Fireside Chat w/Lance Spitzner, Director @ SANS, Founder @ Honeynet Project

Hello and welcome to our fireside chat. This is the replay and you got here right on time. So thanks for joining and thanks for being a member of our community. We hope you enjoy the rest of the show. For this evening, our special guest is Lance Spitzner and so glad that everyone's here. I've been looking forward to this conversation. Lance, I believe we put you on the schedule maybe a month or two ago and really eager to have you share some information with us as we get started. Kind of the some of the disclaimers that we have. If there's any vendors here that want to sell us things, we would prefer you to do that at another time versus the time that we have allotted for fireside chat. As Katie mentioned, we've been doing this for a year and a half plus now every Wednesday night at 8pm until about 9.30pm Eastern Time. The format that we have, the moderators, the folks up on the stage with Lance will ask questions about the first half or so of our time. And then the second half, the folks who are in the listening state, the lower section of here, you feel free to raise your hand and I will be able to bring you up on stage so that you can ask questions of Lance. For many of us, for many of us, the views that we reflect here, the words that we say here are representative of ourselves and not necessarily for our companies. If anyone's recording or want to reuse any information here, please do check with someone on stage before doing so. Let's see. Other moderators, am I forgetting any of our standard disclaimers before we get started? Take a deep breath, have fun. It's a conversation. This is why we do it in the evening. Maybe that part. Ah, I love that. The most important part. Yeah, have fun with this. That's our goal. I think it's time so well. I've got it on my calendar, a recurring calendar reminder. If you don't already have that, we'd love to invite you to come for future conversations that we have here. Lance, what we'll do is we'll briefly introduce ourselves and we'll leave you till the end, Lance, just so everyone can be aware of the folks who are here on stage. And then we'll start to get you started at sharing your origin story, some information over the journey that you've taken to get to where you are today. And we'll do that now. So I'll get started and I'll pass over to St. Russell Eubanks. Been running my company, Security of Rafter for the last three years, virtual CISO, teach with SANS and work with Lance actually in full disclosure quite a bit. But Hussein, let me pass it over to you to introduce yourself next. Good evening, Lance. Welcome to the Firefly Chat. I'm Hussein Syed, C-Sweat Robert Wood Johnson Healthcare System in New Jersey. The opinions are mine. The views are mine. Over to you, Katie. Thank you, Hussein. Good evening, everybody. I'm Katie Hanahan. I am the VP of Cybersecurity Strategy for Boutique SI out of Chicago and also run our VP so program. So I'm a VP so or a CISO for a company as well. Over to you, David. Thanks, Katie. David Cass, Global CISO for GSR. We are a global crypto market maker. So it's been a busy day today. Other than that, former federal appointee, adjunct faculty for Harvard and Rutgers Law. So happy to be joining everybody today. So Russell, back to you. All right. Thanks, David, Katie, and Hussein. And Lance, the format that we'd like to have is, we'd like to just have you share with us kind of what you're doing, how you got to where you are. We like to call it your origin story. I'd like you to take as long as you like, some highlights. And then following that, we'll pass over to the moderators to ask you some questions, get to know you better. And again, our goal is to help people understand you and perhaps get inspired, motivated to be all they can be. But Lance, I'd love to have you just take the mic and again, take as long as you like and love to get to have the audience have the privilege to get to know you this evening. So Lance, the floor is all yours. And Lance, I'm not able to hear you right now. Sorry about that, Russell. So first of all, I didn't know you were going to have all those heavy hitters here. So I'm a little on the intimidated side, but I'm gonna do my best I can to keep people entertained here. So at first, folks, hey, my name's Lance Spitzner. I'm not going to talk that long. I always feel a little odd talking about myself. So I'll give you the quick down and dirty overview. And then we can jump in from there. I've been in cybersecurity for almost 25 years now. So started in about 98, 99. So my path into cybersecurity is a little bit odd because back then there really was no path. In a lot of ways, I literally stumbled into it. Let's see here. I was an officer in the army, actually a tank officer. And when I got out as a history major, so I had no technology background, I was in a situation where not many job opportunities for tank officers that were history majors. So got my MBA. And while getting my master's, I really started to love the idea or the information world, the cyber world. Back then, cybersecurity was not a thing, 95, 96. So while I was getting my master's, I took an internship in a tech company. They work in the world of Sun Microsystems. So that's where I started my geek world. And there was this new technology that nobody had ever heard of called the firewall. And nobody wanted anything to do with it. Because in the tech world, it was all about databases. So as the intern, they gave it to me because nobody else wanted it. And that really started my cybersecurity career. So I'm one of the living proof that you don't need a cybersecurity degree, you don't even need a technical degree to get into cybersecurity. I was highly technical for about 10 plus years. But everything I did is what I learned on my own. It's amazing what you can learn by building a lab and banging away at that keyboard. So the first 10 or so years very much focused on the technical side to include teaching at SANS Institute as an instructor. But about 10 plus years ago, I flipped to the human side of cybersecurity. That is where I passionately feel I can make the biggest difference and where I really enjoy because I love working with people. And I'm actually now full time at the SANS Institute, both as an instructor and at SANS Security Awareness. So my job and passion is all wrapped up around helping organizations on the human side of cybersecurity. It's a very exciting time because there's a lot of movement in the human side of the world now. So that's kind of the short overview of how I got here and why I'm here. Not exactly sure what you were expecting, Russell. Lance, that's fantastic. And the great thing is there's so much to work there. First of all, I think I ever said to you, thanks for your service to the Army as a tank officer. I really appreciate that. And I imagine a lot of folks would say that. But, you know, Lance, you talked about, you know, it's hard to find a need. Maybe you looked at the job ads, you know, tank officer, history major, just didn't really show anything. But I know one of the projects that you worked on before, the Honey Nut Project, you know, I believe you're one of the founders. We've had another founder on with us in the past. Can you tell us what was it like to do that and kind of start that movement that maybe some of us, maybe many of us are familiar with now? What was it like back then when you and some others came up with that idea with the Honey Nut Project? So sure, that was probably around 99, 2000. Back then, cybersecurity is very, very much the wild, wild west. So what happened? I got out of the military, got out of the master's program, and here I find myself in the world of cybersecurity and ended up starting with Sun Microsystems on their cybersecurity team. I ended up at Sun Microsystems because I was doing so many firewalls on Sun Microsystems computers that I was publishing papers and tools on how to automate the installation and security of Sun boxes for firewall installs. So Sun, the security team at Sun saw that, picked me up. So I was full-time cybersecurity at Sun Microsystems, and here I was attempting to secure some of the biggest companies around the world. And as I was traveling around the world to secure all these organizations, what frustrated me is there was no intelligence, no information on who the enemy was. A big part of my experience in the Army was literally know your enemy. Military intelligence, military intelligence briefings. So there was really no world of cyber threat intelligence in 99, 2000, 2001. So I created this concept of honey nets. And what makes a honey pot different than a honey net is A, it's a network of computers, but B, nothing was emulated, nothing was fake. I just built a real network behind a firewall and I let anything in and nothing out. And I used that to capture all sorts of information and it really grew. Now, this does not sound very innovative or world shattering, but really 20, 25 years ago, there was nothing