Fireside Chat w/Malcolm Harkins

[00:00:00] Hello, hello. [00:00:21] Thanks for joining. [00:00:23] Trying to get the room situated. [00:00:26] We'll get started in a few minutes. [00:00:33] Hopefully everybody's doing okay. [00:00:42] Hopefully everybody's doing okay. [00:00:51] I think that works. [00:00:56] Hey, hey everybody. [00:00:59] Malcolm, let's get you up on stage play. [00:01:10] Here you are. [00:01:11] Hey Tomas. [00:01:12] Hey, what's going on? [00:01:14] Not much, not much. [00:01:17] So is it really your first time? [00:01:19] Okay. [00:01:20] It is. [00:01:21] I'm a clubhouse virgin, so to speak. [00:01:24] All right. [00:01:25] That is funny. [00:01:27] All right, let's get you. [00:01:29] All right. [00:01:31] So I'll give you a quick rundown in a minute or so. [00:01:36] Yeah, no worries. [00:01:37] Let me just get the room situated. [00:01:42] We'll get everybody sort of settled in. [00:01:44] And I'll help you out so that way it makes it easier for you since it is your first time on stage. [00:01:52] But you'll see two things and I'm sure you probably you already figured out one of them, which is the unmute button. [00:02:03] So you figure that out. [00:02:05] The other one is to mute yourself, but you'll be doing a lot of talking so you probably won't be muted. [00:02:12] And what I probably should told you is what do we kind of do here? [00:02:16] So, look, we typically run a we run a weekly fireside chat. [00:02:21] We invite guests, usually leaders from across the industry, yourself included. [00:02:27] Hey, Katie, we invite them to sit with us for about an hour and a half or so. [00:02:32] And we ask questions. [00:02:33] And this is what I'll call a middle of the week relaxation type of a fireside chat. [00:02:40] So it's not really focused on product or solutions or anything like that. [00:02:44] It's more about you and your origin story and really getting to know you as a person in this world that we live in and your journey. [00:02:53] Obviously, you're going to interlace that with with some real life experience and practitioner type experience, which is great, because our listeners want to know, you know, how did Malcolm become Malcolm? [00:03:04] You know, so you can start from wherever you want and go to wherever you want. [00:03:10] And then we'll we'll usually ask questions. [00:03:13] We being the moderators. [00:03:15] So Katie is one of our moderators. [00:03:17] There'll be a few others that join us up in a little bit. [00:03:19] Yeah, we'll ask you a question for about 30 to maybe 40 minutes or so. [00:03:23] And then we'll be able to the audience to to pop up on stage and then they'll ask you questions. [00:03:27] So the conversation will go in any direction to be very transparent. [00:03:32] Yeah, that's to be honest. [00:03:33] I love that. [00:03:34] So totally, totally game. [00:03:36] And I'm not shy. [00:03:37] So, you know, ask me the questions that you probably wouldn't ask other people because it doesn't bother me. [00:03:44] Sounds awesome. [00:03:45] Sounds awesome. [00:03:46] Sounds awesome. [00:03:47] So let me just say, hey, who's saying Katie microphone check for you. [00:03:50] Hi, nice to see you. [00:03:53] Hi, Malcolm. [00:03:54] You know, that's dangerous to put something like that in front of someone like me. [00:04:00] Now I have to come up with something really good. [00:04:02] To be honest, even when I did public events, a lot of them, even at Intel and stuff, even the internal ones worth a thousand people when you do a business update meeting or stuff like that. [00:04:12] I'm like, don't filter the questions. [00:04:15] I want somebody to go to the mic. [00:04:16] I don't want anybody, you know, hand holding, massaging or any other way manipulating a question somebody has. [00:04:24] I'll handle it regardless of what it is. [00:04:26] And if I don't have an answer, I'll tell them I don't have an answer. [00:04:30] You know, if I have to make something up off of the fly based upon an opinion, I'll do that and I'll share my logic or data as to why and recognize that I might not actually know. [00:04:42] But, you know, so like I said, that doesn't bother me at all. [00:04:45] Good stuff. [00:04:46] Good stuff. [00:04:47] So look, let's. [00:04:48] Sorry, Katie, I didn't mean to talk over you. [00:04:51] Oh, no, I was just saying wonderful. [00:04:53] Great. [00:04:54] Looking forward to it. [00:04:55] Right. [00:04:56] So look, why don't we why don't we start? [00:04:59] Why don't we get started? [00:05:00] So I'm just going to lay a few ground rules down. [00:05:02] Hey, Lisa Beth. [00:05:03] Hey, Hussain. [00:05:04] We'll microphone check you in a second. [00:05:07] It's just a few quick ground rules. [00:05:09] Again, it's the middle of the week. [00:05:11] I don't know about you, but my week has been interesting so far. [00:05:13] I'm hopeful to make it through to the to the rest of the week. [00:05:16] So let's have fun. [00:05:17] Let's have a good. [00:05:18] Let's have a good time this evening. [00:05:20] This is our weekly fireside chat. [00:05:23] If it is your first time joining us, we do this every single Wednesday between 8pm Eastern Time and 930pm Eastern Time. [00:05:31] I'm just going to. [00:05:33] So I'm just going to mute you real quick, Michael, getting background noise. [00:05:37] Hey, Vijay. [00:05:38] We do this between 8pm Eastern Time and 930pm Eastern Time. [00:05:41] As I mentioned earlier, we're going to ask our guest this evening, who is Malcolm. [00:05:44] We're going to ask him questions for about 30 to 40 minutes or so. [00:05:47] And then we'll open up for the audience for you guys to pop up on stage and ask your question. [00:05:51] Obviously, you can use the chat option if you want to ask a question and you don't want to jump up on stage or you want to just interact with the conversation. [00:05:59] You like what you're hearing. [00:06:00] Feel free to use the chat because we will be monitoring the chat. [00:06:03] And please feel free to share this. [00:06:05] If it is your first time joining us, there's a little greenhouse on the top left of your screen right next to where it says fireside chat. [00:06:11] If it looks like a little monopoly house, you can click that. [00:06:14] You might pass go and collect $200. [00:06:15] Nah, I'm just playing. [00:06:16] You won't collect anything. [00:06:17] But what you will be able to do is you'll be able to see who our next guests are and you will be a member of our fireside chat. [00:06:23] So we invite you to join us on this journey of conversations. [00:06:28] The last few things I'll say is our opinions and expressed this evening are our own and do not represent our current or prior employers. [00:06:38] I think that applies to a good amount of folks on the stage. [00:06:41] So please be respectful of that and mindful of that. [00:06:45] And then the last the last point that I'll make is if you are a vendor in the audience and you do want to sell us on your product. [00:06:51] We appreciate you being a vendor. [00:06:53] We need you guys and gals, but please don't sell us on your solution today. [00:06:57] Let's let's leave that for a different conversation. [00:06:59] Let's try to use this conversation as a really as really as an opportunity to get to know Malcolm a little bit more. [00:07:06] If there is a question that you do want to ask that that does lean towards that direction, you can ask it feel free. [00:07:12] But, you know, I would just say, please don't sell us on any solutions today. [00:07:16] Different type of conversation, different different football game happening this evening. [00:07:21] Had to throw that one in. [00:07:23] All right. So I'm just going to go around the room, introduce ourselves. [00:07:26] Malcolm, we'll leave you for last. [00:07:29] So I'm Tomas Maldonado. [00:07:31] I'm the CISO for the NFL. [00:07:33] Katie, over to you. [00:07:34] I'm Katie Hanahan. [00:07:36] I'm a VC. [00:07:37] So I'm the vice president of cybersecurity strategy for it savvy. [00:07:40] Hussein. [00:07:41] Good evening. [00:07:43] Welcome, Malcolm. [00:07:44] Hussein Said. [00:07:45] CISO at RWJ Barnabas Health. [00:07:48] Over to Lisa. [00:07:49] Hi, everyone. [00:07:51] I hope you're having a wonderful evening. [00:07:53] My name is Lisa Beth Lentini Walker. [00:07:55] I am a compliance ethics and corporate governance strategist working for Lumen worldwide endeavors. [00:08:01] Vijay, you're up next. [00:08:02] Thank you, Lisa. [00:08:03] Good evening, everybody. [00:08:04] Vijay Bala here. [00:08:05] CISO of the Assets Management Division at Goldman Sachs. [00:08:09] Malcolm, looking forward to a fun night. [00:08:12] Tomas, we'll be back to you. [00:08:14] Actually, we'll pass it over to Anil. [00:08:16] Anil, thanks for joining us this evening. [00:08:18] Go ahead, Anil. [00:08:19] Hey, thanks, Tomas. [00:08:21] Anil Varghese, currently serving as a virtual CISO for firms in the US and one in the UK. [00:08:28] Looking forward to a great conversation, Malcolm, this evening. [00:08:31] All right. [00:08:32] Thanks for that, guys and gals. [00:08:34] Thanks for joining us this evening. [00:08:36] Malcolm, I muted you. [00:08:37] So on the bottom right of your screen, there you go. [00:08:39] Yep. [00:08:40] So, Malcolm, why don't you take a moment to introduce yourself. [00:08:42] And while you're doing that, I usually like to ask our guests this question around their origin story. [00:08:48] So why don't you tell us a little bit about your origin story? [00:08:51] How did you come about in this world? [00:08:53] And, you know, you can obviously, as I mentioned earlier, you can start wherever you want and take us however long you want. [00:08:58] So take your time and tell us a little bit more about you, Malcolm. [00:09:02] Yeah, yeah. [00:09:03] Thanks, Tomas. [00:09:04] And happy to be here with all of you and some of you I know and some of you I'm just meeting for the first time virtually. [00:09:11] So thanks for having me. [00:09:14] So Malcolm Harkins, I'm Chief Security and Trust Officer with an early stage cybersecurity startup called Epiphany Systems, but no infomercial on that. [00:09:23] Prior to that, I spent 20 months or so with another early stage cybersecurity company, Cymatic, doing web application security. [00:09:33] Prior to that, pretty simple. [00:09:35] I was at Silence for four years working for Stuart McClure as his chief security and trust officer and managing all the internal day to day stuff that spending most of my time external facing. [00:09:47] And prior to that, my life was simple. [00:09:49] 24 years at Intel at the Intel campus that's still two miles down the street from my house in Folsom, California. [00:09:58] But, you know, so so the beginning in in middle and in for Malcolm. [00:10:04] Let's just see. I grew up a mile and a half from Knott's Berry Farm in Southern California. [00:10:10] And a low to middle income neighborhood with decent amount of gangs all around. [00:10:17] My dad did manual labor. [00:10:19] And, you know, from there, just frankly busted my ass through school and college. [00:10:29] I did undergraduate at UC Irvine in economics and then spent a number of years in retail in undergraduate. [00:10:38] And then when I first got out of undergraduate managing a department store, Southern California credit operations for their couple million credit card holders. [00:10:47] And then my wife and I got married almost 32 years ago in Southern California. [00:10:52] And we moved to Davis and we both went to graduate school. [00:10:56] She did her Ph.D. in developmental psychology and emotion behavior research in early childhood. [00:11:01] And I did my MBA in finance and accounting. [00:11:04] And the funny thing is, I never planned to go in the tech industry, never planned to do security, never planned to even work for Intel. [00:11:10] I was a business guy through and through finance. [00:11:14] And as I was in graduate school, one of the jobs that I had was recruiting companies to recruit the MBA students. [00:11:24] And