Fireside Chat w/Jeff Hudesman, CISO @ Pinwheel

[00:00:00] Hello and welcome to our weekly fireside chat. Thank you for listening to the replay. [00:00:08] This evening we have Jess Hutzman joining us with the CISO at Pinwheel. [00:00:14] Hope you enjoyed the replay. [00:00:20] Hey Phil. [00:00:23] Hope you made it back safely. [00:00:26] It was great seeing you. Was that last week or two weeks ago? I can't remember right now. [00:00:33] If you just joined us, we will get started in about five minutes or so. [00:00:38] We will get started about five minutes or so. Thank you for tuning in. [00:00:42] Should be an interesting conversation this evening. [00:00:45] So let's get this room set up and get it warmed up and ready for our guest. [00:00:52] Katie. Hey Katie. [00:00:54] Hi. [00:00:56] Hello. [00:00:57] Happy Wednesday. [00:00:59] Happy Wednesday indeed. [00:01:01] Let me get this room set up real quick. [00:01:06] How are you Katie? [00:01:07] I'm good. I had a thing that just happened that I think you might appreciate. [00:01:11] I was talking to my son. I'm like, yeah, bears are on tonight. [00:01:14] He's like, no mom, it's Thursday. [00:01:17] Thursday. [00:01:19] That's right. [00:01:21] That's right. [00:01:22] You're day early. [00:01:23] It's day early. [00:01:24] Yeah. [00:01:26] How are the bears going to see you? [00:01:27] Well, I'm excited because they're debuting their full orange ensemble this week. [00:01:32] Oh, nice. [00:01:33] Which I'm excited about. [00:01:34] I like the fashion as well as the game. [00:01:39] That's awesome. [00:01:42] It doesn't matter what their record is. [00:01:44] They will be dressed nice doing it. [00:01:46] Listen, it's a young team. [00:01:48] Just like as we build teams in cyber, not terrible. [00:01:52] People, you know, eager. [00:01:54] It's a little less experience. [00:01:57] But a bright future, not terrible. [00:02:00] So it sounds like they haven't won a game this season. [00:02:02] Is that what you're telling me? [00:02:03] No, they have. [00:02:04] They have. [00:02:05] I was actually at, they beat the 49ers unexpectedly. [00:02:08] At that game with all the rain, if you remember. [00:02:12] Yeah, yeah. [00:02:13] I think I do actually. [00:02:14] I think they were showing replays of the players sliding. [00:02:17] Boring. [00:02:18] Yeah. [00:02:21] Jeff, quick microphone check for you, my friend. [00:02:24] Hey, Tomas, how you doing? [00:02:25] Can you hear me okay? [00:02:27] I can hear you loud and clear. [00:02:28] I can hear you loud and clear. [00:02:29] We're just going to get the room warmed up and ready for you. [00:02:32] So we'll get started in about three minutes or so. [00:02:36] Sounds great. [00:02:38] Let me just add some topics on this. [00:02:42] I think we'll do some networking. [00:02:44] So let's get to network. [00:02:45] Hey, Jeff. [00:02:46] I like your picture. [00:02:48] Oh, thank you. [00:02:49] Where are you in that picture? [00:02:52] So I am in a restaurant, formerly called Little Frog, [00:02:55] in the Upper East Side of Manhattan. [00:02:57] Nice French restaurant. [00:02:59] And yeah, it's got some nice decor there. [00:03:02] So definitely a nice spot. [00:03:04] Where are you located? [00:03:05] I'm in Chicago. [00:03:06] I am going to be in New York in a couple of weeks, Bill. [00:03:09] So you're in New York? [00:03:11] I am. [00:03:12] Yeah, I'm in Manhattan. [00:03:14] I'm going to be in Manhattan. [00:03:15] Okay. [00:03:16] Yeah, I'm going to be in Manhattan specifically, actually. [00:03:17] Very nice. [00:03:18] Katie, you will be in my backyard. [00:03:20] I was going to send you a note. [00:03:23] Yes, absolutely. [00:03:24] Although I may be across the town in Europe. [00:03:29] But yeah, definitely something. [00:03:30] Let me know what dates you're here now. [00:03:32] Try to sync up. [00:03:33] Will do. [00:03:34] Will do. [00:03:35] Um, all right. [00:03:37] I'm missing a topic. [00:03:39] Well, let's give me another topic. [00:03:41] There's a networking mentorship. [00:03:43] Let's do some. [00:03:46] Let's see. [00:03:47] Put something controversial. [00:03:49] Maybe put the word controversial topic. [00:03:53] Let's see what pops up when we do that. [00:03:58] Nothing pops up. [00:04:00] And usually that attracts a crowd. [00:04:05] Fairy tales? [00:04:06] Fairy tales. [00:04:07] Fairy tales. [00:04:08] How about that? [00:04:09] All right. [00:04:10] Let's do fairy tales. [00:04:14] Okay. [00:04:15] Anil, a quick microphone check for you, Anil. [00:04:17] Howdy, howdy. [00:04:20] There it is. [00:04:21] All right. [00:04:22] Look, why don't we get to some of the logistics. [00:04:26] Get that out of the way. [00:04:27] I want to take, first and foremost, thank you, everybody, for, uh, [00:04:30] tuning in and joining us. [00:04:31] Uh, this is our weekly fireside chat. [00:04:33] Uh, if it's the first time you've joined us, uh, we do this every single [00:04:37] Wednesday at around 8 PM Eastern time. [00:04:39] We go for about an hour and a half or so. [00:04:41] Uh, we'll, we will ask our guests questions for about 30 to 40 minutes, [00:04:45] and then we will open it up for the audience to raise your hand, uh, [00:04:48] jump up on stage and ask a question of our guests. [00:04:52] So in this case, we have Jess Hutzman. [00:04:55] Jeff, uh, hopefully I pronounced your last name correctly. [00:04:57] Yeah, that's perfect. [00:04:59] Okay. [00:05:00] Sounds good. [00:05:01] Who's the CISO at pinwheel. [00:05:02] So we'll get to you, Jeff, in a, in a little bit, but, um, just want to, again, [00:05:07] just round out some of the logistics. [00:05:08] Uh, please keep in mind that our comments and opinions are our own for the most part [00:05:13] and do not represent our current or prior employer, at least for the majority of us on the stage. [00:05:18] Um, obviously this is being recorded and you can feel free to sort of take the snapshots [00:05:24] or whatever these things are called. [00:05:26] I think they're called clips and share those things along your social media. [00:05:30] If you choose to do so, if you find something or hear something that's been said that, uh, resonates with you. [00:05:35] Uh, but if you are in the audience and you are a sort of reporter and you want to quote us, uh, we ask that you please just be mindful of, and we, sorry, be respectful of our opinions and, uh, just connect with us offline and ask us if it's okay. [00:05:48] Um, without further ado, it is Wednesday. [00:05:51] It is the middle of the week. [00:05:52] Uh, let's have fun. [00:05:54] Let's have a good time. [00:05:55] Let's really have a, uh, let's use this as an opportunity to get to know our guests a little bit more on an intimate level, get to learn about them and their origin story. [00:06:04] Uh, so if you are a vendor in the audience and you do want to sell us on your latest and greatest product, while we do appreciate vendors, uh, because without security vendors or vendors in general, you know, we wouldn't have anything to purchase. [00:06:17] And using our companies to help keep us going and make us more efficient, but this is not the time nor the place. [00:06:23] Uh, so we ask that you please refrain from selling us on your latest and greatest solution and use this as an opportunity to really grow, uh, your own self, as well as, uh, help us grow as a community, uh, from that sort of mentorship, that networking and that particular, uh, perspective. [00:06:40] So without further ado, I'm just going to go quickly around the room. [00:06:43] Jeff, I'll leave you for last. [00:06:44] So I am Tomas Maldonado. [00:06:46] I am the CISO at the National Football League. [00:06:49] Katie, over to you. [00:06:50] Katie Hanahan. [00:06:51] Hi, good evening. [00:06:52] I'm Katie Hanahan. [00:06:53] I am the vice president of cybersecurity strategy for a boutique SI out of Chicago. [00:06:58] I also run RV CISO program. [00:07:00] So serve as a CISO as well. [00:07:02] Over to you, Anil. [00:07:03] Thanks, Katie. [00:07:05] Uh, Anil Varghese, uh, serve as a virtual CISO for our firm here in the U.S. [00:07:09] and one out of the U.K. [00:07:10] Also the coauthor of the CISO mentor. [00:07:13] On to you, Russell. [00:07:16] Thanks so much, Anil. [00:07:17] Always amazing to be here. [00:07:18] I tell you, if you've not put this on your calendar every Wednesday, 8 p.m. [00:07:22] Love to have you here. [00:07:23] Russell Eubanks been in cyber for a very long time. [00:07:26] Former CISO of the Atlanta Fed. [00:07:28] Last couple of years been leading my own company, Security Ever After, where I help cyber security professionals get promoted. [00:07:35] Over to you, Tomas. [00:07:38] That was good. [00:07:39] Thank you, team. [00:07:40] It's great to hear your voices. [00:07:42] You know, I was traveling last week and I was intimately on and couldn't really participate. [00:07:47] So I apologize for that, but it's great to hear your voices and be back on our fireside chat. [00:07:54] So look, we're joined by Jeff Hutzman today. [00:07:57] And he is, as I mentioned earlier, he is a CISO at Pinwheel. [00:08:01] Jeff, what I usually, how we usually like to start these things off is, you know, why don't you introduce yourself to us and to the sort of community at large that are listening in? [00:08:12] And while you're going through that sort of introduction, why don't you take, you know, as much time as you want to tell us about you and your origin story? [00:08:19] Sure. [00:08:21] You know, it sounds fantastic. [00:08:23] Thank you so much for having me on, Tomas. [00:08:24] I think it's such an amazing program with some of your previous guests, as Sam said. [00:08:29] So I'm really excited to be here. [00:08:31] And yeah, in terms of the origin story, just to get a couple of fun things out of the way, I actually just returned from Bora Bora for my honeymoon. [00:08:40] I was just married a few months ago. [00:08:42] So that was super exciting. [00:08:44] Unfortunately, my wife contracted COVID for June wedding. [00:08:48] So we had to postpone the honeymoon a few months, but totally worth it. [00:08:54] An unbelievable trip. [00:08:55] And again, I'd love to say I had a little break from work, but as a security professional, you know, there is no real break from work. [00:09:02] So it was a blast and a really, really cool trip. [00:09:06] And yeah, back to the origin story. [00:09:10] So I've been in security for, I think it's about 13 years now. [00:09:15] I majored in computer science in college. [00:09:20] Didn't know I wanted to do security then, but I knew it was interesting. [00:09:23] I remember starting to read blogs and articles that really resonated with me. [00:09:29] It just seemed like the internet was really becoming the wild, wild west. [00:09:34] Not quite the wild west of like the phone freaking days, which I'm sure were just absolutely insane. [00:09:39] It's something I didn't really personally get to experience. [00:09:41] But I do, you know, read the books of, you know, Kevin Mitnick and a lot of those other former black hats that have interesting stories. [00:09:49] So my first job was at one of the largest cancer hospitals in the world in New York City doing IT. [00:09:59] And there was a very small security function. [00:10:03] And I volunteered. [00:10:05] This sounded really interesting just beyond doing like Cisco networking, which was interesting in its own right. [00:10:12] But I wanted to do something a little more involved and maybe academic, say. [00:10:18] And started doing InfoSec for the hospital. [00:10:22] And it was just really just opened my eyes to just what my career is going to become in the subsequent years. [00:10:29] It was just, you know, just the, there was no textbook. [00:10:33] I mean, this is not like the beginning of the security days. [00:10:36] This goes back, but like 2008, so really not that long ago, but it still was at a point where like there was no like CISO. [00:10:42] I don't think, I mean, like Gary Hayslip and a bunch of folks have those like CISO handbooks. [00:10:47] Those books were out at that time. [00:10:49] But I just do remember just telling my friends when I was describing what I did, I was like, there's no textbook here. [00:10:54] We, there are risks and we need to support the organization to block as much risk as we can and articulate risks to executive leadership. [00:11:05] And it's really just, you got to learn along the way. [00:11:08] And mentors were very important, but there really were no mentors I had in the beginning that really had all the answers. [00:11:16] So I really just had to really just do a ton of networking. [00:11:20] And I really learned a ton in my years in healthcare. [00:11:25] Healthcare is an interesting place. [00:11:26] And I mean, from what I read and from what I speak to other cyber executives, healthcare is still a bit of the wild west. [00:11:33] Just with legacy operating systems and tragic ransomware attacks that have impact on, on patient care, which is, which is horrendous. [00:11:43] But just really opened my eyes to such small things that can happen and the tremendous impacts that they could have. [00:11:51] So for example, a physician having a, you know, external hard drive, which was a lot more common back, you know, a little over 10 years ago, tons of patient data, like that, those kinds of things are not something that your traditional scanners or port scanners or other types of discovery technologies going to locate, but it just, it introduces a tremendous amount of risk. [00:12:14] So just learning about like what policy prevents, what technical controls prevents and, you know, process controls and things like that were, was really the beginning of my security career. [00:12:26] And then from there, I jumped to a media organization, doing Infosec and running their incident response program, which was really exciting. [00:12:39] And then going to consulting. [00:12:44] And I think that was really a great experience. [00:12:45] Just speaking in front of boardrooms, speaking with people that had in front of like folks that had like 20 years experience that had like C at the beginning of their titles. [00:12:54] And I'm just this like 24 year old kid, like hoping that I don't like say something silly. [00:12:58] It was really just a great experience to be able to translate all of that security knowledge garnered from the aforementioned job at the hospital to solving these large businesses. [00:13:08] And then from there I really, I went to Sony, which I'm sure all the folks in this fall know that Sony's had its share of security issues. [00:13:20] We'll say. [00:13:21] Fortunately, I wasn't with those specific operating companies, but I was actually working for a manufacturing and distribution operating company at Sony called Sony DABC. [00:13:34] We actually manufactured DVD CDs and the Blu-ray discs globally. [00:13:41] And that really introduced a lot of interesting security problems, things that I haven't really seen before in terms of like supply chain and just different threats and what kinds of risks that need to be accepted. [00:13:53] And the whole physical security component came to play for me there. [00:13:58] So that was really just a fascinating role. [00:14:02] And I was really fortunate because I was like 29 at the time and to be like a quote unquote, like director of securities, like a pseudo CISO, I guess for a Sony operating company was really cool. [00:14:14] It was definitely you get that taste of imposter syndrome. [00:14:17] You know, like, am I ready for this? [00:14:19] But I was, I mean, if I didn't know the answer, I knew the, I knew people to reach out to, to get some ideas from and work with our leadership and work with my peers to really bolster that organization. [00:14:31] I'm really proud of what was accomplished there. [00:14:34] And then pressing forward, after, you know, my tenure there, which was for about five years, I pivoted over to FinTech to where I am currently. [00:14:48] My first FinTech company was a company called DailyPay, which is an earned wage access company. [00:14:56] That's so for example, you have folks that are getting paid, you know, biweekly, let's say they're working at like a large retail provider or something like that. [00:15:07] But they need money for gas now. [00:15:09] And they've earned, you know, three, four days of pay. [00:15:13] Why can't they just go and log into a portal and withdraw and be able to make those purchases? [00:15:19] So it was, it was definitely a really great solution where many folks in those positions