Fireside Chat w/Frank Kim, Fellow @ SANS Institute

Looks like I see folks falling in. So, look, this is our weekly fireside chat. We do this every single Wednesday for about an hour and a half or so. So we ask that you all have fun. Have a good time. Have a good evening this week. This week we're joined by Frank Kim, who comes from us, from the SANS Institute, where he's a fellow. And there's a lot more, I'll say, underneath the onion or to peel back the onion and find out about Frank. So I'm looking forward to the conversation. So as I mentioned, this is our weekly fireside chat. We do this every single Wednesday. I do see a lot of familiar faces in the audience. So thank you for joining us. If you are new to this, thank you for tuning in. As I also mentioned, we'll be asking Frank questions for about 30 to 40 minutes or so. And we'll open up for the audience to raise your hand and we'll bring you up on stage. If you're new to LinkedIn Audio, there should be an option on your screen or on your app that says raise your hand. And once we get to that part of the segment, you feel free to raise your hand. It's the middle of the week. It's Wednesday. Let's have a good time. Let's use it as an opportunity to get to know Frank a little bit more. Let's get to know him on a, I'll say, a more personal level. Figure out what motivates him, what's driving him, what's keeping him engaged in the community and what's taking him to the next chapters in his life. For the most part, for some of us, at least on the stage, our comments and opinion are our own and do not represent our current or prior employer. So we ask that you please keep that in mind. And again, let's use this as a platform to have a great time. So if you are a vendor in the audience, you know, try not to come up on stage and sell us on your latest and greatest product or solution. We appreciate you all as being vendors in the community because you're definitely needed. But tonight is not the right time or place to sell us on your solution. So let's try that some other time. Without further ado, I'm going to go around the room. Frank, we'll leave you for last. And I'm just going to introduce myself. I am Tomas Maldonado. I'm the CISO for the NFL. Russell, over to you. Hey, thanks, Tomas. Russell Eubanks here, founder, CEO of my company, Security Ever After, where I help cybersecurity professionals get promoted. And as many of you know, I'm also privileged to be an instructor with the SANS Institute. And amazing to have Frank with us this evening. Like I always say, you know, if you don't already have this on your calendar, a recurring calendar reminder every Wednesday at 8 p.m., you're robbing yourself. And I know that will be the case for this evening and just really eager to learn more and get everyone the chance to get to meet and ask questions of Frank. But with that, Lisa Beth, let me turn it over to you. Hey, hey, everybody. My name is Lisa Beth Lentini-Walker. I am an attorney originally. And I currently work for a fintech company out of the Bay Area, as well as run a compliance ethics and corporate government. Hey, guys, is it just me or can you guys hear Lisa Beth? No, I hear her loud and clear. Yeah, I hear her fine. It may just be you, Frank. Yeah. Well, hopefully you'll be able to hear everybody. But we're really excited to have Frank here today. And I'm going to pass it over to you, Tomas. Hopefully he can hear you. Frank, I hope you heard Lisa Beth. Uh-oh. Frank, just a quick microphone check for you. Ah, there. You know, something weird happened. We did our mic check, sound check beforehand. As soon as Russell turned it over to Lisa Beth, I couldn't hear anything. And then I realized that I couldn't hear any of you guys. But I can hear you now. Something, something. Can't trust this technology. Sorry about that, everybody. That's all right. That's all right. Look, it's a new platform. I'm sure there's going to be some stuff like that. So look, Frank. Usually I, so what I'll say is, you know, why don't you take a moment to introduce yourself? And while you're going through that introduction, feel free to take as much time as you want to cover your introduction. Why don't you tell us a little bit more about you and your origin story? Yeah, well, all right. Yeah, well, hey, hello, everybody. Thanks a lot for tuning in. Hey, Tomas, Russell, Lisa Beth, thanks a lot for having me here. And I guess, you know, as you said at the very top, you know, I'm Frank Kim. I'm a fellow at the SANS Institute. I've been teaching and writing classes with SANS for about 15 years now. I'll circle back to that here in a little bit. So, you know, I'm also a SANS author and an instructor writing and teaching various courses. Also, as part of the fellow role, lead up the cloud security curriculum and our CISO leadership curriculum. I was the CISO here at SANS for a little bit and also helped build security programs in prior lives while I was teaching for SANS these last 15 years, kind of on the side and had various other day jobs. You know, one of the last big companies that I was at was helping to build the security program at Kaiser Permanente. And in terms of my origin story, Tomas, you know, I guess from a career perspective, you know, I actually started as a developer, not in security, actually, as a developer and engineer back in the dot-com days. So the late 90s. So I saw the whole dot-com boom and the corresponding bust. And the reason I got into security was at the time, well, I was writing a bunch of code, wrote too much Java code, actually, and a lot of bad Java code that I think, unfortunately, probably for some organizations, some of that code is still running in production. And I inadvertently, accidentally, unknowingly created a number of vulnerabilities in those various applications that I was responsible for developing. And, well, as you can imagine, well, those issues came back to bite us in some cases, and I became the guy that had to go fix those. And, you know, not just the issues that I created, but the issues that would come up, other vulnerabilities that were discovered, other incidents that would arise. I slowly became responsible for taking on more and more of those security responsibilities. And all of a sudden, after some years, some period of time, I looked up, looked around, and said, you know, this security stuff is actually pretty interesting. You know, why don't I do that full-time? So that led me into various roles, doing things like application assessments, pen tests, code reviews, building an application security team. And kind of as my career progressed, that led me to move to and do other things in the larger security team, working on vulnerability management, consulting, internal consulting, working in the SOC, working in pretty much all areas of the security program. And gave me really a kind of comprehensive, holistic view of what it takes to build and run a security team of a decent size, and making various mistakes along the way to try to figure out how to best actually do that. So from a career perspective, Tomas, that's kind of where it started in a nutshell. That's awesome, man. You know, I'm not sure that I know many people. So this is very weird, Tomas. Sorry, I know, I think you're speaking because your circle is green, but something is wrong with my audio. Let me go ahead and try to switch my headset and put on a different microphone. Sorry about that, everybody. So I know, I believe you guys can hear me, but for some reason, your audio doesn't actually work. So let me go ahead and toggle these audio settings here. Sorry about that. Let me see. And if you could go ahead, one of you, please go ahead and chime in to see if I can hear you. Hey, Frank, can you hear me? Yeah, I can hear you now. So I just switched back a different wired headset, toggled the settings here in LinkedIn, and it seems to work. So hopefully that doesn't happen again. Sorry, everybody. No, no worries. Hey, I was just going to say, you know, I don't know many people that I can, I don't know that many people that I can say they were programmers, created code, and their code is probably lingering around other companies' systems. And, you know, hopefully those people have fixed their code, especially if there was issues in it that you identified and had to fix yourself. But that's a great story. So, Russell, I'll pass it over to you. Hey, thanks, Tomas and Frank again. Really appreciate you being here. You know, Frank, in your role, and I got a little insider information, you know, having worked with you for such a long time. But I know a lot of folks come to you, maybe they want to be a CISO, maybe they want to get a promotion and take classes and sort of all the things that they do and what's your guidance from what you've talked about in your career already in the last few minutes. But when folks come there and they kind of identify, hey, I want to be a CISO, or maybe they've been plopped into the role of a CISO unexpectedly sometimes, which happens. Have you noticed over your years of teaching people how to be an effective security leader, any common blockers, if there's like, you know, a top one or two things that you see that are barriers to keep people from being effective in that role? And if so, I wonder if you could share those with us. Yeah, great question. Appreciate it. You know, pretty much everything you've just described, you know, I've kind of seen and experienced over the years. You know, I've had people that were on my team, and maybe not so succinctly, as you just pointed out, but in their own way, you know, numerous times over the years, they will say something along the lines of, well, Frank, hey, I would like your job as the head of the security team, as the CISO, the head of this team. And, you know, how can I get there? And, you know, so I've had a number of those types of conversations, as well as, you know, meeting people in both in class at various SANS events, just in the community, saying, hey, I'm on my journey, right, in cybersecurity. And I currently have a technical role, want to get more into a management role. I've kind of had a lead type of role, but I want to break through and get a formal kind of manager or director type of role and build and work with a larger team. So kind of along the whole spectrum there. And, you know, I, since, you know, I just gave you a little bit of my background. You know, I started as a technical person, pretty much hands on keyboard. Some of my earliest jobs, I had to sit there and it was more of a formal conservative environment. So I would sometimes have to wear a suit, but definitely slacks and a shirt, really for the purpose of sitting there at my computer all day long. And sure, I would talk to my immediate team members, the other technical folks on the team, but I was really heads down, hands on keyboard, really focused on building my technical skills. And I really had no idea what the larger company, what the larger business was all about, what