Fireside Chat w/Tom Brennan

[00:00:00] What's up John? Hey Evan, what's going on? Hey guys, we're gonna start it in about seven [00:00:16] minutes or so. Just trying to get the room set up. Let's see. [00:00:22] Trying to get the room set up. If you guys want to pop up on stage and say hi or chat [00:00:32] with me while we, just before we get started, feel free to raise your hand. I'll bring you [00:00:36] up. Just trying to get the room set up. What's a row. Should have an interesting discussion [00:00:46] this evening with Tom. We can, I hope everybody's doing all right. It's the middle of the week. [00:00:55] Middle of the week. Hey, somebody's on stage with me. I can't see who it is just yet. I'm [00:01:05] not sure what it is. But who is that? I know who that is. Oh, it sounds like Russell. Hey, [00:01:14] Tomas. Hey, how's it going? Oh, you know me living the dream. When I click on your face [00:01:24] or your whatever your, your, yeah, I guess your face. It pops open a little thing now. It [00:01:30] says, okay, wave at Russell. Wave at Russell to get the conversation started. Okay. I'm [00:01:35] waiting at you right now. So there we go. I don't know what that does. If that will pull [00:01:40] us into a different room or not. Interesting. Hey Tom, how's it going? Hello. Hello. Thanks [00:01:47] for the invite. Yeah. No, no problem at all. We'll get started in about five minutes or so, [00:01:52] Tom. Just trying to get the, trying to get the room set up. Trying to get some links here [00:01:59] so that people know, I mean, I know people know who you are, but for the, just in case [00:02:05] on the off chance, somebody's new to cybersecurity and doesn't know who Tom Vernon is, they can [00:02:11] click on your face. What do I send the $20? Somebody wants to pop up on stage and chat with [00:02:20] us for a little bit. Who is this? Who is this? Oh no, they left. I don't know who they are. [00:02:26] So how's it going? Going well, man. I actually thought I may have run into you last night. [00:02:35] You were over at the United Way with the Giants and the Jets guys, and I was hoping to see you [00:02:41] pop in. Oh, wow. Yeah. No, I didn't. I don't even think I knew about that event, but that's [00:02:47] awesome. Yeah. They do that, the grid iron gallery every year. Yeah. It's all about, [00:02:54] you know, activities that are sort of helping the underprivileged, but United Way does a great [00:02:59] job and it was cool hanging out with like George Fant and Travis Tarani last night and, you [00:03:06] know, hearing these guys talk about what's going on in their careers. That is awesome. No, [00:03:11] that is awesome. Glad you were able to do that. Yeah. No, I would have probably like to have [00:03:18] been able to make that. But we've got a big event coming up next week for those who are fanatics [00:03:25] or who are fans. There's a big event happening next week in Las Vegas. Should be fun. Yep. [00:03:31] All the hackers stay away, but all the fans, please attend and please tune in. Okay. [00:03:40] Okay. It is about three minutes before we get started. So why don't I just start setting the [00:03:45] stage? The rest of the moderators will get, will join us. I'm sure we've got the back channel going. [00:03:52] If you're new to our weekly fireside chat, we do this every Wednesday. We run from about 8 PM [00:03:59] Eastern time until about 9.30 PM Eastern time or so. We usually ask our guests questions for about 30 [00:04:07] to 45 minutes. And then we'll open up for the audience to raise your hand and we can bring you up on stage [00:04:12] and you can ask a question of our guests. This week, we're joined by Tom Brennan. And I'll let Tom sort of [00:04:18] introduce himself in a minute. In case there are anybody, there is anybody in the room who doesn't know who [00:04:24] Tom is. You'll be, well, I don't want to spoil it, but we're in for a treat this evening. I can just tell you that much. [00:04:30] Just very quick ground rules. Let's have fun. Let's have a good evening. Let's have a good time this [00:04:39] evening. I should say this is the middle of the week. This is our, I'll call it our stress reliever, our time [00:04:44] to relax and really just have a conversation, have a conversation and get to know our guests a little bit [00:04:49] more on a different level, different level along the lines of getting to know them and their journey. [00:04:55] So if you are a vendor in the audience or even on stage, which we do have folks who do provide services. [00:05:03] But if you are in the audience and you do want to pop up on stage and sell us on your product, we ask that you [00:05:09] don't do that today. We ask that you keep this as a conversation really focused on, you know, learning about [00:05:15] our guests, learning about, you know, things that could help you continue to further grow in your career or even sell to [00:05:23] folks that are on the stage. So use that type of an comment. And it applies for maybe about, maybe just me. [00:05:34] But our comments and opinions are our own and do not represent our prior or present employer. [00:05:39] So we ask that you keep that in mind and be respectful of that. And then the last thing I'll say, if you are new to our fireside chat, again, we do this every Wednesday. [00:05:47] But if you are relatively new, there's a little greenhouse on the top left of your screen right next to what says fireside chat. [00:05:54] You can click that little greenhouse and join the fireside chat club. You will be able to see who our upcoming guests are and you'll be able to listen to the playback for our prior sessions. [00:06:06] So thank you for tuning in and thank you for taking the time out of your day to spend with us this evening. [00:06:13] So it is almost on time. I'm almost on time. Hey, Lisa Beth, just a quick microphone check for you. [00:06:21] Hey, hey, how are you doing this evening? [00:06:24] Doing all right. Doing all right. Katie, microphone check for you. [00:06:28] Hi, good evening. There she is. Can you hear me now? OK, good. [00:06:34] I hear you loud and clear. And Russell, we've heard you. So I'm just going to go around the room, Tom. [00:06:39] We'll leave you for last. But I'm Tomas Maldonado. [00:06:43] I'm the chief information security officer at the National Football League. [00:06:46] Russell, over to you. Thank you, Tomas. [00:06:49] And as Tomas said earlier, if you don't have this on your calendar as a recurring reminder to be here for fireside chat, you're missing out. [00:06:56] Russell Eubanks, former CISO and CIO for the Atlanta Fed. [00:07:00] Last couple of years, been running my company, Security Ever After, helping folks get their start and get promoted in cyber. [00:07:06] Katie, over to you. Hello. Good evening. [00:07:10] Katie Hanahan. I am a VC. So and also run a cybersecurity program for a MSP local to Chicago. [00:07:19] Over to you, Lisa. That's Lisa Beth. I always do that. I'm so sorry. [00:07:22] Lisa Beth. No worries. [00:07:24] Hi. I'm Lisa Beth. Lintini Walker. [00:07:27] I am the CEO and founder of Lumen Worldwide Endeavors, which is a compliance ethics and corporate governance consulting firm. [00:07:34] I also teach law school in the United States and in Europe. [00:07:38] And I'm an author. And I am just so excited to get to spend the evening with Tom and all of the people on the call tonight. [00:07:45] That is awesome. Thanks, Lisa Beth. Thanks, Katie. Thanks, Russell. Thanks for coming and joining us. [00:07:51] Look, this this guest of ours. [00:07:54] Thanks, again, if you never cross paths with Tom. [00:07:57] You know, shame on you because you should get out more. [00:08:01] No, I'm just playing. Look, if you haven't crossed paths with Tom, you're in for a treat. [00:08:06] I had the pleasure of meeting Tom. I want to say, Tom, during your OWASP days, I think that's probably the prominent time period in my life during my career as I was sort of working at Goldman Sachs around that time period. [00:08:19] And I think you and I sort of crossed paths back then. But you've done a lot more before that and you've done a lot more after that. [00:08:26] So I want to give you the opportunity to sort of introduce yourself. [00:08:30] And then while you're introducing yourself or while you get past your sort of bulk introduction, you know, I usually like to ask our guests about their origin story. [00:08:38] So why don't we why don't you tell us a little bit more about you? Tell us about your origin story. [00:08:44] And first and foremost, I do believe if I'm not mistaken, I should say thank you for your service because I think you were in the military. Was it Marines? Yes. So. [00:08:56] Well, thanks for having me. I really appreciate the invite and I'm honored to be invited. I've listened to your some of your other events and I was always impressed with the guests. [00:09:06] So being asked to be a part of that, you know, definitely a good thing. [00:09:11] So, you know, I'm just an Irish kid from Long Island, right? [00:09:14] Like that's kind of where I grew up, kind of the space I came from, sort of a sort of a lower middle class sort of space. [00:09:20] And today I'm doing a lot in technology and kind of have a couple of things to maybe share. [00:09:26] But, you know, if we go backwards in time, we have to go forward a little bit. Right. [00:09:31] And you can never go back. What's important, I think, today is that, you know, I serve the community today as the executive director of a global nonprofit. [00:09:40] It's an accreditation certification buddy known as CREST. [00:09:44] And CREST provides recognized accreditations for organizations, particularly that are focused on national critical infrastructure. [00:09:51] So, you know, we have a focus around penetration testing, incident response services, threat intelligence and security operation centers. [00:09:59] But really what that means is we accredit the businesses that provide those services to help organizations rapidly work with those qualified organizations. [00:10:09] And certainly what started in 2004 as an effort led by GCHQ, CREST, you know, got off the ground in the United Kingdom, quickly expanded around the world. [00:10:20] And pretty much since 2017, I've been the executive chair and leading that charge here in the United States. [00:10:29] So working from, you know, a bunch of different perspectives from the DOD side to large infrastructure to national critical infrastructure, et cetera, on demonstrating some of the value there. [00:10:40] Like many of us, I wear a couple different hats. [00:10:45] And my other hat that I wear that I actually have the pleasure of being the chief information officer for Mandelbaum Barrett. [00:10:51] It's one of the largest law firms in New Jersey growing nationwide. [00:10:55] And I provide a lot of consultation and technical guidance to the clients as well as the attorneys that are associated with the law firm. [00:11:04] I'm really focused on, you know, business and due process and due care. [00:11:08] So a lot of the things I've been doing over the years, as you mentioned, some of the OWASP stuff, you know, that all plays into the conversation because I think many of us spend a lot of time in the industry. [00:11:19] And, you know, we give back a lot and we try our best to suggest ways forward and then collaborate with peers and others to sort of help sort of evolve the industry. [00:11:30] So I've been doing that for a number of years. [00:11:33] But again, the origin story is pretty simple. [00:11:35] I think I was one of those guys, you know, back in the day that, you know, grandpa came home with a broken televideo CPM machine. [00:11:44] In this case, it was 802H and says, hey, I got this for you. [00:11:48] I don't know what you can do with it. [00:11:49] It doesn't work, but I thought you might like it at like 10 years old and then figuring it out and ripping it apart. [00:11:55] I was the guy that would always take apart stuff and figure out how to work and pull chips and just for fun and understand how items actually correspondingly worked to make things work. [00:12:04] Then after getting a second televideo into 2H and figuring out how I can swap parts out, eventually had a working machine. [00:12:12] It was able to play Colossal Cave and learn all about, you know, X, Y, Z, Z, Y and how that process would, you know, zoom me to different parts of the game. [00:12:20] So passionate, like most of us came from a technology background and had fun. [00:12:26] And, you know, the era I think of where I came from is, you know, in the 80s. [00:12:31] So what did everybody go do in 83 that has a tech affiliation? [00:12:35] Like myself, we went with a bunch of friends and went and saw war games and, you know, sat down and watched that, walked out and sort of joked with my friends and go, wow, that's kind of interesting. [00:12:47] It was kind of a fun thing that some of us were already sort of participating in. [00:12:52] And, you know, tying it back to getting jobs at local computer stores and running bolt and board services on Long Island and associating with our 2600 local groups, which of course is based out of Middle Island, Long Island. [00:13:06] So a very good synergy to that community, you know, at its core, being able to, you know, sit down and understand back in the day how Pascal worked and how the process would go for automation of workflows and really having hands on ability to take technical equipment apart and put it back together and understanding the basics and fundamentals. [00:13:27] I think that was core. [00:13:28] And that's how I learned how to work. [00:13:30] Like many of us, you know, coming up through that age, you know, high school was a fun time, but some of us got distracted. [00:13:37] I was one of those distracted young youths that focused on probably areas I shouldn't have and really spent a lot of time learning about how things worked in interesting ways. [00:13:46] And at the time I was suggested strongly that I might want to choose a different path. [00:13:53] And I luckily chose the United States Marine Corps as a way to sort of get out of Dodge, if you will. [00:13:59] And when I sort of landed on those yellow footprints