Fireside Chat w/Tom Ryan, Sr. solutions Architect & Advisor

[00:00:00] Hey, how's it going, man? [00:00:24] Doing all right. [00:00:27] Doing okay. [00:00:30] When are you heading back to LA? [00:00:33] LA? [00:00:34] Friday. [00:00:35] Oh, nice. [00:00:36] Yeah. [00:00:37] Russell, how's it going? [00:00:42] Good evening, Russell. [00:00:48] Thomas, Hussain. [00:00:50] Hey, I'm living the dream. [00:00:51] How are y'all doing this evening? [00:00:53] I'm doing okay. [00:00:55] Awesome, awesome. [00:00:58] I think Tom is just wrapping up. [00:01:02] He's got a room going. [00:01:04] I think he's wrapping that up and he'll be joining us shortly, I believe. [00:01:08] Yeah, I saw that. [00:01:10] He's been active the last couple of days that I've noticed. [00:01:13] So, can't wait for him to spend some time with us this evening. [00:01:17] Yeah, absolutely. [00:01:18] Absolutely. [00:01:19] I'm just trying to add some topic words here. [00:01:26] You know, I think in the town hall for Clubhouse on Sunday for iOS in two weeks, maybe a week and a half now, they're going to do that thing where you can pre-stage all your stuff before you go live on iOS. [00:01:40] Android 10 for a while, but whatever they call that, I'm like, oh, that'd be really nice to have it all set ready to go when you click go. [00:01:47] So, that would be very useful because then I don't have to look, well, be like I am now, which is trying to plug away. [00:01:57] It's the cast. [00:01:58] I get it. [00:01:59] David Cass is doing this. [00:02:00] What's going on, guys? [00:02:01] Hey there. [00:02:02] What's it going? [00:02:03] We got the room going. [00:02:04] Hey, Katie. [00:02:05] Hey, I just popped in from the other room that Tom Ryan is in. [00:02:10] Yeah. [00:02:11] So, I might actually pop back in there just to remind everybody that he has somewhere to be. [00:02:20] Yeah, I will. [00:02:21] It's okay. [00:02:22] Yeah, give me one second. [00:02:23] I'll be right back. [00:02:24] All right. [00:02:25] That is okay. [00:02:30] Thanks, everybody who's in the audience joining us this evening. [00:02:34] We'll get started promptly at around 8 p.m. Eastern time or as soon as Tom joins us. [00:02:42] Yeah. [00:02:43] He is popular on Clubhouse. [00:02:46] If you're not in any of his other rooms, he does do quite a few rooms throughout the week. [00:02:51] So, if you have the time, you should join in. [00:02:54] Great conversations. [00:02:55] I actually did not make it this evening. [00:02:57] It's been a long day. [00:03:00] Let's just put it that way. [00:03:02] It's got a lot going on for the next 11 days or so. [00:03:08] I imagine. [00:03:09] Yeah. [00:03:10] We've got a good time planned. [00:03:11] So, you're good. [00:03:12] Yeah, no, it's tough with those front row seats you got there. [00:03:15] It's going to be him and 3R Newswire in the front row. [00:03:21] Nice. [00:03:22] Here comes the man. [00:03:23] There he is. [00:03:24] Front row seats to cyber securing the venue. [00:03:25] Here comes the man tower. [00:03:26] There he is. [00:03:27] There he is. [00:03:28] We've been talking. [00:03:29] Say his name 3 or 4 times and boom, here he is. [00:03:30] Tom, how's it going? [00:03:31] No. [00:03:32] Well, yeah, I actually have to do girl grab a water, but yes. [00:03:33] A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long then A long [00:04:03] as well. I will bring my phone with me. Hey, Lisa Beth, how are you? [00:04:16] Lisa Beth, microphone check. Hello, hello. How are you doing today? [00:04:22] Hey. Doing all right. Doing okay. Hang it in there. [00:04:28] Yeah, Russell and I had an opportunity to see each other in real life today. It was a little bit [00:04:36] unbelievable that I've been talking to him for a year or more. [00:04:42] It was literally the highlight of my day up until now we get to hear you. It's just like, whoa, [00:04:48] you got a face and eyes and ears and I didn't know that. And it's just amazing. [00:04:52] That is funny. You guys was in Minnesota, right? Well, no. We wasn't actually meeting in real life. It was a meeting on Zoom. [00:05:04] Like a conference. [00:05:05] Yeah. The next question. [00:05:09] All right. All right. Look, we got, we got a Neil. Hey, Neil, microphone check for you, sir. [00:05:15] Hello. Hey, how's it going? All right. Good, good, all y'all. [00:05:24] All right. All right. Look, it's 7.59 PM Eastern time. We'll get started promptly in about a minute or so. [00:05:30] And once Tom gets back from grabbing his water, he is in the hot seat this evening. So it should be a fun, [00:05:37] insightful conversation. I know I'm looking forward to it as many, as well as many others. If it's the [00:05:43] first time you've joined us, this is our weekly fireside chat. We do this every Wednesday from 8 [00:05:49] PM Eastern time to about 9 30 PM Eastern time. Give or take a minute or two. We do ask our guests [00:05:56] questions for about 30 to 45 minutes, and then we open it up for the audience to sort of pop up on [00:06:01] stage, raise your hand, and we'll bring you up and you can ask the guests that we have a question. [00:06:05] So in that, in this case, it is Tom Ryan. So just a few quick ground rules. One, this is actually [00:06:13] being recorded. So it will be available on demand. If you, if you want to share it, feel free, go right [00:06:20] ahead. Our conversation is recorded, but ground rule number one, let's have fun. Let's have a great time [00:06:26] this evening. This is our week, our weekly series, which is really our midday stress reliever, if you [00:06:32] will. I've had a very long day. I've got 11 days to go for a big event or a small event, however you want [00:06:39] to put it. So it is, it is getting close to crunch time for me and I'm sure others are, are sort of [00:06:45] feeling some levels of stress. So this is our weekly sort of a stress reliever, you know, let's, let's [00:06:50] kick back. Let's have fun. Let's have a conversation. Our comments and opinions for at least for the most [00:06:56] of us, our comments and opinions are our own and do not represent our current or prior employer. So just [00:07:03] keep that in mind. The other thing, if you do pop up on stage, we ask that you try not to solicit us [00:07:09] or sell your product or solution. We know you have really great offerings. Now's not the time. Let's [00:07:16] use this as a conversation to really get to know Tom on a different level. So we ask that you keep your [00:07:21] solicitations or sales pitches or whatever you want to call it to actually, let's keep it to zero. Let's [00:07:26] keep that to zero. Now is not the right time. Without further ado, Tom, are you back? [00:07:33] I am back. Wait, quick question. Now that I'm on stage and I'm a moderator. [00:07:38] Yep. What's the question? [00:07:43] I said, could I make sales pitches now that I'm a moderator? [00:07:46] Tomas Maldonado. [00:07:53] I was going to say, you probably are going to have a lot of time to sell to make any sales pitches, [00:07:58] but we do want to get to know you. So look, we'll go around the room. I'm going to introduce myself. [00:08:03] Tom, we'll leave you for last. So I'm Tomas Maldonado. I'm the CISO for a major sports and [00:08:09] entertainment league in New York. Hussein, over to you. [00:08:14] Good evening. I'm Hussein Syed. I am the CISO for RWJ, a healthcare entity out of New Jersey. [00:08:21] The opinions are mine, solely mine. Thank you. Over to Russell. [00:08:25] Thanks, Hussein. Hey, Russell Eubanks, privileged to be here, former CISO for the [00:08:30] Atlanta Fed. Last couple of years, been running my own program, especially helping companies that [00:08:34] have lost their CISO and helping people get promoted to their dream CISO job. David, [00:08:40] I don't miss disclaimers, but over to you, my friend. [00:08:42] Thanks, Russell. Yep. And still disclaimers, but yeah, David Cass, I'm a former Federal Reserve [00:08:48] appointee for a large institution supervision. So as a regulator, now I'm a senior partner at Law and [00:08:53] Forensics. So any opinion I express is still mine and mine alone doesn't represent that of my past or [00:08:58] current employers. And any advice I give does not constitute legal advice. Katie, over to you. [00:09:04] Katie Hannihan, Hi, everybody. I'm Katie Hannihan. All of my opinions, particularly the controversial [00:09:10] ones are all Tom Ryan's fault. Besides that though, everything else is my own. I'm the VP of Cybersecurity [00:09:19] Strategy for a small SI out of Chicago and also a VC. So in our VC. So program, I'm so excited for [00:09:25] tonight. I know Tom from, met him from Clubhouse and we're having a crossover event between the [00:09:32] Security Mindset Club and Fireside Chat and I'm just tickled to death. So with that, I'll pass it [00:09:38] over to Lisa. Hello. Hello, everyone. My name is Lisa Beth Lentini Walker and I run a compliance ethics [00:09:47] and corporate governance consulting firm called Lumen Worldwide Endeavors. I also teach law school in the [00:09:54] United States and Europe. And in my free time, I wrote a book called Raise Your Game, Not Your Voice. [00:10:01] So that's a little bit about me. On to you, Anil. [00:10:04] Anil Varghese Thanks, Lisa. Welcome aboard, Tom. Anil Varghese. I am a five-time CISO, [00:10:12] currently serving as a virtual CISO for two firms, one on the West Coast and one based out of the UK. [00:10:18] Looking forward to the beginning conversation. Back to you, Tomas. [00:10:22] Tomas Files Five-time CISO. You would have thought you would have quit after one time, but [00:10:26] uh, way to hang in there, Anil. Way to hang in there. [00:10:29] Nothing for punishment. [00:10:30] So look, we've... [00:10:30] You are. So look, we have a great conversation this evening. Again, if you are, if this is the [00:10:37] first time you've joined us, there's a little greenhouse on the top left of your screen next [00:10:40] to where it says Fireside Chat. It looks like a little Monopoly house. Feel free to click that [00:10:44] and you can join our club. We're joined this evening by Thomas Ryan or Tom Ryan. Most of the [00:10:50] folks on the, on the stage and in the audience know Tom from his, uh, his other clubhouse chats [00:10:55] that he has pretty, uh, going on pretty consistently throughout the, throughout the week. But Tom, [00:11:01] why don't you introduce yourself? Why don't you tell us a little bit more about you? And you know, [00:11:05] my first question, tell us a little bit about your origin story. How did you arrive to where you are [00:11:11] today? And give us that sort of background and in between backstory on you. Go for it. [00:11:16] Wow. So you want me to start off at what I do now, or you want me to start off at the [00:11:20] very beginning. Start off at the very beginning, Tom. I like to, I like to understand how, [00:11:28] how you think to a certain degree, like what, what shaped you and molded you into, uh, into becoming [00:11:35] who you are. All right. I definitely have to say what shaped and molded me is, you know, how I grew [00:11:40] up, where I grew up, everything else. So growing up as a kid, I grew up in Sunset Park in good old [00:11:47] Brooklyn back in the days of all the gangs in the seventies and eighties. That was, uh, it was kind [00:11:53] of a lot of things that helped molded me in the direction I went, um, where that led me, you know, [00:12:00] yeah, I think it was like sixth grade when they first started getting me into computers. [00:12:04] When mom said, you know, it's time for you to, uh, it's time for you to take something. So I started [00:12:10] taking computer classes. It started off with basic. And the next thing you know, I have, you know, [00:12:16] a Commodore 64 and then start leading its way. So on and so forth, get into high school. [00:12:23] Then it became all about sports, you know, like what happens with a lot of us. [00:12:27] Now I started off at eight years old playing hockey because that was the big thing. [00:12:31] And I pretty much played hockey until I went into Navy high school. I joined the swim team, [00:12:36] uh, also played baseball. So I was busy at all times. So there really