09] The same disclaimer, Lisa mentioned applies to me as well. [00:05:12] Over to you, Russell. [00:05:14] Thank you, Hussein. [00:05:16] And Lisa Beth, it's my favorite night of the week as well to get to hang out and learn from each other. [00:05:20] Russell Eubanks here. [00:05:21] Last couple of years, I've been able to speak for myself and running my own company, Security of Rafter. [00:05:25] Before that, I was privileged to be the CISO and the CIO at the Atlanta Fed. [00:05:30] But Katie, so glad you're here. [00:05:32] Over to you. [00:05:33] Hi, everybody. [00:05:34] Good evening. [00:05:35] I'm Katie Hanahan. [00:05:36] I am the VP of Cybersecurity Strategy for a Boutique SI out of Chicago and also run their VCSO program. [00:05:44] So I'm a VCSO as well, wear multiple hats. [00:05:47] Yeah, I enjoy this room too. [00:05:48] Every single week, it's really the, we dig into the human factor and origin stories and things that we don't dig into in a lot of my day-to-day and spending time, you know, in the weeds sometimes. [00:06:00] So this is such a great room. [00:06:01] I'm really looking forward to the conversation. [00:06:03] Thank you all for being here. [00:06:06] Well, fantastic. [00:06:08] So I think that's your cue, Jack, to start telling us a little bit about you, what brought you to this profession, and what are you all about? [00:06:19] Sure. [00:06:20] Hi, everybody. [00:06:21] Are you able to hear me clearly now? [00:06:24] You sound good to me. [00:06:26] All right. [00:06:27] Yeah, I had to switch off the headset because that was not happening. [00:06:32] Well, I will say, as far as you, are you talking about background specifically, IT security, or just in general, to begin with? [00:06:41] You can take this where you'd like to go with it. [00:06:44] Some people go deep into like how, what makes you tick. [00:06:49] So you have the floor. [00:06:51] Sure. [00:06:52] So part of the, also the reason I do lazy gamers, because I, for my hobbies, it's mostly video games and stuff of that nature. [00:07:01] So I probably been messing with technology and computers since elementary school. [00:07:07] My first, I think, Windows device was Windows 311 for work groups with my good old 486. [00:07:16] As well, I realized, even though it wasn't at the time realizing it, I had played around with a Commodore 64. [00:07:24] And because I didn't know file names for games I was trying to play on the particular device, I found out about using the wild card for loading files, not knowing exactly what it was until years later that I just somehow figured out that that makes the things play that I can't figure out. [00:07:41] Outside of that, I was heavily on the computers around the dial up days. [00:07:50] Back when Napster was first coming out, I used to use something called Direct Connect plus plus. [00:07:55] Back when RealPlayer, if anybody remembers RealPlayer was real popular, and I would spend days downloading Dragon Ball Z fan sub episodes through those where I would get like one or two episodes. [00:08:07] It would take like more than a day on dial up to get those through different chats and IRCs and things of that nature many, many moons ago. [00:08:18] Outside of that, I'm sad to say in high school, the first time I was able to afford my own personal computer, it came with Windows ME, which is sad. [00:08:32] If anybody used Windows ME. [00:08:37] Let's see, outside of that, in high school I was in marching band. [00:08:44] I actually ended up being a music major for a short time in college. [00:08:49] And what some people know about me and some people don't know about me is I actually went to an HBCU, even though I am clearly white. [00:08:57] It's an interesting thing that I've brought up in different jobs, especially when I don't normally broadcast it in certain professional environments. [00:09:05] And then when you have those happy hours or things of that nature, it's always a nice conversation or shock to PMs that I've had, like for Accenture and other companies where I don't talk about it in the work. [00:09:15] And then 10 months later, we have some social event and it just randomly comes up. [00:09:22] Let's see, outside of that, in the school I went to is a Bethune-Cookman College for computer engineering. [00:09:29] Let's see, as far as IT, my first experience with it, even though when I was doing engineering, I wasn't super interested on the engineering side. [00:09:39] I actually kind of started liking the IT side of things. [00:09:42] I did work study in college. [00:09:45] For a couple of years, that's where I kind of learned the IT help desk, things of that nature. [00:09:50] Back then, for whatever reason, I started using, getting into Linux a little bit, using a distro called Sabion, which is a Gentoo-based. [00:10:00] It leads enough to where I would really install bin files. [00:10:06] I would play around with flags and manually compile everything from Firefox to whatever application you think of, where I spent like five hours installing one application just playing around the different flag configurations. [00:10:25] Outside of that, of course, I grew up with, I'm lucky enough to have, my sister worked at a Babbage's software, which is like a gaming company, kind of like a game store. [00:10:35] Now a days, which is probably where I got my love of my games, playing family, playing on the old Dreamcast, N64, Nintendo, Super Nintendo, basically any system that was out back in the day. [00:10:52] Let's see, for, hold on one second. [00:11:02] It doesn't help that my kids are in the background. Sorry about that. [00:11:05] That's okay. We've got plenty of kids in the, in the moderator crew. So, totally understand. [00:11:12] Yeah. So, I'm actually in the DC area now. I've been in the DC area probably for about 10 years. [00:11:19] I grew up in Columbus, Georgia, went to school in Daytona Beach, Florida. After leaving Florida, came up to DC, had my first son up here. [00:11:29] It's kind of like the whole reason I even stayed in DC this whole time is because I have children. If I didn't have children, I probably would have moved many, many, many, many years ago. [00:11:37] Well, as a mother who's had one child born in the DC area, I, I know what life is like up there. So, thanks for such a robust kind of background. [00:11:52] So, let's talk about today. So, today you are working for Albertsons. What do you love about what you do and, and, and red team activities? [00:12:05] Sure. Definitely. I will say this is my first quote unquote job where I technically was on a red team or the red team that we're actually building here for my company. [00:12:15] I've done a lot of blue team sock work and kind of worked at companies like hedge funds, law firms, worked in socks and stuff before where I did a lot of defensive or blue team type positions. [00:12:30] But what I noticed over the years is I would use a lot of what are considered red teaming tools or more traditionally tool sets that Pentestrian would more to show proof of concepts or things of that nature to kind of push agendas as far as, you know, pushing management into fixing things quicker rather than later. [00:12:53] And then eventually what that turned into was I got tired of pointing things out using tool sets. [00:13:02] And then basically a pen tester, we would pay a third party to come out here and they would run majority of the same tool sets or something similar, provide similar findings. [00:13:11] And then we would fix it because a third party came out and did it versus someone internal, which was always frustrating. [00:13:17] And then we would say, oh, sorry. [00:13:21] Go ahead. [00:13:22] Oh, no, sorry. [00:13:23] And that's kind of what pushed me here for Albertson. [00:13:26] So with this organization, I'm very happy the organization I'm here with now. [00:13:31] We are doing a lot of growth, building out teams. [00:13:34] We've been doing a lot of growth over the last year and continue. [00:13:38] We'll continue to do that. [00:13:39] What I do like here on the red side of things is I have a wealth of knowledge and experience and the people that work with us on the defensive side. [00:13:48] So what I've kind of liked here, at least with the culture from the red side of things, is I work very closely with incident response and the defensive people whenever there is some no vulnerability or something that is concerns of ours that we're trying to drive home. [00:14:03] Like, is there an actual known exploit for it? [00:14:06] How easily would it be to run in our environment? [00:14:08] What kind of damage could that do? [00:14:10] A lot of times I'll do engagements where they'll say, hey, we've detected this in the environment from a vulnerability sample or things of that nature. [00:14:17] Can you do a POC of this within a test environment? [00:14:20] Write up a report on that. [00:14:22] A lot of things I do as well is heavily focused on attack surface. [00:14:27] So, like, my first month or two here, part of what I did was literally was like, all right, cool. [00:14:34] So we are, this is our domain. [00:14:37] Knowing that, that's all I'm going to tell you. [00:14:39] Find out everything you can find about the organization. [00:14:42] Having known nothing about the organization, you have a month or two to use whatever tool set, whatever you want to do. [00:14:48] If you need a tool you need money for, awesome, let us know. [00:14:51] It was kind of like a learning experience in working with a lot of other people from different companies. [00:14:57] People like consultants from Lars, if anyone is familiar with them, and a couple other pen testing consulting companies. [00:15:04] I just kind of have learned their mechanisms, their tool sets. [00:15:09] I've gotten really well at recently documenting processes that I think we do and kind of just making full workflows where if I get to a certain bit of data or I find a certain step in my process, [00:15:20] where I can naturally progress from there from a tool set or kind of just kind of versus kind of just all over the place, which some people kind of do and I've been known to do at times. [00:15:36] That's a great perspective. [00:15:38] And I'm sure that there are many people who have, you know, wondered whether they prefer to be more proactive or more reactive. [00:15:45] And I totally hear you when you're saying sometimes just knowing that there's a problem and having to pay gobs of money for a third party to basically regurgitate what you already know can be a bit frustrating. [00:15:56] So thanks for sharing that. [00:15:58] I'm going to pass it over to Hussein to ask questions from your seat. [00:16:04] Thank you, Lisa. Welcome on board, Jack. [00:16:07] So my question is a bit different. [00:16:09] Can you tell us something about Jack Kaeser outside of gaming and pen testing and computers? [00:16:18] What does he like to do so that people can know who you are and appreciate your being Jack? [00:16:25] Thank you. [00:16:26] Um, I'm well outside of well, it's not directly, but I guess technology related. [00:16:31] I, I tend to pour myself into anything or any interest I like outside of security. [00:16:37] I'm into crypto building computers, built mining rigs. [00:16:44] I like to take things apart. [00:16:46] I like me and my son like to practice our lock picking. [00:16:51] I took him to a lock picking village at a B sides, I think about two years ago, locally in the area. [00:16:59] And he learned it and shockingly enough, he's way better at than I am. [00:17:03] So I just find it funny that we will, I say practice on our, my apartment and he can do it like in, I don't know, five seconds. [00:17:12] Um, so it's kind of like, Oh, okay. [00:17:14] That kind of concerns me a bit. [00:17:17] Fascinating. [00:17:22] Yeah. [00:17:23] Young minds, you know, Russell over to you. [00:17:26] Thanks, Usain. [00:17:27] Jack, so great to have you here as you were given your origin story. [00:17:31] Windows 311, Windows for work group, by the way, uh, marching band, uh, B sides showing your son had a lock pick. [00:17:38] I'm like, man, it looks like we're, we're cousins already. [00:17:41] Uh, so, so, so much enjoy the conversation. [00:17:43] And so grateful you're spending some time with us here tonight. [00:17:46] Uh, question for you. [00:17:47] So as, uh, red T on, on the red team, I'm sure