and sort of walked through that experience, there was an ethics change. [00:14:05] I think there was a monumental change of purpose and being and mission and trying to align, you know, that mischievous kid that was growing up in, you know, Long Island to a kind of a different thing. [00:14:17] And, you know, that sort of was a very big milestone, I think, in my life of sort of changing and applying some of the skill set that I had grown to love about being very inquisitive and challenging authority and not accepting the status quo. [00:14:33] Um, and then putting it into a different set of shoes. [00:14:36] Um, unlike some of these days that would join, you know, the air force or the Navy, or even now the space force, uh, and look forward to, you know, technology. [00:14:45] You know, I raised my hand and signed up to be a grunt and wanted to be infantry. [00:14:49] You know, that's what I wanted to do. [00:14:50] I wanted to follow in, you know, dad's footsteps and, and, and, you know, do that fantasy legacy thing. [00:14:55] And it was interesting and learning about that, uh, was, you know, sort of another passion. [00:15:00] Um, having a career and doing, uh, some stuff in the military always was eyeopening as to, you know, how things worked and, and, and how large logistical problems could be solved. [00:15:10] If people actually took the time to plan things out a little bit. [00:15:15] Um, and as they say, you know, you plan at 80% and once the bullets start flying or things go crazy, you know, you figure the rest out along the way. [00:15:23] So being able to adapt, overcome with integrity, with a team and understanding sort of what that is again, put core functions, I think, into what I am today. [00:15:35] Uh, being able to, you know, sort of grow in that area. [00:15:39] So that's sort of, you know, begins the process, right? [00:15:42] You, you take technical skill, you get mentored, you learn about the way things perhaps should work and, uh, you're off. [00:15:50] Uh, and, and quickly going from there into, um, experiences that are, you know, sometimes scarring for life. [00:15:57] Uh, and in my case, I was, um, you know, I got hurt. [00:16:01] I broke my back. [00:16:02] Uh, and I, uh, got out of the Marine Corps in 91. [00:16:05] And I, uh, after a long time, I came home and I thought about what I was going to do and how I was going to do it and what skills I really had to transition. [00:16:14] And, you know, how does a vet come back to civilian life and that respect and understand, well, what job skills do I actually have now being a quote unquote, a disabled vet and, uh, you know, walking with a limp and having, you know, problems with a limp. [00:16:26] Like, you know, problems with my back and that sort of a thing. [00:16:28] Right. [00:16:29] So you go back to what, you know, and you take the opportunity to then combine those talents. [00:16:34] You take the technical aspects and you apply it. [00:16:38] In my case, I was picked up by a private investigator, uh, who wanted me to assist him with some, some work he was doing. [00:16:45] And, uh, it was kind of cool cause it allowed me to sit behind a desk a little bit and, and work closely with the technical aspects that he needed to understand. [00:16:55] To tie that to the physical side of identification and processing and investigations and hunting down people that were causing disruption in crime. [00:17:05] So now you had somebody that, you know, was kind of weaponized, right? [00:17:09] I had a technical background. [00:17:10] I now had a physical background and I was in a weird state. [00:17:13] So learning from investigators, incident responders, people that were doing this sort of work was, was really, really important. [00:17:21] Um, because it's again, fundamentally helped, uh, what, what I wanted to, you know, kind of aspire to do, which was, um, you know, stay active in that space. [00:17:30] But again, I had to sort of adapt and overcome. [00:17:32] And then it. [00:17:34] And then it. [00:17:35] Change quickly because I was asked to build a database or build a system that we could track certain things. [00:17:42] And there we go. [00:17:43] You know, talk about Fox pro and, and putting a database together and demonstrating how we can quickly build some tools to help the business piece. [00:17:51] And it went very much back to the roots of building technology and building software, and then trying to make it usable in a business functional space. [00:17:59] Uh, and you know, that again, very foundational, right? [00:18:02] So you start to see where, um, things may line up because you come out of that world, uh, and you're, and you get involved in other technical areas. [00:18:10] Um, some of the folks that were part of, uh, I guess, asking me to be part of this, I had worked with in a past life at a, a long island company known as a Paul. [00:18:21] And I went there. [00:18:22] Um, I was kind of recruited there cause they wanted some other assistance. [00:18:27] And one of the first things I did at Paul corporation was again, went back to the tactical side and moved away from a little bit of the investigation stuff, but spend time helping them using Lotus notes of all things, build a public facing system that their clients could do lookups for filtration and be able to processing orders and being able to conduct that. [00:18:49] And that was, you know, a long time ago, you know, that was in, you know, 94, 95, you know, it was the early days of, uh, the explosiveness that, that, that happened. [00:18:58] So, you know, pre, um, uh, you know, in that time, uh, being able to quickly again, adapt and use that technical sense and to kind of then open up a can of worms because everything I then started to touch became lead, follow, get out of the way. [00:19:13] Meaning lead a team, help build out an effort, help the business on its mission. [00:19:19] Uh, and then, you know, sort of push the distractions out of the way to accomplish the goal and be able to, you know, do a sit rep report and feed that back to the business. [00:19:27] And, you know, let people sort of have that, that closed loop as to how these things work. [00:19:32] Um, then I had an opportunity to move to New Jersey and, uh, uh, I joined ADP and, uh, came to New Jersey for the first time. [00:19:42] Um, it was very interesting, uh, spacey would be from long Island Jersey was a whole different world, believe it or not. [00:19:48] It's a quite a ride from where I grew up in long Island. [00:19:51] Um, but landing out here, you know, looking at another organization and understanding what the mission was, uh, a gentleman named by the name of Russ Fraden, uh, who was a senior gentleman at, uh, ADP old Navy guy. [00:20:03] We had a very, we had a very clear discussion, what he needed and how he needed to get it done. [00:20:08] And I was here to help him in a group called major accounts. [00:20:11] And again, building out technology, um, being able to access the data center and work in an environment that was. [00:20:17] Um, very useful and very dynamic. [00:20:20] Uh, and again, always having that conversation of build a system that can be resilient, build a system that has integrity checks and reviews, be able to sort of drive these messages through. [00:20:31] So again, constantly being involved in that space, um, was useful, but then there was not a lot of guidance. [00:20:36] Cause in the nineties, late nineties, there really wasn't a good resource of material out there. [00:20:42] And, you know, you started seeing some chatter for some East coast guys and some West coast guys. [00:20:46] And people collaborating. [00:20:47] And again, remember what I said earlier, I used to run a bunch of Bolton boards and was always in the collaborative sort of space and reaching out to people and that sort of thing. [00:20:56] But organizations like WASC and OWASP and others sort of materialize. [00:21:02] Uh, these were again, nothing more than people collaborating and putting together a place for resources. [00:21:08] And I found it extremely interesting because trying to find data around new areas and innovation really wasn't available. [00:21:15] Um, so you, you had to look to the people, um, that were doing the work, uh, that were willing to share, uh, in your communities, in your small circles, because there really wasn't great guidance there. [00:21:26] Right. [00:21:27] There really wasn't great even books and materials, quite frankly, in some cases. [00:21:31] So trying to be innovative and being on the cutting edge starts with, you know, how do I scale? [00:21:37] How do I build systems? [00:21:38] How do we make this happen? [00:21:39] And again, learning that and being involved in lots of, uh, great efforts, uh, again, recruited out of ADP. [00:21:46] Uh, I was asked to be a participant in a young startup company known as D tech online. [00:21:53] And some of you may know that as a financial services company that you may have traded stocks with, cause we were the first, uh, on wall street to kick in the doors of wall street and do online transactional trading and running that organization's infrastructure. [00:22:06] I read the inside part of the business. [00:22:08] Uh, the front end transactional piece was run by another gentleman. [00:22:11] Uh, but at the end of the day, the, the effort around the teamwork. [00:22:15] And the teamwork that it took to sort of change wall street was amazing. [00:22:20] Uh, and working with a young, passionate group of people that would think nothing of running, you know, 20 hour days, sleeping in the data center in downtown Manhattan, uh, and just getting the job done because it was fun and it was exciting. [00:22:34] And yeah, there was money there, but that was a plus we would have done it anyway, in some cases, right? [00:22:39] Um, just getting those exposures. [00:22:41] Um, just getting those. [00:22:42] So there's a lot of backstory that then starts to spawn from that space. [00:22:45] Cause day tech, as many of you know, had a, had a good short run organization was, you know, then acquired, uh, and many of us moved on. [00:22:54] Um, I moved on as well. [00:22:56] And one of the things I did after taking some time off and trying myself was starting a little consultancy and building some software and selling some widgets and writing some open source stuff and getting involved in a couple of different organizations like InfraGard and OWASP and, and others more formally. [00:23:13] And then taking more of a volunteer leadership role because I had the time I had the flexibility. [00:23:20] Um, and at that point I had the funding to be able to spend a lot of time working with these organizations to sort of make things better. [00:23:28] And why? [00:23:29] Um, because I found a lot of peers, um, that were not only local, but global that, you know, were very communicative. [00:23:36] Um, we were very much in the same boat. [00:23:38] People were trying to learn things. [00:23:40] People were trying to collaborate and share and build a good community. [00:23:43] And you start to meet some of the people in multiple different circles. [00:23:48] Uh, and you start to realize, I think that, you know, there's a lot of common ground, right? [00:23:52] A lot of common ground, right? [00:23:53] A lot of common ground. [00:23:54] You find folks that, you know, uh, may have had a similar background and, you know, may have, you know, turned to a different model, uh, or have simply just tried to make the best they can, uh, in, you know, in the world. [00:24:04] Um, picking pet projects was always fun for me. [00:24:08] Uh, and still is, um, I like to pick really interesting things to focus on and they may not be financially, um, rewarding, but there are sometimes nothing more than, um, personally rewarding. [00:24:20] And I think those are the most important. [00:24:22] Um, I have a child with special needs, so I always look for opportunities to contribute back to those communities. [00:24:29] And one of the ones I thought was always interesting was like echo skeletons, uh, being able to help people with MS, you know, utilize robotics to go ahead and, you know, make the gates change. [00:24:39] So children can, you know, walk faster or be able to be assisted. [00:24:43] Um, I think there's lots of cool underserved markets out there. [00:24:48] Um, and that's, you know, where I like to spend some of my time. [00:24:51] I mentioned before we started this call that even like last night, we were at the United way and had a chance to meet some of the, the jets and giants guys that were there as part of, uh, you know, get there giving back and just hearing stories and hearing the demonstration of gratitude. [00:25:05] And really what that means in the space is super important. [00:25:08] Um, at least for me, um, again, there's lots of tech discussions. [00:25:13] There's lots of penetration type discussions and certain response type discussions that I've been a part of. [00:25:18] Some of them have been, uh, uh, amazingly interesting to, to watch unfold. [00:25:23] Uh, sometimes we get real lucky and we find evidence or information that leads us to, uh, an individual that, you know, commits the crime and we're sort of unmasking who's behind the keyboard. [00:25:32] And that's becomes fun. [00:25:33] Um, but at the same time, um, it's a, it's a technical hard space, right? [00:25:38] We, we enjoy what we do and then helping, um, organizations or businesses or just people, uh, I think is really where I spent a lot of my time. [00:25:48] So, so it's kind of a long opening, but that sort of primes the pump, I think, for some of the more recent things that I've, that I've worked on. [00:25:54] Tomas. [00:25:55] Wow. [00:25:56] So much, so much there, Tom, so much data impact and, and thank you. [00:26:02] So, so first of all, thank you for sharing. [00:26:04] Uh, thank you for sharing all of that backstory. [00:26:07] Um, it's, it's good to see, it's good to hear, uh, all of the activities that you've been involved in. [00:26:14] And, you know, you, you're very much missing mission driven, uh, community oriented and giving back. [00:26:20] So, so that's, uh, um, you know, always a positive thing when you, when you, when you can