Inside Cybersecurity: Omar Sangurima on Artificial Intelligence, Threats, and Opportunity

WEBVTT
00:00:11.039 --> 00:00:16.000
Welcome to Coding Conversations, produced by the STEM Educational Institute.
00:00:16.000 --> 00:00:24.960
I'm Nikisha Alcindor, president and founder of the STEM Educational Institute, where we provide free programming in financial literacy, STEM, and mental health.
00:00:24.960 --> 00:00:28.480
We work with high school students, they go through a one-year program.
00:00:28.480 --> 00:00:31.120
At the end, they earn a college scholarship.
00:00:31.120 --> 00:00:39.679
Coding Conversations are ways to bring exciting voices to you, the viewer, about things in the areas of STEM financial literacy and mental health.
00:00:39.679 --> 00:00:43.520
And today we have an exciting topic as well as an exciting guest.
00:00:43.520 --> 00:00:47.920
We're going to be talking about cybersecurity, particularly cybersecurity and health.
00:00:47.920 --> 00:00:51.359
And to help us with that conversation is Omar Sangurima.
00:00:51.359 --> 00:00:52.240
Welcome, Omar.
00:00:52.640 --> 00:00:53.200
Thanks for having me.
00:00:53.200 --> 00:00:53.920
Excited to be here.
00:00:54.159 --> 00:00:55.520
We're so happy to have you.
00:00:55.520 --> 00:01:02.799
So Omar is the head of cyber program management and third-party risk management at Memorial Sloan Kettering Cancer Center.
00:01:02.799 --> 00:01:07.840
You can think of Omar's job as being the digital bodyguard for the hospital.
00:01:07.840 --> 00:01:18.480
And Omar's goal is to build strategies that stop hackers from stealing information from disrupting the technology that doctors use to save lives.
00:01:18.480 --> 00:01:24.239
And he teaches, he treats his work as like a high-stakes chess game, if you will.
00:01:24.239 --> 00:01:33.840
And what he does is he has to predict what bad folks might do and find the weak spots in MSK defenses and fix them before anyone can attack.
00:01:33.840 --> 00:01:41.599
And so if you love solving puzzles or beating tough bosses in games, cybersecurity is the career for you.
00:01:41.599 --> 00:01:55.439
And when not protecting hostile data, he's usually strategizing in other ways, whether it be obsessing over fantasy football lineups or tackling difficult challenges in single-player RPG video games.
00:01:55.439 --> 00:02:00.959
Omar is always trying to do things that are innovative and high risk, right?
00:02:00.959 --> 00:02:02.480
And so welcome, Omar.
00:02:02.480 --> 00:02:04.079
We're so glad to have you here today.
00:02:04.400 --> 00:02:04.640
Thank you.
00:02:04.640 --> 00:02:05.680
Thanks for having me.
00:02:06.079 --> 00:02:12.400
So it's not a conspiracy, but Omar, like myself, for you the those of you who watch the show is from Queens, right?
00:02:12.400 --> 00:02:15.360
Is it just you know something in the water?
00:02:15.360 --> 00:02:16.560
Something in the water.
00:02:16.560 --> 00:02:19.360
We just we just keep going, right?
00:02:19.360 --> 00:02:27.680
And so, Omar, you got your degree, you got your MBA from Maris College in Piskix in Poughkeepsie, and then you went on to get your doctorate.
00:02:27.680 --> 00:02:28.000
Yes.
00:02:28.000 --> 00:02:34.080
So obviously those are very difficult things to obtain and agrees, degrees to obtain.
00:02:34.080 --> 00:02:36.719
But before that, take us back to your origin.
00:02:36.719 --> 00:02:43.199
Where did you grow up and how did you start to realize cybersecurity was your l field of interest?
00:02:43.680 --> 00:02:51.680
So as you said, uh grew up in Queens till I was around nine, moved up to Massachusetts, followed my sister.
00:02:51.680 --> 00:02:55.439
She got a residency up there, Bay State Medical Center.
00:02:55.439 --> 00:03:01.759
So uh she grabbed me and and our mother, we went up to to right outside of Springfield Mass.
00:03:01.759 --> 00:03:06.400
Um there again, the the overriding goal, right?
00:03:06.400 --> 00:03:11.199
The the first generation in this country, it's uh education's a silver bullet.
00:03:11.199 --> 00:03:15.280
It's uh keep at getting educated, look at your sister, look at what she's done.
00:03:15.280 --> 00:03:19.840
So I just kept my head in the books, uh, kept kept uh chipping away.
00:03:19.840 --> 00:03:22.560
High school, college, undergrad.
00:03:22.560 --> 00:03:25.039
Even then, it was it was odd.
00:03:25.039 --> 00:03:28.639
Cyber wasn't exactly I wasn't born with a computer in my hand.
00:03:28.639 --> 00:03:32.479
There's some people that I work with, you can tell, uh, they're amazing.
00:03:32.479 --> 00:03:35.199
Uh, but that it wasn't that wasn't the origin story.
00:03:35.199 --> 00:03:37.439
I I I'm a career switcher.
00:03:37.439 --> 00:03:56.159
Um so about 12 years ago, 12, 13 years ago, decided to switch over from financial advising and tried to get into a field that you know I thought was gonna be, you know, innovative, uh challenging, constantly different, different things to to focus on.
00:03:56.159 --> 00:03:58.479
And it's been that, thankfully.
00:03:58.479 --> 00:04:03.599
So, you know, it's it's been always interesting and never never a dull day in the field, I'll say that.
00:04:03.680 --> 00:04:04.560
I love that.
00:04:04.560 --> 00:04:10.479
I love when you know going from financial services industry to cybersecurity.
00:04:10.479 --> 00:04:20.399
Can you talk about kind of what was it or what are what are some of the courses or things that you did to prepare you or you think prepared you to go into cybersecurity?
00:04:20.480 --> 00:04:32.879
So I remember this is funny because the there's one certification that I said, let me give this a try, kind of a test run before I went full bore into say a degree in cyber.
00:04:32.879 --> 00:04:35.519
Uh the the Comp TIA Security Plus.
00:04:35.519 --> 00:04:46.480
Uh I remember I I chuckle now because w when I'm, you know, when anybody's asking me about, you know, how do I break in, what certs to start with, I say, you know, I studied for that thing for nine months.
00:04:46.480 --> 00:04:55.120
I usually pause for laughter at that point because that was a long time, like one cert, but I was just so I had to I was taking a leap.
00:04:55.120 --> 00:04:59.519
It was something that I wasn't, you know, of course, classically trained in uh for school.
00:04:59.519 --> 00:05:03.120
So studied for nine months there, thankfully passed.
00:05:03.120 --> 00:05:08.160
Um, you know, my my origin story would be completely different, I think, if I had stumbled, if I had stumbled then.
00:05:08.160 --> 00:05:14.240
But, you know, did that, then started taking a couple courses for an MIS.
00:05:14.240 --> 00:05:14.560
Right.
00:05:14.560 --> 00:05:15.759
That was my first kind of teaser.
00:05:15.759 --> 00:05:16.160
I didn't know.
00:05:16.160 --> 00:05:19.839
And tell us what MIS on Masters of Information Systems.
00:05:19.839 --> 00:05:20.480
Yep.
00:05:20.480 --> 00:05:30.000
So uh to uh started doing that even while I was still kind of you know one foot in the financial field, but definitely looking uh to to move out.
00:05:30.000 --> 00:05:37.839
The cert and beating being getting that beating, but getting that certification, I think then I was hooked.
00:05:37.839 --> 00:05:44.959
Like I I just loved the idea of being able to take a look at a certain level of challenges, right?
00:05:44.959 --> 00:05:50.560
It's always, you know, my my wife has heard this many times, is another it's another windmill to tilt at.
00:05:50.560 --> 00:05:55.360
I just love, you know, seeing seeing something on the horizon and saying, you know what, maybe I could figure that out.
00:05:55.360 --> 00:06:03.439
And the industry, cybersecurity especially, at that point was still more heavily focused on certification.
00:06:03.439 --> 00:06:10.000
So once I started really kind of chaining those together, I started to convince myself that maybe I could do this.
00:06:10.000 --> 00:06:14.319
And then from there, you know, uh networked a little bit.
00:06:14.319 --> 00:06:17.279
I I got my first job through someone I knew.
00:06:17.279 --> 00:06:24.879
It wasn't necessarily it was just, you know, surreptitiously mentioning it to a a buddy of mine at at Jiu Jitsu.
00:06:24.879 --> 00:06:32.399
We were it was an open mat, right, in Brazilian jujitsu on a Saturday, and he, you know, he's like, Hey, I hear you're in this cyber thing, you keep talking about it.
00:06:32.399 --> 00:06:32.560
Right.
00:06:32.879 --> 00:06:36.639
Okay, first of all, you can't just throw in while I was doing jujitsu.
00:06:36.639 --> 00:06:39.920
There has to be an explanation for that.
00:06:39.920 --> 00:06:40.879
So we got it.
00:06:40.879 --> 00:06:44.800
So are you is that kind of one of the other things that you still practice?
00:06:45.199 --> 00:06:46.639
I I mean, sort of now.
00:06:46.639 --> 00:06:53.199
My body's a little busted up, so I I'm I kind of you know, I'm I'll make appearances at Open Mats uh here here and there.
