Trust Is Not a Security Control: Blast Radius and the Management Plane

WEBVTT
1
00:00:00.000 --> 00:00:34.000
Think about not what will this look like when this goes wrong, but what will the logs look like when the tool's been being used with the proper authority, with a proper tool, from the proper account, at the proper time of day. How do you write a query for that? It gets a lot more challenging. I think a lot of people see trust as a control or a boundary, but if you have ansible crossing three trust boundaries, right, they're not really a trust boundary, but on some visio diagram they are, and that's what gets approved.
2
00:00:34.000 --> 00:02:20.000
My guest, Zach Miller, a security engineer who studies the tools we trust most, the ones that manage everything else. Kaiser, Salt, Stack this year, Stryker. Every time somebody called it unprecedented, zero trust asks, should this be allowed? Zach asks the next question, if it is, how far does it go? Thank you for joining me on another episode of the PrOTect IT All podcast, where I get the great opportunity to, to. To sit across from, even virtually across from people from all different perspectives, experiences, focuses. So I greatly enjoy all of these conversations. For those that haven't listened to this very often, just so you know, a little bit of kind of groundbreak or kind of the ground rules of my podcast is I usually don't prep for these, and that's not because I'm lazy. It's not because I'm too good for any of that. But I really want this to feel like an organic conversation. Like the first time that my guest and I are sitting down, like we're sitting down having a beer or a coffee or a cookie. And that's really the focus of that. And for me, it's the type of podcast I want to listen to it. It's not scripted. I don't give the guests preset of questions. They don't know what we're going to talk about. I don't know what we're going to talk about. I just really take it from that. So I, I appreciate the fact that my guests, like my guest today, is willing to come on without much knowledge of, hey, what are we going to talk about? Right? So, because that, that could be a little overwhelming, could be a little scary, but I try to make it as non, you know, scary as possible and just, just to be a fun time. So with all of that, Zach, please introduce yourself, tell the audience who you are, anything you want to share, background, et cetera, et cetera, et cetera, to get you where you're at today on the podcast.
3
00:02:20.000 --> 00:03:21.000
Yeah. Thank you, Aaron. Yeah. Hey, my name is Zach and I'm based out of Colorado Springs, and I Got my start working in it and I was originally a switch and route nerd. Worked for K through 12 education and really got to enjoy and appreciate the IT budget on a string and making things, making ends meet teaches you a lot about the technology and I think it helps break you from the. Like we, we always use these three tools together. Sometimes it can be an open source tool with the other two. And so that really helped me a lot. And then I had some really great mentors and some people that pulled me along. And now I work in defense contracting. Did some consulting, some msp and now I work for a company called in Colorado Springs and just excited to be here today. I read your book this, this last week and appreciated it and well, I was excited. I'm excited to tie a lot of things back to it, but my wife advised me to not do it too often and so I'll try to temper my excitement about that.
4
00:03:21.000 --> 00:04:53.000
Well, I appreciate it, man. You know, I, it took me a long time to put that together. We talked about a little bit before, but yeah, I really appreciate that. You know, it's a labor of love, all of these things together. So, you know, the fact that you're talking about, you know, the K through 12 and the education and the moving in all of us, and I talk about myself as well. You know, I started out in it. I started as a desktop support many, many, many years ago and then moved into network administration and server administration and virtualization and kind of that, that whole trajectory. About half my career was spent in it and then I transitioned over into critical infrastructure and OT, where I mean, I say this all the time. OTs, it's, it's not different. And it is, right? We're using the same, we're not using a different router. I mean most of the time it's a Cisco switch, it's a Cisco router, it's a Palo Alto firewall. Like, you know, we're using very similar tech that what we use in the, in the corporate enterprise world. Right. We just do it a little differently. Right. The use cases are a little different. Like the rule sets are different. I don't patch. Like there's just different things that I do or don't do depending on what we're looking at. But it's so funny how the value that you bring from that IT experience, you go into defense contracting, you go into K through 12. Like all those things make you a better person, a better engineer, a better cyber person for your current role. Because of all those things. Those aren't bad things. Those are great things because those experiences that you learned, you bring forth into the other roles and problems that you face today. Right.
5
00:04:53.000 --> 00:05:03.000
You have anything that you look back on real fondly from your. The introductory of your journey. Not anywhere specific. Could have been a dumpster fire or a mountaintop.
6
00:05:03.000 --> 00:06:36.000
There's so many that along the way. But I remember working at large company like AT&T and I was a server administrator and they had basically laid off all of the technology people in my. There were two data centers. There's one in Texas and one in Washington. And I was the only person left in the, in the Dallas or the Texas office. And I remember we were doing an Exchange Exchange 5, 5 to Exchange 2000 upgrade, which tells you how long ago that was, if you even know what that is. It was way long ago. And I remember sleeping in the data center because I was doing upgrades of servers and you would kick something off and it wasn't enough time to like go home and you need to be there to kind of check it. So I would like go to a conference room, go underneath the conference table. I had like pizza and drinks and a cooler. And I remember sleeping there by my. I was the only person at the data center other than the security guard sleeping there and working like, you know, insane. This was like for like three months. Every weekend of my life was spent upgrading because you could only do it on the nights and weekends. Like they wouldn't let you do it during the week because everybody was using their email server during that time. Like it was, it was a nightmare. But I had a blast at it too. And I learned so much because to your point, like there was nobody to. Nobody else was going to help me. I had to figure it out. I had to do it. You talked about shoestring budget, like AT&T has money, but there was no people, so I couldn't throw money at it. I just had to do it. And man, that it was some life lessons for sure.
7
00:06:36.000 --> 00:06:41.000
That's wild. Well, you definitely have. You've earned your, your points or your stripes on that one.
8
00:06:41.000 --> 00:08:22.000
That's right. Learning. Learning the hard way. And you know, there's, there's a lot of times in my career where you don't realize it when you're in it and you don't realize kind of the lesson that you're learning or the. What it's going, the experiences and how it's going to help you in the future. And whether that's. You're in the middle of an incident or you're going through a troublesome, you know, team member or a difficult boss or whatever those things are, all of those skill sets. Because that's the other piece to this along, along my career that I focused or that I didn't realize until later in my career because nobody ever told me. I always focused on, you know, books. Like I would be the mc, you know, whatever certification, I'd be the smartest in a certain discipline of things which were great. Right. Be the best hacker, be the best firewall guy, be the best server guy, networking guy, ccna. Like all the things. Right. But there's so much more to being really good at this thing that we do in cyber and all. Like, you talked about consulting. Like, to be a good consultant. Yes, you've got to be really good at all the technical things, but you also have to be able to understand and talk to people that don't understand the things you do in a way that doesn't make them feel stupid, in a way that makes them see the value in what you're trying to tell them and why they should care. You're basically a salesman and you don't think about it as a technologist. A cyber person doesn't think about themselves as a salesperson. Right. But you are, you're selling every person you talk to of why it's important that they do the things that they're doing. Whether you're writing a book or you're telling them in a conference room. Right. It's all about making them understand in a way that doesn't make them feel stupid, that, hey, this is important and this is why you should care.
