Fireside Chat w/Kate Fazzini, Director InfoSec @ Ziff Davis

[00:00:00] Hello, hello. [00:00:10] I know there's nobody here. [00:00:12] But, welcome for those listening to the playback. [00:00:15] Hope you enjoy our show as it gets ready to unfold. [00:00:20] Hey, Kate, how are you? [00:00:33] I'm good. [00:00:34] How are you? [00:00:35] I did it. [00:00:36] You did it. [00:00:37] You got it. [00:00:38] You got it. [00:00:39] You got it. [00:00:39] Look at that. [00:00:40] You got it. [00:00:41] Sorry, I don't know if you responded to my email earlier because I was back. [00:00:44] I didn't see it. [00:00:46] Okay, good. [00:00:47] All right. [00:00:47] I was back to back all day. [00:00:48] So, after I responded to you, I was just so super busy. [00:00:53] But, you got it. [00:00:55] You got it. [00:00:55] So, we'll get started in about five minutes or so. [00:00:59] I'm just going to get the room set up. [00:01:01] I see you. [00:01:02] Neil, what's going on, my friend? [00:01:04] Good to see you. [00:01:05] Well, good to see you. [00:01:06] How's it going? [00:01:06] How's it going? [00:01:07] Hey, Neil. [00:01:08] How are you? [00:01:09] Hey, Kate. [00:01:10] How's it going? [00:01:11] I think we met several years ago, but I've been a big fan ever since. [00:01:15] Oh, thank you. [00:01:16] My goodness. [00:01:17] It's going to be fun. [00:01:19] It's my first. [00:01:20] I've listened to a lot of Clubhouse things, and I've listened to Tomas's as well. [00:01:23] This is my first one on the other side of it. [00:01:26] So, I had a lot of coffee. [00:01:28] I'm going to be a little bit hyped up. [00:01:31] Oh, you're a pro. [00:01:32] You'll be fine. [00:01:35] Kate is a celebrity. [00:01:36] She is a celebrity. [00:01:38] Exactly. [00:01:38] Exactly. [00:01:39] She's been on TV. [00:01:40] I was going to say, wait, is she the first guest that we've had that's been on TV? [00:01:44] No. [00:01:44] We've had others, but I think, I don't know, Kate has been probably the one that's been [00:01:49] on TV the most, maybe. [00:01:51] So, there you go. [00:01:52] Really? [00:01:53] Celebrity status. [00:01:54] God, you know, I've tried to show my kids my TV clips before, and they're like, this [00:02:02] is so boring. [00:02:04] So, no matter what, I always get brought right back down to earth. [00:02:09] Don't worry. [00:02:10] That's funny. [00:02:10] That is funny. [00:02:11] We always need somebody to keep us humble, right? [00:02:14] Yeah, they're like, put the cartoons back on. [00:02:16] Oh, my God. [00:02:16] There you go. [00:02:18] It's like, mom, nobody wants to see you. [00:02:20] We want to see the cartoons. [00:02:21] Please change the channel. [00:02:23] Exactly. [00:02:26] Well, I'll give you a funny tidbit. [00:02:28] I still remember I did a board presentation, and I think later that afternoon, you were [00:02:35] on CNBC talking about the Capital One breach, and it strengthened my position because some [00:02:42] of our executives were former Capital One execs, so it was perfect. [00:02:48] That was an interesting one. [00:02:49] That one's still kind of – I'm still waiting. [00:02:51] It's an interesting one, too, right? [00:02:53] Yeah. [00:02:55] I had Amazon shake it in their boots a little bit. [00:02:58] Oh, I bet. [00:02:59] I bet. [00:03:01] Oh, man. [00:03:03] Who do we have? [00:03:04] Hey, Russell. [00:03:05] Look at Russell with the new avatar. [00:03:07] Are we – so, just so I know, Tomas, I know – are we actually started, or do we [00:03:11] need to, like – is there, like, a formal kickoff period or something? [00:03:14] There is. [00:03:15] There's a formal kickoff. [00:03:16] I'll get it started. [00:03:17] So, usually what I do is I'll get it sort of started as we get closer to 8 p.m. Eastern [00:03:22] time, and then we'll kick off – actually, why don't I just kick off some of the logistical [00:03:29] items, get them out of the way. [00:03:31] I'm just looking in the audience to see who's here, and there's a lot of regulars here. [00:03:35] So, they all know this, but for your benefit, we'll sort of kick off. [00:03:41] There's some guardrails, or I don't want to call them ground rules, but just some guardrails [00:03:45] around the conversation that I'll lay out. [00:03:48] And then we'll ask you questions for about 30 to 45 minutes or so, and I say we because [00:03:53] there will be other moderators that join us and sort of work with me on this panel, and [00:03:58] they make the – you know, they make this fireside chat, the weekly fireside chat, what [00:04:03] it is. [00:04:04] So, we'll ask you questions about 30 to 45 minutes or so, and then we open up for the [00:04:08] audience to jump up on stage, so they'll raise their hand. [00:04:11] It's a little icon on there where they can raise their hand, and then we'll bring them [00:04:14] up, and they'll ask you questions. [00:04:16] Okay. [00:04:17] We don't know what they're going to ask you. [00:04:19] Uh-oh. [00:04:21] And we don't know what the moderators are going to ask you. [00:04:23] So, it's a free-flowing conversation, but this is really meant to be that middle of the [00:04:29] week, you know, let your hair down. [00:04:32] Let's have a great conversation, very candid and open. [00:04:36] This is being recorded, so I just want to make sure that you know that. [00:04:39] All right. [00:04:40] I'll try to keep the cursing to a minimum. [00:04:43] Well, I don't actually care about the cursing, but – [00:04:46] Yeah. [00:04:46] Let's keep it in. [00:04:47] But, you know, it is being recorded, so it could be played back for people. [00:04:52] We have people that sort of are part of the fireside chat group that are overseas or, [00:04:58] you know, in Europe or Australia and others, and they sort of tend to listen at different [00:05:01] times of the day. [00:05:03] So, that's been beneficial since they've added that feature because it was one of the [00:05:09] questions that we used to get all the time. [00:05:10] They're like, Tomas, I miss your fireside chat, but it was really – I wanted to hear [00:05:14] that guest. [00:05:15] And I was like, you have to be here, be live, you know, like the old days, right? [00:05:18] It's like not recording. [00:05:19] You got to be close. [00:05:20] I know. [00:05:20] But anyways, why don't I sort of start getting the room ready and people will sort of file [00:05:28] in. [00:05:28] So, again, if you're new to our weekly fireside chat, this is – we do this every Wednesday [00:05:34] between 8 p.m. Eastern time and 9.30 p.m. Eastern time. [00:05:38] Our comments and opinions are our own and do not really – do not represent our current [00:05:42] or prior employer. [00:05:43] So, we ask that you do keep that in mind as we go through the discussion today. [00:05:48] Carl, why don't you have an NJM, you mascot? [00:05:52] Sorry about that. [00:05:54] That was funny. [00:05:56] Hang on. [00:05:56] I'm just going to quickly just mute you. [00:06:00] I have no idea why it will be as mascots. [00:06:02] But so, as we go through today's session, you know, let's have a good time. [00:06:10] Let's have a really good open conversation. [00:06:12] If there are any vendors in the audience, and I'm sure there will be some that pop up on stage [00:06:17] at some point in time, you know, we ask that you please don't solicit us during the conversation [00:06:21] today. [00:06:22] Save that for another time. [00:06:23] We can really use this as an opportunity to get to know our guests this evening. [00:06:26] And our guest is Kate Fazzini, who's the Director of Information Security at Ziff Davis, [00:06:32] which is a publishing company, if I'm not mistaken. [00:06:34] And we'll get into that in a lot more detail. [00:06:37] The last thing I'll say is on the top left of your screen where it says Fireside Chat. [00:06:41] Again, if you are new to our Fireside Chat, there's a little greenhouse that says right [00:06:45] next to that Fireside Chat. [00:06:46] It looks like a little green Monopoly house. [00:06:48] You can click that and join our Fireside Chat club. [00:06:51] It'll, one, allow you to see all the playbacks or listen to all the playbacks from our prior [00:06:56] guests. [00:06:57] It'll allow you to see who's the upcoming guest. [00:06:59] So without further ado, why don't we kick off? [00:07:01] It is 801. [00:07:02] So Kate, I'm going to leave you for last. [00:07:04] We're going to go around the room and sort of introduce ourselves. [00:07:07] So I'm Tomas Maldonado. [00:07:08] I'm the CISO at the NFL. [00:07:10] Anil, over to you. [00:07:12] Thanks, Tomas. [00:07:13] Anil Varghese, currently serving as a virtual CISO, former six-time CISO and co-author [00:07:19] of the CISO Mentor. [00:07:21] On to you, Russell. [00:07:22] Thanks, Anil. [00:07:23] Really appreciate it. [00:07:24] Hey, Russell Eubanks here. [00:07:25] Do a lot of contracting with companies like SANS and IONS and do a lot of cyber work. [00:07:29] But the last couple of years have been focusing on helping people through my company, Security [00:07:33] Ever After, get their first CISO job. [00:07:36] Lisa Beth, over to you. [00:07:39] Hey, hey, everyone. [00:07:40] It's Wednesday. [00:07:41] My name is Lisa Beth Lentini-Walker. [00:07:45] I'm a compliance, ethics, and corporate governance geek. [00:07:48] I really love those areas and I always value the time we spend together on Wednesday nights. [00:07:57] I run the consulting firm Lumen Worldwide Endeavors and I wrote a book called Raise Your Game, [00:08:03] Not Your Voice. [00:08:04] And I'm going to turn it over to Katie, my friend, to introduce herself. [00:08:08] Hello. [00:08:10] Hello. [00:08:11] I'm Katie Hanahan. [00:08:12] I'm always working to raise my game. [00:08:14] Love being on this stage every week and sharing in this community. [00:08:18] Kate, welcome. [00:08:19] I'm so excited for this conversation. [00:08:22] I am a VP of cybersecurity strategy, a VCISO, and I think almost every week contributor to this [00:08:31] stage. [00:08:31] I'm just so happy to be here tonight. [00:08:34] Over to you, Tomas. [00:08:36] Thank you, Katie. [00:08:37] And I can say it right now. [00:08:40] I'm going to mix up your name, Kate. [00:08:42] I will probably call you Katie. [00:08:43] I'm sorry. [00:08:44] It's not my fault. [00:08:45] I don't do it on purpose. [00:08:47] But we have a Katie on stage, so I'm sure that's going to happen. [00:08:51] I'm going to try my hardest not to mess that up. [00:08:53] So, Kate Fazzini, I've known Kate since, wow, it feels like, wow, a long time since, I [00:09:02] want to say I was at Chase from 2011 to 2015. [00:09:05] Kate, we overlapped during my tenure there. [00:09:08] So, it's been that long since I've known you. [00:09:10] But you've had a fascinating career since you left Chase, and I'm sure we'll get into [00:09:15] that. [00:09:16] But, Kate, what I would like you to do, and I muted you, so if you look on the bottom [00:09:23] right of your screen, you'll see the microphone, but you can unmute yourself. [00:09:27] If not, I will unmute. [00:09:29] Actually, I can't unmute you. [00:09:30] You need to do it yourself. [00:09:31] Okay. [00:09:32] There it is. [00:09:33] Thank you. [00:09:34] So, you know, why don't you take a moment and introduce yourself? [00:09:37] And I'll ask that while you're going through that introduction, and you can take as much [00:09:41] time as you want, why don't you tell us about your origin story? [00:09:45] Sure. [00:09:46] So, I guess I'll start with who I am today. [00:09:51] So, I serve as the Director of Information Security Operations and Engineering at Ziff Davis. [00:09:57] Some of you, I think, are probably gamers, so you know IGN and Humble Bundle and some of [00:10:04] those properties. [00:10:05] PCV Mag is one of our properties as well. [00:10:09] And besides that, we have a cloud services business. [00:10:12] We have a significant healthcare business, and it's a really interesting place to be. [00:10:17] It's just many different companies, many different industries, and overseeing that from the central [00:10:23] operations. [00:10:25] So, I just love it. [00:10:25] Before that, I've been in private practice. [00:10:29] I've been a private client cybersecurity advisor. [00:10:32] And before that, I did some time as a cybersecurity reporter for the Wall Street Journal. [00:10:40] And then for CNBC, I was their cybersecurity specialist. [00:10:45] I did the write-ups and the on-air stuff. [00:10:47] And that was sort of a hiatus. [00:10:51] I have been in cybersecurity for a very long time. [00:10:54] As Tomas said, I worked with him at Chase. [00:10:55] In fact, we were cubicle mates in a cubicle farm right next to each other for a while. [00:11:01] I saw you arguing with David Fairman a few times. [00:11:05] But I'll keep those conversations confidential. [00:11:09] Thank you. [00:11:10] I was going to