it did, how it made money, what it considered to be successful. And as I progressed in my career, you know, I realized that just having good technical experience and ability to do the hands on technical job, despite all of those vulnerabilities I may have created, and maybe I'm exaggerating a little bit, you know, thankfully it wasn't that many. But I realized that, you know, the technical skills, your experience in terms of it from a technical perspective will kind of get you maybe invited to that next party, to that next event, but it's not what's going to take you to the next level. So, Russell, to your question, the common theme there is in terms of somebody wanting to advance their career is, well, what differentiates a security leader from a HR leader, a finance leader, some other leader? Well, sure, it's domain knowledge to the extent that, hey, we've got to know about cybersecurity to be able to build our program and steer the team in the right direction. But it's really the non-technical skills that are really going to get us there from a communication perspective, from a storytelling perspective, from a business knowledge and business acumen perspective. You know, I had a senior VP or VP that I was working with once a long time ago, and he was very much a hard charger, definitely kind of a deep personality of, you know, kind of push things forward almost at all costs and get things done. And because he was able to deliver so much, he eventually got promoted to SVP in this large organization. Now, surprisingly, or perhaps not so surprisingly, he didn't last very long in that particular role, because once he got promoted to SVP, he had to interact much more closely with people at a different level in the organization. And those other people, to put it bluntly, realized that they didn't like him. And as a result of that, his hard charging nature didn't necessarily work in that context. So it was more of the communication, the business objectives, that sociability part that was actually missing. So I would say, yeah, Russell, you know, it would be those types of skills that we've got to balance out in terms of that technical knowledge, but also having more of that EQ and some of those soft skills that we need to continue to develop. And, you know, having come from a technical background, I still, from experience and still see lots of other people that come from a technical background, if that's where they're coming from, sometimes have challenges, right? Figuring out how to take that next step. That's awesome. And, you know, to be totally transparent with you, Frank, I was going to ask you, what's the opposite or what are good things? But in the process of answering the question, you kind of covered that as well. The things that hold folks back as well as the things that help make, especially new CISOs, to be successful. So I definitely appreciate that. But, Lisa Beth, over to you. Oh, Frank, you are speaking my language between the storytelling and the importance of communicating so that your voice gets heard through the noise. So I love to hear that. I do think that is one of those things that differentiates you, particularly as you continue to progress in your career. But my question for you is about how you see around corners and what you do to make sure that you're staying aware of, you know, things that are happening within the industry and also where those next vulnerabilities or next opportunities are going to be. Yeah. Hey, great question, Lisa Beth. Appreciate that a lot. You know, I think one of the things that's hard to do is when we get, you know, we're wandering through the forest and kind of looking up close at the trees and not seeing what the larger forest looks like is to try to take a step back and say, well, what are the trends kind of from an industry perspective that we're seeing? And really, you know, I mentioned I started my career at kind of the dot-com era, the boom and the bust. And I didn't quite realize it at the time, but it's, you know, obvious now we've been living in this world for a while is that kind of the web, kind of the internet, the web defined really the last 20 years of technology and a lot of what we've had to, what we've been able to build out, what the industry's been able to build out and therefore what we've had to secure. Now, certainly mobile played a big part in that, but that was built on top of the web in terms of the underlying APIs and so on. So the question then is, well, what's next? And we know that cloud is already here, even as recently as five years ago, I would say, many organizations were hesitant to move to the cloud, whole hog, adopt the cloud because they had concerns about perceived lack of control, perceived lack of visibility. So that trend in terms of enabling digital transformation is already here. Kind of, well, what's next? What's coming up? Why did everybody, why did companies, organizations move to the web? Why are they moving to the cloud? It's really thinking back and understanding those business drivers. And again, coming from a technology background over the years, I've had to learn more about, well, finance, what drives an organization? What are the, what's the mission, vision, but what are the strategic objectives and how that aligns with, well, how the company ultimately figures out what its success means for them. And, you know, having advised, for example, some startups over the years, kind of by definition, the nature of a startup is to, well, get more customers. And you do that by providing some value to those customers in terms of, well, what they actually want to, new capabilities they want to roll out. Now, none of us have a crystal ball. None of us can tell the future, but our job as security leaders is really to manage information risk. It's, I used to think a long time ago that, hey, our job was to roll out and implement and build various technical controls. And sure, that's one common way that we manage information risk. But the bigger picture, you mentioned looking around corners, is really senior leadership, executives, the CEO, the board wants us to help them understand what is the cyber risk associated with, well, hey, opening up an office in China. What's the cyber risk associated with building out this new product or entering this new line of business? What do we need to do to help mitigate some of that risk? What security controls and capabilities and approaches and processes can we put in place to make sure that the business will actually be successful to minimize any potential disruption? And whether in the future that's increased adoption of Internet of Things, whether that be artificial intelligence, whether that be enhanced machine learning, whatever that might be, we don't necessarily know yet. But it's upon us as security leaders to keep our finger on the pulse of those, that changing landscape and figure out, hey, how does that enable the business or not? And what do we need to do to secure it? I love it. I'm so glad that you're here. It's just delightful to hear you speak about the looking around corners and finding ways to be really a partner to the business. So thank you. I'm going to turn it back over to Tomas. Thanks, Lisa. Thanks, Frank. Frank, I want to ask you, I want to maybe lean in a little bit more about what you're doing currently at SANS and really the start, I don't want to call it the starting point, but like I've always been curious about becoming an educator. So this is probably, this is the root of the question. And so if it was me, you know, someone who's been doing cybersecurity for several years, and I wanted to maybe transition into an educational side of the house, if you will, to help others continue to grow in their careers. How would I start? Or where would I start? Yeah, you know, good question. And I mentioned earlier how, you know, I started my career as an engineer, as a developer. But, you know, when I was in school, when I was in college, I actually, you know, didn't major in CS. I actually majored in both business and ethnic studies. So a combination of sociology, history, and political science, and so on. Now, I, you know, had always been, even as a kid, you know, fluent in computers and played with computers and did some programming. And, of course, I took various CS and programming classes in school as well, which, you know, helped prepare me somewhat, I would say, for my first jobs out of school. Not fully, because what you learn in school is totally different from kind of software development, engineering, and administration that happens, as we know, in the work world. The reason that I mention all of that, circling back to your question, Tomas, is because, well, when I was graduating, I actually thought that I wanted to go into education myself. You know, I thought, oh, you know, maybe I'll go teach high school. Maybe I'll go back and get my master's in education and, you know, teach in some way. I didn't know what that would actually look like. Now, you know, we also know that kind of the macro forces that we happen to be living through and living in, that affects kind of the paths that might be available to us. Well, with the dot-com boom happening when I graduated, you know, to be honest, tech jobs were falling off trees. And, you know, anybody with some amount of technical knowledge and aptitude could get a job at that time, which fortunately I was able to. And so I got distracted, to be quite honest, from what I thought was my original goal of going into education. So I worked in tech for quite a number of years, worked in security. And after a while, I wound up taking some SANS classes. And when you take some SANS classes, you get the corresponding certification associated with the class. You know, sometimes you might be on a mailing list, which I was on at the time. Back then, it was Stephen Northcutt sent an email to this mailing list and said, hey, does anybody here know application security? Well, I responded and I said, yeah, I do, because really that was the extent of his question at the time. And then he responded back and said, hey, we're working on a new class around application security and secure coding. We're looking for people to contribute. Would you like to help out? So I said, yeah, sure. And so it turns out that there were a few other people that were involved in this course at the time. There was an outline, different learning objectives. So I picked some different modules that I was familiar with and went back and wrote the corresponding slides, wrote the corresponding hands-on labs. And I turned them in and I thought that was it. You know, I didn't really think too much, too much of it. Fast forward. Oh, I don't know. Some months later, somebody else from SANS reached out to me and said, Frank, this class that you contributed to is done now. And well, you know, it turns out they didn't word it like this, but this was the gist of it. Turns out we don't have anybody else to teach the class. Would you