would have to resort to predatory payday loans and other things that really are not very good for their financial health. [00:15:34] So, you know, it was a B2B2C FinTech. [00:15:39] So that obviously introduced a ton of risk. [00:15:42] I mean, you had just a ton of, you know, we have accounts. [00:15:45] I mean, like, how do you, how do you allow the good guys, the folks needing services that need to use our platform and make it so it's not super, really heavy amount of friction, but also make sure that like these sophisticated actors, you know, can get in. [00:16:03] It's like, you know, it's, it's obviously not the easiest problem to solve. [00:16:07] I think we did a really amazing job of solving it or tackling it. [00:16:12] And I was at DailyPay for about two years. [00:16:15] And now I'm at Pinwheel, which is another FinTech. [00:16:18] DailyPay grew tremendously. [00:16:20] It is something I would love to talk about later on. [00:16:23] It's just doing cybersecurity and information security at startups. [00:16:27] I think it's just the most fun I've really ever had in a professional setting. [00:16:34] You know, you have, it's a great experience. [00:16:37] I think for younger folks to be able to experience like what I experienced at Sony and the aforementioned hospital, but a startup is just, you know, it's just chaos. [00:16:46] And you're trying to build a product, get that product market fit and really just show investors that, you know, you're, you're building this company in a robust, robust manner. [00:16:56] How do you also enjoy, like, wait a second, we're gonna have to throw a few of these barriers in to make sure that, you know, we, we protect ourselves from a cyber standpoint. [00:17:06] Um, so that's always, always a challenge. [00:17:09] Um, so Pinwheel was actually a, a bit smaller. [00:17:12] DailyPay grew. [00:17:13] I think I was probably the 90th and 80th employee. [00:17:16] And we grew up to like a thousand employees. [00:17:19] Um, Pinwheel, I was maybe employee number 40. [00:17:23] And now we have about a little over a hundred employees and still growing. [00:17:28] Um, and Pinwheel is, uh, essentially a platform where we, um, provide access to payroll platforms. [00:17:36] So for Neo banks, um, that means you can capture users direct deposit, uh, in seconds, uh, to get them over. [00:17:44] And if you're a lender, you can retrieve income and employment data directly from a user's payroll platform to, you know, underwrite loans and make. [00:17:52] Um, you know, different decisions based on things, other than just the credit score. [00:17:57] Um, it's a really fun environment. [00:18:01] Um, and I'm just like really happy with, you know, the way things are going there. [00:18:07] Um, and that's essentially my, uh, you know, elevator story about the, uh, my origin. [00:18:15] Um, but I'd love to answer any questions or dive deeper on any, anything that doesn't interest. [00:18:23] Sounds good. [00:18:24] I'll pass it over to you, Katie. [00:18:26] Yeah. [00:18:27] Uh, yeah, no, really appreciate that. [00:18:29] Um, you know, professional origin story and kind of can imagine, you know, what that felt like being a 24 year old standing in front of executives and thinking, huh, how did I get here? [00:18:40] Um, but that leads me to kind of that question of, you also mentioned you love startups. [00:18:44] You love, um, the ride of that, um, type of environment. [00:18:47] And by the way, so do I. [00:18:49] So always curious about, I mean, you even use the word chaos and you love the chaos. [00:18:53] So I would love to know a little bit more of what is it that brought you to a point in your life that you are so, you know, confident and actually eager, um, to embrace the chaos of something like that. [00:19:05] But what are, what, what are the, you know, examples from your, uh, whether it's, you know, where you came from, what you read as a child, anything. [00:19:13] Um, always curious about how someone ends up, you know, loving chaos and working in a startup. [00:19:18] Sure. [00:19:19] I mean, this might just be from like, just watching films and reading books about kind of just like the startup life. [00:19:25] But, um, yeah, it just seems like, you know, just all of that, just innovation and folks getting together and how do we solve this problem? [00:19:34] There's no, not the same working at large enterprise established fortune companies is not exciting in its own right. [00:19:42] But this was just like, okay, like we're solving something that's never been done before. [00:19:46] And on top of that, we need to secure it. [00:19:48] Um, I just thought it was super exciting. [00:19:50] Not having any real, uh, procedures or policies and things when you walk in the door. [00:19:56] So you're just, you're, you have so much stuff to do. [00:19:59] Um, and it was just, you know, really, really excited. [00:20:03] I didn't know before I signed on exactly what I was getting myself into. [00:20:09] I think there was also a little bit of financial interest. [00:20:11] And I think at that point in my life, which actually wasn't that long ago, this feels about to be three, four years ago. [00:20:17] You know, the whole concept of equity, the company that, um, you know, it's private, obviously. [00:20:22] So initially it's illiquid, but to be a part of something and to help build it, uh, to something that hopefully, you know, IPOs or gets acquired, like, uh, like figment did for $20 billion. [00:20:34] Uh, would be, you know, obviously a really, uh, exciting and, and worthwhile endeavor. [00:20:40] Um, but yet to the chaos, I think you really, it really requires a strong personality because you're going to need to step into these meetings and like really show force and say like, listen, we have to do this a certain way. [00:20:54] Or we're really going to open ourselves to a tremendous risk because you have like these cavalier engineers that just want to like, Oh wait, I can do this really quick. [00:21:03] And I'm just going to like, you know, push this for production. [00:21:05] Like, you know, like, I mean, that's, that's really, really early stage. [00:21:08] And fortunately the two startups that I've worked at, they really valued, uh, security. [00:21:14] And that's why they made the hire. [00:21:15] It wasn't just one of those, like, let's hire a CISO to just like, say we have a CISO and then we can put a space everywhere and look, we care. [00:21:23] Um, it was more of like, how do we do things the right way? [00:21:26] So maybe chaos wasn't the right word for my specific example, but there is that definitely that, you know, that feeling of, um, I really need to make sure that I network well in the way. [00:21:37] I network well within these companies to make sure that they know who to reach out to and, and build these processes where we can do things responsibly. [00:21:45] Yeah, no. [00:21:46] And I wasn't calling you out on, on the word at all. [00:21:50] It was more like just really interested in less of what's happening now. [00:21:55] And kind of thinking about, you know, why do you care about equity? [00:21:59] Why do you care about this company? [00:22:00] Why do you care about FinTech? [00:22:01] Why do you, why do you want this? [00:22:03] So what is it about you? [00:22:05] Where do you, where do you come from? [00:22:06] I know you live in New York. [00:22:07] You told me earlier, tell me more about that story. [00:22:11] Um, and the reason I'm asking is, you know, a lot of the people who listen to this every single week are either, um, you know, starting out in their career. [00:22:19] Um, they are thinking about cybersecurity. [00:22:21] They're wondering, um, how did this person who's in this role and maybe it's a role that they want. [00:22:27] They want to know more about maybe where, you know, when they're listening, where did you come from? [00:22:33] Is that similar to them? [00:22:34] Can they relate to that? [00:22:35] So that's where I was going with it. [00:22:36] Um, sure. [00:22:37] No, no, no. [00:22:38] Tell us more about that. [00:22:39] Where'd you grow up? [00:22:40] You grew up on a farm. [00:22:41] You grow up, um, like tell us more. [00:22:44] Yeah, sure. [00:22:45] So yeah, I grew up in, uh, the suburbs of Long Island, maybe like, uh, an hour outside North. [00:22:50] New York city. [00:22:51] So New York city definitely, uh, played a major role in my upbringing, just going out with friends and, uh, just socializing out here. [00:22:59] And immediately after college, it's, uh, in Buffalo where I attended for four years, moved out to the city and I've been there for, um, and now it's like 12, 12 years. [00:23:09] And, um, yeah, it definitely has an impact of having, you know, I've lived in the financial district and like wall street and all of that definitely probably had an impact on my. [00:23:19] Decision to get into FinTech. [00:23:21] Um, but I'm just also, I think one of the, um, most important aspects for me for security organization. [00:23:26] And again, this is like, gonna sound kind of like cliche, but, um, like what are the threats? [00:23:36] You know, like when I was working in the factory setting and when I was working with, um, you know, re-release content, like you're making sure that like folks can't get that for your latest content. [00:23:46] You know, before it's been released, but like when you're in FinTech, like you're protecting real dollars and especially with the, with new, um, you know, companies with web three and, um, and cryptocurrency. [00:24:00] It's just, the threat landscape has changed dramatically. [00:24:04] And I just love the fact where like protecting real dollars, um, comes into play and you have to be really, you have to be one step ahead of your adversaries. [00:24:14] Um, you really need to watch them from the latest things they're doing to steal from you and making sure that you don't miss anything, which is obviously a very big challenge. [00:24:24] So that problem solving aspect, um, along with just the financial implications, you know, this isn't like, uh, you know, we're not in a situation where we're like a, uh, JP Morgan's case that can go through some like tremendous breach. [00:24:38] And, you know, it's in the news for like a couple of weeks and obviously everybody forgets about it. [00:24:42] And like that it's all, and like the fine is like pennies to them. [00:24:45] Uh, and it's all good. [00:24:47] Like that's not the case of the FinTech. [00:24:48] I mean, if there's a, a large breach, like that can have door closing implications. [00:24:53] So I do, I really do think FinTech is a way of the future, especially for folks that are, you know, unbanked per se. [00:25:03] Um, and really just to make, uh, things a lot easier and give folks access to the money that they've earned, uh, and also get, get folks, uh, loans and, and financial products. [00:25:15] They might not have been able to get with, uh, you know, their credit score. [00:25:18] Um, so I still think we're, you know, at the way beginning, we're, you know, at the way beginning, we're, you know, [00:25:22] at the way beginning of like the FinTech revolution. [00:25:26] Um, I'm not sure the, the role cryptocurrency is going to play. [00:25:29] I mean, I know it will play, um, a role. [00:25:32] Uh, and I'm, and I'm, I've been a Bitcoiner for a while, morally just from like a hobbyist standpoint. [00:25:37] Um, and I think like the technology is just absolutely unbelievable. [00:25:42] Um, but how it's going to fare in full grand scheme of, uh, like the financial landscape is unclear to me at this time. [00:25:51] Um, but yeah, that's kind of how I found myself in FinTech. [00:25:54] And I just, I think the opportunities are boundless and, um, it's just, uh, it's been a really, it's something where I, I really see myself, uh, doing this foreseeable future. [00:26:06] Um, and yeah, it's just, it's been a wonderful ride. [00:26:10] Well, that's, that's great. [00:26:11] Thanks for, um, a little more color. [00:26:14] I'm going to pass along. [00:26:15] I don't have a lot of mods today, by the way. [00:26:17] Awesome. [00:26:18] Great to see everybody. [00:26:19] I am, uh, so excited to introduce you to Anil. [00:26:22] So I'll pass it over to Anil. [00:26:24] Thanks, Katie. [00:26:27] Jeff, thanks for jumping in the hot seat. [00:26:29] Uh, I think we share a connection from the Sony days, so we can reflect upon that, you know, after, you know, offline. [00:26:38] But, uh, one thing I wanted to inquire was, you know, you've had an opportunity to work across a couple of different industries from healthcare manufacturing. [00:26:47] What are those key things or themes that you've been able to carry forward into your new role? [00:26:53] Non, non-technical, um, if you don't mind sharing. [00:26:56] Yeah. [00:26:57] Yeah, no. [00:26:58] Um, so I think just understanding incentives and understanding kind of what my role is, like who, what am I protecting for? [00:27:12] Am I protecting, um, ourselves from, uh, regulatory issues? [00:27:18] Am I protecting from adversaries? [00:27:20] Am I protecting from, you know, the OCR for like HIPAA violations? [00:27:25] And I think every industry that I've been in has its own group of things to consider. [00:27:33] And I think that's really been something that definitely has commonalities across the industry. [00:27:39] across the industry. [00:27:40] So, you know, in healthcare, you have HIPAA. [00:27:43] And then when it comes to, you know, [00:27:45] a lot of other industries, you have PCI [00:27:47] and then you have like SOC2 and ISO [00:27:50] for the cloud services and just giving reputability [00:27:55] to your service for folks to sign on, [00:27:59] especially large enterprise folks [00:28:01] and Fortune companies to be able to trust you. [00:28:04] So yeah, I think a lot of that was just what are the, [00:28:08] what are the threats, what are the incentives? [00:28:11] And I think learning, starting on healthcare, [00:28:16] I think was beneficial because I just really remember [00:28:20] how just given just the state of healthcare [00:28:25] and how legacy operating systems were a common thing. [00:28:30] And this was a very well-funded hospital as I was at. [00:28:33] And then, and again, when I was in consulting at Deloitte, [00:28:35] subsequent to that, I traveled the country [00:28:38] and saw the state of a lot of these hospitals [00:28:41] and health organizations. [00:28:43] And it really was just defending those machines. [00:28:47] And how do we do that? [00:28:48] How do we can, you know, be able to provide patient care, [00:28:50] but also make sure that these things [00:28:53] aren't gonna get locked up from like a ransomware standpoint [00:28:55] or a confidentiality breach by some ransomware attack. [00:29:00] So yeah, I think just learning kind of how a CISO [00:29:05] or security leader fits into the mold of an organization, [00:29:09] something that I've kind of carried [00:29:10] and really progressively grown as I went [00:29:13] from organization to organization. [00:29:15] Thanks for sharing that job. [00:29:21] On to you, Russell. [00:29:23] Hey, thanks, Anil. [00:29:24] And hey, everybody, thanks for being here. [00:29:26] We love this time. [00:29:27] I've got it on my calendar. [00:29:28] I mentioned it at the opening, [00:29:30] 8 p.m. every Wednesday, [00:29:32] 9.30 p.m. Eastern time. [00:29:35] Love having you here at Fireside Chat. [00:29:38] If you've not already joined the club, [00:29:39] click the Green Monopoly House. [00:29:41] We'd love to have you get notified. [00:29:43] It doesn't cost anything at all. [00:29:44] So you can know when future meetings, [00:29:46] future conversations just like this are happening. [00:29:48] We love all the feedback that we get from others [00:29:51] with respect to the time that we've been spending [00:29:53] for, gosh, close to almost two years now. [00:29:55] We've been doing this and it's just an amazing time [00:29:58] for each and every one of us. [00:29:59] And I tell you, Jeff, thanks so much for being here. [00:30:01] Love the fact that you're here with us. [00:30:03] So I've got a question. [00:30:04] So you've talked about your tenure in different industries, [00:30:08] discrete different industries, [00:30:09] and you've been privileged to work in FinTech, [00:30:12] which you've mentioned, [00:30:13] privileged to work in healthcare, [00:30:14] which you mentioned. [00:30:15] If you were to say to someone, [00:30:17] hey, here's why you should consider [00:30:19] like pros and cons of FinTech versus