really like this. So learned a lot, met a lot of amazing people and really grew from there. So that's where I really developed my technical skills, building the systems, analyzing these systems. So I got very good at system forensics, network forensics, system hardening. So my specialty became on the security side, both systems and networking. I have no coding skills. If you ask me to secure a developer, we're screwed because I can't, that's just not my field. But really over about a 10 year period, met a lot of really smart people. We published a lot of papers and a couple of books in the process. And now you have the world of cyber threat intelligence, where all these individuals are just doing amazing things to include, you know, things like the MITRE ATT&CK model. Awesome. I appreciate that. I had a feeling you might have a little bit to say about that, but rather than just keep belting you with questions, I'm going to pass the mic over to Hussain. Hussain, up to you, my friend. Hi, Lance. So I do remember, you know, working on Checkpoint firewalls on Ultra 10. Oh my God. Those are fun days. We do like to take our guests back to their childhood a little bit. So do you like to speak a little bit about where did you grow up? What did you do as a child? What intrigued you to go into the military for the service? By the way, thanks a lot for serving. So get to let the attendees hear you, you know, talk about yourself a little. Yeah. I mean, nothing really exciting about my childhood, typical suburban childhood in the suburbs of Chicago. I'm trying to think of anything exciting to share. Nothing really exciting to share. One of the odd things is while growing up, I always thought tanks were cool. Most kids growing up wanting to fly jets, I grew up wanting to play with tanks. So when I went to college, I also enrolled in ROTC, that stands for Reserve Officer Training Corps. And it's a fantastic way to just really kickstart your career in life. Because what's great about ROTC or ROTC is you're at school, but you're also learning leadership through the military. They pay for school, you go serve. And then when you get out, you're ready to go into the corporate world. But no school loans, you've had a lot of skills and you've had a lot of experience. So childhood wasn't too exciting, pretty standard suburban life. College, ROTC, military, that's what really helped develop me into who I was today. Got to ride tanks for four years, got that out of my system. And so a lot of the leadership skills I have today, I would have to really say thanks to the military. So I would say the military really helped influence and guide me to where I am today. Thank you. Perfect. Over to you, Katie. Oh my gosh. You guys are tag teaming here? Oh, listen, this is the hot seat, my friend. Have you not listened to all 100 episodes of this program prior? I am a science institute professor. I am very surprised. Yeah, we do put you on the hot seat a little bit. And if it makes you feel any better, all of us have been in the hot seat at one point or another, if it makes you feel better. Probably doesn't. But I will make you feel better better and much more welcome. So listen, I love your story and preparing for this interview tonight. I noticed that you are a history major. By the way, I was too. I also am in the Chicago area, which I think is probably why we have over 400 connections on LinkedIn together. Oh my gosh. I'm assuming we've met somewhere along the way and I'm hoping late at night in a bar. I believe that we have a lot of people in common. But yeah, you also said something that I say all the time when I talk about my origin story into cybersecurity, which is that I stumbled into it a little bit. And with my military history degree, I ended up supporting the military. And just because you love tanks, I just want to tell you something. This one time at Aberdeen Proving Ground, I'm just there, you know. Oh, I've always wanted to go there. Well, I had a moment you would have liked because I got to a stop sign leaving the meeting I was at, and there was a tank coming off of the range. And I was like, well, I was here first, but who has the right of way? I think that the tank took it and I was glad he did. I don't know if you, I don't know what your position was in the tank. What is it? E-181? Is that what it is? Yeah, close. M1A1. Okay. Sorry. So many acronyms. But yeah, that was one of my moments where I was like, wow, I cannot believe that I stumbled into this industry. I can't believe that I just was at a stop sign with a tank and had to think about whether or not who had the right of way. So thank you for your service. And it was interesting to me when you were talking about your story and you're talking about how the military and being an ROTC for you really developed you into the leader and helped you, you know, quote unquote, stumble. I think we all kind of, we, it's serendipity brought us here, but I think it was destiny for all of us to be in this community, particularly if you're in this room tonight. And what I would love to know more about is, you know, what was the, the, you know, kind of impetus for you to even think about ROTC? Just because I think that some people, you know, don't even think about that as an option for them, but then also expand a little bit more on the leadership skills and the things that you've carried into the rest of your career in cybersecurity. Sure. And so what's interesting is I can kind of contrast the leadership that I learned in the military versus the management that I learned in my MBA program. What's really interesting is, so first of all, when I went to college, I really didn't know of or plan ROTC. It's just one of those in my freshman year at the university. I went to university of Illinois and Champaign-Urbana. They have an event called quad day. So as an incoming freshman, there's hundreds and hundreds of booths all set up with all these different clubs, activities, and organizations. And one was the ROTC. And how he's having a fascination with tanks. I stopped by the booth and boom, you know, found out, Hey, there's career options. There is scholarship options and things like that. So I signed right up and it was a fantastic decision. And what's interesting is what I really love in ROTC is we didn't learn how to manage. So you're not given spreadsheets. You're not looking at numbers, profitability. You're not trying to quantify, are we doing good or bad? Really one of the key things they home in, in the military. And so I have a son that's right now in the Marine ROTC, and he's experiencing and shared the same thing is you really learn to take care of your troops. And as a leader, what happens in ROTC is they don't teach you how to manage. They literally put you in the position. All right, you're in charge of these 20 people. We're going to go spend the weekend in the woods. We're going to go on, you know, training maneuvers. You're in charge of making it all happen. Have fun. So what happens is the professors and the cadre are teaching the senior people how to lead. And the senior cadets, juniors and seniors in college, are actually doing the leading of the freshmen and sophomores. And like you said, by leading, it is all about how to take care of your troops, inspire your troops, things like that. What's a great way to learn about this approach is there's an author named Simon Sinek. And one of his books is Eater Leaders Eat Last. And if you've never read Simon, he's great. He helped inspire a McSands class that both Russell and I have written, real big on culture. And what's great about Simon is he compares the culture of the business world versus the military and the differences on especially on the idea of leadership. So yeah, the big thing there is from a leadership perspective, you tend to be focused on people. On the management perspective, you tend to be focused more on numbers. And I'll be honest, it's not that one is better than the other. Each has their purpose and role. If you're a fantastic leader, but a terrible manager, your company can still go out of business. So I don't like to say one's better than the other. Each has their unique skills. And I'm probably better than a leader than I am a manager because I'm really bad at numbers. I'm really bad at details, especially my wife. She'll tell you that I'm terrible at those. Well, what do you do? Sorry, you took a pause. I want to make sure I didn't interrupt you. Yeah. So what do you do then in terms of when you discover you may have, you know, a strength in one area and maybe a deficit in the other? Is that it was your next step then to surround yourself with people who can make up that deficit or kind of help us understand when you're you're making this amalgamation of both, you know, the leadership style for the military and and the business world and everything you learned in your MBA. What's the what should we do then as leaders in this space? Oh, wow, that's a really good question. It's almost like a cognitive bias question, being aware of your biases