say, that is funny. [00:11:11] And I'm sure David, when he listened to this, he'll start cracking up about that. [00:11:15] But I do remember, I really distinctly remember, Tomas, that I thought, this guy's definitely [00:11:23] going somewhere, because you really were always standing up to yourself. [00:11:26] And you were always there. [00:11:28] Like, you were always at your desk. [00:11:29] You were always plugging away. [00:11:30] So, I'm glad to say my instincts were right. [00:11:35] And so, I also spent some time, I worked at Promontory Financial Group, which is now a [00:11:39] part of IBM, doing consulting work, as well for some of the big tech companies like Microsoft. [00:11:47] And I teach at Georgetown. [00:11:49] I teach at Yashivin University here in Manhattan as well, cyber warfare and intelligence. [00:11:54] So, that's kind of my background. [00:11:55] My origin story is a little bit different. [00:11:58] I actually grew up in Amish country in Ohio. [00:12:02] And I'm not Amish myself, but my old family are kind of, our background is in coal mining. [00:12:08] And so, through West Virginia and Ohio, my family members are from. [00:12:13] And I was in a very rural area. [00:12:16] And so, I got into technology because, for some of you on this call who are of a certain [00:12:23] age, like I am, you might remember that back when the phone companies, you know, had long [00:12:31] distance rates, even for towns who were very close to each other. [00:12:34] This meant that it was very hard for me as a young lady to call my girlfriend. [00:12:39] So, I got a hold of some hacker manuals and how to do black boxes and bypass the long distance [00:12:48] phone system. [00:12:50] And that actually was my entree into technology was wanting to spend hours on my girlfriend [00:12:54] out in the country. [00:12:56] And they worked. [00:12:57] So, I was the hero of my friends for quite some time. [00:13:03] But that got me into technology. [00:13:05] And I ended up, I was an English major actually in college. [00:13:10] But then I worked at the, I went to Ohio State University. [00:13:15] And I worked at the main computer retail store there. [00:13:20] And I helped supply the Ohio Supercomputer Lab. [00:13:23] And it was just sort of this dual thing that ended up dovetailing really well later on. [00:13:30] So, I guess that's sort of my story. [00:13:32] And I'll kick it back to you, Tomas. [00:13:34] Thank you. [00:13:36] No, that's great. [00:13:38] And I did not know about the sort of growing up in Amish country, Ohio. [00:13:43] So, I'm sure there's going to be some questions about that because that is interesting. [00:13:47] I just got back from there. [00:13:48] Actually, I go every year. [00:13:49] So, we were out there for two weeks. [00:13:52] And I just got back this week. [00:13:55] So, with my kids, it was great. [00:13:57] So, it's fresh on my mind, I guess. [00:13:59] That's funny. [00:14:00] And just quickly for you, when you see us sort of flashing our microphones, that's us sort [00:14:04] of doing, I'll call it a clap if you applaud it. [00:14:08] Oh, okay. [00:14:09] So, Ania, I'll pass it to you. [00:14:14] Thanks, Tomas. [00:14:15] Kate, you know, that's great to hear about your background. [00:14:19] It sounds like you're one of those original phone freaks, and that's P-H-R-E-H-A. [00:14:25] But great to hear that story. [00:14:27] You know, and as I mentioned before, I've been a fan of coverage in media from CNBC and [00:14:32] the Journal. [00:14:34] One thing I wanted to understand from your perspective, you worked on both sides of the [00:14:38] fence, you know, covering the cybercrime beat. [00:14:41] What do you feel, you know, and also from an internal perspective, is an area that hasn't [00:14:49] got enough media coverage or attention that's warranted in this industry right now? [00:14:53] Well, I think I, you know, one of the things that when I had just as a private client service, [00:15:02] that was so huge was business email compromise. [00:15:05] And, you know, these crimes, you know, I'm sure that everybody on this call is well aware of what I'm [00:15:13] talking about. [00:15:13] But if there's anybody who's listening, I'm just going to do a quick, you know, overview. [00:15:17] It's just a wire fraud facilitated through email, essentially, by spoofing, say, a legal [00:15:23] professional and asking for, you know, you to wire money for the down payment on a house or something [00:15:29] else. [00:15:30] Often it has to do with contractor payments or, you know, somebody will impersonate a technology [00:15:36] company and email a large company and say, you know, send your bill to here. [00:15:41] These crimes are really devastating to individuals. [00:15:44] You know, they often strike individuals who are in the middle of a home purchase or very small [00:15:50] business owners, individual business owners, because it is easier to target those individual [00:15:56] people. [00:15:56] I really I tried to cover more of those kinds of stories when I was at CNBC, the stories [00:16:01] that really had a heavy impact on individuals, because, of course, when when money is lost [00:16:06] in that manner, it's very difficult to recover it. [00:16:10] And and still, I would like to see more coverage of that. [00:16:13] I think honestly, I feel like there's a little bit too much coverage of the nation state stuff [00:16:18] in the sense that it's happening all the time. [00:16:22] And yes, it's very serious, but does it have an impact on most everyday people's lives? [00:16:28] I mean, yeah, there's no argument that it could. [00:16:30] But I think that that these kinds of crimes that a lot of people don't really know about, [00:16:34] they're not expecting, they're just so pervasive. [00:16:37] And I've seen some really tragic stories come out of those. [00:16:40] So, yeah, I would love to see more coverage of that. [00:16:44] Oh, that's great. [00:16:45] Appreciate that insight. [00:16:46] And like you said, as you highlighted, right, nation states are there and there's never [00:16:50] that's going to go away. [00:16:51] But BEC hits home, right? [00:16:53] I think for whether it's a small shop or a larger corporate entity or multinational, [00:16:57] it's going to be top of mind. [00:16:59] So I appreciate you sharing that. [00:17:01] On to you, Russell. [00:17:03] Awesome. [00:17:03] Thanks, Cidio. [00:17:04] Kate, so wonderful to get to know you. [00:17:06] I love the things that you shared. [00:17:08] It took me back on memory lane a little bit. [00:17:10] I remember when I first wanted to get into cyber, I subscribed. [00:17:14] I got a physical copy of PCMag. [00:17:15] And I go to the beach on vacation. [00:17:17] I'd be reading that. [00:17:18] Everybody else would be doing beach things. [00:17:19] I was so into tech back then or wanted to be. [00:17:23] Just, wow, I hadn't thought about that in such a long time. [00:17:27] And what a journey. [00:17:28] This paradigm between Amish to supercomputers and that continuum back and forth has just [00:17:33] got me fascinated. [00:17:34] I hope we get to talk about that. [00:17:36] But my question to you, though, is you talk about this idea, this concept that you teach [00:17:40] on, that you discuss on, you hold space on with respect to cyber warfare. [00:17:44] That leads me to my question, finally. [00:17:46] The question is, is it a war, really? [00:17:49] And if it is, is there a winnable state? [00:17:52] Is there a place where we can win? [00:17:53] Or is it just trying to not lose? [00:17:54] How should we think about that? [00:17:56] How do you encourage us to think about that concept of cyber war? [00:17:59] That's interesting. [00:18:00] I think, you know, as we know in this space that it's so much broader than often people [00:18:09] think of it. [00:18:10] I mean, even until very recently, cyber security was sort of a discrete part of, you know, [00:18:16] information security, which was yet another discrete part of a larger thing. [00:18:21] But, you know, we have, there's like a really widespread of stuff that happens. [00:18:25] And I think, is there a war? [00:18:29] That's an interesting question. [00:18:30] I think that, I think, yes. [00:18:34] I think that cyber warfare as a tool, when I talk about cyber warfare, it's cyber, I hate [00:18:45] having to use the word hacking because people really hate it, but, you know, I'm trying to [00:18:51] cyber threats as a tool of war. [00:18:54] For instance, when you see Russia softening up areas in Ukraine through ransomware attacks, [00:19:03] you know, which, which of course happened with the NotPetya attack several years ago, going [00:19:08] as far back to Estonia in 2007, there was a dispute between Russia and Estonia. [00:19:13] And Russia used their, their cyber capacity to heavily networked country, they pride themselves [00:19:22] on it to take down quite a bit of critical infrastructure that was based around this, this [00:19:27] digital idea that Estonia had. [00:19:30] And, you know, this is the reason why the NATO cybersecurity center is based in Tallinn in [00:19:37] Estonia. [00:19:37] And so when I, when I talk about cyber warfare, I do mean anything digital as a tool of a war. [00:19:48] And I think that we're going to be seeing it more and more, especially as kind of a preemptive [00:19:53] measure, especially since, sorry, that was my, that was my bedtime reminder. [00:19:58] I'm so embarrassed. [00:19:59] Yes, it is 815 Eastern time, but I have, I have had some coffee, so I think I'll be good. [00:20:07] So, so cyber warfare as a, as a tool, there isn't really a convention around it. [00:20:17] Currently, there is no Geneva convention around cybersecurity. [00:20:20] And so because of that, there's a lot more plausible deniability. [00:20:26] If a country wants to preemptively attack, say, our electrical infrastructure, there are [00:20:33] lots of ways to do that and not, not take direct responsibility for it. [00:20:38] So it could cause chaos. [00:20:41] It could cause sort of a softening around the edges of the country that would, would want [00:20:46] to be attacked. [00:20:47] And for that reason, I see it as a, you know, I, I also see IP theft as a tool of that because [00:20:53] having trade secrets and government secrets ahead of a physical conflict is a significant [00:20:58] advantage. [00:20:59] It's intelligence gathering. [00:21:02] Espionage in some ways is also a tool of warfare. [00:21:05] But, you know, not everything is warfare. [00:21:07] However, we also do see that the criminality that has come out of Russia and Eastern Europe, [00:21:13] very difficult to prosecute, very difficult to have people who have been indicted, extradited [00:21:19] to the United States to stand trial. [00:21:23] And, you know, because of that, you have, you have in, you know, Vladimir Putin, somebody [00:21:28] who is able to say, you know, I have all of these extremely talented hackers all across [00:21:36] the country doing significant business in a criminal enterprise. [00:21:40] If I ever need to call on them after they've hacked a bank or have hacked into a major, you [00:21:48] know, car manufacturer to get information about my enemies or get information for a strategic [00:21:54] advantage, he has access to that. [00:21:57] And so there, you know, there's a little bit of a line that is very blurry between those [00:22:05] two things. [00:22:05] And so while not everything is certainly, I think, qualified as cyber warfare, but this [00:22:10] email compromise, you know, not usually a tool of that, it's just a criminal enterprise. [00:22:18] There's a, there's a lot of ambiguity. [00:22:20] So I hope that was a long answer to a short question. [00:22:24] I'm sorry. [00:22:25] No, no, no. [00:22:25] Don't apologize. [00:22:26] That was fascinating. [00:22:27] My takeaway from that, Kate, is that the language, the vocabulary of a tool of warfare. [00:22:33] I'm going to stick to that. [00:22:34] And I really appreciate that. [00:22:36] So, so thank you. [00:22:37] Thank you very much. [00:22:38] Lisa Beth, over to you. [00:22:41] Yeah. [00:22:42] I, I, I love the clarification about the fuzziness of it all. [00:22:46] So my question for you is in a world that is a brittle, uncertain, et cetera, where there is [00:22:57] a lot of fuzziness, how do you gain clarity and how do you help teams gain clarity about [00:23:03] where the focus should be in, in life, right? [00:23:10] In work and in life. [00:23:11] Yeah, it's really tough. [00:23:14] And it's been a, it's been an extraordinarily tough couple of years for a lot of people. [00:23:20] And as a mother, I, I struggled a lot during the pandemic, just to balance the utter insanity. [00:23:27] And, and so I think I certainly came away with a new sensitivity to like really focusing on [00:23:37] making sure that my, my employees hopefully