Fireside Chat w/Taiye Lambo

[00:00:00] Hello, hello. [00:00:25] So we will get started in a few minutes. [00:00:32] We will get started in a few minutes. [00:00:55] Okay. [00:01:02] Okay. [00:01:07] Okay. [00:01:37] We will get started in a few minutes. [00:01:44] Just waiting for folks to gather. [00:01:47] We should probably get some theme music going on for when we're actually waiting for people. [00:02:04] It feels like a real conference. [00:02:10] Oh. [00:02:17] Hey, Russell. [00:02:18] Thomas, how are you? [00:02:33] Doing all right. [00:02:34] Doing all right. [00:02:35] Doing all right. [00:02:36] It's like, I felt like a young little kid, you know, who scheduled a party and nobody showed up. [00:02:43] Oh, we're showing up. [00:02:44] The gang is the Avengers or Assembly? [00:02:48] They sure are. [00:02:50] They sure are. [00:02:51] I'm sure people are sort of making their way from either other rooms or from their busy day. [00:02:59] Or both. [00:03:00] Yeah, that is true. [00:03:03] Or both. [00:03:04] Ty Lambeau. [00:03:05] Let me see what I go. [00:03:10] Do you know Ty? [00:03:15] I don't know Tomas if you know him. [00:03:20] I do not actually. [00:03:22] I don't believe I've met Ty. [00:03:25] So this will be an interesting conversation. [00:03:28] Usually the folks that come on here, I've either had some sort of relationship with them. [00:03:32] I met them at a conference or met them networking. [00:03:37] But yeah, I actually do not know Ty. [00:03:40] So fun fact. [00:03:42] He'll tell you more about himself tonight, but he's the only person I've hired. [00:03:46] When I heard he was looking for his next gig, I said, Ty, let me hire you. [00:03:50] He's like, well, what will I do? [00:03:51] I'm like, I don't know. [00:03:52] I need your job, but I want to hire you. [00:03:55] The only person I've ever done that for. [00:03:56] And so far, maybe it'll be that way or not. [00:03:59] But I was just to work with him in the past. [00:04:02] And when I heard he was back on the market, we found a job for him at the Fed. [00:04:07] That is awesome. [00:04:08] That is awesome. [00:04:09] I don't know if it's you that's cutting out or is it me? [00:04:12] But you did cut out a little bit. [00:04:15] Can you hear me, Russell? [00:04:16] May have that little red bar came across the bottom. [00:04:19] I'll move my phone to a different area. [00:04:21] Maybe it'll me. [00:04:22] Okay. [00:04:23] All right. [00:04:24] I've been doing some research on NFT games. [00:04:30] I don't know if we've looked into that. [00:04:33] Not that this is the conversation, but we do have some time. [00:04:36] So NFT games. [00:04:37] Have you looked into that? [00:04:39] Well, not so much NFT games. [00:04:40] I'm sorry. [00:04:41] Not NFT games. [00:04:42] Blockchain games, I should call it. [00:04:44] Not so much NFTs. [00:04:46] Yeah, apparently there's this there's a few blockchain games. [00:04:51] And when you play them and you sort of buy, you know, like you can buy things for your avatar or whatnot, whether it's skins or new outfits or what have you. [00:05:03] It's all on the blockchain. [00:05:05] So I've been looking into that. [00:05:07] That seems pretty interesting. [00:05:09] I've not heard of that at all. [00:05:12] Yeah. [00:05:13] Gotta Google it. [00:05:14] Gotta Google it. [00:05:15] I'm still trying to wrap my head around it. [00:05:18] I get the concept of why you would have a blockchain for the transactional side, but I don't know if they're just saying that it's blockchain games, meaning the transactional pieces are done on the blockchain. [00:05:32] But the game itself, I can't see the game being played on the blockchain. [00:05:36] That doesn't make any sense to me. [00:05:38] So it might just be the transactional side that's done on the blockchain versus how it is done today. [00:05:45] Right. [00:05:46] When you buy something on PlayStation or Xbox or something like that where it's not done on the blockchain. [00:05:51] Well, interesting, interesting space. [00:05:54] Hey, Katie. [00:05:55] Microphone check for you. [00:05:56] How are you? [00:05:57] Hi. [00:05:58] Good evening. [00:05:59] Good evening. [00:06:00] Oh, I say George put play for pay like Axie Infinity. [00:06:05] I've got to look into that. [00:06:06] I actually do not know about that. [00:06:08] And I am a gamer, but I don't know about that. [00:06:13] Here's Ty. [00:06:14] Ty, how are you, sir? [00:06:17] Hey, I'm gonna watch this for you. [00:06:18] Quick microphone check for you. [00:06:21] There's a little bar on the bottom right of your screen where it looks like a microphone. [00:06:27] There you go. [00:06:28] Okay. [00:06:29] Hi. [00:06:30] I didn't realize I was on mute by default. [00:06:34] Yeah, yeah. [00:06:35] You're on by default. [00:06:37] Okay, cool, cool. [00:06:39] Welcome to our fireside chat. [00:06:42] We'll get started in a few minutes, but it's just wanted to get the microphone checked for you. [00:06:46] check coin for you. So when you're not talking, you can just pop yourself back on mute. And when [00:06:51] you're talking, which you will be for the majority of the evening, you will not have that little [00:06:56] microphone mute thing. Hussein, how are you, man? Good evening, sir. Good evening, Ms. Anahan and [00:07:04] Mr. Russell. How do you do, sir and Ms? Good to see you. I had a great day today, actually. I did my [00:07:17] recording with Lisa Beth for her podcast. It's great to see you, Katie. We had so much fun today. [00:07:26] It was pretty fun. It went by fast, I have to say. You have a wonderful partner there. [00:07:32] Yeah, I'm pretty lucky. I mean, I've known Dan since I was a wee babe. [00:07:42] That's awesome. I can't wait to see that. When is that scheduled for Lisa Beth? [00:07:46] I think we're booking out like five or six weeks. So I'll have to get a date. But I think it's going [00:07:55] to actually like hit the airwaves, probably like late July, early August. [00:08:02] Oh, okay. Okay. That is awesome. I was thinking it would come out around RSA and Katie could be a [00:08:08] celebrity down in RSA. [00:08:10] Katie is a celebrity. [00:08:13] She already is, Tomas. [00:08:17] That is true. Thank you for correcting me, Hussain. [00:08:20] Katie, I need no RSA. [00:08:24] You are right. Katie is a celebrity. My bad. I'm sorry, Ms. Hanahan. [00:08:32] Yeah, you know, I let it go this one time, Tomas. [00:08:36] I do appreciate that. Please. All right. Look, it is the top of the hour. So I want to welcome [00:08:51] everybody to our weekly fireside chat. Ty, I'm just going to go through some quick logistics [00:08:58] and then we'll do some introductions and we'll leave you for last, my friend. So while we do [00:09:03] that, just some very quick, as you all know, quick little sort of guardrails for our conversation [00:09:08] today, this evening, let's have fun. Let's have a good time. This is the middle of the week. [00:09:12] Hopefully it hasn't been too stressful for, for some of you. And if you're in the U.S., [00:09:18] maybe you get a long weekend with a Friday off and the upcoming Memorial Day weekend, Memorial [00:09:23] Day on Monday. If you do not get, have that opportunity, well, I'm sorry, but most of us will be, [00:09:32] we'll be on, on holiday. The interesting thing is hackers probably usually, they don't, well, [00:09:39] not probably usually, they actually don't sleep and take holidays. So I'm hoping, fingers crossed, [00:09:44] that it is a good long weekend without any, any specific events that might arise. But anyways, [00:09:51] in any event, this is our weekly fireside chat. We're going to have a good evening, have some fun, [00:09:56] have a great conversation, really lighthearted conversation, learn a little bit about Ty and his, [00:10:03] and his journey, his origin story. So I'm looking forward to it. Hopefully you are as well. Our opinions [00:10:09] expressed this evening for the majority of us are our own. They don't represent our current or prior [00:10:16] or even future employer, whether it is an IRL or if it's in the metaverse. I don't know why I said [00:10:24] that, but I figured I'd get my dad joking out of the way. Katie, what do you think? I think that was [00:10:29] all right. That's a good start. All right. All right. We're warming up here. We're warming up. [00:10:35] If you are a vendor in the audience and we do bring you up on stage, we ask that you please [00:10:39] just keep your sales pitch to actually don't bring any sales pitches with you. Just keep that for a [00:10:45] different time, different place. Let's use this as a safe place to really have a conversation, [00:10:49] get to know our guest this evening, who is Ty and use it as an opportunity to really do some thought [00:10:55] leadership and maybe even some mentoring or networking. So with that said, I'm just going to [00:11:03] go around the room. Ty, as I mentioned, we'll leave you for last. I'm Tomas Maldonado. I'm the CISO for the NFL. [00:11:09] Russell, over to you. Thanks, Ty. Thanks, Tomas. It's great to have you here. Ty, got my tongue [00:11:16] tied there. So sorry about that, Ty and Tomas. Great to have us. Ty, we look forward to this [00:11:22] conversation for a long time. Finally got you on the schedule. Finally got you equipped to get [00:11:26] here on the conversation and just really looking forward to this conversation. Russell Eubanks, [00:11:31] former CISO for the Federal Reserve Bank of Atlanta, last couple of years been running my company, [00:11:35] Security Ever After, and can't wait for this conversation. Katie, [00:11:39] over to you, my podcast hero. Yeah, thank you. And always, you know, really thank you for [00:11:47] sharing this space and allowing me to be a mod in this room. I love this room so much, Ty. I've [00:11:52] been looking forward to this one for a few weeks. I'm really excited about our conversation that [00:11:57] we're going to have and hear your origin story. So I'm Katie Hanahan. I am the Vice President of [00:12:03] Cybersecurity Strategy for a small, small under, I guess, under a billion dollars, SI out of Chicago. [00:12:10] I also run our VCSO program. So I'm a practitioner as well. And looking forward to learning from you [00:12:16] this evening. Hussein, over to you. Good evening, ladies and gentlemen. And good evening, Ty. Welcome [00:12:24] to the Fireside Chat. Looking forward to your enticing conversation. And I am Hussein Said, [00:12:31] CISO at Rabiru Johnson, Barnabas Health. And the disclaimer that Mr. Maldonado provided it applies [00:12:37] to me as well. Thank you. Over to you, Tomas. All right. And the last thing I forgot to mention is, [00:12:43] if you are new to our Fireside Chat and I do see somebody new in the audience, actually, I see a few [00:12:48] new folks in the audience. It's a little celebration thing. It means that you just joined Clubhouse. [00:12:54] So welcome on Clubhouse. There's a, there's a, on the top left of your screen, right next to where [00:12:59] it says Fireside Chat, there's a little green Monopoly house. You can click that and join our [00:13:03] Fireside Chat club and be alerted to when we do this. But we do this every single Wednesday. We're [00:13:08] going to run for about an hour and a half or so. We will ask questions of our, of our guests for about [00:13:15] 30 to 45 minutes. And then we'll open up for the audience to raise their hand, which is the, one [00:13:20] of the buttons on, on the bottom of your screen there. And you can raise your hand and we'll bring [00:13:23] you up on stage and then you can ask your question. So without further ado, Ty, why don't you take a few [00:13:30] moments to introduce yourself, tell us a little bit about you and why are you doing that? Why don't you [00:13:35] tell us about your origin story? Awesome. Well, first of all, thank you, my good friend, [00:13:43] Russell Eubanks for inviting me to, you know, giving me this platform. Also want to thank, [00:13:51] obviously Tomas, as well as Katie and Hussein and all the other moderators, Lisa, sorry, [00:13:59] and obviously Russell. So thanks for the opportunity. So usually when people ask me to introduce myself, [00:14:05] it takes an hour at least. So I'm going to give you the really short version, right? I mean, [00:14:13] well, midlife, I've been in IT 32 years. I've been in information security 25 years across four [00:14:22] continents, starting from Africa, Europe, North America, and Asia. And I'm just really, really [00:14:30] excited about sharing my journey