spend time, recognize where you came from and never lose sight of where you came from to, to really help other folks as well, which is, which is always great. [00:26:34] Um, I'm going to pass. [00:26:37] I do. [00:26:38] I did see, uh, Steven and David joined us. [00:26:40] Uh, Steven David, I'll give you guys a, a, a, a little bit more time to sort of warm up and then you can do an intro, but I'll pass it over to, to, to Russell. [00:26:47] If you've just joined us as a weekly fireside chat, I do see somebody with a little party hat. [00:26:51] So, uh, thanks for joining us. [00:26:53] Uh, welcome to clubhouse. [00:26:54] Uh, that little party or celebration that means is your first week. [00:26:57] Uh, and if you did raise your hand, we'll, we'll, uh, open up for questions in about, uh, 15 and 20 minutes or so. [00:27:04] So just hang tight for, for a little bit. [00:27:06] You can put your question in the, in the chat if you want to, if you don't want to jump up on stage. [00:27:10] So Russell, over to you. [00:27:12] Thanks Tomas and Tom, thanks for your service to our country, uh, as a Marine. [00:27:15] That's amazing. [00:27:16] And as you were talking, uh, so many things came back to mind. [00:27:20] Watching war games, my first programming language back in high school was Pascal. [00:27:25] And, and I looked in my email, Tom, and 2011 was my, I thought, how, how long ago did I start getting emails? [00:27:31] And I still see someone about the OWASP summit back in 2011. [00:27:35] It's just a, it brought back just a flood of memories and just an amazing career. [00:27:40] Like what Tomas said just a moment ago. [00:27:42] Question for you. [00:27:43] My first, first question for you is with your role now as CIO, how do you balance the, you know, knowing, [00:27:49] and doing work in security and then thinking with your CIO head, and then maybe talking with customers, like you said, [00:27:57] how do you effectively kind of pivot from one role to another given the responsibilities that you have, as well as the, the, the very awesome career you've had, particularly in cyber. [00:28:08] So I think I'd answer that like this. [00:28:13] Yes. [00:28:14] Um, the law firm of, uh, Mandelbaum Barrett has been around for 90 years. [00:28:19] Uh, and the CEO of the law firm is a gentleman named William Barrett. [00:28:23] Um, as his name is part of the model here, right? [00:28:26] Uh, the other gentleman is, uh, Barry Mandelbaum, um, who has been around for a long, you know, long number of years. [00:28:33] And his dad was the predecessor. [00:28:34] So, you know, firm has been around for a long time. [00:28:36] Um, about 20 years ago, uh, you know, I became friends with bill, um, unrelated to law firm stuff. [00:28:45] Uh, and my wife and his wife are friendly and we had a, you know, a sort of a relationship there that has sort of built over a friendship over 20 years. [00:28:53] And there was an opportunity, uh, when he reached out to me and said, Hey, I'm really looking for someone to help guide us and to, you know, sort of be that guy. [00:29:00] We, you know, we have a lot of issues and, you know, client issues and technical issues. [00:29:05] And can you help us? [00:29:06] Uh, and I said, well, yeah, I can certainly help you. [00:29:09] You know, you want me to come in and have a cup of coffee and talk? [00:29:11] No problem. [00:29:12] Happy to, you know, mix business with, you know, friendship, no problem. [00:29:14] But, you know, these are separate things. [00:29:16] And he goes, no, no, no, I'm looking for you to join the team. [00:29:19] So long story short, I looked at the opportunity and it really gave me a chance to, as I joke with Bill, say semi-retire. [00:29:25] Um, because being able to work with a law firm that has a very complex environment, you know, they always represent 35,000 clients, et cetera. [00:29:34] Um, but the point is it's a small firm. [00:29:37] It's, you know, 200 people. [00:29:39] So to me, that's a small business, right? [00:29:41] So looking at what you can do with technology, looking at how you can spend money, looking at how you can do secure configuration, looking at how you can do good process. [00:29:48] In a small firm, I don't care that I used to be able and work for, you know, organizations that have, you know, many, many, many thousands of people. [00:29:57] Um, the, the applying that to a small business gives me the opportunity to spend less time, if you will, with the organization hands-on more time coaching some of the attorneys on some of the critical matters that they're working on. [00:30:11] And, and breach issues and et cetera, on behalf of the client. [00:30:15] So that becomes more of a, a conversational time that I'm enjoying that part of the business. [00:30:20] Um, it doesn't kill me on the labor time to, to work on the day to day. [00:30:25] And I have a great team, a great team of guys, uh, and providers, uh, that are associated with the firm that, you know, I can help sort of lead. [00:30:32] So we have a great team in a small environment. [00:30:35] We do great things. [00:30:36] And quite honestly, we've transformed that company over the last couple of years to be what it is today. [00:30:41] And I would hope that, uh, many of the, uh, the staff, uh, and, and the lawyers would agree that the place is in a much better position than it is, you know, was a couple of years ago. [00:30:50] Um, so I don't know if the answer is your question directly, but the time gives me more time these days for things I care about professionally, such as crest, uh, such as still working on OWASP projects, which is still working on, uh, activities with the center for internet security, still working on work with CISA and DOD, still doing things that I enjoy to do. [00:31:12] Um, and that's sort of, I almost call it extracurricular, right? [00:31:15] Like I'm, I'm working in those capacities to assist and help, uh, and I'm tying it back to some real world activities that I do on a day to day basis. [00:31:23] Does that make sense? [00:31:25] It does. [00:31:26] I love that extracurricular kind of that label for the extra things that you'd like to stay involved in. [00:31:32] That's awesome. [00:31:33] Thank you so much. [00:31:34] Katie over to you. [00:31:35] Yeah. [00:31:36] Thank you. [00:31:37] Hi, Tom. [00:31:38] It's so good to see you. [00:31:39] Um, we've, I think we've been in a number of rooms together. [00:31:42] Um, we've been in a number of rooms together over the last year or so. [00:31:44] And, um, I think you found your, the right place because you mentioned a few times and what I've noticed about you and the rooms that we've been in is you are just so open and you're so collaborative. [00:31:53] Um, and it's something I've really appreciated about, um, being a fly on the wall in some of the rooms that you've been in, um, and being a moderator, I think in some as well with you. [00:32:01] Um, so you said something really at the beginning, um, about, and thank you for your service, by the way, cause I'm about to mention something you said you learned. [00:32:08] Um, the adapt and overcome with integrity piece. [00:32:12] Um, the adapt and overcome with integrity piece. [00:32:14] I love, um, that you mentioned that, uh, at the very beginning of the conversation and it flowed very naturally into the rest of your journey and the things that you're doing every day in our industry. [00:32:23] our industry. I'm really interested in understanding from you is particularly [00:32:27] since you've been able to find so many ways to have an outlet for the skill set [00:32:33] that you've developed over your career in both the Marine Corps and in the [00:32:37] cybersecurity space. What advice do you have for folks you know like me who are [00:32:42] now kind of mid-career looking for ways to give back to the you know to the you [00:32:49] know society in general but don't necessarily know what to do. Some you know [00:32:53] for me I volunteer a little bit of time with a legal aid clinic where I can [00:32:58] volunteer some cybersecurity you know services and stuff like that but beyond [00:33:01] that I would love to know from you since you're so in tune with that you know what [00:33:06] are some other ways for those of us in the room to be able to give back to the [00:33:10] broader community? So my opinion is that there's if you like if you if you if you [00:33:18] are fond of higher education and you want to see the next generation come out [00:33:22] of you know universities and and higher education then it's natural to assist [00:33:28] with the schools in your area. Now luckily I'm in you know I'm right outside New York [00:33:33] City so I'm an advisor for New York University and NJIT and County College [00:33:38] of Morris and St. John's like these are great people that are on these advisory [00:33:43] teams many of them from industry many of them have you know got the bumps and [00:33:47] bruises to advise a university and really what we're advising on is what you know [00:33:51] the syllabus and trying to help make sure that it stays relevant to what industry [00:33:57] is looking for and where tech is going and that sort of is useful so giving back [00:34:02] at that level is always cool. In addition to that there's even local trade schools in [00:34:09] my area here in Denville, New Jersey there's a technical school that you know is [00:34:14] geared for 9th through 12th and it's it's a it's a like a very unique organization or [00:34:20] unique sort of a school but again helping that out at that level and even going there [00:34:25] and speaking a friend of mine and I went and we did a course on using Arduino board and [00:34:31] you know showing kids how to do it and then turning the tables and having them work with [00:34:36] us and on different small sub projects all of a sudden now we're building drones and now [00:34:40] everybody's having fun and it becomes more of an activity and you know as a father I look [00:34:45] back to some of my kids and my my son I'll use Jack as the example you know my son six [00:34:51] foot eight 265 pounds kids a football player is huge but he has no tech interest it just isn't [00:34:57] his thing and that's cool because I understand the other side as well but it's almost like you [00:35:03] can help out in different areas and find commonality with kids younger people that are looking to part [00:35:11] partake or even peers that want to learn something and to me that's sort of the fun part it's not it's [00:35:16] sort of fun to continue to be collaborative and not doing it because I get paid for it right like it's like [00:35:22] hey I want to go do this thing and I'm interested in hacking the canvas on my car why because I'm [00:35:27] interested in understanding how it works and then I'm going to reach out to key people in the industry [00:35:31] and say hey you know is there is there some tips and tricks I can learn here and many of them will [00:35:34] smirk and say here read this tech article here read this thing I wrote five years ago that is still [00:35:39] important today so to back to your question the universities are a great place to participate many [00:35:47] of them that are in like the NSA Center of Excellences do a lot of collegiate type assessment work so if you [00:35:53] want to help them with their red team or help them with their blue team that's fine but more importantly [00:35:57] if you just want to help the some of the students that are there it's always good to be a guest [00:36:01] speaker from industry or to to give some of the you know again give some some things back in that [00:36:07] respect so in conclusion the schools I think are our core because it kind of also gives you a little [00:36:13] of energy I always like leaving those sessions because it's like you know 30 people that are there [00:36:18] to learn something and if you can contribute to the conversation it's awesome yeah that's amazing [00:36:24] yeah I actually read that about you earlier that you are on some advisory things with with higher ed [00:36:30] and you mentioned something before I pass it over to Lisa Beth just one quick question just because [00:36:35] I'm curious so when you go in and you're advising on a syllabus what are the things that you're saying [00:36:40] that maybe you know they're not really part of the curriculum and you're saying you know this is a [00:36:45] this is actually a little bit more pertinent now what should you know what do you think that if I were [00:36:49] to go volunteer at a local institution here what are the things that you're suggesting that they add [00:36:54] to their syllabus and the places that you're advising yeah so so part of it I think is is taking your [00:37:00] real world experiences that you see in your discipline and you know you mentioned before you know some [00:37:06] of the IR work or some of the compliance work or audit work things that are real and be able to sit down [00:37:12] with the university and say let's let's talk about you know what your syllabus is here and most of them are doing [00:37:17] you know quarterly reviews and quarterly measurement right because it's very much a lot of the schools [00:37:22] are very well organized so looking at the core of their syllabus and questioning it quite frankly and [00:37:30] saying why do you guys do this like why are we still teaching this particular area and and that usually [00:37:36] prompts a few people in the room to go well that's what we've always done and the answer is well that [00:37:40] things change right we would agree that you know perhaps we might want to look at you know some some [00:37:44] efforts that are going to help uh you know students get jobs and depending on what level of school it [00:37:49] is and what type of program it is it could be as simple as suggesting hey you guys should really be [00:37:53] putting things like PowerShell into your core component for learning so that people are understanding [00:37:59] that this is becoming a main opportunity for people to do administration from or hey you know are we [00:38:05] talking about solidarity are there are people interested in writing code but we you have nothing in your [00:38:10] context that