9
00:08:22.000 --> 00:08:25.000
That's super articulate. It sounds like you've done this before.
10
00:08:25.000 --> 00:08:43.000
That's right. A few times. Yeah. Yeah. How about you? Like, what's, what's some lesson along the way, way, like K2 in the, in the K through 12 time. What is one of those stories that comes up that you're thinking back and like, man, that was, that was a big lesson learned. That really helped me to get where I'm at.
11
00:08:43.000 --> 00:09:09.000
Yeah. You know, I think probably one of the biggest ones was we had one of the clients had a proxy server set up and they had it set up in such a way so that they could monitor traffic and eventually they moved into SSL decryption. But for a while it was unprotected and it was open on the web. And as you know, when you have an unprotected proxy, it works really great for the people who are intending to use it, but it Also works really well for people who are not supposed to use it.
12
00:09:09.000 --> 00:09:10.000
Yeah.
13
00:09:09.000 --> 00:09:49.000
And so we real quickly experienced a functional ddosing of that proxy server. And that was one of the really early experiences I had of, oh man. You know, technology. We always worry about how technology is used in an incorrect way, but sometimes when it's used like it's supposed to, it still can cause tons of trouble. And that was a harsh eye opener to why, man, we have no bandwidth after lunch, but we have it now and then we don't have it on Tuesdays, but on Wednesdays we do. And it's just whoever was borrowing our proxy was playing a video game or, you know, listening to music or eating it up with YouTube. So I'd say that was a, that was a really stressful one from early on.
14
00:09:49.000 --> 00:10:23.000
Yeah. You know, it's amazing how many times that, you know, I've walked into, you know, again, being from a networking background and a cyber background as well. You know, when you're having things, issues with bandwidth, things like that, and then you, you start looking at the traffic and you start saying the security guard is watching Netflix and playing PS5. You know, there's your bandwidth right there, like totally. They're, they're streaming stuff at 3 o' clock in the morning that's on the same network as your process control network. So maybe let's, let's take a look at that.
15
00:10:23.000 --> 00:10:27.000
Classic. Classic. Oh, man.
16
00:10:27.000 --> 00:10:54.000
So, so how did you, how was the, what was the biggest difficulty as far as a transition going from the K12 to, you know, defense contracting? Because obviously those are completely different use cases, different budgets, different, different things that you care about as, as your clients, the things that your clients care about. And obviously the, the, the focus and attacks that could come at them. Like what, what was the bigger, you know, lessons or bigger, bigger hurdles that you had as a practitioner coming into those different spaces?
17
00:10:54.000 --> 00:12:29.000
Man, that's, that's really good. You know, I think people skills are pretty important and I know soft skills are touched on a lot, but being able to work in a situation where you're uncomfortable and someone else is uncomfortable is pretty big. And I think that might look a little bit different in a defense contracting environment where there's a lot of red tape and you need access to a resource and it's not available to you or there's someone who's not responding to your tickets. But I think the, the ground, the groundwork was laid. I think the benefit for me was that being in A K through 12 environment, you were handed the kitchen Sink. And so it was systems and networks and the microwave dish and you know, it pulling cable. It was like every, it was everything. You were the, the catch all. And so I think moving into an environment where there's boilerplate templates for rolls and they kind of just throw it out there and they're like, hey, this is what we need. And you don't know who's going to interview you or what they need for the role. I feel like I was able to just talk through things and demonstrate the breadth of my skill and some of it was having a friend on the inside. I'm a really sappy pay it forward person. I've had a lot of people help me out over the years and so I do my best to do that for others. So I got in, I got in the door because of VMware vSphere experience is what pulled me in the door. So it was not at all what I was expecting, right? I was like, you know, I have my, my Linux plus and I'm thinking I'm a Linux guru and I've got my switching route down and I could talk, you know, VLANs and we just need you to clone stuff.
18
00:12:29.000 --> 00:12:33.000
I'm like, okay, well I can do that too.
19
00:12:33.000 --> 00:12:34.000
A long winded answer. Sorry.
20
00:12:34.000 --> 00:14:28.000
No, no, that, that's perfect. Right? That's what this is, man. It's, it's, that's the, I get so many of these. So I go to conferences, I speak at conferences, I'm, I'm at, you know, I volunteer with ICS Village. So I'm talking with a lot of folks that are, you know, in higher education. They're, they're going after their bachelor's or their master's or many times even their PhD in cyber and all these spaces. I get so many questions like how do I get into X, Y, Z field? And obviously usually it's in the OT side but you know, the, the answer is usually the same, right? And it's, it's a networking, right? I've, I've been working for 30 years in technology. I'm, I, I turned 50 in a year and a month or so and I've been doing this since a long time, right. Basically right outta high school. I can count on probably one finger how many jobs that I've gotten in my career that I just applied for and didn't know someone, right? Almost every single job over a 30 year career has been because I knew now knowing someone's not enough, right? That gets you in the door. It gets you the interview Right. But you still have to deliver. I still have to do the work, all that kind of stuff. But. And I tell my kids this all the time as they're going out looking for just, you know, my son's 17, as he's applying for, like, you know, normal jobs, and I tell him like, hey, have you applied for a job? He's like, yeah, I filled out X number of applications online. I'm like, okay, what else could you do? Well, I don't know. What do you mean? I'm like, well, have you thought about just going into the store and trying to talk to the manager? He's like, why would I do that? I'm like, because every other kid that's your age is just filling out the application online. And I can't see. All I'm looking at is a resume with a bunch of words on it. I don't know anything. But when you walk in the door and I see you and I put a name to a face, I'm at least going to go look at your resume.
21
00:14:28.000 --> 00:14:29.000
Yeah.
22
00:14:29.000 --> 00:14:34.000
It's not going to guarantee you're going to get the job, but I'm at least going to say, hey, that kid did something different. Right?
23
00:14:34.000 --> 00:14:35.000
Yeah.
24
00:14:35.000 --> 00:14:51.000
So it's always that thing with almost every job I've ever gotten. And again, I think maybe one in my career that I just blindly applied for on their website and got the. Got the interview. Almost every one of them. I'm reaching out and saying, hey, Zach, I know you're at this company. Would you mind making an introduction to somebody? Can I.
25
00:14:51.000 --> 00:14:52.000
That's cool.
26
00:14:52.000 --> 00:15:05.000
Can I put you down as a reference? Because almost every company will put you to the top of the list of whatever the job is. And again, you still have to have the credentials, you still have to have the experience. You still have to do the work.
27
00:15:05.000 --> 00:15:06.000
Yeah.
28
00:15:05.000 --> 00:15:11.000
But at least it gets you a conversation where. Especially now with AI and all of these tools.