with you. I'm still really trying to figure out what a real, [00:14:37] a good origin story sounds like. So, but I love to tell stories naturally. So I guess I'll probably [00:14:44] just wing it on this one. But you know, I come from very humble beginnings. I was born and raised in [00:14:51] Nigeria. For those who may not know, Nigeria is the largest black, quote, unquote, black country in the [00:14:59] world. Over 200 million people. I'm probably one of the many Nigerians you never have. Because where [00:15:09] you know, Nigerians are harder for other things, you know, usually the bad things. But we're probably [00:15:14] one of the most educated groups in the US, I think from the last time I checked. One in six Africans are [00:15:23] Nigerians and one in six people in the world are Africans. So something to do with that number six. So [00:15:31] my perspective is a very, very global perspective, you know, based on my, not only my exposure, my [00:15:38] experience, you know, my expectations with everything I do, you know, to borrow, you know, the three E's from [00:15:45] my friend, Elliot Abraham, that runs Curious to Learning, or Curious to Learn, a podcast. But that's really my [00:15:53] story. I come from very humble beginnings. My father's dad died when he was seven. And he was able to [00:16:01] bootstrap himself, started working at age 10. And I think by the time he was in his 20s, he got a [00:16:09] Rockefeller scholarship foundation, Rockefeller Foundation scholarship, sorry, it's been a long day [00:16:16] to study in upstate New York, and that pretty much set him up for the rest of his life. So I am, [00:16:24] my family is a product of, you know, philanthropy from folks like, you know, Rockefeller, through the [00:16:31] Rockefeller Foundation, I don't think my dad, certainly, you know, my family wouldn't be where we [00:16:37] are today, if it wasn't for that opportunity. So just a little bit about maybe short, shorter version of [00:16:43] my origin story there. So how did I do? [00:16:54] That's awesome, Ty. Thanks. Thanks for, thanks for that. Russell, I'll pass it over to you. [00:17:01] Thanks, Tomas. And Ty, always great to hear your voice brings, smiling really big. Right now, I just [00:17:08] have you on stage. Tell us about some of the work that you've done diverse places that you've worked, [00:17:13] maybe some of the interesting things you've done and customers you've helped. I know kind of where [00:17:17] I'm headed here. But you have a very diverse background. You've been a lot of places, done a [00:17:22] lot of things and helped a lot of folks, whether individually, getting started in cyber or big [00:17:27] organizations that we've heard of to wrap their minds around what cyber means to them. Tell us a bit [00:17:32] more about that to supplement what you shared on your origin story, please. [00:17:36] Okay, got it. So thank you. So I'm a big Simon Sinek fan. I always have to start with the why, [00:17:43] you know, before I actually talk about what I've done or what I do. And I'll say my why really is [00:17:49] driven by a passion I developed at a very early age at about age 10. I'm 51 now. And so 41 years ago, I [00:17:59] I found out I discovered I had this knack for breaking and fixing things, you know, obviously, [00:18:05] very, very early, early years. And I decided I was going to use that knowledge for good, you know, [00:18:12] basically what the hacker does, you know, I love to tinker. And you know, you know, pick apart, you [00:18:18] know, transistor radios, you know, at home, you know, pick apart my files, I think they were called back [00:18:24] then. Nine out of 10 times, I couldn't put them back together. But it was a whole learning, you know, [00:18:31] discovery for me, but I just chose at a very early age that I was going to acquire a lot of knowledge, [00:18:37] and I was going to use that knowledge for good. So fast forward, 41 years after making that decision, [00:18:43] I would say my, my journey has been a journey of just what I call, you know, my dad likes to call [00:18:49] purposeful living, which is just really, really thinking about, you know, I mean, we're all trying [00:18:56] to pay our bills, we're all trying to make a living, we're all trying to make sure our families thrive. [00:19:01] But sometimes it's all it's about what can you do for others, right? So, you know, wider community [00:19:08] within your community, the world, you know, at large. So I would say that passion has really [00:19:13] fueled everything I've done. So, gosh, there's so much I've done in the industry. But I think one [00:19:20] of my proudest accomplishment would probably from a technical standpoint would be when I founded the [00:19:27] HoneyNet project in the UK. So if you go to honeynet.org, actually founded the UK chapter back in, [00:19:34] I think it was 1999 or early 2000, and ran that for a few years. And just basically research on, [00:19:42] you know, viruses, worms, you know, we call them worms back then, we didn't have ransomware back then, [00:19:48] at least not that I know of. But just contributing that to the industry, you know, at that time, [00:19:54] there were probably less than 100 people that had the technical skills, you know, that I had, [00:20:01] you know, in the United in the entire United Kingdom. It was probably a lot more than that in the US. [00:20:07] But, you know, so I would say that was probably one of my earliest accomplishments, you know, being able [00:20:14] to, you know, bring people together and starting this, you know, HoneyNet chapter for, I believe, Lance [00:20:21] Spitzner, I can never pronounce his last name, who currently works for Science Institute as a one of their [00:20:28] senior fellows. So that was a major accomplishment back in the UK. At that time, I was doing consulting work for [00:20:37] very big name companies, as well as central government agencies, you know, pretty much [00:20:43] helping them to build like secure environments, you know, I was basically a security architect. So I [00:20:48] started out my career as a PC support desktop support. And then I got into land wine. And then I [00:20:56] started doing like security architecture work, you know, just based on, you know, my ethical hacking [00:21:01] background, which we probably don't have enough time on on this, for, you know, allotted to this [00:21:08] session to be able to kind of give you the backstory for that. But I did ethical hacking for a couple of [00:21:13] years. That's actually how I got into security. So I was actually getting paid by customers to poke holes [00:21:21] in their network and in their systems, including social engineering type attacks. So fast forward, [00:21:28] you know, from that time, which is about 20, maybe 22, 23 years ago, I would say that [00:21:36] what I've focused on really in the past 20 years is about just helping to make our industry a little [00:21:43] bit more diverse, right? And what I mean by that is, I come from a very technical background. I'm an [00:21:50] electrical engineer by training, I have a five year bachelor's in engineering, of engineering, [00:21:57] and then I also have a master's in business information systems from the UK. So sort of [00:22:03] MIS here in the US. And I found that, you know, as an industry, we've pre cybersecurity from a [00:22:13] from a technical standpoint, you know, we always say it's people process technology, but we focused [00:22:18] really more on the technical aspects. So, you know, for me, it was it was a five year journey of really [00:22:24] doing it the super techie way. And even though it was exciting, I found that when it comes to like, [00:22:30] talking to people like the C-suite or the board, I was just speaking like, I call it geek speak, you [00:22:37] know, Klingon. And they didn't really, I mean, they sort of were excited about the stuff I was talking [00:22:43] about. In some cases, they were really terrified. But they never really took it that next level of [00:22:49] actually saying, Okay, how do we build a program? How do we make the right investments in the program? [00:22:54] Right? So around 2002, I started taking a different approach. And so I realized that most [00:23:03] information security people come from a very technical background. And I saw a need for a [00:23:09] training program that teaches how you integrate all these different frameworks, whether it's ISO, [00:23:15] whether it's NIST, you know, special publications, or CSF, you know, that I was heavily involved in [00:23:21] developing, but just bringing it all together, ITIL, COBIT, COSO. So I pretty much saw the gap in the [00:23:29] industry, our CISSP, our CISACISM, but I felt there was a gap just from an educational standpoint. [00:23:36] So I put together a curriculum. And this was literally a few months after we moved to Atlanta from [00:23:43] from London in 2002, you know, my family and I, young family at the time, our kids were still young. [00:23:51] So I put together this body of knowledge, and I hired like the best, you know, content developers and [00:23:59] instructors to basically help put this into a training package. And then in 2005, we launched [00:24:05] this training program. At that time, Sabine, Zoxley and HIPAA were like the big ones, like everybody, [00:24:11] you know, and then we had the old SAS 70 as well, which is now obviously SOC 2, SOC 3, etc. So I felt like [00:24:21] there was a need to bring everything and harmonize all these different silos, right? So created the [00:24:26] training program. And, you know, they always say, if you build it, they will come. That's not always true. [00:24:32] But in my case, that's what happened. Literally, the first class we had in Atlanta was hosted by Georgia [00:24:39] Tech. We actually rented a really nice conference room at Georgia Tech downtown. And I think we had [00:24:46] about 35 people in that class. And it was all the big names in town, you know, the Fortune 500 that you [00:24:52] probably all know of. And they were typically security analysts, managers, and director level. You know, [00:24:58] at that time, we didn't have a lot of CISOs, you know, in those roles. And so a lot of those folks [00:25:04] now are CISOs, they're CIOs. So I would say that was probably my second biggest impact. You know, [00:25:11] I wouldn't call it an accomplishment. I would say more of an impact because I'm very, very impact [00:25:16] driven. And then I'll say my third one, which is actually fairly recent, is helping small, medium-sized [00:25:23] businesses stay out of the headlines. As we all know, supply chain risk is moving. Well, [00:25:32] cyber security risk is moving down the supply chain, right? It's moving, you know, five levels down, [00:25:38] eight levels down, in some cases, 10 levels down. So if you're a Fortune 500, and you already have a [00:25:44] fairly solid security program, you may end up having 1000 suppliers, or in some cases, 10,000. You know, [00:25:51] the bad actors are going to go after your weak link, right? They're not going to try and, you know, [00:25:56] yeah, they may try and attack you, but they're going to go for the weakest link in the chain. So [00:26:02] in the past, I'd say five years, I've been working with small, medium sized businesses to really build a [00:26:08] holistic program, right? And that's had a major, major impact, not only on them, but it's also had an [00:26:15] impact on their customers, as well as ultimately, the consumer, you know, that whose data has been [00:26:22] entrusted to those small businesses. So it's been pretty exciting. So I'd say, over the past, you [00:26:27] know, maybe 20, 25 years, that's probably be those three will be my proudest accomplishment, as far as, [00:26:34] you know, the cyber security industry is concerned. Hopefully, Russell, I actually answered your question. [00:26:41] Russell Moore Yeah, you absolutely did. Thanks, Todd. I appreciate you going a little bit deeper [00:26:47] in those areas with the impact and influence that you had on the cyber industry. And it's so great to [00:26:54] kind of relive mentally some of those moments and places that you had an impact with. So thanks for [00:26:59] that. Katie, over to you. Katie O' Thank you. Hi, yeah, thank you for that story. You mentioned a lot [00:27:07] of things that were really interesting to me. One of which, though, I'd like to dig into a little bit [00:27:12] more as you, you know, you touched on people process technology, understanding that, you