Fireside Chat w/Keenan Skelly

Hello and welcome to our fireside chat. This is the replay and you got here right on time. So thanks for joining and thanks for being a member of our community. We hope you enjoy the rest of the show. But look, let's just, let's start the show. For those again that are new to LinkedIn Audio, it's, again, thank you for coming over from Clubhouse. If you've noticed the app, it's pretty similar. The mute button is on the, sorry, the raise your hand button should be on the bottom right. And then once you bring up, once we bring you up on stage, you will have the opportunity to sort of unmute yourself and ask a question. So without further ado, I'm just going to go quickly around the room. I'm going to introduce myself and I'll pass it over to others. Although I don't even know if we need to do introductions because you can read our names and titles from there. But for like, for, for sake of, of the audio, because this, this has been, this is sort of been, I don't know what I want to say here. I'm Tomas. I'm the CISO at the NFL. Russell, I'll pass it over. Love it. Hey, we're all in this experiment together. We're all at page zero here. Russell Eubanks, founder, CEO of my company, Security Ever After, where I help cyber professionals get promoted. But Octavia, over to you. Hey, I'm Octavia Howell. I'm the CISO for Equifax Canada. And my thoughts are mine, but sometimes, you know, we talk about real life stuff. So I'll pass it over to Katie. Thank you. Hi, good evening. I'm Katie Hanahan. I am the vice president of cybersecurity strategy for a boutique SI out of Chicago. I also run our VCISO program. And I'm one of the practitioners who also acts as a CISO. Over to you, Naveen. Good evening, Naveen Balakrishnan. I'm the head of third-party management and risk for TD Bank's technology and platform division. Over to you, David. David Katz, Global CISO GSR, crypto market-making firm, former member of the Federal Reserve regulatory group for larger institutions supervision. So, yeah, happy to be with you guys tonight. And I'll jump in. My name is Lisa Beth Lentini-Walker, and I am Assistant General Counsel over at Marquetta, which is a fintech based in the Bay Area, as well as I run a compliance ethics and corporate governance consulting firm. Tomas, back to you. Thank you, moderators. And thanks for obviously taking, thanks all for taking the time out of your busy day. Let me just get Anil back up on stage so he can introduce himself and then we'll get started. Anil, are you there? Thanks, Tomas. Anil Varghese, virtual CISO and co-author of the CISO Mentor. Awesome. So, look, we'll go for about, we'll go to about 9.30 p.m. Eastern time today. So, we'll ask Kenan a few questions and then we'll open up for the audience. For those that are in the audience, you know the usual program. So, Kenan, why don't you take a moment and introduce yourself? You can take as long as you want or as short as you want. And while you're going through that introduction, why don't you tell us about you and your origin story? And if you're wondering, I muted you so you can unmute yourself with the bottom right. Suddenly, I feel like Wolverine and I need like a really legit backstory. First of all, I want to say I apologize to everyone. I made the mistake of installing a new operating system on my computer this morning, Ventura, which had to have, of course, lots of issues connecting to the internet. So, those are my excuses, Tomas. Again, I apologize. But my origin story is a little bit crazy. And honestly, I think that most people that are in cybersecurity today have a similar crazy story. I have friends who, you know, started out as librarians. I have friends who started out selling cars. I myself, I started my career out in the United States Army as an explosive ordinance disposal technician, which means I got to diffuse bombs, which honestly is kind of the best job ever. I mean, you get to blow stuff up and they let you hang out with the president, which is usually not condoned, right? Usually they're like, I think that's a bad idea. But somehow they let you do that. And I really enjoyed that job. I learned, I enjoyed learning about the technical, you know, pieces of chemical nuclear biological weapons. In fact, my first duty station was Andrews Air Force Base, which was at the time, a weapons of mass destruction unit. So I got to spend a lot of time dealing with really amazing crises, to be fair. And that really shaped kind of who I am as a person and how I deal with security as a person. I was injured. I now have four titanium vertebrae. And, you know, after you have like metal in your spine, they don't really want you to play with bombs anymore. I don't know why. So I left the army and I went to go work for a couple of different, you know, kind of big four at the time, like L3 communications, GDIT, doing security and operations and intelligence and all of that kind of fun stuff. But once DHS stood up, I really knew that that's kind of where I wanted to be. Even before I got into the army, I, at 15 years old, I happened to be the first person on site to a train wreck in my hometown. And because it was such a small town, and nobody had any idea what was going on, I somehow became like the on scene commander of, of all of these people at the school. And press were going there and all the adults in the room were like, Oh my god, we can't deal with this. And I was like, Okay, just go away. And I will talk to the press or I will talk to, you know, the responders. So from a very early age, like stress management, disaster management, chaos management was something that I was okay with. So after 9-11, I was actually stationed at the White House on 9-11. I was the EOD response for that. And I got to see really up close and personal how the national response plan was implemented. And I mean, from the highest levels of government. And it scared the crap out of me. It just scared me. So I really wanted to do something to make a difference there. So when DHS stood up, I had done these kind of other security related jobs. But I went to go work at GDIT to do operations and intelligence management for NPPD, which was brands, banking new, like, Oh, my God, super new. There were like two feds and a bunch of contractors. And we were on Glebe Road. And anybody who's in the DC metro area knows the Glebe Road facility now houses CISA and so many other organizations related to DHS. But when I first got there, we had a corner of like the fourth floor. And it was our program and the one bird flu guy. And I mean, literally the one bird flu guy, the one guy who was dealing with bird flu. So it was a little bit crazy. But after working there for a while, you know, the government team pulled me on and asked me to come and be a GS-14. So I had the ultimate, like amazing privilege of being a plank owner of NPPD, which is the precursor to CISA. And what an amazing job. What an opportunity. So I ran a program called the Comprehensive Review, which did vulnerability assessments on all the nuclear power plants, all the chemical plants, all the LNPG, LPG, electrical, all the things you can think of. And I actually helped to create one of the very first system of systems risk assessment approach in the country. And that was for the California water system leading all the way from Canada down to Mexico and every tiny little thing that that was a part of that. And it was really amazing. But what we learned during all of those assessments is that information security, as we called it in the olden days, information security was a single point of failure for all of them, right? Because as DHS, we could give states, we could give local police, local firemen, local hospitals grant funding, but we could never give that grant funding to the owners and operators. And honestly, this is an issue that we still face today. So at the end, or sort of, you know, coming to the end of what DC people call your two year tenure, in a GS 14 or above position where you're just