like to teach the class? And, you know, to be honest, back then, this was, you know, over. I mentioned I've been doing stuff with SANS for 15 years. So this was probably, I don't know, 17, 18 years ago now. I kind of lose track of time at this point. But so I said, sure. But I said, sure. But I was, to be honest, quite terrified. Now, sure, I had given presentations at work, but I'd never stood up formally in front of people from nine to five, talking all day long and giving a presentation to a large number of people, you know, let alone, you know, dozens, hundreds of people. So I knew, though, I had a sense somehow that if something made me feel that uncomfortable, that I should probably do it. So I said yes. And that kind of started my journey into teaching. So I kind of feel, Tomas, that I got into not only security somewhat by accident. You know, I didn't start in security. But I also got into teaching, well, security in particular, a little bit roundabout, a little bit by accident as well. And your question, well, hey, how can somebody get started? You know, there's that basic saying is like just, well, practice, practice, practice. At this point, I've probably presented in front of people for, I don't know, thousands and thousands of hours. And it wasn't until probably a few years after I started teaching for SANS on a regular basis that I even felt comfortable with the stuff that I was saying, even with material that I created. So really, whether it be speaking at third party events, practicing with your friends, your family, with your co-workers, Toastmasters, things like that. Right. Those are all kind of steps in the journey of being an educator. And for me, it really, you know, having that kind of grounding on the topic, the knowledge of that particular topic, that technical foundation was super helpful to make me a little bit more comfortable to be able to start to share information like we do today. But Tomas, did that, I don't know, did that answer what you were kind of trying to get at there? No, it did. It did. And that's, you know, it did. And I was going to ask you, I was going to ask you a follow-up question to say, you know, I was going to ask you a follow-up question around that sort of fear side. You know, you've been doing this for so long. You've, as you mentioned, so many hours, you know, do you get nervous at all anymore? That's a good question. You know, that's funny that, you know, short answer is it depends. It depends on kind of the venue and the topic and the, so, you know, if I'm presenting, you know, in person to, you know, a thousand people, two thousand people, there is that moment of kind of nervousness, good nervousness, those butterflies, which is just natural. But then, you know, having, you know, gone through, you know, developed all this muscle memory, you know, that kind of fades pretty soon once thereafter I get started. But if it's your typical class or if it's a typical session, you know, I really don't get those butterflies as much anymore. And what's funny is sometimes I'm looking for those butterflies. Like, hey, I want to keep on stretching myself. Maybe I need to talk about a, present about a different topic where, you know, I know that, hey, it's something else that I need to continue to learn. So that is a good signal is when I get those little butterflies, it probably means I'm doing something, something right. That's awesome. So just a very, very quick room reset. If you just joined us, we're joined this evening by Frank Kim, who's a, who's a fellow at the SANS Institute. We've been listening and learning about his origin story and, and, and things that have driven him to where he is today. With that, I will pass it over to you, Russell. Hey, thanks so much, Tomas and Frank. I've known you for a long time and I'm just amazed all the extra things I've been learning throughout this conversation this evening. So next question. So first question was around kind of the leadership side, but I know you're also the curriculum lead for cloud security. And in my work and, you know, full-time work and consulting work now, I often find companies, you know, have some, some amount of space in the cloud. Maybe they were, I've heard this term recently, born in the cloud, always been cloud native as a company, or maybe more traditionally, you know, technology data centers and stuff, and then trying to try out the cloud. So you've got two different scenarios, you know, always been cloud or maybe moving to the cloud. As you think about, and as you teach and advise folks in both of those camps, is there a couple of maybe advantages, disadvantages to both of those models or any kind of advice for folks that may be in one or moving to one or more of those types of ways of doing business? Love to hear that if so. Yeah, you know, we've, we've got kind of the, the ideal state and then the reality here, you know, which you, which you just described is that, you know, there are companies that are just getting started. If I'm starting a company today, I'm going full on cloud native, you know, I'm not looking for a colo facility. I'm not looking for my own data center. I'm looking for what can I do with various SaaS services right out of the gate, right out of the box. And if you're in that situation, you know, Hey, to be honest, there are challenges, but in my mind, it makes it a lot easier. I spent most of my career on the large enterprise side, worked at a number of smaller companies along the way, but most of my career at the large enterprise, which is by definition in today's world, going to be a hybrid type of environment where they've got various on-premise type of systems and then various footprints in the cloud as well. And that's going to be the case for the foreseeable future. And this is why I think one of the reasons why Microsoft with Azure, for example, has been compelling and has been getting so much uptick because from towards the beginning, they've been talking about a story about, you know, about hybrid and multi-cloud and on-premise and working in the cloud itself. So certainly if you've got a more of that greenfield cloud native approach, I do think it definitely makes things easier, but when you've got your hybrid type of environment, your hybrid infrastructure, that's definitely doable as well. For us in security, the common thread here is that, well, one, we need to understand how all of the cloud providers work, because if you're a large enterprise in a hybrid environment, you're kind of by definition, either by choice or by chance, multi-cloud. You're going to have some AWS, you're going to have some Azure, you're going to have some GCP, usually in some combination thereof. Now, you might have one primary cloud, but because of acquisition, geography, the preferences of certain teams or certain business units, there's usually multiple clouds, kind of like every organization has both Windows and Linux. Similarly, we kind of see that now with the various cloud providers. So that means for us in security, well, we've got to, one, understand the cloud providers, the various services, how they work. Number two, understand how to secure them. But number three, which is where a lot of leading edge organizations are going, is try to figure out, hey, how do we use the same cloud principles, practices that enable automation and scale in the cloud? How do we bring those to bear on our security capabilities as well to make things like vulnerability management easier, things like threat detection easier as well? So, yeah, definitely, I think that's why cloud is so transformational. You know, when we say cloud, when I say cloud, it's more kind of an umbrella term, not only for the technologies, but the corresponding processes and practices as well. Russell, did that answer the question? It sure did, Frank. And let me follow up with this. So, you know, besides companies that can't move for whatever reason, you know, governments, et cetera, that just say, you know, they'll never go to the cloud. Do you predict, if you pulled out your security crystal ball, would you see in 10 years, everybody, you know, like a mass shift there and everyone just kind of lived and used to being in the cloud to relieve themselves of that burden? Is that what, what do you think? Is that a prediction or is that just a goofy ambition? You know, I think definitely, yes, that every organization, the vast majority of organizations are going to have some sort of cloud footprint. Now, whether an organization goes 100% cloud, especially a traditional enterprise, you know, that remains to be seen. I don't think I would necessarily predict that. Now, what's interesting, though, is that if you're a smaller company, if you're just getting started, you know, we mentioned the kind of cloud native from the start. You know, there's so many benefits for a company getting started to go all cloud first in terms of the scalability and the flexibility and the cost implications and so on. But what's interesting is that, hey, if you're a mega size organization and, you know, like one of the various mega size tech companies, it's a they've got various incentives to not just be solely in the cloud in terms of wanting to control their own stack from a hardware all the way up to a software perspective. Now, those are the outlier and rare cases there. But, yeah, main point being that because of various business drivers, every organization is going to be a little bit different and have different requirements. Got it. Very, very cool. Lisa Beth, Tomas, over to you. I've been really enjoying this conversation so far. And I want to ask you a question about people who are just starting to think about career planning and are thinking that maybe they might be interested in this type of profession. Before they even head off to college, what are you telling our high schoolers to be thinking about? You know, they've they've grown up in a world where, you know, digital has always been around and, you know, they can't imagine a time where you weren't holding on to a phone with one hand while trying to do a million things with your other hand. Are there things that you would recommend to them that they think about when they're thinking about their career or ways that they can try before they buy a college education or whatever it is? Yeah. Yeah. Hey, really good question, Lisa Beth. And it really hits home because, you know, I have a few kids, you know, one is in high school and one is in middle school. And, you know, we I don't my wife and I, we don't have any kind of predetermined notion of, you know, hey, you should go into this field or not. Like when I was growing up, my parents might have been, Frank, you have to be a doctor or you have to be a lawyer. So, you know, it's not any of that necessarily. And, you know, side note, I think Russell knows this is that out of the blue, you know, one day my the younger my younger daughter, who's in middle school, she used to we have a screen time password