I landed the tech whale of Northern California Intel to recruit the MBA students from UC Davis. [00:11:33] And the day before, you know, we had to fax the resumes over on a Friday for them to show up on a Tuesday for interviews on site. [00:11:43] You know, going through 10, 15 students. [00:11:47] The Dean and I are meeting and we're, let's say, truing up the products on the shelves because the students are the products. [00:11:54] And you want good product on the shelf because the buyer is the recruiter. [00:11:57] Because you want them to come back and buy from you. [00:12:00] They want you want them to hire your students. [00:12:02] And so we did a little cleanup, moved a few lower students out, moved a few good ones in. [00:12:09] And there was still an open interview slot. [00:12:11] And the Dean made me put my resume in the stack. [00:12:14] Now, I was already in flight with a job offer that I had already had a verbal offer to go be assistant vice president of international finance for Wells Fargo in downtown San Francisco. [00:12:25] That was just going to go do that split commutes with my wife, you know, because she was still working her PhD at Davis. [00:12:34] And anyway, so Dean made me do it. [00:12:37] I show up for the interviews, of course, since I recruited them, I got past the first interviews. [00:12:42] They wanted me on site a few days later for an all day set of interviews. [00:12:47] So I had to delay going to San Francisco to finalize my offer with Wells Fargo because the Dean said, Malcolm, what's your mission? [00:12:54] My mission was to stimulate demand for the school. [00:12:58] And way of doing that was to get them to want more of the students, including me, even if I turned them down later. [00:13:06] So I go do an all day set of interviews with Intel, come home on a Friday night, had pushed out my Wells Fargo thing to the next week. [00:13:14] My wife and I had been driving towards the Bay Area. [00:13:18] So you don't know Northern California. [00:13:20] Davis is like 90 miles from San Francisco. [00:13:24] And it's a brutal commute. [00:13:26] And so we were trying to find places to live and think about me working downtown while she was finishing her PhD. [00:13:33] We had been doing it for months, couldn't find anything we liked. [00:13:37] They were too expensive or they were just dumps. [00:13:40] And so, you know, Saturday morning comes around and my wife's like, I don't feel like looking for houses in Vallejo or Richmond or anything else again. [00:13:52] You said Folsom was kind of neat. [00:13:54] Let's go there. [00:13:55] It's on the other side of Sacramento, 40 miles away. [00:13:57] I'm like, okay, fine. [00:13:58] So we stroll into Folsom, you know, old Folsom is a kind of the old gold rush days and, you know, some developments happening in this big Intel campus. [00:14:08] We spend all day in Folsom, just bumming around, looking at houses, doing all this stuff on Sunday morning. [00:14:16] We end up back in Folsom, doing the same thing. [00:14:21] Two o'clock on a Sunday afternoon, I put money down on a house for a city that I had never been in other than four days earlier, for a job that I didn't even have for Intel, because the economics person in me is like, I can afford this and it's nice. [00:14:36] And if I don't get an Intel job, which I didn't necessarily knew that I wanted to yet, we'll rent it out and we'll just, you know, move here sometime later. [00:14:49] But it was a good decision because then I could just deploy capital, make some money and then go do the Wells Fargo thing. [00:14:55] And when we were driving home on Sunday, my wife and I continue talking about, boy, it was really nice and Folsom and boy, I really liked the people I met. [00:15:05] And, you know, it was exhilarating Monday. [00:15:08] I go to San Francisco, finalize the offer from Wells Fargo. [00:15:12] Don't have a cell phone at the time. [00:15:14] They asked me for an answer and I said, Hey, can you give me a day? [00:15:17] I've got to go down and talk with my wife, talk about the relocation package, all that stuff. [00:15:21] They're like, fine. [00:15:22] Tell us on Wednesday, get home Monday night. [00:15:24] My wife and I chat about it. [00:15:27] Tuesday morning Intel calls. [00:15:29] I accept a job in their strategic procurement group as a quasi finance and procurement guy. [00:15:35] And then called Wells Fargo and said, No, that's how I ended up at Intel. [00:15:40] And what I've learned from that, and even the way in which every job I had at Intel, including tripping my way into security, I've managed most, if not all of my career on a few different things. [00:15:53] Luck timing and execution. [00:15:54] Luck. [00:15:55] It happens for you or against you. [00:15:58] And if it happens against you. [00:16:02] If you're savvy enough, you can flip it around. [00:16:05] Timing, you know, the Wayne Gretzky thing, go where the puck is going. [00:16:09] And if you get good on timing, you can develop your own luck. [00:16:12] And then execution. [00:16:13] Execution is the only thing I can control as an individual and for the teams that I've got, what we can deliver, what capacity we can create. [00:16:24] And then the other things that I've managed, you know, my career on is just, again, that kind of sense of purpose and mission, which is what got me into security after 9-11. [00:16:37] When Andy Grove was still running Intel, frankly, beating the crap out of the CIO and some other corporate officers on availability risk issues. [00:16:46] And CIO called me up. [00:16:48] And again, I was in a business unit doing, you know, business operations and some planning and logistics stuff. [00:16:55] And so Malcolm, I need you to run security and business continuity for me. [00:16:58] I'm like, why? [00:16:59] He's like, I, you know, I was like, I don't know shit about security. [00:17:03] He's like, that's fine. [00:17:04] I got a bunch of security geeks who don't know shit about the business. [00:17:06] They'll teach you and you'll teach them. [00:17:08] Literally, that's what got me into security. [00:17:10] And then I've never left the space. [00:17:12] And then over time at Intel, put my arms around other aspects of risk, product security, again, some other business initiatives, corporate emergency management, physical security. [00:17:23] And then, like I said, from there, I've just make most of my decisions, frankly, on gut instinct in terms of what I want to do next, based upon what creates a sense of passion, purpose or curiosity for me. [00:17:38] So that is a five minute or so ramble on who I am and how I got here. [00:17:45] I'll let you guys fire away. [00:17:47] No, that's great, Malcolm. [00:17:49] Thanks for that. [00:17:50] I'm sure I'm sure we've got a lot of questions. [00:17:53] So, Katie, I'll pass it over to you. [00:17:55] We have to be first. [00:17:56] Thank you. [00:17:57] Well, you know, it's a really interesting moment because you just said something that really struck me, you know, passion, purpose and curiosity. [00:18:05] You know, being the things that when I look at my peers in the cybersecurity industry, we do all seem to share that if we're the long haulers. [00:18:18] I'm in about 18 years. [00:18:20] It sounds like you have a couple of more on me. [00:18:22] And, you know, with with that, it sounds like you're leading teams as well. [00:18:27] You know, you had a lot of vignette things, things about your your background and your path into cybersecurity that, you know, demonstrate that very, very well. [00:18:36] But just curious and leading teams. [00:18:38] I'm kind of at the stage in my career where I'm really just beginning that, you know, executive leadership path. [00:18:44] What are the things that you do and say in a day that really help instill that passion, purpose and curiosity in the people that you work with? [00:18:53] And is there ever a time that you've told someone maybe they need to find their passion, purpose and curiosity in a different different profession if they don't have enough for to live in cyber? [00:19:06] Right. So that's I'm just kind of curious from an executive leadership perspective. [00:19:10] Yeah. You know, it's funny. I'm glad you asked that. [00:19:12] I I don't read a lot of books for pleasure, but over the years I've loved reading a variety of leadership books. [00:19:21] And I if you've ever read the book, The Leadership Challenge, it's a fantastic book. [00:19:29] There's a whole leadership practice index that you can have yourself scored against, measured against and stuff like that. [00:19:35] It's really got a good set of things. I used to teach that as a multi day class at Intel to Emerging. [00:19:42] Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern Northern [00:20:12] I still use today as I'd say one of the best definitions of leadership I've ever seen. [00:20:17] Leadership is the art of motivating others to want to struggle for shared aspirations. [00:20:24] Think about it. [00:20:26] It's not authoritative. [00:20:27] It's not organizational. [00:20:29] It's not positional. [00:20:30] It is an art, which it is. [00:20:33] And it's motivating people towards a shared aspiration. [00:20:39] And the other important part is to struggle. [00:20:42] Right. [00:20:43] And when I get that in the cybersecurity industry, it's a struggle day in and day out. [00:20:47] You guys all know that. [00:20:49] Not only from the external battlefield that we face, but the internal battlefield of budgets, bureaucracies and behaviors that dilutes. [00:21:01] It degrades that spirit to want to fight on the external battlefield at times. [00:21:07] I know. [00:21:08] I've seen it. [00:21:08] I've experienced it. [00:21:09] I've seen it. [00:21:10] And so I go with that is my job. [00:21:14] Then you go, how do I do that? [00:21:16] I've got a few trademarks. [00:21:23] One that's more oriented in the security space that I have the registered trademark for three words, protect to enable. [00:21:32] Because I determined a long time ago when I was at Intel that that was the core mission of the security team, protect to enable people, data and business. [00:21:41] If there's protection for protection's sake, we were wasting time, wasting money. [00:21:45] And as soon as we got our orientation of that protect to enable, we also reduced the friction with the business. [00:21:54] You know, you can't eliminate it. [00:21:56] You know, you can't eliminate it, but we've reduced it a good bit. [00:21:59] Now, the other trademark that I have is for a future book that I'll write. [00:22:04] There's a leadership talk I've given a handful of times. [00:22:09] It's deeply personal to me because you'll hear from this dialogue. [00:22:14] I'm a what you see is what you get. [00:22:15] I make myself extremely vulnerable. [00:22:17] I share a lot of stuff. [00:22:20] And it's it's my journey in leadership and and and not only as a leader, but as an employee. [00:22:29] What would motivate me to want to struggle for something? [00:22:33] Right. [00:22:34] What would cause me to be in my ideal state? [00:22:40] To execute and perform and to never give up and never give in. [00:22:44] And we all fall out of sync on it occasionally. [00:22:48] But the six words that I have that I've got a leadership framework around are I believe I belong. [00:22:55] I matter. [00:22:56] I've come to the conclusion for myself and I've come to the conclusion with the thousands of people that I've managed over the years that when I found a performance issue, including in myself, there's something wrong with the I believe I belong. [00:23:11] I matter. [00:23:11] And I and I and I think that if an individual can routinely say to themselves and some people need to say it daily, some it's weekly, some it's every once in a while. [00:23:23] I believe in the mission. [00:23:26] I believe in the management. [00:23:28] I believe in myself and I believe in my peers. [00:23:31] I belong because the culture, the organization, the environment, frankly, gives a