talks about you know the blockchain and how that operates and and where you want students [00:38:14] to go to or is it more of just a a basic introductory class and you really want to have sound fundamentals [00:38:21] on ports and services and you want to make sure that people realize that there's you know issues that [00:38:27] happen with clean you know plain text protocols so it depends on where we go but giving that experience [00:38:33] I think is helpful and a lot of the universities are hungry for content and they want industry people [00:38:38] to participate so if you can hyper connect and even bring some of your colleagues into the conversation [00:38:44] and say hey I've talked to several uh you know large organizations I took a independent poll these are the 10 [00:38:51] questions I asked here's the result it came back from you know 50 people all of a sudden you start having [00:38:56] a little bit of um you know effort for the university and they're very appreciative of that and it really helps [00:39:02] them build that program um I really appreciate that yeah the the tactical guidance so now I know that [00:39:07] when Tomas comes into town to visit the bears that he and I can go in together to a local uh institution [00:39:15] maybe even a city of Chicago college because I went two semesters alma alma mater whoop whoop city of [00:39:20] Chicago colleges um so it's good to know that Tomas is committed to that on this uh this call it's great [00:39:26] and with that um I actually Tomas I saw you flash your mic I assumed you wanted to do a quick room [00:39:30] room reset thanks Tom for that I really appreciated that insight thanks absolutely Katie when I when [00:39:37] I head over to Chicago I would definitely not let you know no I'm just playing and that would be that [00:39:42] would actually be interesting if I if we could carve that out uh time wise and make that work that would [00:39:47] actually be interesting I'd welcome that um but go ahead lisa beth why don't you uh do a room reset and [00:39:52] you can ask your question oh I love a good room reset so thank you everyone for joining us tonight we are the [00:39:59] fireside chat and tonight we're talking with Tom uh if you haven't been here before take a look up at [00:40:06] the top of your screen you'll see fireside chat in the little greenhouse if you click on the greenhouse [00:40:10] you'll get more information about how you can follow and be part of the ongoing fireside chats [00:40:17] and get visibility to all the people who um make this a reality every single week so um without further [00:40:26] ado a Tom I'm completely excited to hear about you as the wife of a retired although I guess he never [00:40:34] does retire uh marine corps gunnery sergeant I know how much you've been through and I just thank you for [00:40:41] your service um and everything that you've done um one of the things that I wanted to ask you though [00:40:47] is as you start thinking about this core skills that we need to start cultivating and making sure exist [00:40:57] in the workforce of the future what are you seeing and is it different than when we all grew up [00:41:07] yeah um thanks for the question I I think that it still comes down to passion um I I think that we can [00:41:13] take technical areas that we believe are deficient and areas that we can't find resources for and train [00:41:21] to what good looks like and train to models and reference architectures and guidance I think that's [00:41:30] not a big lift but I think it's really much focused on trying to drive labor as to where you need labor to [00:41:36] go um if you're looking for innovation that's sort of a little bit different right so I'm always [00:41:42] challenged with the problem that people say oh there's there's not enough people in the security [00:41:47] supply chain to you know get all the organizations that they need assistance with and it becomes sort [00:41:52] of a balance it becomes a balance of maybe how the approach is taking place I happen to believe that [00:41:59] organizations should be um you know working with qualified organizations if they're dealing with [00:42:05] critical infrastructure you know the example that I use all the time becomes um you know hey if I had [00:42:10] god forbid a severe medical problem I wouldn't go to my neighbor's house to have them work on me in [00:42:16] there in their garage right I would go to an accredited doctor that you know has met their [00:42:21] qualifications and I would hope he's you know good you know a good doctor of that particular element [00:42:26] that I'm dealing with so why is it any different in this new industry and I say new industry of cyber [00:42:32] where that we are still looking for assistance from 15 year old kids to figure out why we can't print [00:42:39] at the end of the day we should be looking in my opinion for accreditation in certain components [00:42:44] and when you look at critical services it's important to not only accredit in my opinion [00:42:50] the organizations that are doing the work but also the people now not just a paper cert on the wall [00:42:56] but being able to have competency in those particular skills and that's where it gets interesting because you [00:43:01] know there's lots of great organizations out there that um uh do you know training uh and we encourage [00:43:08] that and then you have the deficiency of the um the problem of people's access to this training and the [00:43:15] ability to say well is it a training business or are you giving training away to the masses so if we look [00:43:20] at some of the higher education organizations back to that again you know you'll see some [00:43:26] you'll see a couple college colleges that are giving their training away you'll see some great [00:43:31] components and it seems that everybody these days has a youtube video on something so I think that if [00:43:37] you're really hungry for the knowledge you can find it and that's the inquisitive issue we have a critical [00:43:42] thinking is trying to find things that people want to do um I took a recent um group of kids and we're [00:43:51] talking about technology and they all were asking about how to get involved and I showed them how the [00:43:56] bug bounty program works and I explained to them how they can get paid for doing their schooling and [00:44:01] training and several members of this group about three months later you know started pulling down 500 [00:44:06] 000 5 000 bounties after learning things like you know using burt proxy to look for [00:44:12] issues within web applications so teaching kids skills but practically applying it to say hey you [00:44:18] know if you want to be you know if you think this hacker thing is a cool title okay great but let's [00:44:23] talk about what you're really doing right you're doing quality assurance you're doing application [00:44:27] testing you're doing bug finding but then turn it into something interesting the same way that I think [00:44:31] that if somebody wanted to learn mechanics I'd put them in a hot rod shop and show them how to to build [00:44:37] cool fast cars like you gotta you know teach to the person that is trying to acquire the skills does [00:44:43] that make sense it totally does and um you know I appreciate you providing your perspectives on this [00:44:52] I will turn it over to Stephen [00:44:58] thank you Lisa uh hey Tom I think this is the first time you and I are on a panel or anything like that [00:45:03] together so uh I did join a little later uh so just intros on my end I'm Stephen Garcia the vice [00:45:09] president of cyber security over at Fandle um first of all thank you for your service thank you for your [00:45:13] time uh like my sensei likes to remind me there's no such thing as an ex-marine so once a marine always a [00:45:18] marine um yeah so look I got like two questions but I'll keep this down to to one for now and maybe if [00:45:25] we got time later we'll come around for the first one um you know like I'm super appreciative that people [00:45:30] like you are really helping out with school and academia um I one of the questions I had for you [00:45:36] is um what we've seen is that there's still I I consider like a lack of overall executive [00:45:44] understanding from the new class of folks coming in right and so when we do interviews for for new [00:45:49] talent right we'll say things like um like if it's a security engineer position or something hey you know [00:45:54] build up this defense for us like paint us a picture of what what defense would look like for any [00:46:00] average network in the cloud or something and the answers that we're looking for are generally the [00:46:04] answers that we don't get and when we do it's like somebody we're like okay here's the person that we [00:46:08] need and the answers that we're looking for is really don't just jump into the diagramming it's it's [00:46:14] ask us things like what's the budget I'm working with look like uh how was that budget decided you [00:46:19] know what's the value of the asset we're protecting in other words a a more balanced risk understanding of [00:46:26] why we're doing what we do um how do you think we should uh as people in the field be tackling that [00:46:34] um so some friends at MITRE um I'll use bob martin as the the source because bob would probably [00:46:41] appreciate this um have always been very focused on helping people with reference architectures and [00:46:50] speaking to the conversation of building a house right you and I both know if we go into the planning [00:46:55] board or the zoning board of our local town there needs to be stamped documents and engineered plans [00:47:01] and agreeable electricity and how that would be you know routed we we don't see a lot of reference [00:47:06] architectures uh in our industry we don't see a lot of that we have a lot of um fear-mongering around [00:47:12] you know problems and solutions that you can buy for you know money uh but we see very little suggestions [00:47:18] around core architecture configurations and setups um when you can demonstrate at the low level um [00:47:26] basic configurations that are solid and understanding of the technology and how it gets applied it goes a [00:47:33] long way um and for those that you know are familiar with you know running pf sense boxes or want to go [00:47:39] ahead and do you know chains and bsd and be able to limit access you know to and from destination rules and [00:47:46] fine-tuning their firewalls and filtering out noise my point is when you go technically deep and can [00:47:52] make those things happen it sort of helps people understand that you don't need a lot of bells and [00:47:57] whistles to get things off the ground maybe you want to add that for maturity of your program and you [00:48:02] want to scale it and make it more um uh you know more useful if you're going to have a large operation of [00:48:08] people to run it for you but you have to understand the basics and i think that we've done a really bad [00:48:13] job we continue to do a bad job around reference architectures and that could be here's a reference [00:48:19] architecture for a uh critical infrastructure that does water supply systems at a municipality level [00:48:26] and here's how they should be configuring their environments yes everyone's going to be different [00:48:31] but having some reference architecture is important i mean even this week the sec came out and you know [00:48:37] they're saying they're going to propose rules on cyber security risk management strategy and governance [00:48:42] and that's all cool and all but i think many people would agree here that compliance is not security [00:48:48] compliance is like the bare minimum right like people are saying you should at least be doing this [00:48:53] and most mature organizations that take this stuff seriously have been doing it for years it's the [00:48:59] organizations that haven't funded it or haven't put the people there or the people don't have the chops [00:49:03] to do the job that it becomes sort of litigious and that's where the lawyers get involved so remember what i said [00:49:09] before as i work with a law firm and as i watch that side of the business i'm always sort of scratching [00:49:15] my head saying wow that's that's interesting and you know the first thing they always say lawyers in [00:49:20] general um especially during litigation is you know can you demonstrate for us you know what commercially [00:49:25] reasonable security practices your company follows and what have you done over the period of this [00:49:30] time to demonstrate that functionality like that becomes me it becomes meaningful and quite honestly at the [00:49:36] end of the day that's the end result right litigation and legal and a jury of your peers that can't get [00:49:42] out of jury duty if they're going to make the decision as to who pays millions of dollars in fines there [00:49:48] should be some reference architecture should be some meaningful approach to security if you look at the [00:49:53] uk um we have this thing called cyber essentials uh in the uk uh and that really focuses around sort of [00:49:59] like the the rules of the road right like the basics to connect your business to the internet and and [00:50:04] there needs to go through that process here in the states we don't have that and um you know that [00:50:09] was again it gives you some perspective like with oas just as a side note watching that organization [00:50:16] and helping to grow to 35 000 people in 118 countries around the world it gave me perspective it gave me [00:50:22] perspective going around the world and being a part of those communities and seeing what was different in [00:50:27] cultures and people and then coming back and saying wow you know there's some really cool stuff going [00:50:31] down in brazil of how they're doing it for their model and there's some cool stuff in the uk and then you [00:50:36] look around here in the us and we have this this uh this ego that we're perhaps you know we think we're [00:50:41] the best in the world but look around the states has a very interesting model in a capitalist market