WEBVTT
00:00:11.039 -->
00:00:16.000Welcome to Coding Conversations, produced by the STEM Educational Institute.
00:00:16.000 -->
00:00:24.960I'm Nikisha Alcindor, president and founder of the STEM Educational Institute, where we provide free programming in financial literacy, STEM, and mental health.
00:00:24.960 -->
00:00:28.480We work with high school students, they go through a one-year program.
00:00:28.480 -->
00:00:31.120At the end, they earn a college scholarship.
00:00:31.120 -->
00:00:39.679Coding Conversations are ways to bring exciting voices to you, the viewer, about things in the areas of STEM financial literacy and mental health.
00:00:39.679 -->
00:00:43.520And today we have an exciting topic as well as an exciting guest.
00:00:43.520 -->
00:00:47.920We're going to be talking about cybersecurity, particularly cybersecurity and health.
00:00:47.920 -->
00:00:51.359And to help us with that conversation is Omar Sangurima.
00:00:51.359 -->
00:00:52.240Welcome, Omar.
00:00:52.640 -->
00:00:53.200Thanks for having me.
00:00:53.200 -->
00:00:53.920Excited to be here.
00:00:54.159 -->
00:00:55.520We're so happy to have you.
00:00:55.520 -->
00:01:02.799So Omar is the head of cyber program management and third-party risk management at Memorial Sloan Kettering Cancer Center.
00:01:02.799 -->
00:01:07.840You can think of Omar's job as being the digital bodyguard for the hospital.
00:01:07.840 -->
00:01:18.480And Omar's goal is to build strategies that stop hackers from stealing information from disrupting the technology that doctors use to save lives.
00:01:18.480 -->
00:01:24.239And he teaches, he treats his work as like a high-stakes chess game, if you will.
00:01:24.239 -->
00:01:33.840And what he does is he has to predict what bad folks might do and find the weak spots in MSK defenses and fix them before anyone can attack.
00:01:33.840 -->
00:01:41.599And so if you love solving puzzles or beating tough bosses in games, cybersecurity is the career for you.
00:01:41.599 -->
00:01:55.439And when not protecting hostile data, he's usually strategizing in other ways, whether it be obsessing over fantasy football lineups or tackling difficult challenges in single-player RPG video games.
00:01:55.439 -->
00:02:00.959Omar is always trying to do things that are innovative and high risk, right?
00:02:00.959 -->
00:02:02.480And so welcome, Omar.
00:02:02.480 -->
00:02:04.079We're so glad to have you here today.
00:02:04.400 -->
00:02:04.640Thank you.
00:02:04.640 -->
00:02:05.680Thanks for having me.
00:02:06.079 -->
00:02:12.400So it's not a conspiracy, but Omar, like myself, for you the those of you who watch the show is from Queens, right?
00:02:12.400 -->
00:02:15.360Is it just you know something in the water?
00:02:15.360 -->
00:02:16.560Something in the water.
00:02:16.560 -->
00:02:19.360We just we just keep going, right?
00:02:19.360 -->
00:02:27.680And so, Omar, you got your degree, you got your MBA from Maris College in Piskix in Poughkeepsie, and then you went on to get your doctorate.
00:02:27.680 -->
00:02:28.000Yes.
00:02:28.000 -->
00:02:34.080So obviously those are very difficult things to obtain and agrees, degrees to obtain.
00:02:34.080 -->
00:02:36.719But before that, take us back to your origin.
00:02:36.719 -->
00:02:43.199Where did you grow up and how did you start to realize cybersecurity was your l field of interest?
00:02:43.680 -->
00:02:51.680So as you said, uh grew up in Queens till I was around nine, moved up to Massachusetts, followed my sister.
00:02:51.680 -->
00:02:55.439She got a residency up there, Bay State Medical Center.
00:02:55.439 -->
00:03:01.759So uh she grabbed me and and our mother, we went up to to right outside of Springfield Mass.
00:03:01.759 -->
00:03:06.400Um there again, the the overriding goal, right?
00:03:06.400 -->
00:03:11.199The the first generation in this country, it's uh education's a silver bullet.
00:03:11.199 -->
00:03:15.280It's uh keep at getting educated, look at your sister, look at what she's done.
00:03:15.280 -->
00:03:19.840So I just kept my head in the books, uh, kept kept uh chipping away.
00:03:19.840 -->
00:03:22.560High school, college, undergrad.
00:03:22.560 -->
00:03:25.039Even then, it was it was odd.
00:03:25.039 -->
00:03:28.639Cyber wasn't exactly I wasn't born with a computer in my hand.
00:03:28.639 -->
00:03:32.479There's some people that I work with, you can tell, uh, they're amazing.
00:03:32.479 -->
00:03:35.199Uh, but that it wasn't that wasn't the origin story.
00:03:35.199 -->
00:03:37.439I I I'm a career switcher.
00:03:37.439 -->
00:03:56.159Um so about 12 years ago, 12, 13 years ago, decided to switch over from financial advising and tried to get into a field that you know I thought was gonna be, you know, innovative, uh challenging, constantly different, different things to to focus on.