and realizing, you know, do you fix them? Do you try to adapt to them? Well, the first step is simply be aware of them. So I know that I am terrible in finance, terrible in detail, terrible at tactical. I love not thinking through things and just jumping right in. So I'm really good at trying new things. I'm really bad at thinking them out or through. So, Katie, you kind of hit on one or two good points, you know, identify where you're weak in and partner with those that you're strong in. So from a business perspective, when I'm working in a business environment, when it comes to finances or things like that, I always depend on those that are much better than much stronger than me. I've been in corporate meetings before they throw up a spreadsheet and they're all talking about the numbers and the bottom lines and what these numbers mean. And that means in 30 minutes into it, I'm still trying to figure out what's this spreadsheet about. So the big thing is, yeah, understanding where you're weak at, partner with those that are strong in and then try to develop those strengths, but also leverage your strengths. So like I said, so for example, one of the things I'm in charge of is the annual SAN Security Awareness Summit. It's a huge event. We get 5,000, 6,000 people, both virtually and person. And I'm really good at the big picture, but I work with some of the SAN Summit team that are outstanding at the operational stuff and make sure I don't forget things like emailing speakers and coordinating agendas and things like that. So Katie, I think it's all about, you can't do everything well. So figure out what you're good at and partner with others that make up for your strengths. So you make up a really good team. Yeah, I appreciate that. And certainly, I think any great leader understands that. And yeah, your perspective, having had both, and like I said, in working with the military as supporting them as my client, the culture piece, I gleaned eight years of my life. That was my life. My clients, my peers, my colleagues were in the military. And so, but I certainly just appreciate someone coming to the stage and helping us recognize that there are things that we can take from every aspect of all of our leadership experience, whether that be in business or in military. And then the fact that you're able to bring those together and even incorporate some really great curriculum is just really, it's inspiring, Lance. So just thanks again for answering the question. Joining us tonight, I'm going to go ahead and just pass the mic over to Mr. David Kass though, because I could ask you like 10 more questions and I'll save them for another, for a little bit later. David, over to you. Thanks, Katie. So Lance, I mean, you know, great background. And you mentioned the human side of things. So as a CISO, I think, you know, that's probably one of the things that we all struggle with from the security awareness point of view. How do you, you know, what's good really look like for an organization and how do you maintain it? Because I think external audit has a different view of the a hundred percent all the time, passing rate a hundred percent all the time for the security awareness. And it's kind of like, okay, so if that was the case, we wouldn't really need to do it. So, you know, what, what does good look like and how do organizations get there and maintain it? Sure. That's a great question. Let's take a step back. I'm less concerned about what you call it. Some people call it security awareness. Some call it behavior and culture. Some say influence and engagement. To me, it's all about managing human risk. Now, traditionally, security awareness has a bad rap and in a lot of ways it deserves it because traditionally five, 10 years ago, security awareness was about compliance, death by PowerPoint once a year, click the box. But in today's world, security awareness is, you know, security awareness 2.0. If you even want to call it that, and I'm not sure that that's a good term to call. Really, it's all about managing human risk. And this is a big movement that you're going to see really start happening even next year. Forrester is going to have their human risk wave. Gartner's coming out with their behavior and culture quadrant. So a lot of the analysts, a lot of the vendors, a lot of the industry is moving away from this idea of awareness and compliance. And it's moving to this idea of, well, whatever you want to call it, the reason we're doing it is to manage human risk because people represent such risk to organizations today. One number, if you follow the Verizon DBIR, 80% of breaches involve the human, or I should say the human has been involved in at least 80% of breaches. And that's a number that's been consistent for the past three years. So this is nothing new. People are being targeted by cyber attackers. People are making mistakes in the cloud. So what happens is people represent probably some of the greatest risks in the world today. And in part, it's because we've gotten really good at using technology to secure technology. Now it's time to also start securing the human operating system. So back to your question, what does good look like? Well, first of all, what are we trying to achieve? Manage human risk. How do we know organizations are doing? So, you know, that's the benchmark I measure. How are we doing good? Well, how effectively are they managing human risk? So what would good look like? Somebody or a team dedicated to managing the human side of cybersecurity. That team is part of the security team. So if it's security awareness, we're calling it, or like I said, it could be behavior and culture, it could be security engagement and influence. It could be security training and education, whatever you want to call it, that team first should be part of the security team, not reporting to HR, not reporting to legal. They should be focused on managing human risk. That means they've worked with the security team to identify the top human risks. Is it phishing? Is it passwords? Is it accidental, like misconfiguration in the cloud? Is it mobile devices? We've identified our top human risks. We've identified the key behaviors that manage those risks. And then we're effectively communicating and training on those behaviors. So you asked, what does good look like? Well, I would say good looks like the organization has identified the top risks, the behaviors that are managing those risks, and they're changing those behaviors. So I would ultimately look at, are we changing people's behaviors? What's the adoption rate of MFA? What's the adoption rate of password managers? Has the click rates gone down? Has the reporting gone up? Has the use of encryption gone up? Has the vital number of policy violations gone down? So good. Ultimately, are we reducing human risk? How are we reducing human risk? By changing human behavior. So that was a bit of a long-winded answer, but A, I'm looking at, are we managing human risk? And ultimately, that is done by changing human behavior. And that is why I really feel the security awareness team, or whatever you want to call it, is part of the security team. Because they've got to work with the SOC. They've got to work with IR. They've got to work with cyber threat intelligence. So they better understand those risks, and they better manage those risks. If I hear security awareness, or whatever you want to call the team is reporting to HR or legal, you're dead in the water. All you're worried about is compliance. So not sure if that answers the question. That's definitely a great point. And then kind of digging in a little deeper on that, you know, I mean, for instance, I work in crypto, so everybody is a risk for me. But in the space of, you know, changing culture and changing behavior, how do you switch between essentially almost the carrot and the stick approach? Because you have some that get with the program better than others. And then you have others where, you know, I hate to say punitive tactics are needed. But you know, what, what is the balance? And where do you start usually? Sure. So let's take us just a step back. What do we mean by security culture? By the way, Russell and I have an entire five day course just on this. So really, first of all, culture is people's shared attitudes, perceptions, and beliefs. So a security culture is people's shared attitudes, perceptions, and beliefs about cybersecurity. Now, why do we want a strong security culture? The stronger your security culture is, the more likely people will exhibit secure behaviors. So it's not that a security culture means you're secure. A strong security culture means you've created an environment where people are far more likely to behave securely. So both very closely related, but the goal is not the security culture. The goal, the ultimate goal is changing behavior. Now, you were talking this, the idea of more of a punitive environment, more compared to, you know, incentive environment, carrot and stick. The whole idea of a strong security culture