29
00:15:11.000 --> 00:15:12.000
Oh, man.
30
00:15:11.000 --> 00:16:32.000
I mean, I talk to recruiters all the time and they're like, we'll publish a job posting and we'll get 3,000 applications. Like, how do. How do you do? You can't, like, you just filter out 90% of those right off the top, and they never even get considered, man. Right. So if you're not doing this and you're not getting jobs, that's why. Because you're not. You've got to go around this, not go around, but you've got to use the system to your advantage and know you've got to do something that everybody else is not doing like, you got to find a way, make a connection, find somebody on LinkedIn. And just like you, Zach, I tell people all the time, hey, if I'm connected with somebody that you need to be connected to, I'm happy to make that introduction. I'm not going to say, hey, Zach and I work together for 10 years, and he's awesome. I'm not going to lie. But I have no problem making an interaction saying, hey, Zach was on my podcast. We had a great conversation. I'd like to meet, introduce you to Bob. Bob, this is Zach, Bob, etc. Etc. Right. Because that takes nothing out of my day, and it can absolutely help you or somebody else. Right. So I love the fact that you focus on that. And I think that the more that you give back, I truly believe in that whole karma idea of if you give good into the world, that that good comes back to you doesn't mean that only good things will happen. But for sure, more good things will come at you than. Than. Than not when. When you're willing to do that and go out of your way for those things. So that was a long winded answer, but that. That I'm very passionate about that piece.
31
00:16:32.000 --> 00:16:34.000
Thank you. I appreciate that.
32
00:16:34.000 --> 00:16:49.000
Yeah, of course. So. So what, what. What keeps you up at night? Like, what are you focused on? What do you. What do you like the most? What are you working on? Like, what do you. What doing are you. What do you want people to know about the space that you're in, the things that you're doing? All that type of fun stuff? Man.
33
00:16:49.000 --> 00:17:06.000
Ooh, man, that's a good question. You know, I think maybe starting with the thing that keeps me up at night, I'm just real excited how fast technology is moving, how much is coming into play, the cool things that are coming out of empowering people who are not traditional software engineers, who can. Who can make a demo, maybe not put it into a sales channel.
34
00:17:06.000 --> 00:17:07.000
Sure.
35
00:17:07.000 --> 00:17:31.000
But demonstrate something really cool and you know the Wayne Gretzky Gretzky quote, like, you skate to where the puck is going, not where the skate. You skate to where the puck is going, not where it's been. Yeah, I'm. I want to be. I'm trying to be that observant. Where's the puck going? And there's. There's only so many places where I feel like you can go and you can see what's happening in the cyber world at a traditional URL.
36
00:17:31.000 --> 00:17:32.000
Sure.
37
00:17:31.000 --> 00:18:14.000
But if you spend time looking at blogs and you. You read some of the the less common news, or you have a cyber community, you can start to pick up on some things that aren't in the news yet. And that's one of the things I'm trying to hone and get better at, is where do I look at the right time and what can I take from this information and is it valid? You know, vetting that information? And that was maybe a pretty boring answer. But it's really along the effort of. I want to. I want to continue to advance my career and develop skills because I feel like so many of us are the byproduct of time. You know, I'm at this job for five years, and so my skillset is the culmination of what happened at that job for five years.
38
00:18:14.000 --> 00:18:15.000
Yeah.
39
00:18:15.000 --> 00:18:26.000
But if I'm willing to learn a little bit outside, go to some networking events, watch over someone's shoulder who's way smarter than me once a month, it has a compounding interest on who you are as a professional.
40
00:18:26.000 --> 00:18:27.000
Sure.
41
00:18:27.000 --> 00:18:48.000
And so that's what I'm trying to. Trying to focus on. I do home lab a lot. I'm a space nerd. I picked that up from my last job. Amateur satellites. A ham radio guy. So I'm. One of the things I feel like, especially from my last job we learned is that some of the really cool RF stuff that happens in the world right now is treated like black magic because it can do some really cool things.
42
00:18:48.000 --> 00:18:49.000
Sure.
43
00:18:48.000 --> 00:18:55.000
And so I'm playing with SDRs in my home lab, trying to experiment with that. I think that that's maybe a good place for me to stop.
44
00:18:55.000 --> 00:21:08.000
No, those are all awesome things. So I'm. I'm right there with you. So I think the point and what I hear in that and what I want people to gather on from that is you have to be a. A lifelong learner. Right. I've got a. I've got a whole shelf of books over there. I've got. You know, and I just did a post today because I. I actually moved my lab that was right behind me before I moved in the other room because it's. It was just too hot. It just too much heat in this room. I don't have enough. I guess then you put like a mini split in here or something. But I moved it all out because I've just got so much stuff because I'm always tinkering. So I'm a ham operator. Have been for nice 15 years or something. I don't use it as often as some of my friends want me to, but, you know, I've done it because I dabble in all of these different things, right? And I'm constantly working on. And to your point, now, obviously, with AI, I can take something. And my. The limitations before where I needed a developer because, you know, I was a CTO of a company. It's not that I can't code. I can. It's just not my strength. I don't really love doing it. You know, I can read it. I can. I can do it. I've built thousands of scripts and all that kind of stuff in my life. And scripting is definitely different than product development. But the point is, is, like, now, because of AI, because I know what I want to build and how it works and how it functions, I can build something at least as a prototype really quickly to get something stood up and say, does this work? And what would be the problems of this? And then you could hand this off to, okay, if this makes sense, like, this is the idea, how do I do those? But even beyond that, like, I helped. So, like, you know, my son was. Is wanting to join the military, and he was going back and forth on, is he going to go the Army? He wants to go the Marine Corps. Now he's made his mind. But when he was going through that decision, I'm like, okay, what. What mos? What job do you want to be? Well, I want to do this. Okay, well, let's think about that. And not because I was trying to change his mind. I was just trying to make him understand. So I built an app that helped him understand. If you went in this mos, like, what was the bonus that they were going to give you? Like, what is your rank going to be, how much you're going to make? Like, what is a normal progression? Almost like a choose your own adventure, you know, kind of book, you know, followed the path. Like, what happens if you get hurt here and you can't go this path? What. What would be your option?
45
00:21:08.000 --> 00:21:09.000
What.
46
00:21:08.000 --> 00:21:14.000
Where are you going to pivot to? So it just helped him. I started out doing that, like, on a whiteboard.
47
00:21:14.000 --> 00:21:15.000
That's cool.
48
00:21:14.000 --> 00:22:04.000
And he was just kind of like. And then as I built it into an app, it, like, he played with it and I. It had everything from, if I put away a hundred bucks a month and investment, like, in 20 years, how much money would you have? Like, you know, all just little things like that. And I did it over a weekend, right. It didn't cost me that much, but it was a huge thing to help him. And I have this conversation about that's awesome. Choosing a path for his career. So you could do that for all sorts of things. But to your point, right, you got to skate where the, where the puck's going to go and AI is going to be here. We have to work with it. Like it's going to impact us. It can be a benefit to us, you know, like you said. I did, I did talk about it in our book, in the book that I wrote. Right. And it's, it's, it's one of those things that so many, I think so few non technologists probably don't get it. They probably are.
