Fireside Chat w/Jeff Peal

[00:00:00] Hello, hello. [00:00:16] Tomas, Jeff, how are y'all? [00:00:18] Good evening. [00:00:21] What's going on? [00:00:23] Can you hear me okay? [00:00:25] Yep, you come in loud and clear. [00:00:30] Loud and clear. [00:00:35] Russell, microphone check for you. [00:00:36] I think that was you, right? [00:00:37] I'm not looking at the app right now. [00:00:40] Yep, no worries. [00:00:40] Hey, Tomas. [00:00:41] Hey, Jeff. [00:00:42] Hey, everybody. [00:00:42] This is going to be amazing. [00:00:46] Russell, you got to lower that bar a little bit. [00:00:50] Man, we've got history. [00:00:51] I know what's about to happen. [00:00:54] I've sharpened my pencil. [00:00:55] I've got extra paper. [00:00:56] I'm ready to learn from you, my friend. [00:01:00] Katie, microphone check for you. [00:01:05] Hello, hello. [00:01:06] Hi, everybody. [00:01:08] Hi, Jeff. [00:01:08] Nice to meet you. [00:01:10] It's a pleasure meeting you as well, Katie. [00:01:13] Well, and I heard you say lowering the bar, and I'm like, I don't think so, sir. [00:01:17] I read your background, and there's no lowering the bar in this room. [00:01:21] Uh-uh. [00:01:25] Not really looking forward to this discussion tonight. [00:01:31] I'm happy to be here. [00:01:33] Just getting the room set up. [00:01:39] I'm getting Jeff's face plastered on the billboard there in the room. [00:01:44] Yikes. [00:01:46] There's also games or something like that on this room. [00:01:49] Is that one of the new features? [00:01:54] Play games. [00:01:55] Look at that. [00:01:57] Hypotheticals. [00:01:57] How does that work? [00:01:59] Hmm. [00:02:01] Who's? [00:02:01] I saw that before. [00:02:02] You can have some questions, and some people see all the answers, and some people don't. [00:02:08] So it takes a bit. [00:02:09] There's a little on the right-hand side. [00:02:11] If you start a game, you can see the rules and learn how to play it. [00:02:14] Oh, well. [00:02:15] I won't do that right now. [00:02:17] I kind of wanted to do it just to see what happens. [00:02:20] But I won't do that right now just in case it actually messes up this room. [00:02:23] I don't want to do that. [00:02:25] But interesting. [00:02:27] Interesting, interesting, interesting what Cardinals is trying to do. [00:02:34] So while we get started, [00:02:36] actually maybe Russell, you or Katie, [00:02:40] maybe you guys can add some topics on there, [00:02:43] on the room page there. [00:02:45] I kind of kick us off, if you don't mind. [00:02:48] I added in networking, [00:02:50] but maybe you can add in a couple of other keywords. [00:02:52] Hey, Lisa Beth. [00:02:55] Hey, hey, Tomas. [00:02:57] Hi, crew. [00:02:58] How is everybody doing tonight? [00:03:01] Doing fantastic. [00:03:04] Fantastic. [00:03:04] Everybody's getting back from RSA. [00:03:08] Big security conference out in California. [00:03:11] Whoever was, well, we were out there. [00:03:13] And I know, Lisa Beth, you were in two locations last week. [00:03:17] Yeah, yeah. [00:03:18] It's been a big travel week. [00:03:20] And I'm going to see Katie next week. [00:03:22] So, Chicago bound. [00:03:25] Yes. [00:03:25] Cannot wait. [00:03:26] Make sure you have some New York pizza in Chicago. [00:03:31] New York style pizza. [00:03:32] I'm sorry. [00:03:33] Are you telling me what kind of pizza to eat in my own town? [00:03:37] I'm telling Lisa Beth to have some New York style pizza in Chicago. [00:03:41] Oh, my goodness. [00:03:42] And hey, congrats, Katie. [00:03:44] It looks like there's some major news from your end, too. [00:03:47] What's that? [00:03:48] I just saw a press release that said you were named one of the leading women voices in cyber. [00:03:56] Like, rock on. [00:03:58] Yeah, thank you. [00:03:59] Yeah. [00:03:59] What I said earlier today, too, there were actually two that came out today. [00:04:03] One of them I knew about and my company had to approve another one. [00:04:06] I was like, well, when your image and your name are used in a press release that you didn't even know anything about, about being a lead. [00:04:14] I'm like, I've arrived without my consent. [00:04:17] My image. [00:04:18] I mean, that's it. [00:04:18] That's whatever. [00:04:19] You know, like, this is it. [00:04:20] I've arrived at being that cool. [00:04:22] You are now a public figure. [00:04:23] No, thank you. [00:04:24] You're now a public figure, huh? [00:04:26] I'm an influencer now because of this room. [00:04:29] Because of this room here. [00:04:31] It was very nice, though. [00:04:32] It's actually really coming off of RSA last week and getting a chance to see people in person again. [00:04:40] It is an honor to be considered a leader in such an innovative space. [00:04:44] So thank you, Lisa Beth, for saying something. [00:04:47] I appreciate that. [00:04:50] Congratulations, Katie. [00:04:51] I did not know that. [00:04:53] I'm looking forward to doing a quick Google and finding that announcement. [00:04:57] Oh, you posted in our chat, Katie. [00:05:00] Maybe if you have it, they post a link in our chat so we can all read it. [00:05:04] But congratulations to you. [00:05:06] So this is our weekly Fireside Chat. [00:05:09] And we do want to welcome you all back. [00:05:12] Sorry that we did not meet last week. [00:05:14] But as we were just chatting, we were at RSA. [00:05:18] At least the majority of the moderators were at RSA. [00:05:20] And we got the chance to meet in real life, in person, live. [00:05:27] Which was, I don't know. [00:05:30] It was rather interesting to get back into an in-person conference. [00:05:34] Hopefully nobody got sick because COVID is still around there. [00:05:38] It did kind of feel a little weird to be back with masks, without masks, and however you were comfortable. [00:05:45] But it was actually pretty fun to be back in person and to get to meet my esteemed colleagues who we've been chatting for, I want to say, over a year now, right? [00:05:54] On Clubhouse. [00:05:55] And we actually never met until last week. [00:05:57] So it was great to meet you all in person last week. [00:06:00] So this is our weekly Fireside Chat. [00:06:03] Thank you again for joining us. [00:06:05] If it's the first time you've joined us, we do this every Wednesday between 8 p.m. Eastern Time and 9.30 p.m. Eastern Time. [00:06:11] So we're going to go for, as you know, that's an hour and a half. [00:06:15] We're going to ask our guest this evening, and that is Jeff Peel. [00:06:18] We'll ask him questions for about 30 to 45 minutes or so. [00:06:21] And then we'll open up for the room for you or the audience to participate. [00:06:26] So you can raise your hand. [00:06:27] There's a little raise your hand icon on the screen. [00:06:29] And we'll bring you up on stage, and you can ask a question of our guest and join the conversation. [00:06:34] You could also use that little side chat feature. [00:06:38] There's an icon there on the left-hand side of the screen. [00:06:41] It has a little number on there. [00:06:43] It's starting to go up from 4 to 5. [00:06:45] That's the chat. [00:06:46] You can use that chat. [00:06:47] If you don't want to join us on stage and ask a question, you can ask a question there. [00:06:50] And we will make sure to read it off to our guest. [00:06:54] With that said, there are a few quick, very, very, very quick sort of ground rules for today's event, if you will. [00:07:04] Rule number one, let's have a good time. [00:07:05] Let's have fun. [00:07:06] It is Wednesday. [00:07:07] It is the middle of the week. [00:07:08] We have a few more days left in this week. [00:07:11] So I'm sure everybody's had a bit of stress. [00:07:14] But we've got a long weekend coming up in the U.S. [00:07:17] We've got Juneteenth, celebrating Juneteenth on Monday. [00:07:20] So hopefully you all can, one, understand what the importance is of Juneteenth. [00:07:27] But also enjoy some time off with your family. [00:07:30] And it is Father's Day weekend this weekend in the U.S. [00:07:34] So I know that should be a fun event for most people. [00:07:39] At least hopefully a fun event for most people. [00:07:44] If you do pop up on stage, we ask that you please don't try to solicit us or sell us on any of your latest and greatest products. [00:07:52] If you are a vendor in the room, this is a free and open space. [00:07:55] We're happy to have you. [00:07:56] But please don't jump up on stage and ask us a question or try to sell us on your solution, on your product. [00:08:03] Let's leave that for another time, another place. [00:08:06] Today we're really going to be focused on Jeff, learning a bit more about him and his journey and how did he get to where he is today. [00:08:13] So the last thing I'll say and the last sort of announcement, actually just two announcements. [00:08:20] One, if it is your first time, there's a little greenhouse on the top left of your screen right next to where it says Fireside Chat. [00:08:26] You can click that greenhouse and join our Fireside Chat Club. [00:08:29] And you can see who our upcoming guests are. [00:08:31] And then the last thing I'll say is for the majority of us, I guess, yeah, on the stage, maybe just me, my thoughts and opinion, our thoughts and opinion are our own and do not represent our current or prior employer. [00:08:45] So we ask that you please be mindful of that and respectful of that. [00:08:50] So without further ado, I'm just going to go around the room. [00:08:54] Jeff, we'll leave you for last. [00:08:56] We'll go around the room and introduce ourselves. [00:08:58] So I'm Tomas Maldonado. [00:08:59] I'm the CISO at the NFL. [00:09:01] Russell, over to you. [00:09:02] Thank you, Tomas. [00:09:04] It was amazing to get to meet you in person last week in real life. [00:09:07] Katie, you as well. [00:09:08] I got the biggest hugs. [00:09:09] I'm like, oh, this is awesome sauce. [00:09:11] And the only reason we skipped for last week was that, hey, Russell Eubank's been running my company, Security Ever After, for the last couple of years. [00:09:17] And teach a lot, mentor a lot, coach people to be CISOs for the first time a lot and just love this space. [00:09:24] And Jeff, I'm telling you, we've been looking forward to this conversation for months. [00:09:27] It took months to get on the schedule, get you here, and we're super excited to learn from you, my dear friend. [00:09:34] Katie, over to