right [00:50:46] the government is not involved in critical infrastructure in some cases why because they're private companies [00:50:51] so it becomes an interesting dynamic as to who's protecting who and how can you help them all the guidance we see [00:50:56] coming out of cissa right now it shields up as a fantastic effort jennifer eastley and that team [00:51:01] has done a great job but it's almost like saying you know hey here's a resource you know here's a [00:51:06] website with a bunch of great stuff um good luck and it's difficult i think for organizations to digest [00:51:12] that and really apply it in a meaningful way and in a speedy way [00:51:15] thank you tom appreciate that um in the interest of time dave cass we're gonna pass it over to you [00:51:29] thanks yeah sorry about that i was having unlock or unmute problems uh david cass uh any opinion i [00:51:35] express is my own it doesn't represent that of my uh current employer or past employer uh i am the global [00:51:41] cso and uscto for for gsr we are a crypto market maker so i went from being a federal appointee regulator [00:51:49] to nice and relaxed looking like tomas's picture on the beach there to back to being a cso so tomas you [00:51:55] look entirely too relaxed in that picture to be a cso um so really you know tom i definitely appreciate [00:52:01] everything you know that you've done and all your contributions to industry um yeah what can we be [00:52:08] doing i guess better as leaders to kind of bring people into the security fold from that perspective [00:52:13] and show them that there are so many different career paths i think you know that you know that [00:52:19] that's always a challenge when somebody goes to school for their you know masters or in finance or [00:52:24] things like that they have a good understanding of what they can do but you know security is such a [00:52:28] diverse space you know how do we do a better job of showing people that you know there are all kinds [00:52:34] of careers in this space yeah um again opinion right i i think that now everyone's in cyber security [00:52:43] right everyone's in security and it's kind of like the statement that was made before that um you know [00:52:48] everyone's in sales right meaning you have to communicate the message and be able to get it out [00:52:53] the door for people to understand it and digest it at the same time you're responsible for your personal [00:52:58] security and you should be and there's folks that just won't be right there's other folks that perhaps [00:53:04] that's not their main focus so they don't care but let's look at it from a physical side right you [00:53:09] lose your wallet in the parking lot do you have a photocopy of all the stuff that's in there credit [00:53:13] cards and port and id information etc do you do disaster recovery backup right the analogy i think [00:53:19] still play a big part you know you'll leave your house and you know all your windows and doors locked [00:53:24] you know all your ports and services secure are you running outdated access components that are [00:53:28] easy to be circumvented um you know trying to teach people the basics is public service and public [00:53:34] awareness because that's going to raise the bar a little bit and then organizations that are running [00:53:39] a business they're there to serve their shareholders or serve the purposes of their their owners if [00:53:44] they're privately held right so there's motivations that are going to be there so i i think that there's [00:53:51] plenty of opportunity but everyone that touches tech they have to be part of the security experience [00:53:58] because whether you're configuring a new iot device for your home network or you're spending time [00:54:03] developing software that's going to be used in you know pacemakers um there has to be a component of [00:54:09] logging controlling understanding what the process is going to be and even getting into you know what [00:54:15] happens when things go sideways what is the p-cert process right how do we identify a problem in a [00:54:20] third-party component how do we understand when we take that and do a hard fork of the code because we have to [00:54:28] or we have to have deal with you know existing licensing issues because we're incorporating somebody [00:54:33] else's open source code into our product or our widget which potentially could be you know libel issue [00:54:39] so all of that stuff is interesting and you mentioned in your space particularly in the crypto space [00:54:45] there's a opportunity there's another opportunity there in that evolving market to have you know [00:54:50] correlation right the fsi sec people that are involved in the banking space don't really embrace a lot of the [00:54:57] folks in the crypto space uh at this time and i would like to see it actually become you know a [00:55:02] recognized sort of group of people and it is not i'm not saying it's not but it's the conversation that [00:55:08] it's separate and different where there's still some of the same needs and only because of relationships and [00:55:14] long-term people working together are there some you know are there a lot of you know individual [00:55:20] groups of people that are collaborating and trying to you know drive things forward um there's just a lot to be done [00:55:27] and again through universities kind of gets the messaging out good government standards good reference [00:55:32] architectures and secure products are kind of important and if you're an isv producing software and you're not [00:55:39] looking at let's say the safe code materials that are helping you build and and drive standardized software models [00:55:46] um you could be held what you'd be held liable so it depends on what end of the spectrum you're on are you building [00:55:52] product building code or are you consuming it and there's different different pieces for each one of those those those parties [00:56:03] oh thanks now i was having unmute issues there yeah i'm just trying to think so you know i guess part of you know as you mentioned i guess staying in this career is kind of staying [00:56:14] you know at the you know in front of all the educational background and everything else so how do you kind of foster that continuous learning and you know life balance aspect of it and i'll hand it over to jennifer after this [00:56:28] so so personally i'm i'm i'm a little obsessive compulsive as it pertains to some of the technology spaces and [00:56:36] i constantly sort of time manage and put time on the calendar to you know block an hour out and go research that [00:56:42] thing and i typically do it over personally i typically do it over 30 sessions so depending on [00:56:48] what it is that i want to learn about like i might break out 30 sessions and put 30 sessions on my [00:56:54] calendar over a period of three months and every quarter if there's something that's on my topic list [00:56:59] that i want to sort of focus on you know start off with a cursory review a little bit of a research and [00:57:04] treat it just the same way so whether i'm bug hunting on a particular product or i'm trying to learn a new [00:57:10] thing or i'm very interested in a particular situation you know around the world in the news [00:57:15] maybe that's where you you know have to go back to discipline of research and how you come up with [00:57:21] results and how you produce papers and how you go down that from even again an academic approach point [00:57:26] of view of you know what are you trying to learn um and it's a ongoing process i think and if if we all [00:57:34] agree to that piece that we like to be a life learner you know what's your next topic what's you [00:57:40] know what's on your list of things to do and are you really making progress there because you know [00:57:44] the definition of insanity is what doing the same thing over and over again and thinking you're gonna [00:57:48] have a different result so if we're trying to drive ourselves to be better the industry to be better [00:57:55] um we want to be able to pave the way document the process and like i always tell people if you get [00:58:02] hit by a bus tomorrow somebody should be able to pick up the ball and keep going if you're selfish and [00:58:07] don't want to write things down and don't want to document things you're doing the business a disservice [00:58:11] and quite honestly you're not doing anything for your legacy i know at least from the oas community and [00:58:16] safe code and some of the other groups i participated in i like seeing some of the material that was re [00:58:21] that you know that was produced during those errors at those times and watching people go oh yeah i [00:58:27] read the oas testing guide you contributed to that yeah you know and it becomes wow that was a really [00:58:31] important document for me to learn how to hack web applications and be like yeah that was a that was a [00:58:35] good good amount of my time i appreciate that you loved it and you read it so people that are [00:58:40] participating in these things i think are really important so whether you're learning or giving back you [00:58:45] just have to find the time and that's that's the most valuable asset we really have [00:58:51] um thank you and i guess jennifer over over to you okay thank you tom i think i know more about you [00:59:01] from what tom lyon tells me than uh i think you actually this is the most i've ever heard you speak [00:59:06] i think which is awesome i love hearing your backstory um don't try me up so something that caught my um [00:59:11] ear was uh when you were talking about um pulling things apart and playing with toys and [00:59:15] going in certain directions and not toys playing with electronics and then um you said that then you [00:59:20] could go in one direction but you went into the marines um wanted to drill into that a little bit [00:59:25] more was whether i misheard that or whether that is what i heard that that kind of was a direction [00:59:30] you took to to stay on a better path is that what you were implying a little bit of both i i you [00:59:36] know back in those days i mean we're talking the uh early 80s um it was probably good that i um you [00:59:42] know got on a bus and and left long island and uh went into different um a different career [00:59:49] uh i probably wasn't in a good trajectory of uh you know not ending up behind bars so the the goal [00:59:55] there of course was you wanted to realize early on in your career and find mentors that could help you [01:00:01] do things that would be more positive uh and again it wasn't any notorious but it was you know it's [01:00:06] definitely in the cyber realm of you know using technology in a way it really wasn't supposed to be [01:00:11] made and and and just being you know a little nefarious kid at the point my point that i made [01:00:17] was that you make choices and you can stay on those tracks and you can stay on um those those [01:00:23] trains and you get hit by the bus or you can just simply say it's about ethics right like i always [01:00:29] come back to the conversation and say that the difference between the good guy and the bad guy [01:00:33] on the internet isn't so much the technical skill because there's lots of great talent on both sides of [01:00:39] the fence but the fence is called ethics right so what you will do and what i will do may be very [01:00:45] different in context because some people may you know take a dollar uh for uh you know for doing [01:00:51] uh doing something that may be considered unethical and others will you know stand with integrity and [01:00:56] say no i'm not willing to accept that that's that's not okay um and you know i'm gonna put my foot down [01:01:01] and i'm gonna go ahead and not make that happen so i think that becomes super important is for people to [01:01:05] have the ethics and integrity to do the right thing when nobody's looking yeah and i would actually um the [01:01:11] the reason it was curious to me um i agree and also though when we're younger we don't even um [01:01:16] realize that the ethical implications necessarily i mean we might know something's not exactly right but [01:01:21] we don't understand the bigger picture of it and the directions i can send you on and um something that [01:01:25] was uh just to share a little bit was in my life that was valuable was um i was a sea scout in high [01:01:30] school and so if i was not a sea scout in high school that would have um that's what saved me from [01:01:34] going in um kind of a direction that would have been great so i just i appreciate that yeah thank you [01:01:39] yeah and and to build on that even those areas like again under the crest uh flag right we did a lot of [01:01:45] work with uh you know the crime and prevention of youth and spent a lot of time on looking at your [01:01:51] diversity in those areas and produce position papers and produce you know research reports and things that [01:01:57] can be used again by universities or corporations to apply them to their diversity programs and and and [01:02:03] even schools on you know how to you know transform troubled youth right because we would like to have [01:02:09] more people on the on the positive side of making the world a better place perhaps than those that [01:02:13] want to light a fire to it right so we gotta balance it and it's a it's a giant geopolitical issue with [01:02:20] lots of logistics uh and i think if we can all do our best to get along uh you may have different views and [01:02:25] political components but at the end of the day uh i would hope that people want to see uh others you know not not [01:02:32] suffer uh in the world they live in yeah and to your point people don't get a lot of guidance i mean [01:02:37] here's the thing like you you know are your teachers providing it to your parents you know what's your [01:02:40] environment you can't necessarily blame the kids for being unethical and then also honestly i um it would [01:02:46] be interesting to hear you talk about this but in the modern world's um education structure i think [01:02:51] our education is highly outdated and kids are bored as