00:06:53.199 --> 00:07:02.000
But I started started Brazilian jujitsu, it was after so I was on the national team for taekwondo, uh, under the under seven the under-18 team.
00:07:02.000 --> 00:07:02.399
Okay.
00:07:02.399 --> 00:07:03.839
Went to North Korea.
00:07:03.839 --> 00:07:09.519
That was the first uh world championships, the second world championships were thankfully in Puerto Rico, right?
00:07:09.519 --> 00:07:12.879
So definitely much nicer than North Korea, I'll say that.
00:07:12.879 --> 00:07:16.319
Um five days in North Korea as a 15-year-old.
00:07:16.319 --> 00:07:17.519
Uh wild wild times.
00:07:17.519 --> 00:07:18.160
Wild times.
00:07:18.160 --> 00:07:18.879
I'm sure.
00:07:18.879 --> 00:07:19.759
Yeah, yeah.
00:07:19.759 --> 00:07:29.199
Um yeah, did that, uh, wrestled in high school, and then you know, I didn't want to continue doing the the you know on the adult team for for taekwondo.
00:07:29.199 --> 00:07:30.800
I was too too grindy.
00:07:30.800 --> 00:07:33.920
So um I I got into Brazilian Jiu-Jitsu.
00:07:33.920 --> 00:07:37.519
There was a school near Hartford, Connecticut, where I went to undergrad.
00:07:37.519 --> 00:07:39.600
It was uh West Hartford, Connecticut.
00:07:39.600 --> 00:07:44.160
And back then it was a it was a huge deal to have like a purple belt teach the class.
00:07:44.160 --> 00:07:44.560
Sure.
00:07:44.560 --> 00:07:48.079
It was you know, because there was not a lot of black belts uh in the United States at the time.
00:07:48.079 --> 00:07:49.600
And uh I got hooked.
00:07:49.600 --> 00:07:55.920
I uh you know, and I've been grappling since 99, 2000.
00:07:55.920 --> 00:07:58.079
Um yeah, like I said, right?
00:07:58.079 --> 00:08:04.800
You know, if I if I shake someone's hand or if I put my hand down, like you can see like the gnarled fingers here and there a little bit, right?
00:08:04.800 --> 00:08:09.279
Or if I had if I stretch out, I can remember times when I should have tapped and I didn't.
00:08:09.279 --> 00:08:11.279
Uh but uh you know, still love it.
00:08:11.279 --> 00:08:17.680
Um but yeah, it was again got into never would have thought that that would have led to you know a career.
00:08:18.160 --> 00:08:31.199
So what I love about that is that your physicality actually is translating to your ability, your s your mental strength in terms of what you do and your critical thinking.
00:08:31.199 --> 00:08:40.159
And we often see that with with athletes being able to transition kind of their work and their physicality into difficult fields.
00:08:40.159 --> 00:08:48.879
Because I remember the term cybersecurity coming out of when people were starting to get hacked or identity theft.
00:08:48.879 --> 00:08:49.679
Do you remember this?
00:08:49.679 --> 00:08:55.759
Like identity theft came out, and then everyone would you would go to the police and they'd be like, Can't help you, ma'am.
00:08:55.759 --> 00:08:56.240
Right?
00:08:56.240 --> 00:08:56.960
Do you remember that?
00:08:56.960 --> 00:09:07.679
Like it's like so someone stole my identity, and it was like the best, the best way to prevent that is to have all these different alerts and all these things.
00:09:07.679 --> 00:09:11.840
And so that was in my mind, that was the scope.
00:09:11.840 --> 00:09:32.080
I'd love to see to to get your thoughts on where that scope has has trended towards because back then it was just okay individual information getting stolen, but now we're talking about ransom, like people taking data from companies and data's having you know, companies having to pay for that.
00:09:32.080 --> 00:09:41.200
So talk to me a little bit about what you've how you've seen the idea of cybersecurity, like that definition transforming over the years.
00:09:41.279 --> 00:09:49.440
So it's really amazing that that you kind of pinpoint it that way, because I see it as kind of a Venn diagram or uh a sine wave, right?
00:09:49.440 --> 00:09:50.399
Like down, up, down.
00:09:50.399 --> 00:09:54.480
It started with individual identity protection, as you said.
00:09:54.480 --> 00:10:06.480
It was kind of very much scoped towards you you're you're gonna get your own your own Social Security number taken, or somebody's gonna start taking, you know, writing checks in your name or taking out loans in your name.
00:10:06.480 --> 00:10:24.080
And then I think as business, as enterprise got more interconnected just by virtue of technology advancing, then I think uh cybersecurity took on a bit more of an enterprise uh scope, as you said.
00:10:24.080 --> 00:10:37.120
It went then, you know, then business data could get stolen, then intellectual property could get stolen, then not only that of the of the business themselves, but then what about the business's customers, right?
00:10:37.120 --> 00:10:41.279
So then you have you start having, wait a second, the the scope starts expanding.
00:10:41.279 --> 00:11:04.559
Now what I've been seeing lately is kind of a return towards first principles where, you know, it's still data governance is taking up privacy is I think privacy now, the the concept of privacy and privacy engineering is having kind of the same renaissance that cybersecurity did maybe 10 years ago, 10, 11 years ago, kind of when I started.
00:11:04.559 --> 00:11:11.600
And it's you know, the and and to think that they're not distinct fields is is uh is a fallacy.
00:11:11.600 --> 00:11:24.720
I think there's there's there's overlap, but there's v fine, fine professionals in privacy engineering that sing a different tune, dance a different dance than the ones in cyber, kind of cousins.
00:11:24.720 --> 00:11:33.120
We kind of, you know, we definitely reinforce each other, but it's it's the the days where it's it's the same, you know, are are kind of are kind of gone.
00:11:33.120 --> 00:11:45.039
Same as I'd imagined, and this would this would be a little bit before my time, but I've done some some studying in the history of the field that I'm in, is kind of where the the break happened between like information security and cybersecurity, right?
00:11:45.039 --> 00:11:56.879
Where it was like, you know, we're making sure that you know physical records are you know uh uh thrown out when they need to be, making sure that folks only have access to you know the hard copies of papers.
00:11:56.879 --> 00:12:03.039
Th there it kind of broke away, and then you had the cybersecurity, information security.
00:12:03.039 --> 00:12:08.399
Folks still kind of they don't disambiguate the terms, you know, but now I think that's a bit more distinct.
00:12:08.399 --> 00:12:12.960
And I think the same thing's kind of happening now with with privacy and cybersecurity.
00:12:12.960 --> 00:12:18.879
Fields that are very connected but not anywhere the same and demand different skill sets.
00:12:19.279 --> 00:12:22.639
Okay, so you we you brought up the term Venn diagram, right?
00:12:22.639 --> 00:12:31.200
And so when I think about kind of privacy settings settings, everyone gets those pop-ups that say, do you want to load cookies?
00:12:31.200 --> 00:12:36.960
Most people don't read them, they'll say accept, manage, or reject all, depending on what your options are.
00:12:36.960 --> 00:12:41.440
And then you have this kind of cybersecurity malware hacking things.
00:12:41.440 --> 00:12:52.159
But then to me, there's like a in the middle, there's some sort of ethical, maybe it's not called ethics, but who gets to decide what goes into what bucket and I guess consumer awareness?
00:12:52.159 --> 00:12:56.399
Like who who is like how is that being dished out or divided?
00:12:56.960 --> 00:13:01.840
So it's I think for me, the the way I'd split those uh uh it's a matter of outcomes.
00:13:01.840 --> 00:13:30.960
So in where where I work, it's usually, well, okay, privacy is gonna sit there and tell us what we need to lock down, uh why to how long for how long, to what extent, you know, makes the that privacy and more data governance says, listen, this is this is important, this is why it's important, whether it's like uh laws, regulations, whether it's intellectual property, right, it's it's uh proprietary to uh to the organization.
00:13:30.960 --> 00:13:33.360
Then okay, we've sussed all that out.
00:13:33.360 --> 00:13:45.440
Now cyber, come over here and make sure that what we want to have happen with this data, with this information, for these purposes, which is where the privacy comes in for the doctors or for the patients.
00:13:45.440 --> 00:13:46.799
Make sure you lock it down.
00:13:46.799 --> 00:13:49.440
So that's where you know we we saddle up.
00:13:49.440 --> 00:13:54.559
Um where I think then, at least that's that's what happens in the organization.
00:13:54.559 --> 00:13:59.120
I think you bring up a great question in terms of who's doing that writ large.
00:13:59.440 --> 00:13:59.679
Yes.
00:14:00.080 --> 00:14:00.559
I don't know.
00:14:00.559 --> 00:14:10.240
That's w you know, uh th this is one of the things that I always harp on when it when you when I get on my soapbox here is, you know, the United States doesn't have a national privacy law.
00:14:10.879 --> 00:14:11.120
Right?
00:14:11.440 --> 00:14:12.799
Europe has kind of figured it out.
00:14:12.799 --> 00:14:13.200
Yes.
00:14:13.200 --> 00:14:18.399
Um they're at the forefront with the EU AI Act as well, which is, you know, in add in addition to the GDPR.
00:14:18.399 --> 00:14:31.120
But you y we have a patchwork in the United States, which I'll tell you what, makes um locking data down fun when when depending on on the scope of the enterprise that that you're that you're working working with.