00:03:56.159 -->
00:03:58.479And it's been that, thankfully.
00:03:58.479 -->
00:04:03.599So, you know, it's it's been always interesting and never never a dull day in the field, I'll say that.
00:04:03.680 -->
00:04:04.560I love that.
00:04:04.560 -->
00:04:10.479I love when you know going from financial services industry to cybersecurity.
00:04:10.479 -->
00:04:20.399Can you talk about kind of what was it or what are what are some of the courses or things that you did to prepare you or you think prepared you to go into cybersecurity?
00:04:20.480 -->
00:04:32.879So I remember this is funny because the there's one certification that I said, let me give this a try, kind of a test run before I went full bore into say a degree in cyber.
00:04:32.879 -->
00:04:35.519Uh the the Comp TIA Security Plus.
00:04:35.519 -->
00:04:46.480Uh I remember I I chuckle now because w when I'm, you know, when anybody's asking me about, you know, how do I break in, what certs to start with, I say, you know, I studied for that thing for nine months.
00:04:46.480 -->
00:04:55.120I usually pause for laughter at that point because that was a long time, like one cert, but I was just so I had to I was taking a leap.
00:04:55.120 -->
00:04:59.519It was something that I wasn't, you know, of course, classically trained in uh for school.
00:04:59.519 -->
00:05:03.120So studied for nine months there, thankfully passed.
00:05:03.120 -->
00:05:08.160Um, you know, my my origin story would be completely different, I think, if I had stumbled, if I had stumbled then.
00:05:08.160 -->
00:05:14.240But, you know, did that, then started taking a couple courses for an MIS.
00:05:14.240 -->
00:05:14.560Right.
00:05:14.560 -->
00:05:15.759That was my first kind of teaser.
00:05:15.759 -->
00:05:16.160I didn't know.
00:05:16.160 -->
00:05:19.839And tell us what MIS on Masters of Information Systems.
00:05:19.839 -->
00:05:20.480Yep.
00:05:20.480 -->
00:05:30.000So uh to uh started doing that even while I was still kind of you know one foot in the financial field, but definitely looking uh to to move out.
00:05:30.000 -->
00:05:37.839The cert and beating being getting that beating, but getting that certification, I think then I was hooked.
00:05:37.839 -->
00:05:44.959Like I I just loved the idea of being able to take a look at a certain level of challenges, right?
00:05:44.959 -->
00:05:50.560It's always, you know, my my wife has heard this many times, is another it's another windmill to tilt at.
00:05:50.560 -->
00:05:55.360I just love, you know, seeing seeing something on the horizon and saying, you know what, maybe I could figure that out.
00:05:55.360 -->
00:06:03.439And the industry, cybersecurity especially, at that point was still more heavily focused on certification.
00:06:03.439 -->
00:06:10.000So once I started really kind of chaining those together, I started to convince myself that maybe I could do this.
00:06:10.000 -->
00:06:14.319And then from there, you know, uh networked a little bit.
00:06:14.319 -->
00:06:17.279I I got my first job through someone I knew.
00:06:17.279 -->
00:06:24.879It wasn't necessarily it was just, you know, surreptitiously mentioning it to a a buddy of mine at at Jiu Jitsu.
00:06:24.879 -->
00:06:32.399We were it was an open mat, right, in Brazilian jujitsu on a Saturday, and he, you know, he's like, Hey, I hear you're in this cyber thing, you keep talking about it.
00:06:32.399 -->
00:06:32.560Right.
00:06:32.879 -->
00:06:36.639Okay, first of all, you can't just throw in while I was doing jujitsu.
00:06:36.639 -->
00:06:39.920There has to be an explanation for that.
00:06:39.920 -->
00:06:40.879So we got it.
00:06:40.879 -->
00:06:44.800So are you is that kind of one of the other things that you still practice?
00:06:45.199 -->
00:06:46.639I I mean, sort of now.
00:06:46.639 -->
00:06:53.199My body's a little busted up, so I I'm I kind of you know, I'm I'll make appearances at Open Mats uh here here and there.
00:06:53.199 -->
00:07:02.000But I started started Brazilian jujitsu, it was after so I was on the national team for taekwondo, uh, under the under seven the under-18 team.
00:07:02.000 -->
00:07:02.399Okay.
00:07:02.399 -->
00:07:03.839Went to North Korea.
00:07:03.839 -->
00:07:09.519That was the first uh world championships, the second world championships were thankfully in Puerto Rico, right?
00:07:09.519 -->
00:07:12.879So definitely much nicer than North Korea, I'll say that.
00:07:12.879 -->
00:07:16.319Um five days in North Korea as a 15-year-old.
00:07:16.319 -->
00:07:17.519Uh wild wild times.
00:07:17.519 -->
00:07:18.160Wild times.
00:07:18.160 -->
00:07:18.879I'm sure.
00:07:18.879 -->
00:07:19.759Yeah, yeah.
00:07:19.759 -->
00:07:29.199Um yeah, did that, uh, wrestled in high school, and then you know, I didn't want to continue doing the the you know on the adult team for for taekwondo.