know, [00:27:17] in the past, most people in our industry have been come from more of a technical perspective. When you're [00:27:26] looking at creating a more diverse environment, and you're speaking to people about that, can you tell [00:27:32] me a little bit more about the people part of that people process and technology component of your [00:27:38] classes and what you bring to the table when you speak as well? Wow. Wow. How much time do we have? [00:27:47] Katie O' It was a big question, wasn't it? Sorry. [00:27:50] Katie O' So this is what I always say. I kind of use this to kind of level set. If you look at the [00:28:01] bad actors, right? So when I say bad actors, it really all depends on what side of the pond you're [00:28:09] on, right? So if you're in Russia, you're going to think the bad actors are, guess what? The big old USA, [00:28:16] right? So it really all depends on where you are. And I think I may be addressing the global audience [00:28:22] here. I know most folks are in North America, but we may have folks outside of the US. So just think [00:28:28] bad actors, you know, whoever you work for and whatever interest you're serving. Bad actors would [00:28:34] typically come from every demographic, right? Every nationality, every color, every race, every gender, [00:28:41] every creed, every type of people, right? Religion, sexual orientation, et cetera. [00:28:48] If you look at their side and they tend to communicate more, they share a lot of information. [00:28:54] They share a lot of what's it called? Knowledge, intel, right? It's all on the dark web, right? [00:29:03] Even on the open web, sometimes they still share a lot of information, right? Sometimes they actually [00:29:07] brag about what they've done. You know, they put it on PaceBin, they put it on all this [00:29:11] and you know, back then it was 2600.org. You know, if your website got defaced back in the 90s, [00:29:17] you know, they'll put a mirror image of your website on 2600.org. So they're naturally inclined to share, [00:29:24] right? If you look on our side, you know, the good folks, my wife likes to use the phrase cyberist, [00:29:31] you know, which is folks who, you know, who like, who use cyber knowledge or cyber skills for good. [00:29:37] So on the good side, we have us and we're nowhere as diverse as they are, you know, in terms of in [00:29:46] every way, right? The ways I've described. So I feel like on the people side, we always say, [00:29:53] oh, what's the weakest link? It's the employees. Actually, no, it's us as an industry, right? And I'm [00:30:01] probably slightly getting on my soapbox here. But you guys are giving me the platform. So [00:30:07] I'll try to minimize it. But we keep saying it's the user, it's the dumb user, it's that, it's that. [00:30:12] But if we look at us as an industry, by not being as diverse as the bad actors, we're actually [00:30:20] shortchanging ourselves. And we're shortchanging our customers and our employers and stakeholders, [00:30:26] right? So that's the people side. How do we fix that? We need to diversify our industry, we need to [00:30:34] welcome different types of perspectives, different types of opinions. So what am I doing in that regard? [00:30:41] I'm trying to get people I've been working with folks that would probably never, you know, like me, [00:30:47] get into cybersecurity. They have non STEM backgrounds, you know, I have mentees that have degrees in Spanish. [00:30:56] I have one of my mentees right now has a degree in English language. She happens to be my daughter. [00:31:05] Right. And, you know, she's doing technical writing for me and QA. And she's really, really good at it. [00:31:10] Like she, she does the stuff that I hate doing. So she shadows me as a VC. So to do that stuff. [00:31:17] You know, at some point, I'm hoping she would want to become a cybersecurity analyst, but [00:31:22] I don't think it's for her. Right. But I can still use her natural skills to help, you know, [00:31:31] to strengthen areas where I'm weak as a virtual CISO. Right. Because I can't do it all. And so that way, [00:31:38] I'm able to bring not only me and my knowledge and my experience and my network, but I'm also able to [00:31:45] bring skills that the customer, I mean, for the customer to actually hire somebody with a [00:31:51] bachelor's degree with honors in English, it's going to cost them a lot. And they probably don't [00:31:56] need that, you know, for small, medium sized businesses. But if they have me as a virtual CISO, [00:32:01] they can do that. So these are the sort of things I communicate during my training classes. Like [00:32:07] we all have our own role to play in this. So if I'm building a team, so when I was at the city of [00:32:13] Atlanta, when I was at the Fed working for Russell and Allen, you know, and the amazing team at the [00:32:22] Federal Reserve, one of the things I always did when we're hiring is let's look for folks that have soft [00:32:28] skills. Let's focus more on soft skills, technical skills can be taught. Right. So yeah, you know, [00:32:34] HR has their checklist, they have their templates, fine. But let's find a balance between the technical [00:32:42] skills and the soft skills. And for me, it really needs to be ideally like 50-50, you know, I'm not [00:32:48] going to hire somebody purely based on soft skills, because I still want them to have the substance and, [00:32:54] you know, the experience and the knowledge. But sometimes, you know, there needs to be a fine [00:33:00] balance, right? It's really what I'm saying. So I would say the people side is really big for me. [00:33:06] I think the process side, I think, you know, we have, I mean, we've been, this industry has evolved, [00:33:12] we have a lot of really good frameworks, you know, like ISO 27000 series, we have niche cyber security [00:33:19] framework, you know, that are very process driven, we have CMMC, you know, that is obviously [00:33:24] trying to become more process driven as well. So I think we already have existing frameworks on how [00:33:30] to do process improvement, you know, the CMMI, which is now owned by SACA, used to be owned by CMMI [00:33:37] Institute, and then they were the match with ISACA. So we have all this proven process based frameworks [00:33:45] and controls based frameworks we can leverage. But the people side is, I think the area where I think [00:33:50] we're really, really behind. And so I'm on the journey to actually help to educate. So I run a [00:33:58] four day program where I'm actually teaching all those principles and saying, hey, technology is great, [00:34:04] right? You know, automation, you know, artificial intelligence, you know, machine learning, all those [00:34:10] things are great. But we still have to have, you know, we have to strengthen the people. And that means, [00:34:15] you know, having teams that have diverse thinking, you know, because in our industry, we tend to be very [00:34:23] crowd, you know, we follow a lot of crowd thinking, in my mind, and just having somebody that would say, [00:34:29] actually, I don't think that's a good idea, just because we've done it that way for 20 years. So I'm always [00:34:36] looking for my analysts to tell me what I'm doing wrong, even though I've got 25 years experience in this [00:34:41] industry, like, how would you do it? If you're in my shoes? Because we're still all learning. [00:34:49] So I think I probably said enough on that one. [00:34:51] Well, you did. And I really appreciate that. And it's interesting that you brought brought up a [00:34:57] checklist that came up in a conversation I was having earlier today is that, you know, it is [00:35:02] something that, you know, HR managers and any hiring manager in the cybersecurity industry needs to be [00:35:07] cognizant of that balance between the soft skills. And if someone doesn't have every single check mark, [00:35:14] they absolutely can still be a great contributor for your company. So I appreciate you reiterating that [00:35:19] topic that had come up. So, well, we'll quickly tie, I'm just going to do a quick reset. We had a [00:35:24] few people join the room. So everyone who's here and, and everyone who's listening to this on playback, [00:35:29] this is the fireside chat, we have this fireside chat every single Wednesday at eight o'clock PM, [00:35:35] Eastern time. Today, we're speaking with Ty Lambo. Ty Lambo is the founder of several companies. And [00:35:42] it's interesting to me, Ty, I looked on your website, everybody, if you'd like to, you can follow him [00:35:47] on LinkedIn, which is posted here. Thank you to Mas for posting that. Also at tylambo.com as well. [00:35:55] A lot of information there that I'm sure if we don't cover it tonight, they can get to you that way, [00:36:00] right, Ty. But we'll continue to talk to Ty for another hour. So for those of you who are in the [00:36:06] room, please, for the first time, please follow the fireside chat. You do so by clicking on the little [00:36:10] greenhouse next to the fireside chat, follow the mods as well. Everyone in this room does a lot of work, [00:36:19] not just on clubhouse and sharing their expertise, but on multiple platforms as well. And with that, [00:36:25] I will give the mic over to Hussein to ask the next question. [00:36:30] Actually, I have to follow you up to Lisa a bit. I was supposed to pass it over to Lisa to introduce [00:36:37] herself. I think I didn't do that. So Lisa, would you like to introduce yourself first? Then I'll go [00:36:41] for my question. Sure. My name is Lisa Beth Lentini-Walker, and I run a compliance ethics and corporate [00:36:49] governance consulting firm called Lumen Worldwide Endeavors. And I'm just excited to continue with this [00:36:54] conversation. So Hussein, passing it back to you. Thank you, Miss. So Ty, great insights. I'm glad [00:37:01] to have you here. Just wanted to get to know you a little bit more. What do you do in your free time, [00:37:06] if you have any? How do you blow steam? How do you get that work-life balance in place? Can you share [00:37:13] some of that as an entrepreneur? It's got to be hard to do that. That's a really good question. Thank you. [00:37:21] I'm free time. Gosh, I don't know when last I had one of those. Actually, I do. So I have a... So when I [00:37:29] left, I was hired as the first seesaw for the city of Atlanta several months ago, pre-ransomware attack, [00:37:38] by the way. I was two years gone. And I walked 8 to 8 PM most days. And even though I thought it would be [00:37:48] be an easy 9 to 5, it's a government public service. I mean, that's got to be an easy job, [00:37:53] right? Government employees don't do any work. That was my thinking. But it became a mission within my [00:37:59] first week. So after one and a half years, I actually resigned after one year and gave them [00:38:05] four months notice. So I could get the budget for the new fiscal year that started July 1. [00:38:11] And so from July 1, 2016, I walked away from City Hall and I started walking three miles a day. [00:38:19] So I block an hour every evening. Sometimes I'm fortunate to have my wife walking with me, [00:38:27] if she can keep up with me. But I do that religiously almost every day of the week. If I miss one or two [00:38:36] days a month, then that's a bad month. So if I had started walking in one direction, I probably would [00:38:45] have walked around the world in the past almost five years. And what that's meant for me is I lost 40 [00:38:55] pounds in the first year. I actually gained 40 pounds on the job. So I lost the 40 pounds. And I mean, [00:39:02] mentally, it just really has helped me to be very mentally fit and be able to juggle everything I [00:39:09] have to juggle as an entrepreneur, as a husband, as a father, and just as a community leader. It's [00:39:18] really, really helped to give me that balance. Every now and then, I'll take a staycation with the [00:39:24] family. We'll book an Airbnb maybe half an hour to an hour away. And we'll let off [00:39:32] some steam for maybe a few days. You know, those are few and far between, especially with the pandemic. [00:39:38] Pre-pandemic, it was travel. I love to travel, not for business though. Business travel is overrated. [00:39:45] So, but yeah, it's been mostly, it was mostly business travel. I also like to go fishing, [00:39:53] although I haven't done that for 15 years. It's because I've been so busy. But yeah, I mean, [00:40:00] it's the one hour brisk walking every