like, I'm trying so hard to change the world, but I only have so much in me to do that. I went to work for a startup. And I worked as a security expert for Obama's inauguration in 2009. And I learned very quick and fast with the company that I've worked for, which was a startup, that having an idea and having an idea of a product does not mean having a product. So for the inauguration, I spent, I think, three months sleeping on the desk of the FEMA director or under it, so that we could make all of that technology make sense and make sure that all of the 27, 28 agencies that were providing data to us that we were taking them into account and actually able to respond to threats. Then I did something super crazy. And I moved to South Africa, because, you know, I do that. I'm weird like that. And while I was there, I had the great opportunity of being a security expert for the FIFA World Cup, which was really scary. Oh my gosh, you guys, it was so scary. So imagine coming from coming off the heels of doing a presidential inauguration to doing a World Cup situation in what at the time was a second world country who didn't have the infrastructure to support that or to do all of the things that needed to make that happen. And that was very difficult. After a while, while I was there, I decided to get another degree in information technology and security, because everything that I had been doing seemed to be pointing towards that, seemed to be getting towards that technology piece. And I really wanted to embrace it. I wanted to figure out a way for us to help owners and operators. I wanted to figure out a way to help everyday businesses understand basic security in a world where that was not normal. When I came back from Africa, I started working for SimSpace, which is a company that did cybersecurity training or, you know, you know, with training as a cloud kind of thing. And while I was there, I had the great opportunity to work on things like cyber flag and cyber guard and, and all of these exercises that the military did to help train up their teams to help promote the idea that cyber is a team sport, and that you have to figure it out together. And that was, I mean, that was for me, that was groundbreaking, because I always remember thinking while I was there, if we had this, if we just had this, like six years ago, it would have changed everything in critical infrastructure. But it is what it is. And then I got stolen away by Circadence, which is another cyber range company, but they were doing something so near and dear to my heart. They were doing gamification. They were using artificial intelligence. They were actually making it into a fun simulation. It was, it was the Enders game. Like was the thing that everybody wanted to do with cyber. And honestly, I mean, and I throw this out to everyone, watching cybersecurity is boring, right? It's like, okay, they're just a bunch of people clicking on keyboards. But when you add gamification, when you add those pieces to it, it suddenly becomes super interesting and super cool. And the strategy between defense and offense is just absolutely amazing. So I really love that. And I did that for five or six years and moving up the company to do some really great things. One of the products that we had worked on, Insight, which was a security awareness game that anybody could play from six years old, to 90 years old. And I actually have examples of six year olds playing with their 90 year old grandparents. But just to get the idea out there that, you know, cybersecurity is important. It's part of everyone's life now. After that, I took I took kind of a break from the training and awareness side of the world because my, you know, my inner operator was like, threat intelligence, I need to do this. So I was the CEO of Shadowbite, which was a threat intelligence company that provides a myriad of data to multiple nation states and large fortune 50 companies. And I really loved that. I really did. But one of my other passions is legislation. And what I saw prior to the Ukraine invasion from Russia, was that intelligence is still even since 911, it's still not being shared appropriately. It's not being declassified appropriately. It's not doing any of these things. And that really frustrates me. So I, you know, talk to a lot of people in Congress, and I bother them, and I harass them in ways I'm sure they don't appreciate. But I have a podcast called the National Blast. And it's all about legislation and policy and cybersecurity and how we can do better, how we can actually make it functional for operators, how we can make it functional for small to medium businesses. Then I started a company called shifted studios to take the idea of gamification to the next level, to really focus in on how we can use AR, VR, XR, and the metaverse to train and educate anyone, everyone when it comes to cybersecurity. I mean, I want people to be able to jump into the metaverse and learn how to pick locks. I want to take every single village that is that black hat, the car hacking village, and the ICS village, and the XR village, and all of these things that I want to make it accessible to everyday people, so that we can instill this into all of the generations that come after us, because we did not get that. So the idea behind shifted studios was really to create this space called the arcade where anybody could come in and learn a variety of different topics, from soft skills to hardcore engineering skills. But what we found out almost immediately is that all of the platforms that are out there for you to develop in AR, VR, and the metaverse have no safety, security, or privacy. And that's not what I want. That's not what I want at all. That's not what we started that company for. We wanted to figure out a way to make this for cybersecurity people and for everyone else and make it safe, make it private, make it secure. So in the last year, I also started the XR village. And the idea behind that is there is no policy, there is no legal information, there is no, you know, hacking or vulnerability information on the tools, on the headsets, on the haptics that are being used in the space right now. So at Black Hat, this year, we had a sub village for the XR village. And we only had, we had space for 20 people, and we were supposed to go for like an hour. And we stopped counting at 75 people standing room only. And we went for three hours. And there was, everybody is concerned about this. Everybody is scared about this. Everybody wants to do something about it. So the XR village now has a focus, a nonprofit has a focus on how do we develop policy? How do we develop legislation? How do we develop legal apparatus to actually operate in the space? And then on top of that, how can we look at the technologies that are already in the space, and have hackathons and CTFs and figure out how to make them safer? So I think that's all I've got. I hope it's not too much. It's not at all. It's actually perfect. Sorry, I was a little slow on clicking the unmute button there. No, that's, that's great story. And, uh, uh, King and thank you for your service, uh, obviously, and sorry that you did get injured, uh, but thank you for your, for your service. Uh, Russell, I'll pass it over to you. Thanks Tomas. And wow, what an amazing story. I've like been writing down all the things you've done, like, wow, these are, I like to do that. I like to do that. And how cool is that? So, and again, as Tomas said, thank you for your service to, uh, uh, our country, uh, and lots of other countries, uh, as well. You know, one of the, the question I have for you, so you mentioned earlier, and I couldn't have said the words better myself, you know, the struggle of Intel, Intel information, uh, not being able to be shared, uh, appropriately or, uh, efficiently, effectively, all the things that we're looking for. Is it a pure technology issue or is it a trust issue or both? Or, you know, if you had, when you have your magic wand in your hand and you go