have, have a good work-life balance. [00:23:42] And I think more importantly, I've, I've taken to making sure that I'm asking everybody, whether [00:23:50] they work for me or not, you know, what do they actually want to do? [00:23:53] My students as well, who I have conversations with, you know, what, what do you actually [00:23:59] want to do in this career? [00:24:00] Like, and, and sometimes people are surprised to be asked that question. [00:24:04] Like, you know, they're, they're sort of like, especially if they're meeting with you [00:24:08] as a manager, it's, it's more of, you know, they're used to the day-to-day thing. [00:24:12] But it, like, I think it's important to find out what each person wants to actually do and [00:24:19] accomplish, even if it's, even if it's not something related to cybersecurity, because [00:24:25] I've had employees say things like, you know, I want to leave a legacy. [00:24:30] And I kind of don't know what that is. [00:24:31] And I've said, well, look, you know, you can take all of this good work you've been doing [00:24:35] and start putting it into white papers. [00:24:37] And here's how that's organized. [00:24:38] And then you can submit that and you can have it published. [00:24:41] And that's, you know, what you're, what you're leaving behind about your knowledge is just [00:24:45] finding out what people actually want to do and then helping them to get to that point [00:24:51] is like, it seems to get so much more productivity out of people that makes it sound like I'm [00:24:56] exploiting that thing. [00:24:57] But, you know, it does really, it motivates people because I, then I want to put tasks in [00:25:02] front of them that help a single other stepping stone toward getting them to where they are [00:25:09] and that, that goal that they want to do. [00:25:11] And I think that's, that's what's important today because people have come out of the [00:25:16] pandemic with new priorities. [00:25:19] And, you know, it's, it's difficult. [00:25:22] You know, no matter who you're working for, it's very difficult to say like, no, I need [00:25:29] you on this call because, you know, somebody did something really dumb and a manager is [00:25:35] upset and they need you to fix it right now at nine o'clock at night and you've just tucked [00:25:39] your kids in. [00:25:39] And, you know, it's, it's very difficult for people to prioritize that anymore, I think. [00:25:44] Uh, and I think, um, going forward, it's just managing the expectation of like, we need to [00:25:53] focus on, you know, the really meaningful things that are going to protect this company, protect [00:25:58] our people, um, and that make a lot of sense and get rid of all of the noise that, that drives, [00:26:05] um, people away from jobs in cybersecurity, like the 24 seven schedule. [00:26:10] Um, so yeah, I think, uh, that's kind of my answer. [00:26:17] Um, I do think that the 24 seven grind of a lot of cybersecurity jobs, like kind of has [00:26:25] to come to an end. [00:26:26] That's one of my, um, one of my big things, I think. [00:26:32] Uh, couldn't agree more because if we're working 24 seven, there's nothing left in that [00:26:37] bucket to pour from. [00:26:39] Um, so I, I really appreciate that. [00:26:42] I am on a mission with you, uh, to say enough, it's enough, um, and that we need to be a little [00:26:48] bit more rational about how we treat the brains and, um, the assets that we're entrusted in [00:26:54] terms of human beings. [00:26:56] Um, so let me pass it on to Katie. [00:27:02] Thank you, Lisa Beth. [00:27:03] Um, and, and hi, Kate. [00:27:05] Um, I'm good. [00:27:06] I'm so happy to see you here there. [00:27:08] I have a lot of questions. [00:27:09] Um, uh, just because I, I do find it really interesting. [00:27:13] You growing up in Amish country. [00:27:14] I grew up in a, in a town of 550 people, which is now. [00:27:18] Here's a smaller than mine, actually. [00:27:21] See. [00:27:21] Here's a smaller than mine. [00:27:22] Yeah. [00:27:22] See. [00:27:23] Yeah. [00:27:25] I love, oh, Illinois. [00:27:26] Yeah. [00:27:26] Yeah. [00:27:27] Illinois. [00:27:28] Yep. [00:27:28] And not Amish, uh, at all, but, um, I did work in the diner at a lot of farmers, just a lot of farmers. [00:27:35] Um, and, and so I do appreciate that aspect of your story. [00:27:38] Um, also the fundamentally that initially when you came into this industry, it was about connection. [00:27:45] I find that super interesting that you ended up in a field where you are tasked with connecting people with thoughts and ideas around this industry that I love so much. [00:27:56] So thank you for that. [00:27:58] You said also the word legacy. [00:28:00] And I don't, I just have to ask, I mean, I'm just curious, um, cause you've done so much already for, for this industry and for, for, uh, women in this industry, for, for people from small towns like ours. [00:28:13] Thank you very much. [00:28:14] But what, but what do you want your legacy to be in light of what you've learned in the last several years in this industry? [00:28:24] Oh, that's really interesting. [00:28:26] I, um, God, that makes me kind of sad too, because I, I'm actually turning. [00:28:32] What am I going to be 42 in like a couple of weeks, days, days away. [00:28:38] Kate, Kate, Kate, Kate, Kate. [00:28:42] Don't be sad. [00:28:43] Be very happy. [00:28:45] Okay. [00:28:47] 42 is fine. [00:28:48] I will, Katie. [00:28:49] Well, no, we'll get, we'll get one of the lawyers in the audience to do that for you. [00:28:54] We have a few here tonight. [00:28:56] We'll, we'll get them to do that for you. [00:28:57] Cause, cause since you're a school, since you're almost 42. [00:29:00] I know. [00:29:01] I know. [00:29:02] Um, so, uh, I think, um, you know, one of the things I've actually spoken about before, I don't think I've ever done it this publicly, but I have done it at events, um, where I've done key notes and stuff. [00:29:13] But, um, so I'm actually a survivor of domestic violence myself. [00:29:17] Um, and, uh, that's played a kind of big role in shaping who I am and, you know, how I, I kind of come to, to view things and, um, and view people and, and taking them from, from one level and to the next. [00:29:31] And so I think if I wanted my legacy to be anything, it would be just, um, bringing a lot of people, um, into the fold of this field, um, who are coming from backgrounds where, uh, you know, they, they, they need to have that chance, that chance of getting into a really good industry. [00:29:51] And I, I try to hire people like that, people who are just hungry for something. [00:29:56] Um, I, you know, there are a lot of people, uh, who, um, you know, they come from difficult backgrounds and, and because of that have this very natural paranoia, um, as I do, uh, but, but that was sort of cultivated maybe by bad experiences, but that comes in very handy in this field. [00:30:20] Where you are able to look at, um, a situation, for instance, your company is acquiring, um, a new, like little tiny, let's say healthcare blog. [00:30:31] Um, you can think of all of the 500,000 different things that will go wrong. [00:30:36] Like you already know that, um, with Roe v. Wade, there's going to be a privacy issue involved with anybody who's talking about their pregnancy and stuff. [00:30:43] And you know that, um, there could be a HIPAA issue, so we need to make sure that there's not going, you know, you just have all of that stuff. [00:30:50] And you just have to open your mind as soon as you hear what's going to happen. [00:30:53] Um, and, and I, I love bringing people like that into the field because, um, so many people, and, and there are a lot of people I know who are on this call probably who I, who I know in my career who will hate me for saying this. [00:31:08] But, you know, you don't, you don't have to be that technical to get a really nice job in this field. [00:31:14] Not a technical job. [00:31:15] Um, I'm, you know, if you're an architect, you, you are an engineer and you've had a heavy technical background and, um, but there are project managers, program managers, um, you know, uh, people who, uh, do all kinds of governance and risk responsibilities that, um, are very, it's, it's just a matter of training people up into their natural tendencies. [00:31:36] You know, um, and, uh, I, I would love to be known and remembered for welcoming. [00:31:42] I, I, I have worked with some domestic violence groups to, um, create training programs and things, um, that they could, uh, help people transition their careers. [00:31:51] There's, um, a lot of women that come in to these different organizations, uh, have not been working for years or have had some, you know, aspect of financial abuse and, uh, where they, they, uh, don't have, um, you know, they haven't had access to money. [00:32:08] They haven't, uh, been in the banking system and stuff. [00:32:11] So, you know, there's a little bit of, of learning, a learning curve. [00:32:14] Um, but once that's overcome, uh, you know, it's this, this field is a really beautiful one to be self-sufficient and to carve out your own path and still get paid for it. [00:32:25] Um, so yeah, I think that's something that's really important to me. [00:32:31] Oh, Kate. [00:32:33] Uh, thank you for that. [00:32:35] Um, I'm a little bit taken aback because I, [00:32:41] I just, I love what you just said so much, by the way, I've mentioned this one other time. [00:32:45] I also am a domestic violence survivor myself. [00:32:48] I'm sorry. [00:32:49] And I am sorry that you had to go through that as well, but what I, what I find so inspiring and what I really appreciate about what you're saying is that, um, out of adversity comes these, you know, skill sets that actually are very beneficial to someone's field, potentially. [00:33:05] Uh, the fact you said natural paranoia, uh, the ability to be able to look at something and cognitively say, okay, I believe there is a risk here. [00:33:14] Now, you know, I'm, I'm detached enough emotionally from it to be able to say, um, you know, here is a risk. [00:33:20] And that the fact that you're dedicating so much time, uh, to now looking for those skills that are in women who have also come through something like that is to me, extremely amazing. [00:33:31] I'm sure we'll have a conversation offline about that. [00:33:34] And I only said it publicly myself as well, because I feel it's extremely brave of you to say that it's hard for me to say it sometimes. [00:33:41] Um, but I, I, uh, I, uh, am just so inspired by the other women in our field who have persevered through it and are now honing in on the skillset that we've gotten as a result of. [00:33:53] I find that extremely fascinating. [00:33:55] I was almost a little taken aback. [00:33:56] Um, what I'm going to do real quick, um, is I'm going to reset the room just so that everybody knows this is a cybersecurity room or fireside chat. [00:34:04] We're, we're, we are speaking with the, uh, Kate Fazzini, who I had not met before today. [00:34:10] Um, but what an amazing woman, um, in our industry, uh, in what I've learned so far in the first 30 minutes of this call is an amazing person as well. [00:34:19] And we're learning so much already, um, we're here every single week at, at eight o'clock Eastern time for an hour and a half to, you know, get to these stories of the people who are making an impact in our industry, uh, in the area of cybersecurity and adjacent. [00:34:34] And Kate Fazzini, thank you again so much for being here and spending, um, your time with us tonight. [00:34:40] Um, if I'm going to just going to ask one more followup question, um, and then also, you know, encourage everyone to follow the fireside chat. [00:34:47] If you just click on that, uh, little, uh, greenhouse at the very top, you'll be alerted to all of our, uh, uh, our guests that we have. [00:34:56] Um, and, and we're here again, like I said, every week, but you can also listen to them on, on replay. [00:35:01] Um, we'll also be bringing people up from the audience, George, I see you, and I will absolutely bring you up. [00:35:05] Um, because by the way, George is, is, is always comes up with an amazing question and another amazing contributor to this organization. [00:35:13] Um, what I would say is, um, and just kind of the followup question before we go into bringing people up into the room. [00:35:21] Um, at the very beginning, you talked about that origin story. [00:35:25] I'm super curious though, how you ended up in the field of journalism as it relates to, uh, cyber. [00:35:32] Cause that part, I don't know if I heard it or if I missed it, but I think I just love to know how telling that story or telling the story or what, where it was that you ended up in the field of journalism, [00:35:42] coming out of, you know, JPMC, et cetera. [00:35:46] Yeah, that