evening really, really makes a difference. Like, [00:40:05] I just don't know how I would be able to carry on juggling so much if I wasn't doing that. But I see [00:40:11] it as kind of an investment, you know, in my time. And I kind of see that hour, you know, and I haven't [00:40:18] really done the math, but I'm sure it's probably, I'm extending my lifespan by at least, you know, maybe, [00:40:26] I don't know, maybe an hour for every hour I work. [00:40:30] And that's, I'm sure I'm going to come up with the math at some point. But it's just really, [00:40:35] really paid dividends from a, just a general health standpoint. It's really helped to, to give me a, [00:40:41] I mean, I'm fairly healthy for my age and fairly fit as well. So yeah, I mean, at some point I would [00:40:49] love to do a lot more, you know, I, I, when I was younger, I liked to do things in, you know, outside, [00:40:55] like, you know, hunting, you know, and stuff like that, you know, even though it was, it wasn't like [00:41:00] the type of hunting that, you know, folks would consider real hunting. So I love doing stuff, [00:41:06] outdoor stuff, but I just don't have enough time to do that. But that's probably something I'll, [00:41:12] I want to pick up as a hobby at some point. So if there's any hunters in the group, please give me [00:41:20] some tips. I actually have a customer that is in the business of hunting. They actually have a, [00:41:26] without doing a shameless plug for them, they're out west and they have a hobby site for hunters. [00:41:34] And they sell a lot of regalia and everything like that. And every now and then the CEO would be [00:41:39] like, oh, Ty, you need to join us for a hunting trip. I'll be like, um, if you paid me for the time, [00:41:45] you know, that could be an extra incentive, but he'll be like, no, we're not going to do that. [00:41:49] Um, so anyway, so hopefully that answers your question, sir. [00:41:54] Indeed it does. I'm so happy that you're taking care of your [00:41:58] physical or mental health as well, along with working many hours, uh, over to you, Lisa. [00:42:03] Absolutely. Well, I'm glad we started down the path of talking about, you know, physical health [00:42:10] and mental health because it is mental health awareness month. And I think it's always good to [00:42:16] talk about these, um, uh, concepts, particularly as it relates to work. So I wanted to ask you, [00:42:24] what drives your interest in, um, discussing topics like mental health within, um, the profession, [00:42:31] because I see that you've done a lot in this space and I just think it would be really interesting [00:42:36] for you to share some of that with us. Wow. That is very interesting. Um, [00:42:45] so yeah, I'm, I'm almost tearing up here. Like, so I've, I've had the fortune of being trusted by a lot of [00:42:55] CISOs and a lot of leaders, right? So sometimes what you see in public [00:43:03] is different for what's going on in their lives privately, right? And until you build a relationship [00:43:09] with them and they kind of kind of trust you and, you know, first they have to like you and consider [00:43:15] you a trusted advisor, you wouldn't see behind the scenes, right? What's going on in their personal lives. [00:43:20] Uh, one of the things I found over, especially over the past 10 years is a lot of CISOs are getting [00:43:27] burnt out. Uh, and when I say burnt out, there's different levels of burnout. Burnout could be, [00:43:33] you know, worst case could be they turn to drugs and, you know, alcohol and, you know, abusive, [00:43:39] you know, um, substance abuse and, you know, stuff like that. Um, that's like the worst case. Um, [00:43:45] the, the, the, not so well, I'll say best case scenario is they get stressed a lot. They have [00:43:55] to take time off work and, you know, their productivity really, really goes down or they [00:44:00] quit. Right. Or they, in some cases they may actually get disgruntled, right? Which is not a [00:44:06] good thing if you have a disgruntled CISO. Right. Um, so I, I've been, I've had a lot, I mean, [00:44:13] obviously can't share particular details, but I've, I've seen a lot of behind the scenes that isn't [00:44:19] good for our industry. So I'll say 10 years ago, I really started being more intentional about [00:44:25] reaching out to folks, especially folks that I have mentored and they've been through my program [00:44:31] over the years to say, how can I help? Like, what can I do to help you? You know, um, my first CISO [00:44:36] job was 2006, I was working for a company called, um, John H Harland. We printed checks for banks. [00:44:45] And I knew what it was like to be in the hot seat, a hundred million bank details. Ultimately the box [00:44:51] stopped, you know, with me as their director of information security. So I was kind of the de facto [00:44:57] CISO. And I, I did that for a year and I knew how much pressure, you know, the thought of, you know, [00:45:03] when the CEO tells you, Hey, my worst nightmare is I wake up one day and the wall street journal says, [00:45:10] you know, we've been hacked. And that's why I have you in this role to make sure that doesn't happen. [00:45:17] That puts a tremendous amount of pressure on you. Right. So, you know, I knew, I know firsthand how [00:45:23] much pressure it's a very thankless job. So, you know, what I go out of my way and to reach out, [00:45:31] you know, to some of my CISO pairs, I just seen how I can help. And sometimes help could come in [00:45:36] different forms, you know, help to come through just being like, being really, really, brutally [00:45:44] honest with them. Cause we all have blinders, right? Things we don't see. And if they're working too hard, [00:45:49] or they don't have enough work life balance, or they're micromanaging their team to death, [00:45:55] somebody needs to call them out on that. And typically I'm the one who does that privately, [00:45:59] right? Just based on things I've heard, you know, and stuff like that. So I may bring it up to them to [00:46:05] say, you know, have you thought about a different way of managing your team? Because I don't think [00:46:11] they're too happy. Or what did you hear? No, I'm just, you know, saying. So I've tried to do that. But one area that I'm [00:46:19] also particularly interested in is, and I don't know if this really clinically falls under mental health, [00:46:26] is the area of autism. So I've had family members that are on the autistic spectrum. And [00:46:36] if you ever have an autistic child, it's one of the hardest things to do. A loved one you're caring for [00:46:43] that is autistic. It's very hard, but it's also very rewarding, right? Because they need support, [00:46:49] they need help. So one of the things I started doing years ago is also studying what there must be a [00:46:56] correlation between autism and what hackers do, right? So some of the best hackers are actually on [00:47:03] the autistic spectrum, right? And obviously, that's not an excuse or justification for criminality, [00:47:10] criminality, right? You know, criminality is criminality, right? So I'm not, you know, [00:47:15] justifying that in any way or condoning that in any way. But there's got to be a way to maybe channel [00:47:22] that mindset or that what others may consider handicap, you know, which in some cases are actually [00:47:32] really good strength. Because, you know, if you're, if you let's say you've got Asperger's syndrome, [00:47:36] right? Sometimes those are like the best analysts, right? They could be so focused on getting something [00:47:42] done that they would get it done, and they would never quit, you know, until they get it done. [00:47:47] So I've started focusing a little bit more on, okay, how can we bring folks like that into our industry, [00:47:53] right? So I have one of, you know, one or two mentees that they haven't told me they're on the [00:47:58] autistic spectrum, but I know they are just by observing them and, you know, communicating with them. [00:48:04] But I'm trying to figure out where the most fit, right? You know, so maybe they're not, [00:48:09] you know, customer facing consultant like me, maybe they're more of an analyst, you know, [00:48:15] working behind the scenes, and eventually they could grow into a customer facing role, [00:48:19] if they, you know, if they desire to do that. But that's something I'm really passionate about. [00:48:24] I would say my drive to just help people and do more for others, you know, I use the word of [00:48:30] Dr. Martin Luther King, Jr. You know, life's most persistent and urgent question is what are you [00:48:37] doing for others? So I wake up every single day thinking, what am I doing for others? Am I doing [00:48:43] enough? And I think that's, you know, any way I can help to be part of the solution and not be part of [00:48:50] the problem, I'm always looking for ways like that, like, what can I control? What can I do, [00:48:55] you know, with the gifts and the resources and the platform I've been given? So yeah, so that's the why [00:49:02] behind it. I wouldn't say I'm a mental health expert, you know, far from it. I'm still learning. [00:49:09] But I think there's a connection there. You know, I think it's something we need to take a really close [00:49:14] look at in our industry, right? On how we can potentially leverage folks that, you know, [00:49:23] may be experiencing some of these mental health issues, you know, within our industry to make [00:49:31] us more diverse, because we certainly have those folks on the other side. [00:49:38] Thank you so much for sharing that. And I agree, there are so many ways that we can [00:49:43] incorporate people who have are a little bit different than ourselves, or are have talents [00:49:50] that are untapped. I'm going to turn it back over to Tomas. Thank you for sharing, Ty. [00:49:54] You're welcome. You're welcome. [00:49:57] You know, while we're waiting on Tomas to come back and kind of reset our room, I'll just say, [00:50:06] as a benefactor, Ty, we had the privilege of working together several times. And when you came up to me, [00:50:11] you looked at me in the eye, and you looked at me sincerely and said, Russell, how are you doing? [00:50:16] It took me about 10 times, 10 times to finally realize what you were saying. And I tell you, I miss [00:50:23] that question. I think about that question. It's been years ago since you've, you looked me deep in [00:50:29] the eye and asked that question, and you checking on me meant more than any other thing that you ever did [00:50:33] for our team, for myself, and for the organization that we worked at. So I just publicly am grateful [00:50:38] and thankful for your friendship and you looking out for me before it was cool to look out for people. [00:50:43] So I appreciate that. And with that, certainly want to invite anyone else who would like to come up on [00:50:48] stage and ask Ty questions. Please raise your hand. Love to have you up on stage and kind of share [00:50:53] this idea of questions and, you know, Ty, what you've been up to, what are some of the things you've been doing [00:50:58] that you might've been inspired from the conversation so far? [00:51:02] Tyrone Lerner- To say something, you can't, you know, you can't give me credit without me giving [00:51:06] you credit back. So I used to work for a guy and every time I said, how are you doing? He looked at [00:51:11] me almost like, why are you asking me? And then he'll go, how are you doing? Like in a very cheeky way. [00:51:19] You were, I mean, Russell, and I, I'm going to say this publicly, Russell is probably one of the top [00:51:26] five cybersecurity leaders. I'll just say leaders I've ever had the fortune of working with. So it's [00:51:34] not just like, some people don't receive that well, like it feels like you're, you're prying, [00:51:40] right. But because Russell, you know, he, Russell's got a great hat, like, and he's really a true [00:51:48] leader and a servant leader. He was able to kind of see the authenticity, right behind me asking him, [00:51:54] right, that I was truly concerned for him. And I truly cared, right. Not everybody likes that, [00:52:00] especially in a work setting, right? People just want to keep everything on the surface. In many [00:52:06] cases, especially in our industry, right? Maybe outside of work, you know, we can talk about the [00:52:12] stuff that is going on that, you know, is not good, but people want, and we disguise