49
00:22:04.000 --> 00:22:05.000
Yeah.
50
00:22:05.000 --> 00:23:33.000
I'm not sure what they're building with it. I think more and more people are starting to kind of grasp the concept of it. But you know, I spend a lot of time with AI and I use it on a daily basis for work, for personal stuff, for, you know, I don't Google. You know, used to, that was the term for searching on the Internet. Right. It was Googling. I don't Google anything. I put everything into an AI. I use perplexity for that. And I'm not sponsored by perplexity, but if they'd like to sponsor me, you know, definitely reach out. But you know, I put it into perplexity because it's, I tell it what I'm looking for and it goes out and starts filtering those things down and builds me a narrative more than just a list of websites. Right. And that's the difference is, is it saves me time. I still have to check the results and make sure that I agree with them and check multiple sources, depending on what. Like if I'm looking for a, a dentist, I'm probably going to do more than just a simple perplexity search. I'm then going to go validate. I'm gonna go to those sites and check other sources. But if I'm just checking for a restaurant, like, hey, what's the, you know, how many burger restaurants are within a five mile radius of my address? I can just put that in there. And hey, which of these, according to Yelp reviews are the best? Which one should I try? And I, I have no problem giving that over to AI and, and giving it a shot and seeing what comes up with it. Right. What's the funnest thing you've built since doing this path as you've done technology, AI, what have you built? That's the funnest thing. Work related or personal? Whichever.
51
00:23:33.000 --> 00:23:35.000
You got me really excited talking about burgers.
52
00:23:35.000 --> 00:23:36.000
Okay.
53
00:23:36.000 --> 00:23:52.000
The most exciting thing I've built is not necessarily work related, but I took the heat map of my smoker and it allowed me to put in different sizes of meat or what meat it was. And it helped me figure out where to put meat and for how long so I could have friends over the smoker.
54
00:23:52.000 --> 00:23:55.000
Like where the hot spots in the smoker are.
55
00:23:55.000 --> 00:24:02.000
Yeah. I took bread, I put bread in there, turned it on high, and then I flipped it over and took pictures so I could see, you know, like how dark the bread was.
56
00:24:02.000 --> 00:24:03.000
Sure.
57
00:24:03.000 --> 00:24:15.000
So then I had my heat map and then I did like temperature and whatnot. So I was like, you know, I have some wings, some ribs, how can I stack this so that like half of it doesn't turn out dry?
58
00:24:15.000 --> 00:24:16.000
Sure.
59
00:24:15.000 --> 00:24:23.000
And of the four uses I used to, three of them were pretty good. The fourth one was just a disaster and I still don't know why.
60
00:24:23.000 --> 00:25:26.000
He got skewed somehow. See, that's a great example of something that. How would you have done that other than thousands of experiments over time, which is, you know, you look at these guys that do this competition, you know, they do competition stuff. They've, they've got their smokers, they know exactly all of those things, but it took them years to get to that level of experience. And thousands of pounds of meat of. Well, that didn't work out, that turned out dry. You know, the rub's wrong. Like in trial and error of those things. You fast track that by putting in some lowcost bread that is a heck of a lot cheaper than a brisket, a thing of ribs or you know, something. And you, you were able to use a tool to really get you to. And again, it's not even most people's primary use case of what's, what AI would do for it because it's not like a fancy app and it didn't. But it helped your use case, which is, which is the whole point. Like, be careful of what you put in there, don't put your Social Security number in there. But like those, that's a great, really great example of how to use AI for good.
61
00:25:26.000 --> 00:25:34.000
Yeah, thank you. My heart, I'm sure, was not happy with the cholesterol I got from those couple of months, but I sure appreciated it.
62
00:25:34.000 --> 00:25:39.000
No, that's all. I mean, you're going to eat it anyways. You might as well have it be better quality, right?
63
00:25:39.000 --> 00:25:41.000
So true, so true.
64
00:25:41.000 --> 00:25:54.000
So what about work stuff? Like how have you seen AI being integrated? Are your clients asking for more? Are they pushing it? Are you guys using it more in your daily processes? What does that look like for you on that side?
65
00:25:54.000 --> 00:26:25.000
Yeah, I think maybe I'd like to start at it from a unique angle before giving a traditional answer. But I've recently, over the past, I don't know, two months, had some really weird hokey mistakes that some of the agents have been making with some of the questions that I've been asking it. And I've had some, several hard learned lessons of like, I can give it all the guide guardrails I'd like, I can give it a clear prompt and I still have to verify the work that it does. And that gets harder to do when it's a lot of data or it's a lot of work.
66
00:26:25.000 --> 00:26:27.000
Yeah.
67
00:26:27.000 --> 00:26:29.000
Or it's tracking a ton of IP addresses.
68
00:26:29.000 --> 00:26:30.000
Yeah.
69
00:26:29.000 --> 00:27:48.000
And sometimes that context doesn't, doesn't last well or between sessions or it doesn't jump topics super well. And so I think I may be a little bit more apprehensive about it just because I've been burned. I'm no less excited about it. It's still a really great tool for me and I use it as well for personal and for work a lot every day. I think the, the big thing that I've seen it seen, I say documentation, like writing documentation, processing documentation is pretty big. Pulling out important parts, being able to ask it questions has been awesome. You know, of course data processing is big. I think I have an awesome book that's Data Analysis, Cybersecurity through Data Analysis. And at first pickup it's pretty boring. It's like, you know, what things do you glean from a lot of data? But that's at the heart of it. What I enjoy now in, in some of what I do is being able to take a large chunk of data and pull things apart. It makes it harder for when done well. I think it makes it harder for bad guys to hide in data, which I also, I feel like that was a pretty boring answer unfortunately. But I do see a lot of early adoption in it. I feel like people are pretty excited about it. My son uses it to make memes.
70
00:27:48.000 --> 00:27:49.000
Yeah.
71
00:27:49.000 --> 00:27:55.000
Cartoons about dogs. Yeah. So we've got some good adoption at home too.
72
00:27:55.000 --> 00:29:06.000
Those are, those are the good use cases there. Yeah, yeah, I do those as well. My kids will send all sorts of stuff. And that's the cool thing is you don't have to be an expert technologist to use it. Right. It can kind of meet you where you're at. And the data answer is a great one. Right. And it's always been data has always been where it mattered. Right. And. But before we were having to buy, you know, a really good analyst, knowing what good. I mean. So if I take a step back and I look at an operator at a power plant or, or at, on, on a manufacturing facility or whatever, like you're paying for somebody with gray in their beard that has been working that process and they can literally walk up to a machine and put their hand on it without any sensors, without any electronics, and they can tap. Well, that's not running right. There's something wrong, like vibration. It sounds different. Like the temperature's off. Like they can just tell because they've experienced it so much. I guess going back to the brisket that we were just talking about, right. Is that, that experience, that repetition, like seeing it like a good person that's that smoked a thousand briskets and is at that level, it's going to be really hard to. That doesn't mean that you can't compete with them.