shit about me. [00:23:39] And the work I do and the work the organization does matters. [00:23:45] The rest of it is easier to hire somebody smart and you can cultivate a culture that that. [00:23:52] Self-corrects identifies where people are out of sync with that. [00:24:00] You'll you'll be in that right executive leadership mindset and you'll have. [00:24:05] More people wanting to work for you directly and indirectly. [00:24:11] And you'll never be. [00:24:14] Without a wreck that you can't. [00:24:17] Already have 10 people waiting to join you. [00:24:21] Before you even open it. [00:24:22] I've never had a recruiting problem at Intel at silence to today. [00:24:27] I mean, and it's because I I've actively worked to create that culture. [00:24:32] And then, frankly, there's been times we all have personal challenges outside of work or sometimes even inside of work where I've gotten disjointed with that. [00:24:44] I've got disillusioned. [00:24:45] I've gotten frustrated. [00:24:46] And I've had my own team members that work, my staff members or individual contributors recognize there's something off with me. [00:24:55] Pull me aside. [00:24:56] Check on how I'm doing. [00:24:58] You know, in that which, you know, leadership can be lonely. [00:25:01] But if you make yourself vulnerable, you make yourself open and you do that, then your own organization will feed your sense of belief, belonging and mattering as well. [00:25:15] Well, thank you for that. [00:25:16] Again, I look forward to that. [00:25:17] Did you say you're writing that book currently or you're you're. [00:25:20] Oh, boy. [00:25:21] You know, it's on the list. [00:25:23] It's on the list. [00:25:24] I have an outline for it. [00:25:26] I've got stories. [00:25:28] It's it's ended up more as a as a keynote or a leadership talk where I've come into some organizations to deliver it. [00:25:35] And, you know, again, I'll just, you know, if anybody's interested, I'd be happy to share it with them. [00:25:40] And if they have a team that wants me to talk with them about it, happy to do so. [00:25:44] To be honest that, you know, I just haven't dedicated the time because having written a couple books in the security space, they're they're painful yet cathartic. [00:25:57] And both the books that I've published have taken me a year ish to get done. [00:26:03] And it's a lot of work. [00:26:04] And then, you know, frankly, just, you know, being in startups, I haven't had the time other than I've collected more stories and more evidence that I think my my leadership framework is reasonably accurate. [00:26:16] I can appreciate that having spent a little time at startups myself. [00:26:20] So, yeah, well, thank you for that. [00:26:21] And I'll just pass the mic over to Hussein next. [00:26:26] Hussein, are you in a place you can ask a question? [00:26:28] Yes, indeed. [00:26:29] Thank you, Katie. [00:26:30] Good evening, Malcolm. [00:26:31] Welcome to the Fireside Chat. [00:26:32] You lead a very accomplished career, you know, from a brick and mortar Intel to jumping over to startups. [00:26:42] Can you describe that transition a bit? [00:26:45] It's a very big culture shift for me. [00:26:49] I'd like to hear a bit about that. [00:26:52] Yeah. [00:26:52] You know, it's it's funny. [00:26:54] Go back to when I left Intel. [00:26:57] I mean, I grew up in a big company that became bigger. [00:27:00] Right. [00:27:01] And I had a technical assistant. [00:27:03] I had an admin. [00:27:04] I had a lawyer. [00:27:06] I had a HR person. [00:27:06] I had a finance person. [00:27:07] I had a procurement person. [00:27:08] Plus, I had all my staff. [00:27:09] I mean, I had the accoutrement of, you know, a lot of support around me. [00:27:14] Right. [00:27:15] And I had handlers. [00:27:16] Right. [00:27:17] If I if I went to an event like this, I'd have two PR people on it. [00:27:21] And, you know, somebody listening and, you know, making sure I didn't go astray or when I went astray, they'd get worried and try and make sure that I didn't dig a deeper hole. [00:27:31] You know, that to silence where I landed and I was an individual contributor. [00:27:39] You know, charged with making sure silence was secure. [00:27:44] I was employee 150. [00:27:48] And to be honest. [00:27:51] I was. [00:27:52] It did not. [00:27:55] It was no experience change for me. [00:27:57] I was reasonably self-sufficient, despite the handlers I had around me, because I would always schedule my own meetings and do some of this stuff unless I got super busy or, you know, it was a complicated thing. [00:28:07] I, you know, still, by and large, did my own expense reports, booked some of my own travel. [00:28:13] My admin would help with it. [00:28:14] And so that type of leaving the that assistance around me wasn't that big of a deal. [00:28:23] Going to a smaller company, frankly, wasn't that big of a deal. [00:28:27] And even, you know, a couple months later, after I joined Stuart McClure, he was a little bit worried. [00:28:35] Big company guy for life and then going and doing a startup thing. [00:28:37] He worried that there would be that culture shock and I would perhaps not survive it because a lot of people don't. [00:28:48] And when, you know, 60, 90 days in, I'm down in Irvine and we're having a chat and just doing kind of a quarterly update on a few things. [00:28:57] He's like, hey, you know, I got to I got to tell you, you're doing better than I thought. [00:29:00] And I'm like, what the hell does that mean? [00:29:02] He's like, well, I thought you'd struggle with the startup and this and that. [00:29:05] And, you know, it was funny because in the dialogue that we had, I told him, I'm like, look, every job I had at Intel was a startup job. [00:29:14] It was just in the context of a big company. [00:29:18] My first job was a new position that he had created to negotiate the cab computing contracts for the design environment. [00:29:28] When I transitioned out of procurement more into dedicated financial, I was doing, you know, the first total cost of ownership stuff. [00:29:37] Hell, I helped fix Gartner's and create Gartner's TCO model from 30 plus years ago for total cost of ownership for PC client computing. [00:29:45] And then every role I had since then were always I went to the worst job possible that nobody wanted to go fix it. [00:29:57] Or it was brand new and I was creating it or, you know, it was a brand new role and I was jumping into it. [00:30:04] And even when I landed running security and business continuity, there was a small InfoSec team. [00:30:08] There's an InfoSec director, no offense to them, but they were policy wonks that had a small investigations team and did some control work. [00:30:18] There was none of the other aspects of anything that, you know, close to what people have today. [00:30:23] So it was all construction. [00:30:27] Sarbanes-Oxley happened. [00:30:28] I went and did that. [00:30:30] The privacy stuff went and did that. [00:30:33] You know, e-discovery efforts because of Intel's antitrust suit with AMD went and built that. [00:30:40] And I just glued all that stuff into my security role. [00:30:43] So for me, it wasn't that much different. [00:30:46] Then I'll go back to what I told Katie. [00:30:48] I believed in the mission. [00:30:50] I believed in the management. [00:30:51] I believed in myself. [00:30:52] Felt like I belonged and what I was doing mattered. [00:30:56] Then it's just, you know, that's how I really helped that solidify in me. [00:31:01] I always realized that if those things were in place, I would, that's what mattered. [00:31:09] And the rest of it was just how much I had to do on my own versus how much I was working through others to do. [00:31:19] Thank you. [00:31:19] Great insights. [00:31:20] Over to you, Lisa. [00:31:23] Hi, Malcolm. [00:31:23] I've really enjoyed the wisdom that you've imparted so far. [00:31:28] So I wanted to ask you a question. [00:31:31] Sure. [00:31:32] As we are getting towards graduation time. [00:31:37] So as you think about advice that could help people, what's the best advice that you would give to students that are making their way out into the working world or thinking about what to do with the rest of their lives? [00:31:51] You know, it's funny that you ask that question. [00:31:54] So I actually teach occasionally college courses. [00:31:58] And I actually probably a couple of times a year. [00:32:03] And back eight weeks ago, I don't know if you guys know Laz. [00:32:07] He's a co-founder of Blue Lava, former CISO for Sears. [00:32:11] Anyways, so I was teaching a class for him. [00:32:20] And, you know, towards the end of it, I knew that question was going to come up. [00:32:26] And I had a couple of slides, which I just pulled up. [00:32:29] So I'll read them. [00:32:30] So that way I'm not going off of memory and screwing it up. [00:32:32] So it's titled careers, where to start, how do you navigate your path? [00:32:37] And I told them almost what I told you guys. [00:32:39] I didn't plan to work for Intel. [00:32:40] I didn't plan to do risk and security. [00:32:42] I didn't plan to leave Intel. [00:32:43] It just all happened. [00:32:45] And again, the three lessons that I learned over the years that I shared with them is hard work beats talent that doesn't work so hard. [00:32:51] So, again, think about that. [00:32:52] Hard work beats talent that doesn't work so hard. [00:32:54] Absolutely true. [00:32:56] I'm not the most talented person. [00:32:58] I wasn't the best finance person. [00:33:00] I'm certainly not a technologist. [00:33:02] I'm certainly not, you know, a built security person, but I hustle more than many people. [00:33:10] Speak in such a way that others want to listen to you. [00:33:14] Listen in such a way that others want to speak to you. [00:33:18] Lesson to influence, be influenced, and again, create that sense of mission and purpose and belief and belonging and stuff. [00:33:26] And then my luck timing and execution. [00:33:27] And then the last thing I told with them is like, look, the perfect day. [00:33:34] If you can have this as often as possible, go to bed with a dream. [00:33:39] Wake up with a purpose. [00:33:41] You do those things. [00:33:42] You'll have a good career. [00:33:44] Some people know I want to be that. [00:33:46] I never knew what I wanted to be. [00:33:49] I still don't. [00:33:51] And that's okay. [00:33:53] I figured out along the way. [00:33:56] I love it. [00:33:57] Especially as someone who continues to find that I'm not, I'm still not quite sure what I'm going to be when I grow up. [00:34:04] But the journey is fantastic. [00:34:07] Yes. [00:34:07] Thank you for sharing all of that. [00:34:10] And I think it's great advice that I will pass along to my children and to the many, many young people who are, well, people just in general who are graduating with hopes and dreams. [00:34:25] If you want, I'll send you the couple slides that has what I just rambled off. [00:34:30] I would love that. [00:34:32] Thank you so much. [00:34:34] Vijay, I'm going to pass it along to you. [00:34:36] Thank you, Lisa. [00:34:37] Malcolm, fascinating journey. [00:34:39] And thank you for a lot of your insights. [00:34:41] We've had a lot of CISOs obviously join us on our fireside chats and a few senior folks also from cybersecurity firms. [00:34:55] You're fairly unique as a, you know, the CISO, a multi-time CISO in cybersecurity companies. [00:35:05] How does that look like? [00:35:08] Could you share us like how your job typically varies from the traditional CISO role? [00:35:15] Yeah, to be honest, there's, and I know a bunch of CISOs and stuff in other cybersecurity companies, wide variety of them, big and small, and people who've tried to do a journey like me and go from the big role into smaller startups and stuff. [00:35:32] There's, I'll be blunt, there's some of them that are complete faux roles. [00:35:35] It's, it's, it's, it's, it's smoke and mirrors. [00:35:43] They don't do anything internal for security. [00:35:46] It's a pure