was, um, another sad story. [00:35:51] Um, no, I'm kidding. [00:35:52] It's fine. [00:35:53] It's a community. [00:35:55] We're here together. [00:35:56] I don't cry anymore. [00:35:58] It's all right. [00:35:59] Um, it's been years. [00:36:00] Uh, anyway, um, I, uh, I was at Promontory Financial Group. [00:36:06] Um, actually, one of my biggest clients, uh, was Microsoft and, um, I was almost exclusively working at that at the time. [00:36:15] Then we, it was announced that we were, we were getting acquired by IBM. [00:36:18] And so, um, I ended up getting laid off and I got laid off with like a nice package. [00:36:23] So I had some time off and, um, I, uh, just kind of was talking to some friends. [00:36:31] I got a call from, uh, a friend, um, who I can't even remember how I know her, but her name is Emily Glazer. [00:36:38] And she covers, um, the banking industry, uh, at the Wall Street Journal. [00:36:42] Um, and, uh, we, we talked about a cybersecurity, um, reporter job that was opening there. [00:36:49] And so I, um, she encouraged me to interview for it and I interviewed for it. [00:36:53] I took, um, the writing test and, uh, apparently passed. [00:36:56] Um, although I think some of the editors passed me, but, um, I had a very wonderful editor named Nick Elliott. [00:37:04] Um, and, uh, it was just a dream job. [00:37:08] Uh, and, uh, it, it was a pay cut. [00:37:12] I will say that out loud. [00:37:15] Definitely. [00:37:15] It's not a very lucrative industry. [00:37:17] Um, but it was the absolute time of my life. [00:37:21] I have so many stories. [00:37:23] I, um, I sat on a, you know, near where the, um, investigative reporters sat. [00:37:29] And, and this was during sort of the Stormy Daniels time period, I guess. [00:37:34] Um, and this was also during Wanna Cry and Not Petya happening when I was there. [00:37:38] And, um, just, uh, it was just wonderful. [00:37:41] I just had to, like, marinate in this incredible experience. [00:37:44] Um, and, uh, yeah, I, I was, like, got, got picked up by CNBC. [00:37:49] Um, and, uh, I, I did eventually start getting tired of it. [00:37:54] It's a little repetitive, um, journalism jobs. [00:37:57] You, you kind of, you get into a groove of a template and then every story is kind of put into that template and it gets a little bit, um, monotonous. [00:38:06] Um, and so I, you know, after the pandemic, I just decided that I wanted to go, um, back into the field. [00:38:15] Uh, and, and I did, and it was great. [00:38:17] Um, and it's been great ever since. [00:38:18] So, um, I'd love to, I do, you know, uh, I do write occasionally. [00:38:23] I do actually write, um, I'm on the board of directors of, uh, a company called ERI, um, which is one of the biggest, um, electronics recyclers, uh, in the U.S. [00:38:32] Um, we, uh, I have a column on, on secure, uh, like the security of physical, um, objects and items. [00:38:42] And, um, with our, uh, our chairman and founder, John Shigarian, um, it's in the, uh, LA Business Journal and Fresno Business Journal. [00:38:50] That's where they're based. [00:38:51] Um, so I do still get to write, uh, and get that out of my system every once in a while. [00:38:55] But, um, I, I like working in cybersecurity better, so I think I'm going to stay here. [00:39:00] It's safer. [00:39:02] Well, I feel like, you know, even as a practitioner where you are now though, you're, um, you know, as a writer, you're still just so incredibly important to, um, you know, helping. [00:39:14] There are so many, there are so few people that are technical and also good writers, I guess is my point. [00:39:19] So clearly I'm not even a very good speaker and here I am on a stage. [00:39:22] So there you go. [00:39:23] Um, so with that, I'll, uh, give it back over to, but thank you, Kate. [00:39:26] This has been such a pleasure meeting you and getting to ask a couple of questions of you, but I'll give it back to Tomas to, to reset. [00:39:33] Thank you. [00:39:34] And likewise. [00:39:34] Thank you. [00:39:35] Oh, thanks, Kate. [00:39:35] Wow. [00:39:37] Awesome. [00:39:38] Awesome. [00:39:39] Awesome. [00:39:39] Awesome. [00:39:39] Awesome. [00:39:39] So far. [00:39:40] So, uh, look, this is our weekly fireside chat. [00:39:42] If you just joined us, you've missed a good 33 minutes of, of great conversation and getting to know, uh, Kate Fazzini. [00:39:48] Um, you know, Kate, I guess, like I say, we, we probably saw it in your future when you were at Chase, cause you were doing a lot of our, I remember our training awareness, if I wasn't mistaken. [00:39:58] Right. [00:39:59] You, you were sort of, uh, spearheading that for us for, for a while, if I'm not mistaken. [00:40:04] Uh, so that journey going into journalism and, and working at Promontory, I, you probably worked with like Judith Pinto and some form of people that I worked with. [00:40:13] Yes. [00:40:14] Judith Pinto is the most, we, she was my best friend there. [00:40:17] So, um, I actually was thinking I got her on CNBC once we were on together. [00:40:23] I'll send you a clip. [00:40:25] Yeah. [00:40:25] Definitely send me the clip. [00:40:26] Definitely send me the clip. [00:40:28] Judith. [00:40:29] Judith is awesome. [00:40:30] I worked with Judith for many years when I was at Goldman. [00:40:32] Uh, her and David Strumpf, I think was over there as well. [00:40:36] Uh, uh, so, so what I, I, I lost track. [00:40:39] I did not know you went over there. [00:40:41] That, that is awesome. [00:40:42] Uh, but I, I will say, and I will make this public announcement. [00:40:46] I am sorry that I did not, I did not sort of respond back to your, to your messages to be quoted or anything like that on, on, uh, CNBC. [00:40:54] It was, you know, different sort of timing. [00:40:56] Okay. [00:41:00] Restrictions and whatnot. [00:41:01] You're like, um, don't, don't expose me. [00:41:03] Now I was bothering when I was a reporter, I would just bother people on LinkedIn all the time. [00:41:08] Um, so I'm sorry. [00:41:10] But, you know, Kate, I want to, I want to talk about that sort of desire to, to, you know, I always get the question about like, well, how did you stumble into security? [00:41:22] Right. [00:41:23] Right. [00:41:23] And, and, and I know you touched upon this a little bit, but. [00:41:26] You know, maybe for some of the, and usually the question comes from, uh, uh, either folks that are trying to figure out what they want to do in their careers, if you will. [00:41:35] Right. [00:41:36] And so, you know, I, I'll say the question to you around, around the same parameters, you know, how did you stumble, if you will? [00:41:43] Or how did you work your way from, you know, English major in college and, and sort of doing, uh, and having an interest in, in technology and security? [00:41:54] Like, like how did, like, where did that start? [00:41:57] Was it, was it at a point in time, like early on before college, or was it as you sort of continue to develop and as, as, you know, cause you are, you are relatively young in the industry, even though you've, you've done this for a long time. [00:42:10] Like, and I say that because you, you, you were complaining about your, your, your age earlier. [00:42:15] I'm trying to let you know that. [00:42:16] You know, there are certain people in this room that might. [00:42:19] Thank you. [00:42:20] Thank you. [00:42:21] There are certain people in this room that might be a little bit older than you, you know, my, myself included. [00:42:26] So. [00:42:28] Oh, I'd be shocked. [00:42:29] Take us, like, like, take us a little bit of on that journey, you know, like, like, like. [00:42:35] Yeah, I don't know. [00:42:36] Where are those sort of interests and those, those key points? [00:42:38] I think my first job, I was still in college. [00:42:42] I started working as a stringer at the Columbus Dispatch, which is the newspaper in Columbus, Ohio. [00:42:49] And a stringer, if you don't know, is like a cub reporter, like somebody who they just, you know, the kind of person you can call and say, hey, there's like a zoning meeting that's happening at 11 o'clock in the evening. [00:43:00] This is like small town and something might happen. [00:43:03] Can you go out and cover it? [00:43:04] And I think I got paid like $50 a story or something back then. [00:43:09] It wasn't very much money even then. [00:43:12] I mean, it was like 2001. [00:43:13] But I think my where my real overlapping interests were, were in certainly in communications, but in international, the international relations and the the warfare aspect of it. [00:43:26] I, I, I, especially kind of the emerging ability of social media to, you know, dictate what people think about things. [00:43:42] And even, even, even back as far as Napster, where people would, you know, kind of share bootleg concerts from different sorts of like freedom fasts in countries that weren't really, you know, open to those sorts of things. [00:43:59] And I, I think, I studied Arabic in college as well. [00:44:06] And, you know, 9-11 happened and that just intensified that interest. [00:44:10] And I, I worked on, you know, I worked really independently for a very long time before coming out to New York and working as a freelancer, kind of in the private cybersecurity field. [00:44:24] And just, I, I've always liked working independently. [00:44:29] I also worked as a journalist during that time. [00:44:34] I, I had the opportunity as a journalist to travel all over the world. [00:44:38] I got to cover, like, all kinds of, I, I worked for some time for a publishing company that did, like, trade magazines in the, like, hard materials and building materials and industries. [00:44:54] So I got to go to China and Israel and the West Bank and all these crazy places and go to trade shows and factories and all of these different things that I could do write-ups about. [00:45:07] I, I wrote about the oil and gas industry. [00:45:10] And, you know, there were a lot of, a lot of technical things in there for some technical trade magazines. [00:45:15] And so all of these industries had this really interesting security issue, you know, that was brewing, whether it was, like, the RFID technology for all of these building materials and ensuring integrity of chips and things when they come from overseas. [00:45:35] And so that's, that's just where, like, my passion is. [00:45:39] I, I think almost at this field, I was just talking to a friend actually from, from J.P. Morgan just the other day, who, we were talking about how surreal this job feels sometimes. [00:45:53] Because, you know, you're, like, you're, like, having a normal life and then you go to work and it's, like, really this intense, internationally tinge, extremely important, and yet also kind of crazy and silly thing that you're working on. [00:46:10] And then it's, like, you go back to the real world and it's very interesting. [00:46:14] So I just don't think I could ever give that up. [00:46:16] So I hope that's kind of a good answer. [00:46:18] I don't know. [00:46:19] That's, that's, that's fine. [00:46:22] That's awesome. [00:46:23] Thanks for that. [00:46:25] Look, if you do have a question and you are in the audience and you want to jump up our stage and ask your question, feel free to raise your hand. [00:46:32] We'll bring you up. [00:46:32] If you can't talk for whatever reason, you know, I know it is, I know it is Wednesday. [00:46:37] It's 8.40 p.m. Eastern time. [00:46:39] Somebody's had a few. [00:46:41] Yeah, somebody's probably had a few. [00:46:44] I'm not going to say anything about myself. [00:46:46] But I'm sure there's, there's been a few people that have had a few. [00:46:49] And there might be people at the bar. [00:46:51] Who knows? [00:46:52] But look, if you do have a question and you want it and you can't jump up on stage, feel free to type it in the chat and we'll read it off to Kate. [00:46:59] But I do see George. [00:47:00] George, thanks for joining us. [00:47:01] And good to see you, my friend. [00:47:03] Anything you want to ask Kate? [00:47:04] Hey. [00:47:05] Yeah. [00:47:06] Guys. [00:47:06] Kate, super fascinated with your story and enthralled at the idea of legacy. [00:47:20] So I have a question that I think Katie and Russell are familiar as a hobby horse of mine, which is kind of the next generation. [00:47:28] So I also came up as a tinkerer, not so much on the freaking side, but on other parts of technology. [00:47:37] And, you know, cyber is one of those industries that has like emerged, been codified and professionalized all within our lifetimes. [00:47:49] Right. [00:47:49] So from, you know, duct taping ports and protocols together up to now we have certifications and all the rest. [00:47:57] So as a leader, my question is twofold because I want to cheat. [00:48:02] When you're a manager, I guess my question is these types of stories of people who came up, you