00:07:29.199 -->
00:07:30.800I was too too grindy.
00:07:30.800 -->
00:07:33.920So um I I got into Brazilian Jiu-Jitsu.
00:07:33.920 -->
00:07:37.519There was a school near Hartford, Connecticut, where I went to undergrad.
00:07:37.519 -->
00:07:39.600It was uh West Hartford, Connecticut.
00:07:39.600 -->
00:07:44.160And back then it was a it was a huge deal to have like a purple belt teach the class.
00:07:44.160 -->
00:07:44.560Sure.
00:07:44.560 -->
00:07:48.079It was you know, because there was not a lot of black belts uh in the United States at the time.
00:07:48.079 -->
00:07:49.600And uh I got hooked.
00:07:49.600 -->
00:07:55.920I uh you know, and I've been grappling since 99, 2000.
00:07:55.920 -->
00:07:58.079Um yeah, like I said, right?
00:07:58.079 -->
00:08:04.800You know, if I if I shake someone's hand or if I put my hand down, like you can see like the gnarled fingers here and there a little bit, right?
00:08:04.800 -->
00:08:09.279Or if I had if I stretch out, I can remember times when I should have tapped and I didn't.
00:08:09.279 -->
00:08:11.279Uh but uh you know, still love it.
00:08:11.279 -->
00:08:17.680Um but yeah, it was again got into never would have thought that that would have led to you know a career.
00:08:18.160 -->
00:08:31.199So what I love about that is that your physicality actually is translating to your ability, your s your mental strength in terms of what you do and your critical thinking.
00:08:31.199 -->
00:08:40.159And we often see that with with athletes being able to transition kind of their work and their physicality into difficult fields.
00:08:40.159 -->
00:08:48.879Because I remember the term cybersecurity coming out of when people were starting to get hacked or identity theft.
00:08:48.879 -->
00:08:49.679Do you remember this?
00:08:49.679 -->
00:08:55.759Like identity theft came out, and then everyone would you would go to the police and they'd be like, Can't help you, ma'am.
00:08:55.759 -->
00:08:56.240Right?
00:08:56.240 -->
00:08:56.960Do you remember that?
00:08:56.960 -->
00:09:07.679Like it's like so someone stole my identity, and it was like the best, the best way to prevent that is to have all these different alerts and all these things.
00:09:07.679 -->
00:09:11.840And so that was in my mind, that was the scope.
00:09:11.840 -->
00:09:32.080I'd love to see to to get your thoughts on where that scope has has trended towards because back then it was just okay individual information getting stolen, but now we're talking about ransom, like people taking data from companies and data's having you know, companies having to pay for that.
00:09:32.080 -->
00:09:41.200So talk to me a little bit about what you've how you've seen the idea of cybersecurity, like that definition transforming over the years.
00:09:41.279 -->
00:09:49.440So it's really amazing that that you kind of pinpoint it that way, because I see it as kind of a Venn diagram or uh a sine wave, right?
00:09:49.440 -->
00:09:50.399Like down, up, down.
00:09:50.399 -->
00:09:54.480It started with individual identity protection, as you said.
00:09:54.480 -->
00:10:06.480It was kind of very much scoped towards you you're you're gonna get your own your own Social Security number taken, or somebody's gonna start taking, you know, writing checks in your name or taking out loans in your name.
00:10:06.480 -->
00:10:24.080And then I think as business, as enterprise got more interconnected just by virtue of technology advancing, then I think uh cybersecurity took on a bit more of an enterprise uh scope, as you said.
00:10:24.080 -->
00:10:37.120It went then, you know, then business data could get stolen, then intellectual property could get stolen, then not only that of the of the business themselves, but then what about the business's customers, right?
00:10:37.120 -->
00:10:41.279So then you have you start having, wait a second, the the scope starts expanding.
00:10:41.279 -->
00:11:04.559Now what I've been seeing lately is kind of a return towards first principles where, you know, it's still data governance is taking up privacy is I think privacy now, the the concept of privacy and privacy engineering is having kind of the same renaissance that cybersecurity did maybe 10 years ago, 10, 11 years ago, kind of when I started.
00:11:04.559 -->
00:11:11.600And it's you know, the and and to think that they're not distinct fields is is uh is a fallacy.
00:11:11.600 -->
00:11:24.720I think there's there's there's overlap, but there's v fine, fine professionals in privacy engineering that sing a different tune, dance a different dance than the ones in cyber, kind of cousins.
00:11:24.720 -->
00:11:33.120We kind of, you know, we definitely reinforce each other, but it's it's the the days where it's it's the same, you know, are are kind of are kind of gone.
00:11:33.120 -->
00:11:45.039Same as I'd imagined, and this would this would be a little bit before my time, but I've done some some studying in the history of the field that I'm in, is kind of where the the break happened between like information security and cybersecurity, right?
00:11:45.039 -->
00:11:56.879Where it was like, you know, we're making sure that you know physical records are you know uh uh thrown out when they need to be, making sure that folks only have access to you know the hard copies of papers.