healthcare. [00:30:21] Love to hear kind of your experience, [00:30:23] what you would give advice to someone who's like, [00:30:25] I'm not sure which area to work in. [00:30:27] What would you say to them? [00:30:29] Yeah, that's a really great question. [00:30:32] I think they both have their, [00:30:33] you know, positives and negatives. [00:30:36] Yeah, as a, [00:30:41] personally, I think in my experience, [00:30:45] I, again, [00:30:45] I really love the fact [00:30:47] when you're protecting real dollars. [00:30:49] But again, [00:30:49] I also really appreciated, [00:30:51] so I come from this background [00:30:52] where I want to do good. [00:30:54] And obviously I'm getting compensated for my work, [00:30:56] but I want to do something that has an impact. [00:30:58] And I think there's really impact for, [00:31:01] you know, [00:31:01] in all of these industries. [00:31:02] But I think healthcare has maybe a special place [00:31:05] for impact, [00:31:06] protecting patients' confidentiality, [00:31:09] ensuring that the most vulnerable [00:31:10] aren't having their records [00:31:12] floating around the internet, [00:31:14] or especially, [00:31:14] you know, [00:31:15] diagnosis that shouldn't be viewed inappropriately, [00:31:19] either externally or internally. [00:31:21] So that, [00:31:23] I think, [00:31:24] is something that I would say [00:31:25] to folks considering different industries. [00:31:27] But again, [00:31:29] again, [00:31:29] in good tech, [00:31:31] protecting real dollars [00:31:33] and just the amount of adversarial interest [00:31:36] in stealing funds [00:31:39] and infiltrating systems, [00:31:41] it's just nothing, [00:31:42] it's like nothing I've seen before. [00:31:44] Again, [00:31:44] I mean, [00:31:44] I haven't been in [00:31:46] the government military space, [00:31:49] so I'm sure there's, [00:31:50] you know, [00:31:51] a lot of that going on there as well, [00:31:53] especially for, [00:31:54] you know, [00:31:55] secrets and whatnot. [00:31:56] But in fintech, [00:31:58] there's absolutely [00:31:59] just tons of, [00:32:02] again, [00:32:02] adversarial interests, [00:32:03] which I find [00:32:04] just absolutely fascinating. [00:32:05] So having to be able to, [00:32:07] you know, [00:32:08] monitor these groups, [00:32:09] see what kind of techniques [00:32:10] they're using [00:32:11] and be a step ahead [00:32:13] and really just constantly, [00:32:15] like I'm a firm believer, [00:32:16] again, [00:32:17] this is kind of tailing off [00:32:18] a little bit for your question, [00:32:19] but just to show my passion [00:32:20] for fintech, [00:32:21] I'm a firm believer [00:32:22] in just really technical, [00:32:24] you know, [00:32:25] red team exercises [00:32:26] and penetration tests [00:32:27] to really just [00:32:29] rip our systems apart [00:32:30] and find potential avenues [00:32:34] for exploitation, [00:32:36] whether that be externally, [00:32:38] but also internally. [00:32:39] I mean, [00:32:39] insider threat [00:32:40] is a big thing too. [00:32:41] You have, [00:32:41] you know, [00:32:42] disgruntled employees, [00:32:44] but you also have folks [00:32:46] that maybe they'll make a mistake. [00:32:48] Maybe they click the phishing email, [00:32:50] like, [00:32:50] I mean, [00:32:50] a lot of the recent [00:32:52] security incidents [00:32:54] we've read in the blogs. [00:32:56] So those types of things [00:32:57] I do not take lightly. [00:33:00] So yeah, [00:33:00] so I think I would just, [00:33:02] you know, [00:33:02] if I was to mentor [00:33:03] or advise somebody [00:33:04] about what industry to go in, [00:33:06] I think like things [00:33:07] that I would like compensation [00:33:08] and those, [00:33:09] those differ between [00:33:09] the industries. [00:33:12] But yeah, [00:33:12] I think just the type of data [00:33:14] you'd be protecting, [00:33:15] maybe some of the internal politics [00:33:17] of how security is valued [00:33:18] throughout the organization. [00:33:21] I think that definitely [00:33:22] plays a role [00:33:23] and what kind of act [00:33:25] and what kind of resources [00:33:27] either you're going to build [00:33:28] or you'll have access to. [00:33:30] Like for example, [00:33:31] a hospital might not have [00:33:33] like a sock [00:33:34] or like, [00:33:35] you know, [00:33:35] threat experts. [00:33:38] But if you go to a big bank, [00:33:39] you're going to have all of that. [00:33:40] You'll have fusion centers [00:33:41] and all the resources [00:33:42] you're really going to need [00:33:43] to combat the threat [00:33:46] and alleviate risk. [00:33:48] So I've been fortunate [00:33:50] to see those types of things, [00:33:53] especially at a Sony [00:33:54] where, [00:33:55] you know, [00:33:55] in the aftermath [00:33:57] of like a very, [00:33:59] very public [00:33:59] Sony Pictures incident, [00:34:02] you know, [00:34:02] the team grew dramatically [00:34:04] and having like a big [00:34:08] sock and global security function. [00:34:11] That was my first exposure [00:34:12] to that. [00:34:13] And I thought [00:34:13] that was really, [00:34:14] really great [00:34:14] as an early security leader, [00:34:17] kind of in my like [00:34:18] director of information [00:34:19] security days [00:34:20] to be able to go [00:34:21] and say, [00:34:21] okay, [00:34:21] so I don't understand [00:34:22] this exact threat. [00:34:24] So I'm going to reach out [00:34:25] to a threat expert [00:34:26] at our global security function. [00:34:27] They can kind of help me [00:34:29] help my organization. [00:34:32] So I think that was really like, [00:34:33] there was a great, [00:34:34] you know, [00:34:34] training wheel, [00:34:35] so to speak, [00:34:36] to be able to then [00:34:37] go to a startup [00:34:37] where I am literally [00:34:39] like the person [00:34:40] along with my, [00:34:41] you know, [00:34:41] small team [00:34:42] to combat threats, [00:34:44] if that makes sense. [00:34:49] Gotcha. [00:34:50] Hey, [00:34:50] I appreciate that insight [00:34:51] and the diverse experiences [00:34:53] that you've had. [00:34:54] I'm going to pass over [00:34:55] to Naveen. [00:34:56] Naveen, [00:34:56] up to you. [00:34:57] Thank you, [00:34:58] Russell. [00:34:58] Jeff, [00:34:59] nice to meet you. [00:34:59] Thank you for joining us tonight. [00:35:01] Likewise. [00:35:01] I'm going to give you [00:35:02] an easy one. [00:35:03] So as security practitioners, [00:35:06] it's hard enough [00:35:07] for us to convince [00:35:08] the engineers [00:35:10] and the product developers [00:35:11] to not go so crazy. [00:35:14] In a startup, [00:35:15] especially a fintech [00:35:16] where you're surrounded [00:35:16] by so much ideas, [00:35:18] energy, [00:35:19] and passion [00:35:19] to get things out, [00:35:21] what are some of the tools [00:35:22] and tips that works for you [00:35:24] to get them to pause [00:35:25] and think about security [00:35:27] and the importance of it [00:35:28] on the backdrop [00:35:29] of, [00:35:29] as you said earlier, [00:35:30] all the chaos [00:35:31] and the urgency [00:35:32] to be great? [00:35:34] Yeah, [00:35:35] that's a phenomenal question. [00:35:36] And that literally [00:35:36] is what my job is. [00:35:38] And I think [00:35:39] that the best way [00:35:40] to do that [00:35:40] is to make sure [00:35:42] that they understand [00:35:43] that we are [00:35:44] on the same team [00:35:45] and not to have [00:35:46] that adversarial relationship [00:35:47] to which I see [00:35:48] is very common. [00:35:50] Like when people [00:35:50] are rolling their eyes [00:35:51] at the security person [00:35:52] is coming around, [00:35:52] that's really not [00:35:53] a good start [00:35:54] to the person's tenure. [00:35:56] So for me, [00:35:57] it's not being [00:35:59] the person of no [00:36:00] obviously [00:36:02] our business [00:36:03] needs to grow [00:36:04] but we need to [00:36:04] grow responsibly. [00:36:06] So really setting [00:36:06] expectations [00:36:07] and being a part [00:36:08] of conversations. [00:36:10] So I've been [00:36:10] sure at the beginning [00:36:11] alongside meeting [00:36:13] all of my executives [00:36:14] and stakeholders, [00:36:15] I want to be a part [00:36:16] of these engineering [00:36:17] conversations. [00:36:18] What are they trying [00:36:18] to do? [00:36:19] What are they trying [00:36:20] to build? [00:36:21] And sometimes [00:36:22] it's like a lot [00:36:23] as everybody [00:36:24] on this clubhouse [00:36:26] I'm sure knows, [00:36:28] it's so much easier [00:36:29] to get good practices [00:36:31] in the beginning. [00:36:33] And if I can articulate [00:36:35] that not only [00:36:36] to the engineers [00:36:36] but also to executive [00:36:37] leadership [00:36:38] and they have my back [00:36:40] as well, [00:36:41] we can do so much good [00:36:42] where we can almost [00:36:45] use like security [00:36:46] as a competitive advantage [00:36:47] which I know [00:36:47] some folks say [00:36:48] well it shouldn't be [00:36:49] or they should just be [00:36:50] like securing [00:36:50] the organization [00:36:51] and not really [00:36:51] telling folks [00:36:53] how great you are. [00:36:54] Not to say you would [00:36:54] never say how great [00:36:55] you are. [00:36:56] I've almost put the target [00:36:57] on your back [00:36:57] in security. [00:36:59] But yeah, [00:37:01] I really think [00:37:01] that just things [00:37:03] like that [00:37:04] and just being [00:37:07] a member [00:37:07] of the team [00:37:08] working with [00:37:09] the engineers [00:37:10] and not being [00:37:12] a major roadblock [00:37:13] has been [00:37:14] tremendously successful [00:37:15] and doing [00:37:15] the normal [00:37:16] user training [00:37:18] but tailored training [00:37:20] not just like [00:37:20] the computer-based [00:37:23] training [00:37:23] that all folks [00:37:24] get at a company [00:37:25] but really giving [00:37:26] them things [00:37:27] that's tailored [00:37:27] to the language [00:37:29] that they're [00:37:30] primarily using [00:37:31] the threats [00:37:33] to the language [00:37:34] that they're [00:37:34] primarily using [00:37:35] and really just [00:37:36] being a resource [00:37:37] for them [00:37:38] and just doing [00:37:39] constant checking. [00:37:41] Like in Technotomy [00:37:41] you know we always [00:37:42] talk people [00:37:42] process and technology [00:37:43] but giving them [00:37:45] the tools [00:37:46] training them [00:37:47] on the tools [00:37:48] to do like [00:37:48] you know [00:37:49] static code analysis [00:37:50] and dynamic [00:37:53] scans [00:37:53] on their stuff [00:37:54] and putting [00:37:55] all that [00:37:55] in CICV [00:37:56] really just [00:37:58] making it almost [00:37:59] so it's hard [00:37:59] for them [00:38:00] to not go through [00:38:01] at least some [00:38:02] of my gates [00:38:02] to find flaws [00:38:04] and we'll always [00:38:05] have other processes [00:38:06] like we're going [00:38:06] to do ad hoc [00:38:07] testing [00:38:08] as the aforementioned [00:38:09] red teaming [00:38:10] and things like that [00:38:10] but I really just [00:38:12] I want to [00:38:13] it's also [00:38:14] important to make [00:38:15] it clear [00:38:16] to these engineers [00:38:17] that you know [00:38:18] there's [00:38:19] there are a lot [00:38:19] of threats [00:38:20] out there [00:38:20] I mean [00:38:21] we'll look at logs [00:38:22] together [00:38:22] we'll look at [00:38:23] what's going on [00:38:23] and I found [00:38:25] especially in FinTech [00:38:27] that this is very [00:38:28] clear to them [00:38:29] I mean they know [00:38:30] this [00:38:30] I mean we're [00:38:31] they read about it [00:38:32] too [00:38:32] and nobody [00:38:34] especially when you [00:38:35] have these [00:38:35] when you're in [00:38:36] these FinTech [00:38:36] and these startup [00:38:37] environments [00:38:37] like all these [00:38:38] engineers are [00:38:39] owners of the [00:38:39] company [00:38:40] I mean they're [00:38:40] all you know [00:38:41] shareholders [00:38:41] or you know [00:38:42] they have equity [00:38:43] they're really [00:38:44] not saying that [00:38:45] companies that have [00:38:46] folks that don't [00:38:47] have equity [00:38:47] don't care [00:38:48] but like [00:38:48] these are [00:38:49] they don't want [00:38:50] their company [00:38:51] to be abused [00:38:52] and they especially [00:38:52] don't want [00:38:52] their customers [00:38:54] vulnerable customers [00:38:55] or again [00:38:56] patients from [00:38:57] the aforementioned [00:38:58] healthcare environment [00:38:59] to be abused [00:38:59] so I think [00:39:01] just placing yourself [00:39:03] really getting [00:39:04] yourself around [00:39:05] not being too [00:39:06] burdensome on folks [00:39:07] has been really [00:39:08] successful for me [00:39:09] to secure [00:39:11] my organizations [00:39:12] thank you Jeff [00:39:14] if all else [00:39:15] fails take them [00:39:16] out for drinks [00:39:17] man that'll be [00:39:17] my [00:39:17] thank you for [00:39:20] that Jeff [00:39:21] I'm going to [00:39:21] pass it over [00:39:22] to Octavia [00:39:22] thank you [00:39:24] thanks Naveen [00:39:25] and before we [00:39:27] kind of move [00:39:27] on I did want [00:39:28] to acknowledge [00:39:29] that October [00:39:31] is Hispanic [00:39:32] Heritage Month [00:39:33] so to all [00:39:34] those who are [00:39:36] Latinx [00:39:38] you know [00:39:39] happy Hispanic [00:39:39] Heritage Month [00:39:41] I know we [00:39:42] October is [00:39:43] a lot of [00:39:44] happy months [00:39:45] right [00:39:46] it's breast cancer [00:39:47] awareness [00:39:47] it's cyber [00:39:48] security awareness [00:39:50] but I definitely [00:39:50] want to acknowledge [00:39:51] that our Hispanic [00:39:54] community [00:39:54] who does so much [00:39:55] for our cyber [00:39:56] community [00:39:57] we appreciate you guys [00:39:59] and we love [00:39:59] everything that you [00:40:00] bring to our [00:40:01] community [00:40:02] so Jeff [00:40:05] one of the [00:40:06] things that is [00:40:07] interesting to me [00:40:08] is like you talk [00:40:09] about you know [00:40:10] your days [00:40:10] growing up in [00:40:11] New York [00:40:12] and Wall Street [00:40:13] kind of looking [00:40:14] at you know [00:40:14] those people in [00:40:15] suits and stuff [00:40:16] and I'm wondering [00:40:18] you know [00:40:18] you're currently [00:40:19] CISO at [00:40:20] Pinwheel [00:40:21] and you know [00:40:22] you talked about [00:40:25] you know [00:40:25] really being [00:40:26] interested in [00:40:26] security [00:40:27] and kind of like [00:40:28] you know [00:40:28] chaos and bringing [00:40:30] in regulations [00:40:30] but what's your [00:40:31] end game [00:40:32] right [00:40:33] I know my role [00:40:34] like my end game [00:40:35] is not to be a CISO [00:40:36] like forever [00:40:37] in a day [00:40:37] but what [00:40:39] what about [00:40:39] Jeff [00:40:40] like what do you [00:40:42] want and where [00:40:43] do you see [00:40:43] yourself in 10 years [00:40:44] wow [00:40:46] that's a good one [00:40:47] um [00:40:48] yeah thanks for that [00:40:50] it's a nice [00:40:50] outside the box [00:40:51] question [00:40:51] like something [00:40:52] you get in like [00:40:52] a job interview [00:40:53] like oh god [00:40:54] um [00:40:55] well the worst [00:40:56] job interview [00:40:56] the worst interview [00:40:57] question you get [00:40:58] is the [00:40:59] what are your flaws [00:41:00] but you know [00:41:01] anyway [00:41:01] so um [00:41:02] so yeah [00:41:03] in terms of [00:41:04] where I'm looking [00:41:05] to go in the next [00:41:06] 10 years [00:41:07] I again [00:41:08] right now [00:41:08] I love being [00:41:10] a part of a [00:41:11] leadership team [00:41:11] of a [00:41:12] fintech company [00:41:14] that I believe [00:41:14] is changing the [00:41:15] world [00:41:15] and in 10 years [00:41:18] I think [00:41:18] if I'm doing [00:41:19] the same thing [00:41:22] I think [00:41:23] I would be [00:41:24] happy [00:41:24] if we [00:41:25] build this one [00:41:26] to a successful [00:41:27] exit [00:41:28] and do [00:41:29] something else [00:41:30] and maybe [00:41:32] co-found [00:41:34] my own startup [00:41:35] whether it be [00:41:36] security centric [00:41:37] or something else [00:41:37] I think would be [00:41:39] really really cool [00:41:40] as well [00:41:40] I've done a lot [00:41:42] of dabbling [00:41:43] and [00:41:43] as I mentioned [00:41:45] before [00:41:46] I'm not sure [00:41:47] how much [00:41:48] this is influenced [00:41:49] by being in the [00:41:50] New York area [00:41:50] but then [00:41:51] cryptocurrency [00:41:51] and given my [00:41:53] skills of [00:41:54] writing code [00:41:55] I've done some [00:41:56] cryptocurrency [00:41:57] arbitrage [00:41:58] trading [00:41:58] some really [00:42:00] interesting stuff [00:42:00] there [00:42:01] so maybe [00:42:03] that'll have [00:42:04] some form [00:42:05] of involvement [00:42:07] in my life [00:42:07] in the next [00:42:07] 10 years [00:42:08] I think [00:42:09] on a personal [00:42:09] level [00:42:10] I see [00:42:10] I'll probably [00:42:11] have a couple [00:42:12] of kids [00:42:12] in tow [00:42:13] maybe move [00:42:14] out of the [00:42:15] city [00:42:15] and move [00:42:16] to the [00:42:16] burbs [00:42:17] but we'll [00:42:17] see [00:42:18] I'm still [00:42:19] kind of [00:42:19] drawn to [00:42:20] the excitement [00:42:21] of New York [00:42:21] and all it [00:42:22] has to offer [00:42:23] but it is [00:42:25] very compelling [00:42:26] to maybe [00:42:27] move out [00:42:27] to the burbs [00:42:28] and have [00:42:28] some space [00:42:29] in the backyard [00:42:29] and have [00:42:30] barbecues [00:42:31] and whatnot [00:42:32] but yeah [00:42:34] I think [00:42:34] I really [00:42:37] just love [00:42:38] the [00:42:39] and as we've [00:42:39] said [00:42:40] I mean [00:42:40] Katie's [00:42:41] great question [00:42:41] and some [00:42:42] of the other [00:42:42] great questions [00:42:43] I just [00:42:43] I love [00:42:44] being not [00:42:45] only like [00:42:46] a CISO [00:42:47] executive [00:42:49] at the table [00:42:50] but also [00:42:50] like a [00:42:51] hands-on [00:42:51] practitioner [00:42:52] not to say [00:42:53] that CISOs [00:42:53] can't be [00:42:54] effective [00:42:54] non-technical [00:42:55] CISOs [00:42:56] can't be [00:42:56] effective [00:42:57] because I [00:42:57] think they [00:42:58] absolutely [00:42:58] can [00:42:58] I mean [00:42:59] there's [00:42:59] so much [00:42:59] human [00:43:00] elements [00:43:01] to [00:43:02] leading a [00:43:03] successful [00:43:04] security [00:43:04] program [00:43:04] but I [00:43:05] just love [00:43:05] being the [00:43:06] person [00:43:06] where [00:43:06] like [00:43:07] in this [00:43:07] situation [00:43:07] I'm [00:43:07] going [00:43:08] to [00:43:08] die [00:43:08] behind [00:43:08] the [00:43:08] keyboard [00:43:09] and [00:43:09] get [00:43:09] involved [00:43:10] and [00:43:11] this [00:43:11] might [00:43:11] be [00:43:11] right [00:43:11] after [00:43:11] I [00:43:12] gave [00:43:12] a [00:43:12] presentation [00:43:12] to [00:43:12] the [00:43:13] board [00:43:13] of [00:43:13] directors [00:43:13] that's [00:43:14] why [00:43:14] I [00:43:14] love [00:43:15] this [00:43:15] space [00:43:16] so [00:43:16] much [00:43:16] and [00:43:17] it [00:43:17] really [00:43:18] gets [00:43:23] an [00:43:23] executive [00:43:24] in [00:43:24] a [00:43:25] large [00:43:25] financial [00:43:26] organization [00:43:26] maybe [00:43:27] that [00:43:27] will [00:43:27] pique [00:43:27] my [00:43:27] interest [00:43:28] at [00:43:28] some [00:43:28] point [00:43:28] but [00:43:29] right [00:43:29] now [00:43:29] I'm [00:43:29] just [00:43:30] enjoying [00:43:30] the [00:43:31] ride [00:43:31] of [00:43:32] the [00:43:33] startup [00:43:33] space [00:43:34] and [00:43:34] I [00:43:35] think [00:43:35] we'll [00:43:36] see [00:43:36] if [00:43:36] this [00:43:37] continues [00:43:37] for [00:43:38] the [00:43:38] foreseeable [00:43:39] future [00:43:39] thanks [00:43:43] for [00:43:44] that [00:43:44] I'm [00:43:45] really [00:43:46] looking [00:43:46] forward [00:43:47] to [00:43:47] seeing [00:43:47] where [00:43:48] you [00:43:48] go [00:43:48] and [00:43:49] what [00:43:49] you [00:43:49] want [00:43:50] to [00:43:50] do [00:43:50] and [00:43:50] once [00:43:51] you [00:43:51] pin [00:43:51] that [00:43:51] down [00:43:52] that [00:43:53] would [00:43:53] be [00:43:53] awesome [00:43:54] good [00:43:56] luck [00:43:56] to [00:43:56] you [00:43:56] thanks [00:43:59] so [00:43:59] much [00:43:59] hi [00:44:00] Jeff [00:44:00] thanks [00:44:01] for [00:44:02] coming [00:44:02] on [00:44:02] tonight [00:44:02] hearing [00:44:03] your [00:44:04] story [00:44:04] question [00:44:06] me [00:44:06] being [00:44:07] in [00:44:07] the [00:44:07] healthcare [00:44:07] for [00:44:08] the [00:44:08] last [00:44:08] 20 [00:44:08] years [00:44:09] running [00:44:10] security [00:44:10] wanted [00:44:12] to hear [00:44:12] your [00:44:12] thoughts [00:44:13] about [00:44:13] what [00:44:13] discouraged [00:44:14] you [00:44:14] from [00:44:15] healthcare [00:44:16] into [00:44:16] financial [00:44:18] markets [00:44:19] as a [00:44:20] CISO [00:44:20] and [00:44:21] also [00:44:21] backing [00:44:22] up [00:44:23] to [00:44:23] what [00:44:23] Octavia [00:44:24] was [00:44:24] saying [00:44:24] where [00:44:25] is [00:44:25] passion [00:44:27] outside [00:44:27] of [00:44:28] security [00:44:28] in [00:44:28] terms [00:44:29] of [00:44:29] professional [00:44:30] careers [00:44:30] sure [00:44:33] yeah [00:44:33] thanks [00:44:33] for [00:44:34] that [00:44:34] and [00:44:34] I [00:44:35] think [00:44:35] that's [00:44:35] really [00:44:35] interesting [00:44:37] even [00:44:37] healthcare [00:44:38] for 20 [00:44:38] years [00:44:39] that's [00:44:39] really [00:44:39] cool [00:44:39] yeah [00:44:41] I think [00:44:41] it just [00:44:44] happened [00:44:45] to [00:44:45] be [00:44:46] my [00:44:46] interest [00:44:47] in [00:44:48] pursuing [00:44:49] different [00:44:49] things [00:44:50] I don't [00:44:50] think [00:44:50] there [00:44:50] was [00:44:50] anything [00:44:51] about [00:44:51] healthcare [00:44:51] I need [00:44:52] to [00:44:52] get [00:44:52] out [00:44:52] of [00:44:52] here [00:44:53] I [00:44:53] think [00:44:53] it [00:44:53] was [00:44:53] more [00:44:54] of [00:44:54] like [00:44:54] I'm [00:44:55] learning [00:44:55] a [00:44:55] trade [00:44:56] of [00:44:57] how [00:44:57] to [00:44:57] address [00:44:58] cyber [00:44:58] risk [00:44:59] and [00:45:00] where [00:45:00] can [00:45:00] I [00:45:00] use [00:45:00] these [00:45:01] skills [00:45:01] to [00:45:02] benefit [00:45:03] organizations [00:45:04] so [00:45:05] yes [00:45:05] no [00:45:06] I [00:45:06] mean [00:45:06] I [00:45:07] can [00:45:07] definitely [00:45:07] see [00:45:08] myself [00:45:08] in [00:45:08] five [00:45:08] years [00:45:09] doing [00:45:09] security [00:45:10] leadership [00:45:10] for [00:45:11] healthcare [00:45:11] company [00:45:11] I [00:45:11] think [00:45:12] it's [00:45:12] totally [00:45:12] feasible [00:45:13] definitely [00:45:15] just [00:45:15] different [00:45:16] approaches [00:45:16] and [00:45:17] it [00:45:17] would [00:45:17] obviously [00:45:17] depend [00:45:18] healthcare [00:45:18] providers [00:45:19] I [00:45:20] mean [00:45:20] it [00:45:20] was [00:45:20] just [00:45:20] really [00:45:20] interesting [00:45:21] to see [00:45:22] when I [00:45:22] was [00:45:22] consulting [00:45:23] these [00:45:23] small [00:45:24] town [00:45:24] hospitals [00:45:25] and [00:45:25] some [00:45:25] of [00:45:26] the [00:45:26] lack [00:45:27] of [00:45:27] security [00:45:28] in [00:45:28] some [00:45:28] of [00:45:28] them [00:45:29] and [00:45:30] be [00:45:30] able [00:45:30] to [00:45:31] have [00:45:31] a [00:45:31] pretty [00:45:32] large [00:45:32] impact [00:45:33] in [00:45:33] a [00:45:33] short [00:45:34] period [00:45:34] of [00:45:34] time [00:45:34] so [00:45:36] yeah [00:45:36] so [00:45:36] definitely [00:45:37] no [00:45:37] knock [00:45:37] on [00:45:38] healthcare [00:45:38] I [00:45:38] think [00:45:38] it's [00:45:39] obviously [00:45:39] tremendously [00:45:40] important [00:45:41] healthcare [00:45:42] cyber [00:45:42] so [00:45:43] yeah [00:45:44] it's [00:45:44] definitely [00:45:44] something [00:45:45] that I [00:45:45] would [00:45:45] definitely [00:45:46] consider [00:45:46] in [00:45:46] the [00:45:46] future [00:45:47] but [00:45:48] yeah [00:45:48] I [00:45:48] do [00:45:49] really [00:45:49] just [00:45:49] appreciate [00:45:50] the [00:45:51] excitement [00:45:52] of [00:45:53] financial [00:45:54] markets [00:45:55] and [00:45:55] the [00:45:55] movements [00:45:55] of [00:45:56] money [00:45:56] and [00:45:56] the [00:45:57] threats [00:45:58] against [00:45:58] it [00:45:58] I [00:45:59] think [00:45:59] when [00:45:59] cryptocurrency [00:46:00] and [00:46:01] web3 [00:46:01] started [00:46:02] becoming [00:46:03] popular [00:46:05] in the [00:46:05] news [00:46:06] just [00:46:06] the [00:46:06] threats [00:46:07] there [00:46:07] it's [00:46:08] unbelievable [00:46:10] the [00:46:10] exploitation [00:46:12] of the [00:46:12] blockchain [00:46:13] and [00:46:13] the [00:46:14] algorithms [00:46:14] and [00:46:14] all [00:46:16] the [00:46:16] core [00:46:18] code [00:46:19] yields [00:46:20] these [00:46:21] hundred [00:46:22] million [00:46:22] things [00:46:23] that [00:46:23] are [00:46:23] happening [00:46:23] on [00:46:23] a [00:46:23] hundred [00:46:24] million [00:46:24] breaches [00:46:25] that [00:46:25] are [00:46:25] happening [00:46:25] on a [00:46:26] daily [00:46:26] basis [00:46:26] so [00:46:27] it's [00:46:27] really [00:46:27] just [00:46:28] things [00:46:28] like [00:46:29] this [00:46:29] are [00:46:29] obviously [00:46:30] horrible [00:46:30] but [00:46:31] they [00:46:31] just [00:46:32] keep [00:46:32] me [00:46:32] interested [00:46:33] in [00:46:33] understanding [00:46:34] these [00:46:35] threats [00:46:35] and [00:46:35] how [00:46:35] to [00:46:35] thwart [00:46:36] them [00:46:36] and [00:46:37] how [00:46:37] to [00:46:37] keep [00:46:38] an [00:46:38] organization [00:46:38] safe [00:46:39] from [00:46:39] these [00:46:39] threats [00:46:40] but [00:46:41] I [00:46:41] also [00:46:41] think [00:46:42] that [00:46:42] the [00:46:42] medical [00:46:44] device [00:46:47] security [00:46:47] and [00:46:48] I'm [00:46:48] assuming [00:46:48] those [00:46:49] are [00:46:49] things [00:46:49] that [00:46:49] are [00:46:50] priorities [00:46:51] for [00:46:51] you [00:46:51] and [00:46:51] I'd [00:46:51] be [00:46:52] curious [00:46:52] if [00:46:52] I can [00:46:53] ask [00:46:54] a [00:46:54] question [00:46:54] back [00:46:54] to [00:46:55] you [00:46:55] what [00:46:55] do [00:46:55] you [00:46:55] see [00:46:56] the [00:46:56] biggest [00:46:57] threats [00:46:59] and [00:47:00] things [00:47:00] of interest [00:47:01] in [00:47:02] healthcare [00:47:02] information [00:47:03] security [00:47:03] right [00:47:03] now [00:47:04] well [00:47:07] so [00:47:08] you [00:47:08] know [00:47:09] I [00:47:10] we [00:47:10] didn't [00:47:10] give [00:47:11] a [00:47:11] disclaimer [00:47:11] earlier [00:47:11] I [00:47:12] got [00:47:12] on [00:47:12] a [00:47:12] little [00:47:12] bit [00:47:12] my [00:47:13] apologies [00:47:13] but [00:47:14] we're [00:47:15] not [00:47:15] generally [00:47:16] talking [00:47:18] about [00:47:18] anything [00:47:18] related [00:47:19] to [00:47:19] our [00:47:20] particular [00:47:21] you [00:47:21] know [00:47:22] industry [00:47:22] but [00:47:23] I'll [00:47:23] say [00:47:24] healthcare [00:47:27] has [00:47:28] matured [00:47:28] a lot [00:47:28] right [00:47:29] and [00:47:29] the [00:47:30] threats [00:47:30] are [00:47:30] no [00:47:30] different [00:47:31] than [00:47:31] any [00:47:31] other [00:47:31] industry [00:47:32] a [00:47:33] healthcare [00:47:33] operations [00:47:34] does [00:47:35] anything [00:47:35] that [00:47:36] any [00:47:36] other [00:47:36] organization [00:47:37] does [00:47:37] supply [00:47:38] chain [00:47:38] financial [00:47:39] management [00:47:40] revenue [00:47:40] cycle [00:47:41] management [00:47:41] you [00:47:42] know [00:47:43] there's [00:47:43] no [00:47:43] difference [00:47:44] in [00:47:44] how [00:47:45] a [00:47:46] large [00:47:46] healthcare [00:47:47] operation [00:47:47] from [00:47:48] provider [00:47:48] payer [00:47:48] operates [00:47:50] than [00:47:50] any [00:47:50] other [00:47:50] large [00:47:51] business [00:47:52] would [00:47:52] operate [00:47:52] the [00:47:53] risks [00:47:53] are [00:47:54] the [00:47:54] same [00:47:54] the [00:47:56] operating [00:47:56] methodologies [00:47:57] are [00:47:57] the [00:47:57] same [00:47:58] you [00:47:59] know [00:47:59] so [00:47:59] just [00:48:01] like [00:48:01] any [00:48:01] other [00:48:02] manufacturing [00:48:02] or [00:48:03] banking [00:48:03] is [00:48:04] prone [00:48:05] to a [00:48:05] phishing [00:48:05] attack [00:48:06] or [00:48:06] infiltration [00:48:07] of an [00:48:08] adversarial [00:48:08] entity [00:48:10] to gain [00:48:11] access [00:48:11] and then [00:48:11] move [00:48:12] around [00:48:12] and [00:48:12] either [00:48:13] yield data [00:48:15] cause a [00:48:16] ransomware [00:48:16] incident [00:48:17] so [00:48:17] it's there [00:48:19] unfortunately [00:48:20] we've seen [00:48:21] some large [00:48:22] enterprise [00:48:23] healthcare [00:48:24] you know [00:48:26] facilities [00:48:27] I would say [00:48:27] have fallen [00:48:28] victim to [00:48:29] that [00:48:29] but [00:48:30] then [00:48:30] again [00:48:30] if [00:48:31] you [00:48:31] look [00:48:32] at [00:48:32] the [00:48:32] reports [00:48:34] healthcare [00:48:35] falls [00:48:35] down [00:48:36] to [00:48:36] like [00:48:36] 10th [00:48:37] or [00:48:37] 11th [00:48:38] you know [00:48:39] in the [00:48:40] sequence [00:48:42] of [00:48:42] victims [00:48:43] right [00:48:43] so [00:48:43] they're [00:48:44] usually [00:48:45] financial [00:48:45] companies [00:48:46] entertainment [00:48:47] and others [00:48:48] have [00:48:49] targeted [00:48:49] first [00:48:50] and then [00:48:50] healthcare [00:48:50] comes [00:48:51] but [00:48:51] yes [00:48:52] the impact [00:48:53] is immediate [00:48:53] when [00:48:54] something [00:48:54] happens [00:48:54] in healthcare [00:48:55] because [00:48:56] it's a [00:48:56] critical [00:48:56] infrastructure [00:48:57] services [00:48:58] organization [00:48:58] right [00:48:59] so [00:48:59] you're [00:49:00] right [00:49:00] there [00:49:00] but [00:49:01] the [00:49:01] threats [00:49:02] are [00:49:02] there [00:49:02] and [00:49:02] you [00:49:02] know [00:49:03] continue [00:49:03] to [00:49:03] fight [00:49:03] again [00:49:04] yeah [00:49:06] absolutely [00:49:07] yeah [00:49:08] I think [00:49:09] that's [00:49:10] really [00:49:10] helpful [00:49:11] and [00:49:12] interesting [00:49:13] and I think [00:49:14] one thing [00:49:14] that a lot [00:49:14] of startups [00:49:15] have [00:49:16] is they're [00:49:16] able to [00:49:17] they don't [00:49:18] need to [00:49:18] contend [00:49:19] with like [00:49:19] a bunch [00:49:19] of legacy [00:49:20] technology [00:49:21] that like [00:49:21] maybe some [00:49:22] like research [00:49:23] scientists [00:49:23] are saying [00:49:24] you know [00:49:24] we need to [00:49:24] use this [00:49:25] thing [00:49:25] and like [00:49:26] it's [00:49:26] you know [00:49:27] running [00:49:27] windows [00:49:27] nt4 [00:49:28] I mean [00:49:28] I jest [00:49:29] but like [00:49:29] running [00:49:30] some [00:49:30] legacy [00:49:30] software [00:49:31] and [00:49:31] you guys [00:49:32] can [00:49:32] secure [00:49:33] this [00:49:33] right [00:49:34] at [00:49:34] startups [00:49:35] I mean [00:49:35] these [00:49:35] startups [00:49:35] that [00:49:36] you know [00:49:37] started [00:49:38] maybe [00:49:38] two [00:49:38] three [00:49:38] years [00:49:39] ago [00:49:39] I mean [00:49:39] we [00:49:40] get to [00:49:40] handpick [00:49:41] new [00:49:41] technology [00:49:42] and we [00:49:42] can [00:49:42] again [00:49:43] not [00:49:43] saying [00:49:43] the [00:49:43] new [00:49:44] technology [00:49:44] isn't [00:49:44] prone [00:49:45] to [00:49:45] exploitation [00:49:45] it [00:49:46] absolutely [00:49:46] is [00:49:47] but [00:49:48] you [00:49:48] can [00:49:48] really [00:49:48] decide [00:49:49] design [00:49:50] from [00:49:50] the [00:49:50] ground [00:49:51] up [00:49:51] a [00:49:52] robust [00:49:53] and [00:49:54] layered [00:49:54] and [00:49:55] secure [00:49:55] architecture [00:49:56] so [00:49:56] I think [00:49:56] that's [00:49:57] one [00:49:57] of [00:49:57] the [00:49:57] definite [00:49:58] positives [00:49:59] of [00:50:00] the [00:50:00] early [00:50:01] stage [00:50:01] startup [00:50:01] game [00:50:02] but [00:50:03] again [00:50:03] resourcing [00:50:04] is [00:50:04] obviously [00:50:05] a challenge [00:50:05] you're not [00:50:05] going to [00:50:06] have [00:50:06] the [00:50:06] 500 [00:50:07] person [00:50:08] security [00:50:08] team [00:50:09] that [00:50:09] some [00:50:09] of [00:50:09] these [00:50:09] are [00:50:09] I mean [00:50:10] I'm sure [00:50:10] they have [00:50:10] more [00:50:11] that some [00:50:12] of these [00:50:12] large [00:50:13] fortune [00:50:13] companies [00:50:13] have [00:50:14] but [00:50:15] yeah [00:50:15] absolutely [00:50:15] thank you [00:50:16] for that [00:50:16] insight [00:50:17] to [00:50:17] healthcare [00:50:18] currently [00:50:18] it's [00:50:18] really [00:50:19] interesting [00:50:19] thank you [00:50:24] for your [00:50:24] insights [00:50:24] over to [00:50:25] Steven [00:50:26] thanks [00:50:29] Hussain [00:50:29] and thanks [00:50:30] Josh [00:50:30] I was a few [00:50:32] minutes late [00:50:32] as well [00:50:32] so I probably [00:50:33] missed the [00:50:33] intros [00:50:34] but I'm [00:50:35] Steven [00:50:35] Garcia [00:50:36] and I run [00:50:36] cybersecurity [00:50:37] over at [00:50:37] Fandle [00:50:37] traditional [00:50:39] disclaimers [00:50:39] apply [00:50:39] all thoughts [00:50:40] of my [00:50:40] own [00:50:40] et cetera [00:50:41] et cetera [00:50:41] so look [00:50:42] I was just [00:50:43] at the [00:50:43] National [00:50:44] Association [00:50:45] of Corporate [00:50:45] Directors [00:50:45] or NACD [00:50:46] over the [00:50:46] weekend [00:50:47] in DC [00:50:48] and for [00:50:48] those who [00:50:49] don't know [00:50:49] this is where [00:50:50] kind of all [00:50:51] the directors [00:50:51] or a lot [00:50:52] of directors [00:50:52] from across [00:50:52] the country [00:50:53] get together [00:50:53] and it's a [00:50:54] good place [00:50:55] to really [00:50:55] find out [00:50:55] what's on [00:50:56] the minds [00:50:56] of directors [00:50:57] across the [00:50:57] country [00:50:58] and I lost [00:50:59] count how [00:50:59] many times [00:51:00] I heard [00:51:00] the phrase [00:51:00] the war [00:51:02] on talent [00:51:02] is our [00:51:02] biggest risk [00:51:03] and there'd [00:51:03] be this [00:51:04] pause [00:51:04] and then [00:51:04] they say [00:51:05] after [00:51:05] cybersecurity [00:51:06] so I [00:51:07] thought it [00:51:07] was really [00:51:07] interesting [00:51:08] that [00:51:08] you know [00:51:09] that we're [00:51:10] at this [00:51:10] point [00:51:10] where [00:51:10] the topic [00:51:12] of what [00:51:12] we do [00:51:13] here [00:51:13] is really [00:51:13] on the [00:51:14] minds [00:51:14] of a lot [00:51:15] of boards [00:51:15] and I'm [00:51:16] bringing this [00:51:16] up because [00:51:17] they had [00:51:17] the CISO [00:51:17] of Equifax [00:51:18] and the [00:51:19] chair of [00:51:19] the board [00:51:20] really up [00:51:21] there talking [00:51:21] about lessons [00:51:22] learned [00:51:22] because we [00:51:22] all know [00:51:23] Equifax [00:51:23] went through [00:51:23] something [00:51:24] pretty major [00:51:24] and I was [00:51:27] thinking about [00:51:27] the pitfalls [00:51:27] of certain [00:51:28] roles that [00:51:28] we do [00:51:29] in security [00:51:29] and so [00:51:30] you know [00:51:31] like for [00:51:31] example [00:51:31] when I [00:51:32] came to [00:51:32] FanDuel [00:51:32] I wasn't [00:51:33] really [00:51:34] explained [00:51:34] that as [00:51:35] an employee [00:51:36] who may [00:51:37] have access [00:51:37] to certain [00:51:37] data [00:51:38] I then have [00:51:38] to get [00:51:39] licenses [00:51:39] for the [00:51:39] states [00:51:40] for gaming [00:51:40] for the [00:51:41] states [00:51:41] that we [00:51:41] work in [00:51:42] effectively [00:51:42] saying I [00:51:43] can't gamble [00:51:45] for me [00:51:46] no big [00:51:46] deal [00:51:48] not really [00:51:48] a gamble [00:51:48] like that [00:51:49] but I'm [00:51:50] curious [00:51:50] in that [00:51:51] same vein [00:51:51] what are [00:51:52] the challenges [00:51:52] for you [00:51:53] because if [00:51:53] I recall [00:51:53] correctly [00:51:54] Pinwheel [00:51:54] I think [00:51:56] you guys [00:51:56] classify [00:51:57] under [00:51:57] the consumer [00:51:59] reporting [00:51:59] agency [00:51:59] rules [00:52:00] which means [00:52:01] that you [00:52:01] kind of [00:52:02] got that [00:52:02] same [00:52:02] exposure [00:52:03] that [00:52:03] an Equifax [00:52:04] would have [00:52:04] and so [00:52:05] I'm curious [00:52:05] it's different [00:52:07] than your [00:52:08] traditional [00:52:08] fintech [00:52:09] and what [00:52:09] some other [00:52:10] roles [00:52:10] are going [00:52:11] to have [00:52:11] on top [00:52:12] of your [00:52:12] traditional [00:52:13] regulatory [00:52:13] stuff [00:52:13] so [00:52:14] did you [00:52:15] know [00:52:15] that [00:52:15] going [00:52:15] in [00:52:16] or [00:52:16] the [00:52:16] kind [00:52:16] of [00:52:16] pitfalls [00:52:17] that [00:52:17] you [00:52:17] say [00:52:17] hey [00:52:18] you know [00:52:18] if you [00:52:18] guys [00:52:18] came [00:52:19] into [00:52:19] this [00:52:19] industry [00:52:20] this [00:52:20] particular [00:52:20] vertical [00:52:21] like [00:52:21] maybe [00:52:22] you [00:52:22] might [00:52:22] want [00:52:22] to [00:52:22] watch [00:52:23] out [00:52:23] for that [00:52:23] for people [00:52:24] who are still [00:52:24] kind of [00:52:25] getting [00:52:25] into [00:52:25] this [00:52:25] because [00:52:26] I mean [00:52:26] I would [00:52:26] definitely [00:52:27] give people [00:52:27] a heads [00:52:27] up [00:52:27] like [00:52:28] if you're [00:52:28] going to [00:52:28] FanDuel [00:52:28] and you [00:52:29] like [00:52:29] fantasy [00:52:30] football [00:52:30] and [00:52:31] you [00:52:31] play [00:52:32] daily [00:52:32] fantasy [00:52:32] this [00:52:33] might [00:52:33] not [00:52:33] be [00:52:33] the [00:52:33] place [00:52:34] for you [00:52:34] right [00:52:34] so [00:52:34] stuff [00:52:34] like [00:52:34] that [00:52:35] is [00:52:35] there [00:52:35] anything [00:52:35] like [00:52:35] that [00:52:35] you [00:52:36] could [00:52:36] share [00:52:36] not [00:52:38] really [00:52:39] I'm not [00:52:40] sure [00:52:40] there [00:52:40] would [00:52:40] be [00:52:40] much [00:52:41] warning [00:52:41] there [00:52:41] I mean [00:52:42] so [00:52:42] I guess [00:52:42] like [00:52:42] what [00:52:43] specifically [00:52:43] do you [00:52:44] think [00:52:44] with [00:52:44] the [00:52:44] CRA [00:52:45] like [00:52:45] what [00:52:45] do [00:52:45] you [00:52:46] think [00:52:46] would [00:52:46] be [00:52:47] like [00:52:47] a [00:52:47] warning [00:52:48] or [00:52:48] like [00:52:48] a [00:52:48] would [00:52:49] dissuade [00:52:50] someone [00:52:50] from [00:52:50] getting [00:52:51] into [00:52:51] the [00:52:51] space [00:52:51] so [00:52:52] when [00:52:53] you [00:52:53] think [00:52:53] about [00:52:54] like [00:52:54] the [00:52:54] credit [00:52:54] reporting [00:52:55] agencies [00:52:55] like [00:52:55] Equifax [00:52:56] TransUnion [00:52:57] etc [00:52:57] these [00:52:59] business [00:53:00] models [00:53:00] there's [00:53:00] a whole [00:53:01] lot [00:53:01] I gotta [00:53:01] say [00:53:01] about [00:53:02] that [00:53:02] but [00:53:02] just [00:53:02] limited [00:53:03] to [00:53:03] we [00:53:04] as [00:53:04] the [00:53:04] consumer [00:53:05] didn't [00:53:05] have [00:53:06] a [00:53:06] choice [00:53:06] right [00:53:06] like [00:53:07] once [00:53:08] you [00:53:08] got [00:53:08] credit [00:53:09] you [00:53:09] didn't [00:53:09] get [00:53:10] asked [00:53:10] hey [00:53:10] would [00:53:10] you [00:53:11] mind [00:53:11] if [00:53:11] Equifax [00:53:12] was [00:53:12] your [00:53:12] you know [00:53:13] like [00:53:13] you're [00:53:14] right [00:53:14] you know [00:53:14] like [00:53:15] you just [00:53:15] are [00:53:16] part [00:53:16] of [00:53:16] it [00:53:16] right [00:53:16] like [00:53:16] this [00:53:17] whole [00:53:17] FICO [00:53:17] system [00:53:17] that [00:53:18] the [00:53:18] US [00:53:18] is [00:53:18] on [00:53:19] and [00:53:19] some [00:53:19] other [00:53:19] countries [00:53:19] like [00:53:20] like [00:53:20] you're [00:53:20] a [00:53:21] mandatory [00:53:21] customer [00:53:22] right [00:53:22] so [00:53:22] that [00:53:22] kind [00:53:23] of [00:53:23] opens [00:53:24] up [00:53:24] like [00:53:24] different [00:53:24] avenues [00:53:25] and [00:53:25] places [00:53:25] that [00:53:25] you [00:53:26] need [00:53:26] to [00:53:26] be [00:53:26] careful [00:53:26] and [00:53:27] so [00:53:28] because [00:53:28] you [00:53:28] guys [00:53:29] fought [00:53:29] on [00:53:29] the [00:53:29] CRA [00:53:29] I [00:53:30] would [00:53:30] wonder [00:53:31] if [00:53:31] there's [00:53:32] specific [00:53:33] things [00:53:33] that [00:53:33] you [00:53:34] got [00:53:34] to [00:53:34] watch [00:53:34] out [00:53:34] for [00:53:34] that [00:53:35] you [00:53:35] know [00:53:35] for [00:53:35] example [00:53:36] like [00:53:36] when [00:53:36] I [00:53:37] was [00:53:37] in [00:53:37] blockchain [00:53:37] and [00:53:37] crypto [00:53:38] you [00:53:38] know [00:53:38] it [00:53:39] was [00:53:39] still [00:53:39] fintech [00:53:39] but [00:53:40] that [00:53:40] was [00:53:40] never [00:53:41] a [00:53:41] concern [00:53:41] for [00:53:41] me [00:53:42] where [00:53:42] I [00:53:42] would [00:53:42] imagine [00:53:42] you [00:53:52] yeah [00:53:52] no [00:53:53] real [00:53:53] lessons [00:53:53] learned [00:53:54] yeah [00:53:56] nothing [00:53:56] nothing [00:53:56] to [00:53:57] note [00:53:57] there [00:53:58] definitely [00:53:58] an [00:53:59] interesting [00:53:59] point [00:53:59] totally [00:54:00] understand [00:54:01] from [00:54:01] the [00:54:01] gambling [00:54:03] standpoint [00:54:03] I could [00:54:03] see if [00:54:04] folks do [00:54:05] appreciate [00:54:05] that [00:54:06] industry [00:54:06] they might [00:54:06] not [00:54:06] want [00:54:06] to [00:54:07] get [00:54:07] into [00:54:07] band [00:54:08] duel [00:54:08] or [00:54:08] draft [00:54:09] game [00:54:09] space [00:54:09] but [00:54:10] yeah [00:54:10] nothing [00:54:10] really [00:54:11] at [00:54:11] note [00:54:11] all right [00:54:15] thank [00:54:15] you [00:54:15] oh [00:54:16] I think [00:54:16] I was [00:54:16] the last [00:54:17] one [00:54:17] on [00:54:17] the [00:54:18] panel [00:54:19] here [00:54:19] for [00:54:19] questions [00:54:19] so [00:54:20] Tomas [00:54:21] I'll [00:54:21] pass it [00:54:21] back [00:54:22] to [00:54:22] you [00:54:22] thanks [00:54:24] Steven [00:54:24] and [00:54:24] thanks [00:54:25] everybody [00:54:25] for [00:54:25] for [00:54:26] joining [00:54:27] on that [00:54:28] sort [00:54:28] of [00:54:28] conversation [00:54:30] again [00:54:32] this is [00:54:32] our [00:54:32] weekly [00:54:33] fireside [00:54:33] chat [00:54:33] if [00:54:35] you [00:54:35] are [00:54:35] a [00:54:36] first [00:54:36] time [00:54:36] listener [00:54:37] we [00:54:38] thank [00:54:38] you [00:54:39] for [00:54:39] joining [00:54:39] us [00:54:39] I do [00:54:40] see [00:54:40] a [00:54:40] little [00:54:41] party [00:54:41] hat [00:54:41] of [00:54:41] celebration [00:54:42] hat [00:54:42] in [00:54:42] the [00:54:42] audience [00:54:42] so [00:54:43] thanks [00:54:43] for [00:54:43] tuning [00:54:43] in [00:54:43] there's [00:54:44] a [00:54:44] little [00:54:44] greenhouse [00:54:45] on [00:54:45] the [00:54:45] top [00:54:46] left [00:54:46] of [00:54:46] your [00:54:46] screen [00:54:46] where [00:54:46] it [00:54:47] says [00:54:47] fireside [00:54:47] chat [00:54:47] you [00:54:48] can [00:54:48] click [00:54:48] that [00:54:48] little [00:54:48] greenhouse [00:54:52] club [00:54:52] and [00:54:53] it [00:54:53] will [00:54:53] allow [00:54:54] you [00:54:54] to [00:54:54] see [00:54:55] or [00:54:55] listen [00:54:56] to [00:54:56] prior [00:54:57] sessions [00:54:57] that [00:54:58] have [00:54:58] been [00:54:58] recorded [00:54:58] and [00:54:59] it [00:54:59] will [00:54:59] allow [00:54:59] you [00:55:00] to [00:55:00] see [00:55:00] who's [00:55:01] coming [00:55:01] up [00:55:01] next [00:55:02] in [00:55:03] our [00:55:03] session [00:55:03] next [00:55:04] week [00:55:04] so [00:55:04] we [00:55:05] ask [00:55:05] that [00:55:05] you [00:55:05] please [00:55:06] join [00:55:06] our [00:55:06] club [00:55:06] and [00:55:07] join [00:55:07] the [00:55:07] community [00:55:07] if [00:55:09] you [00:55:09] do [00:55:09] have [00:55:09] a [00:55:09] question [00:55:10] and [00:55:10] you [00:55:10] do [00:55:10] want [00:55:10] to [00:55:10] jump [00:55:10] on [00:55:11] stage [00:55:11] feel [00:55:12] free [00:55:12] to [00:55:12] raise [00:55:12] your [00:55:13] hand [00:55:13] a [00:55:13] little [00:55:13] option [00:55:15] on [00:55:15] your [00:55:15] app [00:55:16] to [00:55:16] raise [00:55:16] your [00:55:16] hand [00:55:17] and [00:55:17] we [00:55:17] will [00:55:17] bring [00:55:17] you [00:55:17] up [00:55:17] on [00:55:17] stage [00:55:18] and [00:55:19] if [00:55:19] you [00:55:19] can't [00:55:20] talk [00:55:20] for [00:55:21] whatever [00:55:21] reason [00:55:21] feel [00:55:21] free [00:55:22] to [00:55:22] put [00:55:22] a [00:55:22] question [00:55:23] in [00:55:23] the [00:55:23] chat [00:55:23] and [00:55:23] I [00:55:24] will [00:55:24] read [00:55:24] it [00:55:24] off [00:55:24] live [00:55:26] I [00:55:27] will [00:55:28] ask [00:55:28] you [00:55:28] Jeff [00:55:28] I [00:55:29] usually [00:55:30] like [00:55:30] to [00:55:30] ask [00:55:30] this [00:55:30] question [00:55:31] around [00:55:31] books [00:55:33] and [00:55:33] reading [00:55:33] and [00:55:34] things [00:55:34] that [00:55:34] keep [00:55:35] not only [00:55:37] CISOs [00:55:37] but [00:55:37] just [00:55:38] leaders [00:55:38] in [00:55:39] general [00:55:39] up [00:55:40] to [00:55:40] speed [00:55:41] on [00:55:41] what's [00:55:41] going [00:55:41] on [00:55:42] and [00:55:42] maybe [00:55:42] just [00:55:43] what [00:55:45] are [00:55:45] you [00:55:45] reading [00:55:45] what [00:55:45] is [00:55:46] in [00:55:46] your [00:55:47] reading [00:55:48] list [00:55:48] or [00:55:48] audible [00:55:48] list [00:55:49] what [00:55:49] do [00:55:50] you [00:55:50] like [00:55:51] to [00:55:51] consume [00:55:51] to [00:55:53] keep [00:55:53] yourself [00:55:53] educated [00:55:54] yeah [00:55:55] no I [00:55:56] think [00:55:56] that's [00:55:56] oh can [00:55:58] you still [00:55:58] hear me [00:55:58] or am I [00:55:59] cut out [00:55:59] no you're [00:56:01] good [00:56:01] you are [00:56:02] good [00:56:03] oh [00:56:03] I'm [00:56:04] good [00:56:04] perfect [00:56:05] so yeah [00:56:05] so I [00:56:06] mean I [00:56:06] think [00:56:06] I read [00:56:07] like a [00:56:08] bunch [00:56:09] of [00:56:09] different [00:56:09] things [00:56:09] I mean [00:56:10] I just [00:56:10] recently [00:56:11] finished [00:56:11] Apollo's [00:56:12] Arrow [00:56:12] which [00:56:13] was [00:56:13] written [00:56:14] by [00:56:14] Nicholas [00:56:15] Christakis [00:56:15] on [00:56:16] the [00:56:17] COVID [00:56:17] pandemic [00:56:17] I'm [00:56:19] a big [00:56:20] listener [00:56:20] of [00:56:20] Sam [00:56:21] Harris [00:56:22] who's [00:56:22] a [00:56:23] his [00:56:23] podcast [00:56:24] he's an [00:56:25] academic [00:56:26] and interviews [00:56:26] a lot [00:56:27] of [00:56:27] folks [00:56:28] and [00:56:28] just [00:56:30] thought [00:56:31] leaders [00:56:31] in their [00:56:32] industries [00:56:32] and I [00:56:33] think that [00:56:33] definitely [00:56:33] has [00:56:34] applicability [00:56:34] to [00:56:35] cyber [00:56:35] I [00:56:36] really [00:56:36] just [00:56:36] try [00:56:36] to [00:56:37] learn [00:56:37] as [00:56:38] much [00:56:38] about [00:56:38] different [00:56:38] disciplines [00:56:39] as I [00:56:39] can [00:56:40] and [00:56:40] apply [00:56:40] that [00:56:41] to [00:56:41] what [00:56:41] I'm [00:56:42] doing [00:56:42] I read [00:56:43] a really [00:56:43] interesting [00:56:43] book [00:56:43] recently [00:56:44] it was [00:56:44] by the [00:56:46] author [00:56:46] Leonard [00:56:47] Maladna [00:56:48] it's [00:56:48] called [00:56:49] The [00:56:49] Drunkard's [00:56:49] Walk [00:56:50] which talks [00:56:51] about [00:56:52] randomness [00:56:53] in our [00:56:53] lives [00:56:54] and things [00:56:54] that we [00:56:55] think [00:56:55] are due [00:56:56] to [00:56:56] performance [00:56:57] and [00:56:57] ability [00:56:58] but a lot [00:57:00] of them [00:57:00] are just [00:57:00] literally [00:57:01] due to [00:57:01] blind [00:57:02] chance [00:57:02] which [00:57:04] obviously [00:57:04] has a lot [00:57:04] to do [00:57:04] with security [00:57:05] as well [00:57:05] so [00:57:06] so [00:57:06] I [00:57:07] try [00:57:07] and [00:57:07] I [00:57:09] do [00:57:09] purchase [00:57:10] a lot [00:57:10] of [00:57:11] the [00:57:11] new [00:57:12] CISO [00:57:13] handbooks [00:57:13] and [00:57:14] I'll [00:57:14] be [00:57:14] honest [00:57:14] sometimes [00:57:15] I skim [00:57:16] them [00:57:16] a little [00:57:16] bit [00:57:17] just [00:57:18] to [00:57:18] get [00:57:18] some [00:57:19] core [00:57:19] principles [00:57:19] and [00:57:19] I'm [00:57:20] actually [00:57:20] looking [00:57:20] at my [00:57:20] library [00:57:21] right [00:57:21] now [00:57:22] and [00:57:24] something [00:57:25] actually [00:57:26] some [00:57:26] books [00:57:27] that I [00:57:27] find [00:57:27] absolutely [00:57:28] fascinating [00:57:28] and are [00:57:30] super [00:57:30] helpful [00:57:31] are [00:57:32] books [00:57:33] on [00:57:34] open [00:57:34] source [00:57:34] intelligence [00:57:35] techniques [00:57:35] and [00:57:36] there's [00:57:36] Michael [00:57:36] Brassel [00:57:37] who's [00:57:37] a [00:57:38] former [00:57:38] FBI [00:57:39] agent [00:57:40] who [00:57:40] writes [00:57:40] a lot [00:57:41] of [00:57:41] these [00:57:41] books [00:57:41] on [00:57:42] how [00:57:42] to [00:57:42] use [00:57:43] open [00:57:44] source [00:57:44] intelligence [00:57:44] and I [00:57:45] think [00:57:45] that [00:57:45] is [00:57:46] definitely [00:57:46] a [00:57:47] big [00:57:47] aspect [00:57:48] to my [00:57:49] job [00:57:49] just [00:57:49] again [00:57:50] given [00:57:50] the [00:57:50] small [00:57:51] team [00:57:51] we [00:57:52] have [00:57:52] a lot [00:57:52] of [00:57:52] tasks [00:57:53] to [00:57:53] do [00:57:53] and [00:57:53] sometimes [00:57:54] that [00:57:54] open [00:57:54] source [00:57:54] intelligence [00:57:55] is [00:57:55] super [00:57:56] helpful [00:57:56] and [00:57:58] other [00:57:58] things [00:57:59] I'm [00:57:59] reading [00:57:59] I try [00:58:00] and stay [00:58:00] up [00:58:00] on [00:58:01] all [00:58:01] the [00:58:01] languages [00:58:02] programming [00:58:04] languages [00:58:04] so I [00:58:05] know [00:58:05] it's [00:58:05] not [00:58:05] like [00:58:06] real [00:58:06] like [00:58:07] novel [00:58:07] reading [00:58:08] but [00:58:09] I [00:58:10] try [00:58:10] and [00:58:11] just [00:58:11] from [00:58:11] a [00:58:11] tech [00:58:12] standpoint [00:58:12] thing [00:58:13] so [00:58:13] I'll [00:58:13] purchase [00:58:14] like [00:58:14] I'll [00:58:15] purchase [00:58:15] dummies [00:58:15] books [00:58:16] on [00:58:16] like [00:58:16] on [00:58:17] certain [00:58:17] aspects [00:58:18] of [00:58:18] our [00:58:19] tech [00:58:19] stack [00:58:19] just [00:58:19] to [00:58:20] ensure [00:58:20] that [00:58:20] you [00:58:21] know [00:58:21] I [00:58:21] can [00:58:21] speak [00:58:21] intelligently [00:58:22] about [00:58:22] it [00:58:22] I [00:58:22] can [00:58:22] make [00:58:23] intelligent [00:58:23] decisions [00:58:23] if [00:58:24] I'm [00:58:24] not [00:58:24] an [00:58:26] expert [00:58:26] on [00:58:26] the [00:58:26] matter [00:58:26] so [00:58:27] yeah [00:58:27] it's [00:58:27] definitely [00:58:28] a [00:58:28] diverse [00:58:28] library [00:58:30] at [00:58:30] the [00:58:30] moment [00:58:30] cool [00:58:32] thanks [00:58:33] for [00:58:33] that [00:58:33] I'm [00:58:34] going [00:58:34] to [00:58:34] pass [00:58:34] it [00:58:34] over [00:58:34] to [00:58:35] Katie [00:58:35] she's [00:58:35] got [00:58:36] some [00:58:36] lightning [00:58:37] fast [00:58:38] questions [00:58:38] to [00:58:39] ask [00:58:40] you [00:58:40] yeah [00:58:41] Vijay [00:58:43] normally [00:58:44] does [00:58:44] this [00:58:44] and [00:58:45] he [00:58:45] was [00:58:46] unable [00:58:46] he's [00:58:46] on [00:58:46] a [00:58:46] train [00:58:47] so [00:58:47] he [00:58:47] wasn't [00:58:47] able [00:58:47] to [00:58:47] ask [00:58:48] the [00:58:48] questions [00:58:48] sometimes [00:58:49] it's [00:58:49] fun [00:58:49] just [00:58:50] to [00:58:50] go [00:58:50] through [00:58:51] maybe [00:58:51] we're [00:58:51] going [00:58:51] to [00:58:51] ask [00:58:52] you [00:58:52] five [00:58:52] questions [00:58:53] really [00:58:53] quickly [00:58:54] in [00:58:54] a [00:58:54] row [00:58:55] are [00:58:56] you [00:58:56] ready [00:58:56] let's [00:58:58] do [00:58:58] it [00:58:58] okay [00:58:59] number [00:59:00] one [00:59:00] if [00:59:01] someone [00:59:01] were [00:59:02] to [00:59:02] play [00:59:02] you [00:59:02] in [00:59:03] a [00:59:03] movie [00:59:03] who [00:59:04] would [00:59:04] it [00:59:05] be [00:59:05] oh [00:59:07] my [00:59:07] gosh [00:59:07] I'm [00:59:09] already [00:59:09] pretentious [00:59:10] here [00:59:10] who [00:59:11] I'll [00:59:12] say [00:59:12] Matthew [00:59:14] McConaughey [00:59:14] my grandma [00:59:15] says I look [00:59:15] like Matthew [00:59:15] McConaughey [00:59:16] as well [00:59:16] we'll do [00:59:17] that one [00:59:17] okay [00:59:18] well [00:59:19] that leads [00:59:19] me to [00:59:20] my next [00:59:20] one [00:59:20] how about [00:59:21] this [00:59:21] one [00:59:21] what [00:59:22] is [00:59:22] your [00:59:23] favorite [00:59:23] movie [00:59:24] I [00:59:27] would [00:59:27] say [00:59:27] my [00:59:28] favorite [00:59:28] movie [00:59:29] is [00:59:30] Mulholland [00:59:33] Drive [00:59:33] what's [00:59:34] that [00:59:35] I [00:59:35] see [00:59:35] there's [00:59:35] a lot [00:59:36] to unpack [00:59:36] there [00:59:36] isn't [00:59:36] that [00:59:37] fun [00:59:37] okay [00:59:37] next [00:59:37] one [00:59:38] it's [00:59:38] a [00:59:38] two [00:59:38] for [00:59:38] first [00:59:39] concert [00:59:39] last [00:59:39] concert [00:59:40] first [00:59:42] concert [00:59:43] was [00:59:43] the [00:59:44] I [00:59:46] believe [00:59:46] it was [00:59:46] Metallica [00:59:47] or the [00:59:48] the [00:59:48] Goo [00:59:49] Dolls [00:59:49] and [00:59:50] last [00:59:50] concert [00:59:51] was [00:59:52] I [00:59:54] honestly [00:59:55] I [00:59:56] don't [00:59:56] remember [00:59:56] the [00:59:57] last [00:59:57] time [00:59:57] I [00:59:57] been [00:59:57] to [00:59:57] a [00:59:57] concert [00:59:58] so [00:59:58] it's [00:59:58] been [00:59:58] a [00:59:58] while [00:59:58] I [00:59:59] do [00:59:59] like [00:59:59] going [01:00:00] to [01:00:00] Jones [01:00:01] Beach [01:00:01] it's [01:00:02] such [01:00:02] an [01:00:02] amazing [01:00:02] venue [01:00:03] there [01:00:03] just [01:00:03] being [01:00:04] near [01:00:04] the [01:00:04] beach [01:00:04] and [01:00:05] just [01:00:05] the [01:00:06] acoustics [01:00:06] are [01:00:06] amazing [01:00:07] but [01:00:07] yeah [01:00:07] sorry [01:00:07] I [01:00:08] really [01:00:08] don't [01:00:08] remember [01:00:09] well [01:00:11] I guess [01:00:12] like most [01:00:12] millennials [01:00:12] you have [01:00:14] that [01:00:14] whole [01:00:14] two [01:00:14] years [01:00:14] of [01:00:15] COVID [01:00:15] that [01:00:15] you [01:00:15] lost [01:00:16] as [01:00:16] well [01:00:16] so [01:00:16] okay [01:00:17] next [01:00:19] one [01:00:19] ! [01:00:19] what's [01:00:22] sent? [01:00:24] oh [01:00:25] wow [01:00:25] it [01:00:27] was [01:00:27] to [01:00:28] my [01:00:28] father-in-law [01:00:29] to tell [01:00:30] him [01:00:30] when [01:00:31] he [01:00:32] should [01:00:32] come [01:00:32] pick me [01:00:33] up [01:00:33] in [01:00:33] the [01:00:33] city [01:00:34] we [01:00:36] were [01:00:36] going [01:00:36] to [01:00:36] go [01:00:36] to [01:00:36] Long [01:00:36] Island [01:00:37] and [01:00:37] spend [01:00:38] the [01:00:38] weekend [01:00:38] so [01:00:39] yeah [01:00:39] so [01:00:40] that's [01:00:40] it [01:00:40] wow [01:00:43] we [01:00:43] could [01:00:43] all [01:00:43] use [01:00:43] a [01:00:43] nice [01:00:43] father-in-law [01:00:44] to come [01:00:44] pick us [01:00:45] up [01:00:45] it's [01:00:45] nice [01:00:45] it's [01:00:47] telling [01:00:48] all right [01:00:48] and then [01:00:48] number [01:00:48] five [01:00:49] when [01:00:50] is [01:00:50] the [01:00:50] last [01:00:51] time [01:00:51] that [01:00:51] you [01:00:51] were [01:00:52] truly [01:00:52] afraid [01:00:54] could [01:00:57] have [01:00:57] been [01:00:57] you [01:00:57] almost [01:00:57] got [01:00:57] hit [01:00:57] by [01:00:57] car [01:00:58] could [01:00:58] have [01:00:58] been [01:00:59] you [01:00:59] thought [01:00:59] someone's [01:01:00] breaking [01:01:00] into [01:01:00] your [01:01:00] apartment [01:01:01] it [01:01:02] could [01:01:02] have [01:01:02] been [01:01:03] yeah [01:01:03] I would [01:01:03] say [01:01:03] I'm a numbers [01:01:09] person [01:01:09] but it [01:01:09] was really [01:01:10] a bit [01:01:11] of an [01:01:11] irrational [01:01:11] fear [01:01:12] but [01:01:12] so [01:01:13] I [01:01:13] told [01:01:14] I [01:01:14] spoke [01:01:15] about [01:01:15] my [01:01:15] trip [01:01:15] to [01:01:15] Bora Bora [01:01:16] and that [01:01:16] was a [01:01:17] three-leg [01:01:17] trip [01:01:17] pretty [01:01:18] long [01:01:19] we [01:01:20] had [01:01:20] the [01:01:20] flight [01:01:20] from [01:01:21] New York [01:01:23] to LAX [01:01:24] to Tahiti [01:01:24] and then to [01:01:25] Bora Bora [01:01:25] so that flight [01:01:27] returning from Bora Bora [01:01:29] to Tahiti [01:01:29] had some [01:01:30] and I've been flying around [01:01:31] the world since I was younger [01:01:33] for work [01:01:34] or just [01:01:34] for other things [01:01:35] and I've experienced turbulence [01:01:36] before [01:01:37] but this was a very small plane [01:01:38] that literally was just like [01:01:40] the bags were falling out [01:01:41] of the [01:01:42] overhead bins [01:01:44] and you tell yourself [01:01:46] you're like this happens [01:01:47] and it's not like [01:01:48] there hasn't been an accident [01:01:50] in XYZ years [01:01:52] and it's not [01:01:52] like [01:01:53] when you're in [01:01:54] a little metal tube [01:01:55] suspended [01:01:56] 30,000 feet in the air [01:01:57] sometimes you just [01:01:58] even [01:01:59] rational thoughts [01:02:00] like that [01:02:01] so that was [01:02:02] definitely a very [01:02:03] fearful moment [01:02:04] for the 45-minute flight [01:02:06] Well, thank you [01:02:09] for participating [01:02:10] in our [01:02:11] rapid-fire questions [01:02:12] you [01:02:13] are [01:02:14] correct [01:02:15] I don't know [01:02:16] if you guys [01:02:16] watch James Corden [01:02:17] I love that guy [01:02:17] he's always like [01:02:18] and you are [01:02:19] correct [01:02:19] and over to [01:02:21] and over to [01:02:23] Tomas then [01:02:24] to carry on the room [01:02:26] thanks again Jeff [01:02:27] thanks [01:02:28] thanks [01:02:29] thanks Katie [01:02:30] those are awesome questions [01:02:32] hey Jeff [01:02:32] there's a question [01:02:33] in the back chat [01:02:34] from one of our audience [01:02:36] members [01:02:36] who can't come up [01:02:38] so a question [01:02:39] from Matthew [01:02:40] I would be interested [01:02:44] to know [01:02:44] if employees [01:02:45] at pinwheel [01:02:46] and Jeff [01:02:47] in particular [01:02:48] take advantage [01:02:48] of the unlimited [01:02:50] PTO [01:02:51] or if the stress [01:02:53] of taking days off [01:02:55] keep people at work [01:02:56] yeah [01:02:58] that's a really [01:02:59] great question [01:02:59] and I think [01:03:00] one of your [01:03:01] previous guests [01:03:03] on the show [01:03:04] spoke a lot [01:03:05] about remote work [01:03:06] and that's [01:03:07] impacts on employee [01:03:09] mental health [01:03:10] and whatnot [01:03:10] and I don't [01:03:11] want to sound [01:03:12] like I'm just [01:03:12] like kind of [01:03:13] like speaking [01:03:13] super highly [01:03:14] and just like [01:03:15] giving PR [01:03:16] answers [01:03:16] but I really [01:03:17] truly mean [01:03:18] that [01:03:18] we're very big [01:03:20] about saying [01:03:20] take your [01:03:21] paid time off [01:03:22] I think it's [01:03:25] tremendously important [01:03:26] if someone's [01:03:27] not taking it [01:03:27] we're definitely [01:03:28] going to approach [01:03:28] them and say [01:03:29] take time off [01:03:30] we do have [01:03:32] I mean we're [01:03:33] a tech startup [01:03:34] so [01:03:34] you know we have [01:03:36] like 75% [01:03:37] of our company's [01:03:38] engineers [01:03:38] so there's [01:03:39] we don't [01:03:41] silo folks [01:03:42] where it's like [01:03:42] oh Jack is out [01:03:43] and now [01:03:44] we can't do this [01:03:45] or if there's a [01:03:46] problem [01:03:46] then like [01:03:47] you know [01:03:47] we have to call [01:03:48] him [01:03:48] and he's in the [01:03:49] middle of the [01:03:49] rainforest [01:03:49] so we definitely [01:03:51] encourage folks [01:03:53] to take it [01:03:53] PTO [01:03:54] unlimited PTO [01:03:55] actually means [01:03:56] unlimited PTO [01:03:57] I mean as long [01:03:57] as you can get [01:03:58] your mandate [01:03:59] and your work done [01:04:00] so yeah [01:04:01] I think that [01:04:02] it absolutely [01:04:02] is a benefit [01:04:03] I think some [01:04:04] companies maybe [01:04:05] don't treat it [01:04:06] as such [01:04:06] maybe they're [01:04:07] you kind of [01:04:08] almost get [01:04:08] potentially pressured [01:04:09] to say like [01:04:10] it's unlimited [01:04:10] but like [01:04:11] you know [01:04:12] you have a year's [01:04:13] worth of work to do [01:04:13] so I think it's [01:04:14] somehow squeezed it [01:04:15] in but [01:04:15] we make it very [01:04:16] very easy [01:04:19] for folks [01:04:20] to take the [01:04:20] time off [01:04:21] they need [01:04:21] so it would [01:04:21] be a really [01:04:22] great question [01:04:22] awesome [01:04:28] uh [01:04:30] mod any [01:04:33] anyone else [01:04:34] have a [01:04:34] oh I do see [01:04:35] Irvin on stage [01:04:36] sorry [01:04:36] let me uh [01:04:37] pass it over [01:04:38] to Irvin [01:04:39] over to you [01:04:40] anything you [01:04:41] want to ask [01:04:41] Jeff [01:04:42] sorry [01:04:48] the mute thing [01:04:48] always gets me [01:04:49] so [01:04:50] Jeff [01:04:51] Jeff [01:04:52] I absolutely [01:04:53] have a question [01:04:54] for you [01:04:54] and it's a [01:04:55] question I ask [01:04:56] every guest [01:04:56] and I apologize [01:04:57] to the moderators [01:04:58] because it will [01:04:58] sound similar [01:04:59] um [01:05:00] I just wanted [01:05:01] to take a [01:05:01] quick second [01:05:01] um [01:05:02] I know [01:05:03] one of our [01:05:03] topics [01:05:03] is mentorship [01:05:04] and I wanted [01:05:05] to call out [01:05:06] Russell [01:05:07] he taught a [01:05:09] class for the [01:05:09] army about [01:05:10] a month ago [01:05:11] and Russ [01:05:13] I wanted to [01:05:13] let you know [01:05:14] that everyone [01:05:14] who took the [01:05:15] SANS test [01:05:16] from your uh [01:05:17] your topic [01:05:18] passed today [01:05:18] so that was [01:05:19] a hundred percent [01:05:20] passed for you [01:05:21] I know you [01:05:21] love pouring [01:05:22] into the [01:05:23] community [01:05:23] um [01:05:24] you introduced [01:05:25] me to this [01:05:25] platform [01:05:26] but I just [01:05:26] wanted to let [01:05:27] you know [01:05:27] that we all [01:05:28] passed [01:05:28] and it's uh [01:05:29] a hundred percent [01:05:30] uh thanks to [01:05:30] you [01:05:31] thank you for [01:05:31] that [01:05:31] um [01:05:32] congratulations [01:05:33] yeah [01:05:34] no [01:05:35] yeah [01:05:36] um [01:05:36] Jeff we are [01:05:37] at the beginning [01:05:38] of our journey [01:05:39] and you [01:05:39] and everybody [01:05:40] here is [01:05:41] um [01:05:42] like has a [01:05:43] ton of [01:05:43] experience [01:05:44] would you [01:05:46] recommend [01:05:46] because we're [01:05:47] transitioning [01:05:47] I bring it [01:05:48] up every week [01:05:49] and I apologize [01:05:49] in advance [01:05:50] um [01:05:51] but we're [01:05:52] transitioning [01:05:52] from a very [01:05:53] structured [01:05:54] organization [01:05:54] to this [01:05:55] kind of [01:05:55] wild west [01:05:56] of what [01:05:57] job do you [01:05:57] want to do [01:05:58] in cyber [01:05:58] and we're [01:05:58] like there's [01:05:59] more than [01:05:59] one job [01:06:00] um [01:06:01] would you [01:06:01] recommend [01:06:02] organizations [01:06:02] that have [01:06:04] large [01:06:05] um [01:06:06] cyber teams [01:06:07] where we [01:06:07] can kind [01:06:07] of fade [01:06:08] into the [01:06:08] background [01:06:08] and [01:06:09] kind [01:06:10] of just [01:06:10] learn [01:06:11] or [01:06:12] would [01:06:12] you [01:06:12] recommend [01:06:12] just [01:06:13] like [01:06:13] like you [01:06:14] like you [01:06:14] did [01:06:15] like [01:06:15] go to [01:06:15] a [01:06:15] startup [01:06:16] and [01:06:16] just [01:06:16] jump [01:06:17] into [01:06:17] the [01:06:17] deep [01:06:17] end [01:06:17] and [01:06:17] figure [01:06:18] it [01:06:18] out [01:06:18] as we [01:06:18] go [01:06:19] what would [01:06:20] you [01:06:20] recommend [01:06:20] to [01:06:20] to [01:06:21] people [01:06:21] at [01:06:21] the [01:06:21] beginning [01:06:21] of their [01:06:22] journey [01:06:22] yeah [01:06:24] that's a [01:06:24] phenomenal [01:06:24] question [01:06:25] and I [01:06:26] think [01:06:26] it [01:06:26] definitely [01:06:26] depends [01:06:26] a little [01:06:27] on [01:06:27] some [01:06:28] of [01:06:28] maybe [01:06:28] their [01:06:29] work [01:06:29] in [01:06:29] their [01:06:30] their [01:06:30] schooling [01:06:31] and [01:06:31] university [01:06:31] years [01:06:32] that [01:06:32] they [01:06:32] did [01:06:33] have [01:06:33] I mean [01:06:33] I feel [01:06:34] like [01:06:34] a lot [01:06:34] of the [01:06:34] universities [01:06:35] have [01:06:35] these [01:06:35] cyber [01:06:36] programs [01:06:36] I know [01:06:37] someone [01:06:37] mentioned [01:06:38] on this [01:06:38] call [01:06:39] so far [01:06:40] that [01:06:40] are [01:06:42] actually [01:06:42] I think [01:06:42] on a [01:06:42] previous [01:06:43] call [01:06:43] working [01:06:44] on [01:06:44] MS [01:06:45] in [01:06:45] cybersecurity [01:06:45] so I think [01:06:47] it definitely [01:06:47] depends [01:06:47] on your [01:06:48] experience [01:06:48] but I [01:06:49] do [01:06:49] I do [01:06:51] think [01:06:51] a little [01:06:52] bit [01:06:52] of [01:06:52] experience [01:06:53] in that [01:06:53] fade [01:06:53] in the [01:06:54] background [01:06:54] where [01:06:54] you're [01:06:55] not [01:06:55] the [01:06:55] guy [01:06:56] or [01:06:56] gal [01:06:56] for [01:06:57] any [01:06:57] specific [01:06:58] thing [01:06:58] and [01:06:59] like [01:06:59] the [01:06:59] world [01:06:59] is [01:06:59] not [01:06:59] going [01:06:59] to [01:07:00] explode [01:07:00] if [01:07:00] you [01:07:00] don't [01:07:01] do [01:07:01] X [01:07:01] Y [01:07:01] Z [01:07:02] I [01:07:02] think [01:07:03] that [01:07:03] is [01:07:03] a [01:07:03] great [01:07:03] place [01:07:03] to [01:07:04] start [01:07:04] I [01:07:04] mean [01:07:04] I [01:07:04] had [01:07:05] that [01:07:05] at [01:07:05] consulting [01:07:07] I [01:07:08] also [01:07:08] had [01:07:08] that [01:07:08] in [01:07:09] the [01:07:09] hospital [01:07:10] I [01:07:10] mean [01:07:10] when you [01:07:11] think [01:07:11] a [01:07:12] hospital [01:07:12] you [01:07:12] don't [01:07:13] think [01:07:14] large [01:07:14] security [01:07:14] programs [01:07:15] especially [01:07:15] in 2008 [01:07:16] when I [01:07:16] was [01:07:16] doing [01:07:17] this [01:07:17] but [01:07:17] this [01:07:17] is [01:07:18] a [01:07:18] huge [01:07:18] hospital [01:07:19] system [01:07:20] so [01:07:20] I [01:07:20] had [01:07:20] support [01:07:21] and [01:07:21] folks [01:07:22] that [01:07:22] were [01:07:22] a lot [01:07:22] more [01:07:22] experienced [01:07:23] than [01:07:23] me [01:07:23] so [01:07:24] I [01:07:24] do [01:07:24] think [01:07:24] the [01:07:24] mentorship [01:07:25] thing [01:07:25] security [01:07:26] is [01:07:26] tremendous [01:07:27] because [01:07:27] I [01:07:27] like [01:07:28] we [01:07:28] all [01:07:28] know [01:07:28] that [01:07:29] just [01:07:29] knowing [01:07:29] how [01:07:29] to [01:07:30] write [01:07:30] code [01:07:30] really [01:07:30] well [01:07:31] or [01:07:31] even [01:07:31] how [01:07:31] to [01:07:31] like [01:07:32] you [01:07:32] know [01:07:32] write [01:07:32] exploit [01:07:33] code [01:07:33] and [01:07:34] do [01:07:35] pen [01:07:35] testing [01:07:35] or [01:07:36] red [01:07:36] teaming [01:07:36] still [01:07:37] doesn't [01:07:37] make [01:07:37] you [01:07:37] a [01:07:38] great [01:07:38] security [01:07:38] professional [01:07:39] you [01:07:39] need [01:07:39] those [01:07:39] human [01:07:40] elements [01:07:41] and [01:07:41] business [01:07:42] acumen [01:07:43] to [01:07:43] be [01:07:43] able [01:07:43] to [01:07:44] bring [01:07:45] issues [01:07:46] network [01:07:48] with [01:07:48] folks [01:07:49] and [01:07:49] be [01:07:49] able [01:07:49] to [01:07:49] learn [01:07:49] kind [01:07:50] of [01:07:50] what [01:07:50] does [01:07:51] a [01:07:51] CEO [01:07:51] care [01:07:52] about [01:07:52] What [01:07:52] does [01:07:53] he [01:07:53] think [01:07:57] I [01:07:58] think [01:07:58] my [01:07:59] recommendation [01:08:00] to [01:08:00] folks [01:08:01] starting [01:08:01] out [01:08:01] would [01:08:02] be [01:08:02] to [01:08:02] really [01:08:02] just [01:08:03] diversify [01:08:03] and [01:08:04] really [01:08:04] just [01:08:04] have [01:08:05] a [01:08:05] mentor [01:08:05] that [01:08:06] has [01:08:07] done [01:08:07] it [01:08:08] and [01:08:08] is [01:08:08] in [01:08:08] a [01:08:08] place [01:08:08] where [01:08:09] you [01:08:09] want [01:08:09] to [01:08:09] go [01:08:09] and [01:08:10] find [01:08:11] out [01:08:11] the [01:08:11] areas [01:08:12] where [01:08:12] you [01:08:12] need [01:08:12] to [01:08:13] learn [01:08:13] so [01:08:13] maybe [01:08:14] that'll [01:08:14] start [01:08:14] maybe [01:08:15] you [01:08:15] start [01:08:15] at [01:08:15] a [01:08:16] big [01:08:16] company [01:08:16] see [01:08:18] what's [01:08:18] out [01:08:19] there [01:08:19] like [01:08:19] when I [01:08:20] was [01:08:20] at [01:08:20] Sony [01:08:21] there [01:08:21] were [01:08:21] departments [01:08:22] for [01:08:22] everything [01:08:22] threats [01:08:23] and [01:08:24] offensive [01:08:24] security [01:08:25] detection [01:08:25] response [01:08:26] kind [01:08:26] of [01:08:26] learn [01:08:27] what [01:08:27] all [01:08:27] those [01:08:27] things [01:08:28] are [01:08:28] and [01:08:29] it [01:08:29] was [01:08:29] great [01:08:29] again [01:08:29] being [01:08:30] in [01:08:30] my [01:08:30] position [01:08:31] where [01:08:31] was [01:08:31] a [01:08:31] director [01:08:31] of [01:08:31] security [01:08:32] and [01:08:32] operating [01:08:32] company [01:08:33] where [01:08:33] I [01:08:33] reached out [01:08:34] to [01:08:34] all [01:08:34] these [01:08:34] departments [01:08:35] I'd [01:08:35] say [01:08:35] what [01:08:36] can [01:08:36] your [01:08:37] shared [01:08:38] service [01:08:39] security [01:08:39] department [01:08:39] do [01:08:40] for [01:08:40] us [01:08:40] and [01:08:40] so [01:08:41] then [01:08:41] just [01:08:42] learning [01:08:42] that [01:08:42] and [01:08:43] then [01:08:44] if [01:08:44] before [01:08:45] mentioned [01:08:45] a [01:08:46] young [01:08:47] person [01:08:47] that [01:08:48] wants [01:08:48] to start [01:08:48] in the [01:08:48] field [01:08:49] maybe [01:08:49] they'll [01:08:50] see [01:08:50] one [01:08:50] of [01:08:50] these [01:08:50] shared [01:08:51] services [01:08:51] wow [01:08:52] that [01:08:52] was [01:08:52] awesome [01:08:52] I [01:08:52] want [01:08:53] to [01:08:53] get [01:08:53] into [01:08:53] that [01:08:53] or [01:08:54] they [01:08:54] want [01:08:54] to [01:08:54] take [01:08:54] the [01:08:54] management [01:08:54] route [01:08:55] and [01:08:55] kind [01:08:56] of [01:08:56] be [01:08:56] a [01:08:56] jack [01:08:56] of [01:08:56] all [01:08:57] trades [01:08:57] so [01:08:58] yeah [01:08:58] I [01:08:58] think [01:08:58] starting [01:08:59] in a [01:09:01] large [01:09:02] organization [01:09:03] where you [01:09:03] can feed [01:09:03] to the [01:09:03] background [01:09:04] and [01:09:04] then [01:09:05] taking [01:09:05] those [01:09:06] skills [01:09:06] to [01:09:07] go to [01:09:08] a [01:09:08] startup [01:09:08] where [01:09:08] they're [01:09:08] going [01:09:08] to [01:09:08] be [01:09:09] like [01:09:09] hey [01:09:09] you're [01:09:10] now [01:09:10] our [01:09:10] security [01:09:11] person [01:09:11] just [01:09:12] figure [01:09:12] ! [01:09:20] that [01:09:20] helps [01:09:21] us [01:09:22] give [01:09:22] us [01:09:23] some [01:09:23] guide [01:09:23] rails [01:09:23] so [01:09:23] thank [01:09:24] you [01:09:24] for [01:09:24] that [01:09:24] of [01:09:25] course [01:09:25] thank [01:09:26] you [01:09:26] thanks [01:09:31] serving [01:09:31] thanks [01:09:32] for [01:09:32] asking [01:09:33] your [01:09:33] question [01:09:34] hey [01:09:35] Pamela [01:09:35] how [01:09:35] are [01:09:36] you [01:09:36] anything [01:09:36] you [01:09:37] want [01:09:37] to [01:09:37] ask [01:09:38] Jeff [01:09:38] I'm [01:09:38] doing [01:09:39] fantastic [01:09:40] anything [01:09:41] you [01:09:41] want [01:09:41] to [01:09:41] ask [01:09:41] yeah [01:09:42] I [01:09:42] have [01:09:42] a [01:09:43] quick [01:09:43] two [01:09:44] part [01:09:44] question [01:09:44] for [01:09:45] Jeff [01:09:45] so [01:09:45] my [01:09:45] first [01:09:46] question [01:09:46] for [01:09:46] Jeff [01:09:47] is [01:09:47] if [01:09:48] you [01:09:48] were [01:09:48] not [01:09:49] the [01:09:49] CISO [01:09:49] at [01:09:50] pinwheel [01:09:50] what [01:09:51] would [01:09:51] you [01:09:52] be [01:09:52] that [01:09:55] is [01:09:56] a [01:09:56] great [01:09:58] question [01:09:59] and [01:09:59] I [01:10:00] think [01:10:00] if [01:10:00] I [01:10:00] was [01:10:00] not [01:10:01] the [01:10:01] CISO [01:10:01] pinwheel [01:10:02] at [01:10:02] a [01:10:02] company [01:10:03] to [01:10:03] which [01:10:03] I [01:10:03] think [01:10:04] again [01:10:04] we're [01:10:04] changing [01:10:05] really [01:10:06] the [01:10:06] space [01:10:07] of [01:10:07] finance [01:10:07] I [01:10:08] think [01:10:08] maybe [01:10:08] I [01:10:09] would [01:10:09] be [01:10:09] starting [01:10:09] my [01:10:10] own [01:10:10] company [01:10:11] what [01:10:13] that [01:10:13] company [01:10:13] is [01:10:14] I [01:10:14] haven't [01:10:14] thought [01:10:15] of [01:10:15] the [01:10:15] idea [01:10:15] yet [01:10:15] but [01:10:15] if [01:10:16] you [01:10:16] know [01:10:16] anything [01:10:16] and [01:10:17] can [01:10:17] think [01:10:17] ! [01:10:17] of [01:10:17] anything [01:10:17] please [01:10:18] you [01:10:18] know [01:10:18] hit [01:10:19] me [01:10:19] up [01:10:19] in [01:10:19] a [01:10:19] DM [01:10:20] because [01:10:20] I'm [01:10:20] definitely [01:10:20] open [01:10:20] to [01:10:20] ideas [01:10:21] but [01:10:22] yeah [01:10:23] so [01:10:23] maybe [01:10:23] something [01:10:24] along [01:10:24] those [01:10:24] lines [01:10:25] or [01:10:25] I [01:10:27] also [01:10:27] considered [01:10:28] going [01:10:29] to [01:10:29] the [01:10:29] law [01:10:29] enforcement [01:10:30] route [01:10:30] I [01:10:31] think [01:10:31] there's [01:10:31] something [01:10:32] truly [01:10:33] special [01:10:34] about [01:10:34] again [01:10:35] protecting [01:10:35] the [01:10:35] most [01:10:35] vulnerable [01:10:36] and [01:10:36] so [01:10:38] I [01:10:39] think [01:10:39] and [01:10:39] especially [01:10:39] in the [01:10:40] site [01:10:40] where [01:10:40] I [01:10:40] have [01:10:41] my [01:10:41] skills [01:10:41] in [01:10:42] cyber [01:10:42] so [01:10:42] whether [01:10:43] it [01:10:43] be [01:10:43] for [01:10:43] like [01:10:43] you [01:10:44] the [01:10:44] FBI [01:10:44] or [01:10:45] other [01:10:45] federal [01:10:46] agencies [01:10:46] has [01:10:48] been [01:10:48] something [01:10:49] I [01:10:49] considered [01:10:50] over [01:10:50] the [01:10:50] years [01:10:51] but [01:10:52] just [01:10:52] the [01:10:53] current [01:10:53] track [01:10:54] that [01:10:54] I'm [01:10:54] on [01:10:54] in [01:10:55] fintech [01:10:55] I'm [01:10:55] just [01:10:55] very [01:10:56] very [01:10:56] content [01:10:56] so [01:10:57] this [01:10:58] is [01:10:58] where [01:10:59] I'm [01:10:59] going to [01:10:59] stay [01:10:59] for [01:10:59] now [01:11:00] but [01:11:00] I [01:11:00] think [01:11:00] cybersecurity [01:11:02] gives [01:11:02] folks [01:11:03] so many [01:11:04] options [01:11:04] of the [01:11:05] areas [01:11:05] to go [01:11:06] into [01:11:06] and [01:11:06] there's [01:11:07] definitely [01:11:07] a huge [01:11:09] need [01:11:09] across [01:11:10] a [01:11:10] spectrum [01:11:10] of [01:11:11] different [01:11:11] industries [01:11:11] as [01:11:13] I [01:11:13] said [01:11:13] in [01:11:13] my [01:11:14] story [01:11:14] I [01:11:14] was [01:11:14] in [01:11:14] healthcare [01:11:15] and [01:11:15] finance [01:11:16] I [01:11:16] was [01:11:17] doing [01:11:17] consulting [01:11:18] for [01:11:18] a [01:11:19] medical [01:11:20] device [01:11:21] company [01:11:21] and [01:11:21] all [01:11:22] the [01:11:22] types [01:11:22] of [01:11:22] interesting [01:11:23] stuff [01:11:23] so [01:11:23] I [01:11:23] think [01:11:24] it's [01:11:24] such a [01:11:24] wonderful [01:11:25] field [01:11:25] to be [01:11:26] in [01:11:26] so [01:11:27] you [01:11:27] have [01:11:27] tons [01:11:27] of [01:11:28] options [01:11:28] and [01:11:28] so [01:11:29] yeah [01:11:29] I [01:11:29] think [01:11:29] those [01:11:29] would [01:11:30] be [01:11:30] the [01:11:30] couple [01:11:31] things [01:11:31] I [01:11:31] might [01:11:31] do [01:11:31] if [01:11:32] I [01:11:32] wasn't [01:11:32] doing [01:11:32] what [01:11:32] I'm [01:11:32] currently [01:11:33] doing [01:11:33] and [01:11:35] that [01:11:35] piggybacks [01:11:36] on [01:11:36] my [01:11:36] second [01:11:36] question [01:11:41] tries [01:11:42] to [01:11:42] excel [01:11:42] in [01:11:43] cybersecurity [01:11:43] but [01:11:44] has [01:11:44] no [01:11:45] interest [01:11:45] in [01:11:45] becoming [01:11:46] a [01:11:46] CISO [01:11:47] yeah [01:11:48] I [01:11:49] think [01:11:49] that's [01:11:50] a [01:11:50] great [01:11:50] question [01:11:51] I [01:11:51] think [01:11:51] the [01:11:52] answer [01:11:52] to [01:11:52] that [01:11:52] is [01:11:53] and [01:11:54] this [01:11:54] goes [01:11:54] back [01:11:54] to [01:11:55] the [01:11:55] previous [01:11:55] question [01:11:56] try [01:11:57] and [01:11:58] read [01:11:59] I mean [01:11:59] I'm [01:11:59] sure [01:11:59] there [01:12:00] are [01:12:00] books [01:12:01] and [01:12:01] something [01:12:01] I [01:12:01] would [01:12:01] love [01:12:01] to [01:12:02] look [01:12:02] into [01:12:02] for [01:12:03] you [01:12:03] about [01:12:04] the [01:12:04] different [01:12:04] aspects [01:12:05] and [01:12:05] different [01:12:05] types [01:12:06] of [01:12:06] cyber [01:12:06] careers [01:12:07] but [01:12:08] again [01:12:08] I [01:12:08] think [01:12:08] it's [01:12:08] really [01:12:08] great [01:12:08] to [01:12:11] your [01:12:13] in [01:12:14] branching [01:12:14] out [01:12:15] and [01:12:15] seeing [01:12:16] what's [01:12:16] out [01:12:16] there [01:12:16] so [01:12:17] I [01:12:17] mentioned [01:12:17] like [01:12:18] at [01:12:18] a [01:12:18] large [01:12:19] company [01:12:19] like [01:12:19] Sony [01:12:19] where [01:12:19] I [01:12:20] work [01:12:20] there's [01:12:20] a [01:12:20] global [01:12:21] shared [01:12:21] service [01:12:21] security [01:12:22] organization [01:12:22] to [01:12:23] which [01:12:23] all [01:12:24] the [01:12:24] operating [01:12:24] companies [01:12:25] for [01:12:25] example [01:12:26] like [01:12:26] Sony [01:12:26] Pictures [01:12:27] Sony [01:12:27] Music [01:12:28] and [01:12:28] all [01:12:29] the [01:12:29] other [01:12:29] companies [01:12:29] leveraged [01:12:30] for [01:12:31] security [01:12:31] services [01:12:32] so [01:12:34] it [01:12:34] was [01:12:34] just [01:12:35] it [01:12:35] was [01:12:35] such [01:12:35] an [01:12:35] unbelievable [01:12:35] opportunity [01:12:36] for [01:12:36] me [01:12:37] to [01:12:37] go [01:12:38] out [01:12:38] to [01:12:38] Virginia [01:12:39] where [01:12:40] this [01:12:40] shared [01:12:41] services located and just walk around and say, so what do you do? [01:12:44] What do you do? [01:12:45] What do you do? [01:12:46] And it's very likely you'll find something that is interesting to you. [01:12:49] And then a lot of these companies are very amenable to change course and to go into [01:12:57] something like that. [01:12:58] So I think just seeing all the different types of security roles would be such a [01:13:04] great thing for someone like you or an early person in their [01:13:11] cyber career to look into because some people just get pigeonholed into one area [01:13:17] when they might've been so much better off in something else. [01:13:21] So I think just, I think the large companies, it's a great way to pursue that. [01:13:27] Thanks, Jeff. [01:13:28] Of course. [01:13:29] Thanks, Pamela. [01:13:30] Thanks, Pamela. [01:13:32] Thanks, Pamela. [01:13:32] Thanks for asking your question. [01:13:34] There is a question in the chat before I get to DJ. [01:13:37] There is a question in the chat. [01:13:39] And the question is, not everyone is suited to work in a