to fix it and you wave it one time, what, what's the, why can't we get that right? I believe that I believe in that. And I also see struggles with that. And, um, my bias is I oftentimes would get, you know, information from a human, uh, more effectively and efficiently, at least ones that I would want to act on than what I would get from a data feed. But, but I'd love your insights and especially around how do we make that better? Is there a fix or is it a complex thing? Absolutely. I, it is complex, but not in my mind, as complex as people try to make it. So if you think back to the very beginning of human beings or the very first wars, the Roman wars, or if you think about tribes of human beings fighting against each other and you think about intelligence, it was all about so-and-so says they saw this and we're going to move on it. Right. And there we go. It's not classified. The information was told to somebody in power who could make a decision. Right. And then I think during the cold war period, everybody got used to this idea that we would also still have intelligence that was given by human beings to other human beings, but we had technology and we've wanted to verify that we wanted to prove it before we said, because I don't, well, we kind of trust these people, right? Hopefully they're not spies, you know, et cetera. And I think over the last 20 years, as technology has become more prominent, especially in the area of IO and intelligence and operations, a lot of decision makers have come to this point where they expect there to be like a chain of custody of data that has to be proven both technologically and from a human being perspective, which I mean, anybody who's done any of that knows that that's extremely complicated. One of the things that has really inspired me in this whole space with intelligence and operations during the Russian invasion of the Ukraine is that from the very beginning, the administration, NSA, all of these state department, everyone was willing to accept data that private companies were just errantly watching on chat messages, right? Hey, we're looking at this conversation happening right now on the dark web. Here's a screenshot. Here's what they're selling. Here's a zip file of the data that they're sharing. Don't go out of your way to classify this. Don't go out of your way to make this super national security because frankly, it's on the dark web and it's open to everyone. So I think there's been a little bit of a shift in the last year or so as we deal with kind of the Ukrainian issue and Russia and other countries who are trying to support that, where at the beginning, maybe two, three months into it, Biden came out and he said, this is the intel that we have. We know you are here and you are here and you are here and we're coming for you. And I think that's a real shift in the ideology of what intelligence and operations is or has been in the past. So I hope, and I've been talking to some members of Congress and senators about how do we kind of not codify that, but how do we recommend that? There are so many vendors out there right now. I mean, if you look in the DC area alone, I mean, you have NISOS and you have all the Grissmill Exchange. You have all of these companies who have so much data and intel and they try really hard to get it to the government. They have contracts with some people, but not everyone. And so how do you get really relevant, on time, on target data to the people who need to hear it and have them listen to you, even though you don't have a classification? This is something that we need to address as a country and we need to really get on that fast. Wow. So, so fast. That's a fascinating response. I appreciate your insights, your expertise and authority with which you provided. So thank you. Thank you so much. And Katie, over to you next, please. Yeah, thank you. Hi, Kenan. So great to meet you. Thanks for joining us. I think we almost were coworkers. I came up through GDIT and then they spun off to Aptis, which eventually became Ironbow Technologies and so. Oh yeah. Yeah. So I, and about the same time period. I love how small of a world it is. So yeah, I started my career by serving, not with the military directly, but serving the military as, you know, they, they being my client and worked with the EOD. And I just, no one really understands what you guys do unless they've actually heard it. And I have to just share this, you know, 25 year old me walking to, to, on the, I was at Everdeen Proving Ground and just, you know, meeting with the team at EOD there. And they were doing some, you know, some practice that day. And I dove under my car and everyone else with me just looked at me like, what's wrong with you? So nerves of steel is all I can say. So much respect for you. I can, I can tell a short story about my getting into EOD experience if we have time for that. Oh, please do. It's fascinating to me. So in my super small town in Bradley, Illinois, which is like 30 minutes south of Chicago. In fact, now it's basically a suburb of Chicago, but when I was growing up, it was all corn from us to Chicago. You know, we had a family friend who was on the bomb squad for Chicago PD. And I, you know, 12, 13, 14 year old me just thought that he was the most amazing person in the history of the world because he wasn't, he wasn't looking for a fight ever. His entire job was to play with explosives and save lives. That's it. And I remember, you know, teenage me being like, oh my God, that's the coolest job in the world. Well, among two others. So I had three dream jobs when I was that age. One of them was, you know, to defuse bombs, be in the bomb squad and help save people. One of them, uh, based on my affiliation with the Red Cross and all the work that I did with them, I wanted to be a cardiothoracic surgeon because of course those things are totally related and make sense. And, and I also wanted to be a Pink Floyd backup singer because those women are amazing. Like they're just amazing. But after graduating high school and doing some college, you know, I was advised by my, my high school sort of advisor that if I wanted to be on the bomb squad, that I needed to get a degree in criminal justice and I needed to spend five to eight years on the Chicago PD and then possibly apply to the bomb squad. And I was like, are you kidding me right now? Like, this is the worst thing ever. Now this whole time, my dad, who was a Marine, he just kept quiet. He just listened to me rant on about these things that I wanted to do. And, uh, when I was in community college, I was acing all of my classes and sleeping through them. And I'm like, this is not the way I feel like this is not the way, like, I'm going to figure out a different way to do this. And he knew I wanted to do this since I was really young. And finally, finally, one day he pulled me aside. He was like, okay, look, you seem actually very committed to this. I was hoping it was a phase. Clearly it's not, but you seem super committed. If you're going to do this, if you want to play with bombs, if you want to diffuse explosive devices, then you need to go into military. We have an amazing program in the military and it's not the same. It's not like the, the regular cop program where the protocol is just go kick that box and hope it doesn't blow up. It's actually, you know, chemical engineering and nuclear engineering and explosives engineering and really, truly understanding what it is you're doing. So my dad, God rest his soul, was a Marine, like a hardcore, like a 30 year Marine. And I think he assumed when he said that I should join the military, that I would be a Marine. Sadly, that was not the case. So my immediate idea was that I would go to the Navy because not only do you get land warfare and land weapons, but you also get sea bearing weapons, right. And sea mines, which I thought was fascinating. But in my, my, my tiny itty bitty little hometown, the Navy recruiters were never, ever, ever in their office. And I went