73
00:29:06.000 --> 00:29:07.000
True.
74
00:29:06.000 --> 00:31:50.000
The difference between you and I is like, every once in a while we'll have a really great one. Every time there's is going to be that level, like every once in a while we're going to be like, wow, that was really amazing. And then sometimes you get one, you're just like, I don't know what happened. Like, I did the same thing I thought as I did last time, and the same thing didn't come out. And that's where the data comes in. Right. Is, is when you're with AI and to your point, you've got to be careful with it, but that's where the hidden, you know, the needle in the stack of needles is. And you got to know what you're looking for. And AI is really good at finding that. Those needles in the haystack now, they don't know really what's good about it or bad or, or indifferent. That's where it takes somebody that knows how to train it. And hey, this is what good looks like. And when they, when they show you that thing, that's the bigger problem is, is I can tell AI to write me a report on, you know, George Washington. And it'll, it'll write a report. But if I don't know enough about George Washington when I read it to know if the things it put in there are true. It could say he was born in, you know, 1248. And if I don't know that that's not right, then I'd be like, yeah, that sounds good. Sure. Right. So we still have to understand the outputs that it's giving us. And you, you talked about IP addresses and you talked about, you know, it builds reports and I use it a lot for building reports. And then I, And I also will have a peer, peer review me. So I'm looking at, AI is looking at it, but then I'm like, I don't see what I don't see. And it is listening to me. So we're probably close together and I have some random third party that comes in and I'm like, can you review this? Does this make sense? Like, what is it? So obviously that's part of consulting, but we do that a lot because I want to make sure that I remember it. I did the assessment, I walked down the plan. I did all those things. I, I put all the notes into the thing. I understand what it's there. I gave it the things. And then it's building this report. Did I miss something? Because I'm too close to it and I need to step back. Right. So you can do that by giving it different agents. So like sometimes, again, for your barbecue example, you could give that same results or the same data points to multiple agents, you know, chat, GPT and Claude and Grok and see what they come up with. And then I'll do that a lot of times, or I'll give it to all three of them and then I'll give each one of them, okay, I gave all three of you guys these things. This is what they all came back with. And let them understand the thought process of each one and say, okay, well, seeing if I can get a more consolidated finding. The, the mistakes in their logic, the things they make, the assumptions they made incorrectly. Because that's the other piece with AI is a lot of times it makes a whole bunch of assumptions for you because it wants to make you happy.
75
00:31:50.000 --> 00:31:51.000
Yeah.
76
00:31:51.000 --> 00:32:22.000
So you have to really be careful that it's not telling you what you want to hear and it's not making assumptions that you're not aware. It's making assumptions because a lot of times that's the thing I see is it makes a lot of assumptions. You're like, no, no, I don't want you to do that. That's not what I want. Yeah, I didn't say that. Oh, my bad. Let me take a step back, give you this information based upon not making the assumption that you want to, you know, burn your meat. You want your meat to be blackened and hard. Right. That's what you wanted. No, that's not what I want.
77
00:32:22.000 --> 00:32:31.000
That's well put. That's A good example.
78
00:32:31.000 --> 00:32:45.000
So, so what, what are the things on the, on that side that's kind of scary. Like you talked about a little bit about what keeps you up. Like what, what are on the, on the scary side of all that being used in these spaces? Like what keeps you up at night for, for that side of it.
79
00:32:45.000 --> 00:34:35.000
Yeah. You know, I really like the adoption of O365 and environments and how it's equipping small and medium businesses. You know, like you can now join devices to the cloud basically to an active directory in the cloud. You don't need a traditional server in house anymore. The downside of that is now anyone can sign into your domain from anywhere. And with all of the amazing tools offered in Micro Microsoft's wheelhouse, you now have a ton of logs to watch. And just in March the FBI released a memo saying, hey, be warned that bad actors are going to start trying to pop you through your own network. And so there's no longer this, I think let's look for the Russian IP address. Let's look for the North Korean IP address in our logs. It's not there anymore. Yeah, well, I mean in some places I'm sure it still is. But the more finessed attacks are things that are coming from an Azure address. You know, there's something being done in an Azure instance and done during the workday when someone else is working with stolen cookies that make it look like it was being done by a person. And so I'd have to wrap it up and say that this quick adoption, this technology that empowers people is also doing just as many good things for the baddies, for the bad guys. And that's, that's what stresses me out is we have all these seam tools and these seam logs and we have Soar and we have all these things that are good, they really are good and they're watching a lot of the attack surface. But where they don't watch, we don't know until there's, until there's a fire. And if that fire, if there's no firewalls, then that fire spreads really quickly through a house. And so that's, that's my stressor right now.
80
00:34:35.000 --> 00:37:15.000
Well, you know, and I hit on this in the book as well, but you know that we bring these devices home and we plug them into my home network because everybody works remote. Even if they don't work full time remote, you're still bringing your laptop home with you because everybody has a laptop. Very few people have a desktop anymore. So you take your Laptop wherever you go, whether it's the hotel or at home. I bring it home and I plug into my home network. Well now it's sharing the same network as my kids, you know, Roblox or whatever else that they have. So now I've put it on there. So now it's an easier attack path. So you know, the bad actors can get to my kids device because I, maybe I didn't, I don't have protections on those things or my kid installed something and I didn't know about it. Well now it's sitting on the same network. So it's hitting my device from the same network. And if it gets in then it's coming across that path. It's not coming across from a Russian address. It's coming across from Aaron's network. I expect to see traffic from Aaron's network. So I'm not thinking about it. So there's, to your point, it, it's, it's. We're, we're, we're introducing all these problems and I get it. It's a hard problem. You know, we, we have clients that'll actually, they want like we protect like we're doing cyber services for the company. Let's say, you know, ACME Corporation, whatever. Acme Corporations C suite. They want us to protect their homes, which is weird, but it's not if you think about it, right. If I got access to the CFO's home computer and they, they're on that computer and those, it has credentials, vpn, whatever, into the corporate network. That's really risky. So as an attacker, would I rather go to you know, the corporate headquarters and have to break in physically there and all the security things that are there or go to the guy's house when his, his maids there and nobody else is at the house and have all day long. Right. It's the Terminator thing. Right. They didn't go to the scientists to get into the, the where the, the, the robot stuff was. They went to the guy's house so that he would get them in. Right. They convinced him to do it. That's the attack path. Right. That's so much easier than the other. And now with AI and everybody working remote, Covid's really pushed us to everybody works remote and that you know, we instantly, everybody had remote access. Raise you to request it before everybody has it now it's just expected. So like we've, we've widened our attack vector like exponentially. Yeah, we are, we are not able and AI can help us with this. But it also is hurting us in that there's just so much data. To your point, like, how do you, how do you know everything that's happening is good and not bad? Even if it looks like Aaron sounds
81
00:37:15.000 --> 00:37:16.000
like it stresses you out too a little bit.