startup. [01:13:44] Skills aside. [01:13:45] What traits or temperament is needed to be a successful security person in a startup? [01:13:54] I think the, and I'm not saying this doesn't exist or would be required in a large company, [01:14:01] especially for security executives. [01:14:04] I mean, they need to be, um, have exposure to all the different facets of security and [01:14:10] different, different things there. [01:14:12] But a startup, I really think you need to be able to answer questions and, and be a subject [01:14:20] matter expert in things that you might never really work with before. [01:14:24] So you need to apply, you know, your security principles and ask probing questions to folks [01:14:32] to be able to help solve their problem. [01:14:34] Um, and so I think just being dynamic and a quick study and someone who's willing to, you [01:14:41] know, at the end of the day, be like, I'm going to go home and just spend maybe a couple hours [01:14:45] reading about this, um, new project or, or new tech stack that maybe a couple of engineers [01:14:52] want to use. [01:14:53] So I think you're, you, you almost have to play like investigator and you really just need [01:14:57] to be the one that can answer anything. [01:15:00] And you can't be afraid to ask folks. [01:15:02] I mean, I think that's why I think this, um, security community is so strong. [01:15:06] And I think this group here is amazing. [01:15:08] Um, but you have like things like that does like those CISO events and there are a lot of [01:15:13] other ones. [01:15:15] Um, I think speaking with your peers, um, I think it's great too, to be able to, again, [01:15:20] get knowledge that maybe you just didn't have. [01:15:23] So yeah, I think just being super dynamic, um, is, is really what, um, is required in a [01:15:31] startup environment where you might be the only security person. [01:15:34] So it's like your, your first few weeks, you're going to get some, an engineer is going to [01:15:38] be come up and like some of these engineers, these non-security engineers. [01:15:43] We'll just think, oh, this is a security person. [01:15:46] He or she knows the answer to my question. [01:15:47] And you might not know any idea. [01:15:49] It's almost like I, my brother used to joke, my brother's an attorney. [01:15:52] Um, and like, you know, right when he got his law degree, like, you know, our uncles were [01:15:57] asking questions about like law, like exactly. [01:15:59] I mean, like you have, it's just not how it works. [01:16:01] You don't like, or like asking a doctor about like some completely irrelevant or [01:16:05] something like not in their, um, expertise or their, their focus. [01:16:10] So, yeah, I think, um, just. [01:16:12] Um, the ability to stay dynamic, the ability to be. [01:16:15] And I think that's the desire to, to learn more. [01:16:18] Um, I think it's really required at a, in the startup environment. [01:16:22] Thanks, Jeff. [01:16:28] And thanks, Nanette for asking your question in the chat. [01:16:31] Hopefully that answered your question. [01:16:33] Yeah. [01:16:34] Thanks, Nanette. [01:16:34] Uh, DJ. [01:16:38] What it is. [01:16:39] What it do, dog. [01:16:41] How's it doing? [01:16:41] How's it going? [01:16:43] It's going. [01:16:44] It's going, man. [01:16:45] Go for it. [01:16:45] Go for what? [01:16:48] Uh, anything you want to ask Jeff this evening? [01:16:51] I ain't got no question for my man, but, uh, I hope he's, uh, I hope he's having an absolutely [01:16:58] best night though. [01:16:59] Yeah. [01:17:00] Thank you, DJ. [01:17:02] Definitely having a great night. [01:17:03] Nice cool night in Manhattan. [01:17:05] Um, great day. [01:17:07] So yeah, thanks for, uh, thanks for the well wishes. [01:17:12] Sounds good. [01:17:14] Jenny, over to you. [01:17:16] Anything you want to ask Jeff? [01:17:18] Sure. [01:17:19] Hey, Jeff. [01:17:20] Great information so far. [01:17:22] So I work in the, in the government space for state government. [01:17:26] And I'm curious about how you balance with a bunch of engineers, how you balance that tipping [01:17:35] point where engineers or your staff are designing something that provides an operational benefit, [01:17:42] but has security risks that are kind of on the edge of not being acceptable. [01:17:47] How do you balance the, the real passion and push for design for operations versus the risks of, um, security and cyber? [01:17:59] Yeah, that's, that's a phenomenal question. [01:18:01] I think that has to start with setting the culture of, we are not going to accept, um, new features that introduce cyber risk. [01:18:10] It's just not, I mean, again, there's, there's always a level of risk that you will end up accepting, but, um, yeah, that security is, especially when we're designing, you know, we have a process. [01:18:21] I mean, currently where we do, you know, a project review, and then we have our, our spike meetings about the technical implement implementations. [01:18:29] Um, yeah, all of that. [01:18:31] Um, so there, there will be gates where if it doesn't meet a certain risk threshold, if it goes beyond, um, what's acceptable, then it's not going to be released. [01:18:40] And I think that's also important that, you know, the CISO of this organization, and especially how it is in my current one, has that clout to be able to make it. [01:18:49] I know there are a lot of examples where security folks don't have that kind of pull. [01:18:54] And like, they'll say, well, this is terrible. [01:18:56] Um, but it still makes its way out the door. [01:18:58] Um, I think that's also a perk of being in a startup. [01:19:01] It's like, well, at least at our current juncture, like there aren't that many features. [01:19:05] So it's not like I'm drowning in things where I have to just kind of be like, oh my God, like, I think this is okay. [01:19:10] Um, I'm reading like two lines of an email and I have to give an approval. [01:19:14] Like it doesn't really work that way. [01:19:16] You know, we've structured the program where we vet and it needs to, um, you know, be a proper risk threshold. [01:19:24] And again, there might be outstanding actions where we say, this is okay to do this. [01:19:28] It's okay to release. [01:19:29] And we're going to want to button it up in our next iteration. [01:19:34] Um, but yeah, I think this is one of the most important aspects of the program is, is really vetting all of these new, um, you know, operational features to make sure they're, they're buttoned up. [01:19:47] That's awesome. [01:19:48] Thank you so much. [01:19:49] Thank you. [01:19:50] Thanks Jenny. [01:19:51] Thanks for, uh, joining us this evening and asking you a question of Jeff. [01:19:57] All right. [01:19:58] If anybody has any questions that they want to raise or sorry, that they want to ask Jeff, feel free to raise your hand and we will bring you on stage and you can ask your question live. [01:20:07] If you want to ask a question in the chat, cause you can't come up, feel free to put it there and I will read it off. [01:20:14] Uh, Octavia, I think you had a question you wanted to ask Jeff. [01:20:17] Yeah. [01:20:18] So I'll pass it over to you. [01:20:19] No, thanks Tomas. [01:20:20] Yes, I did. [01:20:21] Um, so, you know, one of the things that I do realize is sometimes when you take on a position that has a lot of visibility and a lot of demand and you're speaking to executives, you always wish that you knew something or wish that you had kind of like additional ammunition in your back pocket. [01:20:49] So Jeff, if there was something, and then we, we have this open forum, right? [01:20:55] Where we're really just trying to help everybody here. [01:20:57] Like everybody doesn't know the answers. [01:20:59] So if it was something that you wish you had when you went into this role and see, so a pinwheel or went into your, you know, first leadership position, what would that be? [01:21:12] And what lessons do you think, uh, you would have harsh lessons you think you would have avoided had you had that information? [01:21:21] Whew. [01:21:22] That's a good one. [01:21:23] That's like, uh, that's great. [01:21:25] I feel like that's like, uh, you know, the quintessential job interview question. [01:21:29] Can Jeff please list your, your five negatives right now? [01:21:33] Um, no, but I think it's a phenomenal question. [01:21:37] And I think in, um, I think when I started in FinTech, I think having a better understanding. [01:21:49] So this, this goes back to me a few years of, of the space. [01:21:53] Um, so I think the day that I stepped into the role, you know, I have armed with all of this cyber knowledge and how to protect an organization. [01:22:01] And as you said, like healthcare and, uh, media and entertainment and industries that I've been, but again, this was my first, you know, financial technology company. [01:22:11] So learning the ins and outs of how payments work and how, you know, I was familiar with that crypto work, but how payment rails work and how ACH works and not just, um, you know, superficial, like just like a one financer, but like how it actually works, where it flows, what are the risks and who, who's involved. [01:22:34] Um, I think that. [01:22:36] Cause as a CISO, you know, I think there's nothing worse than having someone who's dropping a bunch of like sniper things and we can do X, Y, Z and then like, they're, they're not speaking business language. [01:22:47] We're not talking about the risks to the company. [01:22:50] It's more generic. [01:22:51] And I think it just really lowers your credibility. [01:22:53] So yeah, I think, um, that is something that, um, I did then, and I will continue to do for spending time and really learning about the organization. [01:23:05] The space that we're in and the industry to make sure that I can be as valuable as we can. [01:23:11] No, I think that's great because it's important that, um, especially as a security executives, we sometimes think that. [01:23:22] We have to know like our primary role is securing the industry or securing our company, but the primary role is ensuring that the business can run and understanding the business so that it can be secure. [01:23:36] And so I think. [01:23:37] Great. [01:23:38] Right. [01:23:39] Um, so just kind of a second question there. [01:23:42] What is the importance of kind of understanding and like when you, cause you talked about Sony a lot, and then you talked about the healthcare realm a lot during this, uh, during your time on the stage here. [01:23:55] And so coming from where you were, when you initially starting in your career to where you are now, if you look back, what are some of the things that, you know, that you have learned around business and understanding the business and not just being. [01:24:13] A security person or looking at regulations or PCI or HIPAA or something like that, but really understanding the business. [01:24:22] Yeah, that's a phenomenal question. [01:24:24] I think it really just goes down to that business acumen, how to articulate things in the boardroom, how to speak to CEO and speak to leadership and really just be a part of that business conversation. [01:24:38] To be on that exact team. [01:24:40] So 10, 15 years ago, you know, I might be able to be armed with in the cyber and increased risk knowledge. [01:24:48] That's just very, um, I might not know how to articulate that and put together, uh, presentations that will be consumable and valuable. [01:24:59] Um, so I think that's definitely something in the past, you know, 10 years of just kind of seeing incentives and how to ensure that. [01:25:07] executive leadership wants, um, you know, to really support security program and really just in, as I think I said earlier, like really understanding what the CEO thinks the biggest risks are. [01:25:22] I think it's really supposed to be bi-directional here. [01:25:25] It's not just one, but I think it's also, you know, sometimes some of the most interesting ideas for securing an organization, the business has come from non-technical folks. [01:25:37] And I think that's really great too. [01:25:39] So just, um, yeah, I think that maturity through the years has been really, truly invaluable as valuable. [01:25:45] I think as the, you know, the learning how to write code and, um, you know, do web application hacking and stuff like that. [01:25:54] Um, I think it's really just that applying it to the business has been really phenomenal. [01:26:00] Okay. [01:26:01] Awesome. [01:26:02] Thanks. [01:26:03] Back over to Tomas. [01:26:04] Thanks Octavia. [01:26:05] Thanks moderators. [01:26:06] So, so Jeff Lucas, it's starting to wind down. [01:26:07] I'm going to do a, just a quick announcement and I'll ask you a final question and we'll, sort of bring us home. [01:26:22] But, um, just very, very quickly for those, uh, for those who are curious and who will be back here next week, we have Ian Hinchy, Hinchy, sorry, joining us. [01:26:36] Who's the founder at Tynes. [01:26:38] Uh, so tune in next week for that conversation. [01:26:41] It should be a very interesting one. [01:26:43] Uh, same date. [01:26:45] So it's not the same date, but same, same time on Wednesday, uh, next week. [01:26:50] So Jeff, I usually like to ask this question and it's a reflection question and you're not that old like me. [01:26:57] You're not an old guy. [01:26:58] Dad jokes today. [01:27:00] Uh, I know Octavia is not mad. [01:27:02] Uh, not that she gets mad, but she's not making fun of me for saying dad jokes, but you're not an old guy, right? [01:27:08] You're still relatively young in your career, but I think there's still opportunities for us, no matter where we are in our life to have a reflection moment. [01:27:16] So I'll ask you this question. [01:27:18] And it's a question I usually like to ask of our guests is if there was one piece of advice that you could give to the younger Jeff, what would it be and why? [01:27:29] That is an interesting one. [01:27:35] Um, I think, um, I would say choose your friends wisely. [01:27:51] Um, trust your gut. [01:27:52] Um, I think you are the company you keep. [01:27:57] I think surrounding yourself with good hearted, supportive people, um, it's definitely essential, uh, to grow to a successful person. [01:28:10] Um, so yeah, I think, um, just don't, don't spend time around negative people. [01:28:18] Um, and really just trying to surround yourself with family and people that are going to support you. [01:28:24] And I think that will go a really long way. [01:28:27] That's great advice. [01:28:32] Absolutely great advice. [01:28:34] Don't drain your energy by surrounding yourself with negative people or birds of a flutter, birds of a feather flock together. [01:28:41] Um, exactly. [01:28:43] Well, like my mom would say in honor of Hispanic Harris' Month, like my mom would say, [01:28:48] Dime con quien andas y te diré quien eres. [01:28:51] Tell me who you're walking with and I'll tell you who you are. [01:28:54] Right? Surround yourself with positive people and positive things will happen. [01:28:57] So, it's, uh, it's been a great show. [01:29:00] This, uh, great show. [01:29:01] It's been a great evening. [01:29:02] Uh, spending time with you, Jeff, getting to know you and a little bit more about you. [01:29:06] Uh, I'm glad you had a good honeymoon in Borobor. [01:29:09] I can't wait to make my way over there one of these days. [01:29:12] Uh, moderators, any final words for Jeff before we kind of wrap up? [01:29:20] I'll just say thank you for, for sharing your time with us. [01:29:25] Yeah. [01:29:26] Thank you so much as well. [01:29:27] Thank you so much everyone for the time. [01:29:28] This is absolutely wonderful. [01:29:30] Such a great program you have here. [01:29:33] Yep. Thanks, Jeff. [01:29:34] Thanks Jeff. [01:29:39] Well, thank you. [01:29:40] Thank you, moderators. [01:29:41] Thank you, Jeff. [01:29:42] Thank you everybody for tuning in and listening to this conversation and being part of this community and joining the community by asking questions and making a conversation what it was this evening. [01:29:51] So, uh, if you missed the beginning, feel free to listen to the playback. [01:29:55] It will be available in a few minutes. [01:29:57] Jeff, thank you again for, uh, for your time. [01:30:00] Thank you for taking the time out of your busy schedule to spend it with us, uh, and have a good rest of your evening and rest of your week. [01:30:06] Cheers, everybody. [01:30:07] I'll see you all or chat with you all next week. [01:30:10] Bye. [01:30:11] Thanks everyone.