you. [00:09:36] Thank you, Russell. [00:09:37] Good evening, everybody. [00:09:38] Thank you for joining us, Jeff. [00:09:39] I am Katie Hanahan. [00:09:40] I am the Vice President of Cybersecurity Strategy for a boutique SI out of Chicago called IT Savvy. [00:09:46] I also run their VCSO program and am a VCSO myself. [00:09:51] I've been a moderator now for six or seven months in this room, and it never disappoints. [00:09:56] Just thank you, everyone, for joining us tonight. [00:09:59] And remember, please get your questions ready because we're looking forward to bringing you up on the stage in a little bit. [00:10:04] Thank you. [00:10:05] Over to you, Lisa Beth. [00:10:07] Hi. [00:10:08] Hi, everyone. [00:10:09] It's another great Wednesday. [00:10:10] My name is Lisa Beth Lentini-Walker. [00:10:13] I am the CEO of Lumen Worldwide Endeavors, which is a compliance ethics and corporate governance consulting firm. [00:10:19] I teach in some of my free time and I've written a book. [00:10:24] And I'm so excited to be spending the evening with Jeff, who I actually met in real life before tonight. [00:10:31] So I am so excited to have this time with all of you. [00:10:37] Awesome. [00:10:37] Thank you, moderators. [00:10:39] And it's good to have you here with us. [00:10:43] So, Jeff, why don't you take a few minutes, you know, or as long as you want, to introduce yourself. [00:10:49] And while you're introducing yourself, Jeff, I usually like to ask this opening question to kind of set the stage for the evening. [00:10:55] And that's the question around your origin story. [00:10:58] So why don't you tell us a little bit about your origin story as you get into your introduction this evening? [00:11:04] I will. [00:11:05] And thank you, Tomas. [00:11:08] Thank you, Kay. [00:11:09] Thank you, Lisa Beth. [00:11:11] And of course, Russell, thank you for this opportunity to be a part of this conversation in this community. [00:11:21] So my name is Jeff Peel. [00:11:23] I currently serve as the information security officer for a firm in Minneapolis called Sullivan Cotter. [00:11:34] Sullivan Cotter just purchased another organization, which we're spinning off into a technology entity called Clinician Nexus. [00:11:44] And I also serve as the information security officer for that new venture. [00:11:49] As part of my kind of personal endeavor, I also teach adjunct at a local college up until this semester. [00:12:05] So I stepped aside at the end of this semester, but I taught the cybersecurity course at Dunwoody College and then also taught online for Bismarck State College in North Dakota. [00:12:21] So I tried to immerse myself in the cybersecurity community and the industry to keep abreast of not only what's happening, but then also serve as a mentor to those that need it and trying to find a way and a path within the entity. [00:12:45] So as Russell mentioned, we have history. [00:12:53] And prior to this role with Sullivan Cotter and Clinician Nexus, I served as the information security officer for the Federal Reserve Bank of Minneapolis. [00:13:07] And I was with the Federal Reserve Bank of Minneapolis for for 20 years for for 20 years. [00:13:14] So and in the IT department and I tell the story that I was with the organization for 20 years. [00:13:24] I was on the same floor for 20 years. [00:13:28] I moved around on that floor. [00:13:30] So I enjoyed my career at the Federal Reserve. [00:13:36] And I can say that the beginning of my six year tenure of of serving as the information security officer started with meeting the esteemed gentleman, Russell Eubanks. [00:13:52] And we spent our first week together. [00:13:57] And we still finally reflect on that. [00:14:00] We spent a few days in Russell had just started with the Federal Reserve System in in Atlanta. [00:14:07] We spent a few days in Richmond. [00:14:11] We went back to our respective homes in the middle of the week. [00:14:16] And then we ended the week in Miami at at Durell at at one of the branch offices for the Atlanta District with the information security, the rest of the information security officer. [00:14:32] So Russell and I shared that that week long getting to know each other for the first time and actually embracing the role of information security officers for the first time. [00:14:44] In that meeting with Russell, he began to and maybe he likely doesn't know this, but he began to shape my view of of information security and being a leader and being . [00:15:11] evangelist, if you will, for information security. There are three things during my time working [00:15:24] in the role of information security officer in the three or four years that Russell [00:15:30] served as the information security officer and ultimately the CIO for the Atlanta district. [00:15:36] There are three things that I took away from our interaction, intentionality, collaboration, [00:15:42] and asking the question, why not? So those three things helped shaped my role and has continued [00:15:54] to shape my role as an information security officer. So I refer to myself as a servant [00:16:01] in this role. That's why I always remark as I serve as the information security officer. [00:16:11] I'm a father of two beautiful humans. One's an adult and one is almost an adult. And I'm a little excited [00:16:25] right now, not only to be a part of this conversation, but my son just surprised me and he came home today, [00:16:32] not only for my brother's wedding this weekend, but then also to spend some time with me [00:16:37] for Father's Day. He's the oldest. He's 21. My daughter is 17. [00:16:43] the opportunity to be a mentor for security practitioners. [00:16:57] Have served as a roadmap on how I handle and how I lead my security teams. [00:17:05] So my cybersecurity career started as, you know, kind of, I was the last one standing or the last one, [00:17:16] the last one standing, if you will, with an idea on how to solve a problem. So as I mentioned, [00:17:25] 20 years at the Federal Reserve Bank, and that's coming into the industry right after college. [00:17:32] I worked three years prior to the Federal Reserve in for IBM for as their desktop support [00:17:43] analyst or agent, if you will. So we, you know, configured and delivered [00:17:50] endpoints to clients and associates with IBM. And at the time we were working on the American [00:17:58] Express contract. So when I transitioned over to the Federal Reserve, I went over there as a desktop [00:18:08] support agent and did the same work, configured workstations and delivered it, helped troubleshoot [00:18:16] kind of the second level of desktop support, right? And had the desire to, you know, continue in this [00:18:27] career path, but not certainly crawling under work, under, under, under work desks and moving, you know, five, [00:18:37] five year old keyboards that had, you know, not only passwords under it, and Lord knows some, [00:18:44] some mothballs that, you know, could choke a donkey. But I wanted to expand my role within, [00:18:52] within the industry. And I knew I wanted to do it as a people leader. So I went back to school to, [00:19:04] to attain my master's degree, undergrad in business administration, to team my master's degree in [00:19:10] information technology, and I intentionally left a general, so I could experience all aspects of, [00:19:19] of, of, of, of, of, of, of IT. So from project management, leadership, um, technical, um, uh, [00:19:27] capability, uh, technical aspects, uh, of, of the program of, as well. So what got me into security, [00:19:37] um, at the time the Federal Reserve was looking at implementing wireless technology, um, in the [00:19:45] organization, but they wanted to do it in such a way that it was only, it was restricted to conference [00:19:53] room and not broadly, um, accessible across the building. Ultimately, it's now part of the, the, [00:20:01] the ethos of, of any organization, but at the time it was kind of new to the organization and how can we do [00:20:10] this? So that inspired me to, um, you know, start investigating and tinkering. And ultimately I, um, [00:20:21] a teen, my wireless, a sharp, uh, certification and, uh, a wireless network, um, administrator [00:20:31] certification, um, all in, um, all in pursuit of being, um, uh, an assistant to, uh, getting that [00:20:42] infrastructure in place. Uh, so at, uh, as I mentioned, I was the last one, uh, kind of standing, [00:20:50] but I was the one that brought the, the option of using directional antennas, um, to minimize, [00:20:58] uh, signal spillage, if you will, outside of the building. And I got the opportunity to work with our [00:21:05] building, our building, uh, uh, folks that we use directional antenna to put on the, the big, uh, [00:21:13] pylons or, or support walls to, to push the signal back in. And we were successful in doing that had [00:21:20] external scans that we had minimal, uh, signal spillage. So it was a great opportunity, not to, [00:21:26] not only to learn, but then to work outside of the technology space in order to, uh, reach a goal [00:21:35] or achieve, um, uh, the mission that we had set out to, to do. So that led me to, to really embrace, [00:21:46] um, cybersecurity. And it was from that perspective where it's technology and control. I realized that [00:21:54] we can go out and buy the new WISBank, um, uh, uh, uh, tool and, and implement it, and then we can [00:22:02] control it and kind of manage how people are going to, you know, uh, work within the system. They [00:22:11] can't do anything outside of it. So that was very naive of me at that time, but it was certainly, [00:22:16] um, an entree into the, the field of information security. So started as a access management. So [00:22:25] transition from desktop support into information security, access management, compliance, um, analyst, [00:22:32] uh, threat management, project management. I serve as, um, the information security manager at one [00:22:39] point, and then ultimately the information security officer. So at the end of that, uh, career or my [00:22:49] tenure at, um, at the fed, there was one thing that I took away from me. So if you can imagine now, [00:22:56] let's go back to 2019, um, we're in the midst of this pandemic. Um, we are trying to figure out how to [00:23:06] now, uh, achieve a new norm. Um, I was also planning or were at the, at a point in my career, [00:23:17] transitioning