that sometimes as [00:52:18] we're being professional. But there's a lot of professional people in the grave that died very [00:52:25] early for, you know, things that they just bottled up, and until they just became very chronic. [00:52:39] Wow. Well, thank you, Ty. I appreciate that. Amazing to work with you. Professor Roger, Jenny, [00:52:44] great to see you up on stage. Love to hear your, give you some space to get to know Ty just a little [00:52:50] bit better as well. Russell, I think you broke up a tiny bit. Are you inviting [00:53:01] Professor to be the first question? Yes, please. Sorry about that. Struggling tonight. [00:53:08] Professor Roger, over to you. [00:53:14] The lower right-hand corner is where the mute button is. We'll wait till Professor Roger comes [00:53:21] back. Jenny, over to you. Hey, everybody. Nice to see you. Wonderful. Everything you've been [00:53:31] speaking about, Ty. My question for you is, you know, your 25 years of experience [00:53:35] in your bio, it says building robust and sustainable security. What was the biggest challenge that you've [00:53:44] experienced over that tenure? And what have you put in place that has made that easier? [00:53:53] Wow. Can I be honest? [00:53:57] Great question, by the way. The biggest challenge was always me. [00:54:07] It wasn't about somebody else, right? So if I think about when I first started in security and, [00:54:13] you know, we'll go sell firewalls to, honestly, I call them dumb CEOs back then. With hindsight, [00:54:21] that wasn't a good thing because I'm sure my body language probably showed I thought they were dumb. [00:54:26] Um, because I was the super techie, right? So I felt like I had this arrogance about my knowledge [00:54:33] and what I know. You know, I know 50 ways of getting into their network and making them [00:54:38] look bad. Why wouldn't they want a firewall? So that was kind of my approach. [00:54:43] What I needed was a bit of humility to understand their pain point and to put myself in their shoes. [00:54:49] And it wasn't until I started my own companies that I suddenly realized I'm now that CEO, [00:54:57] right? That doesn't want to spend money on security, right? Unless there's a business justification for [00:55:04] it, even as a security guy, right? Everything has to have a business case. [00:55:10] So I would say the biggest challenge has been me in the early days. It's become less of a problem. [00:55:18] You're not getting buying is really what I'm talking about. Like in the early days, [00:55:23] you preach the message, you scare them. We use fair uncertainty and for and doubt, FUD. [00:55:30] Um, they, they kind of have sold on the problem, but they're not willing to take that next step of [00:55:37] actually spending the money. Once I started focusing more on understanding the business and understanding [00:55:44] that security is an enabler and selling security as, Hey, if you do all these things that you are kind of [00:55:54] already required to do by regulation, but you want to go beyond the regulation and actually do the right [00:55:59] thing. If you do all these great things, it's going to become a differentiator for your business. [00:56:05] But if you don't do it, it could actually be a discriminator. Once I started using that type of [00:56:13] language, instead of, Hey, the, you know, the bad, you know, the big, big bag, you know, hacker is going [00:56:18] to come get you and, you know, pillage your network, you know, make you look really bad. That was the [00:56:25] initial plan, you know, the initial, um, pitch. It, it changed to let me help you make this a [00:56:34] differentiator. So it doesn't become a discriminator. And I think I've had less challenges then, uh, [00:56:41] have to take in that approach. Having said that, um, when I worked for city government, [00:56:47] it was always potholes, you know, competing against, you know, fixing potholes, competing against [00:56:55] patching systems. Uh, what do I mean by that? So if you live in a city or a county, which I'm sure we [00:57:03] all do, um, you're driving around, you're going to find potholes somewhere, right? Those potholes, [00:57:12] the constituents, I, the residents, you know, the businesses and visitors, they see all the time. [00:57:18] They don't see systems that are unpatched. They don't see systems that, you know, control weaknesses, [00:57:27] right? They typically don't see those things on a day to day basis. You know, so when I was in, um, [00:57:34] city government, the challenge was every dollar we spent on cyber security was at the expense of fixing [00:57:42] the pothole to the point where every time I'm driving home or driving into work, I see potholes [00:57:47] everywhere. And I feel guilty like, Oh, I'm depriving the city of fixing this potholes because [00:57:53] they're spending money on my program. Right. So, but at the same time, it's a balancing act, right? So [00:58:01] you do the things that are obvious, you know, with limited tax, you know, tax dollars, you know, [00:58:05] nobody wants to like, nobody likes to raise taxes because that's usually a, you know, almost a guarantee. [00:58:12] They're not going to get reelected. Um, so they usually, you know, elected officials would normally [00:58:18] say, Hey, I'm going to come in and I'm not going to raise taxes and I'm going to do so much with the [00:58:23] same amount of money. Reality is it doesn't happen that easily. Right. So you're working on that, [00:58:29] that type of administration and that kind of limitation. And so my job is to be able to align [00:58:35] what's important to the leadership, like the mayor, you know, of the city to say, okay, yeah, [00:58:42] I know potholes are priority. I know you promised all these things, but you also promised public safety. [00:58:49] And even though people may feel safe, um, in their neighborhood, if their data gets compromised, [00:58:56] they're not going to feel safe anywhere. So just use types of examples to educate. Um, but I would say, [00:59:02] I've, I've, I've seen, I've experienced less challenges once I started aligning my thinking [00:59:09] and my mission from a cybersecurity leadership standpoint to the business or to the leadership. [00:59:16] So hopefully that answers your, your question. That's phenomenal. Thank you so much. [00:59:21] You're welcome. Let's see if, um, uh, Professor Roger is back. [00:59:31] Hello. Hello. How you doing? Hi, Professor Rogers. Wow. I, you know, I, I think we met and I told you my, [00:59:40] both my mom and dad are retired professors. So I feel really humbled. Yes. Yes. Yeah. I have a question [00:59:47] for you. Um, you know, um, um, um, one of my missions is trying to work on the diversity and inclusion [00:59:57] numbers that, that are very alarmingly low in, um, Silicon Valley. Right. With the, with the, um, in tech. [01:00:08] So, um, have you come across that and are you addressing that or have you addressed that or have you seen that? [01:00:19] What's your take on that? [01:00:20] Very good question, Professor Rogers. So through my nonprofit, uh, his P that's something we've been [01:00:29] focusing on with a very laser focus for five years. Um, we have a vision to help. Well, contribute, not, [01:00:40] we're not going to solve this problem on our own, but there's not only a talent gap, but there's a [01:00:45] diversity gap specifically focused, we're focused on minorities, um, ethnic minorities, veterans, [01:00:53] and women, but we're focusing on the leadership track. Right. So, um, I always joke that, you know, [01:01:00] Walmart could say that diverse because you go to, you know, most Walmart checkouts and you're going to [01:01:06] see a lot of diversity, right? But do they have that level of diversity in the boardroom? [01:01:12] Um, and if they don't, why not? Because as last time I checked, Walmart is probably in every major [01:01:21] city in the U S and probably in every major suburb in the U S. So they need to, um, and I recently [01:01:29] found out that Walmart actually has a very, very diverse cybersecurity team. Um, one of my contacts [01:01:35] actually works at Walmart as a PM. And she said she was shocked to find out that they have such [01:01:41] diversity. I'm not meaning to pick on any particular company. I'm just using Walmart because we all [01:01:46] know what my, we probably all shop at Walmart at some point. Um, so I think the key would be to [01:01:52] diversify not only the pipeline, and that's what his P is trying to do. The holistic information [01:02:00] security practitioner Institute. Um, so we actually have a 20, 30 vision to provide training, certification, [01:02:09] mentoring, uh, internship, apprenticeship, and job placements for 10,000 minorities, veterans, [01:02:16] women that want to become cyber security leaders at some point. So I'm, I'm literally, it's like a CISO [01:02:23] track. You know, we've seen folks go from entry level to CISO, um, in, I would say two to five years, [01:02:34] you probably think, and how can that even happen? So one of the things we do is we look for folks that [01:02:40] already have a lot of business experience or non it, you know, they have leadership experience in [01:02:47] different areas of life. Um, some of them may be like midlife and they just want to switch careers [01:02:53] because, you know, they're kind of doing a restart or reset. Uh, we, we look for those soft skills that [01:02:59] positions them to become really good cyber security leaders with diverse mindsets. Cause I grew up in [01:03:06] tech, right? So I want folks that didn't grow up in tech like me to become, you know, I want to give [01:03:13] those folks the opportunity to become cyber security leaders themselves. And I think that would be good [01:03:19] for the industry. Maybe not all of them will be successful, right? Maybe we still need, you know, [01:03:25] super techie CISOs, but which I mean, there's no way we're going to know if that's going to work if we [01:03:31] don't try. And I'll tell you what I've experienced professor Rogers is I've seen people with a Spanish [01:03:38] degree, folks with a food science degree become really good CISOs in, in a period of five to 10 years, [01:03:48] just giving them that opportunity to learn from, you know, cyber security, from a business standpoint, [01:03:55] and from a leadership standpoint, and then giving them the opportunity to kind of map out what their [01:04:00] career roadmap looks like. You know, it could be a five-year roadmap could be a three-year roadmap, [01:04:06] but just kind of helping them along the way to figure out how to navigate and also providing [01:04:12] sponsorship. So if I have a friend that needs to hire CISO, you know, I have a lot of CIO friends [01:04:18] and typically they'll come to me because they're kind of hoping that I want to come work for them. [01:04:23] And usually the conversation ends when I say, actually, I'm really not interested. I'm happy [01:04:30] to stay as an entrepreneur. But having said that, I have a few people on my network, you know, [01:04:35] that I've mentored and they're probably, I always say that they're better than me. And they're like, [01:04:40] no, no, no, they can't be better than you. No, no, they actually really are better than me. [01:04:46] I'd be happy to, you know, make an introduction. And some of them have ended up working for those, [01:04:51] you know, industry contacts. I also provide like sponsorships where I'm actually able to vouch for [01:04:57] folks and say, yep, I worked with them. You know, they've been through my program. I can vouch for [01:05:02] them. And I think they'll be a great fit for the opportunity, but I still leave it up to [01:05:07] the employer, you know, to determine whether they're a good fit. So hopefully that helps. There's a lot more [01:05:14] that goes on. I mean, we partnered with Cybersity. I've been a really big supporter of Cybersity. [01:05:21] It used to be ICMCP, now rebranded as Cybersity. So we're actually getting like scholarships. [01:05:28] The most recent one is Intuit. We got a scholarship to get folks, I think almost 50 individuals through [01:05:36] phase one of the program. But the funding came from Intuit to Cybersity. And then [01:05:43] his pay as one of the training partners is leveraging that. So Professor Rogers, hopefully that kind of [01:05:49] answers your question. But you know, I'd be happy to talk about this a little bit more offline. [01:05:53] Yes, thank you. You're