00:11:56.879 -->
00:12:03.039Th there it kind of broke away, and then you had the cybersecurity, information security.
00:12:03.039 -->
00:12:08.399Folks still kind of they don't disambiguate the terms, you know, but now I think that's a bit more distinct.
00:12:08.399 -->
00:12:12.960And I think the same thing's kind of happening now with with privacy and cybersecurity.
00:12:12.960 -->
00:12:18.879Fields that are very connected but not anywhere the same and demand different skill sets.
00:12:19.279 -->
00:12:22.639Okay, so you we you brought up the term Venn diagram, right?
00:12:22.639 -->
00:12:31.200And so when I think about kind of privacy settings settings, everyone gets those pop-ups that say, do you want to load cookies?
00:12:31.200 -->
00:12:36.960Most people don't read them, they'll say accept, manage, or reject all, depending on what your options are.
00:12:36.960 -->
00:12:41.440And then you have this kind of cybersecurity malware hacking things.
00:12:41.440 -->
00:12:52.159But then to me, there's like a in the middle, there's some sort of ethical, maybe it's not called ethics, but who gets to decide what goes into what bucket and I guess consumer awareness?
00:12:52.159 -->
00:12:56.399Like who who is like how is that being dished out or divided?
00:12:56.960 -->
00:13:01.840So it's I think for me, the the way I'd split those uh uh it's a matter of outcomes.
00:13:01.840 -->
00:13:30.960So in where where I work, it's usually, well, okay, privacy is gonna sit there and tell us what we need to lock down, uh why to how long for how long, to what extent, you know, makes the that privacy and more data governance says, listen, this is this is important, this is why it's important, whether it's like uh laws, regulations, whether it's intellectual property, right, it's it's uh proprietary to uh to the organization.
00:13:30.960 -->
00:13:33.360Then okay, we've sussed all that out.
00:13:33.360 -->
00:13:45.440Now cyber, come over here and make sure that what we want to have happen with this data, with this information, for these purposes, which is where the privacy comes in for the doctors or for the patients.
00:13:45.440 -->
00:13:46.799Make sure you lock it down.
00:13:46.799 -->
00:13:49.440So that's where you know we we saddle up.
00:13:49.440 -->
00:13:54.559Um where I think then, at least that's that's what happens in the organization.
00:13:54.559 -->
00:13:59.120I think you bring up a great question in terms of who's doing that writ large.
00:13:59.440 -->
00:13:59.679Yes.
00:14:00.080 -->
00:14:00.559I don't know.
00:14:00.559 -->
00:14:10.240That's w you know, uh th this is one of the things that I always harp on when it when you when I get on my soapbox here is, you know, the United States doesn't have a national privacy law.
00:14:10.879 -->
00:14:11.120Right?
00:14:11.440 -->
00:14:12.799Europe has kind of figured it out.
00:14:12.799 -->
00:14:13.200Yes.
00:14:13.200 -->
00:14:18.399Um they're at the forefront with the EU AI Act as well, which is, you know, in add in addition to the GDPR.
00:14:18.399 -->
00:14:31.120But you y we have a patchwork in the United States, which I'll tell you what, makes um locking data down fun when when depending on on the scope of the enterprise that that you're that you're working working with.
00:14:31.120 -->
00:14:40.000So I think that, you know, right now it's anyone's guess in terms of who you you have an ethical folks in the industry do have a compass.
00:14:40.000 -->
00:14:48.639We do kind of know listen, and and you have a compass and you also try to balance it out with, okay, for what purposes are we doing this for?
00:14:48.879 -->
00:14:49.039Yeah.
00:14:49.360 -->
00:14:53.679So, you know, because w what my boss says, I I love the man, right?
00:14:53.679 -->
00:15:00.559Um, you know, the the most secure system is the one that's not connected to the internet and it's at the bottom of the ocean, but how useful is it?
00:15:00.559 -->
00:15:02.480So you have to kind of balance that out.
00:15:02.480 -->
00:15:11.279But many folks in the field in privacy and data governance as well as cybersecurity, we have that true north where we're like, listen, we're we're trying to lock this down.
00:15:11.279 -->
00:15:15.279We want to make you we we treat it like as if it was our own family's kind of data.
00:15:15.279 -->
00:15:19.039And we understand like w would I want my data out there, would I want my family's.
00:15:19.039 -->
00:15:24.799Uh in in the hospital for sure, it's it's not hard to make the connection towards patient harm.
00:15:24.799 -->
00:15:25.440Yeah, sure.
00:15:25.440 -->
00:15:28.399And and privacy, especially with the the type of care that we provide.
00:15:28.399 -->
00:15:28.879Sure.
00:15:28.879 -->
00:15:32.960And so, but in terms of writ large, that's a really good question.
00:15:33.120 -->
00:15:41.519Well, you know, it's something that I think about often, particularly for when I I I do a lot in in artificial intelligence.
00:15:41.519 -->
00:15:47.840A lot of my research is in artificial intelligence, and I start when I'm building models, I start with the ethical questions.