wasn't time for computers [00:12:42] after I started with that being said, you know, neighborhood molded me, you know, I got involved [00:12:49] with a couple of different graffiti crews, a different couple of gangs that got me in a little [00:12:53] trouble. Mom says time to get out of New York. All right. So I go to Jersey, Jersey has does bad [00:13:00] things to people. You know, after a year in Jersey, I said, you know what time to bail out. Uh, [00:13:07] with that, I joined the Navy. Now my grandfather kind of influenced me on it. I was originally going [00:13:15] to go in the army and grandfather was just like the big mold of the family. He's like, whatever he says, [00:13:22] how to go typical old Italian off the boat coming to the U S. So he goes, you do realize I was in the [00:13:32] Navy and your father was in the Navy and your uncles were in the Navy. Oh, and your godfather was in the [00:13:39] Navy. Nobody was in the army. Your grandmother's brother was in the air force. Eh, we'll accept that [00:13:47] for now. So I ended up going in the Navy afterwards and that kind of helped, you know, shape me up, [00:13:53] put in the right mindset, um, travel the world, you know, and kind of learn lots of different things. [00:14:02] Now, back then there was no cyber. There was nothing even close to that. I mean, we were on windows [00:14:08] three, one playing solitaire when we were bored, you know, just to give you a rough idea. I know I look [00:14:15] a little young, you know, I just turned 28 for the 22nd time, not too long ago. And you know, [00:14:26] then came the rough part. You get out of the military and you're like, well, what do I do? [00:14:30] So what I did really doesn't transfer into the real world. So what do I do? So I do what I did best. [00:14:38] I started off playing mechanic because I used to build street race cars. [00:14:42] And you know, it was the beginning of the dot com boom that though, I was a mechanic by day, [00:14:50] a bouncer at night and gave me a lot of different things. So I had the military mindset. You had that [00:14:58] situational awareness when you're a bouncer, you start to see things a whole lot differently. [00:15:04] Cause you start probing the room just like you did in the military. [00:15:07] And once I got into computers, I was like, well, where can I go to learn stuff? And this was [00:15:15] part of the problem. I said, just 95 now. Like there's no schools for this. I remember going to [00:15:22] a school to want to learn. And I said, where can I learn like Pearl and HTML? They tried to sell me on [00:15:30] Cobalt. All right. I'm sure that makes you laugh. So obviously I did not take Cobalt. [00:15:39] So I said, okay, where, you know, where can I go teach myself this stuff? [00:15:44] And then I taught myself this stuff and then I got my first job. Okay. First job. And then, you know, [00:15:50] you know, any of you that had been around a while during the dot-com boom, they always enticed you [00:15:57] with more money all the time. So you get one job and then you get the next and then you get the next. [00:16:03] So within two years, I was on my third job and it was at this lovely little place all of you probably [00:16:10] heard of, or your kids have heard of it was Scholastic. And it was also the biggest rewarding [00:16:18] time as well as the most challenging times. So I started off as a developer. [00:16:24] And from there, before you know it, I'm the lead developer, and then I'm running a team. [00:16:31] And then we had to revamp the whole site. So that was something to remember because I had my team, [00:16:39] and then doing it and then rewarding the team. Because I always looked at it as, you know, [00:16:45] nobody does anything on their own. It's their team. Okay, when you look at all the great leaders, [00:16:51] they're leaders because of the people that they bring with them. So if you're ever in a company and [00:16:56] you see a new leader coming in, and he never brought anyone with him, you know right away that [00:17:02] there's going to be some issues. So with that being said, I've moved on to my next job. [00:17:07] And that was an interesting interview, because this evil bank enticed me by doubling my pay. And [00:17:17] I got bored with it. I'm like, wow, all these controls and regulations, and you know, it's great [00:17:23] money, but it's boring. And then I went to for another interview. And it was an evil tobacco empire. [00:17:32] And I remember specifically because any interview, it's like, well, what do you know about security? [00:17:41] And I literally just hacked them right there in the interview. So well, here's your usernames, [00:17:46] passwords, your database connection strings, boom, boom, boom, thank you. [00:17:51] And that's what really got in. Now going back, well, what got you from a developer to cybersecurity? [00:17:57] Well, back at Scholastic, we had two little incidences. And this is going back to 99. We were [00:18:04] launching the first Harry Potter website. Guess what? It's just like graffiti, some little 16 year [00:18:12] old kid's going to come along and do something. So he came along and defaced the site. But because [00:18:16] we're all on DSL at the time, you know, we had his IP address. And back then we all hosted our own [00:18:24] websites on our home DSL. So we were able to track them down, we scared them a little bit. [00:18:30] That was fine. It was just a defacement. And then as a couple of weeks later, a month, a couple months, [00:18:38] there was this little unknown Chinese American hack of war. And the extent of it's not stealing data or [00:18:45] doing anything else, it's just automated script, you know, site defacements, you know, because back then [00:18:52] defacing websites was the big thing before e-commerce. Once e-commerce came out, this one, [00:18:57] everything turned crazy. So after that, I ended up at the evil tobacco empire. And then all the fun [00:19:05] began happening. So they gave me lots of different things to start testing security because I thought [00:19:13] it was a cool new thing. And the one thing I remember was, you know, [00:19:22] I was like, I'm not going to be able to do this. And the first worm I had to deal with was Code Red, [00:19:26] if any of you remember Code Red. And it crippled us literally for seven days. [00:19:39] And basically, you know, I sit there and think about it. I said, well, that's because we have 6500 [00:19:45] IIS servers running on developers workstations. You know, I went over to the, you know, the SOC team, [00:19:51] I'm like, can't we just create a policy to shut it all of them down? You know, Windows policy, [00:19:57] shut it down and force everybody to reboot or fix? No, you're the new guy, you know, nothing. [00:20:03] Well, seven days later, that's exactly what they did. You know, and this is kind of my origin story, [00:20:08] then I moved on. And I went to go work for a government agency for a while. So this isn't for [00:20:14] me. I don't like the politics. Then I became a VP. And that's also how I know a couple other CISOs, [00:20:22] because they were all working with me at that agency. After that, you know, I got to become a VP of R&D and [00:20:29] run a pen test team. And that's when it truly got exciting. You know, it's like, okay, what can I do? [00:20:35] And so the CEO goes, this is your task. With the pen test team, you have to, [00:20:43] you know, pretty much bring us to bring it up to $1 million a year. Well, I was able to get in there [00:20:49] with four people and bring it to 4 million, as well as starting to bring in other resources. [00:20:58] You know, and that's just when it comes down to the core thing of networking. So I took all my friends [00:21:03] from all the stuff I learned before, you know. So what I had to do to learn everything was going back. [00:21:14] What was it? Yeah, back to 99. You know, I said, how do I learn the cybersecurity stuff? So I started [00:21:19] going to 2600 meetings. I went to DEFCON. When I went to DEFCON, I started meeting all the loft guys, [00:21:25] the CDC guys. And then, you know, by the time I got to running a team, it's like I was in the same [00:21:33] league as them. And watching where all these guys have gone now, it's kind of amazing. Because my [00:21:40] number one competitor was right up the block from me at the time, it was at stake. And they were at [00:21:45] three Wall Street, I was at 80 Wall Street. But I'd walk by there all the time as a man, I wish I could [00:21:50] work here. And then all of a sudden, you know, they got sold off to Symantec. And I was like, Oh, that's the [00:21:57] end of that. Going forward with that did many years from that. And then there's always that time you [00:22:04] want to dip your toe in that water. I said, Okay, let me try starting my own business. I started my own [00:22:11] business with the vision of I'll be able to merge, you know, physical security and cybersecurity together. [00:22:17] Little did I know the politics behind that the pains behind that. All right, so the way we did it was [00:22:24] my partner was a former Secret Service agent. So we utilize that. So cyber and physical, we were doing [00:22:31] executive protection, OSINT, all of that pen testing, investigations, you name it. And it got to be [00:22:38] profitable. You know, from a two person business with a couple of contractors, we've got up, you know, [00:22:44] two and a half million within a year and a half, and then just kept progressing. And from that is when [00:22:54] the protection details is where it got interesting. I think the best one I had, we had to do a detail [00:23:00] for an event with was quite unique. It was Bush and Clinton at the same time. All right, because my [00:23:08] partner was former Secret Service, we did all the advanced playbooks, handed it off to the Secret Service, [00:23:13] we got to hang around for the events, we got to meet them. And that was awesome. And then we got to start [00:23:19] meeting all these former Secretaries of State. Those were awesome gigs. I got to meet Colin Powell, Condoleezza Rice, [00:23:27] Terry Bradshaw, you name it, every big name player that had to go do events. And I was truly starting to like it. [00:23:34] And the niche play that we brought in is, you know, you had to do OSINT on everybody attending, [00:23:44] which made it a niche play. And what the first lesson I learned from that is, I failed because [00:23:49] not realizing maybe I should have created software for this. This would have made it so much easier. [00:23:54] And then it grows and grows. And it took off for a while. And then, you know, stuff after a while just [00:24:04] goes downhill. You know, it didn't work out. And when we finally shut down the business, [00:24:12] you know, I asked two of my customers, one was the CFL, one is a CLL. I'm like, Dave, Randy, [00:24:20] what did I do wrong? He's like, well, you didn't know two things. You didn't know sales. You didn't [00:24:25] know marketing. You relied too much on word of mouth and relationships. And that can only last for so [00:24:31] long. And with that said, I freaking jumped out of my normal thing. And I went over to sales. [00:24:39] The problem with going over to sales is guess what? Once you dip your foot in, you're not getting out [00:24:46] too easy. Because when you're good at what you do, you do make a decent chunk of change. [00:24:52] We call that going over to the dark side, Tom. You went over to the dark side. [00:24:57] But do you know how, see, I know it's the dark side. You know, I was lucky enough to get a job [00:25:02] with HP at the time doing Fortify because I did AppSec all day long. Because I'm sure you see my [00:25:09] friend Tom Brennan. So I started New York OWASP chapter with Stan Guzik. He's the CTO over at SMP. [00:25:16] And another guy, Peter Stern, who's over at IBM. We started back in 2003 and it really took off. [00:25:23] And then we really built up the community in New York to where we had the first profitable OWASP [00:25:31] conference and then the most profitable one. And it was Tom and I and a bunch of others that just put [00:25:37] this stuff together. Other people that were in