for like four weeks straight, like knock, knock, knock, knock, knock, knock, knock. Nobody's there. But the way the recruiter's office was set up right across from that was the army. So they had seen me coming like three weeks in a row knocking on the door. And finally, one day they were like, Hey, they're never there. Like, they're literally never there. What are you trying to do? I was like, I want to be in a UD tech. And they literally laughed in my face. And at the time I was maybe, maybe 98 pounds soaking wet. I mean, it's just ridiculously small and tiny. And they just laughed at me. I was like, okay, whatever. And I left. And I came back the next week trying to get ahold of the Navy guys. And they weren't there. And after a few weeks of this, the army guys were like, Hey, why don't you come in and talk to us? We got cheeseburgers. And they literally had cheeseburgers from McDonald's. I was like, Oh, okay. Some funk kid. And I told them what I wanted to do. And they continued to laugh at me. But eventually I was like, no, I don't want to do any of this other stuff. So I did the ASFAB and I tested phenomenally. And they were like, well, you should do Intel or you should do this or you should do that. I was like, no, I want to defuse moms. This is what I'm here for. Either you can make that happen or I will wait for the Navy. So eventually they're like, okay, well, here you go. You're, you made it into this program. You got to go to basic training and AIT and then EOD school. It's going to be really hard and you're not going to make it because you're tiny. You're so small. Like, how are you going to wear a bomb suit or how are you going to do this or blah, blah, blah, blah, blah. And it just made me want it more. Like it really just made me like, okay, you know what? I don't like you, whatever. So I went to basic training and I graduated soldier of the cycle, top of my class. I went to AIT, which is sadly and very unfortunately, 55 Bravo school, which we, we called ammunition or BB stacker because it's all about identifying different types of weapons, but basically being the inventory manager for that. So you knew if you failed out of EOD school, that that's what you were going to do. You were going to count weapons and BBs and bullets in some hangar in South Korea, which sounded terrible at the time. And so when I went through EOD school, that's all I could think about. I was like, no, man, I'm definitely going to finish this. I'm going to finish this. I'm not going to be a BB stacker. And I can't wait to go back to that recruiter and show him that I did this. And I did. But it was hard. It was so hard. It was hard physically. It was hard mentally. Everything about it was hard, but I did it. And eventually I went back to that recruiter and I walked in with my EOD crab, which was our little insignia. And, uh, I was like, Hey, screw you. He was like, what? There's no way you made it. There's no way you made it. But I did. What's really fascinating to me. And what I try to keep, you know, with me at all times is that all of that struggle of being the fourth woman to graduate EOD school of being surrounded in an environment that was totally dominated by males is that it's so, so similar to technology, right? You know, uh, there aren't a lot of women now there's more, you know, when I first started in tech, I think there were 4% of women that were involved in technology and now it's a 21%. So that's amazing. We continue to grow, but the experiences that I had as the only woman, you know, diffusing moms surrounded by, you know, a bunch of dudes, all of those lessons that I learned have helped me really understand similar problems in cybersecurity in technology. So I wouldn't trade it for the world, but that's my, that's my quick ish recruiter story. Right. Well, and, and honestly, it doesn't matter if it was quick or not. It was perfect. Um, because I think that that kind of leads us into kind of continuing the conversation or, you know, and kind of pulling it back into the cyber conversation. Um, you know, uh, you talked a little bit about, you know, and, and, you know, the, your, uh, experience in the intelligence world and then the gamification within cybersecurity and kind of touched on, um, I don't know if you even, if you said it, or if that's something I'm thinking about just the cyber psychology of, of this, you know, business that we're in and, um, how that transcends, um, your experience, um, you know, in your military career and then working in various startups. And so I think that's, it's really interesting. Um, I understand now Keenan, why the first word on your, uh, LinkedIn says disruptor and I love it. I know it's like a, it's like a double entendre, right? Cause people in tech are like, okay, whatever, everybody says that I'm like, no, you showed up, you showed up, you showed up with it. No. And I love it. And I, and I appreciate those stories so much because, you know, when you, when you say you're going in and you're trying to, you know, um, you know, help our intelligence community share information, uh, you know, cross organization, um, you know, having, you know, again, look, you know, in my experience working with, you know, PEO EIS and PEO C3T, and then even just from an IT perspective, having to, you know, bring those, uh, teams together, it's incredibly difficult. So I am thanking you for your service, not just in the past, but now that is hard, you know, to be able to bring together various parts of the federal government to do those types of things. So I just want to thank you for your, your answer. And then, um, you know, again, just kind of, uh, pass along. There's so many amazing, uh, moderators on the stage, so I could talk to you all night, but we probably should, by the way, I'm from a small town in Illinois too. Oh my God, we have to connect and talk about Westernisms. Oh my goodness. We have a lot, we have a lot of comments. So yeah, so I'm looking forward to, you know, staying in touch after this, but thank you again for joining us. And, um, I'll just pass it over to, um, Octavia, if you're available to go on mic. Um, I'm, I think you have a question next. Yeah, no worries. I'm not cooking tonight. I'm actually laying in my bed. So you guys don't have to worry about the pot clinking, but that sounds wonderful and good for you. It sounds wonderful that I'm not cooking. No, it sounds wonderful that you're in bed having this conversation. I would like to be in bed having this conversation. Oh yeah, definitely. Up under my, um, weighted blanket as well, cause I'm in Canada. So yeah, it's cold, but no Keenan, thank you for your service. And you know, one of the things that you talked about really early on that I picked up on, you didn't say the words, but it's kind of like one of those things, um, that I deal with on a regular basis is intergenerational security, right? You talked about, you know, really playing, you know, having, you know, a nine-year-old playing with their grandmother and really kind of looking at it. One of my pet peeves in our industry is that, um, is that we have a lot of people entry level and we don't have people kind of, um, moving away from like into the, the, the managerial and kind of like kind of moving up. And I kind of look at that as like an intergenerational thing, right? Kind of looking at how do we move up and how do we move the generation? So what I would actually, cause you've been in this for a while, you've been, you've been in some really, uh, influential spaces. So if you were to look at a world, would you, that you will want from security and you look at it from an intergenerational lens, what do you think we, where do you think we should be and what things do you think we should be doing? One, um, as women, two, as disruptors, and three, it's just bringing up the next generation. Oh my goodness. This is going to be a long one. This might take up the rest of the show. I'm just going to tell you. So I definitely have a soapbox when it comes to this, because