00:15:47.840 -->
00:15:49.840Like what is the worst that can happen?
00:15:49.840 -->
00:15:50.559Right?
00:15:50.559 -->
00:15:59.679And when I think about there are pros and cons to having your data taken from you when it comes to privacy.
00:15:59.679 -->
00:16:05.039Because frankly, you know, I like getting coupons at the store based on my buying habits.
00:16:05.039 -->
00:16:05.919Absolutely, right?
00:16:06.159 -->
00:16:06.559Absolutely, yeah.
00:16:06.799 -->
00:16:07.360I like that.
00:16:07.360 -->
00:16:17.600But I don't like my insurance premiums being determined by information that I might have given up voluntarily without knowing or without knowing.
00:16:17.600 -->
00:16:18.480Right?
00:16:18.480 -->
00:16:27.120And so I'm wondering when you think about kind of cybersecurity and healthcare, what are some myths and what's the kind of reality?
00:16:27.120 -->
00:16:31.039Like what what is actually what does that actually mean in the context of healthcare?
00:16:31.600 -->
00:16:53.679So one of the things that I think, and it was an aha moment for me, and and and I'll be the first to admit, I it wasn't even I think I was maybe one or two years into working at the hospital at at MSK at Sloan, where it really dawned on me, hey, it's a data breach here is a horse of a different color because uh medical data is immutable.
00:16:53.679 -->
00:16:58.559You can change your social security number, it's a pain, but you can do it.
00:16:58.559 -->
00:17:01.840You can change your name, it's also a pain, but you can do it.
00:17:01.840 -->
00:17:07.200You can't go back and rewrite your medical record, your medical history.
00:17:07.200 -->
00:17:16.240So in terms of the myth that I would think I think permeates is that it's just like any other data breach.
00:17:16.240 -->
00:17:31.599I think, you know, at the risk of sounding biased uh because it's the field I work in, those types of breaches can be so harmful because you can't y what if there's diagnoses on there that you don't want public?
00:17:31.599 -->
00:17:32.160Sure.
00:17:32.160 -->
00:17:47.279And once it's out there, I can almost guarantee you, once it's out there, and if it's unencrypted, if it's an actual breach, if you know all all those bad steps happen, it's out there but who knows what it's getting used for, who knows how it's being monetized.
00:17:47.279 -->
00:17:51.119So I think the myth is that it's just like any other data breach.
00:17:51.119 -->
00:18:06.400Um it's not a myth that practitioners share, I'll tell you that, because the folks in the field understand that this is, you know, there's very small room for error when it comes to allowing that.
00:18:06.400 -->
00:18:15.359There's you could do credit monitoring, you could do this, you could do that, but what are you gonna do for someone's uh medical information once it gets out there?
00:18:15.440 -->
00:18:16.559Yeah, you're absolutely right.
00:18:16.559 -->
00:18:25.440And I kind of feel like that is when HIPAA came out in the early 2000s, and it was like this whole thing, and patients were trying to figure out what it is.
00:18:25.440 -->
00:18:31.359It the hope of HIPAA was to prevent kind of data transferring, right?
00:18:31.359 -->
00:18:31.920Right.
00:18:31.920 -->
00:18:37.599And patient information being out there without the knowledge of patients and just kind of securitizing that.
00:18:37.599 -->
00:18:44.000Now, where HIPAA is, I don't really know how far it's come along, but I kind of feel like it's a joke.
00:18:44.000 -->
00:18:48.559You walk into your doctor's office and they're like, sign this, and you're like, well, what am I signing?
00:18:48.559 -->
00:18:51.920It's like, oh, you're signing that we gave you the HIPAA booklet.
00:18:51.920 -->
00:18:53.039It's like, well, what is that?
00:18:53.039 -->
00:18:54.400What does that mean?
00:18:54.400 -->
00:18:56.400Does the HIPAA booklet say that?
00:18:56.400 -->
00:18:58.720Like, you're gonna take my genome secrets?
00:18:58.720 -->
00:19:01.519Like, what does the HIPAA booklet, like what does it say?
00:19:01.519 -->
00:19:10.240And I bring that up because you're absolutely right when it comes to these sorts of data breaches, even sharing information between hospitals, right?
00:19:10.240 -->
00:19:13.759When you think about there's like the whole medical records thing, right?
00:19:13.759 -->
00:19:23.680What is the um what are the what are the consequences or what are the potential things that could happen when you're sharing medical records, right?
00:19:23.680 -->
00:19:32.640And so I'm wondering for you, what what are things well I don't want to ask you because then people might use it.
00:19:32.640 -->
00:19:41.200But when you think of those types of things, how do you kind of align yourself and your team to start thinking about like what are your internal meetings about?
00:19:41.200 -->
00:19:45.680Like how do you guys say, hey, um these are things that we're thinking about?
00:19:45.680 -->
00:19:47.839Is there a like what's your process?
00:19:48.319 -->
00:19:48.880Sure, sure.
00:19:48.880 -->
00:19:52.319And I I it's you bring up a just even as a meta point, right?
00:19:52.319 -->
00:19:53.440Taking a step back.