00:14:31.120 --> 00:14:40.000
So I think that, you know, right now it's anyone's guess in terms of who you you have an ethical folks in the industry do have a compass.
00:14:40.000 --> 00:14:48.639
We do kind of know listen, and and you have a compass and you also try to balance it out with, okay, for what purposes are we doing this for?
00:14:48.879 --> 00:14:49.039
Yeah.
00:14:49.360 --> 00:14:53.679
So, you know, because w what my boss says, I I love the man, right?
00:14:53.679 --> 00:15:00.559
Um, you know, the the most secure system is the one that's not connected to the internet and it's at the bottom of the ocean, but how useful is it?
00:15:00.559 --> 00:15:02.480
So you have to kind of balance that out.
00:15:02.480 --> 00:15:11.279
But many folks in the field in privacy and data governance as well as cybersecurity, we have that true north where we're like, listen, we're we're trying to lock this down.
00:15:11.279 --> 00:15:15.279
We want to make you we we treat it like as if it was our own family's kind of data.
00:15:15.279 --> 00:15:19.039
And we understand like w would I want my data out there, would I want my family's.
00:15:19.039 --> 00:15:24.799
Uh in in the hospital for sure, it's it's not hard to make the connection towards patient harm.
00:15:24.799 --> 00:15:25.440
Yeah, sure.
00:15:25.440 --> 00:15:28.399
And and privacy, especially with the the type of care that we provide.
00:15:28.399 --> 00:15:28.879
Sure.
00:15:28.879 --> 00:15:32.960
And so, but in terms of writ large, that's a really good question.
00:15:33.120 --> 00:15:41.519
Well, you know, it's something that I think about often, particularly for when I I I do a lot in in artificial intelligence.
00:15:41.519 --> 00:15:47.840
A lot of my research is in artificial intelligence, and I start when I'm building models, I start with the ethical questions.
00:15:47.840 --> 00:15:49.840
Like what is the worst that can happen?
00:15:49.840 --> 00:15:50.559
Right?
00:15:50.559 --> 00:15:59.679
And when I think about there are pros and cons to having your data taken from you when it comes to privacy.
00:15:59.679 --> 00:16:05.039
Because frankly, you know, I like getting coupons at the store based on my buying habits.
00:16:05.039 --> 00:16:05.919
Absolutely, right?
00:16:06.159 --> 00:16:06.559
Absolutely, yeah.
00:16:06.799 --> 00:16:07.360
I like that.
00:16:07.360 --> 00:16:17.600
But I don't like my insurance premiums being determined by information that I might have given up voluntarily without knowing or without knowing.
00:16:17.600 --> 00:16:18.480
Right?
00:16:18.480 --> 00:16:27.120
And so I'm wondering when you think about kind of cybersecurity and healthcare, what are some myths and what's the kind of reality?
00:16:27.120 --> 00:16:31.039
Like what what is actually what does that actually mean in the context of healthcare?
00:16:31.600 --> 00:16:53.679
So one of the things that I think, and it was an aha moment for me, and and and I'll be the first to admit, I it wasn't even I think I was maybe one or two years into working at the hospital at at MSK at Sloan, where it really dawned on me, hey, it's a data breach here is a horse of a different color because uh medical data is immutable.
00:16:53.679 --> 00:16:58.559
You can change your social security number, it's a pain, but you can do it.
00:16:58.559 --> 00:17:01.840
You can change your name, it's also a pain, but you can do it.
00:17:01.840 --> 00:17:07.200
You can't go back and rewrite your medical record, your medical history.
00:17:07.200 --> 00:17:16.240
So in terms of the myth that I would think I think permeates is that it's just like any other data breach.
00:17:16.240 --> 00:17:31.599
I think, you know, at the risk of sounding biased uh because it's the field I work in, those types of breaches can be so harmful because you can't y what if there's diagnoses on there that you don't want public?
00:17:31.599 --> 00:17:32.160
Sure.
00:17:32.160 --> 00:17:47.279
And once it's out there, I can almost guarantee you, once it's out there, and if it's unencrypted, if it's an actual breach, if you know all all those bad steps happen, it's out there but who knows what it's getting used for, who knows how it's being monetized.
00:17:47.279 --> 00:17:51.119
So I think the myth is that it's just like any other data breach.
00:17:51.119 --> 00:18:06.400
Um it's not a myth that practitioners share, I'll tell you that, because the folks in the field understand that this is, you know, there's very small room for error when it comes to allowing that.
00:18:06.400 --> 00:18:15.359
There's you could do credit monitoring, you could do this, you could do that, but what are you gonna do for someone's uh medical information once it gets out there?
00:18:15.440 --> 00:18:16.559
Yeah, you're absolutely right.
00:18:16.559 --> 00:18:25.440
And I kind of feel like that is when HIPAA came out in the early 2000s, and it was like this whole thing, and patients were trying to figure out what it is.
00:18:25.440 --> 00:18:31.359
It the hope of HIPAA was to prevent kind of data transferring, right?
00:18:31.359 --> 00:18:31.920
Right.
00:18:31.920 --> 00:18:37.599
And patient information being out there without the knowledge of patients and just kind of securitizing that.
00:18:37.599 --> 00:18:44.000
Now, where HIPAA is, I don't really know how far it's come along, but I kind of feel like it's a joke.
00:18:44.000 --> 00:18:48.559
You walk into your doctor's office and they're like, sign this, and you're like, well, what am I signing?
00:18:48.559 --> 00:18:51.920
It's like, oh, you're signing that we gave you the HIPAA booklet.
00:18:51.920 --> 00:18:53.039
It's like, well, what is that?
00:18:53.039 --> 00:18:54.400
What does that mean?
00:18:54.400 --> 00:18:56.400
Does the HIPAA booklet say that?
00:18:56.400 --> 00:18:58.720
Like, you're gonna take my genome secrets?
00:18:58.720 --> 00:19:01.519
Like, what does the HIPAA booklet, like what does it say?
00:19:01.519 --> 00:19:10.240
And I bring that up because you're absolutely right when it comes to these sorts of data breaches, even sharing information between hospitals, right?
00:19:10.240 --> 00:19:13.759
When you think about there's like the whole medical records thing, right?
00:19:13.759 --> 00:19:23.680
What is the um what are the what are the consequences or what are the potential things that could happen when you're sharing medical records, right?
00:19:23.680 --> 00:19:32.640
And so I'm wondering for you, what what are things well I don't want to ask you because then people might use it.
00:19:32.640 --> 00:19:41.200
But when you think of those types of things, how do you kind of align yourself and your team to start thinking about like what are your internal meetings about?
00:19:41.200 --> 00:19:45.680
Like how do you guys say, hey, um these are things that we're thinking about?
00:19:45.680 --> 00:19:47.839
Is there a like what's your process?
00:19:48.319 --> 00:19:48.880
Sure, sure.
00:19:48.880 --> 00:19:52.319
And I I it's you bring up a just even as a meta point, right?
00:19:52.319 --> 00:19:53.440
Taking a step back.
00:19:53.440 --> 00:19:59.119
Thinking about what why we're locking this down.
00:19:59.119 --> 00:20:06.640
I think is is one thing that makes us better at the job, but then also I think it makes us better partners in an organization.
00:20:06.640 --> 00:20:13.279
What I like to always say is, you know, nobody says, hey, I have to go to MSK because I heard they have a phenomenal cybersecurity department.
00:20:13.279 --> 00:20:14.640
As much as I'd love to.
00:20:14.640 --> 00:20:15.200
Yes, yes.
00:20:15.200 --> 00:20:18.319
So what are we doing it for?
00:20:18.319 --> 00:20:33.279
And I think that a lot of our internal meetings, I'll be, you know, I I like being the one in the room that kind of brings us back to that question, if we drift, because I think it guides us if we're, you know, are we locking down a medical trial?
00:20:33.279 --> 00:20:38.400
Are we locking down a collaboration between a couple of different institutions?
00:20:38.400 --> 00:20:40.079
Uh so who are we working with?
00:20:40.079 --> 00:20:41.519
Are we working with researchers?
00:20:41.519 --> 00:20:42.799
Are we working with clinicians?
00:20:42.799 --> 00:20:44.880
Are we working with people that are wearing both hats?
00:20:44.880 --> 00:20:46.720
Are we talking about patient data?
00:20:46.720 --> 00:20:49.680
Are we work you know working on a system that's patient-facing?
00:20:49.680 --> 00:20:55.839
Is it internal to us in terms of you know understanding the guts of the network, which is something, of course, we don't want out there?
00:20:55.839 --> 00:20:56.720
Sure, absolutely.
00:20:56.720 --> 00:21:05.039
Thinking about exactly what we're trying to lock down then shapes and why shapes the how.
00:21:05.039 --> 00:21:15.759
So and it shapes, like you like you were alluding to, the ethical question of okay, where on the spectrum of available and locked down are we gonna land?
00:21:15.759 --> 00:21:27.920
And where are we gonna feel okay sleeping at night that yes, this is this is the right tight rope to walk, where it's available, but it's encrypted, it's locked down, etc.
00:21:27.920 --> 00:21:40.880
I think there, that's really one of the guiding principles that I like to bring forward because it can devolve into, well, we know that this is the best encryption, this is what we have to do, we're gonna lock it down six ways.