from the fed to another, um, organization. And the one thing that, that came back to me, [00:23:25] um, was the need for, um, and the importance of our engagement with people in order to achieve, um, our goals. [00:23:38] Um, and, and I left the, the, the federal reserve knowing that whatever, whatever opportunity [00:23:47] came my way, um, that will be met head on with, uh, an intentional, um, engagement with, uh, the, the end [00:24:00] user, uh, an open space to collaborate with the end user and the ever, uh, inquisitive mind of, of, of asking, [00:24:15] well, why not, why not that idea? Um, or why not this, um, option? Why not that crazy, um, uh, uh, or, uh, [00:24:27] thought that, that crossed somebody's spine. So that led me from transition from the federal reserve into, [00:24:35] um, my beginning, uh, stages of teaching over at Dunwoody for a few months. And then ultimately, [00:24:44] uh, ultimately through this, uh, semester and then into my role as, um, the information security officer [00:24:52] for Sullivan Cotter and clinician Nexus. So I'll wrap up with, um, these few things. So my philosophy, [00:25:02] um, as a leader and as an information security leader, uh, is twofold. One, we're practitioners [00:25:11] and then two, we're in power words, right? So practitioners in that we understand, [00:25:18] or we try to understand what are the threats and potential risk impact to the organization and try [00:25:24] to minimize that in, in whatever way we can empower words. Uh, I don't know if that's a word, but I like [00:25:32] it and I'm gonna continue to use it. Um, from the perspective of engaging, intentionally engaging with [00:25:42] our constituents, if you will, to raise their awareness and empower them to be part of that, [00:25:50] um, of that solution for, uh, security awareness and security control. So my philosophy is this, [00:26:00] uh, look for and seek out other opinions, um, you know, in a room actively across the organization, [00:26:10] but not rely, uh, purely on, on just your, um, understanding, uh, embrace constructive criticism, [00:26:22] uh, empower the quiet voices. This, um, to me is, is critical, not only for the, uh, [00:26:35] uh, the minorities and across the minority is, uh, just a general, uh, kind of, uh, descriptive there, [00:26:42] but the minorities in the room, but also the folks that are, you know, lack the, the, the empowerment [00:26:52] to raise their voice. We need to be advocates for, for those, for those folks, um, leave learned [00:27:00] and leave, uh, uh, but never leave worse than. So leave, um, an organization or leave a project [00:27:11] understanding both from the successes and both from the fail, from the successes and the failure. [00:27:19] Um, I know we often, um, talk about, boy, I really learned from what didn't go right. [00:27:26] And sometimes we overlook the nuggets of, um, of wisdom that we also gain from success, not just the, [00:27:40] the fanfare and the celebration, but the journey to, to that end, um, or even what happens, how did you [00:27:48] change after you were successful or if you change those things are also, um, uh, are also, uh, critical [00:27:58] and crucial in our, in our development. So all of that, I think, um, uh, plays into what I like to, [00:28:08] and I had this written on my whiteboard and, in, in, in, in my office at the federal reserve plays into [00:28:20] what I like to call the culture, my culture, um, for the team and my culture or our culture [00:28:30] for information security. And again, it starts with collaboration. [00:28:34] It starts with, it starts with collaboration, understanding the mission and then setting, um, [00:28:43] attainable goals and not just unilaterally setting those attainable goals. It's working collaboratively [00:28:50] with your team, with, uh, stakeholders, um, uh, to, to ensure that, uh, those goals are, uh, attainable. [00:29:00] And it's something that is collectively supported, um, by, by everyone leading by example and empowering [00:29:10] folks to lead from any position. Um, I really thrive on, uh, junior, um, uh, practitioners standing up, [00:29:24] taking charge and really getting, um, into not maybe some of them are getting into the weeds and some of them [00:29:33] are rising above and looking strategically across, but that really, uh, drives me and, and gives me a sense of, [00:29:42] of, uh, of pride when I see that happening. [00:29:44] Trust is critical. Um, if, uh, if we want a culture that it, that feels supported and, and feels, um, [00:29:57] empowered to, to do what they need to do and, and really work above and beyond what, um, is, you know, [00:30:05] typically expected, is expected in the day. And from a leader's perspective, understanding the unique [00:30:13] personalities that, that make up your team, right? So not everyone is going to think the way you think, [00:30:21] not even, not everyone is going to approach a problem the way you approach a problem, but, but, [00:30:28] um, but we have to put in, or we have to allow, uh, an environment within which folks, um, uh, feel [00:30:38] trusted, respected and empowered to do their best work. So that's how I, um, kind of, uh, not kind of, [00:30:48] that's how I execute my philosophy. So I'll pause there and, and see if there's any questions or if, [00:30:57] uh, if there's anything additional I need, uh, you would like for me to elaborate on. [00:31:02] No, that was, that was, that was great. And thank you for, for that. Um, and I do see Hussain, [00:31:10] Hussain, thanks for joining us. We'll, we'll let you get warmed up and introduce yourself in a second, [00:31:13] but Russell, I'll pass it over to you. Thanks Tomas, Jeff. Wow. What a rich, um, [00:31:20] outline there. And I'll tell you the view from your office, uh, of the mining Mississippi, just a [00:31:25] gorgeous thing. And I miss that, miss seeing you and look forward to being together in person, [00:31:29] like we have so many times, you know, Jeff, you talked about this idea of lead from any position, [00:31:35] which I love. And then you talk about empowering the quiet voices. I'm thinking, yep, got to do that [00:31:39] too. And then thinking of, you know, asking why not being intentional, um, mentoring practitioners, [00:31:47] especially those, I mean, cause it's like your own journey. You gotta go from the entry level to [00:31:52] leading a very large teams on an important mission. Uh, how do you, how do you do all that? [00:31:59] As you're thinking about all these things, I'm like, okay, I need to do that. I need to do that. [00:32:02] How do you make those decisions of which role, which attribute, which characteristics of your [00:32:08] character to, to kind of lean into? I'd be afraid I can't get anything done for, for being more and [00:32:14] more like Jeff. How do you make those decisions of where to spend your time to make sure that you are [00:32:18] all those things and an effective security leader? Uh, great, great question. And Russell, and, and [00:32:25] yes, I do miss that view from, from the office overlooking the Mississippi, but, uh, the new [00:32:31] opportunity is, is, is provides, uh, a brighter future if you will. But, um, yeah, so how do I, how do I [00:32:41] manage my time and how do I, how do I, um, in other words, be present, um, uh, for opportunities that, [00:32:54] that, that may come up or the practitioners that, that, that need help? Uh, there are two things, [00:33:02] uh, two things that, um, that, that typically come to mind and, and folks get annoyed with me when I, [00:33:12] when I, when I say this, but I'm not Australian, but I love the phrase, no worries. [00:33:20] And there, the, the other phrase that, that, that I love as well and use constantly is nobody's dead, [00:33:29] dying or about to die. So with those two, um, kind of, uh, phrases in my mind, I know whatever is [00:33:40] presented, we can resolve, right? So it's a matter of time and opportunity. And how do we invest some [00:33:51] time in there? So nobody's dead dying, nobody's dead dying or about to die means that we can prioritize [00:33:58] whatever we have in flight in order to, uh, address the, the, the current, you know, issue ahead. [00:34:07] And sometimes the current issue at hand really isn't an issue that can be, you know, tabled for [00:34:14] another time or another conversation. We can, uh, stay the course and continue on. [00:34:20] But the one thing I think that helps me the most is that I've been told, and, and there are times [00:34:32] where I feel that I listen very attentively, not to solve, but just to hear. Now I have to caveat that [00:34:45] because most folks that are in relationships, they know that, you know, when your partner comes to you [00:34:52] and say, Hey, did this, that, and this is happening. You, all you want to do is like, well, just move it [00:34:58] from there to here. And then typically that isn't what the problem is. You just need to shut up and listen. [00:35:04] I do that better at work than I do at home sometimes. Um, but, uh, but that's kind of the, [00:35:16] the aspect of my personality that helps me the most, right? Where I can sit and listen and have, [00:35:24] um, an attentive ear, but not one to solve a problem, but to hear what's happening. And then from that [00:35:32] that reflect on what else do we have in flight or what else do we have at our disposal that could help, [00:35:41] uh, resolve this issue. Um, the, there was a book that I, I read it, the black swan. I'm pretty sure [00:35:51] everyone is aware of that. Um, I was going through, uh, uh, uh, uh, a divorce at the time and my mentor [00:36:00] at the bank, we had just started the mentor program and he came and we met the first time. And, you know, [00:36:06] I'm a wreck cause this is happening in my personal life. And, and he, he, he, he, he [00:36:15] mentioned this book and he told me to read it because you're not going to read the whole thing. [00:36:20] He goes, you read the first hundred pages. And I think it's going to at least [00:36:25] give you a place to start thinking about, uh, things a little differently. And, and he was correct [00:36:32] at, after the first hundred pages, what I took away from that was, you know what, you know, [00:36:41] you know what you don't know, and you don't know what you don't know. [00:36:45] How you rebound, how you recover from that last, you don't know