the audience were core contributors to that. [00:25:42] And that's why I kind of started that security mindset club is because of community. [00:25:47] So. And there's so many questions that we want and I want to, you know, I want to make sure we [00:25:52] can get to dig into that. You know, I hear there's some interesting stories about. [00:25:58] Tom, what is it? [00:26:00] Tom, what is it? [00:26:01] Yeah, but that's a, there's some more, there's some more stuff. And I know you've got, look, [00:26:06] so first and foremost, Tom, thank you for your service. You know, thank you for, for, for all you, [00:26:12] you've done service, service oriented wise. And it's great to, to, to have you on the stage with us. [00:26:18] Tom, what is it? I want to get to some of your, your really interesting stories, but I know I'm [00:26:23] getting, I'm getting texts from the, from the, from the mod saying, Hey, we've got to ask him some [00:26:27] questions too. So if you permit us. [00:26:29] It's plenty of time. [00:26:32] You see, I have a specific goal and you're going to hate me for this. [00:26:36] We're going beyond your normal time limit tonight, sir. [00:26:39] Oh yeah. We are going to hate you for that. [00:26:43] We are going to 1022. So we can be all twos across the board. [00:26:48] Look at that. All right. [00:26:53] I'm going to pass it over to Hussein. Hussein, you want to ask Tom and keep the conversation flowing. [00:26:58] Hey Tom, nice to meet you. Thank you for your service. You know, your family and folks keep us [00:27:04] safe. A question here is tell us something about yourself that really tested your resolve [00:27:11] in moving from all the different career paths you took and made you, you know, really think I got [00:27:18] to take this direction because that's better for my career growth or what I'm thinking today. [00:27:24] Yeah. I think that didn't happen until I actually went into sales, believe it or not. [00:27:30] And the, the weird part about going into sales, it's like going to a dark side, I'm doing this a [00:27:36] long time. And then I started realizing from that, it changed my whole mindset. So going over to sales, [00:27:43] I got to learn people's problems from a different point of view. And I was, I was not a product seller. [00:27:50] I was a solution seller. This is the best way to do stuff. And then also how do I take those people, [00:27:56] those customers as a partnership and excel them forward? You know, I wish I could bring some of the [00:28:04] other ones on, but they're kind of hesitant about clubhouse. I could tell you offline, but one of [00:28:10] them's in the audience. It's like, I started a whole, so what I did from sales, I went over to go work [00:28:14] over at Fortify, so on application security. And first thing I realized was there's a gap in the [00:28:21] cybersecurity space. And all of you on here have also felt the same thing. It's like, you know what, [00:28:28] I'm doing good in life. How do I help other people? So I started a university program at work, [00:28:34] and we basically give the security software, you know, Fortify, Web Inspect, away to universities, [00:28:42] along with all the training curriculum, basically to take our customers to when they want to hire those [00:28:48] junior people. It was that, and that's kind of what I liked about the whole giving back thing. And that [00:28:53] was kind of transformational for me. And, you know, on the back end, it also paid off, because [00:29:00] the one thing I learned is by giving back, there's always reciprocity for it. So that was my biggest [00:29:06] transformational thing. Great. Yeah, we were a customer of the HP security products for a while. [00:29:14] They were good products. Over to you, Russell. Thanks for saying, Tom, man, I feel like we could talk [00:29:21] for a minute. Like others said, thank you for your service in the Navy. We really appreciate that. And [00:29:26] your executive protection stories, I'm sure, could keep us up for many nights. But the question, so [00:29:31] for me, I love lessons learned and after-action reviews and after-action reports and the idea of, you [00:29:36] know, get wisdom as cheaply as you can. So the question is, what one thing have you learned recently [00:29:43] that you put into practice that you can share with all of us here in the room so that we can get wisdom [00:29:48] as cheaply as we can from some of your recent life learnings? Whether it's a good thing, bad thing, [00:29:52] bad thing, bad thing. Love to kind of learn from some of your experience. [00:29:59] So a couple of different things I've learned. So I dipped away from Fortify for a little while [00:30:04] and from the AppSec went over to security operations. And I learned a lot from it because [00:30:10] now I'm looking at it from the defenders view, not the attackers view. And what can go wrong with all [00:30:16] this technology that's out there and the importance of your team to help you make the right decisions. [00:30:22] So one thing, AI platform, you know, you have your third party service that managers are making all [00:30:30] the wrong decisions. And then they corrupt the algorithm. And if they corrupt the algorithm, [00:30:36] guess what? Now real attacks are getting in, you're not noticing it. That was one lesson learned. [00:30:41] Other lessons learned is just listening, you know, and Clubhouse really forces you to do this. That's why [00:30:52] Clubhouse is an interesting platform. Before you even speak, you should listen to what the people's [00:30:58] problems are. And then taking those problems and try and see who else has had similar problems. [00:31:05] And with those similar ones, don't listen to the sales rep, you know, talk to the other customers. So I [00:31:20] believe that. So me and my counterpart, my column that we started just doing customer user groups, [00:31:27] you know, and listen to other customers, don't just listen to the sales rep so you can learn from [00:31:31] their experiences. You know, because one thing I've learned is, this is a life of continuous learning. [00:31:40] Okay, what I knew three, if I left this industry for two or three years, I'd be decades behind. [00:31:47] You know, and then you have to rely on those right people to help you make the right decisions. [00:31:55] Does that help you Russell? Doubly so. And thank you, [00:32:00] Tom, for that insight of things that have happened to you. We get the opportunity to learn from that and [00:32:07] get wisdom as chiefly as we can. Well, hey, David, over to you, my friend. [00:32:13] Oh, thanks so much, Russell. And I definitely know that I know you and some of the usual suspects from [00:32:20] Fortify. I was wondering why your name was so familiar to me. But now I mean, and I think, you know, [00:32:26] you've done a tremendous amount, you know, and accomplished a lot in your career. And I think [00:32:32] some of the key things is, like, OWASP has been so instrumental in helping progress things from a, [00:32:38] you know, open source and from a security point of view. You know, how do you see those, you know, [00:32:44] opportunities continuing to grow and kind of continuing to help out in that, you know, [00:32:48] in the public private sector to kind of help advance, you know, software security in general? [00:32:55] Yeah, excellent question. So I think software security is becoming the new big, true pain in the [00:33:02] butt. The biggest problem we had when we started the OWASP community, everybody loves to come, [00:33:08] because we always had sponsorship funding, and you always guaranteed pizza and beer. [00:33:12] And we kind of held off on the beer towards the end. Otherwise, everybody would drink it all. And [00:33:17] then there'd be nothing for everybody else that comes in late. But it was the power of networking. [00:33:23] And that was the key thing. I mean, our favorite event every year, they threw the best one, [00:33:29] they always really hooked us up with Goldman Sachs. And it was always around Christmas time, [00:33:36] and it was in their auditorium. And it was just always the best. So how do we take that forward? [00:33:42] That's something Tom Brennan and I have talked about a lot. Because, you know, we kind of walked [00:33:47] away because how we were given into OWASP for at least 16 years. You know, what, how do you take that [00:33:56] forward is, is interesting, because I'm trying to, my new pet peeve has really become on universities, [00:34:03] because I'm truly not satisfied the way they're training the new and upcoming individuals. [00:34:09] And now when you're looking like the Verizon data breach report, you start looking at, you know, [00:34:15] all the different breaches and how much of it's open source. But because of that open source, [00:34:21] it's also changed the mindset of it. And what I mean by that is now from an insider threat perspective, [00:34:29] you have to start looking at that open source as an insider threat. The reason why I say this is we [00:34:35] don't know these, the people that are contributing. Okay, there's been a bunch of research that's out [00:34:41] there, there's a bunch of stuff that's not even talked about, I had one room on it, it was called [00:34:45] Trojan sources. And what it was is bi-directional Unicode exploits inside a code that impacted nine [00:34:52] languages. And I still have not seen any traction on it. I've seen a bunch of different exploits [00:34:59] come out for it where they're, you know, embedding Trojans inside a Java, you know, JavaScript, [00:35:04] and you're not even going to see it. You know, and then also, how do you get the foot away from [00:35:08] the sales reps? Because, I mean, log4j was the perfect example. It's like, you got sick of hearing [00:35:15] about it. You know, but when now that we're a month, yeah, we're about over a month away from it. So what [00:35:22] are the lessons learned from that? Okay, one of the biggest problems we have in the open source space, [00:35:29] is they're not testing their code. And we, how did we realize that? Well, how many times, [00:35:37] how many times did they have to create the fix? It was four times, because every time they open, [00:35:42] every time they made a fix, they had to go in and create a new patch because they created new [00:35:48] vulnerability. That's the first example. The other problem I find is, you know, and everyone's like, [00:35:58] well, pen testing is dead. I'm like, obviously, you don't know the space then. Because the one [00:36:04] thing that happens is, you can have the best AppSec program, but that pen tester red team is always [00:36:11] going to find their way in. And a lot of times, it's going to be through open source. Like if you [00:36:16] turn around, you know, look at it, I literally mapped out 16 different breaches because of their code [00:36:22] repositories. Okay, so it could be a problem with the code repository, it could be a problem with the, [00:36:29] you know, the IAM functions of that code repository. The biggest risk that you have now is guess what, [00:36:37] you have these code contributors from around the world, your firewalls are open, guess what they're [00:36:42] always open to? Always open to GitHub, GitLab. Well, as a red team, I guess where I'm hiding my payload? [00:36:50] GitHub, GitLab, because I'll always be able to pull it in. You know, this stuff happens all the time. [00:36:56] I actually had to do one where it was an insider threat. And they did a poll for a custom Chinese [00:37:06] VPN from GitHub, built it on the network and ex-filled it out that way. So there's always going [00:37:15] to be the insider threat. But how do you map that insider threat as well, especially with open source? [00:37:19] Hope that helps answer David. Yeah, that was very helpful. Thanks so much, [00:37:25] Katie. Katie, over to you. Well, thank you very much. Katie, you want to do a quick room reset? [00:37:31] Oh, I'd be honored. Thank you. I don't know if I could do the same justice that Lisa and you do, [00:37:36] but I will try. So everybody, this is Cybersecurity Fireside Chat, which happens every single Wednesday [00:37:44] night at eight o'clock Eastern