you deal with, uh, like CISO types like myself and like some others here on the stage in the room. [00:17:56] What's one thing that you wish security leaders, whether they've got the CISO title or not, knew or understood or could get through their thick skulls, uh, about your art and about your craft? [00:18:08] Um, I, I guess the one thing that I, I kind of, I don't know why, I mean, maybe it's not so much of an issue of other organizations. [00:18:17] Um, so whenever I'm trying, especially if there's some sort of new vulnerability, like whether it's print nightmare or some log for J or anything like that. [00:18:26] The thing that I kind of find that, uh, upper management sometimes don't, again, and some of the other organizations I've been at, uh, previously was more of whenever a new thing comes out. [00:18:37] Um, them just not really properly, I guess having a process to at the very least look at your public facing infrastructure and target that first person just kind of running around with your head, you know, like a, with a chicken with your head cut off, uh, trying to focus on, you know, whatever mechanism you're using to identify to kind of just say a checkbox to say, Hey, we have this done, but then not even willing to put in the time to really understand. [00:19:06] Understand their infrastructure or at least have a good infrastructure diagram. [00:19:11] So like, for example, uh, one thing I like to do, um, or at least like organizations to do is whatever technology or services, applications, things of that nature that you're using from a footprint standpoint, just from your footprint of your organization. [00:19:27] If you have good knowledge of that, what I'll then tend to do is have people focus on looking at security feeds and things like that nature, as far as what you focus on to, or like any, like, for example, if you use a certain firewall technology or something like that, um, being a, being kind of focused. [00:19:46] It's not focused on vulnerabilities and things of that nature that are effective for those versus just whatever the flavor of the month is on vulnerabilities so that when something comes out, you just have no idea what actually would affect your organization. [00:19:59] and just kind of like getting some form of focus on that. [00:20:04] Not to mention, I wish more organizations could do the very simple thing of, [00:20:10] I'll give you an example, MITRE framework. [00:20:14] Everyone wants to check all the boxes to say they can detect and find all the things, [00:20:19] but no one actually validates it, checks it, uses stuff like Atomic Red Team, [00:20:25] Caldera for emulation, simulation. [00:20:26] They just kind of basically take vendors' words that they trust but not verify the claims of all these vendors, [00:20:37] and I kind of wish that people would actually audit their security tools to actually see, [00:20:42] like, are they actually doing the things that they say they are versus just you drinking their Kool-Aid [00:20:46] and kind of just in bed with them saying that you're safe, everything's all fine, [00:20:52] you don't have to worry about it, but they don't actually verify any of the claims a lot of these vendors are doing. [00:21:00] Wow, what a wake-up call for us to not just trust but verify, [00:21:04] as former President Reagan said, famous for saying, [00:21:07] to not just be happy because we've got blinky lights blinking, [00:21:11] but have assurance that can help us hopefully sleep well at night. [00:21:16] Love it, Jack. [00:21:17] Katie, over to you. [00:21:20] Okay, so I have one burning question, [00:21:23] and I hope it's okay if I ask, and it's not too personal, [00:21:27] but what instrument did you play in the marching band? [00:21:32] So in marching band, I played tuba, but I actually also played bass clarinet. [00:21:42] So what's funny is I played both woodwinds and brass, [00:21:47] but I did brass instrument, tuba, in marching band, [00:21:50] and I did bass clarinet in symphonic or classical type symphonic band. [00:21:54] So that's very interesting. [00:21:57] And the reason I wanted to go back to the marching band piece as well, [00:22:02] because, by the way, I love marching bands. [00:22:05] I have football players as sons, [00:22:06] but I look forward to the halftime show as much as I look forward to watching the game. [00:22:11] So, you know, I love that background. [00:22:13] But what I've also noticed is there's a lot of people in our industry [00:22:16] who have both a really good acumen in music [00:22:20] and then a really good acumen in doing the type of work that you're doing today. [00:22:24] Do you see a correlation like that as well? [00:22:26] Is that something that I even have a friend who, as they hire, [00:22:29] they like to ask people what their hobbies are, [00:22:31] and they file it under the, you know, the pro column. [00:22:34] If somebody is, you know, in a band or is, you know, a musician of some kind, [00:22:38] is that something that you've ever noticed a correlation in the industry? [00:22:43] I have. I've normally noticed. [00:22:45] I didn't really notice it more for the industry. [00:22:47] I just was like, for example, I was also super nerdy into math and calculus [00:22:51] and all the advanced whatever things. [00:22:53] I've noticed more of a correlation on that math side and higher, you know, [00:22:58] education side, math complex stuff. [00:23:03] Sorry. [00:23:04] For those in the music majors and things of that nature. [00:23:08] But I can see how, you know, if you just apply that to any technical field, [00:23:11] I can see how that kind of correlates. [00:23:13] I just never looked at it that way. [00:23:14] I looked at it more from the people that are more, you know, [00:23:17] mathematically inclined. [00:23:19] Usually we're also super into music, play some sort of instrument or thing like that. [00:23:23] Yeah. [00:23:25] And I, yeah, and I've seen that as well. [00:23:28] And kind of where I'm going with the rest of the question is, you know, you mentioned, [00:23:34] because we talk a lot about, you know, how do we continue to recruit people into our industry? [00:23:38] And you mentioned you had a really good work study program. [00:23:41] I'd be interested to know a little bit more about that piece of your story as well. [00:23:46] I know you were, you know, a computer engineering major. [00:23:50] So clearly that was the direction you were going to go. [00:23:52] They probably do. [00:23:53] Did they come to you? [00:23:54] Did you go to them? [00:23:55] Just in terms of people who are in that position now, you know, [00:23:58] was it your freshman year? [00:24:00] Was it your senior year? [00:24:00] Those are the kind of questions that I get on a regular basis from people who are coming up [00:24:04] and interested in getting into the industry. [00:24:06] What was your experience around that work study program? [00:24:11] Oh, yeah. [00:24:11] So in all honesty, the work study program was basically me saying, hey, [00:24:15] I have a marching band scholarship. [00:24:17] Marching band takes way too much time. [00:24:20] I need money. [00:24:22] So it was like I need some sort of thing. [00:24:24] And then it just so happened that things aligned. [00:24:27] I was in the computer. [00:24:28] So I went ahead and applied for that. [00:24:31] I probably started doing that my sophomore year. [00:24:34] So I did it for a couple of years. [00:24:36] Or probably the tail end of my freshman year. [00:24:38] And I learned so much on just IT in general. [00:24:41] And I had like a lot of really smart people that was working with me at the time [00:24:45] that had worked in IT for 20, 30 years that I just learned a ton of things for, [00:24:49] especially on Linux. [00:24:50] That's basically where the basis of my understanding of Linux and kind of where I [00:24:54] kind of fell in love with that. [00:24:55] And even to this day, I personally use Ubuntu as my host OS on a lot of my [00:25:00] personal devices. [00:25:06] Yeah, I appreciate that. [00:25:07] Yeah. [00:25:08] And I think that that's as we move forward in our career, a lot of those fundamental [00:25:12] pieces of our DNA, I guess, in the industry happen in those first three to four years [00:25:18] of our career. [00:25:20] So, yeah, I find that really fascinating. [00:25:22] And also just the fact that you actually it was some of it was a fiscal reason, too, [00:25:27] because we also hear about people struggling to find opportunities for education in this [00:25:34] field. [00:25:34] So the fact that you were able to find something like that to help you get through college from [00:25:40] a financial perspective as well is really enlightening. [00:25:43] So thank you for sharing that. [00:25:45] Lisa, I'll also add that on the side, you know how like Best Buy used to have your whatever [00:25:52] amount of money they would charge for virus removals and re-imaging and all that like that. [00:25:56] But I used to like for like, I don't know, it was like 20 bucks flat or something. [00:26:00] I would basically clean people's computers from viruses and stuff of that nature, re-image, [00:26:06] recover hard drive, just do whatever where I kind of just I liked tinkering and I wasn't [00:26:09] trying to like make a ton from it. [00:26:11] I was just trying to be like instead of you going and paying Best Buy 100 bucks, like give [00:26:16] me a couple of days. [00:26:17] Let me know what you're trying to do and I'll just have at it and kind of learn along in [00:26:20] that process. [00:26:21] And that was kind of like a side thing I did until the college was like, you can't do that [00:26:25] because you work for the IT and there may be some confusion from a liability standpoint. [00:26:32] Well, that's interesting too, because now it's like everybody has a side hustle. [00:26:37] But so you're a pioneer with the side hustle. [00:26:39] I love it. [00:26:39] So just to reset the room for anybody who's joined us in the past 25 minutes or so, this [00:26:50] is Fireside Chat. [00:26:53] And tonight we have Jack with us. [00:26:55] We get together every Wednesday at this time and talk to all different sorts of people [00:27:03] from security, privacy, compliance, risk, governance, et cetera, with a strong focus on information [00:27:14] security. So as we usually do, we open this up to anyone who's in the audience who has questions. [00:27:21] Feel free to raise your hand and we can invite you up to the stage. [00:27:25] But before we get started with that, another question for you, Jack, as you're thinking about [00:27:32] how you're continuing to grow and develop in this field, is there anything in particular [00:27:37] that you're doing right now to up your skills and up your game that others might benefit from? [00:27:44] Well, just from a growth standpoint, I will say, and this is something that I wouldn't actually [00:27:54] suggest, I'd actually suggest people go more open source and free solutions. [00:27:58] But anybody who knows me, since the pandemic has started, I, for whatever reason, just decided [00:28:04] I was going to take any SANS course or work study that was ever available to me. [00:28:08] So I'm now actually going to be doing my seventh or eighth SANS course like in the last, [00:28:12] I don't know, two years. And what a lot of people don't know is I actually pay all that [00:28:18] out of pocket only because I figure I'm interested in those and I'm willing to put that money in [00:28:26] that investment into myself. Now, if I were to tell somebody else, I would more likely tell [00:28:31] them there are other methods of doing it. I just know for myself, the benefits I see of [00:28:37] programs like that is if you're like me, I have ADHD. Sometimes I need a structured, like even if [00:28:43] all the information is out there, I need a structured plan that can present it in a way that I can get [00:28:48] through it methodically in a more structured way versus me who I kind of get interested in everything, [00:28:54] blank, you know, blinking lights, scroll over there. I need, I need that structure. So like I've gone a lot [00:29:01] of the certification route. So a lot of people that know me know that I've done just a crap ton [00:29:05] of certifications over the last couple of years. Well, I will tell you, I'm glad to hear that. [00:29:12] As