00:21:40.880 --> 00:21:48.559
But then, you know, to your point, HIPAA, you know, the recent updates to HIPAA have been all about interoperability.
00:21:48.559 --> 00:21:57.920
You want to allow that patient to more ownership over their medical record so that they can go and make go to where they wanna be seen.
00:21:57.920 --> 00:22:09.599
And it shouldn't be an issue of well, you You know, I'd go to this other provider, but that other provider can't read my medical record because of the way the the my initial provider encrypted it or the system that it's in.
00:22:09.599 --> 00:22:22.240
I love that concept, and so it's forced my field to be a bit more agile, be a bit more, you know, on its on its toes in terms of, okay, listen, we have to make it available, but we still have to lock it down.
00:22:22.240 --> 00:22:26.160
That was I remember when the interoperability rules really came into effect.
00:22:26.160 --> 00:22:26.640
Sure.
00:22:26.640 --> 00:22:29.440
It was a big it was a big wait a second, hold on.
00:22:29.440 --> 00:22:29.759
Right.
00:22:29.759 --> 00:22:41.759
Um but I think it was a a great moment for the industry to understand, hey, there's, you know, yes, folks want their stuff locked down, but the information is there to facilitate care.
00:22:41.759 --> 00:22:45.440
We have to figure out a way to suss out this issue.
00:22:45.440 --> 00:22:49.359
How can we make it safe, but how can we make it secure and available?
00:22:49.359 --> 00:23:02.079
So, you know, I think that in a lot of those meetings, that's really bringing that back, bringing that question back in has has been, I think, uh probably one of the contributors to you know the type of team that that we have.
00:23:02.079 --> 00:23:02.880
I don't care.
00:23:03.200 --> 00:23:07.440
Yeah, and I love that because especially in the elderly, right?
00:23:07.440 --> 00:23:12.640
So we have baby boomers that are now retiring, they're older.
00:23:12.640 --> 00:23:17.839
A lot of them may or may not have a caretaker that can go to them to the doctor.
00:23:17.839 --> 00:23:22.559
And giving they don't they don't remember their medical history.
00:23:22.559 --> 00:23:33.519
And so it's it's a huge deal for doctors to see that, pharmacies to see what's what's going on in terms of that, to flag medication and to say, hey, this may or may not be good for you.
00:23:33.519 --> 00:23:37.920
So it's completely it's a something that's super important.
00:23:37.920 --> 00:23:49.119
And as as I hear you talk about the different facets of cybersecurity, what are some skills I can already kind of put make a checklist based on what we've talked about?
00:23:49.119 --> 00:23:56.799
But if you were to say there is a skill that every cybersecurity person or someone who wants to go into cybersecurity, what would you say it would be?
00:23:57.200 --> 00:24:01.920
I can identify and I can find, you know how you can say I can find my people in the room?
00:24:01.920 --> 00:24:02.480
Sure.
00:24:02.480 --> 00:24:05.039
You you have to you have to want to tinker.
00:24:05.039 --> 00:24:06.720
You have to.
00:24:06.720 --> 00:24:11.680
And and one of the things I remember I said it, it just came came to mind.
00:24:11.680 --> 00:24:14.160
I said, once you start tinkering, you're you're starting to hack.
00:24:14.160 --> 00:24:14.799
Yeah.
00:24:14.799 --> 00:24:15.599
That's the thing.
00:24:15.599 --> 00:24:38.160
You w you you sometimes if I'm interviewing folks, if I can tell that they will have physical discomfort if they can't figure something out, even if they don't have, you know, the type of the system on their resume that we use or the specific set of skills, I want that person on my team.
00:24:38.160 --> 00:24:44.960
We can we can teach them the MSK way of cyber you know, that's on us.
00:24:44.960 --> 00:25:01.519
But if I can tell that someone is gonna it's gonna bother them, it's gonna burn their mind when they can't figure out why something didn't work or why they couldn't get into something or why they couldn't come up with that technical solution to a problem that's gonna help people, that's a person I'm on on the team.
00:25:01.519 --> 00:25:07.519
And I think that if you if you present that, that's what I say to a lot of folks that ask me, like, hey, how do I prepare for an interview?
00:25:07.519 --> 00:25:12.400
I just had this on actually on on Friday, uh you know, which is what yesterday, right?
00:25:12.400 --> 00:25:15.680
Um how do I prepare?
00:25:15.680 --> 00:25:18.240
I said, listen, let that come through.
00:25:18.240 --> 00:25:19.599
I can tell you're curious.
00:25:19.599 --> 00:25:24.559
I can tell you like to tinker, I can tell you like to break things down and build them up, and maybe they don't work again.
00:25:24.559 --> 00:25:28.720
And then that's going to drive you to you know, learn the system even even more so.
00:25:28.720 --> 00:25:30.960
Um let that shine through.
00:25:30.960 --> 00:25:32.559
That's a person that I want on the team.
00:25:32.720 --> 00:25:57.279
What I love about that is so close to being a coder and writing computer code because the the thing that always bothers me, there is like a meme of someone um sleeping and the code is in the you're trying to figure out what is it, and now of course code assistance can help you with that, but you still are kind of, why isn't this working and your head is bothering you, right?
00:25:57.279 --> 00:25:59.519
And so I I really love that.
00:25:59.519 --> 00:26:18.319
And the the other thing that's interesting, and you probably have better statistics than I see and I have seen, but I've seen in the past, like there are dashboards that companies have that literally show the amount of attacks that are happening in seconds that are coming from all over the world.
00:26:18.319 --> 00:26:20.079
And I believe you have one.
00:26:20.079 --> 00:26:25.200
Can you give us a sense of maybe a statistic, maybe like how many happen like an hour?
00:26:25.200 --> 00:26:27.519
Like how many attempts are do you you guys monitor that?
00:26:27.519 --> 00:26:28.640
I'm sure that you mire that.
00:26:29.039 --> 00:26:30.960
I'll say I'll say we get millions a month.
00:26:30.960 --> 00:26:42.480
It's always it's you know I I liken it to you have and now of course, obviously with AI systems, that's even that's I think that's going to skyrocket.
00:26:42.480 --> 00:26:49.359
That's only going to go because you can automate what what it what I liken it to is you know, you're checking you're checking the doors and the windows.
00:26:49.359 --> 00:26:49.839
Right.
00:26:49.839 --> 00:26:53.200
If you if you've you know grown up in Queens, it happens, right?
00:26:53.200 --> 00:26:56.640
You you you you keep an eye out if anyone's kind of near your car.
00:26:56.640 --> 00:26:57.359
Sure, sure.
00:26:57.359 --> 00:26:59.359
Why are they hanging out by the car?
00:26:59.359 --> 00:27:02.880
It's not you know, it's uh it's a Chevy Cavalier, it's old.
00:27:02.880 --> 00:27:03.279
What are you doing?
00:27:03.279 --> 00:27:06.160
Like if it's not yeah, what are you checking for?
00:27:06.160 --> 00:27:06.640
Right?
00:27:06.640 --> 00:27:09.839
And I think that that is constantly now that's automatable.
00:27:09.839 --> 00:27:11.680
And it's just all the time.
00:27:11.680 --> 00:27:19.039
And if anything and as even as, say, you know, I talk to uh some folks that are you know front-end web developers.
00:27:19.039 --> 00:27:29.599
And uh one of the things that they you have to set up, right, when you're setting up any internet presence is you have to set up some sort of filtering to be able to distinguish like what's real interest, right?
00:27:29.599 --> 00:27:32.720
SEO, yeah, oh I'm I'm getting so many hits.
00:27:32.720 --> 00:27:33.920
I'm getting so much interest.
00:27:33.920 --> 00:27:40.799
Wait a second, is it just the fact that you have bots checking out if if there's something that's vulnerable, a door or a window that's open?
00:27:40.799 --> 00:27:41.279
Sure.
00:27:41.279 --> 00:27:44.319
And you know, I what's the quote, right?
00:27:44.319 --> 00:27:45.920
Like, why do you rob banks?
00:27:45.920 --> 00:27:46.799
That's where the money is.
00:27:46.799 --> 00:27:47.599
Well, of course.
00:27:47.599 --> 00:27:57.279
You put any sort of medical presence out on the open internet, it's gonna get constantly you know, just tap-tap, check, is this open?
00:27:57.279 --> 00:27:58.000
Is this open?
00:27:58.000 --> 00:27:58.720
Is that there?
00:27:58.720 --> 00:27:59.759
Day and night.
00:28:00.079 --> 00:28:00.400
Day and night.
00:28:00.400 --> 00:28:04.079
And it's like bots, you know, that are going to be.
00:28:04.079 --> 00:28:12.240
You know, it's interesting when you talk about kind of the amount of tax and the skills that you need, right?
00:28:12.240 --> 00:28:22.079
Um it seemed just by meeting you and knowing you, not only do you have to have like a um intellectual knowledge, but you also have to have common sense, right?
00:28:22.079 --> 00:28:27.599
A sense of common sense and uh be able to kind of question, question the things.
00:28:27.599 --> 00:28:37.759
And I'm wondering, um uh earlier today, you to you talked to our students and you get you guys can take a look here, um, some some film of Omar talking to our students.
00:28:37.759 --> 00:28:54.160
And one of the things that came up was the how do you get in like the entry-level positions and how these positions are being posted and they'll say entry level, but then when you read it, it's like you have to have all these certifications and two to three years experience.