marketing role. [00:35:49] And that's a good chunk of them in security companies. [00:35:54] Mine, I have the marketing role. [00:35:56] I have the business development. [00:35:57] And I have all that stuff to support the company's growth and mission. [00:36:01] But I mean, hell, I was working on SOC, on our InfoSec policy for Epiphany because we're getting a SOC 2 underway. [00:36:08] And, you know, so literally I was cleaning up the 35 policies and procedures a couple hours ago. [00:36:15] And I scheduled tomorrow update meetings with the IT director, the DevOps director, the CTO. [00:36:22] I'm like, you're busy. [00:36:23] Don't worry about it. [00:36:24] I'll work with these guys. [00:36:25] And we'll, you know, adjust, you know, technically whether or not I shaped it to what we're doing or we have to do some cleanup. [00:36:35] Right. [00:36:36] And then we'll do our gap analysis. [00:36:38] And then we've got a meeting in a couple of weeks to figure out what resources we need so that we can get it all going. [00:36:43] So there's, you know, I still do that stuff. [00:36:48] I'm not a fingers on keyboard guy, never have been. [00:36:52] But, you know, so if it's somebody that's actually really running it and overseeing it, you'll know because you ask them questions. [00:37:03] So if I was on your guys' side and I was, you know, a buyer, which I still am, I'm buying technologies, you know, and solutions and stuff for Epiphany, just like it did at Silence and stuff. [00:37:16] And you'll have the CISO for that vendor come talk to you. [00:37:24] Ask them questions. [00:37:26] Ask them, you know, what's their biggest risk? [00:37:30] How are they managing these things? [00:37:32] And if they come across flat-footed, they're a marketing CISO. [00:37:35] They're not actually running anything or overseeing it. [00:37:39] Right? [00:37:42] So, like I said, for me, I still keep my fingers on it, even though I'm not the fingers-on-keyboard guy and I'm overseeing all those risk issues and the decisions. [00:37:52] Heck, even at Silence, you get to a certain size, everybody has incidents. [00:37:56] Who is the incident commander for things that affected Silence? [00:38:01] I was. [00:38:03] Because we had things that went bump every once in a while. [00:38:06] We had mistakes that occurred. [00:38:08] We had employees in Mexico City during an earthquake. [00:38:12] And guess who was coordinating, making sure they were okay? [00:38:14] Me. [00:38:16] So, like I said, I just, I have a tendency to not want to let that, but that's also because I don't want to just be, I want to stay true to it. [00:38:30] And frankly, I'll be really blunt with you guys. [00:38:32] I don't trust security companies. [00:38:34] You know, the security industry profits from the insecurity of computing. [00:38:39] So, at a macroeconomic level, most of the industry doesn't really care about solving the problems. [00:38:44] Now, I think that started to shift the past several years with startups and some of the stuff like that. [00:38:49] But I've bought from enough security companies. [00:38:53] I've seen the internal actions of security companies. [00:38:57] And there's a lot of security companies out there that have the cobbler's somewhat no shoes. [00:39:02] They'll sell you a security solution, but they're not doing very good internal security. [00:39:05] So, you know, if you're talking to the equivalent of me with a security company, put them through their paces and hold them accountable. [00:39:15] Love it. [00:39:18] Thank you for that. [00:39:19] And then the bluntness as well. [00:39:21] Appreciate it. [00:39:22] Anil, over to you. [00:39:23] Thanks, Vijay. [00:39:27] Malcolm, appreciate you carving out the time. [00:39:30] I think we met years and years ago during your Intel days. [00:39:33] And also, I worked with Stu back in his early days in Illinois. [00:39:38] One thing, you know, you're considered one of the thought leaders in our space. [00:39:43] Nowadays, I'm assuming you get pinged left and right to engage on the board level or advisory standpoint. [00:39:50] Has your approach or methodology changed in how you look at companies that you lend your name to? [00:39:56] Yeah. [00:39:57] So, you know, and again, I do board and advisor work for several different organizations, basically all in the security space in one way, shape, or form. [00:40:09] So, I'm on the board of directors, meaning I have fiduciary accountability as a board of directors. [00:40:16] The advisory stuff, you don't. [00:40:18] It's, you know, you're just providing advice and you might get stock or, you know, they write you a check every once in a while. [00:40:24] For the board roles, I'm on two boards. [00:40:28] One is the Cyber Risk Alliance. [00:40:30] It's the parent company to InfoSec World, SC Media, Enterprise Security Weekly, Collaboration Farms. [00:40:37] It's a media and events business that, you know, services the security industry. [00:40:43] I'm the only practitioner on the board. [00:40:47] The rest of the folks are media and event folks. [00:40:50] But, and I got connected to that from, you know, knowing the founder of Avanta. [00:40:57] You guys might all remember the CISO for CISO stuff. [00:41:01] And Bob Defless and I got to know each other way back in my Intel days when they were just doing CIO events before they started doing the CISO ones. [00:41:10] And when the Cyber Risk Alliance was getting formed and they were getting private equity and then hiring Doug Mononi, who's the CEO, fantastic leader from Sourcefire Media. [00:41:24] They asked me to join the board. [00:41:26] I said yes, because I liked the people and I liked what they were attempting to do and, you know, provide better business intelligence to the security community, better collaboration. [00:41:42] And then also better, you know, reach for the vendors since I've sat on the vendor side now for a long time. [00:41:50] So that's kind of a unique thing to do. [00:41:53] I also sit on the board of directors for TrustMap. [00:41:56] They're in the security performance management space. [00:41:59] So automating the security maturity assessments and stuff like that. [00:42:02] And then I do advisory work for a wide variety of companies. [00:42:06] I've got jobs, Syvatar, SafeBridge, Kconic, Zero Networks, a couple other ones. [00:42:15] And then I'm also an advisor to a large business that, you know, just got bought and separated from a large telecommunications company and is now owned by private equity because they wanted some external advisors to help guide their security and data protection efforts. [00:42:43] So, you know, I meet with them periodically and the team and attending their face-to-face in a few weeks. [00:42:51] You know, so for me, it almost goes back to the same thing. [00:42:55] If I trust them, if I like what they're trying to do and the impact it can have, and I think I can add value. [00:43:06] And certainly if it's a startup, you know, the technology has to work or it has to have the promise of working. [00:43:13] And I've done some advisory work for some startups that will frankly never go anywhere. [00:43:19] Great technology, great concept, but they just couldn't get their go-to-market going and, you know, the funding and stuff like that. [00:43:26] But I'll still go do it because of the, you know, the potential, you know, considering it fed my curiosity and fed my sense of purpose. [00:43:40] No, that's awesome. [00:43:41] I appreciate you sharing that. [00:43:42] I've seen those themes still hold true even back to when you got into the game and started working in that space. [00:43:49] So, appreciate those insights. [00:43:51] Back to you, Tomas. [00:43:51] Hey, Malcolm, you know, I want to follow up on what I'm going to ask, right? [00:43:58] Clearly a lot of activity there. [00:44:01] Yep. [00:44:02] And, you know, some of us have been talking about the whole uptick in a lot of these board events, networking events, vendor meetups. [00:44:12] How do you juggle all of these? [00:44:16] You know, to be honest, sometimes it can be a challenge. [00:44:20] Sometimes it's not that hard. [00:44:23] I get energy from interacting with people, which is why even doing this is fun for me. [00:44:32] Literally, it'll be like when I get done, my wife's going to go, you've got to have a couple glasses of wine because it's like you had two shots of espresso. [00:44:39] So, I feed off of interacting with people and learning and sharing and stuff like that. [00:44:48] So, it's just who I am. [00:44:52] It's why even go back to my Intel days when I took that security team, it was a couple dozen people. [00:44:57] As it was growing into hundreds, and then a lot of people don't know this, there was a period of time, but I also was general manager for the enterprise capabilities at Intel while I was CISO. [00:45:06] So, all the finance apps, HR apps, all the business applications at Intel reported to me, plus the strategic procurement group that I started at reported to me. [00:45:16] So, I have like 900 people directly underneath me and then span out further. [00:45:22] And when some of that stuff was occurring, the size of my organizations were growing, one of my managers, one of the corporate VPs was like, Malcolm, you got to stop doing that stuff. [00:45:36] I'm like, doing what stuff? [00:45:37] He's like, talking to everybody. [00:45:38] I was like, what do you mean? [00:45:40] He's like, you won't be able to scale. [00:45:43] And I'm like, yeah, maybe. [00:45:47] Because, I mean, literally, I could care less if it was the janitor who dropped me an email and said they wanted to talk. [00:45:52] I'd find time. [00:45:55] And I still do that. [00:45:57] It's because it's who I am. [00:45:59] It becomes a scaling challenge at times when there's too many things happening at once. [00:46:05] But it's almost the same thing for me. [00:46:07] I have a hard time saying no. [00:46:10] And if I can fit it in, I try and fit it in. [00:46:16] There's a point at which you get fragmented, though. [00:46:20] Like when you get too many advisory things, too many networking things, and you're not able to execute on your day job. [00:46:26] Now, when I was at Intel, I was limited in the capacity to do some of those external things, even though I did a number of them, because of the span and the size and just the weight of Intel in the marketplace and all the things I had. [00:46:43] As soon as I went to silence and I went to smaller companies, guess what? [00:46:47] I didn't have hundreds of people I was managing with tens of millions of dollars of budgets with a gazillion other things to go do. [00:46:57] So guess what? [00:46:58] I had a ton of capacity that I wasn't using in a massive organization to go teach recent college grads the Intel culture, go teach a leadership class, go do a business update meeting, attend the ethics and compliance over. [00:47:17] I mean, you guys know, and if you're in bigger companies, all of those committees and management meetings and all that stuff, in many ways, they're useful, but in many ways, they're time vampires. [00:47:30] And I got rid of all my time vampires when I left a big company. [00:47:34] And so it freed me up to dabble in a heck of a lot more ways. [00:47:38] And now I just, you know, honestly, it's if I try and keep to a certain number, because I still find that if I get more than, you know, eight, nine, 10 advisory or board stuff, it becomes too big. [00:47:54] But what happens with startups, they either die off and they slowly start, you know, not getting any momentum, which case your time to help them starts minimizing or they get bought. [00:48:09] And when they get bought, your your time with them also starts dissipating and changing, in which case, then I go back to when when it feels right, the right people, right time, right place. [00:48:24] I'll tuck another one in. [00:48:25] So it's it's, you know, I try and keep that, you know, six, seven, very active, but maybe eight to 10 in total. [00:48:38] And and that seems to have