the mother of a child who has some ADHD, it's important to know what's worked for people who have, [00:29:20] you know, matured and how they're able to navigate some of the challenges with focus along the way. [00:29:29] So thanks for sharing that. I'm definitely going to share that with my child. But welcome to the stage, [00:29:34] Jennifer, what's on your mind tonight? [00:29:37] Jennifer H. Hi, Lisa and Katie and Russell and Hussein and Jack. Thanks for having me up. [00:29:43] Hey, Jack, great to see you. And also back to your comment with Katie and the music, the band, [00:29:50] I do see the music is a big math overlay. And so I agree. You do see a lot of people who have played [00:29:57] instruments in the engineering and in this field, which is awesome. And I'm going to ask you a question. [00:30:02] I don't know if this is going to be like in your wheelhouse, but when I'm doing contracts with [00:30:07] companies like vendors and or I'm doing them with customers and we're the vendor, [00:30:11] they want us to report, like we'll put language in contracts. And Jenny and I were having this [00:30:15] sort of this discussion in an earlier room, which is sometimes, you know, legal needs to align with [00:30:20] the business teams to what they're actually doing. And in this, you know, and what's meaningful. [00:30:25] So in this instance, I'll get people who want us to notify them of any suspected and they can define [00:30:31] it as instance or breach. And again, those terms are not always well defined, but my understanding [00:30:39] is that companies are getting hit constantly. And so an obligation to notify your customers of a [00:30:46] suspected instance or an attempted attack would be like a 400 day, you know, 400 times per day [00:30:54] requirement. I just want to get your insight on that. Like what's act, what's real, what's [00:30:58] actionable, what's meaningful. [00:31:00] And I'm sorry, I'm trying to wrap my head exactly on what the, how you're cracking it. [00:31:07] And that's more of me than it. [00:31:08] Yeah. So if I'm, no, no, no, yeah. If you're the vendor, so if you say you're, say you're Albertsons [00:31:15] and you're hiring a vendor, who's going to be handling data. If they're getting hit with malware attacks [00:31:23] or whatever, at what level do you want that reported to you? Like does, is it when there's [00:31:28] an actual, like if you were, what would you consider that in the trust verified is from [00:31:33] the business side versus the legal terms? What would it be material for you to know when something [00:31:38] is actually been breached and there's, you know, your systems are encrypted or data has been leaked [00:31:45] or is it suspected? I find that is a little bit challenging to, to comply with because it's, [00:31:51] it's, you know, how would we notify all of our customers if we suspect a breach when it may not [00:31:56] actually be anything or we don't know what it is yet. Do you, do you have any insights on that? [00:32:00] Like from a business side? [00:32:01] I mean, I guess it depends on your relationship with, with that to go third party. I personally, [00:32:07] if there's suspected breach, I would at least on like some form of heads up, or even if it's [00:32:12] not a hundred percent concrete, especially if, um, now with that, you know, with that assumption, [00:32:18] we're not a hundred percent sure if it's like where they're, they're thinking there's something, [00:32:23] uh, possibly awry, but they're at the level where even, you know, for example, if they confirmed it, [00:32:29] it's not to a level where it is, um, sharing or, uh, putting our particular company assets at risk, [00:32:37] our user accounts or anything of that nature, uh, directly at risk, but it's maybe something [00:32:41] with them as a company. It, I guess it depends on the severity of what the, you know, in the [00:32:49] beginning phases of this detection, right? What severity that would have to us from a business [00:32:54] impact for that so that we can properly prepare. And then even in some cases, um, maybe in instances [00:33:01] engage, depending on what company I've worked for, what kind of business we do, uh, so that we can [00:33:06] possibly help engage with that as we may directly have people on retainer that may handle things [00:33:11] for like our portion. Like for example, if they're hosting, uh, infrastructure for us or [00:33:15] things of that nature, it's kind of a loaded question to me. So it's kind of hard. [00:33:20] That's helpful. The way you're thinking through that and evaluation is super helpful. That's, [00:33:24] that's what I would look at as well. [00:33:29] So that, that was helpful though. Thank you. [00:33:31] Oh, most definitely. That's why I kind of also value, uh, companies like, uh, well, I'm not gonna [00:33:36] mention companies, but I really value risk acceptance or risk, uh, evaluations for vendors. [00:33:42] Although when I've done them at other companies, I dread and hate them. Um, I do like the approach [00:33:48] of also when risk assessments are done and you get a good idea of what level a vendor has, what access [00:33:54] they have into your network, basically what kind of information, if something was compromised with [00:33:59] that particular vendor, would that lead to? And so you have a better idea of what kind of risk [00:34:04] you're taking with that particular vendor so that you can also know, like kind of proactively make [00:34:09] measures to where if you even think there's a possible issue or there's some shadyness from [00:34:13] network wise coming from them or anything of that nature, you have a clean cut kind of, you know, [00:34:18] Hey, let's, you know, look, let's, you know, shut this down and evaluate and then maybe bring in the [00:34:24] vendor and say, Hey, you know, I, I just like, I don't like doing them, but I like what they, [00:34:30] the purpose they serve for doing evaluations for risk assessments for vendors specifically, [00:34:36] because then you have a better idea of what exactly you're exposed to, what they have access to, [00:34:40] and you can properly protect yourself if for whatever reason you have to put something up [00:34:45] to stop that connection or that access. [00:34:47] Yeah, totally. I mean that, and in a perfect world, that would be great. And I totally hear you on it [00:34:52] being a little bit trying and on our side, you know, understanding the risk when we're trying to [00:34:56] define the contractual obligations, but that's super helpful. I like that approach. Thank you very much. [00:35:00] Great. Thanks for that wonderful question, Jennifer. Jenny, good friend of the fireside chat. We are [00:35:10] excited to see you here. Hey, thanks for having me up. And Jack, I just wanted to make a couple of [00:35:17] comments that I also have a question. So my comment is Jack was one of the first people that I came into [00:35:22] the rooms in clubhouse learning about cyber. And I must say that Jack and other men like Tom, who's [00:35:30] also on the stage in the cyber world are very welcoming and very willing to answer questions [00:35:36] for anybody who are coming into this industry. So anybody in the room, please follow Jack because [00:35:43] you know, he's, he's just a gem. And I also would go into rooms when he was working with [00:35:49] Kevin Foster and other people helping others who are going through studying for the various exams. [00:35:55] And I just think his, his work as a mentor really should be applauded because it takes a lot of [00:36:01] time to be a mentor. It takes a lot of patience. And for anybody who is mentoring in clubhouse, [00:36:07] it is just priceless information. So I just wanted to applaud Jack for doing that. And he's just a very [00:36:14] genuine guy. My question for Jack is being that you're on, then you're a red teamer. What's the best and [00:36:22] the worst part for people in the room about being a red teamer? [00:36:30] Selfishly, in all honesty, I'm most excited when there's a new like print nightmare or log project. [00:36:38] I get excited when the new things come out because I like to tear apart the proof of concepts and things [00:36:43] of that nature and figure out how they actually work. On the other side of that, what I hate then is [00:36:49] because I have, you know, I have that general curiosity. I then normally end up being the [00:36:55] person that they want to like explain everything and then tell them how we're going to detect how [00:37:01] we're going to do whatever versus like, well, hey guys, you should probably be looking at this stuff [00:37:04] too, not just me. To where they kind of become reliant on you just because they know you have that [00:37:10] genuine interest, which is fine, which is good. A good use of, you know, your right team, things of that [00:37:14] nature. I just, I know for some organizations, I don't know. I just, I wish from a defensive side, [00:37:21] I'm not speaking about this organization. I just know previous ones I've been at [00:37:27] where I enter, like where I wasn't on the red team, but I interact with the red team. [00:37:31] There's instances where there was an over-reliance on a few individuals versus the team as a whole [00:37:36] collectively contributing in different aspects. And I kind of don't like that because in those instances, [00:37:41] when those one or two individuals would leave those organizations, I am not sure what those [00:37:48] organizations did at that point. Cool. Thank you. And good luck with all your big projects. I'm [00:37:54] excited to hear about it. Jenny out. Thanks, Jenny. Always good to have you up on the stage and asking [00:38:04] questions. Tom, I see you're back again. Would love to hear what's on your mind tonight. [00:38:11] So, you know, this room was always, you know, I've always liked coming to this room because, [00:38:17] you know, you've always had some of the most talented people in here, you know, and I love [00:38:22] the progression of the room. So, Jack, that you're here. Now that I didn't, questions I didn't get to ask [00:38:28] you last week. So, interesting part. What made you go from blue team to red team? Because usually it's a [00:38:37] combination of the both, but also the interesting part of, you know, how you were describing everything, [00:38:44] it's more like you've gone purple team. Were you doing the combination of both, which I think is [00:38:49] extremely essential for organizations? I will say that though I say I've always done blue, a lot of [00:38:57] organizations. I was at smaller companies that I basically was all security outside of whatever we [00:39:05] offloaded to other like VSOCs or things of that nature. So, I truthfully like what you're saying, [00:39:11] I probably was more seen as what you would call probably a purple team. I just, I think for the [00:39:18] red, the general interest of the red team is I used a lot of traditional red team tools and things of [00:39:22] nature. But the parts that never came together for me was the actual workflow. If I was going to think [00:39:28] like an attacker and actually do like an actual pen test or evaluation or assessment, it was the [00:39:36] structure of that that I kind of wanted to learn. Like what that, like, so I can learn how to do, [00:39:40] you know, a hundred things, but I don't, I didn't know how to take those hundred things and logically [00:39:46] chain those together to do say an assessment or a pen test or things of that nature versus just like, [00:39:52] I know how to use a lot of tools. I know how to do a lot of things, you know, play around less up on [00:39:55] GitHub. I guess it's from a structured standpoint, I wanted to kind of piece that stuff together. [00:40:02] And the thing I will say though, that I kind of like with doing red team stuff now is I would do a [00:40:07] lot of education training and stuff like that for like sans or other things like that. But then [00:40:11] I would be in positions where I could literally utilize 5% of what I was learning. So it was always [00:40:16] depressing. And since I've kind of recently got into the more pen testing side, malware analysis, [00:40:22] things of that nature, I like the idea of the ability to use more of that skill set that I've learned and [00:40:30] then kind of reinforce that moving forward