Time, where we meet with industries leaders such as tonight, Tom Ryan, [00:37:51] who has an interesting background. We have people in the audience that have been former guests. We have [00:37:56] a collaboration of people who are just interested in this space where we get to share experiences and [00:38:02] talk to each other about our cybersecurity journey. And it's all over the place. Some of us come from [00:38:10] all kinds of backgrounds, which is what I'm getting to with Tom next. And I'm so glad I have the next [00:38:14] question. Hope that was an okay. Is that an okay reset, Tomas? That was perfect. [00:38:21] It's my first time. I'm a newer moderator, everybody. So thank you very much. [00:38:25] You need to get one of those machines that Tom has in his room where they can, [00:38:30] he actually can have applause for people. So everybody can just, you know, applaud or whatever. [00:38:35] But Tom, so I have some actually big questions for you, if it's okay. [00:38:38] So, you know, it's interesting. You talk about networking. I actually want to do a call back. So Julie [00:38:44] Chapman and I, she was a guest in the room several months ago. I don't know if she was a guest or in [00:38:50] the audience, but we, we had a networking event afterwards and she and I talked about something. [00:38:54] The biggest thing that came out of it is, you know, beyond our overall conversation is the human [00:38:59] factor is the X factor. And obviously that's a big chunk of what we talk about, you know, in general [00:39:05] as well, every day and what we do. Your story about Robin Sage. I mean, we can't, we can't go further [00:39:16] without, I mean, you have a Wikipedia page that's dedicated to this person who was able to infiltrate [00:39:23] almost every single three letter agency, multiple military agencies through the human factor, [00:39:32] through social engineering and other cyber security tactics and physical security tactics. Are you able [00:39:37] to go into that a little bit with us tonight? Because I am, I never get tired of it ever. And is Robin here [00:39:46] tonight? I'm not sure. I didn't see if she was here, but no, I didn't bring her. [00:39:50] What I did was, so I created this persona Robin Sage. Okay. This back in 2009, right as I was starting up the [00:40:04] business, you know, because you're always looking for that X factor to start telling the business story. [00:40:12] The key thing was, is I wanted to show one particular thing. It's, do you know the people you're talking to? [00:40:19] Okay. Because social media was the biggest craze at the time, you know, this, that, the other thing. [00:40:26] And do you know the information that you're putting out there and what it can be used for? So that was [00:40:33] the whole premise of it. All right. So people would post pictures and say, blah, blah, blah. Let me show you [00:40:39] this, you know, so the persona Robin Sage, and then I got a picture from a certain site and I used that persona. [00:40:49] And I used that for the persona. I grabbed a bunch of them, right? It's kind of hard to do the same [00:40:53] thing, replicate it now because of Google images, but there are ways. Now with that, it's, it was kind [00:41:01] of weird because then I started to experience what women go through on all social media platforms. Hey, [00:41:09] an attractive girl, blah, blah, blah. But I also started to realize some of my mistakes, you know, [00:41:15] job titles, different things like that. And there were a couple of people that caught on to it and I [00:41:20] would just go and make the changes real quick. So that was a Robin 1.0, but I also did several others. [00:41:27] And the key things were to show a lot of the dangers of social media. That one got very deep. [00:41:34] It's funny because it's taught in 28 different universities and there are cybersecurity programs [00:41:40] or in their, you know, Homeland Security programs. But the funnier part is not one person bothered to [00:41:46] ask me for a writeup or the actual slides. Everybody took it on their own perspective. [00:41:51] The one reported, the one reported that actually did the most digging into it was reporter Sean [00:41:57] Waterman for the Washington Times. That article is still out there. But everybody got to write their [00:42:04] own perspective. And, you know, I have interesting ways of doing things. As a matter of fact, one of my [00:42:13] friends at the FBI says, you know, your hat's kind of gray, dark gray. If the wind blows in the wrong [00:42:19] direction, you'll probably get arrested. And the reason why he said that is because he started to [00:42:25] see some of the other stuff I did. So I'm sure a bunch of you Googled me after some of these stories, [00:42:31] and then you saw the Occupy Wall Street stuff. And that basically shows where people take on their [00:42:37] own perspective and write up what they want. They don't bother to ask questions or bother to listen to [00:42:43] you instead of responses. So what I was doing in that particular one is I had a couple of [00:42:49] fears about it. And I also used Robin on that particular one. My fear was there was literally [00:42:57] terrorist groups blogging about it trying to say, you know, get involved here, get involved there. [00:43:04] It's in the area where 9-11 happened. So it's that instant trigger right away. [00:43:10] All right. So after that, what I did was I said, all right, let me go to some of these protests and see [00:43:15] who these leaders are. So I had to address differently than I normally do. Go in, listen, [00:43:22] you know, I'm like, wow, why are these 60s protesters teaching them how to break out of handcuffs and do [00:43:27] all this other stuff? It was weird. And that's when it got interesting. So I went to the protest with some [00:43:35] other friends and started watching some of the things. I said, there's something wrong here. There's a [00:43:40] bunch of people being used and they don't know they're being used. I said, so I started thinking, [00:43:46] how can they use the message against them? All right. So as they were posting, I started [00:43:53] the funny part is I started using marketing tools to create social media bots. [00:43:58] And I literally had about 280 of them running at once. And what they were being used for was [00:44:06] collecting this information as well as controlling the message. And the way they were controlling the [00:44:12] message is because you would make everything trending using these bots. And then from those bots, [00:44:18] you start to realize, Hmm, what are the other types of evils I can do with this? I said, all right, [00:44:24] I'm going to block all of it. I cross hashtagged everything with porn. The reason why I did that is [00:44:31] because porn is on there. Well, you're not going to be able to read it in the university because there's [00:44:36] going to be a filter there. You're not going to be able to read it at work because there's a filter [00:44:40] there. Okay. So that was one particular method. And then I said, okay, that worked. Next thing, [00:44:49] let's see how these hackers are real hackers or they're very reactive. So I took all their emails [00:44:58] because I was on the mailing list. And I said, I'm going to dump this somewhere that's going to [00:45:02] piss them off. I did it on Breitbart. And I said, let's see what happened. So I started watching them, [00:45:10] you know, go in and start trying to hack into me after this was leaked out. They didn't pay attention [00:45:16] to the information that was leaked out because some of it had their Excel spreadsheets with all their [00:45:21] usernames and passwords or all their accounts. They also didn't realize the number one person they [00:45:27] kind of tried to befriend that appeared as my adversary was also me. So I always knew ahead [00:45:37] of time what they were doing. And this goes back to the premise of Robin, know who you're talking to. [00:45:43] Okay. Know the people you're talking to, especially if you plan on doing anything with them. Okay. [00:45:49] Because social media, it just there to collect your information and do everything. So from there, [00:45:54] you know, I created other experiments, so on and so forth. Some of you know where Robin four and five [00:46:01] are, but that was kind of where all the Robin Sage stuff went. [00:46:06] Dr. [00:45:56] Dr. [00:46:09] Dr. [00:46:10] Dr. [00:46:11] Dr. [00:46:12] Dr. [00:46:13] Dr. [00:46:14] Dr. [00:46:15] Dr. [00:46:16] Dr. [00:46:17] Dr. [00:46:18] Dr. [00:46:19] Dr. [00:46:20] Dr. [00:46:21] Dr. [00:46:22] Dr. [00:46:23] Dr. [00:46:39] I think everyone has. [00:46:42] I got that FBI agent. [00:46:45] Wait, what's that? [00:46:46] I'm sorry, what? [00:46:46] That's why I got that comment from the FBI agent about how far. [00:46:51] Well, yeah. [00:46:53] So, I mean, just for everyone in the room, I mean, we have a lot of people who are red [00:46:56] teamers in the room, right? [00:46:57] So we're constantly having to deal with that ethical question of, you know, at what point [00:47:03] are we exposing risk? [00:47:04] At what point is this just, you know, astronomically, you know, scary or atrocious? [00:47:11] But, you know, really, you know, pragmatically, how do we move forward as an industry when [00:47:17] these types of things are exposed? [00:47:20] Well, the fact that you brought that up, all the social engineering, I told you the story [00:47:26] about how we took over a hedge fund with a dating app, right? [00:47:31] No. [00:47:33] No. [00:47:34] That's terrifying. [00:47:37] Yeah. [00:47:37] Through Tinder. [00:47:38] It was an interesting experiment. [00:47:41] And the real interesting part about it was I was training one of my mentees on that one. [00:47:47] You know, so it helped out a lot. [00:47:50] And the way we did it was, you know, we did a little OSINT on all the key players in the [00:47:56] room. [00:47:57] And then we created personas like that on social media. [00:48:00] And pretty much on Tinder. [00:48:02] So we knew. [00:48:03] And then we got outside the offices when they were there. [00:48:06] And then they would connect there. [00:48:08] The purpose of it was not to, you know, try and go on a date with them. [00:48:13] The problem was with the social media apps, they gave your geolocation in your distance [00:48:17] away from you. [00:48:18] So as we were doing the red team and actually infiltrating the place, we would know if they [00:48:26] were close by. [00:48:27] So while we were doing things. [00:48:29] So for instance, if you're going into a building, building security, there's two different ways [00:48:34] to go in there. [00:48:35] You're always really nice to the building security guys, buying them lunch. [00:48:39] They give you whatever you want. [00:48:41] The other way is, is you're going to social engineer. [00:48:44] You pick the right time. [00:48:45] Valentine's Day is coming up. [00:48:47] It's always the ripest time. [00:48:49] You show up as the flower delivery guy. [00:48:52] Okay, you go there. [00:48:53] You make sure your target has left the building because you know who your target is. [00:48:58] You do a spoof call into the building. [00:49:01] Okay, we know we can't do this because nobody's at work. [00:49:03] So don't worry about it right now. [00:49:05] You do a spoof call into the building and down to the security guard desk from that person's [00:49:11] phone number. [00:49:12] The guards automatically give you a badge and let you in. [00:49:14] And then you're free to roam. [00:49:16] Then you're there to drop whatever tools you need to around the office for remote access. [00:49:21] So those are some examples. [00:49:25] Thank you. [00:49:26] Yeah, thank you for that. [00:49:28] Yeah, there's just so much to unpack there. [00:49:29] I just, I find it also fascinating. [00:49:32] But I'm going to move along on the moderator panel here. [00:49:37] So Lisa Beth, author of Raise Your Game, Not Your Voice, I'm sure has a number of questions [00:49:42] for you. [00:49:43] So I'll pass the mic to Lisa Beth. [00:49:46] Hi there, Tom. [00:49:47] It's absolutely fascinating to me hearing some of the work that