I've been watching cybersecurity evolve over the last 20 years. And I remember when, you know, we first started talking about inclusivity and diversity at RSA and Black Hat, you know, like 10, 12 years ago. And I, I see that we still are talking about that, but we're not actually doing anything about it. And part of that is it's hard to get people, diverse people to get involved in cybersecurity. So I try to address this as, you know, as head on as my crazy EOD tech mind allows me to do. So I'm on the board of Women's Society of Cyberjutsu, which is all about getting women involved and training women and providing opportunities to meet people. But also it's about tribe, right? It's about having a group of people around you who are going to support you no matter what. I think that's absolutely critical. I'm also on the board of a nonprofit called RAICES, which is about getting Hispanic, Latino, Latino X involved. I remember when women were 4% of the workforce, and now we're at 21%. Well, right now, Hispanic, Latino, Latino X are at 4%. And that's crazy. That's absolutely crazy. We can do better. We can move beyond that. I do a lot of work with the US cyber games, with the international cyber games, with Wicked 6, all of these things that are designed to get people involved in cybersecurity. And honestly, this is the most important thing that we can do. Because right now, right now, we have students in K through 12 who know more about the internet, and the metaverse and AR and VR than we can even think about. But they've grown up in a world where work from home is a thing, where school from home is a thing, where their mom or their dad is on a call, a video call. And in the background, they're logging into the Wi Fi on their Xbox. And that is totally cool. Or they're walking around the house with their phones, video recording everything that happens. And one of their parents works for the government. This generation, the next several generations is so comfortable with technology. And that's amazing. That's an amazing thing. But we have not done a good job of showing them why security and cybersecurity is important. So I have to say, from the very start, that getting involved as low as a kindergartner is crucial. Other countries are doing this so much better than we are right now. In Israel, by the time you get to the eighth grade, you not only know how to code, but you know how to secure code. Just think about that in terms of where we are as a country. And think about what we're missing out on by not doing this. We're all about giving them an Oculus or a MetaQuest and saying, here, learn your objectives for this evening. Do your homework in this environment. But they don't know anything about coding or secure coding or understanding the basics of cybersecurity. You know, IBM actually just made a big announcement about a massive investment that they're doing in K through 12, specifically for schools, not only to beef up their security, because, you know, K through 12 is rife with ransomware right now, how to beef up their schools. But it's not just about training their IT people. It's about training the teachers, the school board, the students. It's about training the everyday citizen who deals with the school, what cybersecurity is and why it's important. And we are behind the power curve on this. And we need to get better. Does that answer your question? No, it does. And I agree. I would say, you know, I feel like there's a lot of emphasis in trying to make sure that we kind of educate adults. But I still feel as if there is some type of lack when it comes to the understanding of the capacity of a child to learn. Oh, my gosh. You know, I'm the worst adult in a room with five-year-olds to 10-year-olds. I'm literally the worst. Except that my biggest thing is they have phones, they have iPhones, they have Apple Watches. And they're like, oh, yeah, I got to do this mug into this. I'm like, so what's your password? And they're like, well, it's one, two, three, four, five, six, what? Like, why? So you want people to steal your identity? You want people to take all of your data and rack up a credit account before you're old enough to even have credit? And the thing is, they're not confused about that statement. They're like, well, no, that would be terrible. Okay, well, let me let me talk to you about passwords. Let me talk to you about some very simple stuff that can help you. But we need to be doing that on the much larger scale. Absolutely. Absolutely. I'm not going to hold it because I know it's 9.03 and I want to get to everyone else. But I would say those kids that said they gave you their password, they need to hang around my kids and my kids. Right? My kids will tell you exactly why you shouldn't do that. But I'm going to go ahead and pass it over to Emil. Thanks, Octavia. I can't even love the backstory, especially the EO details. I've had opportunity to work with a few in my prior life and see up close some of that activity. One thing I wanted to gauge, you want to stay on the same theme with regards to security awareness and training, that domain you've been, you know, definitely exploring and working within is the current state. I know you're actively involved with cyber games. I know with Jen at the helm of CISA, there seems to be a lot of movement on that front. Can you give us a take on where things are moving probably the last, you know, 18 to 24 months on that front on where we are? Do we are we making the right moves? Are we, you know, you know, closing that gap? Absolutely. And absolutely, I will answer this, not absolutely to all of those things. But, you know, what I think CISA has done very well, since Jen has come aboard is the concept of promoting an idea without forcing it or regulating it. So if you think about MFA, there have been no regulations or laws or anything that has come out that says you must have MFA. But there's a massive media campaign, Freddie like MFA, right? It's a rock, rock and roll. It's fun. It's interesting. It gets people involved. But it's not a regulation. This is one of the things that DHS has struggled with that the government has struggled with and continues to, is that we want people to do this. But do we regulate it and force them to do it like the NDAA telling people, government contractors that they must be aware of any and all CVEs in their entire supply chain, which is crazy talk, because it's not possible. Or do we make it cool? Do we make it? Man, I'm going to date myself right now. But like, remember when the more you know, came on Saturday morning cartoons, and just told you random things, and you didn't realize you were even learning it. And then a couple of years later, well, well, did you know that blah, blah, blah, blah, blah, blah, blah. We need to get better at that. Cybersecurity is so pervasive across every field, across every generation, that we need to make it accessible and comfortable for everyone from six years old to 80 years old. And we need to really get better at doing that. You know, we talk about how things are changing now in terms of cybersecurity awareness. I'm a big fan of thinking outside the box. When we talk about gamification, I mean, I believe that is truly the future of awareness and education, because oh my god, everybody plays games. You know, the major demographic for angry birds is 30 to 80 years old. It's not kids. It's not your five year old. It's not your 16 year old. It's middle aged to older people who just want to play. That is how we need to get into this market, because we cannot talk tech and just barf or regurgitate very technical terms to the masses and say, I expect you to know this. We have to make it accessible. So I'm really proud and really excited that CISA has been able to do that with certain campaigns, like MFA. However, I think that there's a long way to go, not just the way to go. But I think that's why things like gamification, things like AR VR metaverse are going to come into play. We just have to get it