versus learn a whole bunch of stuff. Two years down the road, [00:40:35] I've never used anything that I supposedly talked about or did in one of those classes. And it gets a bit [00:40:40] depressing because I was genuinely interested, but then I couldn't apply it to my actual jobs. [00:40:47] So where do you see yourself going in the future? You know, some people want to go for title jobs, [00:40:52] some people stay in that engineering red teaming role. What do you see as a future? [00:40:57] Um, I for a while, because the problem is I'm interested in so much. So like, [00:41:02] I'm heavily interested in threat intelligence. I've always kind of, I've been a little dabbling [00:41:08] interest in like reverse engineering malware. I think the one thing I've been kind of centering [00:41:13] around is maybe like threat research. Um, like some of the people like the workflow organizations [00:41:19] that are kind of like when the new exploits come out or are kind of digging through those or ones [00:41:23] that even maybe do the threat intelligence stuff to kind of see what are the threat actors doing, [00:41:27] uh, find out what, you know, kind of the workflows, see what the new techniques that are getting popular, [00:41:32] report on those. Uh, while my reporting skills and documentation is not the best, [00:41:37] that's something I feel like I've tried to work on recently just because I know it's a weakness. [00:41:41] So it's something I'm trying to address at the moment as well as, uh, get better at public speaking [00:41:48] and kind of speaking in crowds or kind of being more social than kind of being a bit of an introvert. [00:41:54] Yeah. Excellent. Cause those are the biggest problems from people like us, from the red teamers. [00:41:59] We've always hated reports. Then customers always complain. There's not enough details into how you did it [00:42:05] because you're kind of quiet about it. And then the public speaking was always the hardest part because [00:42:12] we're kind of a bunch of, uh, omniverts where we only talk to people who are within our community. So [00:42:19] thank you. [00:42:25] Well, thank you for a wonderful question, Tom. Um, really appreciate you joining us and, and, and for the [00:42:31] support of, um, um, the fireside chats, um, Caitlin, it's good to see you again. We'd love to hear what's on your mind tonight. [00:42:40] Well, thank you for having me. This is, you know, my favorite room to be in on Wednesdays. And, um, the question that I have [00:42:47] is actually tied to a previous answer, um, that you had given. I was just curious coming from another individual who also [00:42:56] has, uh, ADD, ADHD, when you don't have that structure, how do you enforce it? Because that's one thing that [00:43:05] I'm very challenged with. I've struggled recently with one of those, um, you know, four letter certifications [00:43:12] that will not be named that I recently failed. And I feel like part of it has a lot to do with a lack of [00:43:18] structure. So knowing that the world isn't built for, you know, individuals like us who require [00:43:25] structure, who may require other sorts of incentive to drive us to be successful. I'm just curious with [00:43:33] the amount of success that you've had in your career, how do you drive yourself to be successful [00:43:39] in, you know, other instances or ways that, you know, we may encounter business situations, work [00:43:46] situations or certifications that aren't set up with the kind of structure that, you know, what, [00:43:51] what nowadays we would consider neurodivergent individuals require to be successful? [00:43:57] Sure. No problem. I mean, I, in all honesty, um, and it's off and on thing for me, I'm super into [00:44:03] to-do lists. Um, there's been parts of my life where I would create to-do lists for working out, [00:44:10] for getting through my backlog and video games for just basically every aspect of my life. Because if I [00:44:15] don't, I'll spend like a couple hours on YouTube or TikTok or something like that. And I'm like, [00:44:20] well, I could have perfectly done all these other things I wanted to do. And, uh, again, [00:44:25] to-do lists is very important. Um, from like, even from the, the, the, uh, certification training. [00:44:31] Um, so many, many years ago, uh, I think I can remember the name of the guy who wrote the book, [00:44:36] um, kind of like get certified in 30 days or something. I think it was something Dixon [00:44:40] on his site. He had like, if we're just talking about certification training wise, right. [00:44:46] He had like a get certified in 30 days where he kind of broke down, like going through like the [00:44:49] manual or books for like your, you know, say CISSP, CCSP security, plus things of that nature. [00:44:54] Um, and I kind of took his kind of rough scheduling and I adapted that to something that works for me. [00:45:02] And then with that, his stuff was totally focused on maybe getting through the book material and [00:45:09] practice tests. And then what I did is I would then incorporate, um, doing multiple forms of media. [00:45:14] So like I was very heavily in cyber area since like probably 2018 where I started on the platform [00:45:20] as a learner and then later became a mentor, um, for them. And what I would do is I would, you know, [00:45:26] make a to-do list, make a plan for how I get through, like, say my study guide for security plus [00:45:30] or whatever the certification is. And then also along with that supplement that with video training. [00:45:36] Um, and then also for me, and I don't know if it's for you or anybody else. Um, I get very easily [00:45:41] distracted, especially if I'm reading technical documents or anything that requires super concentration. [00:45:47] Um, what I actually found was helpful for me is I actually have this cheap little Kindle fire [00:45:53] that does text to speech. So whenever I got my certification books, what I used to always do [00:45:58] is I would get them on Kindle or get them somewhere that I could send it to my Kindle digitally. [00:46:04] Um, and then when I was reading it, I would do text to speech with headphones [00:46:09] so that that way I was basically kind of reading it to myself. So [00:46:14] audio, you know, from an audio standpoint, I'm hearing it. [00:46:17] So no outside noise can distract me. I'm visually looking at it. So I'm kind of trying to use multiple [00:46:22] senses to concentrate on the thing I'm doing. Cause like even back in college, when I would read like, [00:46:27] you know, electronics books and stuff like that, I could read a chapter and remember like five words. [00:46:32] I couldn't remember anything because I just didn't have that concentration to retain. [00:46:36] So I kind of just kind of sensory overload, try and make sure I have as many [00:46:40] ways of being exposed to material and hands on and things of that nature. [00:46:45] And especially just with, if you're just talking about books or studying, [00:46:48] I really prefer digital with the text to speech, just because I can put headphones on and I can kind of [00:46:54] have literally drawn everything out. Like most of my certification training back when before COVID, [00:47:00] I would literally do all my studying for like CSSP and some of that literally on the metro in DC, [00:47:04] going back and forth from work. I would just do that, listen to that and kind of drown everything else out. [00:47:10] I'm going to apologize in advance because I'm going to bother you after this conversation, [00:47:14] because there are a couple of things that I need to learn from you with regard to what you just said. [00:47:18] So thank you in advance. [00:47:20] Alan Reeves Oh, no problem. What I always will say is the best way to actually reach me is [00:47:25] LinkedIn because I actually check the notifications more than I do anything else. Just because [00:47:30] stuff like Slack, Discord, Signal, all that. I'm in too many rooms and too many things that I [00:47:37] eventually just, it becomes like an inbox the whole bunch of unread. But LinkedIn doesn't at least yet. [00:47:43] So I'm usually more responsive there. [00:47:48] Thank you so much for answering that question. [00:47:51] And I think we all got a lot out of it. [00:47:53] David, it's always good to see you here, sir. [00:47:57] Welcome to the stage and let us know what's on your mind. [00:48:01] Thank you, Lisa. [00:48:03] And Jack, really, really good feedback on the ADH scenario. [00:48:12] I think it's just great how you handled it and how you were able to just focus through it and use the tools that you use. [00:48:18] I'm a fellow clarinet player and also like that whole idea about being the musical connection. [00:48:27] The question I had for you was earlier on, you were mentioning that sometimes higher ups or whatever executives or people up above in whatever role that you're in didn't always validate the tools that they were. [00:48:39] I hope I'm quoting you correctly, the tools that they acquired from vendors and didn't validate them or validate the usefulness, effectiveness or the solution that they had proposed. [00:48:51] Do you think that's because, one, they're dealing, systems or whatever, are dealing with this whole level of, what would I call it, impossibility, dealing with the unknown? [00:49:04] Because I don't know how they're going to attack me next. [00:49:06] I don't know what they're going to do, what they're going to use, how they're going to use it. [00:49:10] Or is it just that they can't see, they don't have total visibility or is it the fragmentation of all the tools that they have? [00:49:16] So, you know, what's the problem and how do you think, you know, we can get through that, all that confusion to get to them to understand, hey, this is necessary and it's required. [00:49:31] You know, this is, you know, just because I purchased a company, I got to another tool. [00:49:36] Now I got to keep that tool. [00:49:38] How do you help get through all that maze and get to helping them understand the reality of what you're, you know, of what they're really dealing with in the secure environment? [00:49:47] I hope I asked the valid question. [00:49:48] Yeah, I'll try and answer, I may have diverged a little bit from what you're probably asking, but one thing, at least recently, that I really wanted, and I've kind of mentioned it, people have been running before, I've mentioned before, is like, for example, one, there's going to be a lot of overlap in the tool sets people are using. [00:50:05] So there's, you know, everyone's basically trying to be your Swiss army knife where they may be good at two things and then they branch out to do five other because they want your business in those type of things. [00:50:13] So you're going to always have some overlap in tool sets. [00:50:15] The one thing that I kind of wish a lot more companies do, which I just feel like a lot of them don't, but seems almost to me, just seems like a simple thing to say, and then, like, then the part is actually planning it, is there's a very simple thing people can do for, I guess, a low-level version of, like, threat modeling, right? [00:50:32] So if you're familiar with Mitre Navigator, I can't remember, there's another tool set that basically creates layers for that as well. [00:50:40] I can't, I'm blanking on the name at the moment, but, like, a very simple thing to kind of get an idea of how well you're protecting or what you can detect and or prevent is if you look at, say, like, I'll use my industry, I work in retail. [00:50:53] So if I know when I look at Mitre, for retail, the main ATPs that target us would be, like, think of FIN 6, FIN 7, FIN 8. [00:51:02] So a very simple thing you could do is literally take Mitre's Navigator, create a three-layered approach where you look at all the TTPs that are used by the threat actors that primarily focus on your industry. [00:51:15] And then when you're evaluating your tool sets and your visibility, verify at the very least that you're focusing on the tactics of the mechanisms that the attackers that would normally primarily attack your industry, [00:51:32] that at the very least you are correcting the right kind of logs and have the artifacts and the data to detect, if not prevent, those kind of attacks. [00:51:42] And then that's where I was