protections. And so she was sitting there trying to brute force guess the screen time password. She out of the blue one day came up to me with her whiteboard. And without any prompting from me, she created her own basic cipher, a very basic cipher. And just because she was curious about it and, you know, trying to circle back to your question here is what, you know, we're trying to instill is this concept of a growth mindset versus a fixed mindset that I think we're familiar with. And what's funny is when my daughter was I think she was in third grade. She came home one day from school and I asked her, you know, hey, so what you what you learn today at school? And, you know, I thought it would be the typical answer of, well, nothing, you know, it was all boring. But she she said immediately she said, oh, well, today we learned about the fixed mindset and the growth mindset. And the fixed mindset is when you believe that you can learn anything and anything is possible and things like that. And I was just a little bit blown away because, you know, nobody told me about the fixed and growth mindset when I was in elementary school, let alone in my early adulthood. So I thought that was great. And, you know, it's really trying to instill that curiosity and the idea that, hey, you can always be learning where you should always be learning. Now, whether that's in security or something else, you know, that remains to be seen. Now, circling back, I think maybe to your question a little bit more specifically, if somebody wants to get into cybersecurity, well, where do they start? What do they potentially do even perhaps at a young age? In the last couple years, you know, I've met people that somebody that was a mechanic five years ago that was always at the various mechanics that he's been working at happened to be the person that also set up their internal IT infrastructure, deployed various servers and networked them together in addition to his mechanic duties. And now he's a DevOps and cloud engineer because of his curiosity. I've met other people that were in non-technical roles and now have moved into more technical roles and leading various vulnerability management teams and application security teams. So I mentioned that to say, hey, I think it really just starts circling back to that curiosity. But building that foundation, whether it be from a networking perspective, from a data perspective, from an application perspective, is getting knowledge of those different areas and seeing where your curiosity takes you. Because as we all know, cybersecurity is a deep and big field that has specialties in a number of different areas. So just trying to identify those, if it's a fit for you, if you've got that, I guess, you know, I would say perhaps skeptical mindset. Even as a kid, for some reason, I always had a skeptical approach in terms of, hey, should it work this way? No, no. Well, what if we tried to do it this way? Lisa Beth, hopefully that answered your question there. No, that was great. You know, as a mom to a couple of children myself, I always, you know, think about growth mindset. And I love it when my children come up with different things that they can be doing to give themselves exposure to many different areas. Let me turn it back over to you, Tomas. Yeah. Yeah. No, look, it is, it's about that time. If you do have any questions and you want to jump up on stage and ask a question, feel free to raise your hand and we'll bring you up and you can ask a question to Frank. If you just joined us, as I mentioned, this is our weekly fireside chat. We're joined by Frank Kim, who's a fellow at the SANS Institute. If you don't know what SANS is, I was going to say you've probably been on the rock for a while, but I do recognize that we do have folks that are starting out their careers and folks that are not cyber professionals. So SANS is an interesting place. I know I studied there and we're lucky to have two folks that actually participate at the SANS Institute with Frank and Russell. So very, very happy to have Frank join us this evening. So Frank, you're doing a lot of educating. What are you reading? What are some of the things that you have on your either current reading list or your future reading list that things that might interest you and things that you might potentially want to teach about? Yeah. Well, you know, I guess I'll start with the non-security stuff first. You know, I'm actually a, what would you call it here, an amateur bartender. So I've never worked professionally in a bar or behind the stick. But, you know, even before COVID, a few years before COVID, I always found myself going to various places, restaurants and bars. And sometimes they would make a great drink and I would go back to the same place and order the same drink and it would not be so good. And I would be like, well, why? What is the difference? And so probably about five years ago, I started to figure out, try to learn how to make drinks at home. And, you know, I'm one of those guys, you know, once I get into something and maybe that's how it started in security is I will read that book cover to cover. And, you know, well, a cocktail book is largely kind of like a cookbook, like kind of a recipe book. Right. And so I'm one of those guys that will read the recipe book from cover to cover, looking at the recipes and seeing the similarities and so on. So there's various cocktail books that I'm reading or reading on a regular basis when COVID happened, you know, unfortunately for the world. But hey, for personally, from a drinking perspective, it was timed just right because I'd been making drinks at home for some time. And when we couldn't go out anymore, hey, well, my wife and I still had things that we could actually imbibe. So it actually worked out pretty well. And I was about to say that, like, wow. Talk about the perfect timing. You learned this new skill and now you're really putting it to the test because you're in lockdown, right, during COVID. That's awesome. Yeah, exactly. I won't tell you what mine was. Mine was being a barber. But you can see my son walking around with his messed up haircut every so often. But anyways, back to you. Oh, that's hilarious. Nice. And then now, hey, you mentioned that, hey, this isn't a sales pitch. So don't worry. This is not a vendor thing. The only reason I caveat with that, because, again, this is not cybersecurity related. I know I see a number of people here in the session that I know. And so hopefully you guys won't ask too many hard questions a little bit later. But I believe that some of you here might have seen this already. But my dad wrote a book about his journey as a kid kind of escaping what became North Korea. Because a long time ago, it was not North and South Korea. It was just one Korea. And because of the confluence of politics, right, there was the Korean War that wound up dividing the peninsula in half between North and South Korea. And, you know, my dad and his family knew that communism was coming. So they tried to escape to the south. So that's another recent book that I've read, which is his book about his own personal story here. And what did you think? Did you criticize your dad about his book? Well, you know, as a kid growing up and, you know, I went growing up, you know, my parents were were the type that wouldn't wouldn't talk to us kids about kind of quote unquote adult things because, you know, he had such a hard life kind of as a young young kid and a young adult. They kind of wanted to shield us from some of that. And, you know, it was very kind of emotional and, you know, kind of heart wrenching for them. So, you know, they didn't really share a lot of that. We had senses of it, but it was never kind of sit down and explain it all. So now as an adult, being able to read his book and looking back upon what, you know, kind of trying to connect the dots a little bit. It helps me better understand, of course, him, which is why he wrote it. One of the big reasons why he wrote it. And then also kind of why he thinks the way he does and why he made those decisions. And there's a saying that only the dead have seen the end of war. And I can definitely tell, you know, from my dad is that, hey, kind of the the the ripples of war and things that he's experienced, right, stays with him to this to this very day. So it definitely helps me understand him and kind of that generation a lot better. That's awesome, man. I'm sitting here because I was just thinking about my dad. My dad is my dad's 86. And, you know, I wish he would have written a book. But I have a lot of I'll call it great fond memories and things that we've captured on video. But it would it would be it would have been really good to to be able to ask him questions like this around his origin story. Unfortunately, my dad is is is that is that at a point in his life where it's a little bit hard for him to recall certain things and topics. But no, that's that's great. I'll pass it over to to Russell or Lisa before. Again, if anybody in the audience wants to join the conversation, prefer to raise your hand. We'll bring him up on stage. Hey, Frank, while we're waiting, maybe some other folks want to come up and ask you questions. Here's here's one for you. What's your favorite interview question when you're screening or advising someone? And if they should be become a CISO? Wow, that's a really good question. You know, I guess it makes you know, I don't know about favorite interview question, but, you know, I will share that kind of most recently in terms of kind of interviewing for somebody for the CISO role, actually, because usually kind of throughout my career, I've been on the other side of the table as I was the one being interviewed for the CISO role. But earlier this year, I had a consulting engagement. And it was with this startup that was Series C going on to Series D from a funding perspective. They had hired their first CISO about a year ago. Long story short, it wasn't working out. And I got connected with the CEO and the CEO said, you know, along the lines of, you know, hey, Frank, you know, we brought this CISO in, but, you know, we're a startup. And, you know, I feel like he kind of flipped the script a little bit after joining is after joining. He said, hey, we've got to invest in a three hundred fifty thousand dollars in an expensive EDR solution. We need to spend two hundred grand on this and we need to do this and we need to build out a SOC and we need to hire an MSSP and so on. Now, in isolation, these are not necessarily bad things to do. But I asked him, I said, well, hey, well, how many incidents have you had? How many employees do you have? It wasn't very many. How many systems endpoints do you have? What's your cloud footprint look like? Because being a startup, they're primarily in the cloud. And even though that they had a decent valuation and gotten a number of rounds of funding, they were still a relatively small company. So, you know, really, in