is, do people ultimately trust the security team? The biggest drivers of your security culture are the security team. If your workforce trusts your security team, you're going to have a positive security culture and people are more likely do the right thing. If you have a very punitive culture, a very opaque culture, so nobody understands what the security team is doing, nobody understands why, all they know is they're getting bad, bad you emails from the security team. That can create a very toxic, untrusting, negative environment where people are now trying to avoid the security team. Think about it. If the security team goes down the punitive path you just described, let's say somebody falls victim to a phishing email and they know they fell victim. They know they just caused an incident. But if you have a very punitive, untrusting culture, very much the stick, that individual may not report it because they're afraid of their job, they're afraid of, you know, yeah, their position. So in general, I avoid this stick whenever possible and try to focus on the carrot. Russell, you teach the class. Anything you can add to that? Man, look at you put me on the spot. I appreciate that. And you know, Lance, I was going to ask you a question that was kind of lead into this. It's actually is a great one. You know, oftentimes in our class, you know, security culture, oftentimes I've seen, I imagine you see when you teach the class too, that folks say, you know, folks come in and says, you know what, fix that culture, have those executives understand cyber, let them give us money, let us go brief the board and such. But what's fascinating is through the journey of the materials is this idea that says, you know, it's not about that at all. Security culture is about molding and changing the culture of our security teams. And for those of us who are leaders or CISOs, you know, changing the team that you're privileged to lead to better meet the needs of the business. It's like this aha, there's this light. I mean, oftentimes we teach this class online, but I can just see on the camera, oh, that's, that's what it means. That's what it looks like to be able to not try to change the culture of the company, but change something that you're empowered to do. And it's just, I love when, when that point sticks with folks and just in my mind, folks go out and make changes as a result of that subtle little change versus what they expected versus what we talk about quite a bit. So that's what I would share. Yeah. So it's interesting culture. And this comes back to the idea of the military teaching about leadership and even Simon Sinek's book, Leaders Eat Last, is one of the labs that Russell and I do about security culture is when you say, hey, describe your security culture. Or if you go to your workforce and go, what do you think of our security culture? People in your workforce are going to be like, um, I don't know, because, you know, security culture, what do you think about cybersecurity? It's very vague. But if I go to anybody in your company and I go, hey, what do you think of the security team? Now you're going to get far more specific answers. Oh, the security team. And one of the things that Russell and I have done is we've created a list. And if people start using words like fear mongering, arrogant, egotistical, too technical, if people are using words like that to describe your security team, those are indications that people don't trust the security team. And you're ultimately going to have a very negative or toxic security culture. But if people are using words words like helpful, approachable, collaborative, friendly, enablers, humble, even humble, yes, to describe the security team, now you're building a much healthier, stronger security culture, because it's all based on trust. And in many ways, these are examples of leadership skills, and something that's really amplified in books like Simon Sinek's Eat Leaders, Eat Last. In a lot of ways, you're looking out for the troops. So instead of the security team mandating people do something and then punishing them if they don't, wouldn't it be great if the security team tried to make cybersecurity as simple as possible and enable people with tools like password managers, or communicating in a way that's really simple to understand. So this is really where culture, managing human risk, and the concepts of leadership kind of all come together. Yeah, I mean, those are awesome points. And yeah, I have more questions, but I think it's time for a reset there. So I'll kick it back to Russell. Oh, geez. Hey, everybody, it's just a little thing we do there, you know, this idea to occasionally just kind of remind everybody, you know, folks can come in and go as their schedules permit. But just, hey, just really appreciate everyone being here for Fireside Chat. We've been having conversations just like this, having someone like Lance this time and all of us, many of us in the past, of course, to be able to just get to know folks better. What's your story? How'd you get into cyber? What's working? What's not working? And I've shared it before, this advice of, you know, get wisdom as cheaply as you can. And I'll say the last 45 minutes or so, we've been doing just that with our special guest this evening, Lance Spitzner. So for those of you who are listening, those who are not on the stage right now, feel free to raise your hand. I'll be happy to bring you up on stage. You can ask your questions of Lance. We're happy to have that happen so far. No one's been able to stump him, and that's not the goal to stump any means, but definitely engaging conversations. And we commit, we up on the stage commit, the moderators commit, that we've got plenty of questions, and all of us have already said, I can think of like 10 questions we want to ask. But that said, I'll be monitoring. I'd love to have anyone who wants to raise your hand, come up on stage, and ask your question of Lance as well. So Lance, while we're waiting for folks who might want to come up on stage, and we'll just keep asking questions, having a great conversation this evening. A question for you. Oftentimes in cyber, many of us, my hand is raised. I know we're on audio, but my hand is raised. Often many of us, you know what, here's this message. If those users just stop clicking on links, and sometimes we think, you know what, we'll make a message, we'll send an email, we'll try to communicate to them. But oftentimes there's barriers when us cyber nerd, me, people try to communicate to business people, people that don't understand technology. What's a, any pro tips or any advice for folks to make sure that message that we want to deliver to hopefully change the culture can be more clear to us non nerds and non geeks? Love to hear your answer to that. Yeah, so absolutely. So two things. First, one of the things I like to emphasize is I'm not a fan of the idea is the human is the weakest link. To me, that implies we're saying it's their fault. And in so many ways, it's not their fault. We've made cybersecurity very overwhelming, confusing, and in some ways, scary. So instead of saying the human is the weakest link, I prefer to say people are the primary attack vector, because we have failed to secure them. And as such, cyber attackers are taking advantage of that. So moving to the point you just brought up, why are cybersecurity professionals struggling in getting people to do what we want, we tell them to do x, they don't do x. So is this a motivation issue or an ability issue? And more often than not, it's more of an ability issue. And it comes back to this concept, a cognitive bias known as curse of knowledge. Curse of knowledge simply states, the more of an expert you are at something, the worse you are at communicating it. And with cybersecurity, that means technology, the ideas of threats, risk, vulnerabilities, our world is very simple for us, and very common sense for us, because we deal with it every day. So the idea of using MFA, or a VPN, or full disk encryption, or single sign on, for us, not a big deal, because we live and breathe it. But for most of the world, they have no clue, not only do they have no clue, but they don't want to know. And it's not that people are in any way dumb. We're talking about doctors, lawyers, engineers, accountants, PhDs. It's that we perceive cybersecurity as simple, but for them, it's very difficult. And what ends up happening is we need to take a step back and look at cybersecurity through their eyes, and then try to make it as simple as possible. Passwords are the classic example. For 20 years, we've been bemoaning the fact that people continue to use bad passwords. We tell them to do X, they don't do it. So obviously, they're bad. But think about what we're telling people when it comes to passwords. You know, something quite often you'll hear, good passwords? They're so simple. All you need to do is make that password 15 characters or longer, use uppercase, lowercase, symbol, numbers, mix in the blood of a version. And then