so um it's they're they're doing i mean you know [01:02:56] they're getting into stuff and it's not it's just they can because they're smart they need a challenge [01:02:59] and unfortunately that challenge might send them in a direction that's not great right now and so to [01:03:03] have these opportunities that can um kind of harness that in ways that are good both for society but for [01:03:09] them too that challenge them and teach them and give them that sense of um accomplishment and achievement [01:03:13] etc and i don't know if you're seeing that in the kids you're mentoring um or want to speak to that at [01:03:20] all it's again with you know i just think that i agree with you i think that we need to do better [01:03:27] uh and there's kids of all different calibers and people with different intellects and we have to [01:03:32] sometimes teach at the lowest denominator but more importantly we have to you know try to give people [01:03:37] things that are interesting and it's all about passion uh many people that i've ever hired on [01:03:41] different teams i've worked on and different organizations i've been a part of it's you know i can [01:03:45] i can quickly pick out passion i think pretty quickly whether be running a security conference and who can [01:03:51] participate or you know people that want to do different things it's it's really about you know finding [01:03:56] people that have an energy and passion and and have a smile on their face if they walk around with a [01:04:00] a black cloud over their head quite frankly it becomes an asset and a liability uh you want to [01:04:05] associate with assets and you want to you know put liabilities in arm's length right because they [01:04:11] either have to you know see the good in what they're working on or they're going to bring everybody down [01:04:17] yep thank you it's awesome assets over liabilities like my good friends that earn your [01:04:24] lives i would say uh um ang jennifer thanks for popping up on stage and asking your question [01:04:31] i was uh always grateful to have you participate and add to the to the conversation ang over to you [01:04:39] hey thanks uh katie thanks for the invite up i like how you guys know that if i'm in the room i've [01:04:44] probably got a question um tom it was great to hear you on the last room um and then this room was been [01:04:52] has been incredible so far um the why behind this question uh i've had the honor to teach several [01:05:00] people that are coming into the industry how to um collect and present forensic findings to lawyers [01:05:07] and there's always a um this hurdle that we have to kind of move across together uh where there's a lot [01:05:15] of anxiety and and kind of some intimidation around speaking with lawyers and so um i was hoping for [01:05:23] anyone that's especially anyone that's in the room that's new into cyber or um or has that kind of fear [01:05:28] can you talk a little bit about what your favorite thing about working with lawyers is like what's that [01:05:34] it factor that just makes you excited to work alongside lawyers yeah no um i i will um and i never [01:05:41] thought i would say this actually because you know it's always the the lawyer jokes i think that were funny when i first [01:05:45] started to meet lots of cool lawyers uh but the fun part i think in some of the projects and cases i've [01:05:52] been a part of has been you know if you want to fight for peace work for justice right so helping [01:05:57] lawyers do the lawyer job of defending people and trying to you know find the right as well as to [01:06:03] navigate to the law is very much cyber related meaning you manage the policy if you don't have a [01:06:08] policy you certainly don't have a procedure uh and then as it pertains to your incident response or [01:06:13] forensic work we all should know you know some of the basic principles like you know following octum [01:06:18] razor and looking at approaches to data you let the data tell the story you don't interpret the data [01:06:26] you don't go ahead and report on what you think happened you report on what you find and what's [01:06:31] factual and then a good legal professional will look at the factual information and make his own opinion [01:06:36] based on that and use it in a way that he'll use it or she'll use it for the case to defend who the [01:06:42] client that that person's been retained to client without bias so forensics or doing work with lawyers [01:06:50] i think is very important because their peers in the conversation where i'm providing you with the [01:06:56] evidence to support the the matter and the evidence may bury the client or the evidence may exonerate him [01:07:04] but that's not for me to interpret right i'm here to provide you the data and i think once people have [01:07:08] an understanding as to what lane they swim in it becomes really really easy so i've seen a lot of [01:07:13] great you know lawyers uh look for pieces of information or ask about a particular thing and [01:07:20] my response is well here's what i found and this is the information that's there so we have to look at [01:07:24] what is within scope uh and if you're on the prosecution side you know what's within the warrant or [01:07:30] the subpoena uh that you know is actually being discovered so it's interesting but i i've found it [01:07:36] um technically challenging working with lawyers in particular because a lot of these guys are or and [01:07:41] girls are smart cookies and that that's that's fun um and they many of them don't know how to use [01:07:46] technology at all which makes it even more fun because they're interpreting um you know information [01:07:52] i'm giving them very factual and then they're interpreting the law around that data think of like [01:07:57] the cfa computer for an abuse act it was written so long ago um that you know there's many ways to um to [01:08:05] manipulate that particular issue from a technology perspective i just want to jump back up here [01:08:11] really quickly being a lawyer tom you're giving them like the benefit of the doubt there in a big way [01:08:15] i think lawyers will absolutely manipulate uh things and find you to support it um and especially [01:08:21] prosecutors but um yeah computer fraud and abuse act is what from the 80s and we're still using the [01:08:26] lincoln law from the civil war in a lot of federal contracts but um that was a nice review of lawyers a lot [01:08:32] of people are not that objective or um ethical just saying thanks yeah well i think that comes down [01:08:40] to again um you know it's uh people that you work with uh and uh i've seen you know some righteous [01:08:47] fights uh for various technical issues and claims including human life um and and seeing those type of [01:08:54] projects and the people that you put the effort behind them you know the righteous you know lawyers [01:09:00] uh again it's different industry right but i always like people with passion and the idea is i think [01:09:06] i've found uh many colleagues that that do things with passion which is what i appreciate yeah there's [01:09:12] lots of good there's lots of good lawyers too uh and i know this was your question so i'm going to [01:09:16] try sit back to you but to just remember that um justice is not always done it tends to be what [01:09:20] evidence is in front of them and whoever's the better lawyer can get that better evidence um i'm a technology not a litigator in those areas but um great great descriptor tom [01:09:29] i knew you were gonna hop back up jennifer i was so ready for it um tom i really appreciate it i same as [01:09:39] you sir i see as a challenge and it's always really exciting to um to get to work with new law firms and [01:09:46] just and just figure out the the best way to speak to a different caliber of of forensics so thank you i appreciate [01:09:56] that so much thanks for letting me ask my question yeah thanks thanks for popping up on stage uh cyber [01:10:05] doctor what's going on hey tomas and everyone good evening tom great great discussion that we had here [01:10:14] uh on clubhouse this evening you brought up a good topic that i actually talked about and spoke about [01:10:20] at a conference last week is in the cyber security industry in that comparing it to the medical industry [01:10:28] where you know when you look at nurses you look at doctors there's they're not running around to [01:10:34] is it comptia you know this century or is it sans now right and so uh you know this is something that a [01:10:41] lot of people discuss and you know you hear different things thrown around about gatekeeping but just [01:10:48] curious your thoughts about that that bar right um if you will as relates to cyber security yeah you [01:10:56] can go to whatever institution or just be self-taught i think all those things are important but we are [01:11:02] definitely seeing an issue uh across the board in the industry and i'm just curious on if you think [01:11:10] maybe not in our lifetime but maybe in the future that there could be room for that equivalent like the [01:11:17] medical industry has is the cyber doctor i'm done speaking yeah no great question um so recent [01:11:23] experiences um i think that are unfolding in a quick google for those that are in the defense [01:11:28] industrial base um look for things called you know cmmc uh and the cmmc is sort of coming from a [01:11:35] dod effort because why um you know nist 100 you know 800 171 was a self-attestation that during [01:11:42] federal procurement that you're saying that you're doing the minimum standards to defend the [01:11:46] organization's supply chain and the security of the data and the controls are in place and you [01:11:51] basically sign a document and say yeah of course i'm doing it why wouldn't i do it of course i'm [01:11:55] doing it i want that gazillion dollar contract from the dod but nobody ever like enforced it or looked [01:12:00] at it right and then we start having different supply chain problems and we literally have all [01:12:05] different types of stories but you can surmise that yes people do die because of supply chain problems [01:12:11] and some of these root causes have been traced back to you know things that like i don't know [01:12:16] third-party organizations that build products or parts uh physical parts in some cases you know i've [01:12:21] had the the documents modified and i've had the specs modify which caused you know a failed part in a [01:12:27] helicopter which killed 13 servicemen like all sorts of crazy things that if you dive deep into it [01:12:32] you start going hmm there's something to this supply chain problem right um so again back to cmmc [01:12:38] this effort is really focused around the 600 000 organizations that are in the defense industrial [01:12:43] base that the cmmc effort wants to help ensure that those organizations have gone through appropriate [01:12:50] review and accreditation that they can be providers and suppliers so will anyone ever get it right [01:12:57] probably not but to your point if we're not even looking if we're not even testing if we're not even [01:13:03] doing a spot audit or a spot review to confirm certain controls are in place then how can we ever [01:13:10] really quantify that we're handling the materials in a way that is uh uh handling materials in a way [01:13:19] that's appropriate and again you said different levels and i agree with you when we talk about [01:13:24] you know national critical infrastructure we talk about the 16 different areas of focus i'm not talking [01:13:30] about joe's hamburger joint at the end of the block who takes credit cards yes pci is important and [01:13:35] yes the banks are insured and the banks write off some of those losses and visa mastercard doesn't [01:13:41] want their brand tarnished by mary getting her credit card compromised but that's different right it's a [01:13:46] different space uh if you're looking at more of a supply chain of disrupting a water system or you [01:13:53] know the famous paragu disruption everyone talks about there's lots of these areas but if you live in a [01:13:58] state that even has a publicly um controlled uh effort let's say around power that is a nuclear [01:14:05] regulatory uh governance area um wouldn't you want to have the appropriate testing and controls in place [01:14:13] wouldn't you want the people doing those assessments to have qualifications that they've done it before [01:14:18] and that it's not a you know a push button computer security vulnerability scan that is being produced as [01:14:24] here here you're nice and secure i think you would having you know the people on this call that are [01:14:29] technical because you want to try to assure and give some credibility to what you're saying so the [01:14:35] point is yes we can have people read instructions yes they can be self-taught yes they can graduate up [01:14:41] and get you know hours but that's where it goes back to what i do on you know with with crest if you can [01:14:46] demonstrate that you've had you know 1800 hours of doing penetration testing and red team work and [01:14:52] security operations center where you have a a level that can be met with verification then you can [01:14:58] be awarded an accreditation and you can go ahead and use these different levels to determine where [01:15:03] you are in the stack and if you're dealing with you know airplanes in the sky or satellites or nautical [01:15:09] systems or whatever it may be if they're deemed you know national critical infrastructure um there are [01:15:15] some assurances that people want to make sure that these systems are there should you also have [01:15:20] the random bug bounty or the random guy who finds a problem and be able to responsibly disclose it [01:15:25] absolutely in my opinion but that doesn't take away from having the accredited doctor do doctor stuff [01:15:32] with the accredited person doing high-risk security work but let's go back to what it's all about right [01:15:37] in many cases it's the code in many cases it's a human that does something in a certain way and in [01:15:44] the id they're working in doesn't necessarily