what you don't know really sets [00:36:57] the path forward, um, for, for an individual. So that's always played in my mind that every objective, [00:37:07] every strategy that we embark on, I have a running kind of, uh, scenario of, I know what I do know about [00:37:19] this. I know that we need to have some, uh, sort of backup, um, for, for this. And the resiliency is the, [00:37:31] you don't know what you don't know, but that resiliency comes in by way of relying on those two, [00:37:38] those two, the first two areas. So that's, that's what kind of plays in my mind, Russell, [00:37:45] when, when I'm engaging with stakeholders, when I'm engaging with, um, uh, with, with, uh, uh, with, [00:37:54] with folks that report up to me, or even, um, as I'm learning now with a 20 year old son living on his [00:38:01] own in another state, you know, our interactions together is, you know, make plans to, you know, [00:38:09] have some provisions if something were to go sideways. And then if, if things really go sideways, [00:38:15] you know, make sure you follow these fundamentals. So, uh, uh, in order to, to, to recover and be, [00:38:22] you know, be ready for, for those curve balls, if you will. [00:38:26] So that's awesome. Well, thanks so much, uh, Jeff Katie, uh, over to you. [00:38:32] Yeah. Thank you, Russell. Um, yeah. So I'm, I'm intrigued by, um, your why or why not? I would [00:38:39] like to drill into that a little bit more. And the reason I'm asking that is because you've been very [00:38:44] articulate and going through, um, all of the different ways that you have had to choose why or [00:38:50] why not in various, um, aspects of your career, whether it's a mentor, whether it's a practitioner, [00:38:55] an empowerer, by the way, I don't know if that's a word either, but I love it. [00:38:59] So please keep using it. I might steal it from you. I will give you credit. I promise. [00:39:03] Um, but my question is really when you're, when you're deciding, I'm at the point in my career when [00:39:09] I'm, you know, either, you know, mentoring or deciding to, um, you know, bring someone new into [00:39:15] my organization. I mean, the why and the why not can sound almost flippant, but I know it's not [00:39:20] having heard you for the last, you know, 30 minutes. Um, but what are the, what are the things [00:39:25] that you think about when you're going through your why or your why not, as it relates to [00:39:30] the investment that you make in individuals and your organization, as you grow your team? [00:39:35] Um, this is all kind of new to me. I'm in, um, kind of, uh, this is one of the first times in my [00:39:39] career where I'm, I'm growing a, uh, aspect of a business and growing a team and leading [00:39:45] a division. And, um, so I just love to know your perspective, um, of what the, uh, you know, [00:39:51] why the, why not? And when, when is it sometimes why not? And, and when is it, is it why? And what, [00:39:57] maybe some stories from your, um, experience. Yeah. Perfect. Okay. Thanks. Thanks for the question. [00:40:04] And it plays into my new role, um, as the information security officer for Sullivan [00:40:09] Cotter clinician, uh, a clinician nexus, um, coming over to, to that organization, um, uh, [00:40:18] the information security officer role was new. So they had an individual that was kind of spread [00:40:25] across infrastructure, uh, information security and, you know, a million other things that, uh, that [00:40:31] that person was doing. So they wanted to carve out specifically someone to focus on the information [00:40:37] security in order to position the organization as they kind of move into this next phase of growth. [00:40:48] So I took it on, I took it on, you know, head on. Um, and there are a couple of opportunities where I [00:40:56] saw right away where things were not being done at the cost of, you know, other [00:41:07] uh, projects or other priorities. And my question, uh, to, uh, stakeholders and individuals that, [00:41:19] you know, made those decisions were, well, why not? Why aren't we doing those things? [00:41:25] And it came down to, you know, most of the time was budgetary, uh, reasons or, or, um, resource [00:41:36] constraints. And my approach in the first few months, um, with the organization was [00:41:46] including the risk impact to the organization. If we didn't do this. So regardless of, of, of, [00:41:58] budgetary constraints or, uh, resource constraints, if we don't do this and we are part of a breach or [00:42:06] we're affected in some way where our clients lose their confidence in the product, resource [00:42:15] constraint and budgetary constraints is going to be the last thing on your mind. We need to figure out [00:42:20] a way to make this, um, a priority. Now, Russell knows this because the, the, the system CISO for, [00:42:30] for, for, for the federal reserve before he left, use this phrase all of the time, risk-based threat [00:42:40] driven. That's the approach that I brought in to the organization. Let's make decisions in for [00:42:48] information security decisions that are informed by the threats that are out there that could impact [00:42:56] the organization and then the potential, uh, the potential, uh, risk impact to the organization. [00:43:05] And then let's make an informed decision, which will have budgetary impact and it will have, uh, [00:43:12] an opportunity for us to reallocate resources in order to address that. So that's been working [00:43:18] really well from a security objectives perspective from a personnel and empowerment and, um, personal [00:43:28] growth, uh, for, for individuals that report up to me. I look to that. What is in our bucket of, uh, [00:43:39] uh, for training opportunity that aligns specifically to better security, better compliance, better, um, uh, [00:43:53] more empowerment of, of, of our folks. And then use that, use that resource that the budgetary resources [00:44:00] is there very liberally, um, for folks to feel like they're getting the support they need for their [00:44:09] personal growth. And I emphasize feel because it isn't, it isn't something that I, we can quantify it [00:44:21] by throwing X amount of dollars into a pool and then that's what's used. But I think it, it, it has to [00:44:31] be married to the idea of, we are dedicated and we are, you know, intentional on making sure that the [00:44:42] folks that support this product, the folks that support this organization, um, have the tools [00:44:50] and they feel like they have the tools in order to be productive. So I'll wrap up with, with this. When I got [00:44:58] there, we had to establish the information security program, understand what our critical assets were, [00:45:04] you know, identify those, you know, Russell knows, as he's preachers all the time, know where inventory is [00:45:10] nowhere. Um, uh, who has access to it, how we manage that. So the, the, the top, top 10, right. Um, [00:45:19] Speaker 2. Um, but what I, what I, what I led with was this is an organization that, um, is part [00:45:30] consulting, consulting, and part, um, software as a service. [00:45:36] Speaker 2. Um, so we rely on people, we rely on processes and we rely on technology. [00:45:44] Is it, and I propose that instead of, uh, calling out a single thing, [00:45:52] Speaker 2. We have to collectively look at those three aspects of the organization [00:45:58] as the critical asset for the organization. So the people, our processes and the technology that we [00:46:05] use in order to provide services to our clients, that's our critical asset. If any one of those [00:46:13] fall by the wayside, we are in trouble. If we lose the good, if we lose good people within the [00:46:21] organization and lose, uh, primarily physically or emotionally detached from the organization, [00:46:30] we have a problem. If we lose the confidentiality and availability of the processes that we use, [00:46:37] that we rely on in order to provide those services to our clients, we're, we're in trouble. If we, if we, [00:46:44] if we have, um, uh, uh, uh, uh, security breach or a technical failure, um, within, uh, that affects [00:46:53] the technology that we rely on that provide services to our clients, we're in trouble. So, um, you know, [00:47:01] that's how I've been able to, for the last year, just over a year, been able to kind of start to shape [00:47:09] the information security program over, over at the, over at the firm. And if, if, if it isn't clear, [00:47:19] I hope I can reiterate the point that it isn't a singular, um, point of, of, of, of, of, of, of delivery. [00:47:31] It is a collaborative effort. So it's the consultants is the developers is the contractors, [00:47:40] and it's all of the associates. So it's never that you all need to do this. It's we, as a collective, [00:47:48] need to do this in order for us to be successful. [00:47:55] And now I can't help myself, but say, yeah, why not do that? Yeah. Perfect. Now, thank you. I really [00:48:01] appreciate that insight. Um, I was, I actually was taking notes this time. Thank you so much, Jeff. Um, over to [00:48:07] you, Lisa Beth. Great. Well, I'll, I'll just take a minute to, um, reset the room in case anybody's [00:48:14] joined us in the last, uh, 45 minutes or so. Um, but this is the fireside chat. If you haven't been [00:48:20] to fireside chat before, click on that little greenhouse at the top, so you can see what's [00:48:24] going on with this crew tonight. We've got Jeff, uh, here with us and we're chatting about his life, [00:48:30] some of his insights. Um, and we will be opening up the room to questions from the audience very [00:48:36] shortly. But before we do that, um, Jeff, I'm so glad that you're here. Let's start with that. Um, [00:48:43] and you know, I know that you are the parent of what I'll call emerging adults, um, and that you have been [00:48:52] teaching students for a long time. Um, one of the things I wanted to ask you is are there any go-to [00:48:59] resources that you think are critical, reads, listens, you know, watches, et cetera, for people who are [00:49:08] starting this journey that we like to call life, um, as, uh, emerging adults or as, you know, emerging [00:49:16] leaders in, in the professional world, what would you, what would you recommend? Great question, [00:49:24] Lisa Beth. And, uh, to, to everyone in the room, um, Lisa