change it every 90 days. Oh, by the way, every password has to be unique for every account. And heaven forbid, never write it down. How hard could that be? Well, turns out it is really, really hard. So what happens in most cases, the challenge we have is security teams are not making security simple for people because we're communicating to and engaging them in our terms. And this is where the world of security awareness, security engagement, security influence, whatever you want to call it, this is where we come in because our job is to make cybersecurity simple. And quite often, these individuals have backgrounds not in cybersecurity, but in communications, marketing, organizational change. One amazing awareness officer I know, she used to be an English teacher. That sounds really odd. But when she talked to the security team, she would understand what they were trying to communicate. And as an English teacher, it was very easy for her to then translate that into simple terms. So I would say the biggest challenge we have, one of the key reasons why security teams struggle is this idea of curse of knowledge. We think in terms of technology, we think in terms of our world, and that's how we communicate to our workforce in our terms. We need to communicate in their terms. They're not stupid. They're not unmotivated. They're just not security experts. So we need to simplify security, not dumb it down, but simplify it. Turns out that's pretty hard to do. Wow, that's amazing. Simplify, not dumb it down. That's a tagline. I need to make that. I think my ring, whatever you call me, that should be like the sound that comes out of my phone is a good reminder for me. I appreciate that, Lance. And I see Stephen and Kevin, Jay Foster, come up on stage. But Stephen brought you up first. I'd love to have you spend some time asking a question of Lance. Stephen, it's all you. Thanks, Russell. Good to see everyone here. It's a nice change of platform from Clubhouse. Lance, thanks for taking the stage here in the hot seat, as we would say. You know, as a recently, actually not even recent anymore, you know, PhD in focusing on the human side of things, human risk, you really make me want to go back and revise my dissertation, but I've never done that. You know, but all good things as the academic process and, you know, did a lot of research into security education, awareness training and all that for the last 20 years. But, you know, one of the things that you said that actually was at the time when I started my PhD program, you know, had all these great ideas was the concept of incorporating some sort of human risk baseline as a part of employees, third party consultant onboarding process. What are your thoughts on a baseline for organizations as a part of the onboarding process, right? It's what everyone enters your organization in some form or fashion associated as an employee contractor, et cetera. What are your thoughts from a human risk standpoint on baselining? Is it effective? Should we be doing it? Is there an appetite for that throughout the industry? By baselining, do you mean measuring the individual's aptitude for cybersecurity or providing some type of baseline training to begin their training, their cybersecurity career, if you will, in the company? Yeah, no, looking at from a human risk standpoint, right, understanding that their individual risks, you know, essentially saying, hey, everybody's not on the same level playing field as it relates to the risks that they pose to the organization, right? Because what we've done for the last, let's say, 15, 20 years is assuming, right, everybody in the organization doesn't know about X, Y or Z, right? And that's not necessarily the case, as I think you and I know, because you have varying different, you know, degrees of people coming into your workforce. The workforce is changing. And so looking at it and taking a more tailored approach, right, to managing human risk, right? That's in that sense, not necessarily from a cybersecurity perspective. So by baselining, you mean assessing their knowledge of cybersecurity when they onboard? Correct. Oh, okay. Well, yeah, that can be great. But just because what they know may not align with what the organization teaches. So they may know about cyber attackers, they may know about phishing, but there's still a lot of training that needs to go on. I think, you know, doing some baseline might be great trying to measure what they know. But I would still want to train them on the specific policies and what they know could be wrong, could be outdated, could be misguided. So perhaps baseline not only on what they know, but baseline them on the overall expectations. But either way, whoever you are, whatever you know, there should be some type of continuous training throughout your career at the organization. Because we want to be continually training and updating people. Because even what they know now, threats change, technology changes. So we're going to want to be continuously training people throughout. So you could come into my organization as the world security expert. But I'd still want you part of that training program. So you could probably stay current. I don't know if that answers the question. Yeah, no, thanks. It certainly does. And I think you understand where I'm coming from, right? Coming from the military, coming from the government. The first thing that they want to do is have a baseline. Hey, where are you at today? Right? It's like academic 101, right? Yeah. So you get where I'm coming from. Some organizations, you know, metric heavy, right? We can go into metrics and what they mean and how effective, right? But some of them will say, okay, well, in order to fund this program in managing human risk, what, you know, what do these folks look like when they walked in the door? Right? And what do they look like six months from now? You know, you know, etc. So I appreciate that, Lance. And I'll connect with you about some other things. No, please do. And also, one of the things I'm seeing is more mature programs, whatever you want to call them, could also be role-based. So if you're coming in as a salesperson, your expectations from a cybersecurity people, you know, are X. But if you're coming in as an IT admin, if you're coming in as a developer, we may have a much higher expectation because you represent a far greater risk due to the data you handle, the systems you're working with, and things like that. So in more role-based environments, that baseline may be different based on your role. So up for any other questions. Very, very cool. Hey, thanks, Stephen, for your question. Kevin J. Foster Sr., always great to see you, my friend. Look forward to questions you might have for Lance. Kevin, up to you. Hey, Russell. Thanks a lot. Hey, everybody. I see a lot of familiar faces here. So great to see everybody. Great change of platform. So Lance, I've actually met you back at SANS Fire before COVID. And it was really interesting to meet you because I've met almost every SANS instructor. Oh, my gosh. Yeah. I haven't done that, so kudos to you. So I aspire to be a SANS instructor, and we can certainly talk about that later. I have to get Russell on my list. I haven't met him yet, but I have to get him yet. So that's great. But I have a comment and then a question. So in my role as a security professional and a law firm, and I've worked at many different verticals, but the culture is what I find is most likely the same. It's always the same in most of these organizations. And what I've tried to do is, you know, use really simple examples of how to convey security concepts, even the most complex security concepts, even down to like buffer overflows. How do you explain a buffer overflow, you know, to a five-year-old or to a seven-year-old, right? So I've always looked for opportunities to do that. And in my role now, what I've done to try to change some of the culture shock of, we have to change our passwords, and we have to make longer and more complex passwords or pass phrases, which is probably the better thing to do now. How do I do that? And one way I found out doing that is like gamifying the experience. So what I mean by that is I would use a website like a How Secure Is Your Password and have folks just type in any password that they think is a secure password. Of course, so we do the training beforehand where we talk about the use of passwords and why they're important and why they are the keys to the kingdom, et cetera. But then I kind of add to that, go to this site and just type in any password if you think it's a secure password. It doesn't have to be your firm password or any password that you're using. But think of a password that you say, hey, this is a good password. Type it in and see what you get. And I've gotten responses like, you know, oh man, it'll take six days to crack my password or it'll take three hours or it'll take a year. But what it drove home is I said, okay, now add two characters to that or add three characters to that. And then it