right. Hi, Keenan, you had some really great points. And can I just say a couple things here? Of course. Okay, so, you know, I have children different age ranges. And one way also for InfoSec, I sat at a legal panel for my child's middle school. So how did I bring out, you know, it was their students were wondering, you know, how they can go into legal. And so I had to get a little creative and tell them, hey, so to touch up on privacy laws, I'm like, okay, so practice this with your friend. Even if you're not friends with her, you can't tell the secret that she told you. So that touches up on privacy laws, where you have to sit here and adhere to it. And you can't just blurt out just anything with my little one. I know I have weird age ranges, I have a high schooler and so different. You know, with my little one, I was I got, like, coloring, like I found like some, like, I just Google searched it, you know, some like hackers, and we're talking about it. And, you know, believe it or not, they actually do talk about it at a young age. And this is now a second grader. So they, they have the capability of really grasping the material is just a matter of how to present it. But I wrote a white paper about should we let, you know, I think LinkedIn honestly should create a LinkedIn junior, I mean, networking is everything. It's like, I extended essential of who we are now. Should we have that and you know, where it's moderated through the school, and obviously, it would have so many laws and legal attachments to it. But I think it's not a bad idea for kids to do that. Have like LinkedIn junior. I'm just gonna there's just so many ways that we need to bring this to light have them, you know, from early on. And I'm really big about advocating for kids learning, you know, the new tech, new tech and how the world is. And it's just a matter of the biggest problem I think they have is funding. Honest to God is funding it's they're underfunded public schools just don't have the means for it. And I think that's awful. So that's a great point. And that's why, you know, I highlighted earlier what IBM is doing with K through 12, and providing massive grants, so that they can tackle these issues. And, you know, I commented in an article recently that this is exactly what big tech should be doing. You know, you can spend all of your time and effort trying to sell your latest product to, you know, whomever. But if we're going to measurably affect the attack surface of human beings in the next five years, 10 years, however many years, we actually have to work on the human beings from a very young age. And I'm here for technology. And I believe that technology can do anything and change the world. But at the same time, we cannot expect that technology is going to fix everything. We have to remember that human beings are the ones driving technology. So if we don't teach future coders, if we don't teach future doctors, if we don't teach, you know, future, you know, astronauts about security, privacy and safety, when they're young, then why would they suddenly figure that out when they get a job doing that? We live in this world right now. And I really feel like it's a Cold War era world where you only learn what you might have to learn for the next 24 hours and need to know that. It's the SCI, it's the compartmentalization. But cybersecurity isn't that. Cybersecurity is a broad skill, like balancing your checkbook or understanding, you know, how to run a house or, or how to, you know, continue to manage details of your life. It's a basic skill. Now, it is no longer advanced technology, it is everyday life. And we as a people as the human race need to come to terms with that and say, holy crap, right? Literally, everyone on this planet should be entrenched in protecting their privacy, safety and security. And if they don't, then we are messing this up for them. Sorry, that was a soapbox moment. No worries. Thanks. Thanks, Ali, for coming up on stage and asking your question of Kenan. Did we skip Naveen? We did. So, nice to meet you. I've been enjoying this conversation. So, I'm going to go with a left field question. So, everybody on this panel loves to read books or listen to books. I'd love to hear from you. What is the last book that you read that you absolutely fell in love with or listened to? Thank you. These questions are so hard for people who read books all the time. It's almost not fair. Like, it's almost not fair. Fair. What is the last book that you enjoyed? Not your most favorite, but what is the last book that you enjoyed that you recommend to us? So, the last book that I read and absolutely loved, and the timing of it is just perfect, is The Storyteller by Dave Grohl. So, if you are a fan of Dave Grohl. So, one of the things we didn't talk about at all was, you know, I wanted to be a Pink Floyd backup singer, and I spent a very serious amount of time doing music in Chicago. So, music is my outlet. Music is my storytelling ability. So, I really appreciate musicians and artists in a way that I think a lot of technical people don't necessarily do. Dave Grohl is just a fascinating human being. And when I lived in my previous location, his mom lived, like, down the street from me, which was really cool. But it's a fascinating story about finding something that you love and that you're passionate about and doing everything and anything that you can to get to that point, to get to that hero, to get to that moment where you feel like you've mastered this subject, where you've mastered, in his case, mastered being a musician, mastered being a drummer, mastered, you know, connecting to people in a global way. I love that. I absolutely love that. I think, you know, we all have our inner passions that may or may not be cybersecurity related. And those are the things that drive us, that power us, that feed us to be ready for the complicated stuff that we do in cybersecurity. Like, we don't, none of us here, none of the moderators, not me, not anyone, we don't have easy jobs. We have hard, hard jobs. And a lot of the time, in cybersecurity, it's easy to get to a point where that is all you can focus on. And you can't break away and think about things from somebody else's perspective. What I love about this book is that the determination and the outlook that he describes growing up and loving this thing and seeking out people that could teach him and seeking out companies that would help him. And that is like the most fundamental human story, especially in cybersecurity. We have so many unfilled jobs, but there are so many people out there who want to be a part of it. And they just are trying to figure out who should I talk to? What organization can I get involved with? I've been YouTubing this and I have an interview with Microsoft tomorrow. And I literally have learned everything I know from the internet, but they're probably not going to take me. Well, you know what? They probably are going to take you because you're determined, because you're smart, because you're looking for a way to break into this thing that you love. And I wish that message was better told in cybersecurity. I love it. And I can't wait to connect with outside of here. I have a studio in my basement. I've got over 10,000 records, still in plastic. And so I think I love it when I hear a fellow creative that escapes through music from all the craziness that we do. So thank you for sharing that. Tomas, back to you. How are we doing on time? We're looking pretty good. We've got some time for additional audience questions. So if you do have a question or a comment or you want to contribute to the conversation in any way, feel free to raise your hand. It should be on the lower right of your screen in the usual place or look for something that says hand raise. And we'll bring you up on stage and you can ask a question. I'll open it up to Katie or Octavia. You guys have or Neil, any follow-up questions you want to ask, Keenan? I actually have a follow-up question. Go ahead, Octavia. So I'm