82
00:37:16.000 --> 00:38:50.000
It does. And it, it's happening everywhere, man. It's happening at, you know, power plants and, and this pharmacy and manufacturing and you know, the corporate headquarters, you know, and you look at something like a, you know, a FedEx or a large company. I'm just throwing out a big company name, right? If something happens to them, they've got, you know, insurance policies and they've got big budgets and, and they can sustain. But what if this happens to a small business, a medium sized business, right. Not that, you know, they're doing all the things right, you know, they've got something, they're monitoring stuff, whatever. But if they get their systems taken down by ransomware and they can't do business for a week, yeah, they're, they may or may not make it. And yeah, they can't pay the ransom. Like they don't have millions of dollars. And even if I think everybody knows by now, just because you pay the ransom doesn't mean you get your stuff back. Like, it's not guaranteed. You're dealing with criminals, so they may or may not release your stuff. So it's a, it's a big problem. You know, critical infrastructure is a big one, obviously. Water utilities, we've seen a lot of things here recently and hitting the water utility districts and you know, it's, it's the path of least resistance. I'm not going to attack the bad guy. You know, I'm not, I'm not going to go after the guy that's, you know, got all the defenses and the security and you know, it's got a gate and a guard and dogs and all the things. I'm going to go to the house next door that they're, they got a screen door and nobody's home and there's no lights on and like I'm going to go to the easy path, right. I'm going to go to that door instead of the front door that's barricaded. Right.
83
00:38:50.000 --> 00:38:51.000
It's just so smart.
84
00:38:51.000 --> 00:38:53.000
Yeah. I mean, that's what you're going to do. So.
85
00:38:53.000 --> 00:39:03.000
Yeah, it makes me think a little bit about the, the old adage, the, the humorous adage. Of course, you know, if you're outrunning a bear, you don't have to outrun the bear. Just you're just your Friend.
86
00:39:03.000 --> 00:39:28.000
That's right. You don't have to be the best or the fastest. You just don't. You can't be the slowest. You don't have to outrun the bear. You just have to outrun your friend. Right. That's triple whatever you got to do. And it's, it's sad, but it's true. Right? It's, it's. We're at that space where you're never going. And this is the other piece that I think people are under. Start understanding. Or maybe they. Hopefully they are. You're never secure.
87
00:39:28.000 --> 00:39:29.000
Yeah.
88
00:39:28.000 --> 00:40:17.000
There's no such thing as secure. Like, you're never done. Like, it's never, there's never. Not a hole. There's a zero day you don't know about. If we've seen anything from the hugging face and all the different examples of mythic and all the stuff in AI, there's an infinite number of zero days that we just don't know about yet. Right. So we're never secure. And even if you are, you know, the analogy or the, the example I've. I've given a hundred times. And people talk about like the Terminator when we just talked about. Right. I don't have to hack you. I can just walk up to you and say, if you don't walk me in, I'm going to kill your family. It's very graphic. I'm sorry to say that. But yeah. If I did that to you, I've got kids. If somebody did that to me, I'm going to give them whatever they want. Because I'm not. It's. It's my work. It's not. It's my family.
89
00:40:17.000 --> 00:40:18.000
Yeah.
90
00:40:17.000 --> 00:40:21.000
All they want is my login here. Yeah, of course.
91
00:40:21.000 --> 00:40:23.000
Yep.
92
00:40:23.000 --> 00:40:49.000
So nothing is going to stop somebody from doing those things. So we've got to make sure that we understand risk is. You can never get a risk of zero. Like, you have got to understand that risk is never zero. You want to, you want to monitor it. You want to mitigate. You talked about firewalls. I want to isolate and segment so that the risk is. I don't want my entire organization to burn down. Let's compartmentalize. So if something does happen, Aaron doesn't have access to everything.
93
00:40:49.000 --> 00:40:50.000
Yeah.
94
00:40:49.000 --> 00:42:21.000
They'd have to do that to 100 people or 5 people or 20 people or whatever that is. I can segment those responsibilities is a reason we have delegation of authority. If you think about, you know, if you took an accounting class in college, you know, there's a reason why your Financial officer doesn't have the ability to, you know, do the books and, and make the payments like you separate those tasks. That way one person can't cook the books because if he's the one writing the, the bookkeeping and he's also the one making the payments, he can pay himself and, and write it off the book so nobody sees it's happening until it's. Wait. That's how people embezzle money. Right. It happens all the time. But there's a reason why you have that delegation of authority in, in a larger organization. Right. It's the same concept in, in, in technology and cyber and all the things that we do is segmentation. Right. The segmentation concept is not something we built in cybersecurity. That thing has been designed for eons of segmenting our environment, our, our neighborhoods, our, our houses. You know, fireblocks. You know, firewall didn't come from a network device. That term. Yeah. Existed before network adopted that term because it meant the same thing. I want a segment so that if a fire happens on that side of the road, I've got a block that stops the fire from coming over here. That's literally what a firewall is. I go down these, these, these rabbit holes of, of of deep dives. But you know, it's, it's fun in that helps to people to understand.
95
00:42:21.000 --> 00:42:22.000
Yeah.
96
00:42:21.000 --> 00:42:24.000
Or the goal is to help people understand. Right?
97
00:42:24.000 --> 00:42:25.000
Yep.
98
00:42:24.000 --> 00:42:50.000
You're never good. It doesn't matter where you're at, you can always get better. Like you have the best. You could spend a ton of money. You can have a team of 100 people and you can still improve. Or you can be a one man shop doing the best you can. And you, that doesn't mean that you can't win. You can still win one man shop and you can do great things. Like don't get discouraged because you don't have a huge budget. Don't get discouraged because you know you're not able to get the product that you want. Do the best that you can with the resources that you have.
99
00:42:50.000 --> 00:43:34.000
Mm, yep. No, I totally agree. And I feel like that's one of the benefits of the AI right now is we have the ability to champion ourselves. I think the place where I'm starting to see that maybe that pull ahead too far as we have this desire to streamline things and save on labor. And that's a good thing. Right. Like saving on labor enables new jobs and it provides bonuses at the end of the year, hopefully depending on the role that you're in. But as soon as we start to streamline that work so that we can have less eyes on sensitive processes or systems, we can end up having a situation where that fire starts and we're not able to catch it before it gets too big.
100
00:43:34.000 --> 00:43:35.000
Yeah.