you've done and the path that [00:49:54] you've taken, as well as some of the things that you've done from a research perspective. [00:49:59] So coming from the side of legal and compliance and ethics, one of the challenges that we have [00:50:08] in that profession is connecting and understanding some of the things that are going on in the [00:50:15] cybersecurity and information technology space. [00:50:21] How do you go about connecting with people who just aren't in your field and helping them get it? [00:50:28] That's what I've learned. [00:50:32] The hardest part is trying to, well, lawyers are usually always open to discussion because [00:50:39] the easiest way to handle lawyers is you just go out for a drink. [00:50:43] And, you know, you sit there, you relax, you explain things. [00:50:47] Some of them get the, you know, that's kind of why some of my little tribe, like the Jennys, [00:50:52] kind of understand because they're there all the time. [00:50:56] Jack's another one in the crowd. [00:50:58] She understands because same mindset, comes from the military, had to do some of these things. [00:51:04] The hardest people to explain this to are the small businesses because they seem to be the [00:51:10] most naive, that they think they're never going to be a target. [00:51:14] I said, well, who do you do business with? [00:51:16] And there's always a small business that has that one good contract. [00:51:21] And you could become a target just for that one good contract and then they don't realize it. [00:51:27] And then they look at cybersecurity and realize, wow, this is really expensive. [00:51:32] And trying to relate with them on how to do this is the toughest part. [00:51:39] And it's been something that's been a little bit of my passion lately because of that. [00:51:45] You know, like right now, if you were to go around Clubhouse and say, well, what's the biggest problem you have? [00:51:51] They'll tell you their social media accounts are getting hacked and they have no way of recovering it. [00:51:56] And they've taken over their small business completely because they've relied on Facebook. [00:52:02] And usually the hack, the hack scenario is relatively simple. [00:52:07] They compromise your Gmail from your Gmail. [00:52:09] They take control of everything. [00:52:11] It's done in a short amount of time. [00:52:13] And so those are some of the tough things. [00:52:18] I think that's why, you know, a couple of us have talked about we're going to take this up a level. [00:52:24] Not to sound like the marketing people. [00:52:26] And then you have the magic $9.97 price for an online training class. [00:52:31] But Katie, Jennifer and a bunch of others said, you know what? [00:52:34] Let's just start doing some free YouTubes about this. [00:52:37] And doing some free Zoom calls. [00:52:40] So last week, Tom Brennan and I tried this one. [00:52:43] And we did it on attack surfaces. [00:52:46] Kind of to see if people even understand what their attack surface is. [00:52:50] Okay. [00:52:51] Nowadays, the average human, their attack surface is everything electronic. [00:52:56] Okay. [00:52:56] One of the weirdest researches I've looked at was if I hack your phone, can I take over your car? [00:53:05] And then if I take over your car, can I hold it for ransom? [00:53:10] You know, because we're so connected with our electronic devices. [00:53:13] You know, it's a limit of where your mind goes. [00:53:18] And if we talk with everybody else in this room, everybody has a different approach. [00:53:22] And that's why I kind of like the cybersecurity industry the most. [00:53:28] Because of the diversity of thought. [00:53:31] And then things like this where Tomas, you know, asked me, you know, if all of us got to a table, [00:53:37] I can only imagine the crazy whiteboarding session we would have. [00:53:41] How do we handle this scenario? [00:53:42] How do we handle this? [00:53:44] And then we would probably run live training exercises. [00:53:49] You know, I mean, and that's kind of how I look at it. [00:53:53] The only one who I think has a little bit tougher was Tomas. [00:53:56] And I was going to tease him. [00:53:58] And I was going to ask him, did somebody really use, you know, like, you know, a deep fake, [00:54:06] like deep fake live to say Tom Brady retired? [00:54:09] Because that kind of blew my mind. [00:54:11] Well, I am all in for a whiteboarding session whenever we can find a time to do that. [00:54:21] Because I think we could solve a lot of problems and work collaboratively together on a lot of different areas. [00:54:26] So thanks for sharing all of that, Tom. [00:54:29] I'm going to turn it over to Anil. [00:54:30] Thanks, Lisa. [00:54:34] Tom, appreciate the backstory, background. [00:54:36] I knew we had a connection. [00:54:37] I knew we had a connection. [00:54:38] Also a product of Sunset Park. [00:54:40] And also reliving some of those histories of, you know, 2600 getting out there back in the day. [00:54:48] A question I did have for you, you know, per your background, per your experiences, having been on the offensive and defensive side, when you're engaging customers or clients or even your teams, how are you helping them cultivate that security mindset? [00:55:04] You've had roles where you've got to step into those opportunities and those roles and delve into that space. [00:55:11] But how do you, almost double dipping into Lisa's question, how do you cultivate that mindset? [00:55:17] How do you engage your teams? [00:55:18] How do you stay abreast of what's happening in the space, especially for those folks who are trying to get into the field? [00:55:24] Right. [00:55:26] That's always the interesting part, because, you know, who do you teach and then do they take that training with them, too? [00:55:35] So, usually you have to give somebody a shock factor. [00:55:39] Okay. [00:55:39] What do I mean by a shock factor? [00:55:41] Okay. [00:55:44] You know, you usually get their permission and say, can I show you something? [00:55:49] Okay. [00:55:50] And a scenario would be we'd be out for drinks. [00:55:53] Okay. [00:55:54] Maybe I'd have Katie or Jennifer come up and distract you and say, hello. [00:55:58] Oh, how you doing? [00:55:59] Boom. [00:56:00] That would swipe your phone. [00:56:02] Okay. [00:56:03] Little trick we used to do on the red teaming side. [00:56:06] If it was in the rules of engagement, you swipe your phone, you pop it into something like, say, BlackBank. [00:56:13] BlackBank, I can take enough Intel off of your phone in a quick swipe and all the data off your SQLite database in about 15 minutes and get it back in your pocket. [00:56:22] Okay. [00:56:23] And then say, oh. [00:56:24] And then you'd have more things to talk about. [00:56:28] Okay. [00:56:29] That's one thing. [00:56:30] Okay. [00:56:30] And you have to be cautious about your approach. [00:56:33] That could be one way. [00:56:35] Other ways is just walking through it. [00:56:37] Okay. [00:56:37] Okay. [00:56:39] I got called on a couple of different cases where it got interesting. [00:56:45] So we met with a couple of people and I said, okay, how do you handle this one? [00:56:51] And I literally had a call today about this before the rooms. [00:56:54] It's like, okay, I got a bunch of people going through the Olympics. [00:56:56] What should I do with their phones? [00:56:59] Simple example. [00:57:00] From that security mindset, you know you're going to China. [00:57:02] They have back doors we have no clue about. [00:57:08] I would say, I tell them, don't overthink it. [00:57:11] Just grab a burner, grab a different SIM and that's it. [00:57:14] Don't try and use your same SIM. [00:57:15] And then have some fun when you get back, take the burners and do some forensics on them and see what happened. [00:57:22] One guy that comes into the rooms here, Jonathan Data, you know, Jonathan Scott, [00:57:27] he was showing a lot of interesting stuff that had happened with the Olympics app. [00:57:32] And from the competitive intelligence perspective, it makes a lot of sense. [00:57:38] So they would take control of your mics, listen to stuff through the app that everybody was forced to have on their phone. [00:57:44] So different scenarios like that. [00:57:48] So how would you protect those people then? [00:57:51] Okay, you can listen to everything they say. [00:57:54] That's fine. [00:57:55] But guess what? [00:57:56] You can also collect everybody's phones and put it in the Faraday bag when you're having important conversations. [00:58:03] All right. [00:58:03] Key things like that. [00:58:04] Simple solutions. [00:58:06] You just have to think about. [00:58:08] And that's kind of how I look at it. [00:58:10] I hope that was helpful. [00:58:13] Awesome. [00:58:14] Appreciate that, Tom. [00:58:15] Brings me back to prior engagements and doing some of the same exercises experience. [00:58:20] So it's great to have you convey the same. [00:58:22] Back to you, Tomas. [00:58:25] Sounds good. [00:58:26] Look, great conversation so far. [00:58:28] Tom, obviously, thank you for sharing a very interesting story about Sage, Robin Sage. [00:58:35] That was a man. [00:58:37] Wow. [00:58:38] Got to talk about that one offline. [00:58:40] Great pleasure to be in that one. [00:58:42] Yeah. [00:58:43] So, look, it's 8.52 p.m. Eastern time. [00:58:47] I know Tom Ryan is pushing to try to get us past our 9.30 p.m. Eastern time. [00:58:50] We'll see how that works out. [00:58:52] But if you do have a question for Tom, please raise your hand. [00:58:55] We'll bring you up on stage. [00:58:56] I do see Tom Brennan has a question. [00:58:58] I try to bring him up on stage. [00:59:00] Tom. [00:59:00] Hey, Tomas. [00:59:01] Can I ask a question? [00:59:02] I probably could you think again. [00:59:04] Go for it, Jennifer. [00:59:05] Thank you. [00:59:06] You did. [00:59:06] Go for it. [00:59:07] Yeah. [00:59:07] Yeah. [00:59:08] Thanks, Moss. [00:59:09] Thanks. [00:59:09] Thanks, everybody, for having me up. [00:59:10] Thanks, Katie and everybody. [00:59:13] Hey, Tom. [00:59:14] Love doing all this stuff with you. [00:59:16] And you definitely know your attorneys well. [00:59:19] And it's great hearing all this additional background. [00:59:22] I've heard most of these stories, but I'd love having you present them in this thought-out manner. [00:59:27] Definitely do your research and have a lot of expertise across this. [00:59:32] And I know you prepare for things. [00:59:35] Recognizing that, what OSINT tools did you use to prepare for tonight's interview? [00:59:41] None. [00:59:44] Oh, no, wait. [00:59:45] Are you talking about the Google search I told you about? [00:59:49] At least that. [00:59:52] Tomas, I just wanted to tease you because we found Tomas in IMDb. [00:59:55] I'm pointing out that Tom doesn't do anything without preparing. [01:00:00] It's just good. [01:00:05] That's all she was talking about, Tomas and his three little TV shows. [01:00:11] Sounds good. [01:00:12] Anything else you want to ask Tom Ryan, Jennifer? [01:00:18] I'm good for now. [01:00:19] Thank you. [01:00:25] I already know what Tom Brennan's going to say, so watch out. [01:00:33] All right. [01:00:35] Jax, thanks for popping up on stage. [01:00:38] Anything you want to ask Tom? [01:00:40] Jax, if you're having trouble speaking, there's a little microphone on the bottom right of the screen. [01:00:58] I think if you use an iPhone, I don't know if you use an Android. [01:01:01] You can just click that microphone and it'll unmute you and then you can talk. [01:01:04] I do know that Jax is a real person. [01:01:08] She's not a Robin Sage. [01:01:10] She may have just stepped away, so maybe we should go to the next person. [01:01:13] All right. [01:01:14] Jax, take a bathroom break. [01:01:15] Mike, thanks for popping up on stage. [01:01:17] Anything you want to ask Tom? [01:01:18] Hey, thanks. [01:01:19] Hey, Tom. [01:01:19] Great stories. [01:01:20] Great listening to as a fellow Alexis Park alumni back in the day. [01:01:25] Some of those places. [01:01:27] Bringing back memories. [01:01:28] Hey, since you brought up Robin Sage, would you speak to what I conceive as an underperceived massive threat, which