mentioning stuff like there's Atomic Red Team, Caldera for some simulation things of that nature. [00:51:49] I just wish organizations would do that. [00:51:50] And, like, even when you're evaluating security tool sets, maybe, like, well, this one claimed to do X, Y, Z, this, that, whatever. [00:51:57] Like, well, the normal person that would target us, what are the kind of mechanisms they would do? [00:52:01] How well, if I were to emulate or do some simulation of these kind of tactics, do these tools even pick up on? [00:52:08] Or how much would they false positive? [00:52:10] Do they even have the right kind of, like, telemetry data? [00:52:12] Do they have the right kind of data to properly, like, for you to tune it? [00:52:15] Or is the data, like, not that valuable or not at a level? [00:52:20] Like, I'll give an example. [00:52:21] Years ago, there was a, not Hashcat, or I'm sorry, there was a hash dumping tool that was, like, remote. [00:52:30] I can't remember. [00:52:30] I'm blanking on the name of it. [00:52:31] But, like, I would use one of the EDR solutions we have, and I would be able to do it every time and dump credentials. [00:52:37] And my EDR, which is, like, one of the big name EDRs, you, like, never pick it up. [00:52:43] And then what I ended up eventually finding is just when I would literally do it over and over again, I would look at the, how much data, or, like, I would look at the telemetry data, right? [00:52:52] As far as what exactly is big enough to see if I could write some sort of rule for detection. [00:52:55] And I just realized, oh, it's because this company sells a base level. [00:53:02] And then they sell, like, their threat, whatever, hunting, you know, whatever portion of that that has all the extra telemetry data that is actually valuable for finding a lot of the tool sets that I would use or be interested in finding and doing detection things on. [00:53:18] But you would never know that because they're, like, they're that big name and they're, you know, whatever they're known for. [00:53:23] But as well as me, I sometimes get vendors also would kind of get mad at me as well because, like, when I would tune EDRs and things of that nature, I'm a person from an engineering standpoint where I turn on all the bells and whistles, every capability of things, beaconing anything you can find in audit mode. [00:53:39] And I would just look at the ocean of data there. [00:53:44] And then I will just, over time, slowly carve out what is important to me, what is, like, okay, then that's not really that relevant, things of that nature. [00:53:54] And I'd rather take that approach than, like, do the base level configuration that, like, a lot of the vendors will push towards you because they'll have a lot of capabilities. [00:54:05] And what I even found, like, one of the vendors I used previously is I was doing that and I would just notice on the back end, they would do on-the-fly stuff that would break some of the features I was using. [00:54:14] And I would report it and they're, like, no one else is reporting. [00:54:17] I'm, like, I don't know what to tell you, but you broke this or whatever. [00:54:20] And they'd be, like, oh, yeah, well, only, like, 1% of our people even use any of these features. [00:54:25] I'm, like, okay, well, I'm 1% and I'm your customer. [00:54:27] I still put you to not make changes without, like, literally they would make changes on the fly where it's not even a version change. [00:54:34] It's not whatever. [00:54:35] They just changed and broke something to where, like, I had something I was, you know, getting in audit mode and not preventing. [00:54:41] And I would write an exclusion for and then they would just ignore my exclusions. [00:54:46] Interesting. [00:54:48] What a great feedback. [00:54:49] What a great response. [00:54:50] I think that was just covered everything I was thinking about when I was conjuring that question. [00:54:55] But thanks very much, Jack, and kudos to you for being who you are, where you are. [00:55:01] Again, I appreciate your response. [00:55:02] Thanks very much. [00:55:03] I'm finished speaking, Lisa. [00:55:05] Thanks so much, David. [00:55:06] It's always delightful to have you join us. [00:55:10] Just as a quick room reset, we are almost at the top of the hour. [00:55:15] We generally try to wrap these things up about 30 past what would be 9 o'clock on the East Coast. [00:55:25] But if you have questions, again, feel free to jump up on stage and ask your questions. [00:55:32] Moderators, you're also allowed to ask extra questions towards the end. [00:55:36] This is the fireside chat. [00:55:38] If you haven't followed us before, welcome. [00:55:40] We enjoy having lots of new people here. [00:55:44] Follow us by clicking on that little green house at the top of the screen and joining the club so that you can be aware of upcoming events. [00:55:53] We have loads and loads of them. [00:55:55] Feel free to reach out to any of the moderators if you're interested in being in the hot seat. [00:56:01] And, Henry, thanks for joining us tonight. [00:56:06] What's on your mind? [00:56:08] Hello, Lisa. [00:56:08] Thank you for acknowledging me. [00:56:11] And, Katie, thank you for inviting me up to the speaker side of the house. [00:56:15] Jack, good to connect with you on LinkedIn this morning. [00:56:20] So I'm glad to see that you're doing just fine and you're, you know, I'm giving us a great story here. [00:56:27] So I appreciate that time. [00:56:30] You mentioned earlier Commodore 64 and Windows for Work Groups. [00:56:34] And it kind of took me back in time because I'm an IT veteran myself and I have some great memories as you were mentioning those technologies. [00:56:45] And my question is, as you've evolved through IT and, you know, in your career, when or how did you kind of get steered into the information security, cybersecurity side of this house? [00:57:03] Okay. [00:57:03] Yeah. [00:57:04] The way, and I kind of wish I'd moved into security a little sooner. [00:57:08] I will admit that I did contracting work for six years or so for government contracts for IT and kind of was just got complacent in that. [00:57:17] What ended up changing that for me is I went to go work for a managed service provider and locally in the area. [00:57:24] While I went to go work for them, I worked for them about close to four years. [00:57:28] While I was there, I had great mentorship within that company from all aspects. [00:57:33] I was like, so before that company, I had never touched a server, knew nothing about Active Directory, knew no GPOs, no firewalls, no anything. [00:57:40] And I basically learned all that side of the house, managing all of that. [00:57:44] And like even for one of the companies we were supporting, I basically built out their whole security stack, moved into a tiered AD model, would evaluate all the pen testing reports we do and do the actions on those with the CTO and things of that nature. [00:57:58] And luckily enough, some of you may know him. [00:58:01] I was able while I was at that company to get a wonderful mentor in Terrace Jackson, who is now with Microsoft, formerly CISO for Thycotic. [00:58:11] So like through the years, he's kind of been like a big proponent for me and kind of, especially when I was working at the MSP, he was very quick to be like, all right, here's an article. [00:58:21] Go figure this out. [00:58:23] I was like, awesome. [00:58:24] Cool. [00:58:24] You didn't need to say a word. [00:58:26] And even a funny story with that MSP, and I think that's what may have driven the way I approach certifications, is you know how when you're working for a managed service provider or IT, [00:58:37] and some vendors will say, hey, if you have X number of certified engineers or advanced, whatever, for our testing stuff, you get a better rate and all this other stuff. [00:58:47] I used to basically, even if I didn't really touch the tools that much, I would volunteer for a monetary fee to basically study up on whatever technology thing we needed, [00:58:59] a quote-unquote advanced or whatever type of engineering for. [00:59:02] And I would do that, take the exams, pass them, and do that for the company so we could get that status for those things. [00:59:08] And that kind of made a bad habit of me kind of methodically approaching certifications and trainings and things of that nature. [00:59:15] That kind of came from that before I even started getting into the security certifications. [00:59:21] Awesome. [00:59:21] So that led you into this role here with Albertsons? [00:59:26] Well, you mean for the pen testing side? [00:59:29] Well, I've been doing security. [00:59:30] No, on the cybersecurity side of the house. [00:59:32] Yeah, so in cybersecurity, security stuff I did, what was that MSP? [00:59:38] Once I did a lot of security, like, you know, base level, like kind of touching all aspects of it. [00:59:42] From there, I went to do, I worked at a government SOC doing vulnerability management, managing web app security, database security, net tenable, things of that nature. [00:59:52] Then I kind of did security analyst role at a law firm. [00:59:56] I worked at a defense contractor for a while doing Azure, fentanyl, sim, playbooks, architecture type stuff. [01:00:06] And then I eventually ended up landing where I am now. [01:00:08] So I've done a gamut of a couple other little things all over the place, but mostly on the engineering side. [01:00:14] And this is like the first time I've actually done anything specifically leaning more towards the red team specifically. [01:00:19] Most of my other stuff has been more of an engineering side of things. [01:00:22] Right, but that gave you the, I guess, the foundation to kind of get where you are today and continue in this role as more, you know, CISO type role as opposed to the engineering roles that you were in before, correct? [01:00:38] Correct. [01:00:38] But I mean, I'm definitely in more of a, I'm not a CISO type role. [01:00:42] I'm just a security engineer. [01:00:44] Okay. [01:00:44] But I mean, we're building out a red team. [01:00:47] So I am the beginning of the red team we're building out here. [01:00:50] So as we build that out, I'm helping develop that for the company itself. [01:00:55] Awesome. [01:00:56] Well, thank you for your response and for being on here today. [01:01:01] Yeah, I appreciate your questions. [01:01:05] Fantastic. [01:01:05] So thanks for coming up to the stage, Henry. [01:01:08] Ryan, you have been waiting so patiently. [01:01:12] We're thrilled that you have decided to raise your hand and kind of come on up to the stage. [01:01:17] What's on your mind? [01:01:19] Thanks, Lisa. [01:01:19] Appreciate that. [01:01:20] I think this is like my fourth or so, maybe one or two more fireside chats. [01:01:25] Just want to say loving, loving this. [01:01:28] Looking forward to this as always. [01:01:31] Jack, nice to meet you. [01:01:33] Thanks for sharing. [01:01:34] You know, I have to admit, I did have to step off for like a minute after you started introducing yourself. [01:01:40] So I hope I didn't miss too much. [01:01:42] But I was listening to some of your answers about how you want to get more into like threat research and just kind of going down that avenue a little bit more. [01:01:52] And I was just curious with what you're doing with like pen testing and being, you know, with Albertsons and thinking of like the supply chain risks with food and then, you know, digital modernization that may or may not be going on. [01:02:09] Right. [01:02:10] And just like the world we live in. [01:02:12] And I'm curious, I guess, my question's a little bit around like a, you know, how are you identifying some of the ways that you would do these pen tests? [01:02:19] Right. [01:02:20] So like that's a really generic question. [01:02:22] What I'm trying to say is, you know, like I think I just saw two weeks ago there was more so a food manufacturer I thought was hit with a cyber attack. [01:02:30] And that may have hit their production. [01:02:33] So that may mean, you know, maybe Albertsons doesn't have potentially their snacks if they did sell them. [01:02:38] Right. [01:02:39] Is that somehow kind of in your view or are you really focused on just like Albertson only IT? [01:02:50] And then like kind of stretching the question here is like, if you