became a game because, oh, now I'm up to a thousand years. Now I'm up to a million years, et cetera. And then it became a game with within the organization I used to work for where folks were trying to create a more complex password to, you know, have the most complex password that takes longer, longer to break. And that became the genesis of how we moved from, you know, organization using six and eight character passwords to using 12 character passwords, which was what we, what we wanted to accomplish. So the way I thought about doing that was doing that exact thing. So we had like a security day and everybody would display their particular technology. This was in a hospital. So my, my, my tech display was the security game. So they would come up to this giant screen, type in their password and, and everybody would start to, you know, just like go crazy because of the, the complexity of the, of the password that they thought of. But it really drove home, you know, the importance of password security, one, and two, it actually enabled me to more easily get into, okay, we're going to use 12 character passwords. And I really thought that was a great approach. And I want to ask you, what is your, your thoughts when it comes to gamifying or, you know, changing the security culture at an organization? Because I find that usually if you can change the culture of the organization, it's much more easier to get your policies and things like that. And your, and your objectives into the organization and be successful in doing that. And thanks for your, your, your answer. Yeah, absolutely. So first of all, you bring up a great point, culture. So how you approach changing people's behavior, remember that our goal to change behavior quite often aligns with the culture. Gamification can absolutely be a fantastic way. If it's a good fit for the culture, I tend to find the more outgoing, the organization, the more likely gamification is going to be a good fit. One of my favorite examples is Salesforce. They have for many years have some fantastic gamified environments, especially for their developers to teach them secure coding practices. And it's gamified in a very competitive way on badges, tiers, points, all sorts of good stuff. But it's a very outgoing, tends to be a younger Silicon Valley type of environment. There are certain cultures though, where gamification may not work as well. I tend to find that where it's much more of an older generation, maybe a very conservative type environment. They may prefer to consume training, content, engagement in a different way. And for me, when it comes to building a security culture, for me, it's not so much changing the organization's overall culture, but aligning cyber security with the existing culture, trying to embed cyber security into the existing culture. So if I'm dealing with a very conservative culture, the security team may be engaging and working with the workforce in a more conservative style. If you have a very outgoing overall culture, I'm going to be trying to have the security team as edgy, as engaging as possible. And absolutely, gamification. So once again, things like gamification may be fantastic, as long as it aligns well with the culture. But remember, the end state, the end goal is changing behavior. Absolutely. Thanks for that answer, Lance. And look forward to checking out with you again. Please do. Please do, folks. By the way, that's open to anyone. I love getting questions because I usually end up learning more than the person that asked the question. That is the dirty little secret of being an instructor of anything, is this ability to learn from others. And that's just a beautiful thing that we're able to do here this evening. So anyone else who wants to come up on stage, just raise your hand, I'll bring you right up, be happy to do that. But Maud, any other questions from you for Lance? Yeah, sure. I have one I was kind of marinating on. I love what you said about changing something that you are empowered to change, right? This is a big, a big deal when it comes to the human factor, and it comes to even just in leadership, picking and choosing your battles. Curious for you, as you were coming up in this industry, it doesn't have to be the first, but maybe the most significant or just kind of moment in that journey for you, where you were kind of figuring out when it was time to change something and figured out you had that empowerment to be able to change something. So you're asking me, okay, just to confirm and repeat the question, you're asking me, give an example of when I felt like I could create some change? Yeah, it'd mostly be, and this is the context, because we have a lot of people who listen to this program who are kind of maybe, you know, early career, mid career, who are thinking about, okay, how do I find a voice in my cybersecurity organization? So when you said what you said about, you know, that, you know, change something that you were empowered to change, or I wrote it down, I may have, I may have misspoke. No, no, no, no, you got this. But that's the quote that I was, I was going back to, because I think for the people who are listening that are thinking about where they are, and in that moment within their cybersecurity organization, where they need to be empowered to make that change. Yeah. What did that look like for you? Were you afraid? How did you overcome that obstacle of potentially being afraid? You don't sound like a person that was ever afraid, quite frankly. No, no, no, no. But I think that that's kind of where I'm going with the question is, you know, how do we as individuals within this space ensure that we're doing our due diligence to speak up when we need to and have that empowerment to be able to make the change we need to within our organizations? Is that helpful in the clarification? It is, and it is. And I think it really comes from a passion or something that you really believe in. So for example, I'm extremely passionate about the idea that we have to, security is not just technology, it's people. And we need to stop blaming people and start helping them. Now, for the people on this call, you're like, yep, absolutely, totally agree. But if I walk into a room full of cybersecurity geeks who are all technical, and I say, hey, I'm Lance, I'm the security awareness officer of so-and-so organization, I know I've instantly lost all credibility with those individuals. The battle I'm trying to fight is really with the cybersecurity community. The battle I'm trying to fight is making highly technical individuals believe and understand that it's not just about technology, but it's also about the human side. And the idea that security awareness officers are not just about posting memes and posters with cats, but we're really about managing human risk. We're on the same team. So that's where my passion and the belief is in. And to be honest, it is hard for me to still, when I get into a room full highly technical geeks, say, hey, I'm the security awareness officer, because I know I now have to sell the concept. The idea of security awareness has a bad rap and deservedly so. So that's a big thing I'm changing. But where I get the energy to do that is when I get around people who are open to the idea. So what, for example, when I'm at the security awareness summit, when I'm teaching the class, when I'm calls on this, and you see the light bulbs going off, and people are starting to catch on, then you get really excited. And that gives you more energy. But what's really exciting is I'm beginning after 10 years, beginning to see things are really starting to change. When Forrester, when Gartner, when the big four consultings like E&Y, PwC, when those folks all start talking about managing human risk, you know, boom, maybe we've finally crossed the ball and crossed that barrier. Now, the other thing I really get excited about this field and really pumps my passion is the real diversity you see in the field on the human side. So when I teach the managing human risk course, when we host the security awareness summit, things like that, quite often in the classroom, in the venue, there'll be more women than there are men. So also, I get a little extra energy knowing that people that normally would have a hard time getting into this industry, this can be their door, their path into this industry. And I would someday I would love to see a lot of CISOs stand up and say, no, I did not start in the SOC. No, I did not start an incident response. I started in security awareness. So long, long answer to a short question. I think the strength or the idea of really challenging this and causing change is driven by the passion and belief. If you believe in it, you go for it. No, it just may take longer to make that difference than you planned on. Well, yeah, I'm almost 20 years into this industry that I stumbled into, as you recall. So yeah, it does take longer sometimes than we would like. But yeah, no, it's interesting. This bringing up even the human condition and even what you're