this particular case, the CISO didn't realize that, you know, whatever the right percentage is, I would say in this case, probably 80 percent of their job, they didn't realize it would be more of a sales enablement type of role. And, you know, sure, you're going to spend 20, 30 percent of your time building capabilities to make sure that the story you're telling your potential customers that's actually exists. But, you know, at that stage of the or at the stage of the company, right, it was more of a enabling the business from a sales and marketing and a brand perspective. So when I was helping to interview for who would be the next head of security at that company, it was really to your question, Russell, asking things along the lines of, hey, so here you are. Here's the scenario. What's the first thing that you think you would do? Right. And if somebody said build out a SOC, well, that probably would be in this context the wrong answer from a business perspective. Right. So it's really more asking those scenario based and those situational questions. Like if you're hiring a SOC analyst, ideally, you're going to give them maybe a packet capture. You're going to tell them about an incident or you're going to say, hey, well, what does this evidence tell you about what might be going on? Similarly, for a CISO, you want to put them in some sort of environment where there's a scenario, a case study and say, hey, what do you think about this? Right. What are the types of things that you would think about? How might you respond to these events as they unfold? So really, it's thinking about what are those situational questions? Russell, hopefully that answered your question there. Yeah, I love that. You know, anyone can memorize the five steps of the cybersecurity framework. But, you know, that situational here's kind of painting that picture. And, you know, gosh, it's so easy. I found to be busy doing stuff in cyber, but to focus on the thing that's the most important or what's my next moves to what you were answering. I think it's just just a fantastic approach at that. So I definitely appreciate that. Well, I've been enjoying everything that we've been talking about. So now I have a little bit of a more difficult question for you, Frank. I hope you're ready. What is the hardest earned wisdom that you've had in your career and in your life? Yeah, wow. Really good. I'm glad you prefaced that, Lisa Beth, with, you know, saying that it's a hard question here, because now that gives me an excuse to pause and think about it here a little bit. But, you know, I would say, you know, the hardest earned wisdom is, you know, a lot of times we talk about in cyber that, hey, it's just kind of the basics, the cyber hygiene that a lot of organizations can't do. So from a kind of from a leadership and even from a life perspective, it's really the hardest thing is realizing that it's challenging to turn common sense into common practice. In our mind, we might know some of the best practices, we might have even experienced these things before. But when we are put into a new situation, depending who we're interacting with and the time of day, well, we might forget about some of that common sense. You know, hey, for example, I mentioned my kids earlier, late at night when we're all tired, some little thing happens and I get a little bit grumpier, easier, right? To be honest. And it's for us in our roles is being able to decipher. Well, what's needed at the time? I recently had a situation arise at work where there's somebody that I've been working with for a long time and he has always delivered. And as a result, well, he's always delivered. So I've over time kind of taken a much more hands off approach. Sure. Every once in a while, we'll check in. How's it going? The last check in we had, you know, he's like, oh, yeah, you know, hey, it's hard, but there's some challenges. But I'm working through it. And I had no really indication that a that deadline wouldn't necessarily be met. Fast forward. Right. Some time later. Well, instead of me having my regular check ins, hey, how's it going? What's up? And, you know, it's not really micromanaging, hopefully not. But it's really just kind of keeping your finger on the pulse. Well, this is one thing that I made the mistake of not checking in with him because the deadline came and he basically said the day before the deadline. Hey, I'm not going to be able to do it right now. I'm sparing you guys all of the nitty gritty details. But that was the that was the gist of it, which came as a total surprise because I didn't. Implement my common sense into common practice of realizing that, hey, that thing he's working on is not something that he has done before or a million times. It's actually something new, entirely new from a technology, from a scope perspective. So I think that's maybe one of the hardest lessons that this just happened recently that I keep learning over and over again. It's hard to turn that common sense into common practice. I love that. And it's so true. I mean, you know, one of the challenges that I think we all have in, you know, the various professions we're in is, you know, it's the human factor. And, you know, it applies to us. It applies to the people who are trying to have modified behaviors. And it's just something that is part of the human condition. And speaking of the human condition, one of the things that has been talked about a lot is well-being and overall, you know, wellness in the workplace, particularly when it comes to those groups of people that are tasked with some of the always challenging jobs of being the guardians of, you know, integrity, security, you know, risk, ethics, etc. How do you think about well-being in the workplace for yourself and for the teams that you work with and for your students? Yeah, another great question. And, you know, you kind of mentioned this already. I mean, security is definitely fires every single day. I mean, within security, I think to me, there's two really hard areas of the security team is, you know, one is the SOC because there's fires every single day. Your analysts are staring at the alerts every single day until their eyeballs bleed. There's never ending stream of stuff and issues that arise. So that's one really hard area. But two, I find that the vulnerability management team is really difficult as well, because not only are there a mountain of vulnerabilities that sometimes never get patched, having been in environments with millions of unpatched vulnerabilities, unmitigated vulnerabilities, but you've got to wrangle all the cats with different competing interests across the organization and different groups. And, you know, I had a long time ago, I had a guy who was the manager of the SOC, one of the managers in the SOC. And he was a workaholic. He actually enjoyed it. But I could tell, you know, it was kind of it was a lot. It was too much. And I said to him, I said, hey, you know what? You know, we don't have to tell HR. Why don't you just take every every Friday for the next month? Just take it off and just relax. You've been saying that you wanted to work on these classes and certifications and and, you know, it'll just be between us and, you know, just take some time and we'll manage it with, you know, I'll help out and we'll manage it with the team that we have. Now, as you can imagine, he didn't take me up on that offer. Right. And he continued to kind of work himself to the bone a little bit and get burnt out. And that was this was a long time ago. Now, I always think back to that is and maybe how maybe hey, maybe I'll turn the tide here and ask you guys the question or the audience. The question is, well, hey, what else could we have done in that scenario to to help him? Right. What else could I have done to encourage him? Hey, certainly there's kind of work life balance, making sure you're appropriately staffed and making sure that the team is appropriately trained, that they can they've got time to do to do all of that training outside of the work itself. Making sure that the hours are reasonable, making sure that we don't have unrealistic expectations, having various team building activities, you know, a lot of these best practices. But, you know, this is still still something to be quite honest with that I I find to be I find to be challenging from a kind of a work life balance perspective, especially in those cases where you've got a team member that is as a high performer, but has always been working really hard. So, hey, Lisa Beth, I don't think I really have a great answer for you in that particular case other than, you know, kind of that common sense trying to turn that into common practice. It's totally, totally, totally acceptable that you we don't have all the answers, you know, I mean, we always try to do our best for ourselves and for the people that we are responsible for. And I think that's just understanding that common sense does have to be put into common practice. It really does help us over the long run to think about that. Tomas, I'll turn it back over to you. You know, I couldn't I couldn't help but think, man, Russell, why are you giving Frank so much hard time as a co-worker, as at work and the different challenges that you're doing? What's going on, Russell? Yeah, Russell just does not deliver. No, it was it was not Russell. I figured that. But but on that question, what is it like working with Russell? Have you had an opportunity to to co-teach a course or a class or something like that? What is what has that been like? Come on, you can tell us. Don't worry. We're most friends. Yeah. You know, of course, Russell and I first got to know each other through SANS. And, you know, hey, Russell's probably already shared some of his background here with the audience in prior prior sessions and so on. But, you know, I guess I will say that, you know, one of the things that stands out to me the most about Russell is that kind of he that I notice is that he's got a deep sense of caring. He definitely cares in terms of kind of making sure that his team and people and others are taken care of and set up for success. And that's something that is evident, Russell, in the way that you interact with students and you interact with kind of your colleagues and interact with other folks is that kind of deep sense of caring. And, you know, that's not something that you can just make up. You know, I don't think, Russell, we've ever talked about that. I don't think I've verbalized that to you before. But, you know, that's just more of that that vibe and that energy that comes across. Right. So if there's one thing that I could say about Russell is that I think, yeah, Russell, that's that's one big thing that you you epitomize there. All right. You're forever on my Christmas card list. I appreciate it. You know, I was kind of nervous. I shared with Tomas, Lisa Beth and the other moderators. I said, you know, one of the most stressful moments I had in my