worked for me since I left Intel. [00:48:43] Love it. [00:48:44] I'm going to borrow that time vampires race, too. [00:48:49] I did trust me. [00:48:51] Eliminate time vampires. [00:48:52] They suck the life out of you. [00:48:56] True that. [00:48:57] Hey, Tomas, I realize it's 844. [00:49:00] Do you want to do a quick room reset and maybe bring the folks up? [00:49:06] Well, I certainly there, Vijay. [00:49:08] I was about to. [00:49:10] Nice. [00:49:10] You had one other pressing question. [00:49:13] So I wanted to make sure you got that in. [00:49:15] But I do appreciate that. [00:49:16] Look, it is. [00:49:18] All right. [00:49:18] Sounds good. [00:49:19] Look, if you do have any questions, if there's anybody in the audience that wants to sort of chime in, join the conversation, ask a question. [00:49:27] Feel free to raise your hand and we will bring you up on stage. [00:49:30] It is about 845 p.m. [00:49:32] Eastern time. [00:49:33] And this is our weekly fireside chat. [00:49:35] We do this every single Wednesday. [00:49:37] We bring in a guest. [00:49:39] This evening we're joined by Malcolm Harkins, who's joined us. [00:49:43] If you just joined us, you've missed a good conversation so far. [00:49:46] I'm not going to recap it because we actually have it recorded. [00:49:50] So you can go back and listen to it afterwards. [00:49:51] But if you have been here for the get go and you want to pop up on stage and ask a question, feel free to raise your hand and we'll bring you up. [00:49:58] So I do see Mr. Pan. [00:50:01] Peter Pan has joined us. [00:50:03] So, Peter, anything you want to ask Malcolm? [00:50:07] Thank you, Thomas. [00:50:08] Thank you, Malcolm, for sharing this wonderful experience. [00:50:11] I'm the founder of Deuteronomy. [00:50:13] So I think my question is, I have been in a couple of sub-security conferences where lots of companies are rating them the number one risk for them is really the inability to hire quality sub-security professionals. [00:50:32] And on the other hand, I do hear like lots of junior people, they have a hard time to find a sub-security job. [00:50:40] So my question to you is that as a CISO of model companies, do you see the risk of hiring security professionals? [00:50:51] And if you agree, and what's the gap there? [00:50:55] How do we solve these problems? [00:50:58] Yeah, good question. [00:50:59] Good question. [00:51:00] So, again, put on my economics hat and look at this from an economics perspective. [00:51:07] If you go back to my statement of don't trust the security industry because it profits from the insecurity of computing, and you look at the inefficiency and ineffectiveness of a lot of what we're doing that then drives, let's buy more, let's get more alerts, let's do more, more, more, more, more, more instead of better. [00:51:28] However, we haven't, you know, again, I grew up in a manufacturing company, we got to get yield, right? [00:51:34] Yield in a manufacturing means lower product cost, higher output, right? [00:51:39] You know, if you look at the companies that I have gone to since I left Intel, and the companies I advise, I'm going after people who are trying to change not only the risk dynamics, but the economic dynamics of the industry, and lowering the total cost of controls. [00:51:57] And part of the total cost of controls is the fact that we have created our own labor shortage because of our own failings for how we manage risk. [00:52:08] So we need more bodies because we've done a crappy job of mitigating risk up front is a strong personal belief I have. [00:52:17] Now, how do you solve that? [00:52:21] You, you have to automate more to lower cost because more manual efforts is higher cost. [00:52:30] And we have to constantly I have a bias towards prevention, I know we can't eliminate risk, but I have a strong bias toward prevention, because prevention is the only true form of minimizing vulnerability and the potential for harm. [00:52:44] Detection of response or damage minimization controls. [00:52:46] So when you're detecting and responding, bad things are already occurring. [00:52:51] And so the macro things that you should measure there are time to detect and time to contain. [00:52:54] So if you have a philosophical view, and I've written this in my books, my nine box of controls that you, you constantly shift to automation to lower cost and you constantly try and reduce risk by preventing it proactively, and then shrinking things and having design goals around it. [00:53:13] Believe it or not, you end up with not as much of a labor issue. [00:53:17] I mean, I was able to build from scratch when I was at silence, you know, until I left when we were almost 1000 people. [00:53:25] You know, I had a handful of security folks that included the compliance team. [00:53:30] And we got a lot of stuff done because we instrumented with a level of automation and, and a focus on proactive, you know, prevention as much as possible. [00:53:44] And believe it or not, when you do that, you know, the detection response stuff. [00:53:49] Yeah, it happens. [00:53:50] And yeah, you're gonna have to deal with it. [00:53:51] And you're gonna have to instrument more and more and more. [00:53:53] But it becomes more easily manageable because I focused on it like I would a finance person. [00:53:56] How do I get yield out of this stuff? [00:53:58] Now, having said that, even if we did all that stuff, and we all did all those things, we'd still have a labor shortage. [00:54:04] Because then we'd have the shortage on the upfront design development architecture, pre implementation of technology that if that was done better, we'd be also preventing a hell of a lot more issues. [00:54:18] But I'd rather have the labor shortage at that security development lifecycle privacy by design side of things, than where we have it today, which is all in the back end, in the more tactical IT operations of it, that we're all living in. [00:54:38] So I'm, you know, now, having said all that, you go, okay, that's, you know, like solving world hunger, but you can, you can do it within the, the, your sphere, in your organizations, but more broadly, in the industry, I look at talent, like, you know, you know, almost anything, it's a build versus buy. [00:55:00] Build versus buy. [00:55:01] I can either buy the talent and compete with everybody else for the high cost. [00:55:06] People. [00:55:07] Or, going back to what I said to Katie earlier, I can create a culture of believe, belong and matter. [00:55:14] Go get people that are hungry, humble and smart, and groom them at a lower total cost, a higher sense of purpose. [00:55:24] And guess what, they'll be sticky with me because I'm giving them career lift. [00:55:28] And then I constantly backfill at the beginning of it with more junior people that don't have the, the pedigree or skillset yet. [00:55:38] And I have that strong belief because when I started at Intel in 1992, Intel was hiring a thousand people a month. [00:55:46] And guess what? [00:55:47] 90% of them were recent college grads, never had a job before. [00:55:51] 90% of them were in the middle of the year, and I think that's what I'm doing for. [00:55:54] It grew the talent because it knew economically that was the only way to do it and the most cost effective way to do it. [00:56:05] Thanks, Peter. [00:56:08] Thanks. [00:56:09] Thanks, Peter. [00:56:10] Thanks for popping up on stage and asking you a question. [00:56:13] Ryan, what's going on? [00:56:15] Ryan, over to you. [00:56:16] Anything you want to ask, Ma? [00:56:18] Hi, Malcolm. [00:56:19] Nice to meet you. [00:56:20] My name is Ryan Rosado. [00:56:21] Gotta say that when you mentioned the leadership challenge, I don't know if you saw the chat, but I had actually just been talking about that one last week. [00:56:29] So just super happy to hear about that. [00:56:31] Oh, cool. [00:56:32] Was curious what edition you read, only because I know they are really good at updating it. [00:56:37] But my real question is, with you having started your career really in Intel, I started actually in cyber intelligence as well. [00:56:45] I'm curious since, you know, in where you are in your career, how do you specifically think that starting in Intel or having such a, having Intel be such a deep or substantial part of your foundation? [00:57:00] How do you feel like that maybe if that changes you as a CISO or adds to your, to your goal? [00:57:07] I'm just curious. [00:57:08] I've been doing this for about 10 years. [00:57:11] So just curious maybe what, what additional insights you've. [00:57:15] Yeah. [00:57:16] Yeah. [00:57:17] And I just went and looked at the bookshelf outside my office and it was the fourth edition of the leadership challenge that I had grew up around and taught for a number of years. [00:57:27] And I think they're what on their seventh edition now or something like that. [00:57:34] I can't remember. [00:57:35] But so, and, and on Intel, yeah, it's, you know, Intel was so culture strong when I landed there and Andy Grobe was running the company. [00:57:46] And there was just this relentless pursuit of Moore's law about always, you know, doing better and stuff. [00:58:02] And, and, and, and again, I, it, it just, it was a good home for me to grow up in as a professional because of just the, the directness. [00:58:18] Intel could be harsh back in the day, which I still can be, even though I've softened a bit, but just plain blunt talk. [00:58:27] What's the problem, who owns it and what the hell are we going to do about it? [00:58:31] And when's it going to get done? [00:58:32] Right. [00:58:33] Or what's the big idea that seems impossible, but man, if we could do it, it'd be cool. [00:58:43] And you go start, you know, figuring it out. [00:58:48] So it, it, for me, it, it was a perfect spot to be in. [00:58:56] I'll be blunt. [00:58:57] I probably would have gotten fired in too many other organizations because my mouth goes before my brain engages. [00:59:02] And I'm not a shy individual. [00:59:04] In 1995, three and some years into Intel, I was asked to give a strategic review to Intel's executive staff. [00:59:13] Andy Groves starts beating me with questions on the second slide. [00:59:18] I walk up to this U shaped table in the boardroom, you know, Gordon Moore's there. [00:59:24] I mean, all the legends of Intel who upgrade the company. [00:59:27] And I said, can you shut up for a minute and let me build a base of data. [00:59:30] And then you can come at me with questions. [00:59:32] And then I went back to the old school foil machine. [00:59:35] That was the plastic overlays with the overhead. [00:59:39] You could have heard a pin drop in that room. [00:59:42] I would have gotten fired any other place. [00:59:45] Because I, I just like, look, you hired me to get stuff done. [00:59:50] If you're in your way, you're in my way, I'm going to give you an opportunity to move over or I'm going to run over you. [00:59:58] And I still, you know, operate that way today, other than I'm probably a little bit mellower. [01:00:04] But Intel was that way. [01:00:06] And it was, it was a perfect environment for me to grow up in. [01:00:09] And, you know, but I still love it, even though I'm not there. [01:00:13] And even though it's changed and mellowed and, you know, while it's doing good, it's, it certainly doesn't have the, the impact that it did at times and lost its, you know, way in some, some ways. [01:00:29] But glad Gelsinger's back who grew up at Intel to run it and, you know, get that stuff going again and, and innovating. [01:00:37] So, like I said, it's, it, it definitely, you know, was a spot like how I ended up there. [01:00:45] I felt a sense of belief, longing and what the company was doing, what I could do to help the company regardless of the role mattered. [01:00:58] Thank you. Appreciate it. That was really interesting. [01:01:02] Thanks. [01:01:03] Thanks, Ryan. Thanks for popping up on stage. [01:01:06] Philemon, good to see you, my friend. [01:01:09] Well, good to hear you because