talking about, DEI, the factors of the room. And then I love the fact that you also were a history major. And it doesn't necessarily mean that you can't be in cybersecurity profession. In fact, just as a little plug for history majors everywhere, you're the best researcher ever. You have to learn how to write and articulate your ideas, be held to the fire on anything that you're saying, and make sure, you know, those are all things that are still really important attributes to any cybersecurity professional. So I do appreciate that. And I also just wanted to mention one other thing, too, about what you were saying about the human factor. I'm actually going to be on a panel coming up in early December. And what I find really interesting, too, is like this merge of tools that are now looking at multi-channel communication and where the human makes the decision. And then what can we do as an organization? And I would love your perspective, though, on the kind of privacy aspects or your thoughts on how those tools tools for you are on your radar in your curriculum at SANS. Tools, as in you mean tools that are tracking people's behaviors? Yeah, tracking behavior, communication, and how important those are, in addition to the, because, you know, we were talking about security awareness earlier. And I agree with you. You can only go so far with training people. Yep. And so at what point, then, do we go out to industry and then learn a little bit more about what we can do around some of those additional tools? So I'm just kind of curious. I don't know if you've done any of those classes at SANS, but just curious of kind of what the proportion is between the tools that we need versus the security awareness and the culture changes. And maybe a little bit more about maybe policies, procedures, and tools that you would put around the human being within a cybersecurity organization would be really interesting to me. Sure. So from a tools perspective, there's really two things we can do to approach it. For one, for the existing tools that we're using or asking people to use, let's try to make them as simple as possible. So for example, I mean, when you are designing an airplane and you're designing the instrument panel for the pilots, you want that instrument panel to be as simple as possible. So people don't make mistakes. The problem is with so many of the tools that people are using nowadays, we make a lot of mistakes because tools or even processes are not designed from a user perspective. So we need to make those tools as simple as possible. But on the flip side, there's also tools that are tracking people's activity, what they're doing, their behaviors. In a lot of ways, what we can do is configure those tools to create automatic alerts or even nudges, and then alert people saying, hey, you just made a mistake or you were about to make a mistake. This is why you should not do this. And that's not so much new technology. You're just looking at existing technology from a human perspective. DLP, data loss prevention, not new. However, if I'm an employee and because of autocomplete in email, I end up emailing the wrong person sensitive information. So I was trying to email, say, Katie, who is in accounts payable. But I end up emailing Katie, my daughter's basketball coach with sensitive documents. A technology like DLP would catch it and block it. We have that. Wouldn't it be great if the DLP then alerted the person? Hey, you just attempted to accidentally email Katie, your basketball coach. We highly recommend anytime you're going to send a sensitive email, double check the two header first so you don't mistake, make mistakes like this again. So the security technology caught the air, but then we can add on to that a nudge, train the individual. So it's real time training. Same thing with EDR, endpoint technology. If we're doing any type of proxy or filtering of websites people go to, password creation. Anytime we see a mistake, instead of blocking it and logging it, add on to that, letting the individual know, giving them some additional training. So we're using a real time event to help change human behavior. So from a tools perspective, A, make the tools easier for people to use. So they're less likely to make mistakes. Two, when they do make mistakes, let them know, let them know what they did wrong and let them know what they can do right. So two perspectives from tools that we could start doing that we're probably not doing very well right now. No, I appreciate that. Lance, you have a style of speaking, I have to say, where it seems like you're going to continue to say something. Oh, I'm so sorry. So I'm not, it's not that we're all stunned. What you were saying was wonderful. I just, I'm always expecting something else eloquent to come out of your mouth. So that's why no one was speaking. Listening and on the edge of our seat, I swear. So yeah, no, just would love to open it up then again to the rest of the room. You know, this is fireside chat. We have moved over to a new platform. You know, again, welcome everybody to fireside chat on LinkedIn audio. Thank you, Russell, for hosting the event tonight. And I just want to open it up again to the folks on stage and remind everyone who is in the audience that they can raise their hand. It looks like we might have one hand raised in the audience to go ahead and come up on stage and ask a question. Go on stage. I love how you virtualize this. Well, it's a stage. Yes. Yes. I love it. Yes. It's a community, Lance. Welcome. Welcome. Welcome, Keith, to the stage. Oh, and Keith. Oh my gosh. Yeah. Keith, love to, wow. Welcome. Great to have you here. I'm a little bit scared, just like a little bit scared to have Lance. And last week we had Frank Kim on as our speaker, but Keith, love to hear from you. Yeah. So first off, huge thank you to Russell for being a continued leader in the community and for bringing venues like this together. Lance, I would just offer one tidbit of advice. You know, I've, like many of the folks here, been around the block for a while. I would just offer that whether it's the suggestions you just made around the DLP messaging or the earlier conversations around security awareness. I think one small thing we can all do to tweak the experience of the folks that we rely upon is for us to own those gaps between what the technology can do for us and where it can't complete the messaging versus, you know, blaming the users for those gaps and the failures that occur. I think we really need to own, you know, the things that the technology can't do. We really need to own the messaging to our customers on, hey, you know, yeah, your password's not strong enough for you. You failed this social engineering test. This event occurred. How can I do a better job of closing that gap versus turning the camera on them to focus on failure? I love it. I couldn't agree more. And sometimes that can be something hard for us, the security community to consume and understand because it's traditionally been almost an adversarial type of relationship. And we really need to change that. Like Russell and I were talking about earlier, if we asked people what they thought about your security team at your company, we'd love to hear the words approachable, collaborative, helpful, and enabler. Just unfortunately, that doesn't always happen. So the positive news is that when earlier in the conversation, you just weren't humble. I sent Russell a private message that says, you know, Russell Eubanks equals humble. So it's good to have some peers in the community that we respect that are setting the tone and setting the example for how we can do better as a community. All right, Keith, you're on my forever Christmas card list. I appreciate that. And, you know, it reminds me, your comment there, Keith, it's something that, you know, when we worked together at the Fed, I did, it's kind of a goofy thing. I call it the cafeteria test, you know, back when we were in person and had a cafeteria to go to. And my thought was, you know, how am I, how's the team I'm privileged to lead showing up? And my thought was, you know, as I go to the cafeteria and I decide a hamburger, do I get a soup or some salad or a healthy option, whatever, I'll just kind of scan the room. And then when, not in a stalky way, not in a spooky way or a goofy way, just before someone looks at me and sees me, I just kind of want to see what's their nonverbal reaction. Like when, when they see me or a reflection of the team, do they like run away and it happens or do that? Ooh, there's, there's somebody on the security team and they're an advocate. There's someone who helps out there. Someone can do it. And this idea, I call it the cafeteria test. I probably didn't have a better name, but I did that for a long time and it helped me better gauge like in the moment, like right then, right there, what was the likelihood that our team or gosh, ultimately me was helping them achieve their goals. And just that little micro test, uh, serve me well. And, and, um, uh, it's