life. And, you know, Frank, I don't think I ever shared this with you. One of my most stressful moments. I was already certified, already been through the gauntlet of getting to be a SANS instructor. And I remember we were in San Francisco and you and I co-taught your class. And I tell you, teaching you your class in a room full of students who certainly had high expectations was probably one of the most stressful things. It's great. I'm glad we did it. We had a debrief at the end of every day, just as I would expect. But, wow, that was a lot of stress for me. Well, hey, and you made it seem very smooth because it didn't feel like you it didn't appear that you had a lot of stress. But, yeah, you know, hey, you you you did great with flying colors, which, you know, and you still continue to do today. So, yeah, I appreciate you. So, hey, who knew this would turn into a Russell and Frank love fest here? So I don't know, guys, we might want to change the topic. We definitely got to get some folks up on stage. We can't see the buttons to push. But, again, folks who are here love to have you come up and be able to ask a question. We'd love to hear from you. Otherwise, who knows where the conversation is going to go? Yeah, I'm surprised it's been such a quiet group these past couple of weeks that we've done this on LinkedIn. I wonder I wonder if the fact that we're on LinkedIn, this might be a good social experiment. I wonder the fact that since we're on LinkedIn and we can see everybody's sort of corporate titles, are we still stuck in corporate world speak, if you will? Versus when we're on Clubhouse where it's a little bit more loosey-goosey. I don't know. I'm curious. But, Frank, I did want to ask you a question specifically about your background or your opportunities that you've had. Because you're an advisor for several companies. Oh, wow. I said that and we got like three hands raised. Oh, well, hey, let's go to the hands for sure. Yeah. All right. There you go. Let me get folks up here. I rallied. I was going to say I rallied. I don't know what I'm saying. Forget it. It's Wednesday. Hang on. Let me get some folks there. All right. Derek, I see you. I see you up first. Go ahead, Derek. Thanks for joining us. Wow. Tomas and the rest of the team. This has been a great fireside chat, I will tell you. Frank, Kim, awesome discussion so far. So I actually have a question, not necessarily related to what you discussed before. It's about certifications. I've been, in my capacity as a cybersecurity professional, I've been receiving emails about CISO certifications. And one in particular, and I'm just asking the entire audience, is from Eric Cole at Secure Anchor. I just wanted to know if you were familiar with that person, that entity, and that certification. And do you have any other thoughts on CISO certification? Yeah. Hey, Derek. Appreciate the positive feedback to start. And, you know, I do know Eric Cole from many years ago, from a long time ago. I don't know kind of the details of what's, you know, offered in that particular course. Now, I can say, though, that over the years, sometimes people have asked, hey, Frank, what is the one class I can take? Now, they don't always word it like this, but the gist is, what's the one class I could take to be prepared to take on a CISO role, eventually become a CISO? Now, in my opinion, there is not one class that can do that. In my opinion, it's a combination of experience and knowledge and skills across a number of different domains. And so, you know, we talked about starting your career as a technical person. You know, I started my career and moved into various technical lead and technical management and technical director type of roles, kind of still kind of building out and overseeing kind of the technical operations. So from a security perspective, you know, I see that as a confluence combination of, hey, can you manage your vulnerabilities? Do you know how to build and build a vulnerability management program? Do you know how to build your security operations team in terms of kind of your SOC or your detection and response team? And do you know how to implement various controls? So those are kind of three areas that help us in our goal of becoming more of that kind of operational leader, security operational leader. And then kind of, hey, as you progress in your career, you know, you need that foundation. Ideally, in terms of kind of, hey, maybe, you know, lots of people go into a CISO role, not just from that technical background, but you need to have knowledge of those areas that I just described. And then from a senior security kind of CISO perspective, I see that as a combination of, well, understanding kind of that technology and the trends that we talked about, what should go into the program, but also, hey, what is strategy? How do you align your security plan, your roadmap, do that cap analysis, figure out what needs to be done, align your strategy with the overall strategic objectives of the organization, but then also build a sustaining culture? And I mentioned those things here because I've seen a number of security teams over the years when the CISO leaves, a few key people leave, that the team kind of slowly disintegrates, right? It doesn't really keep up with what was there. And that's an indication that it was really those people or the strength of those personalities that were kind of holding things together versus a sustaining risk-aware and security-aware culture that's in place. So, Derek, to your question, yeah, I really think it's more a combination of knowledge across those different areas versus the, you know, it's hard to encapsulate. You know, if you asked a CEO, hey, so this is CEO, you know, what class should I take to become a CEO? You know, they probably, I would guess, say something similar, that it's kind of a combination of knowledge, skills, experience, and so on across a number of different domains. And I find that it's a similar thing from a CISO perspective as well. Derek, hopefully that answered the question. Oh, I'm just excited that there are personnel, especially in this group yourself, who knows Eric Cole. A lot of times you get these notifications, these emails from personnel who are advertising these particular programs, and it's not that much behind it, if you will. So, I just wanted to kind of throw that out there, you know, kind of have that discussion, break the ice, if you will, from the audience standpoint. And appreciate your feedback so much, Frank. And, again, I love, like I said in my comments here, this new location. So, please keep it up. At least that's my vote. Right on. Appreciate it, Derek. Thanks, Derek. Thanks for joining the conversation and asking you a question. You know, I wonder, or at least I started wondering this as Derek was asking the question about the CISO certification. I'm like, man, I wonder, will I pass that certification exam? What is in that? Is it very difficult? Is it something that I should be looking at and seeing if I could get that certification? Man, I wonder. I wonder so much. All right, I'm done wondering. I don't know. I'm done taking tests. I'm tired of tests. I get tested every single day. Well, Tomas, I would tell you this. I'm interested in looking at the CISO course that Eric is providing. And also, there's a CISO course that's offered at Carnegie Mellon. There's a retired general, Greg Tuhill, who introduced me to that particular program. It talks to what you're talking to, Frank, regarding classes of courses. It talks different domains. The technical aspects were definitely heavy in having discussions with senior business personnel to ensure that you are able to hone in your technical skills with supporting their strategic business objectives. So just two avenues that I'm looking into taking those certifications, FYI. That's cool. That's awesome, man. Look, I hope those courses, the first thing that they start with is why. Why do you want to be a CISO? And if they don't start with that, I would question the course specifically. Because I think you need to really think thoroughly about why you're trying to be a CISO. And what is it that you want to get out of being a CISO for a specific organization? Because there's a lot of stress. There's a lot of responsibility. There's a lot of accountability. And there's a lot that you need to know that I can almost guarantee you're not going to find dug into the chapters in a book. Because there's so much nuance around the CISO and what the CISO does that I don't think you can capture it all in a training. I think you'll get a good understanding. But I really do think it comes down to the person and that person understanding and fully appreciating where they are in their journey and why they're trying to actually attain a role as a CISO. And when you get there, Derek, I'm happy to have a conversation with you about that. And, you know, maybe you could take my job one of these days because we need more. No, I just want to work with you and glean from you. You remember we just talked on LinkedIn about being your deputy one day. I'm just trying to be like you. No, don't be like me. I want to be retired. If you want to be like me, that's a good path. And we'll be retired soon. But anyways, again, my comments and opinion on my own, please don't hold it against me. It is Wednesday. I'm having a free-flowing, candid conversation. I am very truthful when I say, you know, people should think about the why. Why do you actually want to do certain things? Specifically, why do you want to be a CISO? But anyway, thanks, Derek. Thanks for joining the conversation and asking Frank a question. I was just trying to give Frank some time to get some water and drink because I do see Jennifer Sanders up. Jennifer, over to you. Hey, Tomas. Thank you. Hey, Frank. Nice to see you. So I think my question might tailor just a little bit on what these guys just said. But I wanted to go back to your comment, which I loved, on looking at the decisions are situational. So when you ask somebody, you know, how would you approach this? What would be the first thing you do, et cetera? And you said it's all situational. I 100% agree on that. And I'm just wondering how broadly you, you know, how broad that aperture is. Because you're looking at, like, the first thing you look at is a company and their resources. What's their goal? What's the risk? So I just wanted to see if you could kind of go into that a little bit more. And it kind of tailors into what these guys were talking about with the why. Like, why would you take that path versus X? And to an outsider, situations where it wouldn't have been my first, you know, I don't like the legal path we're taking. But then someone explained to me the bigger goal of the business and the company in that scenario. And then it made total sense. So just wondering if you could explain that more. I mean, you brought it out to also, you know, even just how you feel that day. Are you tired? So maybe you're