00:28:54.160 --> 00:29:00.480
And then you have this great um saying that tech is kind of cannibalizing or its pipeline.
00:29:00.480 --> 00:29:01.680
Tell tell us more about that.
00:29:01.759 --> 00:29:03.519
Yeah, it's it's cannibalizing the pipeline.
00:29:03.519 --> 00:29:04.559
It's eating its own tail.
00:29:04.559 --> 00:29:08.400
I uh it there's I the math just absolutely doesn't math.
00:29:08.400 --> 00:29:10.160
You you brought up the certifications.
00:29:10.160 --> 00:29:12.640
I I I that that was a keen point.
00:29:12.640 --> 00:29:24.240
I did I didn't mention that, but you have some of these entry-level positions where it's asking for certain certs that the industry knows, oh, you need five years in the field to have that cert.
00:29:24.240 --> 00:29:44.799
If you see an entry-level position and it's asking for the CISSP, like either a bot put that up or you know, some unbeknownst, you know, not not knocking my friends in HR, but somebody put the someone signed off on a job spec that asked for a five-year cert on an entry-level position.
00:29:44.799 --> 00:29:49.440
And even then it the the comedy gets worse, or the tragedy, which one would you want to say?
00:29:49.440 --> 00:29:53.359
But it gets worse when then the experience only says two to three years.
00:29:53.359 --> 00:29:56.079
Wait a second, you're asking for a five-year cert.
00:29:56.079 --> 00:29:58.480
You want two to three years experience in the field.
00:29:58.480 --> 00:30:06.160
You know, some some folks, uh maybe the comment section or whatnot will say, hey, you know, you can you can take some of that experience requirement off.
00:30:06.160 --> 00:30:07.359
I get that, right?
00:30:07.359 --> 00:30:10.799
With a degree you can maybe lop lop it down to about three years.
00:30:10.799 --> 00:30:18.240
But even then, then we're talking about a three-year cert, two to three years of experience for, again, what I say is an entry-level position.
00:30:18.240 --> 00:30:18.559
Yeah.
00:30:18.559 --> 00:30:20.000
It doesn't jive.
00:30:20.000 --> 00:30:22.240
It doesn't make any sense.
00:30:22.240 --> 00:30:30.160
And what gets me is that not only is that obviously that's gatekeeping, that's keeping amazing folks in.
00:30:30.160 --> 00:30:38.799
I always say this, like i I liken it to when, you know, my my my oldest niece graduated a couple years ago.
00:30:38.799 --> 00:30:41.440
My youngest niece is about to graduate this year.
00:30:41.440 --> 00:30:43.680
When they were getting into school, right?
00:30:43.680 --> 00:30:50.799
When they were getting into undergrad, I said, I I I would never I would have never gotten in with the type of barriers and things that they have to do.
00:30:50.799 --> 00:30:53.680
Or then I thought back to my undergrad.
00:30:53.680 --> 00:30:55.519
Would I would I get into Trinity College now?
00:30:55.519 --> 00:30:56.160
I don't think so.
00:30:56.160 --> 00:30:56.720
I don't know.
00:30:56.720 --> 00:31:04.240
So I look back now, there's no way I'd get in as a career switcher now with with the types of of barriers that are there.
00:31:04.240 --> 00:31:06.160
There's there's that gatekeeping aspect.
00:31:06.160 --> 00:31:18.960
Then the other thing that's a bit more down the road but is worrisome to me, is where do the mid and senior level people come from in a field normally?
00:31:18.960 --> 00:31:28.240
The juniors that stuck it out and got the salt on them and stayed in and and graduated to higher levels of proficiency.
00:31:28.240 --> 00:31:29.839
Where are we getting those folks now?
00:31:29.839 --> 00:31:31.359
The ether?
00:31:31.359 --> 00:31:43.920
Like i if if we're making all these hoops and and and honestly, like in they there's no congruency to the things that we're asking folks to do to get into the field.
00:31:43.920 --> 00:31:52.559
Not even to mention that you see those jobs and they're still trying to pay junior level money.
00:31:52.559 --> 00:32:02.960
So I I just don't understand what we're we're setting ourselves up for a tsunami of we don't have people to fill the roles that we need.
00:32:02.960 --> 00:32:05.519
And and another thing that really just irks me.
00:32:05.519 --> 00:32:13.759
Yeah, you can tell this whole the whole subject does, but the thing that does irk me is the cyber field in particular goes, oh, there's no good people out there.
00:32:13.759 --> 00:32:14.559
Wait a second.
00:32:14.559 --> 00:32:20.079
Yes, there are tons of folks that I know would be phenomenal, but we don't let them in.
00:32:20.079 --> 00:32:27.200
We don't have pipelines, we don't have bridges, we don't go out into communities that potentially like mine, right?
00:32:27.200 --> 00:32:31.440
Like uh my origin story, I didn't mention tech till many years later.
00:32:31.440 --> 00:32:36.720
You uh we don't go out into communities and say, hey, there's you know, tech could work.
00:32:36.720 --> 00:32:37.200
Yes.
00:32:37.200 --> 00:32:38.160
This is a path.
00:32:38.160 --> 00:32:42.240
This is a way to, you know, to improve improve your uh your situation.
00:32:42.240 --> 00:32:44.880
It's it's it's maddening.
00:32:44.960 --> 00:32:51.359
Well, you know, one of the problems that I find is that the people who are putting those positions don't even understand them.
00:32:51.359 --> 00:33:13.920
So a lot of times they'll go to a chat GPT or some AI source and ask it to write a job description and they'll post it, and then the person or whomever will get into the interview and they'll either ask about, you know, the bullet points, the 500 bullet points, and then the person interviewing be like, oh, we just put that in there.
00:33:13.920 --> 00:33:18.720
Have you ever that I that I've had that experience, and I'm sure a lot of people have had that experience.
00:33:18.720 --> 00:33:24.640
And so, well, we'll well, just you putting that in there has turned away so many applicants.
00:33:24.640 --> 00:33:35.920
I'm sure if you've ever been on LinkedIn, and you always know if a job is actually a legitimate job based on the, you know, how they put the number of how many people apply.
00:33:35.920 --> 00:33:38.799
Like if it's over a hundred, it's probably not a real job.
00:33:38.799 --> 00:33:44.400
But if it's honestly if it's like 30 people apply, it's like it's probably a real job.
00:33:44.400 --> 00:33:44.960
Maybe, yeah.
00:33:44.960 --> 00:33:46.480
Yeah, it might maybe a real job.
00:33:46.960 --> 00:33:47.920
The chances are better, right?
00:33:47.920 --> 00:33:49.039
You're still playing roulette.
00:33:49.359 --> 00:33:51.359
Yeah, because it's like, okay, a hundred people apply.
00:33:51.359 --> 00:33:53.440
Why are you telling it's just like why am I gonna apply?
00:33:53.440 --> 00:33:55.200
It does it's like nonsensical, right?
00:33:55.200 --> 00:33:55.519
No.
00:33:55.519 --> 00:33:59.440
And you had this beautiful saying kind of out of your Genesis story.
00:33:59.440 --> 00:34:08.559
Um, your it starts with your mom saying, Mijo, I want you to talk about that and like how that really got you having a firm um foundation.
00:34:09.119 --> 00:34:21.360
So it was, you know, again, you know, I I did school, went to business school, did the financial advising, and my and my and my undergrad wasn't a financial advising degree, right?
00:34:21.360 --> 00:34:22.559
It was it was philosophy.
00:34:22.559 --> 00:34:30.559
So my mother at this stage of life is going, okay, Mijo, you know, plantate con lo pie firmamente debajo.
00:34:30.559 --> 00:34:32.639
Like put your feet firmly underneath you.
00:34:32.639 --> 00:34:39.519
If you're gonna make this change, make sure you're going in eyes open, you're doing your research.
00:34:39.519 --> 00:34:48.800
She was the best career coach at that point in time to make sure that, hey, I wasn't just gonna, you know, try this for a year or two and then say, oh, this is not for me.
00:34:48.800 --> 00:34:53.760
Um, because she had she had seen that obviously with undergrad and then the financial advising.
00:34:53.760 --> 00:35:01.360
Um but even then, what what kills me now is that somebody can do that, can do the research.
00:35:01.360 --> 00:35:08.000
I have tons of folks that reach out on LinkedIn, I'll sit with them, I'll, you know, I have a saying with my my CISOs, I'll talk to them all.
00:35:08.239 --> 00:35:08.400
Right?
00:35:08.559 --> 00:35:11.679
If they reach out, I'll make a half hour, let's how can I help you?
00:35:11.679 --> 00:35:12.480
How can I be a service?
00:35:12.480 --> 00:35:14.480
I like starting the conversation that way.
00:35:14.480 --> 00:35:19.360
And they'll tell me, hey, I have it, I have it planned out this way, this is what I'm getting into.
00:35:19.360 --> 00:35:27.920
They'll tell me, they'll tell me some deep part of cybersecurity, and they'll have a roadmap all the way to get there, right?
00:35:27.920 --> 00:35:36.079
And and it warms my heart, but then it also makes me sad because like they're not gonna get the chance in a lot of cases to get there.
00:35:36.079 --> 00:35:38.880
They've they have a better roadmap than I did when I started.
00:35:38.880 --> 00:35:43.199
They have their feet f more firmly underneath them than even I did, right, according to my mom.