wouldn't mind, I'm curious if you can share like, you know, outside of the pen test and the reporting part, [01:02:58] like do you have any insight or interaction right? [01:03:02] Like above, like are you sharing any of this with, you know, chief financial or the finance side, right? [01:03:08] About how to better budget for preventing attacks or chief risk officers or board. [01:03:15] So I know I just threw a lot at you, but I just really am curious from like where you're at and maybe what you've seen before, what your insight would be. [01:03:26] No problem. [01:03:27] Um, I, so I'm a couple, I'm a couple steps removed from, I guess the C level or C so level, uh, uh, people in the organization. [01:03:36] Um, normally I'm, so basically whenever something comes out or things are concerns to our industry or company or customers or things of our nature, [01:03:45] um, I have a lot of, uh, free time, not free time. [01:03:50] I have, I guess some flexibility to where I can explore what, you know, scenarios can happen from different instances that are happening and occurring, [01:04:00] how that could affect us. [01:04:01] Like, cause even as simple things like before I got here that I never would have thought of. [01:04:04] Right. [01:04:04] So like some simple use cases are like, for example, say any retail store, any retail company, a lot of people will find ways to. [01:04:12] Like game the reward systems or something of that where like there may be companies are losing millions of dollars or hundreds of thousands or whatever it is from people finding some sort of a trick or way of getting around the way a system works. [01:04:26] And then they're doing something that's like basically getting a whole bunch of free stuff based on some rewards program that company has or things of that nature. [01:04:34] Um, and just kind of like dissecting that, um, just from like a company standpoint, just kind of, cause me personally, I've always been a person that tinkered with stuff. [01:04:42] I'm the person that always created the multiple email addresses, more whatever. [01:04:45] And I was like, well, if you're giving away like free food or free, whatever, based on accounts and all that, I would always kind of poke fun at those back in the day where there's like a lot of simple things you can do. [01:04:54] I'm like, if they're not preventively doing those things to stop me from creating multiple emails and things of that nature to get these, all these accounts and get this stuff, then that's kind of on them. [01:05:04] But now that I'm on this side of it, um, I kind of like looking into those, uh, mechanisms on the backend, especially like websites where they maybe do API calls or different things like that, that we may expose inadvertently, um, and kind of work on that side of the house. [01:05:18] Um, I'm kind of very interested in those and kind of just as someone who likes to tinker with things and ways of finding those and hopefully preventing those. [01:05:25] Cause a lot of stuff, when I think traditionally red team, it's more of kind of trying to think more like an attacker would, and then trying to use that to proactively find things before others do. [01:05:35] And then it costs your company that money. [01:05:41] And I'm not a hundred percent. [01:05:42] I answered it exactly the way you heard. [01:05:45] Sorry if I may have divulged from what you were asking. [01:05:48] No, I appreciate it. [01:05:49] You know, I never know who has what insight. [01:05:51] And I think that, you know, every piece is important. [01:05:53] So I just appreciate that. [01:05:55] And, and, uh, you know, I, I did follow you on LinkedIn. [01:05:58] So I look forward to seeing what, you know, other things you might be able to share in the future, maybe around that or anything else. [01:06:04] So thank you. [01:06:09] Fantastic. [01:06:10] Fantastic. [01:06:11] Um, so, um, we are a little bit past the hour. [01:06:15] One of the questions that's been on my mind and I've just wanted to ask you, Jack is, um, you've said that you're into crypto. [01:06:23] And one of the questions that I got today, um, in a different forum was, do you think that companies will be holding assets in crypto going forward? [01:06:35] What are you seeing as trends? [01:06:38] Um, is this something that is, um, different, you know, industry to industry? [01:06:44] I'd love to hear your perspectives. [01:06:46] Cause I, you know, I definitely have mine, but I'd love to hear what's on your mind. [01:06:51] I'm not sure as a whole, I know from the financial side, I have, I get the feeling from at least the things I've been looking into that a lot of financial companies are kind of dipping their toe. [01:07:01] But I mean, the way I see crypto is I don't see a lot of companies that are going full into it. [01:07:06] I think it more as people diversifying, um, and like maybe giving portion or slivering off portions of their, their revenue. [01:07:14] Uh, based around uses and utilization of crypto versus a hundred percent, depending on like some companies are like literally being born out there that are purely around the, the, the, not the cyber, the crypto space. [01:07:26] Um, I mostly see it more on fintech than I see anywhere else. [01:07:30] Um, but then also there's other companies I see, like, for example, all the things, if anybody follows stocks and all the drama that happened with AMC and GameStop and everything like that, where, uh, they're like starting to embrace, like accepting, you know, Bitcoin or Dogecoin and, and all these other forms of payment at, uh, say AMC theaters. [01:07:49] And some other companies were like in a, in an attempt to kind of be more personally approachable or kind of, uh, play to their audience a little bit. [01:07:58] A lot of companies are starting to be more accepting of crypto, uh, because of the popularity of it more as a good faith thing. [01:08:04] And I think with that, especially nowadays with crypto versus crypto years ago, um, is there's a lot more retail investment. [01:08:13] When I say retail is more like the big industry versus like the little guy, the, the, the quote unquote dumb money people, the, the little people that are doing, I see a lot more in industry wide, uh, investing in it. [01:08:24] Um, if, even if it's just a small portion to where it's like, it's one of those things where it's a rounding error to some what they're investing, but it's the, the possible return on that, that investment could be outweighs the, uh, the downside of what the, what they're willing to put in on the crypto side. [01:08:45] Great. [01:08:45] Thanks for sharing those perspectives. [01:08:48] Um, so let me open it up a little bit more. [01:08:50] If anybody would like to jump on the stage with additional questions, feel free to, um, mods, any questions from you? [01:08:59] Yeah, I have one follow-up question, Jack. [01:09:01] Um, you touched on something that intrigued me in, uh, talking about, uh, the, the vectors, uh, with which people are, are going to attack you personally, uh, not you personally, your company, your, your company, sorry. [01:09:16] Um, as an industry, as, you know, as Albertsonson. [01:09:20] So what I was thinking about is when you're looking at your goals for your red team and what you're trying to accomplish from your, uh, red team exercises, um, what are some of the things that you're doing in preparation? [01:09:33] I mean, you mentioned the, the coupon thing. [01:09:34] It made me giggle a little bit because there was that movie that just came out with, uh, Kristen Bell. [01:09:39] I don't know if you guys are aware of that movie. [01:09:41] Jack, do you know the movie I'm talking about? [01:09:43] Um, I don't think I do. [01:09:45] I'm not really sure. [01:09:46] I always forget. [01:09:47] Like, something if I literally watched it that day, I probably would have still forgot the name. [01:09:51] Yeah, I don't know the name either, honestly. [01:09:53] But it, it, it's really like, it's the paper version. [01:09:56] So in the 80s or 90s or something, she, um, she did that with paper coupons. [01:10:00] And they had, they used fraud, like fraudulently. [01:10:03] And then they made over like $3 million with these fraudulent paper coupons. [01:10:08] Um, so I thought that was an interesting, you know, thing to say about one of the ways that, um, you know, you have to, to think about the way that you're going to be attacked. [01:10:16] You know, I, when I talk to an energy company or I talk to a financial services company, you know, I think about, you know, infrastructure, nation state actors, all those kinds of things. [01:10:25] And, uh, when Ryan mentioned kind of you being a part of the, the food supply chain, I had never really thought about that. [01:10:31] So I guess I just wanted to pick your brain a little bit when you're formulating your goals for any of your red team exercises and what you're trying to accomplish. [01:10:39] Do, do all of those things enter into it? [01:10:41] Do you, you talked about, you know, making sure you're, you're having focus around, um, the process with which you, you know, achieve these goals. [01:10:49] But, um, I wondered if you could just dig into that a little bit more and, and how you choose to, to run those exercises, uh, and the, and the goals that you're trying to accomplish and how much it touches on those various components that I mentioned. [01:11:04] Sure. [01:11:04] I'll do my best. [01:11:05] I think so. [01:11:06] Like for me, I've, the, the, the very bare minimum thing that I always super focus on is attack surface and knowing what you have available. [01:11:15] And, and I, the one thing I've, I've found myself doing at a lot of companies is, and this is maybe bad, is whenever I've been in companies where we've had audits done or any kind of assessments and you hear the management say, oh, we don't have any issues with that. [01:11:31] Or we don't have this. [01:11:32] We don't have any eternal blue boxes. [01:11:34] We don't have whatever, or dah, dah, dah, dah. [01:11:36] I usually take that as a personal challenge. [01:11:39] So like, I remember one instance I was working for a company, we had a cloud audit thing and they're like, Hey, we have, you know, the cloud audit rules, condition, [01:11:45] conditionally access rules that enforce MFA and, you know, disable legacy and all this other stuff for login. [01:11:51] And then after, and I think we're doing like an internal audit for that company. [01:11:54] Right. [01:11:55] Uh, and like literally after that meeting, um, I was like during the meeting, I was looking cause I had done the conditional access rules and stuff like that before in a previous one. [01:12:03] I'm like, I'm pretty sure I know how to get around this. [01:12:06] And like literally during lunch, I literally connected my phone to our email without MFA and getting around it in a way that I knew that they weren't looking at. [01:12:17] And then I had them fix it because I like I like taking a challenge when someone, you know, kind of speaks from a point of view like, oh, we definitely don't do that. [01:12:25] We don't have issues with that. I take it as a personal challenge to prove them wrong, even if, you know, they're justified in saying that. [01:12:32] I just don't believe anybody 100 percent does everything they think they do. [01:12:36] And I usually kind of like to drill into that and personally just use that as goals to make, you know, to the whole verify where you think you're doing something you're not. [01:12:47] I kind of like doing that. And I feel like I probably didn't actually answer your question, so I'm sorry. [01:12:55] No, you did. You did it. I asked you maybe 15 questions in one question. So fair enough. [01:13:00] Yeah. I how often do you run exercises? I guess maybe you don't run them more as formally as I think you do. [01:13:08] I don't. In all honesty, a lot of times I have other projects that I'm helping with because also like every now and then if I have down cycles from an engineering standpoint, [01:13:20] like some like deploying something or like something as simple as working out a way of like getting agents deployed for like, [01:13:27] say, Tenable or something or whatever, like something where like I have engineering background or I've done it in other companies. [01:13:32] I'll do that on my down cycles. But then what