making it in that mindset. But just to see how broadly you look at things. Yeah. Hey, Jennifer. Yeah. So, yeah, great question. Appreciate that. The, you know, I think it also. So if we're kind of taking it from the security perspective, kind of taking it from the CISO lens. The other thing to understand is, you know, the CISO needs to understand, well, how and where in the organization are we situated? And how, what is the current state of the company or the organization overall? So, you know, I've seen cases, for example, where the, in a smaller organization, the CISO reports to the CTO, for example. And that's not a very common reporting relationship. It happens more so in smaller companies. And it's not just about the reporting relationship, but in those particular cases, you can pretty well discern that the incentive, the motivation of the CTO and the stage of that organization is building out technology, cool technology, rolling out new features and functionality and so on. And so that would be kind of the primary driver. So, you know, the reporting relationship doesn't necessarily always indicate kind of what the primary goals are, but that's something that we've got to decipher and use our EQ and savvy and non-technical skills to be able to decipher that, figure it out and navigate within the organization to figure out, well, what are those strategic objectives? You know, a lot of times, you know, I don't think in the work world, I've never been presented with a succinct kind of, here's your 20-page Harvard business case study summarizing the current state of the organization and the backgrounds of all of the leaders and the different departments and divisions and so on. It would be nice, but that's usually something that we've got to kind of figure out on our own. A lot of times, you know, and this is not a bad question, but sometimes in security, we say, hey, well, why don't we ask our business leaders, so what keeps you up at night? Well, that's not really, you know, that's not a bad question, but in my opinion, that's not an ideal question. Maybe a slightly better version of that would be asking something like, so, you know, what are the most important business processes in the organization? Because then, you know, you could use that to determine, well, where is the cyber risk within the organization? And that will give you some insight into, as you said correctly, the larger business context of why something is actually going on. And this isn't even for a public company. What the senior executives of a public company say is not actually what the moat of the company is, what the crown jewels actually are. Because, well, senior executives, they don't want to advertise to the world necessarily what those crown jewels are in a lot of cases. So this is something that we've got to go ahead and figure out and decipher. And that's what makes the job of the CISO a little bit challenging. Jennifer, hopefully that kind of. That was awesome. And actually, and I want to just reframe something you said, which is awesome, which is when you ask them what keeps them up at night, they may not even know about security risks, since that's your job. But you know how to frame those in the broader, as you said, ask them what are the broader goals of the organization, et cetera, and then trying to kind of pull that through. But pull that through and then you interpret it into your organization. So that was great. Thank you. Thanks, Jennifer. Thanks for contributing to the conversation. Good to see you on LinkedIn. LinkedIn audio. Wow. We joined LinkedIn. What is going on? All right. We've got about 20 more minutes left. Eric, thanks for joining us this evening. Anything you want to ask, Frank? Thank you very much. I hope you guys can hear me okay. Eric, thanks for joining us this evening. Anything you want to ask for? I'm just messing with you, Eric. Yeah, I can hear you loud and quiet. Oh, Jesus. Look at it. All right. Well, Frank and Russell, very, very great conversation that we've had here. Thank you, Tomas, for scheduling this. This has been really good. I just wanted to pull a little bit on a couple of threads. One of the ones that Derek mentioned here. But what I want to know from your perspective is I see a lot of companies out there putting this concept of hiring a VC. So or a virtual CISO versus having an actual CISO, especially during that formative time on a company. What's your perspective on that? Yeah. You know, I would say that it. Well, you mentioned the key word there, formative time. And usually if it's an earlier stage company, if it's a smaller organization, you know, they might not want to dedicate resources to one full-time person. So I definitely think it helps in that particular case. Now, there's a catch, though. You know, and just like any time I might have had a MSSP, a managed service provider or a vendor doing something, you know, there always had to be somebody that was overseeing that relationship to make sure that that MSSP or the vendor was continuing on a regular basis to do the things that they actually needed to do. So as a VC, so if you're, you know, for example, going and joining an organization as the VC, so, you know, we got to look at it from two perspectives is one, who's the main point of contact at the company? What are the resources that you're going to have to actually get the job done? But also then from, you know, your perspective, what's the scope of that engagement? And it's not just about, oh, you're a, you know, quarter time, you're a half time person. It's what are the key outcomes that are going to be necessary? And so, yeah, definitely from the company, the business perspective, you know, I could see why it makes sense. But sometimes, depending on the growth trajectory, it might very well quickly lead to needing somebody to be more full time. I have also seen, you know, people that are kind of part time VC, so. And it's exactly what I was saying is that sometimes it kind of turns into a, well, the scope, right? The scope of the kind of engagement and responsibility is not necessarily well understood or well defined. So it could be a little bit tricky. Now, I will say having lead socks and having to respond to various incidents in the past, I personally, you know, shy away from and don't take kind of incident response type of role. So, hey, sometimes I've had people approach me and say, hey, Frank, we'd like you to be the VC. So, and that also includes if we have an incident, you're going to get called in the middle of the night. And in a nice consultative way, I declined those particular engagements. Yeah. Yeah, that's my career has been both being a CISO and a VC. So, and you nailed it right there with that description. The second question I have here is maybe Russell can discuss this. You guys mentioned the reporting chain of a CISO. And the question for the ages is, you know, you mentioned the CTO reporting chain, but the other chain that we see, you know, in certain areas is that it reports to the CFO. What's your thoughts on that? Yeah, you know, I really think about it, you know, everything from a leadership or management perspective is kind of pros and cons. Unlike technical work, it's not necessarily black and white. Right. Now, you know, I will kind of maybe call out Russell here. I do remember at some point, Russell, I'm not sure if you remember this because it was just a casual conversation. At one point, Russell, you had said to me in not in an emotional way or anything, again, just in casual conversation that you would never report to the CIO. Now, at one point you were the CIO. And because there's a natural conflict, right, the vast majority of reporting relationships, the CISO still across industry reports to the CIO. And now there are pros, though, with that, because if you're in a organization that has less mature IT, hey, we can only mature security as in a way that is aligned with how mature IT is. So if you're less mature IT, well, it's going to be hard for you to mature your security capabilities. I think that's one reason why security commonly reports rolls up to the CIO because of that alignment of technology. That's definitely a pro. But as we know, the con is, well, we've got corresponding conflicts of incentives, like we see most commonly in vulnerability management. Well, the IT team wants to maintain stability, doesn't want to patch. The security team wants to push forward various mitigations and patches. There's a natural conflict. And we've all known and seen those situations where the CIO might be the one presenting to the board, but the message gets lost a little bit in translation. It might not be exactly what the CISO was intending to be conveyed. Now, when you report to the CFO, the CFO, to your question, Eric, tends to be a little bit more of a, depending on the size of the organization, in large organizations, the CIO is definitely also a business executive, not a technologist. But the CFO also, by definition, in all cases, is a business leader, is a business executive. And so they are going to be more focused on, well, what is the business performance? Well, in some cases, at a large organization, they'll also be the ones, as we know, that are focused primarily on various forms of compliance. So that might, depending on the situation, again, this is what we have to decipher, might mean that, hey, we turn into needing to do things a little bit more from a compliance perspective. But I would try to use that report, leverage that reporting relationship to gain a little bit more insight into the noncompliance activities that the CFO is familiar with and involved with as well. So, Eric, hopefully that answers your question. Yeah, and then, of course, you have the other thing that I don't hear very many people, or I hear some people discussing this. But a CISO starts with a C. You know, so the C stands for chief. So why are they not at the same level reporting as the other C positions, as the other SWE SWE? Great question. Great question. You know, and if we look back across history, you know, two, three decades ago, the CIO was actually in a similar spot, was a C in their title, but was not considered a equivalent level C level executive. And, you know, to be honest, I really think that the reason for that today with CISOs is, and if we look towards ourselves first, right, we look to ourselves first before we, you know, criticize others, is I think that the vast majority of CISOs, we don't understand the business. And until we understand the business, really, what those crown jewels are, what those key business processes are, what the corresponding cyber risk is, if we don't understand financial statements, if we don't understand the strategic goals of the organization, how could we hope to have a conversation with the CEO, the CFO, the COO? Because that's all they think about. And I've had, you know, I've been in IT the vast majority of my career. And now when I'm working with IT folks that are