know, hands on technology. [00:48:12] I think it's an allure for the industry, but I also think it casts a shadow and maybe the newest generation is constantly suffering from imposter syndrome. [00:48:23] I've talked recently with like people who are pivoting from a high school history teacher, you know, and they're taking boot camps and they've just always saying like, well, I don't really, I'm not really a technology person. [00:48:34] So how do you assuage that as a manager? [00:48:38] And then on the leadership side, how have you worked to get buy-in to build out those training programs to cultivate, quote unquote, unconventional talent? [00:48:53] Yeah, that's a great question. [00:48:55] Thank you, George. [00:48:56] And I think I say this often when it comes to imposter syndrome because I suffer grievously from it. [00:49:05] But I was just saying the other day that every single day I'm struck at some point in the day by the thought, am I actually an asshole? [00:49:19] Like, am I totally full of shit, you know? [00:49:23] So, and, you know, sometimes I think I might be, but I, like, I always stop. [00:49:32] Like, there's always a point in the day where I just kind of look up at the computer and I'm like, wait a minute, is this, am I a total fraud? [00:49:39] And then I, like, have to kind of go back to it. [00:49:41] So I definitely, I appreciate the feeling of imposter syndrome no matter where you are in the journey. [00:49:49] I think I've only met one person who does not suffer from it in my entire life, and he was a network engineer. [00:49:55] So I knew exactly what he was. [00:49:59] I think if there's any network engineers on this call, I think they probably know exactly what I'm talking about. [00:50:05] But besides that, you know, from the training point of view, it can be a real struggle. [00:50:11] And I see, you know, when I bring on employees who have on-time and field backgrounds, there's a lot of nervousness. [00:50:19] There's a lot of fear of making mistakes. [00:50:22] It's interesting to me because in the journalism world, there are pretty severe consequences for making mistakes, like especially in your career, if not, you know, publicly having some sort of, you know, fallout from that. [00:50:38] So that was actually a big change for me because it made me realize, like, I think in Subritory, we've all made, like, mistakes. [00:50:48] I mean, you know, bringing down production or something crazy in, you know, whatever everybody can recall, like, their worst thing that they've ever done. [00:50:58] And nothing compares to the kind of fear and trepidation I felt when I made a mistake of the journalist. [00:51:04] So when I have employees now who go through that where, you know, I see they're afraid of making a mistake in an email to an executive or they're afraid of not telling, giving somebody the right advice about whether an email was phishing or not. [00:51:20] And, you know, and it goes up from that would be like the lowest level fear to the higher level things. [00:51:25] Like, am I going to interpret this wrong? [00:51:27] Am I going to miss a call when I'm on call? [00:51:30] And I just am constantly trying and I'm probably not always doing a great job, but trying to just reassure them that, like, really, there are very few mistakes you can make that are going to have a severe consequence. [00:51:45] I mean, just don't wire money. [00:51:47] Okay. [00:51:48] Don't wire anything. [00:51:50] Like, that's it. [00:51:51] Like, please just, if you get wire instructions, just tell me. [00:51:55] But besides that, like, everything else is, you're going to be fine. [00:51:59] And I think once people get over that, there's so much fear of making mistakes. [00:52:05] I see it more now, I think, that I'm older, too, that, you know, people can get over that fear. [00:52:14] And, you know, sometimes you're going to make a mistake and the person who is your manager is going to give you tons of shit for it unnecessarily. [00:52:24] And you might not know that it's unnecessary, but, like, I'm telling you, it probably is. [00:52:29] So just remember that. [00:52:31] If, you know, if you've made some mistake and people are just coming down on you like crazy and, you know, you're getting a bad review because of it and all of this stuff, like, it's probably unfair. [00:52:46] And it's probably for some other reason that's political in nature. [00:52:49] So just, you know, I really hope that people can kind of put that fear aside and make mistakes because, you know, I will quote Tomas. [00:53:00] I will quote David Fairman, actually, because he gave me some very good advice once. [00:53:03] And that was that everybody in this field is, like, their own little entrepreneur. [00:53:08] Like, this is your business. [00:53:10] You are your business. [00:53:11] And business owners make mistakes all the time. [00:53:15] And, you know, you read entrepreneur kind of mythology literature, and it's always about, you know, fail fast and fail all the time and make mistakes. [00:53:26] But when you're in a job as a practitioner, you don't kind of get that advice, right? [00:53:30] So I would say, like, take David Fairman's advice to me that I always remember and extend that into your role today that, you know, you are your business. [00:53:44] And business owners try things. [00:53:48] They are innovative. [00:53:50] They make mistakes. [00:53:52] Business owners go bankrupt. [00:53:54] They lose their business. [00:53:55] They start other businesses just like you get fired. [00:53:58] You know, you go on. [00:53:58] You start something else. [00:54:00] I like that mindset. [00:54:02] And I think, especially in this field where it's growing so much, there's so much opportunity. [00:54:07] And if you get down on yourself, you might miss out on some of that. [00:54:12] Great. [00:54:13] Thanks so much. [00:54:14] Yeah, thank you. [00:54:18] Thanks, George. [00:54:19] Thanks for jumping up on stage and asking you a question. [00:54:23] I've got to send that to Fairman. [00:54:25] I know he's in Australia, so he's clearly not on right now. [00:54:29] It's like Sunday there right now, right? [00:54:31] It probably is. [00:54:33] It probably is. [00:54:38] Again, if anybody has any questions and you want to jump up on stage, feel free to raise your hand and we will bring you up. [00:54:45] I'm just looking at the chat. [00:54:45] There's no questions on there. [00:54:46] And moderators, any other questions? [00:54:51] I didn't look at the back chat. [00:54:52] So if anybody has a question, feel free to go. [00:54:55] Well, I have one just to lighten it a little bit. [00:54:58] Kate, can you tell us something about Tomas? [00:55:01] Like, when did the dad joke start for him? [00:55:04] Was it in the mid-2010s? [00:55:08] Or, like, when did that start? [00:55:10] I was a lot younger back then, Katie. [00:55:14] So no dad jokes. [00:55:15] She doesn't even know. [00:55:16] Oh, you really waited until a lot later in life. [00:55:20] Okay. [00:55:21] Yeah. [00:55:21] I didn't know about this side of the floor. [00:55:23] Oh, yes. [00:55:25] Tomas, I'll tell you, I don't think we sat next to you for very long. [00:55:29] So I don't have a lot of, like, stories other than David's family. [00:55:33] It was usually when I was in New York. [00:55:35] Honesting you. [00:55:36] Yeah, it was usually when I was in New York. [00:55:38] Oh, okay. [00:55:39] Because I was Jersey based. [00:55:40] You were in New Jersey. [00:55:41] And I worked in New Jersey for months, too. [00:55:42] Okay, that's right. [00:55:45] But Tomas, I just have nothing but good things to say. [00:55:49] I know it's boring, but he was always head down and just, like, working really hard. [00:55:53] He was always there before I got in. [00:55:55] He was always there when I left. [00:55:57] Don't worry. [00:55:59] The check is in the mail, Kate. [00:56:01] The check is in the mail. [00:56:02] He's the CISO, and I'm the director of information security. [00:56:06] The check is in the mail, Kate. [00:56:08] Don't worry. [00:56:08] I got you. [00:56:09] All right. [00:56:10] All right. [00:56:10] Thank you. [00:56:11] You're welcome. [00:56:13] That's – we had quite a wild ride there, though. [00:56:18] It was a fun time at Chase, I will tell you that. [00:56:24] And, you know, what's interesting – or not interesting. [00:56:27] What's fabulous about the people that we work with is that if you look across the board and maybe across LinkedIn, you'll see that everybody, including yourself, are doing fascinating things with their career. [00:56:40] And so that core group of people within – that we work with, it's just – you know, I'm honored and privileged to want to work alongside yourself and others that we did have the opportunity to work with. [00:56:54] So it's been a great ride. [00:56:55] Yeah, it's been – it seems like an interesting class of people from that time period. [00:57:00] Yeah. [00:57:00] Stephen Ward out there. [00:57:02] Yep. [00:57:03] It's definitely – [00:57:04] Anthony Calciari. [00:57:05] Okay. [00:57:06] They're definitely making money, those guys. [00:57:08] It definitely aged me. [00:57:09] I can tell you that much. [00:57:10] I don't know if it aged you, but it aged me. [00:57:12] Oh, Jesus. [00:57:14] You know, we – well, I won't talk about it because I'm sure it's not appropriate for me to talk about, but there was something that happened there once that coincided with my house burning down. [00:57:23] I had, like, my apartment building in Queens. [00:57:27] There was, like, this guy hired a plumber, a non-bonded plumber, to do some work, and I ended up. [00:57:36] Catching the entire building on fire. [00:57:38] And, like, I'm laughing because nobody got hurt. [00:57:40] But the building was just totaled. [00:57:42] And, like, we were out of that place. [00:57:44] It was my first home purchase. [00:57:45] I had bought it, like, six months prior. [00:57:48] And we were out for, like, two and a half years or something like that. [00:57:51] But that happened. [00:57:52] And Chase actually put me up in a, like, apartment in the city to deal with the issue that was going on. [00:58:01] And they were really – it was incredible. [00:58:04] It was such a weird experience, though. [00:58:07] It was so weird. [00:58:08] It was so surreal. [00:58:09] What a time. [00:58:11] I guess it was kind of ironic because we were dealing with an incident around that time period. [00:58:14] So it's – you were dealing with two incidents. [00:58:17] But, look, David Elcock, good to see you, my friend, or CEO Avatar. [00:58:24] And I'm sure we're going to hear you in a second. [00:58:25] So go ahead. [00:58:26] Unmic. [00:58:27] And anything you want to ask Kate? [00:58:28] Can you hear me, Tomas? [00:58:33] Yeah, we can hear you. [00:58:35] Sorry. [00:58:36] I'm a little distracted. [00:58:37] I'm driving. [00:58:38] But I had a question that I wanted to ask about the office environment. [00:58:44] There's a company that I sort of represent that today they had a webinar that was focused around mental health in the workplace, [00:58:52] especially for folks that are tasked with some of these really critical positions to help safeguard their company's infrastructure, [00:59:02] safeguard their intellectual property. [00:59:05] And you were talking about giving people a space or making the environment pleasant. [00:59:16] I'll use that term, pleasant. [00:59:18] And is it – well, and my question is kind of twofold, but one, is this – you know, we were having this conversation about mental health, [00:59:25] and, of course, we were talking about CISOs and CIOs mostly, but then it trickled down or it scaled down to the folks that work for them [00:59:33] that report directly to them. [00:59:36] Do you see this as a concern or a challenge in the industry? [00:59:40] Oh, yeah, definitely. [00:59:41] I – when I worked with a journal, I interviewed a couple of different CISOs who had been through some major incidents, [00:59:48] and they discussed, I mean, having to – I mean, this was – these were, like, some major shutdowns, like, [00:59:55] that may have caused the companies to collapse. [00:59:58] And they discussed how they actually brought in, like, PTSD counselors for some of their cybersecurity professionals to, you know, [01:00:07] like, this was a are we going to lose this company or not kind of scenario. [01:00:12] That's really hard on people. [01:00:14] And, you know, I sometimes think of the Equifax incident. [01:00:19] And if you recall, I think it's in congressional testimony, the former CEO, you know, mentioned that it was, like, [01:00:28] the fault of some engineer, I think, in, like, one of their lines of business, like, way down the food chain. [01:00:37] And he was rightfully called out for doing that because it was just kind of petty. [01:00:43] And, you know, you're the