I can't see you, but thanks for, thanks for joining us, Philemon. [01:01:15] Go ahead. [01:01:16] And I know it's late for you, right? Or early? [01:01:18] Where are you at this? [01:01:19] 11am Sydney, Australia. [01:01:22] So yeah. [01:01:24] You're fine. [01:01:25] Privileged to be here. [01:01:26] Thank you, Malcolm. [01:01:28] Really liked the practical insights from your leadership journey. [01:01:32] You raised an important point relating to cyber leaders or CISOs that don't have any, you know, technical bone. [01:01:41] You know, you said smoke and mirrors, which obviously is, you know, a big concern in the industry. [01:01:48] My experience dealing with CISOs, I think on the other hand, I see a lot of CISOs who have 10 to 20 years experience in cybersecurity, very strong technically, but also failing to transition into that executive space. [01:02:05] Yeah. [01:02:06] They struggle to detach themselves from, you know, the technical decision making and stuff. [01:02:12] So where do we find the balance? [01:02:14] And I also see some unhealthy tension within the industry where, you know, there's a stereotype against, you know, CISOs that don't come from technical backgrounds. [01:02:24] And how do we, you know, how do we solve this? [01:02:28] Yeah. [01:02:29] So I have frameworks for everything. [01:02:33] So again, dating back to my Intel days and given my background and pedigree, there's, you know, kind of three dimensions of, I think, looking at what is required to be that executive chief information security officer, chief security officer, chief trust officer, [01:02:53] chief privacy officer, chief privacy officer. [01:02:55] And I glue them all together because I think they're interrelated. [01:02:58] I, you know, for those of you that are old enough, you might remember there was a design company, IDEO, back 70s, 80s and stuff. [01:03:07] They, I think, helped create the original Xerox machine. [01:03:12] They were a spin out of something like that. [01:03:14] Anyways, they used to talk about the ideal technologist. [01:03:17] And I grew up around this at Intel, because it was a highly technical company. [01:03:20] And it was, they were said the ideal technologist was T shaped. [01:03:24] And the top of the T was their breadth of business acumen. [01:03:29] And the pillar of the T was the depth of technical acumen. [01:03:34] And go back to my Intel days. [01:03:36] I'm in the job five ish years. [01:03:39] And other than that, every other job I had at Intel, I was changing roles every 12 to 18 months. [01:03:45] Because there'd be a problem, I'd go start solving it, or somebody go grab me and put me in a role that nobody else wanted. [01:03:53] Or there was some new thing. [01:03:55] I was just, you know, plug and play. [01:03:58] So I was moving around a ton until I landed security. [01:04:01] I'm five years in, other than I'm continuing to grow into my stuff. [01:04:05] CIO, John Johnson, loved working for him. [01:04:10] He sat me down and he was worried about my development. [01:04:14] And that I would get bored in security. [01:04:18] And this is 2007 ish, 2008. [01:04:23] And, and so he's wanting to talk about other things. [01:04:27] And I was like, JJ, you don't understand. [01:04:29] I have to have all your knowledge. [01:04:33] I have to have all this risk security controls compliance acumen. [01:04:36] And I have to have enough business acumen. [01:04:39] And so I went to a whiteboard and I drew the T and he's like, yeah, yeah, ideal technologist. [01:04:43] And he goes, I'm that, I'm the CIO. [01:04:45] And I'm like, yeah, I get it. [01:04:46] I was like, but I have to be Z shaped. [01:04:48] And I drew a Z and I've actually written about this in my book. [01:04:50] I was like, I have to have the breadth of business acumen. [01:04:53] I have to have the breadth of technical acumen, not the depth, the breadth of technical acumen. [01:04:58] And then the hash that creates the Z is the risk security controls and compliance breadth and depth. [01:05:04] I said, now surrounding all of that also has to be a level of personal integrity, objectivity, not happening on my damn watch. [01:05:13] You know, all those things that make me and my organization above reproach and in some cases unbindable and unbreakable under certain circumstances, regardless of who's telling me to whitewash risk, which does occur. [01:05:30] You guys probably have all experienced it. [01:05:33] And that's actually a talk that I'm leading at RSA in a few weeks on on integrity for the role. [01:05:39] So for me, you have to again, it's a growth thing. [01:05:44] If I didn't have the technical depth, I had to grow my technical depth. [01:05:48] And then because I wasn't a technologist, I had to surround myself organizationally with people that I can trust that would keep me from making stupid technical decisions because I wasn't a technologist. [01:06:00] And so there's ways in which you can mitigate that when you look at that Z shape that I described and you go not only for that is for the individual, but structurally, I my Intel days, anybody's work for me, I always try and grow them to be these Z shaped individuals with the right values and the right ethical and integrity issues. [01:06:22] I want to grow their business acumen, I want to grow their technical acumen, I want to grow that risk security controls compliance depth. [01:06:29] And so to me, that's, it's, you have to grow it. [01:06:34] It's just not innate. [01:06:37] The thing that that's innate is, does the individual have the desire to grow that way? [01:06:43] And at some point, we all peter out, right, you hit a plateau. [01:06:48] And, you know, either you don't want to transition past it, or you just can't, just like, I work out every day, but I will likely never do an Ironman. [01:07:01] I don't think physically I have that capacity in me. [01:07:04] But I could, I just don't want to spend the multiple years to go develop it and find out, right? [01:07:10] Awesome. [01:07:11] Thank you so much. [01:07:12] Appreciate it. [01:07:13] Thanks, Philemon. [01:07:14] Thanks for jumping up on stage and asking a question. [01:07:15] And Malcolm, I'm sure you can do an Ironman. [01:07:16] Come on. [01:07:17] You've been home for two years in the pandemic. [01:07:18] You've been working out. [01:07:19] You know, it's funny, my oldest son, who's an adrenaline junkie, and lives in Colorado, texted me this morning to see if I wanted to do a road biking thing in Northern California if he comes sometime late this summer. [01:07:26] And I think it's a great question. [01:07:27] It doesn't ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever ever [01:07:57] 30 and I've done that for decades. Um, and I'm like, okay, well I need more specificity. Cause [01:08:03] I know I could go get on a bike and do five to seven miles, no sweat up and down a few things. [01:08:11] I could do a 25 mile bike, like right now, flat 75 to a hundred mile bike. Uh, you know, [01:08:18] that'll take some, uh, that would take some training and conditioning. So, um, yeah, I, [01:08:25] you know, and so I left the door open. I was like, but until I know more and, and know whether or [01:08:30] not I can afford the time to go get myself conditioned, or if you go, Hey, a 75 to a hundred [01:08:35] mile bike, but we're going to do 25 miles a day through the Napa Valley. And we're going to go [01:08:39] have, you know, a couple hours of biking and then go have nice lunch and drink wine and go to dinner. [01:08:44] Yeah. I could do that for three days and do, you know, 75 miles in three days, but 75 miles in one [01:08:50] shot. I don't, my, I don't want to be that sore. Um, uh, you know, um, doing it straight out of the [01:08:59] gate, but no conditioning. I hear that, man. I hear that. That is, uh, not something that I [01:09:05] have on my list of aspiration. Um, Katie, I know you had another question or two. Why don't you, uh, [01:09:12] go ahead. And if there's anybody in the audience that wants to jump up on stage, [01:09:15] feel free to raise your hand and ask your question. If you don't want to raise your hand, [01:09:19] ask a question, you can pop it into the fire site room chat and we will ask the question for you. [01:09:25] Go ahead, Katie. Thank you. Um, yeah, Malcolm really enjoying this conversation this evening. [01:09:31] Um, you know, I, I, it might be a controversial question. I hope not. Oh, go for it. Oh, [01:09:38] I mean, you said you were so very, very early on you said, and I thought it was interesting between [01:09:44] MBA finance accounting and working your way through college that you lived a mile and a half away from [01:09:51] Knott's Berry farm. What I would love to know is when you were a little, you know, seven-year-old [01:09:58] kid showing up to Knott's Berry farm, where did you go first? Yeah. Great question. You know, so, [01:10:04] um, again, we were a mile and a half away. My dad worked nights and weekends, uh, and, and, [01:10:11] uh, and stuff. So afternoons, my brother and I, we get home from school. Um, we do our homework and [01:10:17] there was a couple nights a week where, and again, it was the old tickets for any of you that are old [01:10:23] enough. You'd eat a Disneyland and the A tickets, E tickets, whatever. Knott's Berry farm had similar [01:10:28] thing. And there was no gate around Knott's Berry farm at that time. We would walk up there after [01:10:35] homework and do an early dinner and we would walk past Walter Knott was still alive. He lived on a [01:10:42] mobile home at the edge of the parking lot on the park, 90 something. He'd sit there. We'd say hello [01:10:49] to him, chat with him for a minute or two, because he saw us a couple of days a week. And then my first [01:10:53] ride that I always wanted to go to was the log ride. Well, yeah, that makes a lot of sense. Uh, [01:11:00] I've heard a lot of great stories. I've actually never been to Knott's Berry farm, but, um, you, [01:11:04] you mentioned that so early on, I thought it must've left an impression and, um, you, you kind [01:11:09] of answered my follow-up question. You know, the reason I wanted to, you know, kind of get into the [01:11:13] headspace of, you know, your, uh, you know, very beginning origin story, because you said several [01:11:17] things that stood out to me, uh, through the conversation, hard work beats talent that doesn't [01:11:23] work as hard, I think is what you said. I don't want to say this incorrectly because I know [01:11:26] you're, you're, uh, you've trademarked some of these things, so I don't want to misspeak. [01:11:29] No, no, that, that one I haven't, but yeah, hard work beats talent that doesn't work so hard. [01:11:33] There's another one that I've got. If you actually were able to see my office, you'd see all the, [01:11:38] you'd think I was this weird idiot because I've got post-it notes literally several feet up, um, [01:11:44] in front of my computer with all these things that have come out of my mouth or sayings that I've [01:11:48] heard that I like. Um, one of them is the only place where sex success comes before work is the [01:11:54] dictionary. I love that one. [01:11:56] Also something you learned in the, the very early origin of your, in your, after Knott's Berry Farm, [01:12:03] it sounds like you'd sit down and read the dictionary. I mean, who doesn't do that? [01:12:06] But you know, it sounds like, I mean, you mentioned your father was working, you know, [01:12:09] several jobs. It was, it's very clear that you have, you know, a work ethic. And, um, I just, [01:12:14] I find it interesting that you've also, then you went into a, you know, into recruiting and being able [01:12:18] to identify not just intelligent, um, and passionate people with purpose and curiosity, [01:12:24] but then also it seems like you've also been able to, to hone in on that work ethic piece as well. [01:12:29] So, um, it was more of a comment than anything. I just kept seeing that kind of, uh, almost not as [01:12:35] deliberately being brought up