00:19:53.440 -->
00:19:59.119Thinking about what why we're locking this down.
00:19:59.119 -->
00:20:06.640I think is is one thing that makes us better at the job, but then also I think it makes us better partners in an organization.
00:20:06.640 -->
00:20:13.279What I like to always say is, you know, nobody says, hey, I have to go to MSK because I heard they have a phenomenal cybersecurity department.
00:20:13.279 -->
00:20:14.640As much as I'd love to.
00:20:14.640 -->
00:20:15.200Yes, yes.
00:20:15.200 -->
00:20:18.319So what are we doing it for?
00:20:18.319 -->
00:20:33.279And I think that a lot of our internal meetings, I'll be, you know, I I like being the one in the room that kind of brings us back to that question, if we drift, because I think it guides us if we're, you know, are we locking down a medical trial?
00:20:33.279 -->
00:20:38.400Are we locking down a collaboration between a couple of different institutions?
00:20:38.400 -->
00:20:40.079Uh so who are we working with?
00:20:40.079 -->
00:20:41.519Are we working with researchers?
00:20:41.519 -->
00:20:42.799Are we working with clinicians?
00:20:42.799 -->
00:20:44.880Are we working with people that are wearing both hats?
00:20:44.880 -->
00:20:46.720Are we talking about patient data?
00:20:46.720 -->
00:20:49.680Are we work you know working on a system that's patient-facing?
00:20:49.680 -->
00:20:55.839Is it internal to us in terms of you know understanding the guts of the network, which is something, of course, we don't want out there?
00:20:55.839 -->
00:20:56.720Sure, absolutely.
00:20:56.720 -->
00:21:05.039Thinking about exactly what we're trying to lock down then shapes and why shapes the how.
00:21:05.039 -->
00:21:15.759So and it shapes, like you like you were alluding to, the ethical question of okay, where on the spectrum of available and locked down are we gonna land?
00:21:15.759 -->
00:21:27.920And where are we gonna feel okay sleeping at night that yes, this is this is the right tight rope to walk, where it's available, but it's encrypted, it's locked down, etc.
00:21:27.920 -->
00:21:40.880I think there, that's really one of the guiding principles that I like to bring forward because it can devolve into, well, we know that this is the best encryption, this is what we have to do, we're gonna lock it down six ways.
00:21:40.880 -->
00:21:48.559But then, you know, to your point, HIPAA, you know, the recent updates to HIPAA have been all about interoperability.
00:21:48.559 -->
00:21:57.920You want to allow that patient to more ownership over their medical record so that they can go and make go to where they wanna be seen.
00:21:57.920 -->
00:22:09.599And it shouldn't be an issue of well, you You know, I'd go to this other provider, but that other provider can't read my medical record because of the way the the my initial provider encrypted it or the system that it's in.
00:22:09.599 -->
00:22:22.240I love that concept, and so it's forced my field to be a bit more agile, be a bit more, you know, on its on its toes in terms of, okay, listen, we have to make it available, but we still have to lock it down.
00:22:22.240 -->
00:22:26.160That was I remember when the interoperability rules really came into effect.
00:22:26.160 -->
00:22:26.640Sure.
00:22:26.640 -->
00:22:29.440It was a big it was a big wait a second, hold on.
00:22:29.440 -->
00:22:29.759Right.
00:22:29.759 -->
00:22:41.759Um but I think it was a a great moment for the industry to understand, hey, there's, you know, yes, folks want their stuff locked down, but the information is there to facilitate care.
00:22:41.759 -->
00:22:45.440We have to figure out a way to suss out this issue.
00:22:45.440 -->
00:22:49.359How can we make it safe, but how can we make it secure and available?
00:22:49.359 -->
00:23:02.079So, you know, I think that in a lot of those meetings, that's really bringing that back, bringing that question back in has has been, I think, uh probably one of the contributors to you know the type of team that that we have.
00:23:02.079 -->
00:23:02.880I don't care.
00:23:03.200 -->
00:23:07.440Yeah, and I love that because especially in the elderly, right?
00:23:07.440 -->
00:23:12.640So we have baby boomers that are now retiring, they're older.
00:23:12.640 -->
00:23:17.839A lot of them may or may not have a caretaker that can go to them to the doctor.
00:23:17.839 -->
00:23:22.559And giving they don't they don't remember their medical history.
00:23:22.559 -->
00:23:33.519And so it's it's a huge deal for doctors to see that, pharmacies to see what's what's going on in terms of that, to flag medication and to say, hey, this may or may not be good for you.
00:23:33.519 -->
00:23:37.920So it's completely it's a something that's super important.
00:23:37.920 -->
00:23:49.119And as as I hear you talk about the different facets of cybersecurity, what are some skills I can already kind of put make a checklist based on what we've talked about?
00:23:49.119 -->
00:23:56.799But if you were to say there is a skill that every cybersecurity person or someone who wants to go into cybersecurity, what would you say it would be?
00:23:57.200 -->
00:24:01.920I can identify and I can find, you know how you can say I can find my people in the room?