Beth and I met, um, obviously late [00:49:34] April or mid April. Yeah. Right around then it was early spring. Early spring. And in Minnesota, [00:49:41] there's no such thing as early spring. It's just late winter and then summer. [00:49:46] So true. Um, so we met late winter and had a really great conversation and, um, uh, I was excited [00:49:58] to participate in a conference, uh, that was going to be held here in Minneapolis. And, uh, if this is a, [00:50:08] if, if, if this is a safe room to share, um, I had a medical scare, um, I was with my dad, we were watching, uh, [00:50:21] a basket, the basketball game and I, for some odd reason, uh, passed out and had to be revived on his couch. [00:50:30] And that opened up, um, another kind of arena in my mind in terms of what am I, what am I doing? What [00:50:46] can I provide? Um, you know, and just the thought of, holy Christ, you just croaked on your dad's couch and [00:50:55] he scared him half to death. And, you know, um, and coming back from that and trying to figure out [00:51:01] what, um, what's next in, in this, in, in this opportunity that I have now to your question. Um, [00:51:11] it has always been for me to share with my students and anyone that is interested in, uh, the field of [00:51:23] technology, uh, because I say the field of technology, because if we look at information security, there's [00:51:29] so many things you can do with a security, um, function that it is overwhelming for someone to [00:51:38] say, I am going to be the, the guru of information security and, and know it all. Um, good luck. And I [00:51:48] wish you the best. Um, when I taught and, and today, uh, this fall when I open up, uh, my class, uh, at, [00:52:01] at Bismarck state, it is going to be about the fundamentals of information security or the [00:52:11] fundamental fundamentals of technology. And the question I usually ask folks are inquisitive [00:52:18] is that what do you want to do? What do you, what do you want to do in information security? [00:52:24] Do you want to be, um, a hacker? Do you want to be a developer? Do you want to be a leader? Do you [00:52:30] want to, you know, what is it that you want to do within this industry? And then from there, start [00:52:38] building, um, kind of your repertoire of, of, um, uh, of, of references and, and, and information to, [00:52:47] to learn. Uh, so I usually send the, the new, um, folks to, uh, information security for dummies or [00:52:59] CISSP for dummies or CNA for dummies. Cause that's where you get kind of the fundamentals, uh, of that area. [00:53:10] Um, and this last class that I taught, which was security one, we actually use, uh, the book, um, [00:53:19] from, uh, Kevin Mitnick, uh, the art of deception. That was part of our read, um, for that class. [00:53:28] Um, for folks that are kind of steeped in the, the industry and looking for other references, [00:53:39] um, to, to kind of expand their knowledge. Uh, Russell is also aware of this. We have a good [00:53:46] friend, Barry Dalton, who's the CISO for national, the national IT, um, division for the federal reserve [00:53:54] system. He was an evangelist for this book, the, the, the Phoenix project and every, uh, uh, information [00:54:04] security officer re, uh, meeting, he would reflect on the, the kind of the insights of the books and the [00:54:11] learnings from the book. And we would all give him a hard time of, man, you must be getting some nice [00:54:17] royalty checks because he keep pushing this book. When we went to work from home, I viewed 2019 and 2020 [00:54:29] as 2019, the Mike Tyson jab and 2020, the right hook from Mike Tyson. And at, and especially in [00:54:40] Minneapolis where we have, um, where we had so much, um, societal unrest, I started reading the Phoenix, [00:54:53] the Phoenix project. And I also read, um, uh, across that bridge by, uh, the late, uh, Senator John Lewis. [00:55:02] In fact, both of those kind of came back to one resounding theme, people, people, people, [00:55:14] right? So if we look at where we are, uh, from an information security prep perspective and for new [00:55:23] commerce to the industry to you know seasoned veterans people are the [00:55:31] greatest asset and the greatest liability to what we do we sit in the [00:55:37] middle of keeping the bad guys out and keeping the good guys honest and both of [00:55:44] those arenas are no kind of driven by the behavior and the varying personalities [00:55:55] of the carbon-based life forms that reside on either side so those would be [00:56:03] kind of you know from from for for newcomers like you know fine find a book [00:56:09] that is an intro level foundational understand kind of you know what are we [00:56:15] what are we doing what do you want to do and what do you need to do to prepare [00:56:20] for it and then for the seasoned veterans is to continue to embrace ourselves in [00:56:26] understanding this variable of human behavior and and how we can not not [00:56:34] control it because I've I've moved away from technology and control but how do [00:56:39] we embrace some of the nuances that each behavior or each person brings to the [00:56:45] table and try to mold that in support of as opposed to ensuring that they don't do [00:56:57] this so let's let's all support this path forward as opposed to using technology to [00:57:04] keep you from doing something something crazy that's great advice and I think [00:57:12] that we can all take a couple of notes from that I know that I'm gonna be [00:57:15] trying to make sure that I can connect with my kids and the people that I'm [00:57:20] working with I give them some of that good advice so thank you so much Jeff and [00:57:24] I'm really glad that you're sticking around with us for a little while longer [00:57:28] here because the world is a much better place with you in it thank you I'm [00:57:33] I'm really glad to be to be still here it's a different perspective when you [00:57:39] you know you you wake up a little bit differently the the idea of no worries [00:57:48] really is like yeah that's not a that's not a big deal and you know nobody's dead [00:57:56] dying or about to die although that was almost true it really kind of sets the the [00:58:01] table on how you approach problems right like unless you're a doctor and [00:58:07] somebody's really on the table and something's about to happen you know it's [00:58:11] a different it's a different it's a different situation you know I thinking [00:58:17] about that my dad and the emergency folks that were at the house but in our [00:58:23] line of work you know we can kind of step back and and take a beat to understand [00:58:33] what's happening and what we need to do to be more productive in trying to [00:58:39] address that problem because if we look at what we do on a day-to-day basis I mean [00:58:45] every organization and individuals here can reliably say their defense in depth [00:58:52] strategy is you know bar none we've got all the tools in place that if one fails we [00:58:59] have many others that can that can help in support of that failure but we can't [00:59:06] reliably say that if a person does something that circumvents those [00:59:13] controls that they understand the impact to the organization right so that's kind [00:59:21] of the the opportunity I see that you know we'll we'll invest in the technology as as [00:59:29] foundational but collectively if we all understand that what we do has a [00:59:38] meaningful impact to the organization because in some way or another if you do [00:59:43] it intentionally or you do it accidentally it could cost the [00:59:51] organization a significant amount of money embarrassment you can lose your job [00:59:55] we could all lose our job and that's the opportunity I feel that we have that we [01:00:02] need to know kind of embrace awesome so it is it is five minutes to 9 p.m. Eastern time [01:00:14] so we've got a good 40 minutes left yes in the session no I'm doing my math wrong 35 [01:00:23] minutes what am I thinking anyways if there are any questions from anybody in [01:00:30] the audience feel free to raise your hand and we will bring you up on stage I do [01:00:35] see Ryan Ryan want you go ahead and ask your question and we'll bring up other [01:00:40] folks as well thanks Thomas hi everybody hi Jeff nice to meet you thanks for [01:00:47] sharing so much great insight I think my question is around what keeps you going [01:00:57] most during the hardest moments before you said you know but between no worries and [01:01:05] if I apologize I think after the exact verbiage essentially like if no one's [01:01:09] bleeding or dying but you also shared that you you had your own personal health [01:01:13] care and it sounds like you know what what do you do during those moments when [01:01:16] it is time to worry how do you maybe how do you either get through it or get out [01:01:22] of that and what advice do you have to everybody when they are going through [01:01:25] those tough moments since it sounds like you have some great insight and [01:01:29] experience thanks Ryan it's also a pleasure to to meet you as well I know we [01:01:36] connected on LinkedIn for for me I don't know if it's a curse or a blessing I have [01:01:44] always been kind of an even keel an even keel personality and that is driven by [01:01:56] this obsession of not being the smartest person in the room but understanding [01:02:06] what the mission is right so so what does that mean that means that [01:02:13] understanding what the mission is is that you have I am a what-if person so [01:02:21] there's a lot at any given moment there's a lot of squirrels running around [01:02:25] in this in this noggin trying to to kind of play out what if scenarios so what if that [01:02:35] fails what do we have in play to to counter that what if we move this here what [01:02:42] will happen so that is always running in the back of my mind and typically when I am [01:02:52] working on a problem or a problem presents itself I don't know what I don't know [01:03:01] but I can I can you know reliably say that I do know what I do know and I do know what I [01:03:11] don't know and in that area I've run a couple of scenarios in my head that we can go to one of those [01:03:19] that will at least stop the bleeding and then have the opportunity to pause reflect and then look at broadly what's happening [01:03:30] the