00:35:43.199 --> 00:35:47.360
And it's still the the pipeline's just just not there.
00:35:48.159 --> 00:35:59.039
You know what's interesting because I I think a lot of similar to artificial intelligence, a lot of CEOs and a lot of um a lot of business owners, everyone's like, we gotta get this AI thing, right?
00:35:59.039 --> 00:36:00.719
Most of them don't even know what AI is.
00:36:00.719 --> 00:36:01.199
Oh no.
00:36:01.199 --> 00:36:04.639
They think it means Chat GPT, and it does not.
00:36:04.639 --> 00:36:09.679
And so I I feel like the same thing is happening when it comes to cybersecurity.
00:36:09.679 --> 00:36:17.440
Like no one realizes that artificial intelligence, generative AI is a subdomain, and that there are all these different pieces of artificial intelligence.
00:36:17.440 --> 00:36:19.280
It's been around for a very long time.
00:36:19.280 --> 00:36:31.039
And I'm wondering how do you get leaders to one understand cybersecurity and without giving without using fear tactics.
00:36:31.039 --> 00:36:32.800
Like how what does that look like?
00:36:33.360 --> 00:36:44.800
I think the the best advice I ever got and that I hold to mind is I'm a business problem solver whose tool is cybersecurity.
00:36:45.360 --> 00:36:45.920
Oh, I like that.
00:36:46.320 --> 00:36:51.519
Since turning that perspective around, and again, shout out to my director as well as my CISO.
00:36:51.519 --> 00:36:53.840
I'm blessed with a great leadership team.
00:36:53.840 --> 00:36:56.559
Um love working for those two.
00:36:56.559 --> 00:37:05.599
If you're then able to say, hey, what are the business problems that you're facing, I might be able to help you.
00:37:05.599 --> 00:37:12.480
Here's how I can help you in my lane, you start then going, wait a second.
00:37:12.480 --> 00:37:25.039
The person you're talking to starts going, wait, they're not just trying to beat me over the head with cyber, they're not just trying to wave around IT terms, or they're not just trying to, you know, throw IT at me and then just just trust me, right?
00:37:25.039 --> 00:37:26.559
Sources trust me, bro.
00:37:26.559 --> 00:37:29.119
No, that's not that's that can't happen.
00:37:29.119 --> 00:37:34.960
But if you sit there and listen, and and it's funny because it goes recursively, obviously, back to like my sales background.
00:37:34.960 --> 00:37:44.960
That's how you know you sit there and try to qualify the customer, understand like what is the problem that they're coming to you for to solve.
00:37:44.960 --> 00:37:59.599
Speak to the benefits, speak to the outcomes, speak to what new future your solution can offer versus I'm just gonna lock this down and you know, you you can tell.
00:37:59.599 --> 00:38:01.360
And sometimes it even happens to me.
00:38:01.360 --> 00:38:05.039
Like I I try to practice this a lot, but you can tell folks' eyes will glaze over.
00:38:05.039 --> 00:38:07.199
Yeah if you start going off in the cyber world.
00:38:07.199 --> 00:38:09.519
Cool, you're showing off that you know some terms.
00:38:09.519 --> 00:38:09.920
Yes.
00:38:09.920 --> 00:38:10.639
Amazing.
00:38:10.639 --> 00:38:11.119
Yes.
00:38:11.119 --> 00:38:12.880
But they're coming into you to solve a problem.
00:38:12.880 --> 00:38:16.159
So go back to that and and and talk to that.
00:38:16.159 --> 00:38:18.960
Then I think, and you don't have to bring up the fear.
00:38:18.960 --> 00:38:26.000
You you know, that that's kind of understood a little bit, where it's like, hey, listen, if you don't do this, then it's out in the open and that's all she wrote.
00:38:26.000 --> 00:38:27.440
But you don't have to harp on that.
00:38:27.440 --> 00:38:28.639
How can I help you?
00:38:28.639 --> 00:38:30.159
What am I solving for you?
00:38:30.159 --> 00:38:32.079
What pain point am I getting rid of?
00:38:32.079 --> 00:38:34.159
Cool, I have a cyber tool that can help that.
00:38:34.159 --> 00:38:34.719
Right.
00:38:34.719 --> 00:38:36.000
And if I don't, be honest.
00:38:36.559 --> 00:38:42.000
Now let me ask you, you provided our students with kind of some tips and safety tips about cybersecurity.
00:38:42.000 --> 00:39:03.679
Do you ever use things like um you can give us some examples of you know some of the things that but do you ever use analogies to for people in kind of higher positions, executives, for their personal life so that they can kind of better understand so that you don't get those those gay glazing over.
00:39:04.079 --> 00:39:04.480
Absolutely.
00:39:04.480 --> 00:39:27.599
I I always I like to bring it back to one one of the the the things that I jumped on in terms of getting into IT really to begin with was one time my my mom, you know, she's from Puerto Rico and she said, Omar, I want to learn about this email.
00:39:27.599 --> 00:39:29.039
Help me with this email, right?
00:39:29.039 --> 00:39:30.480
She had never sent an email.
00:39:30.480 --> 00:39:34.480
Not you know, it wasn't it wasn't part of her her skill set there, right?
00:39:34.480 --> 00:39:39.199
But she knew that it was a way to maybe potentially talk to the folks back home.
00:39:39.199 --> 00:39:40.079
Right.
00:39:40.079 --> 00:39:57.280
And I just remember walking her through, it was the simplest thing for me, but just patiently answering her questions and and walking her through, setting up her Gmail account, and seeing just like her eyes lit up with this is magic.
00:39:57.280 --> 00:39:58.159
Wait a second.
00:39:58.159 --> 00:40:03.360
I can s you know, I I'm reconnecting back to my home country.
00:40:03.360 --> 00:40:09.840
Like, you know, yeah, she has the phone, of course, and that but like being able to, you know, have that asynchronous communication.
00:40:09.840 --> 00:40:15.039
And then obviously that were was the training wheels to then getting her like more on the internet.
00:40:15.039 --> 00:40:15.519
Sure.
00:40:15.519 --> 00:40:15.840
Right?
00:40:15.840 --> 00:40:17.440
Then then the whole world opened up for.
00:40:17.440 --> 00:40:27.440
And it's just it just I always remember that in terms of then coming back to, hey, what what are you trying to do here?
00:40:27.440 --> 00:40:27.760
Right.
00:40:27.760 --> 00:40:41.039
The analogies that I that I bring up, I usually just bring them back to whatever the per the a person will tell you, I always say like, they'll tell you like what their pain points are and what their hopes and aspirations are.
00:40:41.039 --> 00:40:44.880
They'll hint at it in the first like five to ten minutes of talking to you.
00:40:44.880 --> 00:40:45.280
Mm-hmm.
00:40:45.280 --> 00:40:46.239
If you're listening.
00:40:46.239 --> 00:40:46.719
Sure.
00:40:46.719 --> 00:40:52.239
If you're focused on I'm smart and I'm just trying to tell you something, you'll miss the signs.
00:40:52.239 --> 00:40:57.519
But if you sit there and you just take a beat and you they'll folks will tell you.
00:40:57.519 --> 00:40:59.199
Folks will tell you what's important to them.
00:40:59.760 --> 00:41:11.119
Well you know what I love about that, and especially the the example of your mother, is that the older generation, they I feel like they are being targeted so hard right now.
00:41:11.119 --> 00:41:28.239
Um and it's it's just so interesting because the naivete that happens and it's it's sad because they are not able to distinguish if someone's lying to them and selling something and it always comes on a phone call.
00:41:28.239 --> 00:41:43.920
How, you know, for our audiences, a growing audience, how would how would you recommend they protect themselves or their caretakers help them navigate like difficult like, you know, um calls and all the stuff that floods their inboxes?
00:41:44.000 --> 00:41:56.880
I always say, and this is this is still for all the tech solutions that we've come up with, one of the main ways that an enterprise gets compromised is still social engineering.
00:41:56.880 --> 00:42:00.239
So it's a great, it's a great topic that that you're pivoting to.
00:42:00.239 --> 00:42:07.840
Now with AI, the old school ways of saying, well, the grammar's bad, that's out the window.
00:42:07.840 --> 00:42:22.000
Uh even non-native English speakers can use an LLM to craft an amazingly worded uh targeting message to an audience that they don't speak the native language of.
00:42:22.000 --> 00:42:22.880
So that's out the window.
00:42:22.880 --> 00:42:32.000
So grammar, um, you know, you can spoof email addresses, all the technical things are still they're they're increasingly less of a checklist that you can go to.
00:42:32.000 --> 00:42:41.519
But still the main thing that I try to instill in in any security awareness training that I I support take a beat.
00:42:41.519 --> 00:42:52.719
If there's if there's a sense of urgency that's coming from the other side of that communication, take two beats.
00:42:52.719 --> 00:42:55.840
It very it doesn't it's not fail-safe.
00:42:55.840 --> 00:43:00.400
Could very well be, you know, you might get that panicked phone call from a family member.
00:43:00.400 --> 00:43:01.679
It happens, life happens.
00:43:01.679 --> 00:43:14.800
But nine times out of ten, if they're going, you have to do this now, uh, wait a second, your your your stuff is compromised, click here, or calling you, hey, I need this, I need your information, we're doing an investigation.