00:24:01.920 -->
00:24:02.480Sure.
00:24:02.480 -->
00:24:05.039You you have to you have to want to tinker.
00:24:05.039 -->
00:24:06.720You have to.
00:24:06.720 -->
00:24:11.680And and one of the things I remember I said it, it just came came to mind.
00:24:11.680 -->
00:24:14.160I said, once you start tinkering, you're you're starting to hack.
00:24:14.160 -->
00:24:14.799Yeah.
00:24:14.799 -->
00:24:15.599That's the thing.
00:24:15.599 -->
00:24:38.160You w you you sometimes if I'm interviewing folks, if I can tell that they will have physical discomfort if they can't figure something out, even if they don't have, you know, the type of the system on their resume that we use or the specific set of skills, I want that person on my team.
00:24:38.160 -->
00:24:44.960We can we can teach them the MSK way of cyber you know, that's on us.
00:24:44.960 -->
00:25:01.519But if I can tell that someone is gonna it's gonna bother them, it's gonna burn their mind when they can't figure out why something didn't work or why they couldn't get into something or why they couldn't come up with that technical solution to a problem that's gonna help people, that's a person I'm on on the team.
00:25:01.519 -->
00:25:07.519And I think that if you if you present that, that's what I say to a lot of folks that ask me, like, hey, how do I prepare for an interview?
00:25:07.519 -->
00:25:12.400I just had this on actually on on Friday, uh you know, which is what yesterday, right?
00:25:12.400 -->
00:25:15.680Um how do I prepare?
00:25:15.680 -->
00:25:18.240I said, listen, let that come through.
00:25:18.240 -->
00:25:19.599I can tell you're curious.
00:25:19.599 -->
00:25:24.559I can tell you like to tinker, I can tell you like to break things down and build them up, and maybe they don't work again.
00:25:24.559 -->
00:25:28.720And then that's going to drive you to you know, learn the system even even more so.
00:25:28.720 -->
00:25:30.960Um let that shine through.
00:25:30.960 -->
00:25:32.559That's a person that I want on the team.
00:25:32.720 -->
00:25:57.279What I love about that is so close to being a coder and writing computer code because the the thing that always bothers me, there is like a meme of someone um sleeping and the code is in the you're trying to figure out what is it, and now of course code assistance can help you with that, but you still are kind of, why isn't this working and your head is bothering you, right?
00:25:57.279 -->
00:25:59.519And so I I really love that.
00:25:59.519 -->
00:26:18.319And the the other thing that's interesting, and you probably have better statistics than I see and I have seen, but I've seen in the past, like there are dashboards that companies have that literally show the amount of attacks that are happening in seconds that are coming from all over the world.
00:26:18.319 -->
00:26:20.079And I believe you have one.
00:26:20.079 -->
00:26:25.200Can you give us a sense of maybe a statistic, maybe like how many happen like an hour?
00:26:25.200 -->
00:26:27.519Like how many attempts are do you you guys monitor that?
00:26:27.519 -->
00:26:28.640I'm sure that you mire that.
00:26:29.039 -->
00:26:30.960I'll say I'll say we get millions a month.
00:26:30.960 -->
00:26:42.480It's always it's you know I I liken it to you have and now of course, obviously with AI systems, that's even that's I think that's going to skyrocket.
00:26:42.480 -->
00:26:49.359That's only going to go because you can automate what what it what I liken it to is you know, you're checking you're checking the doors and the windows.
00:26:49.359 -->
00:26:49.839Right.
00:26:49.839 -->
00:26:53.200If you if you've you know grown up in Queens, it happens, right?
00:26:53.200 -->
00:26:56.640You you you you keep an eye out if anyone's kind of near your car.
00:26:56.640 -->
00:26:57.359Sure, sure.
00:26:57.359 -->
00:26:59.359Why are they hanging out by the car?
00:26:59.359 -->
00:27:02.880It's not you know, it's uh it's a Chevy Cavalier, it's old.
00:27:02.880 -->
00:27:03.279What are you doing?
00:27:03.279 -->
00:27:06.160Like if it's not yeah, what are you checking for?
00:27:06.160 -->
00:27:06.640Right?
00:27:06.640 -->
00:27:09.839And I think that that is constantly now that's automatable.
00:27:09.839 -->
00:27:11.680And it's just all the time.
00:27:11.680 -->
00:27:19.039And if anything and as even as, say, you know, I talk to uh some folks that are you know front-end web developers.
00:27:19.039 -->
00:27:29.599And uh one of the things that they you have to set up, right, when you're setting up any internet presence is you have to set up some sort of filtering to be able to distinguish like what's real interest, right?
00:27:29.599 -->
00:27:32.720SEO, yeah, oh I'm I'm getting so many hits.
00:27:32.720 -->
00:27:33.920I'm getting so much interest.
00:27:33.920 -->
00:27:40.799Wait a second, is it just the fact that you have bots checking out if if there's something that's vulnerable, a door or a window that's open?
00:27:40.799 -->
00:27:41.279Sure.
00:27:41.279 -->
00:27:44.319And you know, I what's the quote, right?