CEO. [01:00:45] You can't blame, like, you know, some associate engineer, you know, for a major incident like that. [01:00:52] But – [01:00:52] I think it was an intern, actually, Kay. [01:00:54] I think you blamed an intern. [01:00:55] Oh, geez. [01:00:55] I mean, come on. [01:00:57] That makes me so mad. [01:00:59] But it's things like that that are very affecting to the mental health of people in this field because they think – again, [01:01:06] it goes back to the issue of mistakes. [01:01:08] If I make that mistake, am I going to be, like, this Equifax guy? [01:01:10] And that's why, you know, as a manager, I encourage people to – it might seem kind of dry, [01:01:16] but you do have to surface these obvious flaws in strategy, in your stack, whatever it is, up to senior management. [01:01:26] Say, you have been warned about this problem. [01:01:29] And, therefore, if something goes wrong, you know, this is what I would need to solve the problem. [01:01:35] I would need this many more people or this kind of tool or whatever it is. [01:01:40] And I can have it. [01:01:42] Or if I don't, it is your fault. [01:01:44] But that is a matter of communication. [01:01:47] And it's – I believe that it's that communication that creates a bridge between, you know, [01:01:54] your employees feeling like they're out on a ledge and them feeling like senior management is informed of all of the things that, [01:02:03] you know, they need to be. [01:02:04] And I think that's really – if there's a problem, the buck stops in the appropriate place, if that makes sense. [01:02:11] You know, so first of all, thank you for that because that's – it's very informative. [01:02:16] And it feels like it's coming directly out of you, you know, in some people's form. [01:02:21] So, you know, for that – thank you for that. [01:02:24] Of course. [01:02:25] Thank you. [01:02:25] Questions that we started with were around senior management feeling vulnerable and comfortable enough. [01:02:32] And I earlier heard you say that vulnerability is probably a big skill set or a big tool that senior managers should have. [01:02:39] The environment that you all work in, it doesn't seem like it's – I don't know if the word is appropriate or acceptable that you as a senior manager come to someone and say, [01:02:50] I've got a problem. [01:02:52] I've got some challenges. [01:02:53] And, you know, you're performing. [01:02:55] Everything is going good. [01:02:56] You're performing well. [01:02:57] But now you personally have some things that you're dealing with. [01:03:00] And being able to actually say that comfortably and it be accepted. [01:03:07] What's your feelings or take or position on that? [01:03:11] And I've got one more question. [01:03:12] I promise that'll be my last. [01:03:13] No, this is great. [01:03:15] Thank you. [01:03:18] The fear of – I think everybody who does these kinds of things is that people won't have questions. [01:03:23] So thank you. [01:03:24] I appreciate it. [01:03:25] So I think you just have to cultivate, first of all, a relationship with your employees. [01:03:32] And it takes time. [01:03:35] You know, unfortunately, with so much turnover, that kind of hurts the ability to create those relationships. [01:03:39] But, you know, create a relationship where you're there to listen and where you also, you know, recognize that if somebody who performs a certain way has a change in that performance, [01:03:54] and sometimes the change isn't what you expect, as in, like, often, you know, they're not doing as much as they used to or they're having a falling off in performance. [01:04:03] Being able to tell the difference between that kind of change in performance and ask them what's happening versus, you know, somebody who's consistently underperforming or has just kind of checked out of the job is a skill set that's important. [01:04:20] But as the employee, it can be really difficult because there are a lot of different management styles. [01:04:29] There are a lot of people who – and, I mean, I think as a woman in this industry, and I have been on a lot of, you know, in a lot of meetings and stuff where it's – I'm the only woman. [01:04:41] And I do, you know, especially if the room's filled with engineers, there's a lot of sort of locker room mentality. [01:04:52] You know, people are snapping towels at each other, making fun of each other. [01:04:55] There's, you know, a lot of long hours, a lot of that. [01:05:00] And in that environment, it becomes kind of hard for people to say, you know, I need to step back. [01:05:05] I'm dealing with a sick parent. [01:05:08] I, you know, having issues finding child care, and I just can't commit the amount of time that I used to. [01:05:16] That – people will worry that that's going to be met with the same kind of reaction. [01:05:21] And, I mean, I think as managers, you just have to work on that culture. [01:05:25] And, you know, there's a certain culture around this kind of stuff that is a little bit sarcastic and funny and that sort of thing. [01:05:36] But you just need to be sure that that other side is also there so that people feel comfortable stepping back when they need to. [01:05:43] And as an employee, yeah, you have to – the only thing – some people feel like they can't step back. [01:05:52] But you just have to break through that wall. [01:05:56] And I've certainly found that once you start standing up for yourself, advocating for yourself, nothing but good things happen from that. [01:06:07] You know, your performance is better, and people can see that it's better. [01:06:10] And I have never had somebody actually come back and say, you know, no, that's unacceptable. [01:06:17] There are certainly managers who do. [01:06:19] I hear stories all the time. [01:06:21] I wish people weren't like that. [01:06:23] But it does happen. [01:06:25] But it doesn't mean that you can't – you do have to keep kind of pushing for yourself, unfortunately. [01:06:31] I hope that makes sense. [01:06:35] Good answer. [01:06:37] As I promised, last question. [01:06:39] Earlier, you were talking about how you asked some of your direct reports and folks that report to you, what do you really want to do? [01:06:46] I was part of a – I was experiencing – what is it, Joe Gibbs training, leadership training. [01:06:56] And in that leadership training, they talk about managing your energy with things that are appropriate for you, things that are for you, things that you want to do. [01:07:07] Rather than managing your time or managing your career, just manage your energy, and it leads to better healthy outcomes or better mindful, spiritual, blah, blah, blah. [01:07:17] All those things, outcomes, will not blah, blah, blah. [01:07:19] I don't mean that. [01:07:20] No, no. [01:07:20] I mean, those things are really important, even if you're a CISO. [01:07:24] Right? [01:07:25] Who you are is – CISO is what you do. [01:07:27] It's not who you are, necessarily. [01:07:28] So what is your thoughts on mining your energy more so than managing your energy rather than managing your time or managing your career? [01:07:43] How do you feel about that? [01:07:45] Yeah, that's an interesting question. [01:07:46] I think that my greatest lesson in energy management has come from the pandemic because there was just – there were so many different things pulling on energy. [01:08:00] And I think we take for granted a lot of times how much energy is – mental energy encompasses that when you're thinking about something for a very long time or, you know, especially if you're sitting down and doing focused work where you're dealing with an issue or you're writing a report or whatever it is that's focused, that that takes a lot out of you. [01:08:28] And, you know, I started to notice that in the mornings when we started doing the at-home school and I had – my kids are young, so I had one in kindergarten when the thing started. [01:08:43] God, she's going into second grade. [01:08:44] I can't believe how long this has lasted. [01:08:46] But she was in kindergarten and my son was in second grade. [01:08:50] And, you know, we had, like, two different rooms with the – I mean, the bandwidth on the Wi-Fi was just being, like, brought down to its lowest level. [01:09:02] And I would spend the first part of the morning getting them set up and then trying to troubleshoot online classrooms for a kindergartener and a second grader and, you know, bathroom breaks and lunches being prepared. [01:09:17] And I was just, like, I can't think after this. [01:09:21] Like, it's so much mental energy. [01:09:23] And it's just – by the time 10 o'clock rolled around, I was like, I'm done. [01:09:27] I can't. [01:09:28] I can't do any more thinking today. [01:09:30] But, of course, the day is not finished then. [01:09:32] So I think that really taught me how valuable it is to just kind of step aside a little bit, re-energize your brain. [01:09:45] Don't think about anything for maybe 10 minutes. [01:09:48] Stare at the wall. [01:09:50] I'm somebody who's, like, I'm so hyper that I can't do meditation, so I've tried it. [01:09:54] Like, it doesn't work for me. [01:09:56] I can't do yoga. [01:09:58] Like, it's just too static. [01:09:59] Like, I'm really always kind of hyped up. [01:10:04] But being able to just stop for a minute has been really helpful. [01:10:08] And I think, you know, mental energy, physical energy, all of that stuff, it's tough when you ask somebody to be on – and this is my thing about 24-7 essentials is that you have a lot of people who work in cybersecurity are constantly thinking about it. [01:10:23] And you can't stop because no matter what, you know if something goes wrong, you're going to get a call. [01:10:29] Especially if you're the CISO, you're going to get a call. [01:10:33] And so it is – no matter what you think it is, it is a 24-7 schedule. [01:10:38] You're always, like, expending some version of energy towards it. [01:10:41] So, yeah, I think that definitely being able to really carefully box out what you do can be beneficial. [01:10:51] And today I feel like I have much more control over that, you know. [01:10:55] Plus my kids are now a little bit older, so I can just say, put the shoes on yourself and, you know, you can do it. [01:11:03] I'm out of that game. [01:11:04] And I hope that's helpful. [01:11:08] It's not perfect, but it is what it is. [01:11:11] Yeah, thanks very much for answering and entertaining my questions. [01:11:16] Absolutely. [01:11:17] Thank you so much. [01:11:19] Yeah. [01:11:19] Hey, Tomas, thanks for letting me talk. [01:11:22] Katie and Kate and Lisa and Russell and Anel. [01:11:28] Thanks, guys. [01:11:29] Haven't been around for a bit, been busy, but thanks very much for letting me jump on stage. [01:11:32] Appreciate it. [01:11:33] No, thanks, David. [01:11:34] It's always good to have you contribute to the conversation. [01:11:38] And, you know, I'll say a couple of things with respect to one of your earlier comments there, Kate. [01:11:45] You know, the mental health aspect of what we do at CISOs, I jokingly tell people I wish I could get paid the same amount as baseball players [01:11:57] where they only have to be correct or hit the ball 25% of the time and they're making millions. [01:12:05] Imagine if I could be correct at my job 25%, maybe let's say 30%. [01:12:10] I was an all-star hitter, 30% or 35% of the time. [01:12:15] Like, that would be fantastic. [01:12:17] And it's the unfortunate reality. [01:12:20] And maybe it's – I don't know about it. [01:12:22] I don't know if it's the unfortunate reality. [01:12:24] Maybe it's more self-pressure, if you will. [01:12:27] But if you're wrong in the CISO profession, it becomes a challenging conversation, right, with leadership. [01:12:35] And it's – you know, you mentioned the comment around – which I agree with the comment around how the entrepreneurial books [01:12:42] or the leadership books say fail and fail fast, and I've even sort of told people that as well, right? [01:12:48] And I strongly believe that. [01:12:50] But then I also – in the same vein, I also think about, like, what I do for a living. [01:12:55] And it's like, if I fail too many times, it's not going to be an acceptable sort of failure, right? [01:13:02] It's like, well, you failed, and you probably failed in a bad way. [01:13:06] We need to find another leader to do the job. [01:13:09] And so, you know, that stress that we carry as CISO or security practitioners, it doesn't matter whether you're a CISO or anywhere in that chain, right? [01:13:19] Being a security practitioner, you have that level of integrity and responsibility to your customer, [01:13:24] that level of integrity and responsibility to your colleague, right, if you really truly believe in this profession and what you do. [01:13:31] And that level of stress, it doesn't go away, and it's very, very difficult. [01:13:35] A lot