is that of the use of these false personas? [01:01:39] I out some of them on LinkedIn from time to time to try to get people's awareness up. [01:01:44] And some of the ones that I've traced back and taken apart are clearly targeted. [01:01:50] Many are clearly state sponsored. [01:01:52] Just recently, I didn't make it public on LinkedIn, but I had one that sent me a request and I traced it out and it was obviously fake and it was obviously from an unfunded place. [01:02:04] And it was in the friends list of a very well-known security researcher and I sent it to him. [01:02:11] And would you just speak to what a threat these are? [01:02:14] Because I don't think the average person out there is really making that connection. [01:02:20] And I know they're not taking the time to look into a lot of these requests they're getting. [01:02:24] And there are some out there, I'm sure, that are entrenched going back many years, which gives them a lot of appearance of legitimacy. [01:02:32] And it's just such a dangerous thing. [01:02:34] What's your thoughts on that? [01:02:37] No, it definitely is a threat. [01:02:38] I had one operational for eight years before it got nicked. [01:02:41] And she had over 12,000 connections, so on and so forth. [01:02:49] Several of them were media contacts asking for information about specific stories. [01:02:56] And this was like Robin Sage 10x. [01:02:58] The way I like to look at this, when I did Robin Sage 13 years ago, the threat landscape has gone up 10x. [01:03:08] LinkedIn has its uses and misuses. [01:03:11] Now, fake accounts can be used for numerous different things. [01:03:17] So, for instance, Facebook and Twitter, if you turn them into bots, they can burn up your marketing budget. [01:03:25] And that's how a business would understand it. [01:03:27] Because they'll constantly reply, they'll start to troll, they'll do things like that. [01:03:31] And you can literally build in your own specific AI to say all of that. [01:03:37] Okay? [01:03:37] It's not that hard. [01:03:39] Especially nowadays. [01:03:40] The other threat you have to think about is, okay, now that we have the great resignation going on, the easiest way to exploit people is be a recruiter. [01:03:53] Okay? [01:03:53] You post as a recruiter. [01:03:56] The one feature I did not like that Microsoft embedded in LinkedIn is they allowed you to send Word docs. [01:04:02] I hated it as a person, but loved it from, you know, the red team side. [01:04:09] Because now I can embed stuff in that Word doc. [01:04:12] And everyone's like, well, I got EDR. [01:04:14] I got this. [01:04:14] I got that. [01:04:15] It's all signature based. [01:04:16] All I have to do is change one line of code that hash value changes. [01:04:22] It's not going to be detected. [01:04:24] As soon as somebody opens it up to look at the job requirements, they now have access in it. [01:04:32] I wouldn't say root yet. [01:04:33] It all depends on the person's role. [01:04:35] All right? [01:04:35] Once you get in there, it's a whole different world. [01:04:39] If you go look at the MITRE ATT&CK framework, another specific thing, [01:04:42] go and look at how many of these threat actors actually start off with application security. [01:04:49] They'll do SQL injections, different things like that. [01:04:52] But the social media stuff is easy because it helps establish legitimacy. [01:04:58] And then, hey, can I have a conversation or so on and so forth? [01:05:03] You know, Daniel, you know, one of the other guys that normally comes in, [01:05:09] he's focusing a lot on the deepfake stuff. [01:05:11] So we've goofed around and said, well, how much data does it take? [01:05:16] Okay? [01:05:16] He gave us some sites, how we can use it, different things like that. [01:05:21] And as long as you have that collaboration and that knowledge share, you know, that's the key thing. [01:05:28] I mean, all of us here are on Clubhouse. [01:05:30] That alone is a threat in itself. [01:05:32] Okay? [01:05:33] Because stop and think about it. [01:05:35] What is your two-factor authentication with a bank? [01:05:37] Okay? [01:05:38] Okay? [01:05:38] Okay. [01:05:39] It's either a text message, which we can hack all day long, or it's your voice. [01:05:44] Well, I can take your data from Clubhouse. [01:05:46] I could take it from Twitter spaces. [01:05:49] Oh, by the way, if I compromised your password for your Amazon account, [01:05:53] and your wife has an Alexa at home, I can take all the data from that and build a persona around you. [01:06:00] It's not that hard. [01:06:03] You know, a lot of people are thinking it takes a lot of advanced tech. [01:06:06] They've made it easy enough for the average user. [01:06:09] So that's kind of where that risk is. [01:06:17] Thanks, Mike. [01:06:18] Hopefully that answered your question. [01:06:20] Thanks for popping up on stage. [01:06:23] Thanks. [01:06:25] Sounds good. [01:06:25] Thanks, Mike. [01:06:26] Jenny, over to you. [01:06:27] Maybe you want to ask Tom. [01:06:29] Hey, Tom, Tomas, and crew. [01:06:31] Tom, I wanted to actually commend you for all the work that you're doing to promote and support women in cyber. [01:06:41] You've certainly done that from day one from any room that I've been in. [01:06:46] You've also done a lot in your background to do that. [01:06:49] So I think it would be great for folks in the room to hear what you've done in your background to promote women in cyber, [01:06:57] because it's very impressive. [01:06:59] Right. [01:07:00] I always like to look at people based on mindset, because when I first went to DEF CON and I first went to Black Hat and, you know, 2600s, [01:07:11] there was no differentiating people. [01:07:13] It was just who can learn from each other. [01:07:16] You know, and that was a good part of the old days. [01:07:19] You know, everybody has a different mindset. [01:07:21] And you can, you know, when you start focusing, you know, who has what. [01:07:26] I personally always go to have a female on my team because they counterbalance the biases that I have. [01:07:33] I mean, my number one team player is in the room here. [01:07:36] She, you know, she puts up with the most of my shit and she's not going to say anything. [01:07:41] And she's going to get mad because I'm going to say it. [01:07:43] So if you look at the second row and followed by speaker section, yes, my wife decided to even come in and listen to this one. [01:07:50] So the women in cyber stuff is, it was kind of weird to me because I found it a lot easier to train women than to actually train vets. [01:08:08] I don't know if that sounds weird or not, but that's kind of how it worked out. [01:08:16] So one of my mentees, I'm looking to see if she's in here. [01:08:21] No, she decided, no, she's in here. [01:08:23] She's hiding. [01:08:24] She's hiding. [01:08:25] Oh, wow. [01:08:25] My boss is even in here. [01:08:27] Oh, this is interesting. [01:08:29] So one of my mentees is down there. [01:08:32] I'm going to call her out on this one because I told her not to call me out before and she has. [01:08:35] So if you go look at RP, my mentee, Renee Pollack, we started off while she was over at Peace University. [01:08:45] And talk about ambition and just wanting to learn everything about the space. [01:08:52] That was the key thing. [01:08:54] And then another one of my mentees, Morgan, she was the same way. [01:08:59] And everybody has a different driver and what pushes them to that. [01:09:04] So Morgan, who's not here, her driver was she went to a security conference and she heard somebody speaking and she felt she represented women wrong. [01:09:16] So by representing women wrong, she's like, I want you to teach me to be better than her in six months. [01:09:23] So basically six months of three days a week of teaching her what to do, you know, she was able to step up her game and, you know, truly be part of the team and go out and do a lot of the social engineering, pen testing, stuff like that. [01:09:40] And, you know, it's all about the drive and the passion. [01:09:43] And, you know, that's how I vote about it. [01:09:48] Thank you, Jenny. [01:09:50] Absolutely. [01:09:51] Thank you, Tom. [01:09:53] Thanks, Jenny. [01:09:54] Thanks for popping up on stage. [01:09:57] Before I go to Dave, Jax, are you back? [01:10:00] Hey, I am. [01:10:01] So sorry. [01:10:02] You must have called on me while I was away. [01:10:03] My apologies. [01:10:05] No worries. [01:10:06] Go for it, Jax. [01:10:06] Yeah. [01:10:07] So, Tom, great discussion. [01:10:09] So happy I was able to make it in here. [01:10:11] Something that I always like ponder about and think about and I would love to get your thoughts around is, you know, we look at breaches and we see that 90% of breaches are caused by human error for one reason or another. [01:10:25] But we seem to, as an industry, rely more on technology to protect our network. [01:10:31] And we're still having a rise in these breaches. [01:10:34] So my question to you is, should the focus be more on stopping the bad actors or should we shift to educating the public around and understanding what does a phishing email look like, how to stop things like that before it gets to our network? [01:10:50] What are your thoughts? [01:10:51] I think it's a multi-phased approach. [01:10:55] Well, the phishing stuff works out great, but it also depends on your policy. [01:10:59] Some people have a policy of, you know, you'll get fired if you click on it three times. [01:11:05] I think that's the wrong policy to have. [01:11:08] You know, and that's the tricky part. [01:11:11] How do you teach people to make that more informed decision is how I look at it. [01:11:17] And then, you know, kind of reward them. [01:11:20] And then they think about, okay, I want to keep doing this. [01:11:23] And who knows, maybe it may even drive somebody to do that. [01:11:26] I guarantee you, I can send a phishing email to all the lawyers on stage. [01:11:29] That'll be easy. [01:11:30] But that's the reality of it. [01:11:37] I mean, have I ever, I know the first time I was hit and it wasn't from a phishing email. [01:11:46] It was from going to the wrong website. [01:11:48] And then I got hit with a browser exploit, which basically I remember it specifically because it made me research. [01:11:57] It was Burboo B. It was back in 2002 because it dumped all my passwords. [01:12:04] And I remember I did it because shortly before that, I found a hack that was like the first hids, like personal hids for home. [01:12:16] You know, and the situational awareness is a key thing. [01:12:20] But how do you teach it at scale? [01:12:22] I think that kind of has to be taught in school. [01:12:24] I'm not the biggest fan of university, so it shouldn't be there. [01:12:29] It should be done way before then. [01:12:31] And I always tell everybody from a hacker perspective, the youngest hacker on record right now is a nine-year-old hacking blackboard to change his grades. [01:12:41] Okay? [01:12:42] Now, when people learn this stuff, now what happens to a female if her boyfriend does it to her? [01:12:51] It's a different situation. [01:12:52] Now, from a work purpose, human's always going to be the problem. [01:12:59] Okay? [01:13:00] You take away all that type of hacking. [01:13:03] I walk up to conferences all the time. [01:13:05] When you work in competitive intel, you know the right people to talk to. [01:13:10] You, of all people, should know that based on your background, how easy it is for you to get information out of people. [01:13:16] You don't take it technically. [01:13:18] You take it to the conversation level. [01:13:20] Okay? [01:13:23] And how much information can you get to help them out? [01:13:26] Nowadays, there's so much tech out there, it's easy to find back doors. [01:13:31] It is. [01:13:31] Like, in my previous room, Alex was talking about RDP being open for the ransomware guys, stuff like that. [01:13:38] And then I turn around and look at some of the tools that are out there. [01:13:43] You can find that. [01:13:44] Just go and look at census.io. [01:13:46] You can, you know, if you know Jeremiah Grossman, his new stuff, BitDiscovery. [01:13:50] Holy cow, the stuff