a frequent Googler. So I've been Googling myself since I was like 16. And so, you know, I've seen the shift from like where, you know, Caesar, I guess his niece came up into where it actually started becoming me. And so I'm saying all this and I think you already know where I'm going. I do. I already know where I'm going. So I'm saying all this, because you kind of opened the book for yourself. You did this on your own. I Googled you and you actually came up as a music artist. So I need to understand what is all this about? The beginning of my life, you know, I started playing instruments very young and singing very young. I was always involved in music, always like all the music. If it was a club or a band or choir or whatever, I was involved. I was a drum major at this moment in my life. I can play 17 different instruments. Music has powered me through my life when I was young. And I mean, stupid young, like illegal. And I shouldn't have worked there. And I'm not sure I should say this because I don't want to get them in trouble. But I mean, it was forever ago. There's probably not even records. But I was around 15. I worked at the Cotton Club, the Cotton Club where Ella Fitzgerald and all of these amazing musicians played. And I was 15. But I opened the tiny stage right in front. I was meant to be the bait to get people to come in and listen to the main show. And I did that for a while. And, you know, when I talk about wanting to be like a Pink Floyd backup singer, I actually saw myself in music that that's where I thought my life was going to go. I got accepted to Michigan State for music education and music performance. And I really thought that was my space. But after working in Chicago at a very young age, I didn't like the industry at all. I thought it was dirty and shady and gross. And I was like, I this is not who I want to be at all, even though I really love music. So instead, I joined the army and I became an EOD tech. And I did all of that. But through my entire life, music has been huge. I've been in lots of different bands and, and, and, and, and, and, and even today, every single day, I have music playing constantly in the background, and I'm constantly listening to new music. And during COVID, I taught myself how to play the violin, which was one of the instruments I'd never quite gotten around to. And I love it. I love every minute of that music is probably the most important thing in my life, no matter what I'm focused on, because music is what drives me forward. So I have actually submitted a report to Google, like, first of all, all of the things you're listing as songs are actually podcasts. Hey, that's hilarious. It's literally my podcast, all of my podcast episodes. And be like, if you want to talk about my musical history, that's great. But actually talk about the music and not my podcast. Well, that means just you're not doing something right, Kenan, your algorithm is thrown off. So I need you to go fix that. But yeah, that's awesome. And before anyone thinks that Kenan is immortal, I wouldn't say that you weren't at the Cotton Club when Ella Fitzgerald were there. Oh, no, no, no, no, no. It's the same place. It's the same place. But it's the same place. And it's the same microphone. It's the same Victrola. It's like, it's just mind blowing. And I can't, I can't express in words how much it meant to be able to do something like that. When I was a kid, when I was a kid. Now I look back on it. I'm like, you're so stupid. You did everything wrong. You could have done so much with that. But it's just phenomenal. That's awesome. That's awesome. All right, Katie, did you have any more questions that you want to talk about your small town, small town girls? Yeah, it's what's funny too, because she's like, oh, it was a little skeevy. Yeah, when I was 17, and I was doing, I was doing a show. It was two in Chicago at the, it was at the Burkhart Underground every Sunday. It was back in, I love that you said olden times or something too, because it was, we actually like went to Kinko's and I put paper flyers up all over town and stuff. Yes, totally. Yeah, but it was super skeevy. And so yeah, I ended up going into cybersecurity also. Isn't that funny? But no, I just, it's interesting too. You know, I think all of us as cybersecurity professionals are super stressed out. I'm very stressed out today, frankly, with my job. I mentioned earlier, you know, just how you have to have nerves of steel to have done the job that you did in the army, you would have had to have nerves of steel to be standing outside of the cotton club at 15, getting people into a show in Chicago. And I can relate to that. And then, you know, here we are now, you know, 20 some years later, and you've developed this, you know, really impressive track record and being able to communicate very, very well about, you know, what we need to do as cybersecurity practitioners and leaders. Really curious as you're looking at 2023, 2024, you're on the speaking circuit as you know, and many of the people on the stage are as well, way more so than I am, quite frankly. And, and just curious what you're thinking about when you're thinking this is the message that I want to bring to the cybersecurity community in 2023 and 2024 and beyond. What is that fundamental message? You know, for me, I think it's, it's kind of twofold. The first one is that diversity and inclusion do not mean what people think it means right now. I think a lot of companies think of diversity and inclusion as I have to have a woman or I have to have a black woman or black man or a Hispanic or this or that. When we talk about diversity, what is so important to me is diversity of thought, diversity of culture, diversity of just generalness, right? Like what do you do? What do you like? I have a super nerd. I like, I'm a gamer. I love games. I play Call of Duty constantly. I also play, you know, Valhalla and all of these things. Also, I've experienced a crazy world of musicians that are both wonderful and horrible. Also, I've experienced the military and multiple different countries and how people see us and how people see other things. Every single one of those things contributes to my capability to provide a diverse opinion. So when we talk about diversity and inclusion in cybersecurity, I think the message keeps getting stalled at, well, what is your sex and what is your race? But it's so much more than that. It's your life experiences. It's where you grew up. I grew up outside of Chicago. So if we're going to talk about anything, it's going to be Chicago style, hot dogs and roast beef sandwiches, right? Like, I mean, it's part of who you are. And I think the aperture for determining that needs to get so much bigger in cybersecurity. We need to stop thinking about it as just a diversity hire. And we need to be looking at it like, holy crap, man, this guy has done things no one else on the team has done. And he does this and he does that. And he came from here. We're going to hire him because his perspective is so diverse. It is so outside the box. And that's exactly what we need. So I think that would be the first one. The second part of it goes very much to my education and training, you know, kind of background and safety and security and privacy. We have to get better at demonstrating to all generations, whether you're six years old or 80 years old, showing them ways to understand privacy, safety and security. And what is happening with their data? What is happening with their information? Because we suck at this right now. And we can't afford to do that any longer, especially with advanced technologies like AR, VR, XR and the metaverse. We have to get smart and we have to make everyone else smart at the same time. And we need to do it fast. The metaverse. It sounds like such a scary place. When you just said that, I thought of the Lion King movie. Ooh, Mufasa. Mufasa. Well, listen, it is getting close to the end of our segment. And if there's anybody in the audience that wants to