throughout the conversation and just wanted to say, you know, [01:12:39] I think that's really interesting. And, you know, are there ways when you're, you're, uh, recruiting [01:12:45] or interviewing or looking at the startups where you're wanting to work with those founders is how [01:12:50] much of, of that hard work piece is, you know, is that maybe, is that fourth or is that first, [01:12:56] second or third in that? Yeah. Thank you. [01:12:58] Yeah. It's a good question. Um, you know, I, I think most founders have a strong work ethic or [01:13:10] believe they do. Otherwise they wouldn't, you know, go take the leap to go, um, try and found something, [01:13:15] but there's, if you go to Maslow hierarchy, right. You know, there, you know, your, your hierarchy of [01:13:25] needs, right. I mean, I grew up in, like I said, a, a low income neighborhood with gangs around, [01:13:32] um, Spites shootings, elementary school, kids would pull out knives. If a fight happened, [01:13:40] um, helicopters would fly over our house every once in a while because of shootings in around, [01:13:45] um, the area. So, you, you know, you grew up like that, you, you know, and I went to school with [01:13:53] kids that are in jail. [01:13:55] Um, manslaughter, other things, drugs, um, you know, and, and my parents were hardworking and [01:14:02] conservative and my dad busted his ass to, you know, get my brother and I educated, get us into [01:14:10] private schools by the time we get into high, you know, junior high and high school, um, paid for my [01:14:17] college paid for most of my graduate degree. So I, I grew up seeing that just hard work, [01:14:25] to make the next generation better. Um, and it's just, you know, um, it's part of it. And, and, and I know a bunch of people who grew up privileged, who bust their ass all the time too. Um, and, you know, I, I just, you can tell people who coast. [01:14:47] Um, and it's okay to coast depending upon the job, depending upon where you're at in your life, um, and stuff like that. But, you know, if, uh, um, if, if it really needs a level of, uh, grit, if it needs a level of somebody willing to do the grind, you gotta find people who are willing to do the hard work and not be shy of it. I've had a lot of folks. [01:15:17] You know, and I, I, I still mentor recent college grads. The fact I was, uh, guy that the class I taught at Pepperdine, um, he's in the Navy. He's getting out in a couple months. [01:15:28] I made an offer to all the students. I'll chat with you. Anybody, anytime, call me. I'll, I'll spend time and give you career advice. I've spent four or five hours with them since March. Um, cause he's hungry. He's humble. He's smart. [01:15:42] You know, and, uh, and I'm trying to help network him in two roles. And he's a IT network administrator, not a security person, but he's getting his MBA and he's getting, you know, uh, security certifications. And he wants to figure out how to get into cybersecurity. [01:16:01] And then he's like, well, how do I, how do I become chief information security officer someday? I'm like, go back to my thing. Hard work speeds down. It doesn't work so hard. [01:16:11] Luck timing and execution. And you're going to have to make a lot of sacrifices to get there depending upon how quick you want to get there. [01:16:19] And I said, but let me, you know, I, I went and asked him a different question. I said, tell me the life you want to be, you know, he's 25, I'm 54. I'm like, tell me what life you want to live when you're in your early fifties. [01:16:31] What, what do you know? Married kids home, uh, vacation home, aging parents that you want to take care of philanthropic efforts that you want to donate money to, or are you the type that just says, Hey, I want to make a decent amount of money. [01:16:49] I don't want to want for anything, but I don't have any, you know, anything necessary more than that. And if it happens, it happens. If it doesn't, it doesn't. You just want to do be intellectually stimulated and make a decent amount of money. [01:17:03] It's like, if you can tell me what life you want or have an idea of it, I can tell you how long it's going to take you to get there and what net wealth you need to be there and what sacrifices you might have to do to get there. [01:17:19] So for me, I look at it from that perspective and I made a lot of sacrifices to drive myself hard. [01:17:27] You know, I got promoted every 18 to 24 months at Intel in a 24 year period. [01:17:32] I mean, I went from a recent college grad to a vice president in, you know, um, decade and a half. [01:17:44] Um, and it requires a lot of sacrifices, missing kids, birthdays, anniversaries, you know, um, heck, you know, I'll, I'll just share it. [01:18:00] Some of you may have been in the same situation at times. [01:18:03] I managed incidents while my parents were both on their deathbed several years apart. [01:18:08] Why? [01:18:08] Cause they were nation state incidents and I had to be in the middle of it while I'm sitting next to them at the hospital a few hours before they die. [01:18:18] They, you know, I had to do it. [01:18:20] I had to do it because of what I wanted to deliver for my family down the road, but I had to also manage, you know, um, stuff at home too. [01:18:33] You know, that's where there's a lot of stress in our roles and we end up sometimes in that push and pull of personal life, corporate life. [01:18:44] And if the corporate thing is material, you can't not keep your eyes on it or keep your finger on it while you're dealing with sometimes life events at home. [01:18:54] And it's just, unfortunately that, you know, happened to me multiple times and, you know, so you have that dialogue and you go, I, you know, doesn't mean you might happen that way for somebody, but it, it, uh, it's a decent likelihood. [01:19:10] If you're choosing the path of, of running cybersecurity. [01:19:13] Wow. [01:19:14] Malcolm, I can tell you that, uh, I can't even coast if I wanted to at home. [01:19:24] My wife won't let me. [01:19:25] I'm the garbage man. [01:19:29] I'm the Mr. [01:19:30] Fix it. [01:19:30] But, uh, I, I, a lot of what you said resonated with me. [01:19:35] Uh, I know we've, we've sacrificed, I've sacrificed, uh, quite a bit in my role. [01:19:40] Um, [01:19:41] Um, anyways, I don't really care to get into that, but, um, but yeah, it's, it's, it's tough. [01:19:48] It's tough. [01:19:49] And, uh, [01:19:50] Uh, anyways, [01:19:53] but knowing that other, knowing all of us might face that if you haven't, and some of us have, it's a struggle, hence struggle for shared aspiration. [01:20:05] And, you know, again, I'll tell you guys, like I tell everybody, if I can help and you're in a struggle, drop me a note, ping me. [01:20:16] I'll, I'll find the time. [01:20:17] I was lucky enough to have other people in my career at Intel executives when I was junior. [01:20:25] That I, that created lift for me because I would just say, Hey, can I pick your brain? [01:20:30] Can I get some help? [01:20:32] I'm struggling with something and I need somebody to give me perspective. [01:20:35] And I still go back to some of them and I haven't worked with them for decades, but they're still available to me. [01:20:44] Just like I am for anybody that I've ever worked with, or I sometimes randomly meet like the guy who's in my Pepperdine class. [01:20:57] Yeah, definitely need to reach out and call someone. [01:21:01] If you do need, uh, if you do need any sort of assistance or somebody to bounce ideas off of, that's definitely a good thing. [01:21:08] Having a network of friends or even colleagues or trusted colleagues or mentors or what have you. [01:21:14] It's, it's, uh, it's good because no one should suffer in silence, right? [01:21:18] Yep. [01:21:19] No one should, uh, struggle in silence. [01:21:20] So there is a, just a pivot and switch gears a bit. [01:21:24] I did see David Cass join us. [01:21:26] David, welcome. [01:21:26] I'll give you a minute to settle in. [01:21:28] There was a question in the chat that was posed by, uh, Matthew. [01:21:32] Uh, can you ask Malcolm if he believes there has been an improvement since 2013? [01:21:38] And information sharing between CISOs and organizations, or is this, or is, or if this is still a huge challenge for the industry. [01:21:48] Hopefully I got that question. [01:21:49] Right. [01:21:50] Yeah. [01:21:51] I, there's definitely been pockets of tremendous improvement, but there's also pockets of people who just will sit on the side, let everybody else share their information. [01:22:06] Um, and then never say a word and just collect data and intelligence and never contribute back to the community. [01:22:14] Um, I still see it. [01:22:16] I, it drives me nuts. [01:22:18] Um, and I hear the excuse from people. [01:22:23] Well, my general counsel won't allow me to do it. [01:22:27] I, you know, I don't know. [01:22:28] I'm a risk taker. [01:22:29] First time, uh, one of the times I was in front of the board, uh, at Intel, again, it was, uh, 2009, 2010. [01:22:38] And anyways, we're having a dialogue and threatened intelligence and public party partnerships were, you know, starting to emerge then. [01:22:45] And, you know, the next generation of them and stuff. [01:22:48] And I got asked a question from the board and I, you know, um, I was like, yeah, I, I belong to this group and this group and share. [01:22:54] And I, you know, play with some of these government agencies from time to time and, and different ways. [01:23:01] And, and I, I generically answered, uh, answered it and Paul Oedlini was running the company at the time. [01:23:06] And he, he was like, you didn't really answer that. [01:23:10] And I'm like, I don't like, ah, crap. [01:23:12] And I'm like, okay. [01:23:14] It's like, okay, let's, let's be blunt. [01:23:16] I said, uh, Norm is the CIO of Qualcomm. [01:23:19] Joshua Davis is the CISO for Qualcomm. [01:23:21] We all know each other. [01:23:22] We all know each other. [01:23:23] And I know what's going on in his environment. [01:23:25] He knows what's going on in mine. [01:23:27] And I said, and I know we're market competitors, but I don't really give a crap. [01:23:30] Our competitors are the people who are trying to do damage to this industry. [01:23:34] And you could hurt a pin drop on the board. [01:23:37] And, and of course the, the general counsel and one of the lawyers on the board was like, [01:23:41] what, what non-disclosure agreement and, you know, whatever do you have in place for these things? [01:23:47] And I said, none, they're handshakes. [01:23:49] They burn me. [01:23:50] I burn them as like, and it's trust. [01:23:54] I was like, trust is not in the form of a contract. [01:23:56] It's because I know the person. [01:23:58] I trust the person. [01:23:58] They're vulnerable with me and I'm vulnerable with them. [01:24:02] That's how I do it. [01:24:03] You don't want to know how I do it. [01:24:05] Don't ask. [01:24:06] But that's what I do. [01:24:09] And, and then you saw this all uncomfortableness. [01:24:12] And I'm like, look, I recognize if I screw it up, you'll fire me. [01:24:18] And they're all like, yes, we will. [01:24:20] I said, great. [01:24:21] We're all clear then. [01:24:23] I'll do it the way in which I do it. [01:24:24] And if I screw it up, you can fire me. [01:24:26] All good. [01:24:27] That's how we ended the dialogue. [01:24:29] There's, but it was a very uncomfortable moment because a lot of people are like, you're, you're sharing what with who? [01:24:35] Right. [01:24:36] But I'm like, look, guys, I will trade in sensitive information. [01:24:42] And I still do. [01:24:44] In order to protect my organization and protect other parts of critical infrastructures and prints that I have. [01:24:51] And in return, they do the same for me. [01:24:58] Just some people are more, they'll take, but not give. [01:25:03] And I try and do both in at least equal proportions. [01:25:09] Yep. [01:25:10] I hear you. [01:25:11] There was a comment in the, in the, in the chat