that that finds. [01:13:53] When you don't know your external assets, that thing is phenomenal. [01:13:59] You know? [01:14:00] And I'm sorry if I'm talking tools, Thomas. [01:14:02] It's just, you know, when you're out there, you're looking. [01:14:05] Okay, what works? [01:14:06] What doesn't work? [01:14:07] You know? [01:14:08] Luckily enough, it's too expensive for threat actors, but that's a different story. [01:14:13] You know, census.io, when Log4J hit, I literally just went in there and Googled it. [01:14:20] Well, it didn't Google. [01:14:21] I searched for it in census.io. [01:14:22] And all the different companies that had it exposed, I was like, wow. [01:14:28] And that's because census.io scans the internet like every other day. [01:14:34] So finding these holes is easy, but also finding the most vulnerable ones. [01:14:40] I've always found that the hardest people to teach in an organization is the executive assistants. [01:14:46] You know, as the ones who report to the C-levels, because they feel like they have a lot of power. [01:14:51] But they're also the main target. [01:14:55] So if I'm going to hit somebody, I'm going to hit them because they have access to the C-level. [01:14:59] And then the C-level after that. [01:15:01] Or if the C-levels have drivers, hit the drivers. [01:15:05] Because they're the ones with the power authorities. [01:15:09] But that's me personally. [01:15:11] I hope that helped answer it, Jax. [01:15:13] It did. [01:15:14] Thank you, Tom. [01:15:15] And one last thing. [01:15:16] I want to concur with what Ginny said earlier about your support with women in the industry. [01:15:20] You are the best. [01:15:22] Thank you. [01:15:26] Awesome. [01:15:26] Thanks, Jax. [01:15:27] I do fear Jax, Tom. [01:15:29] So watch out. [01:15:31] No worries. [01:15:32] No worries. [01:15:33] Thanks for popping up on stage, Jax, and asking your question. [01:15:37] There was something that I was going to agree with you, Tom, on your comment around admin assistance having a lot of power. [01:15:44] I completely agree with that. [01:15:46] I tend to always focus on education awareness with admin assistance as well. [01:15:52] Because they are key holders, if you will, to a lot of power for some senior executives. [01:15:58] But anyways, Dave, thanks for popping up on stage. [01:16:02] Anything you want to ask Tom? [01:16:05] Hey, Tom. [01:16:05] Great room as usual. [01:16:06] And hey, Tom. [01:16:07] I'm really, really enjoying the conversation tonight. [01:16:12] I spend a lot of time, as you know, mentoring young people. [01:16:16] And you had a comment about learning about risk and cybersecurity in university a minute ago. [01:16:23] So as you look at this next generation that's coming of age here and you talk about, you know, the nine-year-old hacker and things like that, what would you say to young people that are looking at this big, broad industry and trying to figure out where they fit into it? [01:16:51] What advice would you give to a young person looking at cybersecurity as a whole? [01:16:56] What areas do you think are growing a lot? [01:16:59] And what are some of the best ways that our young people can explore this industry in a positive way and best ways to learn? [01:17:15] That's an excellent question. [01:17:17] So young people are, you know, they're the future, let's face it. [01:17:22] And they're learning so much faster than I can think of. [01:17:27] So the reason why I say that, I've told this story several times. [01:17:30] So my daughter, she's 14 months old. [01:17:33] Okay. [01:17:34] She wants to get on the Internet. [01:17:35] She knows if she takes mommy's phone, she goes and puts it up to her face and she gets on the phone because she likes to FaceTime people. [01:17:43] That's 14 months old. [01:17:45] Okay. [01:17:45] Okay. [01:17:45] Okay. [01:17:46] Now, think of where they'll be in the future. [01:17:50] I think we have to really start revamping the education system. [01:17:55] And we have to stop focusing on people in universities. [01:17:59] I think what we need to do is, you know, you know how we used to have all these different trade schools, you know, was part of high school. [01:18:07] Imagine if we did that with security. [01:18:09] We created a cybersecurity trade school. [01:18:13] Okay. [01:18:13] That would also help solve a lot of different problems. [01:18:16] But it would really help with the diversity problem where people can't afford to go to these schools. [01:18:24] Because if you go for a cybersecurity course, you know, at a university, you're out $100,000, $200,000 in debt. [01:18:30] Okay. [01:18:31] Now, what if it was part of your normal learning? [01:18:35] And that's also where you take that training to the students. [01:18:39] Okay. [01:18:40] Because now that they're talking about these things like the metaverse and everything else like this, it has to be taught younger. [01:18:48] Because when I, and Jennifer and I talk about this all the time, it's changing the threat landscape like you would not believe. [01:18:57] So imagine a world of AR and VR. [01:19:00] Okay. [01:19:00] We have all this cool tech. [01:19:02] Now, imagine how that's going to change the threat landscape for insider threat, for competitive intelligence, for social engineering, you know, for data that's lost. [01:19:15] Okay. [01:19:15] You go on Facebook, you're wearing your goggles, your goggles focusing on your retina and all this other information. [01:19:21] You have high security areas. [01:19:24] Where is that information? [01:19:25] They need your retina scans to get in. [01:19:29] And that's kind of how I'm looking at it. [01:19:31] It's drastically going to change it. [01:19:33] And that's why it always comes down to the mindset. [01:19:35] So I think differently than Katie. [01:19:38] I think differently than Tomas. [01:19:40] Now, imagine getting all these people together. [01:19:42] How do we fix this problem? [01:19:45] You know, if there's other people in the audience from, you know, different schools, how would we go about and start a trade school and do a pilot program and see if something like this works? [01:19:56] I love that, Tom. [01:19:57] What a great concept. [01:20:01] Yeah, I also love that. [01:20:03] I'd be highly interested in helping to collaborate on a citizen-led, like, cybersecurity 101 sort of, like, we could even do it as, like, a YouTube channel as a proof of concept to prove to the schools that it would be a valuable course to incorporate. [01:20:18] Honestly, I think Udemy and a bunch of the other coursewares out there kind of prove that. [01:20:26] Because me personally, I – so one of the things I didn't tell in the story, one, I never went to college. [01:20:32] Okay? [01:20:32] I wanted to go to Pratt, but I didn't have the $8,000 a year to go. [01:20:37] Yes, an art school, because guess what? [01:20:39] I was pretty damn good at my little pieces while I was doing graffiti, so I kind of went that way. [01:20:45] But that perspective, I mean, I also look at if certain things didn't happen, where would I be? [01:20:52] What if I stayed in the military? [01:20:54] What happens if this? [01:20:55] And I just think Destiny has its own course, and I think the course kind of has to be we need to build a trade school, especially with the big gap on this. [01:21:03] YouTube is great for learning, but it's also great for poisoning people's minds, because if you go to the panel, it could be a lot of misinformation. [01:21:12] I totally agree. [01:21:13] I'd also be on board with contributing to anything like a trade school and would be happy to help collaborate on that. [01:21:19] Yeah, this is David. [01:21:20] So I totally agree with you guys, and there is something out there called the Cybersecurity Workforce Alliance that actually has a partnership with Department of Labor, [01:21:33] and I think they have like four, eight, and like 14-week credit-based courses that give you on-the-job training, like apprenticeship training, [01:21:43] that target both individuals in high school as well as college individuals as well. [01:21:52] And I think they have approvals from the Department of Labor to kind of do it through an apprenticeship program. [01:21:58] Yeah. [01:22:02] So, Tom, I've been working a little bit, I think, you know, on a high school curriculum, just on risk management. [01:22:12] The idea of a trade school, that's really cool. [01:22:16] And, David, thank you for the information on that Workforce Alliance, too. [01:22:23] But, yeah, I'd be happy to contribute however I could to something like that if anybody ever does spin that up. [01:22:30] I think the idea of focused trade schools, you know, we've seen people run back in the early 2000s, run MCSE boot camps and things like that. [01:22:42] But I think that a different approach to education is certainly something that we need to be taking a close look at, [01:22:52] especially as automation and AI continues to sort of move forward. [01:22:58] It's going to be really important that we're giving our children options and people that have to change careers, [01:23:07] that optionality of being able to have pragmatic coursework taught by people that are practitioners. [01:23:16] Yeah, David, I couldn't agree more. [01:23:18] The current education system was built for the industrial revolution, right, to have people in factories. [01:23:24] So it's completely outdated. [01:23:27] And you're hearing a lot about this right now, right up there with health, the health industrial complex and the educational industrial complex. [01:23:33] So we're moving to trade schools. [01:23:35] And as David said, internships with hands-on training, you know, is picking up a lot of steam and speed, which is awesome. [01:23:43] So I'm happy to help or get involved in any way that I can. [01:23:47] But, yeah, great ideas. [01:23:49] Yeah, definitely great. [01:23:51] Definitely good ideas. [01:23:52] And look, I was reading something the other day where someone, I think it was a woman, was on in the metaverse, [01:24:00] and there was some sort of activity that was happening that was not, I guess, not favorable. [01:24:08] I think it was some online groping or something like that. [01:24:10] So I don't know how that sort of works or plays out, but I think there definitely needs to be a focus on what this new world will look like for our youth and how we're going to, you know, not only our youth, but our adults and how we're going to navigate that. [01:24:25] So very, very interesting comments, Dave and others. [01:24:33] Daniel, thanks for popping up on stage. [01:24:35] Anything you want to ask Tom? [01:24:36] Yeah, Tom, I, as a question, this is going to be a hard left turn, but here it goes. [01:24:44] I guess I was just wondering, I get the impression that you've had a fairly large amount of experience in the cybersecurity world and like as an actual day job. [01:24:55] And that is unique to the people that I interact with that have a lot of cybersecurity experience. [01:25:03] And so I'm just wondering in the course of your day job, before you got into an actual cybersecurity role, how much pushback did you get when you tried to raise concerns about like cybersecurity related topics at your day job when that wasn't actually part of your job description? [01:25:19] And hopefully that makes sense. [01:25:20] Oh, tons of pushback. [01:25:25] That one government agency, there was tons of pushback. [01:25:27] Um, and then the other one was when I had the VP of R and D position, I truly learned the politics of business. [01:25:36] I found one exploit in site minder that I could use all day long and pen tests. [01:25:43] And the problem back then is it took so long for them to fix. [01:25:49] It literally took three years. [01:25:50] So that was the golden nugget for three years. [01:25:54] Cause now I bypassed your single sign on solution all day long. [01:25:59] That's a lot of pushback came back from there to where one of the bank executives told me, well, if you ever make this public, I guarantee you will not work in this industry again. [01:26:09] Said, all right, I'll just copy and paste this into your reports for the next three years. [01:26:15] And