ask a question, now's your chance. I feel free to raise your hand. I don't know, figure it out. I'll do it. I think it's on the lower right of your screen. Sorry, folks. But I do see a lot of friendly faces who have come over from our clubhouse following. So that's great. Obviously, it's great to have you here. With that said, Kenan, moderator, any final questions before I kind of get to our final question and wrap up? Question for me or question from the panel? Question for you. So if the moderators don't have any questions. So Kenan, I will ask you my final question that I usually like to ask all of our guests. And it's a reflection question. I don't know. I think you touched upon this a little bit, but I don't think you... Oh, I think you touched upon it. I'll ask you the question and we'll go from there. So if you had one piece of advice for the younger Kenan, what would it be and why? Oof. So I have this thing that I tell everybody that I ever meet or mentor or whatever. And I wouldn't take that away for anything. And if I could go back in time, I would tell myself this over and over and over again at different points in my life. Because when I've adhered to it, it serves me well. Be unapologetically fearless about the things that you believe in. Don't let other people convince you that what you think is important isn't important. There have been times in my life where I am so convinced that something is absolutely right. And I've let people talk me out of it because, you know, imposter syndrome or I feel like I don't necessarily... I'm not old enough to have enough experience or say in this. But when I follow that, being unapologetically fearless about my ideas and my thoughts, everything makes more sense. And I get to do the things that I really want to do. I get to affect the things that I really want to affect. When I don't, I end up being, you know, a puppet for someone in marketing or blah, blah, blah. But that's not what I want. That's not who I am as a person. I want to change the world. I want to save people. I want to make everyone smarter and better. And I want utopia in my lifetime. Don't laugh. But the only way to do that, the only way to see that is to continue to be unapologetically fearless about the things that I believe in. So I would go back in time and every time that I doubted myself or I doubted my gut, or I doubted my fearlessness, I would go back and smack myself upside the head and be like, what? What are you doing? Shut up. Go. Go do... Just do it. Just do it. I think that's it. No, that's great. That's great advice. And look, I think the reason why I like that question is because, you know, it's a time for you to reflect. And I think that piece of advice is really helpful for folks either starting their journey or even where they are today, right, to be mindful of and sort of be cognizant of that fact. Because some of those things do appear for people that have been doing this for years and people that are just starting out. So great advice, Kenan. Moderators, any final thoughts before I leave Kenan with the final words? I love your energy. Don't stop. Thank you. Yeah, this has been great. And I've seen you, like, I think we hang in the same circles and I've seen you around, but I'm really glad that we had an opportunity to actually be on the club also. And I will connect. And I just love your energy, as Naveen said, and just keep going. Thank you. I really appreciate that. I agree. Oh, I'm sorry, Russell. No, no, no. Ladies, go ahead. Okay. Well, you know what? I am going to go first. You know why? I'm going to be unapologetically fearless. Yes. No, I really appreciated that bit of advice, you know, just a reminder to, you know, be that fearless person, the person who really wants to be the change, right? Right. That is, you know, the fundamental function and what drives, I know, the people on this stage. And it's inspiring and just so wonderful to hear that, you know, from you. And yeah, just really thankful to have met you tonight. So thanks again, Kenan. Thank you. I really appreciate that. What Katie said, that's just amazing. And you did inspire all of us and we appreciate you spending the evening with us. Thank you. Thanks for carving out the time. Appreciate it. Look forward to meeting you in real life. Absolutely. Kenan, I didn't ask you whether you like fireworks or not, but I'll leave that alone. Oh, oh, oh. You like to explode things. Oh, oh, oh. Okay. I'm going to take the next two minutes to talk about this because it's really important. First of all, my birthday is the 5th of July. I was supposed to be born on the 4th of July, but I was stubborn and late with my ADHD brain even then. And so I was born on the 5th. Literally growing up for like 10, 12 years, my family had been super convinced that the fireworks were because of my birthday. And I cannot tell you how absolutely disappointed and heartbroken I was when I found out they were not. Like that's totally messed up. So I like fireworks. Whole world shattered. Right. So I love fireworks from a personal Kenan Skelly kind of way as an EOD tech. Do not mess with fireworks. They're unregulated and unsafe. That's all I have to say about that. That's funny. I was going to say, look, my son shares a similar story. He's a Halloween baby. And for a while he thought everybody dressed up for his birthday. But look, Kenan, it's been a blast. Thank you for joining us. I'm still not happy to join us a little bit late, but it was a great story, a great origin story. And it's been a great sort of hour and a half spent with you. So thank you for taking the time out of your busy schedule to join us. We do appreciate it sincerely. I will leave you with the final words for the evening and feel free to plug any podcasts or anything you're working on. Well, I will start with, you know, be unapologetically fearless in your life, just in general. And I don't mean just with cybersecurity or your work. I mean, in general, if there's something you want to do, do it. And if you fail, you fail. But once you've done it, you will realize whether or not it's something you want to keep failing at and get better. And I think that's so important. I think we culturally we kind of make these rules that, you know, failing is just horrifying. And you can't ever do that. You just have to be successful. But I am where I am today because I failed at all of the things that I used to be unapologetically fearless about. Right. Because I took that step forward and I learned about it and I got experience from it. And I think that that's one of the most crucial things we can do as human beings. And I also think that in terms of education, in terms of learning, in terms of the cybersecurity workforce, in terms of all of these things, there are so many ideas that are outside the box that people are thinking of. And large companies are not taking serious. And they should. They should be looking towards the next couple of generations of, you know, folks who have really amazing, crazy ideas because that's where innovation is. That's what is super important. And finally, if you want to hear me talk to really cool people about cyber legislation and policy and all of that, I do have a podcast. It's called The National Blast.com, which honestly, I didn't think was going to get as much hate and discontent for combining National and Blast as it did. But it's OK now. So, yeah. Be you. Try things. Try everything. At least once. Just go out there and do it and figure out if it's for you or if it's not. That's it. Awesome. Thanks, everybody, for joining us on our weekly Fireside Chat. We'll be back next Wednesday. You know the time. And we'll post where we will be. It will most likely be on LinkedIn. So please tune in next week and tell your friends. Share whatever you want with your friends. Let them know to come in and join us. We're going to have a great guest. So thanks, Kenan. Thanks, everybody. Have a good night. Have a good rest of your week. Cheers. Bye, everybody. Bye, everybody.