welcome. Awesome. Thanks. Thanks, Professor Roger. Thanks for jumping up and [01:06:02] asking that question. Roger, over to you. Is it Roger or Roger? It's Roger. Roger. Okay. Go ahead, Roger. [01:06:13] All right. I appreciate it. Thanks for inviting me up. Sorry, I don't really know how to say the name. Is it [01:06:19] Ty or Ty? I forget what I heard. Ty. Ty. Ty. Okay. A question came to my mind and it's a little bit [01:06:28] broad slash vague, but after listening to you talk, I think you would be a great person to kind of take [01:06:34] a stab at it. I pretty much find myself in different areas of life kind of not knowing the best course of [01:06:44] action. Subconsciously, I've noticed that I don't have the right answer. I don't have the right idea, [01:06:52] the best idea of how to approach something. And so I typically respond to that by just taking some [01:07:00] kind of action, just kind of going forward. And usually that results in mediocre results. [01:07:06] And so I wonder what would be some better mental processes to kind of ask yourself in that moment [01:07:15] where you know you don't know the answer here. You don't know what the best thing is to say in this [01:07:21] situation or to approach this situation. What do you think is a good way or a good question to ask [01:07:30] yourself or a good approach to take the kind of, I don't know, just kind of get a better result in terms of [01:07:40] decision making and thinking through something? Okay. Wow. That's a very interesting question, but it's a [01:07:48] loaded question. So every time, I mean, what you've described sounds like a situation where you're stuck [01:07:55] about the best way to go about doing something? [01:08:00] If I, if I, unless I... No, no, no, sure. No, sure. That's it. And, and, you know, like I say, [01:08:05] you can subconsciously know that you don't know what the best way to go about this or that is. [01:08:12] And, but you have, but you feel that, okay, well, I have to do something. And so, well, let me just do [01:08:17] something. And, you know, you kind of wing it, or you kind of just put your best foot forward. And hindsight is [01:08:23] always 20, 20. And you always can look back and be like, well, if I would have just took a second to [01:08:28] think about it this way, or this or that, but none of that matters in the moment. In the moment, [01:08:33] you feel that, okay, well, I need to do something. And so, well, let me just do something. So, but I [01:08:38] really feel like there's a better way to think through some things. And I really liked the way you've [01:08:42] kind of spoken about some of your experiences. And so I'm like, this, this would be a good one for, [01:08:47] to hear what you had to say about that. Awesome. So I am the master at Wingenit. [01:08:53] Like, I didn't know what to expect from this conversation. I've joined a few fireside chats, [01:08:58] but I didn't know what the format was, but I'm like, okay, I need to prepare. So I actually listened [01:09:03] to some of my previous interviews, like who does that, just to make sure I can remember my own [01:09:08] talking points. And of course, I never used 80% of what I wrote down. Right. So I think the key thing [01:09:16] is just knowing that you've done the, your best, you put your best foot forward. But so when I wing it, [01:09:22] I still try to put my best foot forward. And sometimes when I, some of the things I winged [01:09:29] have actually been the most successful because I never thought it through. If I think too much, [01:09:37] I'm an engineer by training, I'm going to, it'd be, is it analysis by paralysis or paralysis by analysis? [01:09:44] I think it means the same thing. That's what I experienced. So I, I'm actually better at [01:09:50] winging things, but I also make sure that I put my best foot forward. And if I fail, there's nothing [01:09:57] wrong with failing, just fail fast and fail forward. But I would say one of the areas where you definitely [01:10:08] can, can, I mean, this could be for anyone. Everyone needs a mentor. You need somebody you can look up to [01:10:15] that has already walked the path or the walk that you're trying to walk and they can guide you. [01:10:23] So I recently signed up for my, actually last year, I signed up for my dad's mentoring program [01:10:29] on strategic life planning. And I come up with a, I think it's 15 years plan because I never had that. [01:10:38] Right. I always had like a, you know, two to five year plan, but it was nothing like concrete. It was just [01:10:43] in my head and more aspirational. But with this, I actually broke it down by the different, you know, [01:10:49] life areas, you know, and it's, so it's given me a little bit more, what's the word? It's made me a [01:10:58] bit more organized and a bit more intentional about the things I invest my time in. So, but you only get [01:11:05] that kind of, you only get to that kind of place where you're humble enough to submit yourself to [01:11:10] mentoring. So I think mentoring is one way. Even in my CISO roles, I've had mentors, you know, when I was [01:11:18] the city of Atlanta CISO, I signed up through MS ISAC. Shout out to my friend, Kurt. I noticed Kurt joined. [01:11:27] Thank you from Center for Internet Security. So they have a really good program for MS ISAC, which is [01:11:34] multi-state ISAC, you know, state, local, tribal, territorial government, non-federal government, [01:11:39] government agencies. They had a mentoring program. So I actually had a mentor who was the CISO for the [01:11:46] state of Montana. And we did monthly mentoring sessions. And it wasn't like I didn't know what I was supposed [01:11:52] to be doing. I just needed somebody who was a seasoned public servant to guide me and help me navigate the [01:11:59] politics, you know, that I had to deal with. And quite frankly, some of those mentoring sessions for [01:12:05] me was like therapy. And one thing that always happened at the end of our sessions is she would [01:12:12] always say she's retired now. Her name is Lynn. She said, Ty, you should be the one mentoring me [01:12:17] because I've learned so much from just hearing what you're doing at the city of Atlanta with your [01:12:22] program. Like I can't get all this stuff done at our state because there's so much bureaucracy. [01:12:27] And but so she helps me, you know, I believe in that concept of, you know, iron sharpens iron, [01:12:34] you know, so that's kind of how I live my life. I always want to get somebody else who I feel I [01:12:39] respect and I feel like they have a little bit more experience in certain areas to get their input. So [01:12:47] hopefully that answers your question. But, you know, feel free to hit me up offline, you know, [01:12:53] if you wanted to continue that discussion. I appreciate it. And it was open ended. So I mean, [01:12:59] there was no there was no wrong answer I was looking for. And I really just wanted to hear [01:13:04] how you would respond to it. So I appreciate it very much. Absolutely. Well, I'm the master of [01:13:10] winging it, but not everybody is designed to be like that. Sure, sure, sure. [01:13:16] Thanks, Roger. Thank you. Thanks for popping up on stage and asking a question. Jennifer, [01:13:24] good to see you over to you. Hey, Tomas, thank you. Can you hear me? Okay, I'm outside. [01:13:33] I can hear you. Great. Okay, good. Hi, Ty. I am loving pretty much 100%, 101% everything you're saying. [01:13:40] And I wish Roger was still here because when he said diversity in Silicon Valley, I almost spit my [01:13:46] drink out. I'm kind of an oxymoron. I'm in Silicon Valley. So I love what you're saying and what diversity [01:13:54] brings to the table and what you're hitting and all the different, you know, genders, races, [01:14:00] ages, etc. It's also diversity of discipline or thought process. And you brought this up in a couple of [01:14:05] ways, which is like when you're describing your role in the city of Atlanta and having to kind of quote [01:14:10] sell the whoever holds the purse strings on the benefit of cyber and that it is and I agree, that's [01:14:18] how I sell it as a differentiator. That's a sales skill. And then you describe yourself as an engineer, [01:14:24] which is they don't usually have, you know, a lot of engineers don't have that sort of sales skill. [01:14:29] You're also everything I've heard, you're very much a people person. And so these are just different [01:14:33] different diverse sort of diverse thought processes or approaches. And I'm wondering how you bring [01:14:41] that into your your community that you work with. And you did bring in that the, you know, chef and [01:14:47] the other role where they because I do think those skill sets go a long way or just having diverse [01:14:52] thought process and not having group think or we've already done it think. And then also how we bring this [01:14:57] younger in groups. I know a few weeks ago, Tomas and Katie and everybody in your room, we had, [01:15:01] I can't remember her name, but she started black girls in cyber for young kids because it really, [01:15:07] it's great to start people younger and get them interested in things and mentoring. [01:15:11] But I'm wondering how you bring those into your world. [01:15:16] Wow. That is very interesting. So, you know, full disclosure, Jennifer, right? [01:15:21] Yes. Thank you. [01:15:24] Okay. I wasn't very good with young folks. I grew up fast. My sister is actually on the call. So she can [01:15:34] disprove or validate anything I'm saying. She's my baby sister at the Lapo. And so I grew up being, [01:15:44] I grew up fast, let's put it that way. A lot of my friends were older. So I matured very, very quickly. [01:15:50] Right. And so I have very, very little tolerance for like kids that don't know where they're going in life. [01:15:58] And all they want to do is play on social media and, you know, do crypto or whatever. [01:16:05] Or what's the other one? YouTube. They want to be a YouTube influencer. Right. Nothing wrong with that. [01:16:10] Oh my God. They're behind the scenes. It's all TikTok now. Right. [01:16:13] I'm kidding. I'm kidding. [01:16:16] And they actually think that's a career. So it was very hard for me to connect to like young folks. Like my, [01:16:25] up until two years ago, my youngest mentee was probably somebody in their thirties. [01:16:31] I never took on like teenagers or 20 years old. I was just like, we just won't be able to gel. Right. [01:16:38] This is the best way to describe it. Um, cause I would challenge them a lot. Cause I'll think about, [01:16:43] okay, when I was that age, I already knew where I was going in life. So, you know, I would have been [01:16:49] very judgmental. I, I launched the book too, just a little bit about two years ago, that really, [01:16:56] really captures that demographic. Um, the character in the book is a 14 year old kid that pretty much [01:17:04] went from straight A student to being a national security threat in 40 weeks, a kid from Atlanta, [01:17:10] fictional novella. Yeah. So it doesn't really represent any real world character that I know of anyway. [01:17:17] Um, so that's been my bridge to connect to younger folks. So up until two years ago, [01:17:25] somebody sends me a young person, I'll be like, talk to my wife. She loves young folks and she [01:17:30] gels with them. And, you know, I mean, she's more connected with them. So I'll just like pass the [01:17:35] buck to her two and a half years or two years ago, after launching my book, I started mentoring a 19 year [01:17:43] old and that completely blew my mind. Now that 19 year old pretty much already knew where they wanted to be, [01:17:50] but where they wanted to be, they weren't on the path, you know, this 14 year old wanted to work for three later agencies. [01:17:58] And I said, yeah, that's great. Um, but they didn't get the opportunity. So they were pursuing the path and the [01:18:04] Dodgers shot slamming their face. So they had, you know, I talked to his dad and dad said, he needs help. [01:18:13] And I started mentoring him. But what I did is actually got him to review my book. Um, it's a series, [01:18:19] it's a novella series. It's called attributes on social and cyber spaces. And once he reviewed my book, [01:18:27] I was able to connect with him. So I basically said, I need you to critique the book, [01:18:32] the good, the bad, the ugly of the book. And I need you to come back and present that to me. [01:18:38] And I'm going to