pop and tell them hey you didn't go ahead and you [01:15:48] know you didn't go ahead and escape these characters correctly hence this could be a a vulnerability [01:15:53] in the future when somebody wants to go ahead and attack it and do you know sequel injection which [01:15:58] has been around for how many years now about 20 right so the idea is some of these problems repeat [01:16:03] themselves and we have to go back to the core piece if we're talking about software software is buggy [01:16:09] by definition and you know some of these things now run very critical systems so i think there's an [01:16:16] opportunity to up our game and demonstrate what a good supply chain looks like and be a part of that [01:16:22] and as many organizations that contribute to that not just one thanks [01:16:32] awesome stuff awesome stuff if anybody has a question uh feel free to raise your hand we will [01:16:36] bring you up on stage and you can ask you a question of tom we're going to go for another [01:16:40] uh 20 minutes or so so if there's anything that's burning uh in your mind you want to know feel free [01:16:48] jump up and let us know uh tom i'm gonna pivot a little bit okay do you want to ask something oh no [01:16:56] go ahead go ahead katie no no go ahead go ahead well i mean i was gonna do the same you were gonna pivot a [01:17:02] little bit um i was gonna say um you just said a lot of things that would keep me up at night tom um you [01:17:08] really you stretch yourself um i wouldn't say thin it sounds like you're balancing everything really [01:17:12] well but i guess that's my question is how do you um talk about all the things that you talk about know [01:17:18] all the things that you know and also be able to sleep at night what are your outlets i think a lot [01:17:24] of people in our industry right now are struggling with how do we um you know deal with all of these [01:17:30] really complex and um sometimes very mission critical um obstacles every day and then also find an [01:17:37] outlet in our life um you know whether that's meditating or whatever and if you'd be open to [01:17:42] share um kind of what the other part of your life looks like i think that it's important for all of [01:17:46] us to know that someone like you is able how you how are you able to balance all these things and still [01:17:51] sleep at night yeah wow um i'm actually super happy that that question was asked because um in the [01:17:59] information security industry um you know unfortunately some of us find out that colleagues friends [01:18:04] associates we've met at conferences you know kill themselves uh and you know stress and the burden [01:18:12] and not understanding you know how to socially let that communicate and and have the ability to talk [01:18:18] with peers and super important right we've lost a number of people in the last three years that have [01:18:24] been sort of public um in the security space that for unfortunately based on personality defects uh have [01:18:32] decided it would be better for them to um kill themselves quite honestly than to uh to deal with [01:18:39] it a different way but to your point i think that the mental health balance is important to you know [01:18:45] work real hard i i'm a type of person that goes passionate for 15 hours a day but then when i shut it [01:18:52] off i get to a point that i need to go take a two-day break and go do something else and that may be you [01:18:57] know off-roading or that may be you know taking a fishing trip or that may be going to the gun range or [01:19:02] that may be whatever it is that i'm doing with my kids and my family and you need to break away so [01:19:09] i i personally have found a good balance with the people around me that understand that when tom's [01:19:14] doing his thing which was what tom does i'm going to kind of you know work my own hours and when i'm [01:19:19] done i'm done um and sometimes that's not conducive right it's not a nine to five type job it's not a [01:19:24] hey let's go do this for six hours and then go take a lunch break for an hour [01:19:28] yeah this is not the way i operate uh i i'm pretty much you know full on and then when i have the [01:19:34] opportunity to to break out i will um and that doesn't work for a lot of people um so you know [01:19:40] that's that's there but again if you find a team of people that you have different strengths and you [01:19:44] can play off each other if you're part of a team um then you can kind of have that go around and many [01:19:49] of us that are done the incident response type work you know that those type of projects are [01:19:55] unfortunately 24 7 until they're done so you have that mentality then you have the bug bounty and [01:20:00] the qa and the pen test mentality which is similar right which is we're going to get this thing we're [01:20:05] going to get through this problem and we're going to you know get to the the treasure chest but when [01:20:10] those projects are over sometimes you gotta take a break and those are those those those type of [01:20:15] projects if you're just doing operational stuff all day long and you have a very comfortable business [01:20:20] and you have a ton of people and you have a ton of money and you know that's that's that's rare [01:20:25] right there's not a lot of tech people that have the resources and the people and the things that [01:20:30] they need to help run their practice everybody's short-staffed everybody doesn't have all the bells [01:20:34] and whistles that they would like to have nor they have the time of the day so again i go back to the [01:20:40] stress and going back to the mental health piece um and those are very important areas to to make sure [01:20:46] we spend time in and check in with our friends and give them a call and you know do the face-to-face as [01:20:51] possible or even the zoom meetings these days but you know do that physical hey how you doing you [01:20:56] just checking in and making sure that people have uh have lifelines oh yeah thank you so much yeah i [01:21:03] appreciate you um sharing that and yeah it can be just that easy to is to reach out to somebody and [01:21:09] just say hey are you okay so i appreciate that tom yeah thank you for sharing um tomas [01:21:14] thanks kate and uh mental health is a real issue it definitely is a real issue um stephen you had [01:21:26] another question you wanted to ask uh you want to ask it now yeah uh i think we were kind of touching on [01:21:32] it with the sec proposal for um you know security and cyber being part of the board i think the [01:21:41] question for tom would have been what what do you think took so long right because when we talk about [01:21:46] what sarbanes oxley was supposed to do i i think you know i look back at it and laugh a little bit [01:21:51] because what was it like 20 years ago where the thought was like hey maybe we should have people who [01:21:56] are financially literate actually taking a look at what numbers we're putting out there you know to the [01:22:02] street and cyber security has been such a part of that overall risk formula for a while now what do [01:22:08] you think took this long to really get this as even an idea that's circulating around the sec so i think [01:22:16] socks was a little bit different really more tied to enron at the point right when that sort of was the [01:22:20] driving conversation around financial misrepresentation and and and sort of driving that to the bottom line [01:22:27] which caused you know a bunch of cascading effects i do feel that you know cyber these days is a hot [01:22:34] topic although all of us that have been talking have been in the space for quite some time it's mainstream [01:22:40] it's kind of like a news cycle uh in my opinion where that you know data breaches these days are [01:22:46] happening all the time the third largest law firm in new jersey just fell victim to that problem and you know [01:22:52] they got hit really hard and we're going to see how that flows out and it'll become sort of case law [01:22:58] and we're going to see what happens to a large law firm that has had some problems but at the end of [01:23:04] the day and it wasn't ours of course but at the end of the day you start looking at the um the impact [01:23:09] and ramifications but when organizations have a data breach right and now there's federal law that's going [01:23:14] to go into place that's you know reporting within a certain amount of time and every state has [01:23:19] unification about what the approach should should look like but the states are happy to take the [01:23:25] inbound phone call and report the data and be able to determine oh what the fine may be leveled here if [01:23:31] it goes you know to a litigation but what resources and assistance are they actually able to provide to [01:23:36] the organizations so that's kind of the where the gap is right again reference architecture um assistance [01:23:43] this has done a good job over the last year and a half sort of changing some of its efforts to allow [01:23:49] businesses to ask for help as well as to get best practices and some guidance but who's applying [01:23:55] those um so things as things change uh especially the sec piece going back to what you asked about [01:24:01] i also see that to be a focal point around um maybe getting lost think about dfs 500 here in new york [01:24:09] city right that space in particular is organizations 10 million dollars and over doing financial transactions [01:24:15] that have to report into the state as well as have a dpo and have people that are responsible for [01:24:22] those act those actions on behalf of the company i don't think there's anything wrong with somebody [01:24:26] saying who at this company is responsible for cyber security and that person should be reporting to [01:24:32] the ceo that person should be the right-handed man of the ceo that is saying hey here's your risk [01:24:37] but being able to articulate that being able to have the business realize that you're giving good guidance [01:24:43] and having to be based on what having to be based on formal education have be based on a framework [01:24:48] have it be based on a metric have it be based on some product that you're pushing buttons in and [01:24:52] spits out a report providing the data is what the the board is fiduciary responsible for right they have [01:24:58] to have the data to make the decision so i think that that's the sec in this latest attempt is to say [01:25:05] who's in your organization that is that person and what that person says especially in writing if he [01:25:12] puts something in writing about a risk that is up to the organization to digest it and have a response [01:25:17] to it hence goes on the risk registrar and the log of those communications so it gets tricky it really [01:25:22] does but again it's still a people problem right it has to be good communication and solid relationships to [01:25:28] to make them make things move appreciate the insights tom thank you i think it's gonna be very [01:25:35] interesting tom i think uh a lot of cso's uh um who are in different stages of their career maybe some [01:25:44] closer to the uh to the latter part of their careers will see this as a as breathing a little bit new [01:25:49] life into into what they might want to do and add value back back to companies and uh by way of of board [01:25:57] level type roles i also think cso's need to be cautious and ensure that there's you know appropriate [01:26:03] safeguards for for them uh things like dno insurance is going to be uh very key and critical uh because [01:26:10] now you're taking on a lot of personal liability right by being on the board so i think it's an [01:26:16] interesting time i think i think it's a step in a in in a direction that is almost necessary uh because [01:26:25] of everything that's happening uh companies being breached you know almost every just by every single day [01:26:31] um so look i i i see it as a as an opportunity uh for us to add value back back to the community and [01:26:40] and to uh and to find a new way for us to to continue to to carry on the the practicing the [01:26:48] profession so it should be uh should be fun it should be fun few uh months or years if you will as [01:26:54] to how this progresses and and be interesting to watch um all right uh oh i do see uh kevin thanks [01:27:04] for pop oh cyber doctor did you come up on stage again you have another question or were you darren [01:27:09] we got you yeah you guys already got me all right sounds good kevin thanks for uh popping up on stage [01:27:16] anything you want to ask tom sure uh i'd like to introduce myself first my name is kevin martin i'm a [01:27:23] first nations uh uh honk to one yankton sioux from the fort peck reservation montana and i live on the [01:27:30] navajo reservation right now i have a a bit of an experience and a question at the end so let me [01:27:37] describe my bit of experience uh not having a business background or having um formal training [01:27:45] uh i gathered together a team we established a 501c3 with the sole purpose of establishing [01:27:56] sustainable infrastructure on reservations using a nearly zero tax base and a single bid contracting [01:28:05] with the u.s government we were able to assemble about 14 different companies with wonderful products [01:28:11] um it was going pretty good things were going very well until somebody threw serious money at us over [01:28:21] 50 million to start and that's where the problems began um i i learned some valuable lessons and as far [01:28:30] as organization and structure the kind of team members that you want on your team etc i haven't given up on [01:28:35] that dream and certainly those companies are still waiting there ready to go ahead and present to um [01:28:42] the individual reservations creating micro industries in reservations and then eventually linking out past [01:28:48] the reservation boundaries for example you know um electric car stations and electric car manufacturing [01:28:56] on reservations etc so my valuable lesson and i guess the question at the end of the [01:29:03] uh at the end of it was um it was um and and tom