101
00:43:34.000 --> 00:44:22.000
And I, I, I get a little, I'm surprised. I don't know if surprised is the right term but you know, Kaseya and Salt Stack were in like 20, 20, 2021. We saw that the management's plane abused. And you touch on Stryker in your book really nicely. I really enjoyed that, that section. We've had five or six years to see what happens when we give too much concentrated authority to a system and then we have Stryker and intune hit, you know, five, six years later. It's like, oh my goodness. And it was treated depending on who you were talking to. It's like, wow, this is really unprecedented. And so we have all these attacks that have, I think, a similar shape, but people are like, oh, that's unprecedented. Almost as if, like we shouldn't be surprised, but we are, you know.
102
00:44:22.000 --> 00:44:23.000
Right.
103
00:44:22.000 --> 00:44:50.000
And so this, one of the things that I've been working on in some of my free time is this concept of blast radius. And it's, it's real similar to zero trust, but not quite the same in where like zero trust might say, should this be allowed? Where some of the blast radius that I've been trying to experiment and play with at home is if this is allowed and something blows up, how far does it go? For example, like Kubernetes, you know, you might like have namespace scoping that can help control that blast radius.
104
00:44:50.000 --> 00:44:53.000
Sure.
105
00:44:53.000 --> 00:45:06.000
Microsoft came out with the fix for Stryker. You know, it's multi admin approval, which is great. But if you have a global admin, you can make yourself another account to be the multi admin approval.
106
00:45:06.000 --> 00:45:07.000
Yep.
107
00:45:07.000 --> 00:45:35.000
And so it's like the fix came after it was already exploited. And for a lot of people going back to your segmentation thing, like we've all known about segmentation for a long time. It's a hard sell to tell an organization, hey, break up your MDM plane. Let's make it so that you need seven accounts to administer 20,000 devices. But had they, we might have had a different outcome depending on how that global admin account was compromised.
108
00:45:35.000 --> 00:45:36.000
Yeah.
109
00:45:36.000 --> 00:46:28.000
And so I feel like this, now's that time we just had that Stryker event. Now's that time to talk about, hey, how are, how are we delegating trust? How are we delegating authority? And some of the Ways I've tried to experiment with that in my own role is reach authentication, scope, crossing standard privileges, human concentration, automation, visibility and recoverability as a way of looking at the shape of infrastructure, because Splunk is centrally located and can see even the entire environment. But Splunk can't go and automate or touch 20,000 devices to brick them. And so I'm trying to look at infrastructure more than just vulnerability in configuration and compliance. But what happens when this catches fire? What does it do to the organization?
110
00:46:28.000 --> 00:48:27.000
Yeah, yeah, yeah. The analogy I give on that one, on the, on the use case, right? So I could have two devices. Let's say they're a Windows machine or a PLC or whatever they are. The analogy I usually give is a plc, so program will go, logic controller. And one of them is controlling the turbine, like in a power plant or on. It's controlling a train, something really important. And the other one's controlling the ice machine in the break room. They're the same version, they're the same hardware, they have the same firmware, they have the same vulnerabilities. So as a, as a cyber practitioner, it's really easy to see those two devices on a list and say, hey, I've got all these vulnerabilities. I, they're both risky, but from a business organization. It goes back to what you were just saying. One of them. If it goes down, somebody doesn't get ice in their water, it's not the end of the world. Yeah, somebody's upset, frustrated, whatever. But my plant doesn't shut down. I'm not losing money. I've just got an annoyed employee. And we can bring ice in. That's, that's an easy answer for that. If the turbine goes down, completely different conversation. If the train crashes, if the plane crashes, etc, those are big problems. So just because they're the same vulnerability, just because they're the same risk of the, of the vulnerability level that, you know, the vulnerability score and, and you know, all that type of stuff that comes up that does not factor into what the impact to the business life, availability, all those other factors that are not just a technology score. And that goes along with kind of what you're saying, kind of mirrors what you were just saying, right, Is you need to understand what is that blast radius of if this thing breaks, what is the impact of that? And if it's like, you know, we can bring it back up. I've got a spare. If it breaks, I'll just grab another one and put it back in. Takes me 10 minutes. We don't lose anything. Like. Okay, well, I'm okay with that. No, this thing. We're down for a month, and we can't. We can't run the plant. Okay. So we need to really make sure we're protecting that device.
111
00:48:27.000 --> 00:48:28.000
That's so well put.
112
00:48:28.000 --> 00:48:30.000
Two different problems, right?
113
00:48:30.000 --> 00:48:33.000
Sounds like you've had a couple turbines go down.
114
00:48:33.000 --> 00:48:34.000
Yeah, for sure.
115
00:48:33.000 --> 00:48:34.000
Metaphorical.
116
00:48:34.000 --> 00:48:38.000
Sure, that's right. And an ice machine, too.
117
00:48:38.000 --> 00:48:42.000
Oh, no. Which is a serious issue if you need ice in your bourbon.
118
00:48:42.000 --> 00:48:50.000
Correct? Correct. Yes. And they. They don't like that to go down. But again, compared to the turbine going down, it's. It's a. It's a lot less frustrations.
119
00:48:50.000 --> 00:48:51.000
Yeah.
120
00:48:51.000 --> 00:48:52.000
A lot less paperwork.
121
00:48:52.000 --> 00:48:55.000
Yes.
122
00:48:55.000 --> 00:49:02.000
Well, what else? So how do people find out about you? What do you want them to know? Kind of call to action. What do you want people to know?
123
00:49:02.000 --> 00:50:30.000
Yeah. You know, I think the. The thing that I've been excited about is I've been researching trust. And in this blast radius is that we have all these tools and we. We spend a lot of time making splunk queries and detection rules for the guy from Russia to log in and pull from the Finance. Finance database. And it doesn't always look like that. And for an obvious reason, we. It's like, almost like the dog chasing its tail, like where. Where there's opportunity, the criminals go. And so you. You build up a really good section of your wall, like you talked about, and then you find that next section of the wall that needs to be stronger because you're almost inviting it, because that's the section of the wall that's the weakest. And so I think the. The big thing that I've been trying to practice with people is when you go to tabletop and you talk about tabletopping as well, which is gold, think about not what will this look like when this goes wrong, but what will the logs look like when the tool's been being used with the proper authority, with a proper tool, from the proper account at the proper time of day, how do you write a query for that? It gets a lot more challenging. I think a lot of people see trust as a control or a boundary. But if you have ansible crossing three trust boundaries, they're not really a trust boundary, but on some visio diagram, they are. And that's what gets approved.
124
00:50:30.000 --> 00:50:33.000
Yep.
125
00:50:33.000 --> 00:50:57.000
So I feel like it's rewarding, but it's also stressful to sit down and have to go back through, like, okay, what is our sore detect? You know, had Striker done the same thing. Would the outcome be the same? I don't know. I. So I don't want to like, try to make a blank check promise on that. See, I think that would be a good place to end. My answer. What, what happens when all goes right?