of people struggle with that, and it's very important that we, you know, address it, right, address that there is a challenge there, [01:13:43] and that we spend time talking about it and we try to cultivate better working environments to breed less stress, if you will, [01:13:54] or manageable stress, I'll say, right, because I think security practitioners, it's never going to be less stress, [01:14:00] but it's just manageable stress. [01:14:02] So anyways, I wanted to add that or contribute to that, but I don't want to take away from your comments and what you said, [01:14:09] because I agree with everything that you said. [01:14:12] Yeah, absolutely. [01:14:13] And I agree with that, too. [01:14:14] I think I've almost taken a radically different view, too. [01:14:23] Certainly, the responsibility to my colleagues and everything is something that definitely keeps me up at night. [01:14:31] But now that I've been on a board and I've actually had the experience of, like, asking my CIO and head of cybersecurity questions [01:14:45] and kind of seeing the look of terror. [01:14:48] You know, in my mind, I'm asking these, like, I'm just kind of a curiosity. [01:14:57] I'm like, oh, I'm just interested in what you're doing. [01:14:59] And it's like that's causing him a lot of stress. [01:15:02] And he thinks that if he says the wrong thing, you know, like, it's curtains, you know, or he can't get – [01:15:09] I mean, it just kind of depends. [01:15:10] And I think, you know, there's mistakes and then there's just being a consistent leader over the years. [01:15:21] And I think that doing that, as you have, Tomas, kind of gives you some cushion. [01:15:26] Yeah, and it's – and it's – and it's a – sorry to interrupt you. [01:15:31] And it's, you know, sort of, you know, I'll say planting the seed, right? [01:15:37] Because there is no shortage of breaches or compromises on the news. [01:15:42] And, you know, making sure any good CISO will come in or any good security practitioner will come in and say, look, security is everybody's job, which is a true statement, right? [01:15:52] But it's also – the reason why we say that is because, look, we can't solve every single problem. [01:15:57] And the other reason why we say that is it's almost hedging a bit, right? [01:16:00] It's like letting people know, look, it's not so much that we might potentially get breached or compromised, but it's really how do we respond. [01:16:09] And it's preparing the organization to think in that mindset of, like, look, you know, you have to expect that the cost of doing business, there will be some sort of – [01:16:18] the cost of doing business on the internet, there will be some sort of repercussions. [01:16:23] And those repercussions, our goal is to minimize those so that they're not business damaging. [01:16:28] But you put them in the same vein as, like, you know, I'll go to our financial services days as credit risk and market risk, right? [01:16:36] Those sort of risk management functions that are very well defined, and I'll say the security – [01:16:43] the cybersecurity function is defined, but it's not as established as, like, credit risk and market risk if you think about it from a financial standpoint. [01:16:51] But there's companies, financial services companies that have budgets associated with how much money they're willing to lose [01:16:59] because they know that there will be some level of fraud, if you will, right? [01:17:03] And it's not that they're willing to lose it, but they understand that that is the risk and the cost of doing business for credit card transactions per se. [01:17:11] So that mindset needs to apply for technology risk or information risk or security risk, right? [01:17:18] And until we – not until we get there because I think we're pretty far along there, [01:17:23] and I think there's a lot of very progressive CISOs and very progressive organizations that understand that. [01:17:29] I think they start to allocate – not allocate. [01:17:32] I think they start to condition themselves that, look, it's not so much if we get breaches. [01:17:39] What do we do when that actually happens, and then how do we actually respond and recover and control the narrative, right, [01:17:44] to be able to come out on the better side? [01:17:47] But anyways, I'm sorry. [01:17:49] I don't usually get into these sort of long monologues myself. [01:17:53] Oh, no, no. [01:17:53] This is great. [01:17:54] I don't usually focus on you being our guest at the Fireside Chat. [01:17:59] But it is 9.12 p.m. Eastern time. [01:18:01] Just very, very quick room reset. [01:18:04] If you just joined us, we've been having a very fascinating conversation with a fascinating individual that I've had the privilege to work with alongside Kate Fazzini. [01:18:13] So I encourage you, if you're just showing us, to listen to the playback shortly after this is done because you've missed a good conversation so far. [01:18:23] But those that have been here from the beginning and have stuck through us, thank you. [01:18:28] And Jennifer, always great to have you join the conversation. [01:18:32] Over to you. [01:18:33] Thanks, Tomas and Kate. [01:18:35] I highly recommend you come back. [01:18:36] I have never heard so many words from Tomas in a room. [01:18:40] And he was getting through some of my questions there, but I'm going to narrow it a little bit. [01:18:46] Yeah, he's definitely excited to talk to you. [01:18:49] He kind of brought into it. [01:18:50] So a theme I wanted to ask you. [01:18:52] So I'm coming at this similar. [01:18:55] I'm an attorney. [01:18:56] And so when you were talking about sort of failures, like how you handle failures, and then Tomas was saying you can only fail so many times, I would look at it and go. [01:19:04] It was like, how are you defining failure? [01:19:06] Like everyone's going to get breached, right? [01:19:07] So is that the failure? [01:19:08] Or is the failure in that the company really handled something badly or the person really handled something badly? [01:19:15] Because in my world, we may screw something up or not have, you know, we may lose something or not have handled it best. [01:19:23] But it's not a personal failure or a team failure, I would say. [01:19:26] If we've done the right expectation setting, like how do you handle expectation setting up front, both with the people, you know, like you're reporting to the executive management, getting their understanding of what needs to be done. [01:19:40] Like, so for you, like budget or your knowledge of this, and then your team's expectations of their role. [01:19:45] And then when things aren't going, I would say, like how you're in your management role, how you handle it when it's not. [01:19:54] Like, like I wouldn't consider it a failure if you, like to put it in your world, if something was breached, if you had done all the right process and procedure behind it, and this still happened, or this was what you were limited to, that the company decided, you know, based on risk evaluation, this is how much money they're going to put towards it. [01:20:11] So I was just kind of wondering how you navigate sort of that. [01:20:16] Yeah, it's tough. [01:20:17] I mean, that's, it's a good question. [01:20:19] And the, I think, you know, to some extent, I think that when you go into this field, especially if you're in management at any level, you have to, you know, for your own, your own personal risk is you do understand that if something goes very wrong, if it was your fault, that you might get fired. [01:20:44] If it goes very wrong and it wasn't your fault, you might also get fired and that you might, you are, you know, essentially being, being paid as a kind of sacrificial lamb, as in to say, this program had better go well. [01:20:59] But if we have a major incident, you know, you're the one who's going to take the heat for it. [01:21:04] And you see that with a lot of these breaches, you see the CISO ending up testifying before Congress, sometimes deer in the headlight, sometimes very well. [01:21:12] But I think, you know, another kind of illustrative example is Equifax. [01:21:21] You know, the failure, as Tomas kind of illustrated, was not in the breach as much as it was in the response, really a very tone deaf response. [01:21:33] I personally think that, you know, it kind of continued to be that way up until there were some machinations from the, I think, New York Department of Financial Services about, you know, holding them to what they were going to do for consumers afterwards. [01:21:52] But there was, you know, it's being able to figure out what is the response that your customers want from that. [01:22:07] And, you know, that, of course, who are Equifax's customers? [01:22:12] That's kind of a good question. [01:22:14] You know, are they consumers or are they the banks that are using the stuff, you know, who is it that they would try to please in that case? [01:22:21] But, I mean, for most of us, we would think, like, what would our customers want to do? [01:22:26] And I think when I'm approaching any incident, that's what I'm thinking is, what's the thing? [01:22:34] And sometimes it's almost like a selfish calculation because you're thinking, or at least I'm thinking, maybe because I have a media background, but what's the thing that if it came out in the news, what would be the mitigating factor? [01:22:49] And would it be that we did this so fast to take care of our customers? [01:22:54] We notified them as soon as we heard about it. [01:22:55] Is it that, you know, we made available for them credit monitoring before we even knew very much about the incident? [01:23:04] What is the thing that the customer is going to make them feel the best of it? [01:23:08] And I think if you work towards that, as far as when something goes wrong, if you work towards, and as an attorney, of course, it's the same thing with clients. [01:23:18] You know, you accept the fact that if something goes wrong, you could lose the client. [01:23:23] And you also, if something does go wrong, you're thinking, what is in the client's best interest? [01:23:30] What is the thing that is going to, you know, make this work out for them in the end? [01:23:36] And, yeah, I think just focusing on the end user or the investors or whatever it is that is relevant to your business is one way to kind of go about doing that. [01:23:51] And if it's still so bad that you get fired, again, you know, that isn't the end of the world. [01:23:57] Like, there is, it feels that way sometimes, I think, but, you know, I have seen so many really good cybersecurity professionals who have had major incidents that resulted in them losing their jobs just come back and have even better careers afterwards. [01:24:17] So, there's just, you know, I don't really think there's any clips that you could fall off of and that's a disastrous thing. [01:24:26] I mean, unless you decide to do espionage for like a foreign entity or something like that. [01:24:31] Yeah, Kate, that's a great, that's a great synopsis. [01:24:33] I think there's two big themes I just took out of this. [01:24:35] One is that you guys are disliked or the sheep more than legal. [01:24:42] I'm glad to hear that. [01:24:44] Legal is usually the worst party in the room. [01:24:46] And also the most hated, the most hated and avoided department. [01:24:50] But no way. [01:24:51] I love, I love the legal department. [01:24:54] Well, and if you have a good, yeah. [01:24:56] It's my first one, so. [01:24:58] As long as you have a good legal department. [01:24:59] As long as you have a good, yeah, and I have some funny jokes about that one. [01:25:02] But the other one is also, it's, it's, everything's an engagement or it's an ongoing activity, as you said. [01:25:07] So, it's how you handle it, right? [01:25:08] So, who are the customers and who are the people that were damaged or who are the people that you need to talk to? [01:25:12] Another good example that's recent was Opka. [01:25:14] I couldn't believe their PR releases after their breach was disclosed. [01:25:17] It took them about a week to correct those. [01:25:18] But I was pretty surprised. [01:25:21] So, again, it's who's your client. [01:25:22] Like, the example for me is my client is my company who wants me to close a deal. [01:25:25] But it's also the opposing counsel is my client in any negotiation because that's who I have to appease and make sure I'm meeting their interests. [01:25:34] Right. [01:25:35] So, anyway, super helpful, that thought process because a lot of people don't see broadly to see who, you know, what is the ongoing engagement mitigating factors? [01:25:45] How do you handle the entire scenario? [01:25:46] And then who, who is, who are you addressing it to? [01:25:48] So, thanks so much. [01:25:49] Exactly. [01:25:50] Exactly. [01:25:51] Yep. [01:25:51] Thank