determine whether I want to take you on as a mentee. And this kid just wowed me. [01:18:45] Within three months, I actually, within a month, I hired this kid as a pen tester doing part time, [01:18:53] he was still in college. I was able to engage him for by a year while he was still in college in his [01:19:01] final year. And just within a few months of graduating from college, he gets hired by one [01:19:07] of the big four as experienced, not entry level, but they gave him like the highest in the pay, [01:19:14] you know, entry level, experienced associate with the big four. 10 years ago, that wouldn't have been [01:19:21] possible like that 19 year old out of just turn them away. I like sorry, I'm just too set in my ways, [01:19:27] I can't help you. But the book has been able to, through the book, I've been able to connect with [01:19:33] the younger generations, right. And, but it has to be somebody that is driven, like I don't like to [01:19:40] micromanage or drive people, you know, drag people along. I want people who have already made up their [01:19:45] mind. You know, they want to be successful, and they're willing to, you know, they're willing, [01:19:50] they're humble, they're hungry, they're teachable, they're willing to invest in themselves, and they [01:19:55] actually want somebody to mentor them, right. So hopefully that answers your question. So that's what [01:20:02] I'm doing, you know, to make sure we get that diversity of thought and also reaching out to the [01:20:09] younger generation. I love I love that. I just want to highlight a few points there, [01:20:16] why I love that, which I think is hilarious. In the kids sitting around being on apps, I, [01:20:21] and I don't directly mentor, but I think that everything we do when we're interacting with [01:20:25] people, we have an opportunity. And so I have friends, kids who they're like, Oh, he's on TikTok [01:20:29] all day. And like, and here's why that might be relevant, not because he's a passive consumer. [01:20:34] So to your point, like, I would actually think, he needs to understand this digital world, [01:20:37] or let's explain to him how this works. You know, I don't expect it to be his life thing. [01:20:41] But you're and then you mentoring also isn't just telling someone what to do. Like you said, [01:20:47] they have to have some interest and passion, and maybe introducing them to that and then having them [01:20:51] review your your book where you change the names to protect the innocent and not get a libel suit. [01:20:55] I'm just kidding. That's, you know, it's a great way to give them an opportunity to step up. And you [01:21:01] guys apply just a platform to work together. I think that's amazing. So thank you. [01:21:05] Thank you. [01:21:07] All right. I just I was talking to somebody where we had a youth event in my church that [01:21:13] we planned and there was this past Saturday, and somebody walked up to me and said, Hey, [01:21:17] I'd like to get your books. We have like a cohort of underserved, I think it was like 16 kids, [01:21:25] high schoolers, no middle schoolers. I'm like, what ages are middle schoolers? It goes like 10 to 13. [01:21:32] I said, Okay, yeah, I think I think I think they would understand the book. But I never thought I [01:21:40] mean, like, that's just giving me such a way of reaching out because now they read the book, you know, [01:21:45] I'm going to come speak, and I'm hopefully going to inspire them to want to become a [01:21:50] silent security practitioner at some point. Like that was that wouldn't have happened without me publishing this book. [01:21:58] Love that. Seriously, and I do love that you change the names. Good. [01:22:08] Well, I, no comments. [01:22:10] I'm in Silicon Valley. Thanks, Jennifer. [01:22:15] Yeah, I was just saying, Tomas, I'm in Silicon Valley, you can't see anything crazier than what we get. [01:22:19] And I'm not changing the names of my book. [01:22:23] Well, I was just updating my TikTok. But thanks for that, Jennifer. [01:22:28] Thanks for asking your question. [01:22:30] Talapo. Hopefully I got that right. [01:22:37] Hello, sis. [01:22:39] If you're new to clubhouse. [01:22:42] Oh, there you go. [01:22:42] Sorry. Sorry, I had to get unmuted. Sorry about that. Can everybody hear me okay? [01:22:48] Yep, loud and clear. [01:22:50] Awesome. So thank you for having me in this room. I'm truly humbled. And if you don't know by now, [01:22:56] Ty is my brother. So I've heard a lot about him on the call. I think he's phenomenal. He is the best [01:23:05] brother. He's the best son. He's the best husband anyone could ever ask for. And I'm very humbled to be [01:23:12] his little sister. My briefing tour is I'm a supply chain transformational expert. And my question, [01:23:20] I had a couple of questions for Ty, you know, aside from him always trying to win me over to [01:23:26] the crisis of security, cybersecurity. So my question is, you know, what are the top three risks [01:23:33] that maybe should keep a supply chain officer like a chief supply chain officer awake at night? And, [01:23:41] you know, how do you go about tackling this as far as cybersecurity, supply chain security? [01:23:49] Wow. So after that, what do you want? You want me to send you a text? [01:23:54] Yes, everything. [01:23:56] All right. Very good question. So there are three, it was actually one of my talking points that I can [01:24:06] use. So there are three things I consider in the past, maybe three years that have been like the top [01:24:13] three risks for cybersecurity in general, right? One of them we already talked about weaknesses in people [01:24:22] process and too much focus on technology. So as a supply chain risk analyst or manager or director or [01:24:29] executive, you need to make sure that your suppliers invest the right amount of money in, well, not money, [01:24:38] resources in people process. So if a supplier tells you, oh, we have the latest and greatest, you know, [01:24:47] I had a client as a VC so that did printing. [01:24:53] They were a mailing company [01:24:56] and they invested in a multi-million dollar printer. [01:25:02] And while they were doing that, [01:25:04] their program pretty much was not like on life support, [01:25:09] but was close to being on life support, [01:25:11] their security program, [01:25:13] because their CIO left abruptly, right? [01:25:16] Obviously, I can't mention any names, [01:25:19] but they made a huge investment in technology, right? [01:25:23] But they had this security program [01:25:26] that pretty much kept them out of the headlines [01:25:28] and kept the customers happy. [01:25:31] Most of their customers were healthcare, [01:25:33] insurance and government, federal government. [01:25:37] But they had just made this huge investment in technology [01:25:40] that had absolutely nothing to do with security. [01:25:44] So when they engaged me as a VC, [01:25:47] so I literally spent nine months bringing the program back on track. [01:25:53] And luckily, they had to get ISO recertified. [01:25:58] So that was the driver, like, [01:25:59] hey, you're going to lose your ISO certification [01:26:01] that your customers expect you to have. [01:26:04] And they said, yeah, Ty, we know that's why we hired you. [01:26:07] Okay, good. [01:26:07] I'm glad you realized that it's a risk. [01:26:12] So it took nine months to get it back on track. [01:26:14] Not many companies make that kind of investment. [01:26:17] They invest in the shiny objects that may impress customers. [01:26:22] But as a supply chain risk executive, [01:26:25] you need to make sure they're spending their resources [01:26:28] or they're committing the necessary amount of resources [01:26:32] to strengthening their security posture. [01:26:36] So the people in the process typically making sure [01:26:39] they have the staffing. [01:26:40] And if they don't have it in house, [01:26:42] they hire a virtual CISO like me or Russell [01:26:44] or some of the other virtual CISOs on this call. [01:26:49] So that's the first one, [01:26:50] strengthening that human firewall and processes. [01:26:53] And you only can do that by having a program [01:26:56] and committing the resources to the program. [01:26:58] And the second one is everybody now is in the cloud. [01:27:03] I don't care what industry sector you're in, [01:27:06] you're putting your data in the cloud at some point. [01:27:10] So if you have a vendor that has some sort of platform [01:27:16] that handles your workload or your data, [01:27:21] that's mostly in the cloud, right? [01:27:23] Could be a private cloud, could be public cloud, [01:27:26] could be hybrid cloud. [01:27:27] So jumping into the cloud requires one thing. [01:27:31] I call it a parachute. [01:27:33] In the physical world, it's the same. [01:27:35] You know, if you go skydiving, [01:27:37] you're going to need a parachute. [01:27:38] In the IT or technology world, [01:27:41] you also need a parachute to make it safe. [01:27:44] Do your due diligence. [01:27:45] Make sure the cloud service providers, [01:27:49] you know, they have the same level of scrutiny [01:27:52] as the customer itself or the supplier. [01:27:55] I'm sorry. [01:27:56] So follow the data. [01:27:58] Follow the data. [01:27:59] Follow the money. [01:28:00] Make sure you do your due diligence. [01:28:02] Sometimes the cloud, and I actually love the cloud, [01:28:06] even as the CISO. [01:28:08] Some companies don't have any business having their own data center, [01:28:12] especially small, medium-sized businesses. [01:28:14] Everything needs to be in the cloud, [01:28:15] but they need to understand the shared responsibility model. [01:28:19] So between the cloud customer or the tenant and the cloud provider, [01:28:25] there's a shared responsibility. [01:28:27] Sometimes there's a shared responsibility with the end customer, right, [01:28:31] that the supplier is handling the workload for, right? [01:28:36] So it could be three ways. [01:28:39] It could even there could be other parties involved. [01:28:41] If you have like a broker involved in the relationship [01:28:44] or a systems integrator or a managed service provider, [01:28:47] making sure they understand that shared responsibility [01:28:51] and due diligence. [01:28:53] Typically that's part of supply chain risk management, right? [01:28:57] Or at least an extension of supply chain risk management. [01:29:00] Any framework ISO needs to typically has controls [01:29:04] related to supply chain risk management. [01:29:07] So that's the second one. [01:29:09] The third one, the lack of will be the talent shortage [01:29:13] and the lack of diversity. [01:29:15] It's one thing for the enterprise to have good representation, [01:29:22] but the supply chain needs to have that as well. [01:29:25] And when I say diversity, I'm not talking about one race [01:29:29] or one type of people or a bunch of engineers. [01:29:32] You'd need a diversity of thought, right? [01:29:35] So, you know, when I worked at City Hall, we were very diverse, [01:29:40] but we were 90% African-American, right? [01:29:44] And I always say that's not the kind of diversity [01:29:47] I'm talking about. [01:29:48] We need more representation here, right? [01:29:51] On that team. [01:29:52] So I hope hopefully that answers your question, but you know. [01:29:56] Yes, it does. [01:29:58] Yes, it does. [01:29:58] Thank you for addressing all those areas. [01:30:01] Awesome. [01:30:01] Awesome. [01:30:02] Awesome. [01:30:04] Thank you, Dilopo. [01:30:05] And thanks for jumping up on stage [01:30:08] and asking your sibling that question. [01:30:10] And it wasn't even an easy question either. [01:30:12] I can tell you if my sister jumped up on stage [01:30:16] and asked me a tough question like that, I don't know. [01:30:19] I knew he could handle it. [01:30:21] Yeah. [01:30:21] Well, thank you, Tomas. [01:30:23] No, thank you. [01:30:24] There is a question in the chat that I do want to address. [01:30:28] The question comes from Zenet. [01:30:31] It's given your incredible career journey, [01:30:37] is there anything you would have done differently? [01:30:39] And it's a two-part question. [01:30:42] The second part is, and what are you currently reading? [01:30:45] So the first question, given your incredible career journey, [01:30:48] is there anything you would have done differently? [01:30:51] Wow. [01:30:52] That's a really good question. [01:30:53] So what, sorry, who asked that question? [01:30:57] It must be a