other part again is the fundamentals right so an information security [01:03:38] practitioner understands that the bad guys are going to do the reconnaissance and [01:03:45] then they're going to find the weakest point and then they're going to exploit [01:03:50] that point they're gonna get in escalate their their access try to pivot and then get the hell out [01:03:57] of those who don't know who don't know who don't know who don't know who don't know who don't know who [01:04:00] don't know who don't know who don't know who don't know who don't know who don't know who don't know who [01:04:04] arises, we need to start, I start thinking, where in that attack lifecycle are we? [01:04:15] So that gives you an opportunity to understand what's failed and where we need to start [01:04:23] engaging in some defensive strategies. [01:04:30] So that's one of the reasons why I teach, because I'm always engaged in the evolution of technology [01:04:45] and what's happening in the industry and actually putting that to practice in terms of either [01:04:53] a lecture or have had the opportunity of running cyber ranges over at another university here [01:05:02] called Metropolitan State University, running cyber range scenarios there. [01:05:09] So getting that practical exposure and exercising, kind of that noodling that allows, I guess, [01:05:20] me to then be able to reflect on different scenarios and kind of piece them together to solve a problem. [01:05:30] And sometimes, Ryan, it's like, okay, all right, so everybody take a beat. [01:05:35] Let's sit down. If we have a burden, let's take a sip and then come back to it. [01:05:43] Yeah, so that's that last part. I knew, you know, like you said, you say no worries and [01:05:46] no one's bleeding or dying, but there are those times too that it is time to worry, [01:05:51] but focus on the facts. So appreciate the answer. Again, nice meeting you. [01:05:54] And yeah, thanks for the connect on LinkedIn. [01:05:58] You're welcome. [01:05:58] Thanks, Ryan. Thanks for jumping up on stage and asking your question. And Ryan was another one that [01:06:06] we actually got to meet in real life last week at RSA. So it was fun meeting Ryan. Nate, over to you. [01:06:15] Anything you want to ask Jeff? [01:06:17] Yeah, thanks so much. Jeff, really appreciate you sharing your journey as well as some of the insights [01:06:24] into your philosophy. You touched on culture a good bit there, which is such a key component to any [01:06:30] organization and really kind of the embodiment of leadership. When it comes to security as a subset [01:06:36] of that culture or where security intersects within the culture of your organization, I mean, [01:06:40] a lot of us have faced [01:06:41] folks in organizations that kind of see security as in an adversarial stance or, you know, the house of [01:06:52] no or attacks on kind of existing business as usual. How do you start to turn the tide from a [01:07:00] cultural standpoint and really kind of embrace that security is something to be celebrated and [01:07:05] and issues are to be addressed and not necessarily a downfall or something to be looked down on? [01:07:12] Great question, Nate. I think it all kind of goes back to kind of the people power of the organization. [01:07:21] So if we reflect back on security as a problem, [01:07:27] as opposed to security as a service as it is now, security as a problem was we were the last one [01:07:37] to know what's happening in the organization. And we were the first one called when there was a problem [01:07:44] in the organization. So we were at a position where we could we could do nothing right, if you will. [01:07:52] Right. So if you're the last one called and the house is already on fire, it's like, well, [01:08:01] is everybody out? No? Well, the ones that are in there. [01:08:07] And if we're the the the first one called, but don't understand how those those decisions were made [01:08:17] and we're not going to be made for a situation that's going sideways. We're also in a position [01:08:23] where we're asking a lot of questions as opposed to providing providing options for solutions. [01:08:32] So what I tell my students and what I serve as as a, you know, information security cultural leader [01:08:44] is that we're in the role as consultants. We're in a role as advisory members. We are [01:08:55] we're not problem. We're not kind of the decision makers in in a sense, we provide options to folks [01:09:06] that are going to make a decision and we need to be at the table early in order to provide the most informed [01:09:16] options so the decision makers can make an acceptable balance decision. And again, going back to my previous [01:09:28] comment of the adage of threat driven and risk based when I engage with our advisory leaders and our [01:09:39] technology council folks, it's coming from that perspective of this is the threat. And if we don't [01:09:49] do this, this is the impact to the organization. So it's tangible. This is how we're going to feel it. If [01:09:57] we don't do this, it's not a pie in the sky is not that shiny object over there that's affecting everybody else. This one [01:10:06] here specifically for what we're doing. If this happens, we're going to be affected and we need to address [01:10:15] that. It makes it real to folks that the conversations can begin where we're looking at how [01:10:27] how do we then adjust either from a budgetary perspective or a resource perspective in order to [01:10:36] address that issue and then go back to where we were before. I am a staunch believer that people [01:10:46] are the greatest asset. I know we see all the stats that, you know, the weakest link is the people that [01:10:53] that you that you know, carbon based life learn between the chair and the keyboard. Yes, we are faulted. However, [01:11:01] if provided the right tool and training, we can actually use the people within the organization to be a [01:11:15] part of the security program, not affected by the security program. Once you're a part of it, [01:11:24] it's a thing that we need to do. If you're not a part of it is a thing that's being done to you. And that is [01:11:32] a harder kind of barrier to to to get over. What I've done, and I mean, I'm very proud of this. And I tell [01:11:43] people about it a lot. So at the Fed, when we started our information security awareness program, [01:11:53] we were at a click rate, a fish click rate at the Federal Reserve Bank in Minneapolis, each reserve [01:12:00] bank had a different kind of click rate percentage. But we started at 10%. When I left, we were at [01:12:13] three and a half percent. And it wasn't because we were beating people upside the head or public shaming [01:12:21] or, or anything like that. It was a intentional engagement with employees and a reward a risk reward [01:12:31] program. So the risk was, like, if you demonstrate that you are a habitual clicker, [01:12:40] then there is no other recourse than, you know, to put you in some remedial training, right? [01:12:50] If you demonstrate that you're someone that understands the training, you're getting the [01:12:55] information, you're actually reporting when we're having these tests. So that means it's resonating with [01:13:02] you. Then we're going to reward you. And at the Fed, we had a reward system that ranged from $25 in a gift [01:13:12] certificate, gift card for either Target or Amazon, that went all the way up to $100. And then a grand prize [01:13:21] of $500 for folks that reported successfully during the course of the year. For the habitual clickers, [01:13:29] you had to go through remedial training. And after the fifth or sixth time, it fixed fifth or sixth time, [01:13:35] it became a performance issue, just as it would be if you're on the line, the front line, and you keep [01:13:44] messing up the widget. After a while, it becomes a performance issue, and then you're shown the door. [01:13:53] That proved to actually engage people within the information security program, and they became active [01:14:03] participants in the overall program where we then spun off where if an individual reported an actual fish [01:14:13] that wasn't a test, that person was also raised up and rewarded as a human firewall. So those are the [01:14:23] opportunities I think we need to do across the organization and in engagement with the folks [01:14:31] within the organization. I've carried that over to my new role. It's not a bigger purse as it was [01:14:41] at the Fed, but I married that with the Know Before, Phish Alert, Phish ER technology. And we've had [01:14:53] instances where folks have used that Phish report button and have been able to [01:15:00] to allow the system to retrieve 19 malicious emails, 11 malicious emails in two different scenarios. And [01:15:10] those individuals are raised up and awarded. The phishing tests are still happening. I've been there a year. [01:15:19] So, in the year, we started with 14% when I got there. Today, our last Phish results from the test was 8.3%. And folks are [01:15:32] actively using the technology and using word of mouth via Teams. No, word of Teams and chat to report [01:15:46] suspicious and malicious activity. [01:15:49] Yeah, that's great. It makes a lot of sense with the praise in public, you know, reprimand behind [01:15:58] closed doors kind of approach. But also, you know, as you started out by saying, you know, keep [01:16:02] everything rooted in facts and focus on enablement. So thank you. Thank you. I really appreciate it. [01:16:08] You're welcome, Nate. Thanks, Nate. Thanks for jumping on my stage to ask you a question. David, [01:16:15] good to see you. Over to you. There you go. Thank you. Thanks, Thomas. Sorry I missed you out at RSA. [01:16:24] And, and, and, and Jeff, man, what, every time you answer a question, it just seems to add more to my [01:16:31] question. But I'm going to keep it simple because I do, I like the fact that you have a people focus. I think [01:16:38] people is, people are paramount. And knowing that, what seems like we've got, what, 20 or 30, we got vacancies [01:16:49] enough to fill for 20 or 30 football stadiums. So human capital is probably the scarcest thing, aside from [01:16:56] once in a while money. But I wanted to ask you if, when you're dealing with folks that are on their career path, [01:17:04] how do you help them to understand