00:43:14.800 --> 00:43:17.519
Or uh this is the help desk.
00:43:17.519 --> 00:43:18.159
You know.
00:43:18.159 --> 00:43:25.519
If there's a sense of urgency being foisted on you, that should ring alarm bells.
00:43:25.519 --> 00:43:25.920
Sure.
00:43:25.920 --> 00:43:28.239
Do a little bit more due diligence there.
00:43:28.239 --> 00:43:29.519
Take a step, right?
00:43:29.519 --> 00:43:34.639
Not to mention why would a help desk be calling you if you didn't call them to get help, etc.
00:43:34.639 --> 00:43:40.000
But that's a little bit more, I feel it's it's not like that one rule I can say.
00:43:40.000 --> 00:43:49.599
But if someone's trying to get you to do something quickly, you the hairs on the back of your neck should come up and then take a couple steps and really examine.
00:43:49.599 --> 00:43:51.679
Then you can start understanding.
00:43:51.679 --> 00:43:55.199
Okay, then uh the other tips might start to show themselves.
00:43:55.199 --> 00:43:57.039
Like why are they calling me?
00:43:57.039 --> 00:43:58.320
Where is this coming from?
00:43:58.320 --> 00:43:59.679
Is there an extra letter?
00:43:59.679 --> 00:44:03.199
In the address that you wouldn't have noticed if you didn't take that step.
00:44:03.199 --> 00:44:06.239
But that social engineering is always keyed in.
00:44:06.239 --> 00:44:10.159
And again, sadly, like you say, it's targeting those populations.
00:44:10.159 --> 00:44:14.719
But if it's urgent, double check it.
00:44:14.800 --> 00:44:15.360
Absolutely.
00:44:15.360 --> 00:44:29.119
And you know, it's interesting because when I I think also avoidance, for lack of a better term, is like putting on there are blockers you can put on home phones so that they the caller has to talk and explain themselves.
00:44:29.119 --> 00:44:36.880
With text messaging, now they text you for anyone who's out there when someone's texting you about a job.
00:44:36.880 --> 00:44:42.239
I actually have one person who keeps calling the spammer back.
00:44:42.239 --> 00:44:44.000
Those are fun.
00:44:44.000 --> 00:44:45.280
Those are fughts.
00:44:45.280 --> 00:45:02.000
There are vulnerabilities in some of their some of the way they communicate to each other.
00:45:02.000 --> 00:45:09.280
What are some tips that you can give parents when it comes to to that if you if you were like a kid?
00:45:09.280 --> 00:45:13.519
I feel like sometimes a kid with a cell phone is not too much of a good idea.
00:45:13.679 --> 00:45:16.719
It's uh it's one of those things and it's something I'm facing now, right?
00:45:16.719 --> 00:45:19.920
I I have a two-year-old and I know that conversation is coming.
00:45:19.920 --> 00:45:26.480
Uh she's already very keen on what's mom or dad doing on the laptop, what's mom or dad doing on the phone, right?
00:45:26.480 --> 00:45:27.760
She notices that a lot.
00:45:27.760 --> 00:45:38.159
And one of the things that I've I've seen, and because this is a question I've been asking myself to my peers, what what are you doing, what's going on?
00:45:38.159 --> 00:45:42.000
I think you have to take sadly, not sadly, but uh it's an extra step.
00:45:42.000 --> 00:45:46.800
You have to take an active role in what they're doing with those devices.
00:45:46.800 --> 00:45:55.360
Um does the person need to have communication capabilities if they're playing Roblox.
00:45:55.360 --> 00:45:56.719
What why?
00:45:56.719 --> 00:45:57.039
Yeah.
00:45:57.039 --> 00:45:58.880
Who's on the front?
00:45:58.880 --> 00:46:15.679
Having the conversations appropriately at whatever age they're at and saying, listen, this is not just the character that you're talking to on this Discord server or in in this uh chat room before you you know you drop in and play a couple rounds of of battlefield or whatnot.
00:46:15.679 --> 00:46:17.760
It's these are other people.
00:46:17.760 --> 00:46:18.239
Yes.
00:46:18.239 --> 00:46:18.639
Right?
00:46:18.639 --> 00:46:24.079
And and there's very little that they need to know about you in order to play, right?
00:46:24.079 --> 00:46:27.039
You don't want to be the no fun folks, because then what's gonna happen?
00:46:27.039 --> 00:46:28.320
They're just gonna work around you.
00:46:28.320 --> 00:46:28.719
Sure.
00:46:28.719 --> 00:46:32.400
So you know, engage and understand that, yeah, yeah, there's there's need for this.
00:46:32.400 --> 00:46:43.519
But I'll tell you what, personally for me, that that cell phone conversation is gonna be is gonna be a difficult one because I just, you know, now we're seeing it's kind of a recursive loop, right?
00:46:43.519 --> 00:46:44.159
A sine wave.
00:46:44.159 --> 00:46:46.559
You're seeing schools go, you don't need it all day.
00:46:46.559 --> 00:46:47.039
No.
00:46:47.039 --> 00:46:48.159
Deposit it.
00:46:48.159 --> 00:46:55.440
So, you know, I get the tug of you want to be able to communicate, but at what cost?
00:46:55.440 --> 00:47:00.000
You're seeing countries now determine that under 16 you don't need social media.
00:47:00.000 --> 00:47:00.320
No.
00:47:00.320 --> 00:47:03.360
More of those, and I'm I'm kind of in favor of that.
00:47:03.840 --> 00:47:04.480
No, I agree.
00:47:04.480 --> 00:47:17.519
I mean, I I I I observed my my son actually, he was playing chess and some way the setting was on like a he was playing the computer, but the computer was actually another person.
00:47:17.519 --> 00:47:21.039
And the person had a name, and I was like, whoa, whoa, whoa, who is this?
00:47:21.039 --> 00:47:26.239
And then I had to go to a setting, it was like buried to like turn it off.
00:47:26.239 --> 00:47:29.840
And so all these things, because you know, who doesn't want their kid to play chess?
00:47:29.840 --> 00:47:30.320
Of course.
00:47:30.320 --> 00:47:35.280
But then you have some you don't know who this person is playing chess with it with the you know, a kid.
00:47:35.280 --> 00:47:41.039
And so it just becomes um, you know, really, really tricky.
00:47:41.039 --> 00:47:41.280
Yes.
00:47:41.280 --> 00:47:46.719
Um and I love that you f you picked up the idea that schools are turning away from technology.
00:47:46.719 --> 00:47:52.639
You know, and in my my opinion is that as a parent, you have to be involved.
00:47:52.639 --> 00:47:56.960
I mean, there are there are no perfect parents, you can't be everywhere with your kids.
00:47:56.960 --> 00:48:01.679
But I feel like, just like I feel with SEI, our goal is to empower our kids.
00:48:01.679 --> 00:48:05.440
Obviously, when they're younger, you have to intervene and play an active role.
00:48:05.440 --> 00:48:10.159
But at the end of the day, we're sending them out, especially high school students, we're sending them out into the world.
00:48:10.159 --> 00:48:12.320
We're not gonna be there, you're not gonna be there, right?
00:48:12.320 --> 00:48:20.639
And so you want them to have be like, mm, I remember Omar was on coding conversations and he said, he said I should not do this.
00:48:20.639 --> 00:48:23.760
So that we kind of, you know, we're teaching them, right?
00:48:23.760 --> 00:48:25.199
Um I love that.
00:48:25.199 --> 00:48:33.519
So, Omar, if you could leave a voice message for your younger self um on uh day one in cybersecurity, what would you say?
00:48:33.920 --> 00:48:43.280
It's uh it's a phrase that my my father used to say to me, you know, he's not he's not with us now, and and it's something that I hear uh and especially on days when Barcelona soccer plays, right?
00:48:43.280 --> 00:48:43.840
Which was today.
00:48:43.840 --> 00:48:45.599
And they've they won three nothing big.
00:48:45.920 --> 00:48:46.480
Oh congratulations.
00:48:47.440 --> 00:48:48.800
A banner day for me today.
00:48:48.800 --> 00:48:51.360
Um Tranquilo, mijo.
00:48:51.360 --> 00:48:52.639
Like relax.
00:48:52.639 --> 00:48:54.159
Relax.
00:48:54.159 --> 00:48:59.440
It's you're not late, you're on time for where you need to be.
00:48:59.679 --> 00:48:59.920
Okay.
00:49:00.800 --> 00:49:02.079
It'll work itself out.
00:49:02.320 --> 00:49:02.559
Okay.
00:49:02.800 --> 00:49:07.119
Because I remember again as a career switcher, I felt like I was behind the eight-ball.
00:49:07.119 --> 00:49:11.599
I felt like, wait a second, all these people uh have ten years on me.
00:49:11.599 --> 00:49:13.519
I'm just trying to break in, right?
00:49:13.519 --> 00:49:14.960
I'm 30, what am I doing?
00:49:14.960 --> 00:49:16.320
Oh no.
00:49:16.320 --> 00:49:20.719
And just that's something I tell myself and it's it's funny.
00:49:20.719 --> 00:49:31.519
Now it's advice I give, and I always preface it with, you know, f if uh you know, if my wife were in the room, she'd laugh because like there's definitely nothing tranquilo about how I was trying to break in.
00:49:31.519 --> 00:49:33.039
I was trying to make up for lost time.