I did weekly reports. [01:26:17] So just expect to see it. [01:26:18] He said, okay, thank you. [01:26:19] Well, that's a little reminiscent of some recent experiences I've had. [01:26:28] I've had, um, thanks for, for sharing that. [01:26:31] Um, yeah, it's not always popular to, to raise a red flag when people that are in positions that are higher paid than you are officially aligned to the thing that you're talking about. [01:26:42] Haven't already raised that red flag. [01:26:45] That's for sure. [01:26:46] Other ones I've run into, and this is, uh, this is where hosting comes into play. [01:26:52] And it's something I've done in sales a lot. [01:26:56] So it's knowing the people you're going to talk to. [01:26:59] Okay. [01:27:00] I'll give you a little advice basically because this helped me out in business from talking to my own company executives to, you know, meeting with customers. [01:27:11] I use a little browser plugin. [01:27:14] Okay. [01:27:15] And basically it, it'll tell you everything about the whole personality of the person you're about to talk to. [01:27:26] Okay. [01:27:27] And the reason why is because then you, you know how not to say the wrong things because my biggest problem. [01:27:36] And I'm sure those of you that know me, my biggest problem is I'm kind of brutally honest. [01:27:42] Right. [01:27:43] And that's just always how it's been because I expect people to be the same with me. [01:27:49] So that's kind of how it works. [01:27:54] I hope that helps. [01:27:56] Uh, it would help more if you could tell me the name of the browser plugin that helps you not be brutally honest or touch on the topics that are going to be red flags. [01:28:05] No, that's literally the exact S show I walked into. [01:28:10] That's called finding a, finding an ally internally in the company and, uh, getting them to help you sort of navigate those, uh, political bombshells or landmines, if you will, not bombshells, landmines. [01:28:23] That might be a helpful. [01:28:25] Try this plugin called crystal nose. [01:28:28] K N O W S. [01:28:30] Crystal. [01:28:31] Thank you. [01:28:32] C R Y S T A L. [01:28:33] It will profile the person you're about to talk to. [01:28:36] Thank you so much. [01:28:38] From a disc perspective, you know, because the key things are everybody's looking at personality types. [01:28:45] The hardest problem for people in the cybersecurity spaces, you know, we're a bunch of fricking introverts. [01:28:53] Most of us, you know, the only reason why we're talking to each other on this app is because guess what? [01:29:00] Well, it's other geeks. [01:29:02] So there's a little trust right there, but just your full trust. [01:29:05] And it's kind of how I look at it. [01:29:08] Thanks. [01:29:12] Thanks. [01:29:13] It looks like the app may have been rebranded to crystal. [01:29:15] Anyone looking in the, uh, the website is still crystal news.com, but the Chrome app is called just crystal. [01:29:21] Anyone who's interested. [01:29:22] Cool. [01:29:23] Thanks, Daniel. [01:29:24] Thanks for popping up on stage and asking your question. [01:29:27] Tom, uh, it's about 9 23 PM Eastern time. [01:29:30] I know you've had a long day. [01:29:32] We're going to ask, ask you probably a few more questions, but, uh, uh, really, really gonna, um, ask if there's anybody else that has any questions for Tom, uh, and you want to jump up on skills. [01:29:41] Please feel free to raise your hand and we'll bring you up. [01:29:44] Uh, I do see somebody with a party hat. [01:29:46] So welcome to clubhouse. [01:29:47] If you're new and you don't know how to use the app, uh, it's a little, uh, hand raised. [01:29:51] If you want to pop up on stage and ask a question, uh, but welcome to our fireside chat. [01:29:55] Uh, Tom, what are you reading? [01:29:57] What's in your, uh, audio books or physical books, anything, anything, uh, anything that you're reading lately? [01:30:06] Do you honestly want to know? [01:30:09] Absolutely. [01:30:10] Now I think we're all a little scared after that answer, but yes, edge of our city. [01:30:17] Be warned. [01:30:18] All right. [01:30:19] There's two of them. [01:30:20] So there's the man in the arena from Eddie Gallagher and then the subtle art of not giving a fuck. [01:30:29] That is a great. [01:30:32] Tell me about, tell me about that. [01:30:33] I love that book. [01:30:34] I have that also. [01:30:36] Tell me about that last one. [01:30:37] I got, I got to download that one. [01:30:40] Well, the other one you really got to read. [01:30:42] Uh, I'm shocked. [01:30:43] A lot of you have read the 48 laws of power. [01:30:46] Yeah. [01:30:47] I've read that one a couple of times, actually. [01:30:51] Robert green. [01:30:52] Yeah. [01:30:53] I mean, because my end game is not to sit here in sales forever. [01:31:00] My end game is literally, uh, you know, pretty much start my own business again. [01:31:08] And, you know, from my lessons learned, you know, go forward with that. [01:31:14] And ironically, when I do do it, I already goofed around with my boss. [01:31:20] I said, you do realize I'm actually going to partner with the company. [01:31:23] Cause I make more of a commission as a partner than I do working for you. [01:31:27] And he laughed at that. [01:31:29] Oh, wait, he's in the audience. [01:31:33] Awesome. [01:31:34] Hey, can I ask another question to Moss? [01:31:37] Go for it, Jennifer. [01:31:38] Okay. [01:31:39] This is going to follow on the books that you're reading. [01:31:40] Um, and actually I'm reading Chris Hagney's book right now. [01:31:42] I think it's called, um, hacking humans or emotional, whatever it's on social engineering. [01:31:47] How much of your, um, role and you've, you've discussed a lot of these examples and they are tools as well as a strong social engineering or strategic component. [01:32:01] How much of your, um, activities do you consider on that? [01:32:05] I would call it this sort of the soft side. [01:32:07] You can use tools to help with your social engineering, as you said, like Crystal knows, but, um, how much of it, it's also human intuition. [01:32:15] How much of your, your role do you consider like understanding that working with, um, you're working with clients, as you said, working with bosses who aren't going to accept your, um, recommendations or your findings, working with customers, uh, you know, designing Robin. [01:32:30] Robin knows. [01:32:31] I mean, that's a lot of, it's, it's not just technical tools. [01:32:34] It's a lot of savvy and strategy. [01:32:36] How much of your role do you think you contribute to that? [01:32:38] Um, you know, leverage those skills. [01:32:41] The tools, tools are always interesting because the one thing I've learned that's the greatest tool nowadays is all these marketing tools. [01:32:53] Because they're excellent intelligence tools. [01:32:56] Now with Robin, the tool I use is called Maltigo. [01:32:59] Okay. [01:33:00] Okay. [01:33:01] Cause I was friends with role of timing while I was building it out. [01:33:05] And we started building out all the different use cases behind it. [01:33:09] And what can I do if I have your business card? [01:33:13] Okay. [01:33:14] So now I have your name, every email, every phone number, you can gather a lot of information. [01:33:20] Well, what happens if I gathered your real resume? [01:33:23] Well, I can pretty much track down everything you've done on the internet and I can pretty much social engineer everything out of you. [01:33:33] Okay. [01:33:34] Okay. [01:33:35] I'm not the smartest person in the room. [01:33:37] There's other people a lot smarter than me in here. [01:33:40] So, and that's why I always say it comes down to mindset. [01:33:44] And sometimes that shared knowledge and mindset when you're working as a team is what makes everything happen. [01:33:50] You know, so when you're doing that, when I did Robin, you know, a bunch of people knew. [01:33:57] You know, Tom Brennan goofed around about it. [01:34:00] He knew. [01:34:01] The irony of it is there was another character that was created around the same time and they always accused me of being that persona. [01:34:10] But I won't mention that name. [01:34:15] The other thing is when you're doing investigations on these fake accounts, there's always part of the real person that's left behind. [01:34:25] Okay. [01:34:26] So that makes it easy to kind of figure out who it is. [01:34:29] You know, because believe it or not, we always leave a part of our real life in stuff that we created personally. [01:34:38] So the more you find out about a person from OSINT, the better your social engineering can be. [01:34:44] Oh, we lost. [01:34:45] Look, it is 9.28 PM Eastern time. [01:34:49] Mods, any final questions for Tom before we kind of bring us home? [01:34:58] No questions for me, Tom. [01:34:59] I'll tell you, this has been so engaging to see such a big crowd and the stories you've shared with us and just in so many ways, connecting the dots for old timers like myself and been around for a long time. [01:35:13] It's like, oh, that's why that happened. [01:35:14] It's just been so valuable. [01:35:15] It's just been so valuable. [01:35:16] So we definitely appreciate you sharing this evening with us. [01:35:18] Well, Russell, the key thing to remember is timeline analysis. [01:35:21] So watch for an event that happens and then watch what happens afterwards. [01:35:25] then you could kind of put together a story and then you can kind of pivot to where somebody else may be manipulating a story. [01:35:31] So we definitely appreciate you sharing this event with us. [01:35:35] Well, Russell, the key thing to remember is timeline analysis. [01:35:40] So watch for an event that happens and then watch what happens afterwards. [01:35:44] And then you could kind of put together a story and you can kind of pivot to where somebody else may be manipulating a story. [01:35:59] All right. [01:36:00] All right. Look, it is 929 p.m. Eastern time. [01:36:03] Before we kind of wrap up and go to final sort of words and things like that, I do want to remind everybody this is a weekly fireside chat. [01:36:10] We do this every Wednesday. [01:36:12] We've got a great streak going. [01:36:15] So please join us next week. [01:36:17] We do have the CEO and co-founder, I believe, Jessica Santana. [01:36:25] She's the co-founder and CEO of America on Tech. [01:36:28] So it's a great organization. [01:36:30] If you've never heard of them, please tune in next week, Wednesday, 8 p.m. Eastern time. [01:36:34] And we'll go through the conversation and get into know Jessica. [01:36:38] So with that, Tom, I'll leave you some final words. [01:36:42] Any words that you want to share with the audience before we kind of conclude? [01:36:47] So first of all, I want to thank all of you for having me in. [01:36:53] I figured my title is, you know, a solutions architect may not be good enough for the room, but you proved me wrong. [01:36:59] I'm shocked nobody asked the question why position, but that's for another time. [01:37:05] Now, with that being said, you know, final words for this, you know, just stay safe. [01:37:12] You know, the world's a crazy place right now. [01:37:14] And don't click on shit. [01:37:17] That simple. [01:37:18] Love it. [01:37:20] Don't click on shit, people. [01:37:22] Definitely don't do that. [01:37:24] And take care of your mental health. [01:37:25] If you're going through anything stressful, remember to take some time for yourself because it is tough times these days. [01:37:33] All right, Mauds, thank you, Tom. [01:37:37] Again, thank you for your service. [01:37:38] Thanks for taking the time out of your busy schedule. [01:37:41] I know you had back-to-back sort of clubhouse calls today. [01:37:44] So I appreciate it. [01:37:46] We appreciate you, you know, hanging in there with us and sharing your story. [01:37:50] It's been a pleasure, my friend. [01:37:52] And everybody, have a good evening. [01:37:54] We'll see you all next week. [01:37:55] Cheers. [01:37:56] Excellent. [01:37:57] Thank you. [01:37:57] Have a great one. [01:37:59] Thanks, Tom. [01:37:59] Good night, everyone. [01:38:00] Good night. [01:38:02] Thanks, Tom. [01:38:03] Good night.