126
00:50:57.000 --> 00:51:09.000
Yeah. Well, and that, that's the hard part, right? And that's anytime I'm building these things out or having that conversation, right. I never start with the worst case scenario. I start, how do you know what good looks like? What does good look like here?
127
00:51:09.000 --> 00:51:10.000
A baseline.
128
00:51:10.000 --> 00:54:00.000
What does a successful process, if this, if this was going end to end, no bad things are happening. Everything, perfect day, the sun's up, you know, everybody, you know, woke up on time and had great coffee and all, you know, no traffic, all green lights, all the things happen. What does good look like? Because then that's your baseline. Like, that's what under. Then you start understanding the things that go wrong and which of these things are big problems, which things are not so big problems. Can I still run my process if this thing happens? Yep, I still can. Good. What about this one? Nope, process stops with that one. Okay, so we need to circle that on the list. That's one we need to think about and continue that down that path. You should be looking at the total process, not just the cyber, not just the ansible or the firewall or whatever. Because to your point, it's the same thing back in my networking days, right? Is it's like a firewall is not a firewall if it's got an anti. Annual. That's just a router, right? It's on the drawing as a firewall, but it's not a firewall if it's got an any, any rule because then it's just routing anything that comes through. I had an argument with a guy about that because I was looking, I was assessing their, their cyber posture and, and you know, the firewall had 478 rules. And he's like, man, my rules are really good. I'm like, yeah, they are. Except the one. He's like, which one? I'm like that Any. Any. He's like, well, yeah, but all my other rules are good. I'm like, but none of your other rules matter because that one's there. So if I can get to that one, none of this matters. Yeah, and he just argued back, but it'll get blocked by. I'm like, no, man. Like, I'm sorry, but no, you can't have an EMU rule ever on a firewall like that. Should never be like security zero. It should decline by default and then you enable you. You peel back the onion. You don't go the opposite direction. That that's just a bad and same thing on on you know identity. Right. Is is again. I remember back in my active directory administration days it's really easy to solve the problem by being a schema admin and an enterprise admin because I have God rights. I can do whatever I want, but I don't need that. Right. And obviously there's past the hash and all sorts of reasons why you should not be an administrator and logging into anything other than a domain controller. And if you don't know that this is old hack capability. But yeah, I mean there's, there's all these reasons why you should only have the, the rights that you. You need and if you need that extra admin rights you shouldn't be using it for anything other than administration. You should really log in as a separate account for normal email and surfing the web and a different account for administration. I know that's a pain in the butt people, but I'd much rather be a lower risk to my organization than logging in from Starbucks as domain admin. That's just me.
129
00:54:00.000 --> 00:54:01.000
You're not alone.
130
00:54:01.000 --> 00:54:25.000
And, and checking the logs to your point. Right. Aaron just logged in and he's doing things and if I don't know that that's not normal, how did I know? So you know that that's man, this has been a great conversation. I love all this. I think you've hit some really awesome points. Lots of things for people to think through. How do people reach out, find more about you, maybe see about doing work with you or finding where you're going to be. All that kind of stuff. Man.
131
00:54:25.000 --> 00:54:56.000
Yeah. You know the, the best place I think probably would be to reach out through email or through the, the side project website that I have skip to secure because that's where I do a lot of my independent research or am able to do some, some things that I'm not able to do during my day job which is still very important to me and rewarding. So I think that's maybe a best place to, to reach out. And I have some of my research that I've been talking about that's there some stuff on GitHub, some white papers that people can read. So if they want to explore and go dabble with blast radius stuff and punish themselves, it's there for them.
132
00:54:56.000 --> 00:55:26.000
Awesome. I think the thing I love about the people that listen to this podcast is Everybody's out there wanting to tinker and learn more and, you know, kind of go through those types of things. So definitely we'll include all those things in the show notes. Guys, just check out the show notes, look at for those details for the website and email all that kind of stuff. So if you didn't catch it, we'll have all those things there and go check out the things that Zach's doing. And man, thank you so much for taking time out of your day today and joining me and, and having. It was a great conversation. I appreciate, appreciate you being here.
133
00:55:26.000 --> 00:55:28.000
Heck yeah. Thank you to you.
134
00:55:28.000 --> 00:55:29.000
Awesome.
135
00:55:29.000 --> 00:55:45.000
I've been, been sorry, I, that was a little short. I just got a little nervous. I'm grateful to be on the show. I enjoyed your book. I enjoyed. I've been a new. I'm a newcomer to your podcast and I've been enjoying it as well. So you've got a. A new fan and well, hopefully stay in touch with you.
136
00:55:45.000 --> 00:56:25.000
Awesome. Hey, yeah, absolutely, man. I appreciate, appreciate it for sure. And always enjoy again. I really mean it when I said it in the beginning. Right. Is I do this because, hey, I want to give people a platform. You know, I've been doing this a long time. I've spoke on stages and all the things, but I didn't start there. Right. I started out as a technologist in a basement. Right. And I wasn't public speaking and all these things did not come naturally to me. And I think it's really important for people if you want to continue your career, you've got to get good at those softer skills. And you mentioned that earlier. Right. And sometimes that's doing things that are uncomfortable, like coming on a podcast with a guy you don't know and you don't know where it's going to go. Right. And being a little nervous, and that's okay.
137
00:56:25.000 --> 00:56:26.000
Right on.
138
00:56:25.000 --> 00:57:46.000
You did a great job, man. I had a great conversation and that's okay. So anybody that's out there listening, like, sometimes we don't. I don't share all this. I think I will today. And the reason for that is it. Wherever you are, submit for the the talk, go to the conference, get on stage. If you, if you. Every one of us that has done that and been there, we've all been there. I remember sweating profusely the first time I got on stage. And I remember, you know, being all anxious and nervous and worrying about it. And now it doesn't bother me, not because I don't care, but because I've just done it so many times now I don't have to worry about it because I know what I'm going to say and I'm not worried that somebody's going to ask me something. And I just have gone through that muscle and it comes with repetition. So, man, I, I, I'm thankful that you were willing to take the risk to be here today. Thank you for, for trusting me in that process. And man, anybody out there, I definitely challenge everyone to get on the podcast, go out and, you know, do the YouTube, you know, get out there and post on LinkedIn network, get on conferences, get on a, go up in stage, get Bsides, any of these things. You don't have to go talk at defcon. Go, go talk at Bsides. Go do something local. Start flexing that muscle and getting better and better and better at those things. So, again, man, I, I, I applaud you for being here today. Thank you for the time and, and I think you did a great job, buddy.
139
00:57:46.000 --> 00:57:48.000
Right on. Well, thank you. I appreciate it.
140
00:57:48.000 --> 00:57:49.000
Absolutely.
141
00:57:49.000 --> 00:58:01.000
I hope you.