ends up happening is sometimes when I do have a little free time, [01:13:37] I just start looking at stuff and then I start playing around with I love sitting on GitHub or whatever and just looking at all these tool sets [01:13:45] or going into Slack or Discord channels that are traditionally used by pen testers for other organizations and just kind of figure out what's the tool sets they're using, [01:13:53] what are the things they're trying, what things are they having successful. [01:13:55] And then at like maybe once every week or two, I'm trying some new tool on my downtime. [01:14:01] And a lot of times that ends up turning to like, say, I get off at six. [01:14:04] There's been instances where I've found some tool to play around with. [01:14:08] And then after I get off work, I'm playing around with that on my personal computer from like the time I get off work to like maybe 1 a.m. [01:14:16] Because I just get kind of really into it and I kind of want to build it out and play around with it and see the capabilities. [01:14:22] So I definitely like finding new tool sets. [01:14:24] And then even with that, there have been instances where just me doing my pet side project things, [01:14:29] because I have my company I work for that I can kind of use them as a target. [01:14:35] Not a target. [01:14:36] You know what I mean? [01:14:36] I can use them as a use case to try these different mechanisms, these tools for. [01:14:40] And then I have a good relationship with our IR people. [01:14:43] I'm like, hey, I'm going to be doing X, Y, Z. [01:14:47] This is the IP I'm coming from. [01:14:49] If you happen to see me or whatever, just know that is me. [01:14:51] If you have concerns with anything I'm doing based on what I'm telling you, let me know. [01:14:54] I will stop it immediately. [01:14:56] And then I like sometimes we'll just find stuff that we normally would not have seen just by trying different tool sets, [01:15:03] finding different things out there without really even being an actual quote unquote like assignment or something. [01:15:09] I have to work just because I'm generally curious. [01:15:12] Yeah, that's fascinating. [01:15:13] Yeah, I appreciate that perspective. [01:15:15] So it's really kind of it's it's semi semi formal formal in the sense that you have the the blessing from your incident response team. [01:15:22] But you're doing a lot of this even just on your downtime. [01:15:25] I love that. [01:15:25] I mean, clearly you're in the right role. [01:15:26] So thank you. [01:15:28] I always aggressively ask for permission. [01:15:33] Well, I think it's probably from which is also funny because of my organization with my management. [01:15:38] They're kind of big on like stop with a CC. [01:15:41] If I'm not needed for whatever, I don't need to be CC versus when I did government contracting. [01:15:46] The email was the get out of jail for you. [01:15:48] That was the cover your, you know, whatever. [01:15:51] So I'm just I'm used to that. [01:15:53] So I aggressively over ask permission for everything I'm ever going to do just so it doesn't become an issue. [01:16:02] But then what's happened sometimes is when I found things, sometimes some management were like, well, how did you find it? [01:16:09] Or what were you doing or why were you doing that? [01:16:11] Or like, why didn't our things find that? [01:16:12] I'm like, I don't know. [01:16:13] I just play with the new whatever the new tool was. [01:16:16] And the good thing about that is it actually brings up like if there's there's if there's weaknesses in tool sets that we have, especially, you know, good or bad. [01:16:27] Like when I if you find something like just using some open source tool, whatever, like we'll say, like, for example, there may be some tool set out there more enterprise specific versus you spending maybe 10 hours a week managing something or doing like that. [01:16:40] It's a good pushing point to like get other products or things push that you want to kind of push, because if you can find stuff definitely shows a gap in like the security tool sets and things you're using. [01:16:52] And then it makes it a lot easier budget wise to request the more enterprise specific tool sets to manage those versus kind of like expecting me to are relying on me to have the bandwidth to do all the different things that especially for a company our size. [01:17:08] There's a it takes a lot of bandwidth to manually do that with open source tooling. [01:17:14] Wow, what incredible insight. [01:17:16] Thank you. [01:17:18] I noticed while you were answering my question, we had Jennifer rejoin the stage. [01:17:23] Bob is on the stage as well. [01:17:25] If I could, maybe I'll go to Bob first and then we'll go to Jennifer since Bob is your first question of the night. [01:17:31] Wait, Katie, can I ask because I want to jump in the car. [01:17:34] I just don't want to have much background noise. [01:17:35] Of course. [01:17:35] Yeah, of course. [01:17:36] We're all friends here. [01:17:38] Thank you. [01:17:39] Right. [01:17:39] Thank you. [01:17:40] Right, Bob. [01:17:40] We're all friends. [01:17:44] Thank you. [01:17:46] Jack, I feel like you kept talking because you thought I'd be up next. [01:17:48] You're like, oh, not the attorneys again. [01:17:50] I want to echo what Jenny said earlier. [01:17:51] You've been extremely helpful along with Tom and others on this platform. [01:17:55] I was always amazed with you and Casper doing those tabletops. [01:17:58] It was phenom. [01:18:00] So I have two questions and you can choose not to answer one of them. [01:18:03] But the one that you brought up earlier about the coupons and kind of looking into those, is that part of your role to disclose those? [01:18:10] Is that part of a security role to say, hey, these can be gamed and bringing that forward? [01:18:17] Is that part of it? [01:18:17] And you clearly love your job. [01:18:18] And the second question is, from your picture, you look about 22 and your background keeps going on and on and on and on and on. [01:18:27] What decade? [01:18:28] You don't have to get super specific, but like, seriously, how long have you been doing this stuff? [01:18:33] Two questions. [01:18:33] Security only like maybe like, well, okay, full security, not like a mixed role of where security and whatever, maybe only four or five years. [01:18:43] But I did IT maybe 10 years before that. [01:18:45] I mean, I'm in my mid to late 30s. [01:18:48] I've like been around for a while. [01:18:50] I just I did a lot of IT first. [01:18:52] And then what I found is that IT, sysadmin, firewall, like all the engineering, active directory, group policy, all the stuff basically just made it where picking up the technical side of the security was just so much easier because I just I already knew how the technologies worked. [01:19:10] I didn't have to worry about like how DNS works, how CNAME registry, like DAC. [01:19:15] There's like just a lot of underlying technology that maybe people have here's a Python script. [01:19:20] Go get, you know, get clone, download this, run this, whatever. [01:19:23] But then if you actually look at it, you have no idea what technically it's even doing or why the thing works versus not. [01:19:28] But because I have the engineering background, I have a better like basic understanding of how the underlying things work just because I have that background on the IT side. [01:19:38] Not to mention, it's always great whenever I was in security at some of my other companies where a lot of times there's friction between IT and security. [01:19:45] And I always joke, well, I've done your job longer than I've done the job I have now. [01:19:49] So whenever there's an argument, I'm always on your side. [01:19:52] So I always try to make things easier for you versus making it harder, but in a way that we can make stuff more secure. [01:19:59] Awesome. [01:20:00] And then back to the couponing and that kind of scamming. [01:20:02] Is that was that does that roll up under you? [01:20:05] Like is it vulnerability? [01:20:07] Something like that would have come up like that specifically here or like some other retail or whatever. [01:20:11] Sure. [01:20:13] I so also some of the things that I look into a lot is from our threat intelligence side. [01:20:19] We have people here that do threat research or not for research threat intelligence with the the the hospitality, the retail hospitality ISAC. [01:20:27] So what ends up happening is even if it's not something necessarily that's affecting us, we work with other companies on like sharing threat intel and stuff like that. [01:20:37] So like companies like say Starbucks or Target or other things like that that are in the retail space from the ISAC. [01:20:43] And then the other mechanism and things that they're you know, they're kind of seeing activities of people trying to do that with them. [01:20:48] I mean, because we're still in the retail space. [01:20:51] I mean, we all basically when it comes down to it, have the same type things if we're trying to sell something online. [01:20:55] The same way they're going to gain us is the same way they'll gain, say, Walmart or Target or some other company. [01:21:00] While we may, you know, primarily focus on food products, we still have a portal and mechanisms that a lot of other retail space would. [01:21:08] So whatever, especially a lot of things that we end up looking at is especially if we see people trying things with some of the other people in our space, we'll use that to like reevaluate like, huh, you notice that. [01:21:20] Let me see what's going on over here to see if it's possibility of someone doing that with us as well. [01:21:27] Awesome. Thank you. [01:21:32] Over to you, Bob. [01:21:35] Oh, thank you. [01:21:36] Okay, thanks for inviting me up. [01:21:38] And Jack, good to talk to you again. [01:21:40] It's been a while. [01:21:42] It definitely has. [01:21:44] Hey, I have a question. [01:21:46] I want to get your thought about the evolution of red teaming and where do you see it going in terms of machine language and automating the red teaming function? [01:21:57] I'm curious what your thoughts are on that. [01:21:59] I mean, honestly, the way I see more, the more automated things that I see are more maybe from a purple teaming standpoint, like more like technology is like Caldera or things like that. [01:22:11] Where they kind of piece together techniques to kind of simulate different ATPs and how they would focus on there. [01:22:17] Where I kind of see the more of the automation in more of a, I guess, almost audit versus like a direct doing the whole pen test. [01:22:26] Because even with pen test, there's certain things you can automatically do. [01:22:29] But there's certain nuances to it where there's certain things that are just hard to pull out and do that an individual. [01:22:41] I don't know. [01:22:41] I see more from an assessment and evaluating and strengthening security for companies, more from the purple team for the automation side of things, for workflows, more than I see it for like maybe replacing pen testing specifically. [01:22:54] If that makes sense. [01:22:56] Just because, like I always mentioned, I'm super big into MITRE and like focusing on what, like versus focusing on trying to identify everything. [01:23:06] Focus on what actually may actually affect you. [01:23:11] It's like you're worrying about a million things that probably no one's ever thinking of even trying against you or people that would normally attack you would never really use against you normally. [01:23:18] How about you focus on the thing that is a no-no that they do and focus on that before you focus on everything else. [01:23:26] Yeah, because there are some companies out there pushing the concept of cart, you know, continuous automated red teaming and pushing that concept. [01:23:36] I think that's a lot of people out there and I'm just curious what your thoughts are. [01:23:38] One last question. [01:23:40] Do you see red teaming going into doing the same type of analysis you're doing now into more of the data privacy workflows, whether it's GRC and those type of areas? [01:23:55] Do you see any of that going on in red teaming and taking that profession and taking those tools or whatever and applying it, the concepts to data privacy in an organization to see