you had mentioned that some of your team members um mental [01:29:12] stability uh suffered and well i certainly saw that um of my core team five of us that began two and a half [01:29:24] uh went through divorces real you know we're pumping out 21 hours a day trying to get this thing rolling [01:29:30] and people didn't understand us they didn't understand their purpose etc and uh i haven't given up on that dream [01:29:38] and i'm always thinking you're you know i would like your reflection on this current uh bitcoin [01:29:45] um boom that may be going out and i'm looking at it as whoever is basically um farming or actually [01:29:54] establishing the bitcoin service system eventually is going to have to have a pretty large space for [01:30:01] the amount of power that it's drawing and i'm looking at that as the nexus of the next step and centralizing [01:30:09] bitcoin if it's going to be a future um i would really love to hear your reflection on you know your [01:30:17] take on um if that's an endeavor worth really pursuing and um if if it's clever enough if uh [01:30:25] reservations could service because to me if you're going to have that amount let's just say you're going [01:30:31] to be drawing power from solar or wind or wherever you're going to consume a lot of large amount of [01:30:36] land if you're not already locked into rivers and in this region down here the river's drying up [01:30:41] you know um that's just the way it is so we have to have sustainable systems in order to in order to [01:30:50] suffice for the farm so what would your take be on a potential future for creating such a system [01:30:58] um on on a reservation if it's possible yeah um i appreciate the question um there's a lot to unpack [01:31:07] there um i i think that there's a couple things you mentioned i'd like to dive a little deeper in [01:31:11] to and and maybe the first one i would ask is um why you went with a 501 c3 and not a 501 c6 was there [01:31:17] a reason for that a conscious reason based on what you've said well you know we were offered b core [01:31:25] we were offered a couple platforms and b core and we were like okay that would probably be the direction [01:31:30] to go and uh you know being new to this this entire structure i i just basically i'm a counselor [01:31:38] right i had nothing in this in the way of business at all so you know i can't really fully answer that [01:31:45] question because i really don't know the difference in in uh in any real meaningful way okay that's fair [01:31:51] um so uh in summary i i that's the other thing like with owoc that you heard about which is a 501 c3 [01:31:58] and then safe code and then uh another non-profit and crest in the united states another non-profit so [01:32:05] having the um the understanding of how some of those things work uh is really important but in [01:32:11] summary let's just say the 501 c3 is more like a a church a synagogue you know serving the greater good [01:32:16] and a 501 c6 is more of a business league where it might bring multiple businesses together for the [01:32:21] same purpose to you know drive mission etc but um in in what you're saying though is gets you know deep [01:32:28] very quickly uh the the crypto space and mining and power and that component i'm not your guy uh but [01:32:36] certainly that's where you know hyper connecting to the right people and some of them are in the room [01:32:41] i just noticed um would be a great way to uh make some friends uh but i think there's a lot of opportunity [01:32:48] there uh i think there's a lot of opportunity for businesses to look at that um uh currency model that's [01:32:56] been involving right since 2008 2009 um and it's not going away anytime soon um but i don't know that [01:33:04] i'd be the best person to speak to the the technical components of the uh the power uh and uh capitalizing [01:33:11] on that in in your region uh but i would say uh that sounds like one component of your overall piece [01:33:18] i would be interested though you said you got 50 million dollars in funding was that a grant into you [01:33:23] guys to do your mission or was that raised in a different way um we had private investor we met [01:33:30] with him um i'll i can't disclose but basically a billionaire um that was his minimum invest his [01:33:36] minimum investment and i you know the beautiful part of it is that when we were all got when we all got [01:33:45] together for our first initial meeting um what was said was we have gathered here because we are spiritual [01:33:52] people and that that was the leading thing that the glue that held us all together was even though [01:34:00] we were different denominations and we're different uh parties uh political parties that was a very strong [01:34:08] start and i i think that that was the right way to start personally well well i i definitely think [01:34:14] that regardless of you know the the the the effort or what it sounds like in your voice you there's [01:34:19] there's something there that's about mission and purpose and and helping um those are always [01:34:25] welcomed and i'd love to take that offline and learn more about what you're doing and see how [01:34:29] um you know i might be with the connect you to some people that could help you uh or uh contribute [01:34:34] in that way again that's one of those areas i mentioned before that's something i look at and go [01:34:38] oh well let's look at you know 30 sessions on figuring out what that's doing and and learn learn learn [01:34:43] then execute because it becomes you know another passion right which is trying to help change the [01:34:49] world uh especially in your region or uh to help to help those that need need that assistance well [01:34:55] it'd be much appreciated and if i were to do something again you know we had a scoping meeting [01:35:00] with tom chi who was google's lead tech and he invented google glass etc and the caliber of people that i [01:35:08] would like to bring to the second scoping meeting is uh would be have to have to be very carefully [01:35:15] thought out and i would i appreciate the offer and i certainly will be message you and uh thank you very [01:35:20] much for your insight yeah cool thanks thanks for the question um so so adding back to um the cyber [01:35:30] piece i think that might also invoke other questions i think is that the convergence i think we haven't [01:35:35] really touched that yet the convergence of physical security electronic security right i think many of [01:35:40] us would agree that's happened right and and now we've crossed over where that you know if i'm gonna [01:35:46] do things in manhattan like just don't think about the recent shooting um was anyone surprised when the [01:35:52] public news report was that the camera systems were not working in the subways so they had a more [01:35:58] difficult time to identify the assailant was anyone surprised that you know technology wasn't working that [01:36:05] could have aided and abetted or assisted uh with identification uh quicker um i was uh if you're [01:36:12] going to you know use technology as a red teamer as a assailant with a guy with no ethics perhaps you're [01:36:19] going to attack that thing and i don't mean that situation in europe but i mean the next thing you're [01:36:24] you're going to blind the organization first right you're going to take out their ability to see you're [01:36:29] going to take out their ability to have remote guards or remote monitoring you're going to have a [01:36:33] blended threat you're going to have physical people you know storm the storm the building if you will or [01:36:39] access the location so what i draw on is again experiences of doing red team work and doing [01:36:46] critical infrastructure testing and when you put those scenarios and tabletop exercises together for [01:36:51] your businesses um those are the things that i think now are very interesting right active shooter [01:36:56] conversations even though that's far and few uh it should still be very much in in your conversation [01:37:03] my opinion because many of your uh staff members uh you know think about this stuff and they wonder [01:37:09] you know how can they be safe and what would happen god forbid somebody walked into their building with [01:37:14] uh you know with a chip on their shoulder and a gun in their pocket does that make sense so we got to [01:37:19] look at these things in context so you know having a policy is nice having a procedure is great going [01:37:25] through testing and training exercises is is good because most of us are going to fight the way we train and if we [01:37:31] train the way we're going to fight um then we're going to be more resilient [01:37:38] all right i i i'm not going to disagree with that um i i completely agree with you tom um [01:37:48] man sorry the the day is getting to me let's just put it that way it's a it's been a bit of a long day but [01:37:56] look um i've had a really good conversation or really i heard i've heard a really good conversation [01:38:02] and i've i appreciate you sort of taking the time out of your day to answer our questions and even [01:38:07] entertain this this discussion that we've been having for the past hour and a half um i'll open [01:38:12] up to the moderators any any other questions uh if not i'll ask tom uh my typical final question [01:38:18] i'm just going to say a final thought if i could real quick just tom thank you so much for being [01:38:23] here tonight and um it does go by really fast uh for me when uh there's a person on the the stage that [01:38:30] answers questions and goes in directions that i would never have expected and i really appreciate [01:38:35] your transparency tonight and spending so much time with us thank you yeah thanks for the invite [01:38:40] um right if not all right so tom i usually like asking this this question um and and it's probably [01:38:52] going to pivot a little bit but if you had one piece of advice for the younger tom what would it be and why [01:38:59] um i think at this point don't do anything different um i think stay committed to the effort um surround [01:39:17] yourself with people that run towards bullets because those are the people you want to be by your side [01:39:22] um and do your best to um do the right thing when no one's looking i think those are some really [01:39:28] important characteristics that i hope to instill on my kids to make sure that they see that every day [01:39:34] and they you know pick up um you know where dad leaves off in some cases [01:39:41] it's good advice solid solid advice still nobody wants to say buy google i don't know why that i don't [01:39:48] know i would tell my younger self buy some google stock um but listen it is it is uh close to the [01:39:55] well it is 9 33 p.m eastern time and uh i i did say we would sort of try to conclude at about 9 30 [01:40:03] so i want to keep keep to time and i also want to just very very quickly plug uh next week next week [01:40:10] uh come back next week we do this every wednesday between 8 p.m and 9 30 p.m eastern time next week [01:40:16] we've got ryan rosado joining us in the hot seat so come back next week um but this evening has been [01:40:22] fantastic uh it's been a really good conversation uh if you joined us late you can hear the playback [01:40:29] in about maybe 10 minutes or so when it when it becomes available and i guarantee you don't want to [01:40:34] uh you don't want to miss hearing the playback because it's been a really great conversation [01:40:38] uh there's so much in this in this evening's conversation unpack and we could probably talk [01:40:43] for another few hours uh but again i want to be very respectful of everybody's time uh because we [01:40:48] do take up a lot of your time during the week so moderators any final words before i leave it to [01:40:54] tom to bring us home man my mods are quiet this evening i'd say tom thanks so much for spending [01:41:03] the evening with us what you've done is inspiring both in the past and uh shoulders which we get to [01:41:09] stand upon as well as inspiring for us to keep at the good work that you were doing so again thanks for [01:41:14] your time this evening and thanks for all you've done for all of us well uh thank you very much and [01:41:20] i guess from a clubhouse side you know if we if we land the plane i would say that uh um it's it's [01:41:25] really a matter of doing more things like this and collaboration and and the face-to-face stuff is [01:41:30] important um you know people are usually very accessible or could be very accessible sometimes on [01:41:35] purpose um i fall into that camp of being on purpose so if there's anything i can do to help or [01:41:41] uh any organization that um you know is looking for input especially non-profits or organizations [01:41:47] that have a rightful mission you know i'm here to help and that's uh all i can ask [01:41:54] awesome awesome awesome awesome uh all right tom if if you want to say anything else i'll leave you [01:42:02] with the final final word um but it's been a pleasure my friend i really appreciate you i really appreciate [01:42:09] everything you've done uh for not only uh indirectly for me in my career by being involved in leading [01:42:16] owas uh and everything that i've been able to take advantage of uh learning from you and learning from [01:42:23] people that you've put in front of me by way of different organizations that you've been a part of so [01:42:27] i i sincerely appreciate that and i appreciate you for for uh for giving so much of your time um so i'll [01:42:35] leave you with the final word and you can bring us home yeah um we're good again thank you um again [01:42:41] things like rsa black hat defcon those of uh uh our our stomping grounds look forward to catching up [01:42:46] with people for uh face-to-face or uh a quick pint uh but at the end of the day um collaboration is is [01:42:53] really where it needs to stay at and people need to be approachable sounds good thank you everybody [01:42:59] have a good rest of your week uh we'll see you back next wednesday 8 00 p.m eastern time don't be late [01:43:05] cheers bye everyone thanks everybody