you. [01:25:53] Thanks, Jennifer. [01:25:54] Thanks for jumping up our stage and asking your question. [01:25:56] I'm surprised you have any words left after that earlier. [01:25:59] Just kidding. [01:26:00] You know, Octavia is not on here. [01:26:05] Octavia is not on here to give me the, to give me it tonight with my dad jokes. [01:26:09] So, Jennifer just is, is taking up the mantle, I guess, for Octavia. [01:26:14] Look, it's been a, it's been a very fascinating conversation. [01:26:17] And, and it is true. [01:26:19] I don't usually try to overshadow our guests by talking too much. [01:26:24] I appreciate it. [01:26:25] I appreciate it. [01:26:26] We're old buddies. [01:26:27] All right. [01:26:28] We sure are. [01:26:29] And, and, and I am excited that you're here and I'm, I'm happy and pleased that you, [01:26:34] that you decided to do this. [01:26:35] So thank you for, for your time. [01:26:38] Look, if there is anybody else in the audience that has a question, feel free to raise your [01:26:43] hand. [01:26:43] We'll bring you up on stage. [01:26:45] I'll pass it back to our moderators to ask you another question. [01:26:49] And then we will start to conclude it. [01:26:51] We have about 10 minutes or so left because I want to be respectful of everybody's time. [01:26:55] Ooh. [01:26:55] Ooh. [01:26:55] My moderators are. [01:27:01] Sorry. [01:27:01] There she is. [01:27:02] There's Katie. [01:27:02] Well, no, I, I'd always ask, um, you know, at this point, I'm an avid reader, listener [01:27:09] of podcasts, um, you know, trying to find time, but you know, as a, as a busy mom and, [01:27:14] and, uh, you know, see, so figuring out where I can get all that stuff in and, and be able [01:27:19] to, uh, move forward with, uh, my education. [01:27:22] So, so what are you reading? [01:27:24] What are you listening to? [01:27:25] Is there anything that you'd give us as like a, um, you know, best thing you've listened [01:27:30] to in the last three months moment? [01:27:33] Oh gosh. [01:27:34] I, um, for podcasts, I was like, I was like, I've really been getting back into opera lately, [01:27:40] but, um, I just got tickets to Romeo and Juliet at the Met, uh, this Friday. [01:27:47] So, um, I'm psyched about that, but that's what I'm listening to. [01:27:49] Um, but, uh, podcasts. [01:27:52] So I, you know, um, I, one of my favorite podcasts is done by a guy named George Reedus, [01:27:59] who me and Tomas used to work with. [01:28:01] Um, he has, uh, a really, uh, interesting podcast where he brings on, he's a former secret service [01:28:08] person. [01:28:08] Um, he kind of brings on people who come from that law enforcement background. [01:28:12] And then besides that, I'm like, I'm a huge true crime fan. [01:28:15] And, and I honestly get a lot out of just these really dry procedural kind of, um, podcasts [01:28:24] that go over different cases because there's always so many elements that I feel like are [01:28:28] relevant to my job. [01:28:29] And then it's also like a little bit of a break from my job to think about something else. [01:28:34] Although obviously I'm not doing the most optimistic type of pursuits in my off time, am I? [01:28:40] Um, but yeah, I, I'm really interested in, in true crime. [01:28:44] I've, I've, I've been very interested in organized crime as well. [01:28:47] So, um, anything related to that, I've been, uh, kind of soaking up. [01:28:52] Um, and, and I've, I've learned a lot. [01:28:56] Um, so it's actually, and I live in Fort Lee, New Jersey, by the way, where, like around where [01:29:02] they filmed the Sopranos. [01:29:03] Um, in fact, I think the Bada Bing is like right up the street, which gives you an idea [01:29:09] of the kind of neighborhood I live in. [01:29:11] Um, uh, it's, uh, it's a very interesting, um, interesting place. [01:29:16] And we just had a case recently that involved, um, the Italian mafia and proceeds from different [01:29:23] kinds of cyber crime. [01:29:24] And I was really fascinated by that. [01:29:26] And I think learning about how these criminal organizations are structured, um, and, you [01:29:33] know, bringing that into how the, the, the criminals who are kind of our adversaries in [01:29:39] cyberspace are similarly structured is something that's really interesting to me. [01:29:44] So I'm sorry that wasn't so specific that, uh, yeah, I've been really into organized crime [01:29:48] stuff lately. [01:29:49] And, and the Russian mafia stuff is so interesting, um, especially with, with, uh, you know, the, [01:29:54] the war and what's going on there and how they interact with, um, the politics. [01:29:59] So fascinating. [01:30:00] Well, I'll say, Kate, um, there are a few times that I wish this was an audio app. [01:30:05] I just, if you could have seen my face, like, absolutely. [01:30:08] This is what we're all talking about. [01:30:10] Uh, I just got a text from somebody in the room, like, yes, like this is, we were just [01:30:14] talking about this yesterday. [01:30:15] So yeah, we, there is a ton of correlation to our daily lives and all of these, what some [01:30:20] people feel are almost cinematic and outside of our reality, but it is our reality. [01:30:26] So I do appreciate that you are paying attention to those things. [01:30:30] And, and, um, and also there is some entertainment in, um, uh, when they, they put it all together [01:30:36] in these docu-series as well. [01:30:38] And just, um, yeah. [01:30:39] And I thought of that too. [01:30:41] I think, I think, um, you know, my, my million dollar idea or probably like my thousand dollar [01:30:47] idea is that, um, there should definitely be a true crime podcast or cybersecurity. [01:30:53] That's actually interesting. [01:30:55] Like, so like, like if you read some of the, um, indictments, like if you read, oh God, [01:31:01] the Russia hacking one. [01:31:03] Um, if you read like some of the North Korea stuff, um, the, um, the Huawei, uh, the, the [01:31:10] back and forth that's been going on there and, you know, T-Mobile and Huawei and these like [01:31:16] espionage, apparently Huawei sent over these supposed, you know, like students who were going [01:31:25] into T-Mobile labs. [01:31:26] And this is one of my favorite stories. [01:31:28] I didn't write it at CNBC, somebody else did, but, um, Steve Kovach, I'm sorry, I should [01:31:33] say his name or it'll be pissed at me. [01:31:34] Um, Steve Kovach wrote this story, one of the San Francisco editors. [01:31:39] Um, he, it was about, they have this robot, um, that they use that, that is just like a [01:31:46] butt with jeans on and the phone is put in the back pocket of the butt and it sits down [01:31:52] over and over again, like a hundred thousand times, you know, to test how much the phone [01:31:56] could be, um, you know, so Huawei, anyway, I love that aspect of the indictment because [01:32:04] it, it involved, um, the Huawei people coming over there and copying their design for like [01:32:09] the butt machine that sits on phone. [01:32:12] Um, so anyway, that is very cinematic, but it's also, it's just the perfect, like kind [01:32:17] of IP theft story, I think. [01:32:19] Um, anyway. [01:32:22] Sorry to have died crashed into, um, some vulgarity here. [01:32:26] Yeah. [01:32:26] Yeah. [01:32:26] And guys, yeah. [01:32:28] 930 on a Wednesday night. [01:32:29] So that's it. [01:32:33] Wow. [01:32:34] Yeah. [01:32:34] Your bedtime alarm did go off an hour ago. [01:32:37] So we, yeah, we get you. [01:32:39] We feel you. [01:32:39] Yeah, exactly. [01:32:40] And I, and I guess we've come full circle with, uh, you know, the Amish upbringing, the [01:32:44] Bada Bean Club and, uh, and everything in between. [01:32:48] So, uh, wow. [01:32:49] Exactly. [01:32:50] Um, you know, you mentioned George Reuters. [01:32:52] I, I, I need to reach out to George because yeah, you're right. [01:32:56] His task for seven radio podcast. [01:32:58] It actually is a pretty decent one. [01:33:00] I gotta get, I gotta get George on this side of the table. [01:33:02] He had me on his side. [01:33:03] I gotta get him on this side. [01:33:04] So that'd be interesting conversation. [01:33:06] Uh, look, it is 927 PM Eastern time. [01:33:09] We are going to start to, uh, conclude or start to wrap up our, our show this evening. [01:33:15] I know folks, uh, don't want it to end, but again, we do want to be respectful of everybody's [01:33:20] time. [01:33:20] And Kate's, uh, Kate's bedtime alarm did go off. [01:33:27] So, uh, so, uh, if you just very quick announcement, uh, please join us back next week. [01:33:33] We do have, uh, another fireside check cause we do this every single Wednesday. [01:33:37] Uh, next week is Kendrick Trotter, who's the founder at us in technology. [01:33:41] So please, uh, tune in to us, uh, next week and I'm sure that would be a really interesting [01:33:46] conversation. [01:33:47] Um, so Kate, I usually like to ask this question and, uh, and I, I probably should be more respectful. [01:33:55] My moderators, moderators, any final questions before I sort of ask that, uh, typical last [01:33:59] question. [01:34:03] All right. [01:34:04] Hearing silence from the mod. [01:34:06] So Kate, I usually like to ask this last question and it's, it's really, you know, a [01:34:10] self, I'll call it a self-reflection question. [01:34:12] So if you had any piece of advice for the younger you, what would it be and why? [01:34:19] Oh, don't marry that guy. [01:34:20] Sorry. [01:34:21] Um, yes, yes. [01:34:26] I think he can all agree. [01:34:29] No, um, I really, that is, that is it. [01:34:31] But, uh, I think just, um, enjoy the ride, you know, uh, it's, it also just keeps getting [01:34:39] harder and that's okay. [01:34:41] You just have to keep getting more resilient. [01:34:43] Um, unfortunately, kind of like cybersecurity, right? [01:34:45] It's never going to get easier. [01:34:47] Um, it's never going to get better. [01:34:49] We just have to keep getting more resilient. [01:34:51] Um, so yeah, get more resilient. [01:34:54] That's it. [01:34:57] Awesome. [01:34:58] Well, Kate, look, uh, uh, I sincerely appreciate you taking the time out of your busy schedule [01:35:05] to join us this evening. [01:35:06] Um, so a million thank yous to you. [01:35:09] Uh, hopefully you had a good time. [01:35:11] I know I did. [01:35:12] And, uh, you know, I'm sure the moderators, uh, I'll shut up and I'll let them say a few [01:35:17] words before we kind of bring us home. [01:35:23] Thanks, Kate. [01:35:24] Appreciate you sharing insights throughout the night. [01:35:29] Yeah. [01:35:30] Thank you guys so much. [01:35:31] Thank you. [01:35:32] You, you've been an absolute inspiration. [01:35:35] So thank you for, for being with us in this moment and for sharing part of what makes you, [01:35:41] you. [01:35:42] Absolutely. [01:35:43] Thank you guys so much. [01:35:44] Thank you all for sharing so much. [01:35:45] Um, this was terrific and I'm looking forward to hearing some more of these. [01:35:49] So, uh, I'll see you guys again. [01:35:55] That would just be my final thought is, yeah, don't be a stranger, Kate. [01:35:58] Please, please come back and, you know, continue to contribute to this community. [01:36:01] But yeah, I'd love to stay in touch and, um, just really appreciated your candor and your [01:36:05] insight and what an amazing evening. [01:36:08] Thank you. [01:36:08] Yeah. [01:36:09] Thank you guys. [01:36:10] Yeah. [01:36:11] Totally great. [01:36:11] An amazing night. [01:36:13] Thank you, Kate, for spending it with us here on Clubhouse on behalf of ourselves as one of those [01:36:17] listening in live and on the replay. [01:36:19] Thank you. [01:36:19] And I'm, I'm pretty proud of myself. [01:36:22] I didn't mess up your name, Kate, even though I thought I would, uh, because, because Katie's [01:36:29] with us and I'm used to saying Katie so much because I, we chat every week, but, uh, Kate, [01:36:34] I'll leave you with some final words and bring us home. [01:36:37] Sure. [01:36:38] Of course. [01:36:38] Um, just thank you guys. [01:36:40] I think it's so important, uh, for cyber security professionals to talk to each other. [01:36:44] Communication is probably the biggest, uh, difficulty in this field. [01:36:48] So, um, this is really a critical thing and, um, keep it up. [01:36:53] Thank you, Tomas, for putting it together. [01:36:56] Awesome. [01:36:56] Thank you. [01:36:57] Uh, thank you everybody for joining us this evening. [01:36:59] Uh, we'll see you back next week. [01:37:01] Have a good rest of your week. [01:37:02] Uh, hopefully it's enjoyable and peaceful and you can enjoy the rest of the sort of nice [01:37:07] weather wherever you are. [01:37:08] Uh, see you guys next week. [01:37:10] Cheers. [01:37:11] Bye everybody. [01:37:12] Okay. [01:37:12] Bye. [01:37:13] Bye. [01:37:13] Good night. [01:37:13] Bye everyone. [01:37:14] Good night.