that they're complying with GRC, et cetera? [01:24:11] You're saying more from like an audit standpoint as far as enforcing that companies are actually doing the things they need to do to secure their private data that they have for their customers? [01:24:20] Yeah, because we have seen some of that where some red teaming and some companies are migrating toward that capability and taking that red team capability into that workflow within those companies. [01:24:32] I'm curious what your thoughts are on that and then I'm done speaking. [01:24:36] Oh, no, no, no. [01:24:38] And I'm going to be honest. [01:24:39] I haven't thought that much in that side of the space, unfortunately. [01:24:44] That's not my forte. [01:24:46] So I'm not really sure. [01:24:48] I'd have to think about that a little more just because it's not my strong suit, I guess you would say. [01:24:56] No, that's fine. [01:24:56] I appreciate it. [01:24:57] Thanks, Jack. [01:24:57] I figure the worst thing you could do, it's better to say you don't know than it is to try and BS your way through stuff because everybody can see it. [01:25:09] Oh, yeah. [01:25:09] You're absolutely right about that. [01:25:14] Great. [01:25:15] I know, Russell, you had a question as well that you wanted to make sure you had time to ask, Jack. [01:25:21] So I think it's your time. [01:25:23] Cool. [01:25:23] Thanks. [01:25:24] So, Jack, what a great conversation this last hour and a half. [01:25:28] All the things you've done and shared and helped us understand better. [01:25:32] So here's the art of you as well as on red teams as well. [01:25:37] Question for you is this. [01:25:40] What, how often for cybersecurity leaders and stuff, how often should we go and have red teams? [01:25:48] Is it once a year to get our audit pretty green checkbox? [01:25:51] Is it more frequent than that? [01:25:53] What would your advice be to folks like me when wondering how often I should get me one of those shiny new red team or pen tests at my organization? [01:26:03] How do I think about that? [01:26:04] I mean, some of the organizations that I've been at, what I've kind of preferred, if you're talking about from the third party assessment, is either, like, I think one thing I like, which you could probably not go as frequent as this, but I know one of my employers, one of my managers, I like that basically he had an assessment every six months. [01:26:21] But he would rotate it. [01:26:23] He would be like, I'm going to do an external pen test. [01:26:27] And then six months later, internal, and then kind of flip off. [01:26:29] And so where you're doing one annually, but you're not just doing, like, you know, your shebang all at once. [01:26:35] But then, like, even from internal, like, red team standpoint, right, to me, and this is kind of something that I push as well, is anytime we do any assessments or things of that nature from a red team standpoint or if you're building a red team or a habit, I think it's important. [01:26:49] Like, for me, I always ask to see all the reports from all the pen tests from all the whatever, because I like it because, one, I get to see, all right, what tool sets are they using? [01:26:58] What mechanisms they use? [01:26:59] Is this stuff I'm familiar with? [01:27:00] Is it maybe something I haven't heard of? [01:27:02] But then also, like, when you're looking at remediation long, you know, down the road, having, like, people, like, on your red team or whatever kind of looking to where, like, for example, say something's identified in this year's pen test, right? [01:27:13] Like, a lot of times things tend to fall through the cracks where maybe the immediate findings are things that you need to, like, evaluate and resolve. [01:27:24] But then there are other things that are concerns that just kind of fall off to the wayside, and then you'll get into that bad habit of, like, the next two pen tests you do literally keep finding the same thing that they keep telling you over and over again. [01:27:35] And there's, like, not anybody dedicated to actually working on plans to adjust them. [01:27:38] So I think it's valuable, like, to still do the third-party assessments but have, like, your internal red team where that's just becoming other data sources for them to help also steer them in, like, hey, progressively, let's look at a way to resolve this and do continuous testing. [01:27:53] In a lot of cases, a lot of the assessments will use a lot of open source technology or stuff that you can kind of in-house do to where – and this is also, like, for one of the companies I worked at when I first did security for MSP. [01:28:05] What I loved about that, where I wasn't traditionally doing the right team, but I was kind of doing all the security stuff, is we would have an annual pen test from this company. [01:28:14] And every year, it was considered a win if every year they did it, I made it harder and harder for them to do what they were trying to do. [01:28:23] And I remember – I think it was right when I left one of the companies. [01:28:29] It was, like, the third pen test or whatever. [01:28:30] I remember the things that we put in place. [01:28:33] The CTO had, like, contacted me. [01:28:35] I was, like, super happy that, like, for one time they actually had done, like, an internal pen test. [01:28:40] And they weren't even able to get a hash of a, like, privileged account based on the things that we'd put in place there over the years, identifying what they were doing and then me verifying testing and doing some of the same mechanisms, looking at defenses, and then re-verifying with other testing using same type tool sets. [01:28:58] So that when we would have that external validation, we were making sure that we were properly identifying things so that you get better value. [01:29:08] Because it doesn't – you don't get a lot of value as a company if a pen test comes – if they come and do a pen test and they're basically finding the same crap that you – or you're aware of and, like, you're not making any progression. [01:29:17] To me, it's really valuable when you have people doing some continuously internally to where the idea is, like, every assessment you do, every internal or external pen test you do, you want – as an organization, you want to feel like you're making it harder on those assessors or those pen testers. [01:29:34] Because if you're not, then are you really making progress in your security program? [01:29:40] Love that. [01:29:40] Thanks, Jack. [01:29:41] Such great insight and wisdom for us to all take away from that. [01:29:44] Hussain, over to you for what may be the last question. [01:29:48] Hey, Jack. [01:29:49] Thanks for all the good insights. [01:29:50] Question for you. [01:29:51] What's your thoughts about doing red teaming campaigns outside of the MITRE framework? [01:29:58] I've heard from some experts saying that just don't rely on MITRE framework. [01:30:02] You need to explore social engineered scenarios that may not be accounted for in the MITRE framework. [01:30:10] Thanks. [01:30:11] Yeah. [01:30:12] I mean, when it comes down to it, that is true. [01:30:16] So, like, even when I've done a lot of organizations, I end up doing, like, whatever the annual, whatever required. [01:30:23] Like, I did a lot of know-before campaigns, a lot of the phishing tests that we would do and all the things like that at other organizations I've been at. [01:30:31] When it comes down to it, no matter what amount of training or whatever you do, people are always going to be the weakest link in any security thing as far as, like, just – [01:30:40] It's good to, I guess, invest in that training and that knowledge within your company. [01:30:45] But I tend to focus more outside of that only because the technology and the tool set and the things you do is something you have more control over. [01:30:55] So, like, even if you look at a lot of data breaches out there and things like that and stuff that's happened over the years, a lot of them are very simple things that were – like, things that audits could have found or, like, evaluations from third parties, misconfigurations, weak passwords, just different stuff that, like, the human element maybe was not the biggest component of them. [01:31:17] But those are things that, like, me as a technical person, I can more directly manage than, say, the social engineering aspect. [01:31:26] While I do see it's still important, I tend to focus more on the technology and, like, that side of it because that's a little bit easier to manage and to predict or be a little more active in, I guess, making better in your organization. [01:31:41] Because there's only so much you can do and there's going to be people that just, you know, still click the links no matter how much you tell them or train them. [01:31:51] Thank you. Appreciate it. Over to you, Lisa. [01:31:54] Wow. Well, time flies when you're having fun. [01:31:57] We are already at our ending point. [01:32:01] I am so glad that you were able to join us tonight. [01:32:07] For anyone who's joined us on this journey today, know that we will be back again next week on Wednesday. [01:32:15] Jack, are there ways that – you said that the best way to reach out to you would be on LinkedIn. [01:32:20] So, Jack, thank you so much for spending time with us tonight and for allowing us to ask you questions and find out more about you. [01:32:27] Oh, no problem. I just hope that someone – you know, you guys actually just got something out of this because I feel like I tend to ramble. [01:32:35] So, you know, sometimes you got to stop me. [01:32:37] You were terrific. I got a ton out of it and I really appreciate you. So, thank you. [01:32:45] Any last comments, Mauds? [01:32:49] Well, I feel like we can't break the tradition of the final question of what would you say to your younger self. [01:32:56] Good memory, Katie. Go for it. [01:32:57] I like that question. Yeah, Jack, the final question that's kind of a tradition in the room that was not started by me. [01:33:06] It was started by – I don't even know. It was before I even joined as a listener myself. [01:33:11] So, what would you – with all of the years of experience that you have, what would you say to your younger self? [01:33:19] And then we'll leave with that insight. Thank you. [01:33:23] What advice would you give to your younger self to be more clear? [01:33:26] Don't settle. [01:33:29] What I've noticed in the last couple of years is there was a good portion of time where I just kind of got into a groove where I wasn't really learning anything new and just kind of doing the same monotonous thing and not growing. [01:33:41] And I kind of just wish I had not gotten into that – I don't know how to phrase it. [01:33:49] I wish basically I had just been a little more proactive towards my growth or career like, I don't know, maybe 10, 15 years ago versus like most of my security knowledge is literally in the last four or five years. [01:34:00] So, like it's more recent. [01:34:02] But there was like a good five to 10 years where I basically wasn't really learning anything new and I was just content and I didn't know that there was other possibilities out there for me. [01:34:13] Yeah, thank you. [01:34:19] Yeah, I really – I like that question. [01:34:21] And I know sometimes it can be – it can be a little bit difficult to reflect on our lives. [01:34:27] I was thinking about that question myself today. [01:34:29] And so I really appreciate you answering that for us as we close the room. [01:34:34] And what a great guest. [01:34:35] You can buy a whole bunch of Tesla and Apple. [01:34:37] You know what, that's actually – that's a very creative answer. [01:34:42] I like that one. [01:34:43] Good call. [01:34:45] Well, those are words to live by. [01:34:47] Thank you for joining us, Jack. [01:34:49] Thank you, Mods. [01:34:51] And join us next week when we have another Fireside Chat. [01:34:56] I'm excited about the one we have in store for next week. [01:34:59] And you can find out more by looking at our events. [01:35:03] Next week it will be Brian Lozada, who is the CISO at HBO Max. [01:35:10] So thanks everyone for joining us and have a great week ahead. [01:35:15] Thank you. [01:35:16] Be safe. [01:35:17] Be well. [01:35:18] Good night. [01:35:19] Thank you. [01:35:20] Thanks, Jack. [01:35:20] Great job. [01:35:21] All right.