00:49:33.039 --> 00:49:36.079
But you know, you're you're running your own race.
00:49:36.079 --> 00:49:38.639
You gotta be better than you were yesterday, and that's it.
00:49:38.800 --> 00:49:39.039
Yeah.
00:49:39.199 --> 00:49:39.679
That's all.
00:49:39.679 --> 00:49:42.480
That's that's really what I because I think I'd enjoy it more.
00:49:42.639 --> 00:49:42.880
Yeah.
00:49:43.119 --> 00:49:43.920
To start, right?
00:49:43.920 --> 00:49:51.519
You know, I I'd I'd again my wife, you know, there's gonna be a time when you're not an analyst and you're gonna look back and remember those days fondly.
00:49:51.519 --> 00:49:52.800
And I said, What are you talking about?
00:49:52.800 --> 00:49:55.280
I want to get promoted, I want to continue, I want to hard charge.
00:49:55.280 --> 00:49:57.360
And she was a hundred percent correct.
00:49:57.599 --> 00:49:57.760
Yeah.
00:49:57.920 --> 00:50:01.679
There's days I'm like, oh, I remember when I was just a risk contract analyst.
00:50:01.679 --> 00:50:03.119
Those were amazing days.
00:50:03.119 --> 00:50:05.039
I had so much, it was great.
00:50:05.039 --> 00:50:10.320
Um you know, not that I don't like where I'm doing or where I'm at now, but it was just it was a different time.
00:50:10.320 --> 00:50:17.360
And I I think, you know, being more present, relaxing, tranquilo, chill, it'll come.
00:50:17.920 --> 00:50:18.559
I love that.
00:50:18.559 --> 00:50:32.639
I I feel like I just had that conversation in regards to being an AI and building algorithms and was talking to a bunch of people, uh, and I said, you know, do you ever feel like you're going too slow?
00:50:32.639 --> 00:50:34.559
And they were like, everyone feels that way.
00:50:34.559 --> 00:50:34.719
Yeah.
00:50:34.719 --> 00:50:36.239
Everyone in this room feels that way.
00:50:36.239 --> 00:50:38.800
We all feel like we can't, we're developing too slow.
00:50:38.800 --> 00:50:43.760
And uh it's just so I guess it's I think in God's time is the way to look at it, right?
00:50:43.760 --> 00:50:44.239
Absolutely.
00:50:44.239 --> 00:50:46.880
And so we're rounding out our conversation here with Omar.
00:50:46.880 --> 00:50:48.159
We have a lightning round.
00:50:48.159 --> 00:50:48.400
Okay.
00:50:48.400 --> 00:50:49.679
And so this is how it goes.
00:50:49.679 --> 00:50:54.000
Now, a lot of guests try to say both, but you have to pick one.
00:50:54.000 --> 00:50:54.480
Okay?
00:50:54.480 --> 00:50:55.679
It's gonna pin you down.
00:50:55.679 --> 00:50:59.440
All right, so I'm gonna give you two choices and you you gotta pick one, okay?
00:50:59.440 --> 00:51:00.400
Which one you prefer?
00:51:00.400 --> 00:51:02.800
Okay, so let's kick it off with the most important one.
00:51:02.800 --> 00:51:03.599
Coffee or tea?
00:51:03.920 --> 00:51:04.880
Bustello, coffee.
00:51:05.039 --> 00:51:05.280
All that.
00:51:05.280 --> 00:51:06.000
All day.
00:51:06.000 --> 00:51:07.039
Did you use the press?
00:51:07.039 --> 00:51:07.840
Do you do the press?
00:51:07.840 --> 00:51:09.039
Uh no, not that fancy.
00:51:09.039 --> 00:51:09.760
Not that fancy.
00:51:09.760 --> 00:51:11.119
No, no, no, no, no.
00:51:11.119 --> 00:51:14.239
Uh control alt delete or stay on this page.
00:51:14.559 --> 00:51:15.360
Three finger salute.
00:51:15.360 --> 00:51:16.320
Control alt delete.
00:51:16.320 --> 00:51:16.800
Absolutely.
00:51:16.960 --> 00:51:17.280
100%.
00:51:17.280 --> 00:51:18.400
I love that.
00:51:18.400 --> 00:51:20.320
Morning meetings or afternoon meetings?
00:51:20.320 --> 00:51:21.280
Afternoon meetings.
00:51:21.280 --> 00:51:21.760
Okay.
00:51:21.760 --> 00:51:22.239
Oh, yeah.
00:51:22.239 --> 00:51:24.000
Um, iPhone or Android.
00:51:24.000 --> 00:51:24.719
iPhone.
00:51:24.719 --> 00:51:26.400
Work from home or in the office?
00:51:26.719 --> 00:51:27.199
Work from home.
00:51:27.519 --> 00:51:29.039
Slack messages or email?
00:51:29.440 --> 00:51:30.800
Am I in trouble?
00:51:30.800 --> 00:51:37.199
Because I prefer like Slack messages, but I will be the first one to email if I need a receipt.
00:51:37.199 --> 00:51:40.960
Like if it's official, if it's some, if I you know, and and I feel the same way.
00:51:40.960 --> 00:51:42.320
I I definitely put that on people.
00:51:42.320 --> 00:51:42.719
Yeah.
00:51:42.719 --> 00:51:43.119
Right?
00:51:43.119 --> 00:51:44.159
Why are you emailing me?
00:51:44.159 --> 00:51:45.679
Like, are you trying to wait a second?
00:51:45.920 --> 00:51:46.639
Are you trying to record?
00:51:46.639 --> 00:51:50.000
Well, well, Slack I feel drives me a little crazy.
00:51:50.239 --> 00:51:51.280
Oh no, the pings are nuts.
00:51:51.599 --> 00:51:54.000
The pings are like, you're like, what's going on?
00:51:54.000 --> 00:51:55.760
And it's like a hundred percent.
00:51:55.760 --> 00:51:57.199
And no one follows the rules.
00:51:57.199 --> 00:51:57.519
No.
00:51:57.920 --> 00:51:58.800
No one follows the rules.
00:51:58.800 --> 00:52:02.800
And that little message that says, oh, send it during hours.
00:52:02.800 --> 00:52:04.639
No, they don't believe in their mothers.
00:52:04.639 --> 00:52:05.519
It's like that.
00:52:05.519 --> 00:52:06.320
Terrible.
00:52:06.400 --> 00:52:07.199
I I can't stand it.
00:52:07.199 --> 00:52:07.679
Okay.
00:52:07.679 --> 00:52:09.039
Dark mode or light mode.
00:52:09.039 --> 00:52:09.760
Dark mode.
00:52:09.760 --> 00:52:10.320
Okay.
00:52:10.320 --> 00:52:13.199
Password manager or I'll remember it.
00:52:13.519 --> 00:52:14.480
Oh, password manager.
00:52:14.480 --> 00:52:14.800
Okay.
00:52:14.800 --> 00:52:15.920
Oh, yeah.
00:52:15.920 --> 00:52:17.199
There's no way.
00:52:17.199 --> 00:52:20.320
I can't remember all that.
00:52:20.320 --> 00:52:21.280
Yeah.
00:52:22.239 --> 00:52:23.920
Automation or manual control?
00:52:24.320 --> 00:52:24.800
Automation.
00:52:25.280 --> 00:52:25.599
Okay.
00:52:25.599 --> 00:52:30.559
Biggest pet peeve, just click approve, or can we circle back next quarter?
00:52:30.880 --> 00:52:32.880
Oh, can we circle back next quarter?
00:52:33.280 --> 00:52:33.519
No.
00:52:34.079 --> 00:52:37.280
The best time to sort something is yesterday, and the second best time is today.
00:52:37.280 --> 00:52:38.880
I don't like I'm no.
00:52:38.880 --> 00:52:40.320
Don't call me, I'll call you.
00:52:40.320 --> 00:52:41.360
Let's figure this out now.
00:52:41.760 --> 00:52:45.760
I love that because then the to-do list becomes uh it's never gonna happen.
00:52:45.760 --> 00:52:46.239
100%.
00:52:46.239 --> 00:52:48.960
Once we go into the to do to-do list, we're done.
00:52:48.960 --> 00:52:50.320
It's not gonna happen.
00:52:50.559 --> 00:52:51.199
It's a myth.
00:52:52.719 --> 00:52:53.360
I love that.
00:52:53.360 --> 00:52:55.280
Well, thank you so much, Omar.
00:52:55.280 --> 00:52:57.199
It was a pleasure to see you.
00:52:57.199 --> 00:52:58.559
And where can we find you?
00:52:58.559 --> 00:52:59.360
I think on LinkedIn.
00:52:59.519 --> 00:53:00.400
Yep, LinkedIn, Dr.
00:53:00.400 --> 00:53:01.119
Omar S.
00:53:01.440 --> 00:53:01.840
I love that.
00:53:01.840 --> 00:53:02.159
Dr.
00:53:02.159 --> 00:53:03.840
Omar S on LinkedIn.
00:53:03.840 --> 00:53:04.880
Thank you so much.
00:53:04.880 --> 00:53:08.400
Thank you for joining us on today's episode of Coding Conversations.
00:53:08.400 --> 00:53:11.440
Remember to like and subscribe and check out our swag.
00:53:11.440 --> 00:53:12.639
Thank you again.