the, their relevancy in the industry? I hear, I hear when folks talk, [01:17:14] they use words like, I'm trying to break in to the industry, which is already kind of says you don't [01:17:20] belong because you're trying to break in. So that kind of language using that kind of language or that [01:17:28] imposter syndrome language sort of, you know, puts them on the outside and not put them on the inside where they [01:17:34] actually belong and where they should be. But how do you empower folks and create relevancy with folks that you [01:17:41] mentor and even folks on your team? And I know you touched on it, but I wanted to see if there was something [01:17:47] deeper there or something more there that you had, that you had in your bag of, bag of sort of mentoring and consulting. [01:17:55] Yeah. Thanks, David. It's a, it's a really good question. And to your point of the idea of breaking in [01:18:04] into an org, into the industry, it's like a, we're a bunch of thieves trying to, to, to get a piece of [01:18:11] the pie and it's not true. As I mentioned, we sit in the middle of the bad guys trying to get in and the [01:18:23] good guys trying to get out. So anyone that's had to deal with, you know, adversary, um, uh, persistence [01:18:33] or trying to, you know, work with or, um, manage, uh, an internal, uh, situation serves as [01:18:46] as a starting point, right? So can you listen? Can you understand? Can you then take those, those, [01:18:54] those learnings and, and put them into, um, practical implementation? So when I, um, often [01:19:06] sit and talk to someone, a cousin just recently, uh, we talked about, [01:19:11] uh, he wanted to, to break into the field of information security. I'm like, oh man, break into, [01:19:20] um, what, what, what aspect of information security are you interested in? And, and, you know, just [01:19:30] trying to understand what he was, uh, uh, trying to get into a, what information security, uh, bubble he [01:19:39] was trying to, to get into. Um, he is, uh, uh, an analyst with an MBA in finance and working for a bank, [01:19:52] uh, here in Minneapolis. And I asked again, he's like, okay, so what do you, is it threat management? [01:20:01] Is it broken? And he really didn't know. And then I told him this, well, if you're interested [01:20:09] in information security and you have a finance background, the whole world of, um, uh, electronic [01:20:18] currency and cryptocurrency is life and rich and ready for you to not break in, but be an active [01:20:27] contributor in that environment from regulatory to actual, uh, security implementation. That is [01:20:37] an avenue for anyone in the financial background to actually start looking at and embracing. [01:20:44] And that was a revelation to him. And he, he was like, I didn't think of that. And I haven't thought [01:20:52] of that. And, and I was like, well, let's start planning on how to get you exposed to people either [01:20:59] in that field active actively, or, you know, financial leaders that are thinking about that move [01:21:09] into, into, into that area. So those are kind of the, the, the active engagement that I have when I'm [01:21:17] asked, how, how do you break into, or how do you get into the field of information security? It's often [01:21:25] followed up. What do you want to do in information security? Right. Um, last thing before I, before I [01:21:33] stop, how do you feel about this, the notion of being very comfortable, being uncomfortable in your [01:21:41] pursuit or in your, in your field of, uh, field of endeavor. And thanks very much, Jeff. Appreciate [01:21:47] it. I'm going to ping you on LinkedIn too. All right. Yeah, no, no problem, David. Uh, being comfortable, [01:21:56] being uncomfortable, um, I would say is, is, is part of my, my, uh, my, my personality. So, um, I grew up [01:22:08] in, I was born in, in Monrovia, Liberia, West Africa. I moved to the United States in, uh, 1987. I was 12. [01:22:23] I moved to a city in Minnesota called Andover. Um, you could count how many African-American people [01:22:34] lived in Andover on one hand and not reached a thumb, um, went to high school at another small, [01:22:45] well, not, it wasn't a small time, but in terms of the, the, the diversity population was small [01:22:53] in Bleen, Minnesota. That's where I went to high school. Um, after all of that, you know, limited [01:23:01] exposure, um, I decided to run for the University of Mary in Bismarck, North Dakota, um, uh, track, [01:23:12] uh, scholarship. So I was one of, you know, 10, uh, uh, athletes, African-American athletes in, [01:23:22] at the school. So you were either in football, basketball, or track. Um, and if you didn't see [01:23:30] four of the five, you knew where the other ones were. And, you know, so my career and my [01:23:37] lifespan has been always in that position of feeling uncomfortable or feeling like the, uh, [01:23:47] only one in the room, not looking like everyone in the room. And it took a long time for me to find [01:23:55] my voice and, and be comfortable in, in that resignation, the resignation of my voice and, and, [01:24:03] um, accepting what comes with that, either good or bad. Um, so I find myself and I put myself in, [01:24:12] in positions to, to be uncomfortable, to ensure that, um, uh, ultimately that the information that [01:24:22] I'm gathering is going to provide a comfortable, uh, comfortable situation. So I talked about my, [01:24:29] my master's degree once I was hired, and this is a direct story, um, a situation to my promotion as, [01:24:40] uh, information security officer at the federal reserve. Once I was promoted, there were grumblings [01:24:47] that I wasn't qualified or I hadn't been there long enough to serve in that role. And [01:24:59] my senior officer at the time, who is now the CIO and the executive leader for the technology arm of [01:25:09] Solomon Cotter, he went to bat for me. He doesn't look like me. He went to bat for me. And he said, [01:25:16] not only is he qualified, he's been ready for this role for a long time. So having that individual see [01:25:25] the potential in me, I thought I needed, and again, this is my thought. I thought I needed additional, [01:25:33] um, credentials in order to prove to people that I was ready and able for that role. [01:25:43] I started on a track of my doctorate in information security and assurance. I completed all of the, [01:25:53] the, the, the classes in support of my dissertation at the cost of my second marriage. [01:26:03] So because of that dedication and because of that pursuit of making sure people understood that I [01:26:10] under, I was the, the right person for that job, that the, the opportunity cost there was, was, uh, [01:26:20] was personally felt. So I could, I had to stop because, you know, that was happening. [01:26:27] But that again is an example of being uncomfortable, um, and trying to get to a place of, um, of comfortable. [01:26:40] And ultimately what I, what I learned and what I took away from that was, was this, is that, uh, in the end, [01:26:51] it isn't the credentials that you have. In the end, it's not, you know, the designations behind the [01:26:59] name. It's how you interact with others is your understanding of the situation at hand, [01:27:07] how you consistently show up to be a part of that community. And, um, that's, that's been kind of, [01:27:16] uh, my, my way forward. [01:27:48] Yeah. [01:27:48] And spectacular answer. Um, I'm in government, I'm state government, I'm risk counsel. So [01:27:54] I loved what you said before about being the last person to contact or, you know, when you're building [01:28:00] things, but the first person to contact when you get into trouble, because I think I run into that [01:28:04] both in the legal side and the risk side. But my question is more, more detail on when you quantify [01:28:11] the risk. I think one thing I'm running into in state government, because we do it on a statewide [01:28:15] basis. And we're trying to raise the awareness of internal controls for cyber is that everybody [01:28:21] understands the risk. They, they get it. But the, the, the next step that's really hard is how do you [01:28:27] quantify it in a way that they can re you know, relate it to the CFO and the budget and, and [01:28:35] in an environment where there's never enough resources to do just their basic mission. [01:28:39] How do you quantify it so that they're willing to kind of take that step forward and invest in it? [01:28:48] Yeah. So there's, there's two things that pop to mind. One X, if everybody understands the risk and [01:28:55] they buy in that, okay, yeah, this, this is a potential, you know, cloud that if we don't do [01:29:02] something could impact the organization, but no one is doing something about it. That's something is [01:29:09] usually tied into some theoretical event happening, right? So my experience and Russell can attest to [01:29:19] this as well, is that we've had at the, at the federal reserve, we had a number of tabletop exercises [01:29:26] that walk through those risk scenarios and kind of demonstrated the impact of the organization that [01:29:36] led directly to policy changes by senior, by senior leaders. They understood at, at during those, [01:29:46] those tabletop exercises where the shortcomings were and the looming threat that was out there, [01:29:56] that if it wasn't addressed at a, at a, you know, manageable level that could have a significant [01:30:03] impact to the organization. So I would, I would, I would recommend a tabletop exercise in addition [01:30:08] to that tabletop exercise, get someone that isn't a part of the organization to come in to either lead [01:30:15] or provide some tangible examples. So when we, we did a couple of tabletop exercises within the [01:30:24] federal reserve in Minneapolis, where we solicited help from the F the local FBI, um, contacts that [01:30:31] we had. So they brought to the table real world examples of what would happen if we didn't do [01:30:38] something, if we didn't have, um, this policy in place, or if we didn't have this process implemented [01:30:45] consistently across the organization. So those things, especially if there aren't, if they hear you, [01:30:51] because they hear there's a risk out there, but they aren't listening to, to you, then have somebody [01:30:58] else come in, um, and have it resonate