just one little thing that you might, uh, do whenever you do, uh, get back in person. So, uh, yeah, Keith, uh, Steven, Kevin, uh, awesome, uh, questions that we've had so far, about 10 more minutes or so, uh, for our time together. Uh, but, uh, again, if anyone has any other questions, feel free to raise your hand. We're bringing you right up on stage here, but you know, Lance, uh, with the security awareness summit, I know it's been super successful. You've been very humble about, um, what's happened there. What's grown there. I've been privileged to be a part of that, uh, here recently in particular, but as you reflect back on the community that's there, what's your proudest, uh, what's the proudest achievement of the community and what has surprised you most about what's, uh, where it was to where it is right now? Um, lots of proud moments, but I think one of the most that I'm excited about is in the community, we have a community forum about 2000 people that are all focused on the human side of cybersecurity and security awareness, culture, influence, and engagement. By the way, if anybody wants to be added to this, by all means, please reach me, reach out to me. It's a private invite only. So I have to personally add you, but it's very friendly, very trusted, and very interactive. So lots of very proud moments, but I think one that I'm really excited about is, as I mentioned, this human side is starting to explode. And on the forum, we have a job site and people can post that they're looking to hire someone or they're looking to get hired. And I would say in the past six months, I've seen more posts than I have in the past six years. So it's an example of how I see this is growing. But what I really am excited about is how excited people that are new to cybersecurity, how they're getting jobs, how they're loving their jobs, and then how they, after a year or two, they've grown, they've taken on new jobs. So here they're junior in one company. Now they're senior in another company. And these are big companies we're talking about, credit card companies, financial companies, Zoom. I mean, big, big players. So one of the things that I'm most excited about is, yes, the security community is benefiting from this because we're starting to really impact managing human risk. But what really excites me is the individual impact. You know, moms are coming in and getting excited. People that have never thought they'd have an opportunity are getting excited. So I love the idea of all these new individuals who may not have a technical background, have the opportunity to grow in cybersecurity, and if they wish, develop that cybersecurity background. So for example, I saw one gal two weeks ago, she posted, Hey, folks, I'm looking for a job. So just the other day, I reached out to her and said, Hey, how's it working out? Because she had been, she'd been active on the list. And she's like, I've got multiple opportunities include, I just got an offer to be the official human risk officer for this major organization. And she could not have been more excited. So I love how this is benefiting the security community. But I love how this is benefiting all people who may not have had these opportunities five years ago. So there you go. I'm done. Yeah, it's amazing. Especially, you know, we hear however many unfilled cyber jobs, however many people needing a job and curious interested in cyber. I didn't know that I'm glad I asked. And that's really awesome that folks are finding their place in our community and loving it and falling in love with what it is that we're able to do. Love, love that. So, so very much. So Lance's were kind of winding down and we'll leave kind of the last word for you at the very, very end to close down our, about an hour and a half conversation today. What I know you, you've inspired us. You talked about your story, talked about some things that have been a privilege to be a part of in your career. If you could, I know you're very action oriented. I know that you like to get things done. You don't like to admire the problem. If you could have one wish that all of us who've been listening to you the last hour and a half would, would be like, if you could say, hey, go take this action, go do this one thing. What would that be? What would you share that you wish that we would do or we would do or think about differently to go back and maybe apply one of the ideas that you've talked about or inspired us with this evening? So I'm going to share an idea with you that I was inspired with, with an individual who inspired me. I'll share her name, Janann Budge. She is the lead analyst at Forrester on the human side of cybersecurity. She shared a great idea with me. For those of you who are involved on the human side of cybersecurity, I would ask you reach out to your technical security team and explain to them, hey, what you're doing, you're managing human risk, open their eyes to our world and how we benefit them. Hey, technical security team, are you struggling reaching your workforce? I'm here to help. And it's not just posters and memes. I can help with your communications, your tool rollouts, policy development, any type of interaction or engagement work the workforce. And then I'd flip it. If you're on the technical side, I would encourage you reach out and build bridges with the security awareness team or whatever they're called. So quite often, my biggest concern is we have security awareness, we have the security technical team, but they're not partnered together as strong as we could. So if you're on the human side, reach out to and build that bridge with the technical team. If you're on the technical side, reach out to the awareness team and help build that bridge. That would be my ask, because that's what I'm trying to do. That's fantastic. I was writing that down. I think that's something that's actionable, something that can produce results and something that we all could choose to do even before the week is over. Hey, before we go to you for last words and everything, let me just see, check in with the mods. Any other comments, questions, observations before we start to wind down for this week? Yeah, Nald, Hussein and David, I'm sure you have something as well. But I just, yeah, appreciate your time, Lance. Appreciate your perspective. I'm walking away every single week. I always walk away with a quote, and I don't know if it's the one you would have hoped for, but I loved that you just said simplifying and not dumbing things down on the human side of cybersecurity within organizations. It's just a helpful reminder to remember to simplify and not dumb something down. We are working with incredibly intelligent people within our organizations that are capable of understanding what they need to be a more secure organization. So thank you for that quote. That's what I'm walking away with. And thanks again for your time. Well, thank you. My gosh. I appreciate the opportunity. Yeah, same here. Thanks, Lance, for coming on, spending the time with us. Great insights. Appreciate all you're doing. Thank you. Yeah, and I echo the sentiment of all the other moderators. It's been great. I think, you know, one of the things that I find great about our weekly chats is I always find some key takeaways from it and some learnings, no matter how long you've been in the field. And that's probably one of the reasons why cyber is so great. There's, you know, always something to learn. So thank you so much for your insights. Awesome. Awesome. Well, hey, thanks, mods. And thanks, everybody, for joining us. As always, we have conversations just like this, 8 p.m. Eastern time until about 930 p.m. Eastern time. And today is no exception. Fantastic to have Lance here with us. And again, he made that offer. If you'd like to be involved with the security community he talked about before, send him a note, send me a note. Happy to do the very same thing. But Lance, love to give you the final word as we kind of close down for today. But love to anything you want to share with us, anything that you want to kind of close the room with. But just kind of love to give you this opportunity to talk to us one more time before we end this evening. No, first of all, once again, folks, thank you. It's a privilege and honor to be working with all these great minds. But key thing is, and I think we are all many of us are believers here. Cybersecurity, it's no longer just a technology issue. It's a human issue. And when it comes to the human side, we use a lot of different terms, behavior, culture, engagement, influence, security, awareness, training, education. Don't get caught up in the terms. Just focus on the end goal. Help manage human risk. And then we can really start making a difference. Otherwise, thanks so much, folks. I really appreciate this. Awesome. Awesome. Well, hey, thanks, Lance. Thanks, everybody. We'll see you back again next Wednesday. Appreciate your patience, everybody. And Lance, again, thanks so much. And I'm sure we'll talk again soon. Good night, everybody.