just focused on IT and, you know, from a business perspective, you know, even though I'm a technologist, they're giving excuses of why something can't be done. Well, we don't want excuses. We want options. And really, I think that the CISOs, many CISOs still today, don't have that seat at the table because, well, bluntly speaking, we're not business executives. Now, we can be, but it means we've got to learn a lot more about the business, the finances, the strategic objectives, and not just think about it from a technology and security perspective. Right. And last point, I was going to add something to what Jennifer was saying earlier. So my current role is a combination of what we just finished talking about plus the business side of the house. I'm actually called Abuso. I'm a business unit security officer. So I'm kind of the middleman between the security organization, the business organization, to the leadership. So that's a new concept that I've seen. And I'm six months into this role. And it's been saying almost everything that what you just said is, you know, being the business view, looking at the business risk. And it's a really interesting concept that my current company uses. So for each one of the major divisions, there's Abuso that reports to the CISO. That's great. Congratulations on the relatively recent role. That's awesome. Yeah. Thank you. All right. And I'm just going to step out, Mr. Tomas. No. Thanks, Eric. Thanks for contributing to the conversation this evening. And yet another reason why I think the certification of being a CISO is interesting because the CISO role is still being changed. Every industry and every opportunity. So good stuff. I'm going to self-promote real quick, Tomas, if you don't mind. No, I'm just going to promote it. No, I'm just going to promote it. No, I'm just going to go ahead. Go ahead, Eric. Because it's SANS. I just got nominated for the Mentor of the Year for SANS as well as the Diversity Champion. So go to my profile. Vote for me. Hopefully, I'll make the SANS Difference Maker Award this year. There you go. Good luck, Eric. Good luck to you. Cody, thanks for joining us this evening. Anything you want to ask Frank? Hey, sure. Sure. Thanks again. This is very cool. I joined late, but very cool and a great conversation. Going off the last question about CISOs reporting through CIOs, are you seeing any, in an age of shrinking budgets and budgets being constrained, do you see any conflicts with CISOs or CIOs knocking down CISO budgets in favor of their own agenda items? So thought of it from another interest of conflict on that side. You know, that's always a constant negotiation, I've found. And, you know, even beyond kind of the current macroeconomic conditions, you know, I've had situations where, you know, I'll get a $10 million increase in budget. But, you know, I don't get that $10 million all at once, right? They say, well, hey, we're going to give it to you in tranches. You know, hey, you have the plan. You put forward this plan. We all like and approve the plan. But that means then, hey, well, we're going to give you the tranche to get you through the first quarter. And then, hey, if you meet your metrics and goals, then, hey, we'll give you the tranche for the second quarter. And so that goes on for about a year. And then usually what happens is, to your point, hey, there might be a change in priorities or there might be a change in budget or the macro conditions. And as a result, we get to quarter five and they say, hey, you know, that budget that we had previously said we were going to give you, we can't give that to you anymore. So then you've got to try to figure out how to adjust scope, given that new reality. I don't know how many times over the years I've had to go through something similar. So, yeah, I think, you know, unfortunately, yeah, Cody, it sounds like you've gone through that. And, you know, unfortunately, we've got to go, you know, deal with that on a regular basis. And it's kind of, you know, our job, that's right, right, as senior leaders is to not implement the controls. It's to, you know, navigate these different hurdles as they arise on a regular basis. Absolutely. Thank you. Appreciate that. Thanks, Cody. Thanks for joining in the conversation, asking your question. If anybody else has in the audience has a question for Frank before we start to wrap up, feel free to raise your hand and we will bring you up on stage so you can ask your question live. If you want to put it in the chat, well, the chat is if you just click on the event page, you can put it in the event page on the comments and I'll read it off if you for some whatever reason you can't talk live. Russell, Lisa, any final questions you want to ask, Frank, before I kind of get to the typical last question? Well, I just wanted to say, Frank, thank you for giving so generously of your time tonight. I mean, between hearing about your dad's book and how you've cultivated growth mindsets and some of the, you know, current debate around what type of background you should have and what skills you need. I've had just an incredible time listening to all your perspectives. So I just wanted to say thank you. You're too kind. Thank you so much, Lisa Beth. Appreciate it. And I'm going to say, man, I don't even know what I say half the time, but Frank, your memory is like a trap. I do. When you called me out on that, I said I would never work for a CIO. And then ironically, when I was at the Fed, they appointed me as CIO. But I'll tell you the statement that I used a lot and it was just as much for me as it was for those I was privileged to lead is I would say, hey, it's the security guy who's leading IT instead of the other way around. And it made me feel better. But I don't know if I was a really good CIO or not. But it was interesting to kind of live in that world and kind of be a part of the executive table like what you mentioned there earlier, Frank. And again, I can't thank you enough for all you've done for me in my career as well as what Lisa Beth said the last hour and a half spent with us. We're just all grateful and appreciate that. Hey, thank you, Russell. It's been great knowing you all these years and working with you. So, yeah, appreciate, you know, having you as a friend and appreciate all of you guys, Lisa Beth, Russell and Tomas for keeping this forum going on a regular basis for people to share and contribute to the conversation. Yeah, no, absolutely. Absolutely. It's hard to believe we've been doing this for, wow, so many weeks in a row. We've had so many great guests. And so, you know, you definitely continue the streak of great guests. So just before I get to the last question, hang on, is somebody asking to come up on stage? Let's see who it is. Tom, let's bring Tom up on stage. Go ahead, Tom. Hey, Tom, go ahead. Tom, Ryan. Yeah, I accidentally raised my hand. I really don't have questions at the moment. All right. No worries, Tom. No worries. We're getting you to your lovely new platform. There you go. There you go. So what was I saying? Oh, I lost my train of thought there for a second. But just very quickly before we sort of get to final minutes, just want to make a very quick announcement. Again, we'll be back here. As I mentioned before, we do this every single Wednesday. Start up around 8 p.m. Eastern time. And next week, if you are so kind to join us back next week, we will be joined by another person from SANS, Lance Spitzner. Hopefully, yeah, Spitzner. Hopefully I said that right. If you've never heard the name before, feel free to join us back next week and learn more about Lance. But he's definitely a name that I've seen on several emails that I receive and different blog posts and the like. So definitely somebody in the industry that you might want to follow us in addition to Frank and Russell, if you don't already follow them. So Frank, this question that I like asking is a reflection question. So if you have one piece of advice for the younger Frank, given everything that you've learned in your career so far, if you have one piece of advice for the younger Frank, what would it be and why? And you guys like the hard questions, huh? Yeah. So that is a good one. One piece of advice for the younger Frank. You know, I'm going to, you know, I'm going to cop out a little bit here because it makes me think, you know, I've mentioned this several times over the years to different people. But, you know, many of us maybe I think we've seen the Steve Jobs Stanford keynote commencement address, which, you know, I think is probably the best commencement address I've seen. And, you know, he says in there that, hey, you can only connect the dots looking backward. You can't connect the dots looking forward. So, you know, I would say, hey, make the make the most of your time. And especially after having kids, I realized how much free time I actually had before. And really just try to make the most of your time. Enjoy it. You know, hey, did I really need to watch all of those? I think it was seven seasons of Sex and the City back then. Now, hey, I enjoyed it and it was nice watching it with my wife. But, you know, sometimes I think, oh, well, you know, maybe I could have spent my time doing something else. But, hey, make sure you balance that things that you enjoy. But, yeah, try to make the most of your time and enjoy it the most with your friends, your family, with your colleagues, those around you. That would probably be my advice that it's not just about the work, even though, you know, I was kind of hinting at that just now. But you make the most of your time and make sure that you focus on things that you enjoy. Yeah, you know, that's a great reminder and a great piece of advice, Frank. You know, if there's anything that we've learned over the past two plus years or so living through a pandemic is that, you know, life is not guaranteed. Right. And our days are not guaranteed. So, you know, making the most of our time is probably the best piece of advice that we could keep reminding ourselves to do. So I'm glad you made the best use of your time by joining in this evening and listening to Frank share his words of wisdom, share his origin story and share his overall journey. I hope you all have a great rest of your week. I hope you, you know, accomplish everything that you're looking to accomplish as you get through towards the end of the week and you spend a lot of quality time with your with your loved ones and take care of your mental health. So with that, Frank, I'll leave you with the final words to bring us home. No, hey, just again, thank you, Tomas, Lisabeth, Russell, for having me on. Appreciate you hosting this show on a regular basis. Thanks, everybody, for taking the time out. Looking forward to staying connected and maybe seeing you in real life sometime in the future. Thanks so much, everybody. Thank you. Thanks, everybody. Cheers. Have a good evening. Bye. Bye, everyone. That's what I was waiting for, Lisabeth.