saying that's powerful. [01:25:15] Trust is not a contract. [01:25:17] I agree with that. [01:25:18] I mean, there, there's also telegram. [01:25:19] You can use telegram. [01:25:22] But that didn't exist years ago. [01:25:24] If you have to have a contract, there's no trust. [01:25:27] I, you know, you have to have it for some things, but I go, the contract doesn't generate trust. [01:25:33] It just generates how you're going to sue each other. [01:25:37] If, if the relationship doesn't pan out. [01:25:41] Yep. [01:25:41] Absolutely. [01:25:42] David Cass, are you with us? [01:25:44] David Cass. [01:25:46] Hey. [01:25:47] Hey. [01:25:48] Why don't you introduce yourself real quick, David? [01:25:51] And say whatever disclaimer you have. [01:25:53] Yep. [01:25:53] So yeah, exactly. [01:25:54] Any, any opinion is mine. [01:25:57] I represent that of past or present employers. [01:25:59] So I'm currently the global CISO for GSR and also their US CTO. [01:26:07] So by the way, Malcolm, if that 25 year old happens to be looking for a role in enterprise [01:26:11] IT, I have openings. [01:26:13] You know, to be honest, we can have a side note on that, but I've plugged them into a couple of people for just, again, mentorship. [01:26:23] So that way they might have an opening. [01:26:26] It might be in the network team and then it might lead to the security team. [01:26:29] But yeah, I'll, I'll connect them to you. [01:26:31] Like I said, he's, he's a smart guy. [01:26:33] No, perfect. [01:26:34] And I do owe you a follow-up as well. [01:26:36] Yeah, no worries. [01:26:36] Up to my eyeballs and like money transmitter licenses. [01:26:40] So yeah, happy to join you. [01:26:41] Always a great conversation. [01:26:42] So no questions from me, just apologies for being late. [01:26:46] I literally just got off of phone calls. [01:26:48] No worries. [01:26:49] And, and, and, and again, you know, David, congratulations on your, your other new role that was announced, you know, the other day or so. [01:26:58] Yeah. [01:26:58] I'm starting to think free time is a hobby that I don't have anymore, but. [01:27:02] Oh, come on. [01:27:05] You're not with the federal reserve anymore. [01:27:06] You've got plenty of free time, but no, always a pleasure, man. [01:27:09] And I definitely appreciate all your insights that, that I've caught so far, but you know, no questions for me. [01:27:16] Thanks. [01:27:17] That's all right, Mr. President. [01:27:20] Congratulations, Mr. President. [01:27:22] But did somebody say hiring for a security architect in California for the NFL? [01:27:27] Sorry. [01:27:28] Oh, that was a different conversation. [01:27:30] Go ahead, Lisa Beth. [01:27:31] I know you wanted to say something. [01:27:33] So I have a quick question for you, Malcolm. [01:27:35] You know, this evening has been full of, um, so many different experiences that you've had and, um, the wonderful advice that you've provided. [01:27:45] I'm wondering, you've done so many different things in your life. [01:27:51] What is the best compliment that you've received? [01:27:56] Wow. [01:27:57] Um, [01:27:57] I, [01:28:01] Boy, there's a couple of them that come to mind. [01:28:05] Some personal, some from a work perspective. [01:28:09] Um, from a personal perspective, um, from a personal perspective, when, um, I was promoted to a vice president at Intel. [01:28:19] Intel would do a corporate officers and board dinner. [01:28:23] We took over the California Academy of Sciences. [01:28:25] There was, you know, dozen of us that were promoted and, you know, board and executives and stuff like that and our wives. [01:28:33] But they, Intel had a, an approach to create a book for all the people that got promoted and had their pictures and your boss wrote something about you and stuff like that. [01:28:47] And, and you were asked to go find somebody, a colleague, a friend, a family member to give a quote about you. [01:28:58] And your boss actually wrote the thing. [01:29:01] Mine, actually, it still sits on our fireplace mantle. [01:29:05] And you could probably guess this from all the things I've said. [01:29:08] The title of it was, I Exude Extreme Integrity, because I had told enough people to F off and some, some things were not going to happen under my watch. [01:29:17] Um, over the years that that became how I was labeled. [01:29:21] I was made a vice president. [01:29:23] Um, and then the quote, I'm like trying to figure out who and whatever. [01:29:27] And one day my, my middle son, he was, uh, in, uh, uh, late, uh, he was in middle school at the time. [01:29:35] We were standing around and I'm trying to figure it out. [01:29:38] And I was like, Hey, Evan, if you were to do a, um, a quote that would describe me, what would it be? [01:29:43] And he pauses for a second. [01:29:46] And he's like, you're a person who does what he says he's going to do. [01:29:50] And I'm like, that works. [01:29:52] And that, you know, I, that's who I am. [01:29:55] Uh, if I say something, I'm going to do it. [01:29:56] I make a commitment. [01:29:58] I try and meet the commitment. [01:29:59] Um, that was a big compliment to me that my son recognized that in me. [01:30:05] Um, so, um, from that perspective, um, that's one I, from, uh, from a kind of a work and other industry perspective, to be honest, the biggest compliment that I get is seeing people who I've worked with or worked for me. [01:30:26] Um, and, you know, bring just a genuine sense of, of passion and purpose and then turn around and try and grow the next generation. [01:30:53] Um, and spend time with people and, and again, cultivate that culture of, I believe I belong. [01:30:58] I matter to me. [01:30:59] That's the biggest compliment for anything I've done in the industry is when I see people that I've spent time with. [01:31:04] And, and, and who've worked with me for years and I see them taking aspects of things that are important to me and they've implemented them in their own way, genuine to themselves to generate impact and, and protect to enable their companies. [01:31:21] Uh, that to me is priceless. [01:31:24] That's fantastic. [01:31:25] And it really tells me, you know, what matters to you in terms of what you value as your contribution. [01:31:34] So thanks for sharing that. [01:31:35] Tomas. [01:31:36] Thank you. [01:31:37] All right. [01:31:38] Thanks, Lisbeth. [01:31:39] Thanks for asking that question. [01:31:41] Very good insight, Michael. [01:31:42] Malcolm. [01:31:43] Uh, look, it is, uh, it is three minutes away until the end of our, our segment this evening. [01:31:47] I want to be conscious of time. [01:31:48] I don't want to keep anybody longer than they, than they have to be. [01:31:52] Uh, I, I didn't even realize that we were sort of zipping, zipping on by with, with, uh, given that the conversation has just been flowing. [01:32:01] So thank you, Malcolm for, for that. [01:32:02] And thank you for sort of taking the time to spend with us. [01:32:04] Uh, just before we sort of get to the conclusion, I just want to make one quick announcement. [01:32:09] Uh, if you're joining us back next week, uh, please make sure you just want to make a quick announcement. [01:32:16] Uh, please make sure you join us cause we have Ashley court or Ashley court joining us. [01:32:21] Hopefully I got her last name, right? [01:32:22] Uh, so please come back next week. [01:32:24] Again, we do this every Wednesday between 8 PM Eastern time and 9 30 PM Eastern time. [01:32:28] Uh, mods, any final questions for Malcolm before I kind of get to, uh, maybe the last one that I, that I have. [01:32:35] Just that it was a pleasure, Malcolm. [01:32:39] Honestly, just really enjoyed this conversation. [01:32:41] Thanks for being so candid and, um, just what a great guest. [01:32:45] Thanks again. [01:32:46] Oh, thank you. [01:32:47] Likewise. [01:32:48] Had a blast. [01:32:49] Thank you, Malcolm. [01:32:50] Thank you, Malcolm. [01:32:51] Thanks, Malcolm. [01:32:52] Uh, Neil here, uh, you know, also want to convey, you know, I appreciate, you know, being those, those conversations over lunch or at events, uh, and your insights there as well. [01:33:04] So definitely keep it rolling. [01:33:05] Thank you. [01:33:06] Thank you. [01:33:07] So Malcolm, I'm going to ask you this question and, and I'm going to, I'm going to, uh, steal from our prior guests. [01:33:17] So I usually ask the, the final question is, uh, if you had any piece of advice for the younger Malcolm, what it would be, but I'll ask you, I'll, I'll switch it up. [01:33:27] Uh, in honor of Ryan, who asked this question, which I thought was fantastic. [01:33:31] If you had any piece of advice for the future, Malcolm, what would it be and why? [01:33:36] Uh, it would try and be, you know, stay true to who I am. [01:33:44] You know, there's, um, as I told you, if I look at my wall, I have all these things. [01:33:48] When you ask that my, my eyes wandered because I kind of roughly know where all this stuff is. [01:33:53] There's a, uh, um, a quote from Edward Everett Hale that, um, I really like, I am only one, but I am still one. [01:34:04] I cannot do everything, but can still do something. [01:34:07] And because I can not do everything, I will not refuse to do the something that I can do. [01:34:13] It, I mean, if you think about it, it's, I'm an action oriented person and we can't solve everything, but you know, it's, it's always make incremental progress every day. [01:34:29] Love that. [01:34:33] Love that. Love that. That incremental progress. [01:34:36] You'd be surprised once you add it all up and see how far you've gone or how far you've come. [01:34:42] So I love that. [01:34:43] Um, so Malcolm, look, uh, really, really thank you for, uh, taking the time to spend with us and share your insights. [01:34:51] Um, again, if you just joined us, you missed a good session, but you can listen to the playback. [01:34:55] It should be available in a few minutes. [01:34:57] Uh, on behalf of the fireside chat group, I want to thank you. [01:35:01] Malcolm, I'll leave the final words for you to bring us home and close it out. [01:35:05] Hey, you know, I, uh, again, thank you for the time. [01:35:09] Thank you for allowing me to, uh, express my opinions. [01:35:13] And, uh, I'll leave you with one final quote. [01:35:16] Um, it was from T. [01:35:18] Doer, the, uh, Doer distillery is the guy who created it. [01:35:21] Mines are like parachutes. [01:35:22] They work best when open. [01:35:24] Keep an open mind. [01:35:26] It, uh, it will, it will help us all. [01:35:29] Couldn't agree more. [01:35:31] And if you see us flashing our microphones, that's us applauding, by the way. [01:35:36] Uh, and just go and you. [01:35:40] All right, go ahead. [01:35:41] And did she raise her hand and coming up? [01:35:45] No. [01:35:46] Okay. [01:35:47] All right. [01:35:48] We're, we're, we're including edge. [01:35:50] You got five, four, four, five. [01:35:55] Four, three, two, one. [01:35:57] All right. [01:35:58] Angela's not coming up. [01:35:59] All right. [01:36:00] Sounds good. [01:36:01] Look, we'll, we'll close on that. [01:36:02] Uh, thank you, Malcolm. [01:36:03] Thanks everybody for, uh, for tuning in. [01:36:04] We'll see you all and hear you all next week. [01:36:06] Have a good rest of your week, everybody. [01:36:08] And if you need to talk to somebody for free to give us a call and Malcolm, I heard him [01:36:12] say he's open for conversation. [01:36:13] So, uh, ping Malcolm, but if you, uh, want to connect with him, you can see his LinkedIn [01:36:18] there and please stay tuned to what Malcolm's got going on with his new company. [01:36:22] It's worth, uh, worth keeping an eye on for, for those security practices. [01:36:24] Practitioners professionals in the room. [01:36:25] So I'll talk to you all soon. [01:36:28] Cheers. [01:36:29] Bye everybody. [01:36:30] Thanks. [01:36:31] Bye everyone. [01:36:33] Bye. [01:36:35] Bye. [01:36:36] Bye. [01:36:37] Bye. [01:36:41] Bye. [01:36:43] Bye. [01:36:45] Bye. [01:36:46] Bye. [01:36:47] Bye. [01:36:49] Bye.