from, from that perspective. Um, the, the last thing I'll offer [01:31:06] is that in our, uh, a cybersecurity awareness program, we had it written as part of that, that, uh, [01:31:15] uh, uh, part of the remedial training and the potential impact to the organization of somebody [01:31:20] that was habitually clicking on links, or to take away their workstation. So here's, uh, Johnny over [01:31:28] here is his fifth time clicking on this phishing test. So the tabletop exercise that we had was we [01:31:37] went down there and took away the workstation. And then you had to figure out how his role would have [01:31:45] to play out where other resources will have to take it out because he just represented a significant [01:31:51] risk to the organization clicking on the link and potentially taking his workstation out of service. So [01:31:57] how would your business then deal with that? And that helped, um, from that, uh, cybersecurity [01:32:04] awareness perspective that helped in the engagement of supervisors, managers, officers to, uh, repeat [01:32:13] and support the idea of being diligent, uh, when it came to, uh, social engineering. [01:32:24] That's fabulous. Thank you so much, Jeff. And what an impressive career. And thank you so much for [01:32:29] being here tonight. Thanks Jenny. Thanks Jenny. Thanks for, uh, adding to the conversation this evening. [01:32:38] Uh, Katie, I know you had a question you wanted to ask, uh, Jeff before we sort of conclude. So why [01:32:44] don't you, uh, take it over? Well, thank you. Yeah, I wasn't sure if we had time or not. It'll be brief. [01:32:49] Um, so Jeff, you are exceptional, um, you know, listening to your story. I can only, you know, hope to achieve as [01:32:56] much as you have in your career and, um, and, and your acumen and as it pertains to leadership. And, [01:33:03] um, one of the things that we talk about both in this room and overall, you know, in the industry is, [01:33:10] um, that balance in, in our lives, but I thought I'd lighten it up a little bit with this final question [01:33:15] because, um, we have learned some really interesting things about you, but, um, in terms of what you do [01:33:21] when you're, uh, decompressing from all of the pressures of your day, what is something, [01:33:25] what is a hobby, something you do that might surprise us? Are you a bird watcher? Do you, [01:33:32] you know, make creme brulee for fun? Or I don't, have you summited Everest three times this year? [01:33:37] Something like that, because I think it's so important for us to know that, um, we all need [01:33:42] to have these lives outside of it too. And you're so, you know, you're, you're that example for us all. [01:33:47] So I just curious, something that would surprise us. Katie, I have three motorcycles. See, [01:33:56] I knew there was something. I knew it. And are you a Harley or a Honda? I have a mixture. I have a [01:34:04] mixture. Um, so I, I don't have a Harley, but I have, uh, a Yamaha Raider, which is Harley-esque. [01:34:12] Um, I have a Ducati and I have a Triumph, um, Thruxton. So I live, I live 35 miles, um, kind of [01:34:26] north west of the cities in Minneapolis. So during the summertime, that's, that is, uh, that is my, [01:34:35] that's my escape. I, I ride, I ride the bikes, you know, not all three at the same time. I know [01:34:40] somebody has that joke out there somewhere. Um, I take it, I take them one at a time, um, and, and go in. [01:34:49] And it's, it's, uh, for me, it's a, it's a place where, you know, I'm, I'm calculating and managing risk [01:34:59] risk in real time, you know, so, uh, I'm, I'm on the motorcycle, I'm enjoying myself, but I'm also aware [01:35:07] of the, the, the other folks in the enclosed vehicles. And, um, it, in many ways have made me, [01:35:16] um, an attentive observer. Um, and in some cases when I'm in my car, I'm a better driver. Uh, but [01:35:26] nonetheless, it is, um, it's, it's an avenue for within which I can kind of release and, and, [01:35:34] and let go. The other is playing golf, but that is more stressful than anything that I know. I, [01:35:42] I just go and, and make my weekly donations as I call it, um, make my donation, get frustrated and, [01:35:51] uh, and I leave. And then I guess the most important, um, thing that I do, um, in my free time is, [01:36:02] is following and living vicariously through, through my kids. Um, before Ethan, my son went down to [01:36:10] Iowa, uh, excuse me, South Dakota to live. He was, you know, still is in some ways a track athlete in [01:36:18] high school and in clubs. So would watch him succeed and national all American and state champion, [01:36:28] um, here in, in Minnesota in the hundred meters. And then my daughter, she plays soccer and track and [01:36:36] she won, she won, um, the long jump last year as a sophomore and the full by one team won the state [01:36:45] championship last year, um, as sophomores. And, uh, you know, she's, uh, an awesome soccer player. [01:36:54] I love watching her play soccer. Uh, and, uh, so yeah, so that's, that's how I spend my time. [01:37:02] I love that answer. Yeah. And thank you for sharing. I think sometimes it's nice for people, [01:37:06] you know, as we heard your story, a very exceptional story to be like, wait, there's a human in there. [01:37:10] Right. Um, so thank you for sharing all those tidbits. And I guess Lisa Beth will have to be looking out for you [01:37:15] on the highways of Minnesota. Oh, I'll see her first. [01:37:22] Always aware. Always aware. I love it. Well, thanks. And probably perfect transition back to Tomas. [01:37:29] No, awesome. Look, that was, that was probably a great way also to, to, to wrap up the, this evening's [01:37:35] segment. So I do want to thank everybody for taking time, obviously out of their day, out of their busy [01:37:40] schedules to, to attend this and listen in. Uh, and, and obviously Jeff, I, you know, [01:37:47] a lot of thank you to you, a lot, a big thank you to you for taking your time out of your, out of your day. [01:37:53] But before we kind of get to closing remarks, I, I do want to remind everybody we'll be back here next [01:37:59] week. Uh, same, same time, 8 PM Eastern time. Uh, we actually have next week joining us. Why is my app not [01:38:08] working? I believe it's, uh, uh, my app work. Here it is. Uh, Nick Snyder, uh, who's the president and CEO [01:38:16] of Arctic Wolf will be joining us. So tune back in next week to listen to Nick and his, uh, his journey. [01:38:23] That should be another interesting and great conversation. I I'm expecting that to be a, a pretty good one. [01:38:30] So with that said, uh, I do want to just very quickly remind everybody, if you're new to our [01:38:37] fireside chat, it's a little greenhouse on the top left of your screen. You can click that greenhouse [01:38:40] and join our, our fireside chat club. Uh, and you can listen to the prior recordings. If you missed the, [01:38:46] a good portion of today's segment, I, I advise you, I strongly advise you to, to, uh, to come back, [01:38:53] tune in after we close the room in about maybe five minutes or so, and listen to the playback. [01:38:57] Cause you'll be able to hear what you missed cause you missed some good conversation this evening. [01:39:01] Um, so with that said, Maz, I'll leave some final words for you. [01:39:06] I just want to say, Jeff, it's a pleasure knowing you and I am so glad that we were able to have you [01:39:11] on the fireside chat so we could learn more about you. It's an absolute pleasure to be here. Um, and [01:39:18] thank you all for the opportunity to share what I do. [01:39:27] Go after you, Katie. Oh, my final thought was going to be, you know, knowing, uh, the, the mentor [01:39:33] that Russell is, uh, for the community and for this, you know, and even in this room every week, um, I, I, I had [01:39:39] no doubt that this would be a great session, but this is really one of the, this was a highlight of my [01:39:43] week. So thank you again for sharing your, your time and the space with us. [01:39:50] You're too good. Jeff, man, I miss you so much. We got to get together. It's been a while. We've [01:39:55] been through things together that we can never talk about. And we've been through things that [01:39:59] maybe we shouldn't ever have to talk about, but I appreciate you spending the evening with us, [01:40:05] sharing with us, inspiring me, teaching me things about you. I didn't know that makes me want [01:40:09] to be a better leader. So I'm grateful. Uh, and the, the room here is grateful for you. [01:40:18] Absolutely. Thanks mods. And, you know, Jeff, again, sincerely, thank you for, for taking the [01:40:23] time out of your business schedule to share your thoughts and, and your, and your journey with us. [01:40:27] Uh, and it's great to, uh, to, to meet you and it's good that you're are still here with us. Um, [01:40:34] so I'll leave the final words for you. [01:40:35] Uh, thank you. Thank you all, uh, Tomas, Russell, Katie, Lisa, um, uh, the folks, uh, within the room [01:40:46] as well. It is truly a pleasure to have this opportunity to talk to this group and, um, have [01:40:55] the interaction, right? So, um, you know, in, in Russell's sayings, when we were, you know, serving [01:41:04] together as information security officer officers, it was always be intentional and be present. And, [01:41:11] um, and I, it, it has resonated with me since our time together, um, at the, at the fed and it continues [01:41:22] to be kind of a bedrock of, of how I lead teams and how I interact with folks. So it is truly a pleasure [01:41:30] to have met all of you, um, virtually and Lisa in person, Russell, we go way back. Uh, I'll see you in [01:41:38] the, in the, um, in the airport at, uh, in Richmond at the green chairs, one of these days. [01:41:44] A hundred percent. [01:41:50] Well, there you have it, ladies and gentlemen with that. It's a, it's a pleasure. We'll see [01:41:54] you all next week. Have a good rest of your week. Uh, keep the fight, keep, keep up the good fight [01:42:01] and, uh, and try to enjoy your, your long weekend. As I did mention, uh, it is a holiday in the U.S. [01:42:06] uh, on Monday. So most of us will have the day off. So have a good long weekend, everybody, [01:42:11] and happy Father's Day weekend. Uh, everyone cheers. Bye. [01:42:19] Bye everyone. Enjoy the weekend. Bye.