really smart person, not Russell. [01:31:00] It was Zenet. [01:31:03] That's a Russell kind of question. [01:31:04] Russell asked very, very smart questions like that. [01:31:09] So who did? [01:31:11] Oh, it was Zenet from the audience. [01:31:14] She's in the audience. [01:31:15] She has kids in the background making a lot of noise. [01:31:19] Thank you for that amazing question. [01:31:22] So two things. [01:31:24] As a cybersecurity practitioner, I probably would have, [01:31:30] I felt like my first five years in the industry were wasted. [01:31:38] There was a lot of missed opportunities, right? [01:31:41] And the reason why there were those missed opportunities [01:31:43] is because I was very technical. [01:31:45] I think I alluded to this earlier on. [01:31:47] I would have probably started from approaching it [01:31:50] from a business standpoint than a technical standpoint. [01:31:53] So I feel like I've spent 20 years trying to undo the damage. [01:31:59] Literally, we created this industry. [01:32:01] This industry didn't exist, [01:32:04] at least not to this level of maturity or lack of it, [01:32:07] 25 years ago. [01:32:09] And I feel like the first five years, [01:32:11] we kind of preached the technology or techie message. [01:32:14] I would love to go back and undo that. [01:32:17] And I've been trying to do that for the past 20 years. [01:32:21] Hindsight, 2020. [01:32:22] But obviously, that's something I would do differently. [01:32:26] The other one, because I wear two hats. [01:32:28] I'm both a cybersecurity practitioner, [01:32:30] cybersecurity leader, as well as an entrepreneur. [01:32:35] As an entrepreneur, I've learned that the key to success [01:32:39] is, I think I call it my three Ts now. [01:32:46] You have to be, the timing has to be right for your idea. [01:32:49] So I typically come up with ideas five to 10 years early. [01:32:54] That's a blessing, but it's also a curse, [01:32:56] unless you're very, very patient and you've got a lot of money to burn. [01:33:01] So I'm usually five to 10 years early. [01:33:03] I think about solving future problems. [01:33:05] Our industry is very, let's solve problems now that we have. [01:33:10] People are willing to pay for, I call them now problems. [01:33:14] So hindsight 2020, I probably should have been a little bit more focused on current problems. [01:33:19] So the timing is really, you know, my timing should have been later rather than sooner. [01:33:27] The other thing is having a team around you. [01:33:30] So some of you are VC-sos. [01:33:32] If you want to grow a lifestyle business as a VC-so, great. [01:33:37] You know, a retirement business. [01:33:38] But if you're trying to grow the business, you need a team around you. [01:33:42] It took me 20 years to realize that. [01:33:46] So having the right team. [01:33:48] And I think the third one, there's another T and I can't remember what it is, [01:33:54] but it's a very important T. [01:33:57] Timing and talent. [01:33:59] So having the right timing, having the right team and having the right talent. [01:34:03] So talent for me is find people that think differently from you. [01:34:10] Find people that are not going to just say yes to everything you say because they think you know it all. [01:34:17] Or you act like you know it all. [01:34:21] Yeah. [01:34:22] So I would say that would be my two things I would have done differently. [01:34:32] That's great. [01:34:32] And then the second part of that question was, what are you reading currently? [01:34:37] Oh, wow. [01:34:38] Oh, gosh. [01:34:38] So confession, I don't read a lot. [01:34:42] I read, well, I listen a lot. [01:34:44] I watch podcasts. [01:34:46] I listen to podcasts. [01:34:47] They wouldn't listen to mine after I've spoken. [01:34:51] But I'm reading a book now called Scaling. [01:34:54] I think it's called Scaling or Scale. [01:34:55] That tells you how often I'm back. [01:34:57] It's actually an audio book. [01:34:58] So I actually read by listening. [01:35:02] I learned by listening. [01:35:04] So I'm reading, I think it's on Audible. [01:35:08] Yeah, I think it's called Scaling. [01:35:10] I'm just pulling it up so I can scale. [01:35:12] So it's called Scale. [01:35:14] And it's a book by, I can give you the name of the author if you want to ping me offline. [01:35:18] But it's a really good book. [01:35:20] It's about six hours to listen to it on Audible. [01:35:25] But actually, I've been listening to it off and on for a couple of months. [01:35:29] And it has a lot of very practical applications on the things that you could actually do to scale a business successfully. [01:35:41] Awesome. [01:35:42] Is that Scale by Jeffrey West? [01:35:45] Is that the author? [01:35:45] It's actually Jeff Hoffman and David Finkel. [01:35:51] Yeah, they're both serial entrepreneurs. [01:35:54] So Jeff Hoffman and David Finkel. [01:35:57] Yeah, it's called Scale. [01:35:59] Trying to pull it up as I'm talking to you. [01:36:01] Hopefully it doesn't disconnect. [01:36:04] The Clubhouse app. [01:36:05] Yeah. [01:36:06] Yeah, seven proven principles to grow your business and get your life back. [01:36:10] Awesome. [01:36:11] So it was actually recommended by a trusted advisor, a friend of ours. [01:36:18] They said, it looks like you're not getting your life back. [01:36:22] You need to get your life back. [01:36:23] Because it seems like you're spending 80% of your time on business. [01:36:29] And, you know, I mean, I work easily 12 to 16-hour days, right? [01:36:35] So from the time I wake up to the time I go to bed around midnight, I mean, I may take one hour breaks here and there, you know, my three-mile walk. [01:36:44] But I'm constantly working. [01:36:45] I'm constantly, you know, doing something on the business or the nonprofit side. [01:36:50] So this is really helping. [01:36:52] And it also helps you to determine how best to identify your team and to kind of serve your team. [01:36:59] Because I'm finding that you bring in a team, you actually have to empower them to be successful. [01:37:05] You don't just say, hey, now you guys are here. [01:37:07] I'm going to dump everything on you. [01:37:10] It doesn't work that way. [01:37:11] I was hoping I can do that, but it doesn't work that way. [01:37:17] Awesome. [01:37:18] Great tips and great book. [01:37:21] Sounds like a great book, at least. [01:37:22] So, look, this brings us, actually, this brings us nearly to closing out our session. [01:37:30] So we're going to start to wrap up now. [01:37:33] I will pass it over to the moderators. [01:37:35] Moderators, any final questions for Ty before we kind of conclude today? [01:37:44] Yeah, I'd say no questions for me. [01:37:47] But, Ty, thanks for spending the last hour and a half with us. [01:37:49] You bring back warm memories. [01:37:50] It's a pleasure to know you, to have worked with you in the past. [01:37:54] And who knows, maybe we'll get to do something again in the future. [01:37:57] And, again, I just really appreciate you sharing with Candor some critical issues that many of us are facing, have faced, or perhaps will face in the future. [01:38:07] Now, Russell, thanks for the opportunity. [01:38:09] Anything, I mean, you know you can never ask me to do anything that I wouldn't do just because you're just such an awesome leader. [01:38:18] So thanks for giving me the opportunity. [01:38:21] And thanks, everyone, for, you know, putting up with my storytelling. [01:38:25] Your storytelling was amazing. [01:38:30] And I really appreciate a couple of tidbits I'm walking away with as a good reminder. [01:38:36] You know, fail fast and fail forward. [01:38:40] And then I really liked your timing, team and talent. [01:38:44] I think that's so important as well. [01:38:45] So definitely things I'll be thinking about over the next couple of days. [01:38:49] Thank you again. [01:38:50] You're very welcome, Katie. [01:38:53] Thank you. [01:38:53] Thanks for the opportunity. [01:39:02] Okay. [01:39:03] All right. [01:39:03] Look, before we sort of wrap up, and I'm not going to ask my final question because you actually answered my final question in responding to the other question earlier. [01:39:13] So that is good, but I might just put a little spin on it since actually Ryan's not in the audience to quote Ryan and her question. [01:39:27] If you had any advice for your future self, what would it be? [01:39:31] And why? [01:39:34] Wow. [01:39:36] Wow. [01:39:37] Okay. [01:39:38] So future self would be 15 years time. [01:39:42] Did I get all the things on my strategic life plan accomplished? [01:39:48] It's a 15 year plan. [01:39:50] And what does the next 15 years look like? [01:39:55] That would be the question I'll be asking my future self if we go out, you know, 15 years. [01:40:03] Awesome. [01:40:04] Good stuff. [01:40:05] Good stuff. [01:40:08] Look, it's been a pleasure to have you on, Ty. [01:40:12] Thank you for taking the time out of your busy schedule to sit with us and share your origin story, your background, your journey. [01:40:20] A lot of good tips and what we call gems, if you will. [01:40:26] Great sort of moments that we can take away and help us continue to enrich and grow in our own journey. [01:40:35] Which is always very useful. [01:40:37] So we do appreciate that. [01:40:40] For those in the audience, again, we do this every single Wednesday between 8 p.m. Eastern time and 9.30 p.m. Eastern time. [01:40:47] So we appreciate you all sort of hanging in there with us and listening in and joining in on the chat or popping up on stage and asking you a question. [01:40:58] We ask you to join us back next week. [01:41:00] We'll have Dave Glenn in the hot seat next week on June 1st. [01:41:04] So we'll start the month off with a little bit of Q&A with Dave and getting to learn him and his particular journey as we continue on our weekly fireside chat. [01:41:17] So without further ado, thank you, Ty. [01:41:21] Ty, again, I'll leave the final words for you to bring us home. [01:41:26] Thank you so much, Tomas, for the opportunity. [01:41:30] I just really wanted to say that I wasn't sure if everybody in the audience is in cybersecurity or aspiring. [01:41:37] But I really wanted to say that we we as a community have a lot of influence and we we have a lot of impact. [01:41:48] And when I say influence, sometimes we don't know how much influence we have. [01:41:53] We need to use it. [01:41:55] We should never be afraid of using that influence, especially if it's to make a positive impact. [01:42:01] Right. So I just really wanted to challenge everyone like in 50 years time, this industry, if it exists, would probably be completely different in 100 years time. [01:42:13] I'm sure none of us would be around. Right. [01:42:16] I don't know who's the youngest in the audience. [01:42:19] We have the opportunity to shape what this industry looks like over the next 50. [01:42:24] You know, it's going to look like in 50 or 100 years time. [01:42:28] So I really want to challenge you all to really think about how you can play a more active role. [01:42:34] I'm sure you're already doing that, but there's always more to be done. [01:42:38] But always have at the back of your mind. [01:42:41] Burnout is a real thing. [01:42:43] And so always find that balance. [01:42:45] You know, walk, you know, walk to live. [01:42:49] Don't live to work. [01:42:53] Exactly. And to answer your question, the youngest one in the audience is me. [01:42:57] Yes, it is me. [01:42:58] So I will be here in 50 years time to let you all know how it's how it's come along. [01:43:04] Awesome. [01:43:04] But no, that is great advice, Ty. [01:43:07] Definitely. [01:43:10] You just said it. [01:43:12] Definitely don't live to work, work to live. [01:43:18] Yes. [01:43:19] I don't know why. [01:43:20] Why am I having a mental breakdown right now? [01:43:22] But that is great advice. [01:43:24] And, you know, take care of yourself. [01:43:26] Right. [01:43:26] Definitely take care of yourself because I agree with you. [01:43:29] Burnout is a real thing and it does impact us. [01:43:33] And, you know, sometimes you won't even recognize that it's happening to you and you're burning yourself out. [01:43:39] So please take care of yourself, everybody. [01:43:41] Have a good rest of your week. [01:43:43] And we'll be back here next week. [01:43:45] See you, everybody. [01:43:46] Bye, all. [01:43:47] Bye, everyone. [01:43:47] Thank you. [01:43:49] Have a great rest of your week and Memorial Day. [01:43:53] You too. [01:43:53] Bye-bye.