00:27:44.319 -->
00:27:45.920Like, why do you rob banks?
00:27:45.920 -->
00:27:46.799That's where the money is.
00:27:46.799 -->
00:27:47.599Well, of course.
00:27:47.599 -->
00:27:57.279You put any sort of medical presence out on the open internet, it's gonna get constantly you know, just tap-tap, check, is this open?
00:27:57.279 -->
00:27:58.000Is this open?
00:27:58.000 -->
00:27:58.720Is that there?
00:27:58.720 -->
00:27:59.759Day and night.
00:28:00.079 -->
00:28:00.400Day and night.
00:28:00.400 -->
00:28:04.079And it's like bots, you know, that are going to be.
00:28:04.079 -->
00:28:12.240You know, it's interesting when you talk about kind of the amount of tax and the skills that you need, right?
00:28:12.240 -->
00:28:22.079Um it seemed just by meeting you and knowing you, not only do you have to have like a um intellectual knowledge, but you also have to have common sense, right?
00:28:22.079 -->
00:28:27.599A sense of common sense and uh be able to kind of question, question the things.
00:28:27.599 -->
00:28:37.759And I'm wondering, um uh earlier today, you to you talked to our students and you get you guys can take a look here, um, some some film of Omar talking to our students.
00:28:37.759 -->
00:28:54.160And one of the things that came up was the how do you get in like the entry-level positions and how these positions are being posted and they'll say entry level, but then when you read it, it's like you have to have all these certifications and two to three years experience.
00:28:54.160 -->
00:29:00.480And then you have this great um saying that tech is kind of cannibalizing or its pipeline.
00:29:00.480 -->
00:29:01.680Tell tell us more about that.
00:29:01.759 -->
00:29:03.519Yeah, it's it's cannibalizing the pipeline.
00:29:03.519 -->
00:29:04.559It's eating its own tail.
00:29:04.559 -->
00:29:08.400I uh it there's I the math just absolutely doesn't math.
00:29:08.400 -->
00:29:10.160You you brought up the certifications.
00:29:10.160 -->
00:29:12.640I I I that that was a keen point.
00:29:12.640 -->
00:29:24.240I did I didn't mention that, but you have some of these entry-level positions where it's asking for certain certs that the industry knows, oh, you need five years in the field to have that cert.
00:29:24.240 -->
00:29:44.799If you see an entry-level position and it's asking for the CISSP, like either a bot put that up or you know, some unbeknownst, you know, not not knocking my friends in HR, but somebody put the someone signed off on a job spec that asked for a five-year cert on an entry-level position.
00:29:44.799 -->
00:29:49.440And even then it the the comedy gets worse, or the tragedy, which one would you want to say?
00:29:49.440 -->
00:29:53.359But it gets worse when then the experience only says two to three years.
00:29:53.359 -->
00:29:56.079Wait a second, you're asking for a five-year cert.
00:29:56.079 -->
00:29:58.480You want two to three years experience in the field.
00:29:58.480 -->
00:30:06.160You know, some some folks, uh maybe the comment section or whatnot will say, hey, you know, you can you can take some of that experience requirement off.
00:30:06.160 -->
00:30:07.359I get that, right?
00:30:07.359 -->
00:30:10.799With a degree you can maybe lop lop it down to about three years.
00:30:10.799 -->
00:30:18.240But even then, then we're talking about a three-year cert, two to three years of experience for, again, what I say is an entry-level position.
00:30:18.240 -->
00:30:18.559Yeah.
00:30:18.559 -->
00:30:20.000It doesn't jive.
00:30:20.000 -->
00:30:22.240It doesn't make any sense.
00:30:22.240 -->
00:30:30.160And what gets me is that not only is that obviously that's gatekeeping, that's keeping amazing folks in.
00:30:30.160 -->
00:30:38.799I always say this, like i I liken it to when, you know, my my my oldest niece graduated a couple years ago.
00:30:38.799 -->
00:30:41.440My youngest niece is about to graduate this year.
00:30:41.440 -->
00:30:43.680When they were getting into school, right?
00:30:43.680 -->
00:30:50.799When they were getting into undergrad, I said, I I I would never I would have never gotten in with the type of barriers and things that they have to do.
00:30:50.799 -->
00:30:53.680Or then I thought back to my undergrad.
00:30:53.680 -->
00:30:55.519Would I would I get into Trinity College now?
00:30:55.519 -->
00:30:56.160I don't think so.
00:30:56.160 -->
00:30:56.720I don't know.
00:30:56.720 -->
00:31:04.240So I look back now, there's no way I'd get in as a career switcher now with with the types of of barriers that are there.
00:31:04.240 -->
00:31:06.160There's there's that gatekeeping aspect.
00:31:06.160 -->
00:31:18.960Then the other thing that's a bit more down the road but is worrisome to me, is where do the mid and senior level people come from in a field normally?
00:31:18.960 -->
00:31:28.240The juniors that stuck it out and got the salt on them and stayed in and and graduated to higher levels of proficiency.
00:31:28.240 -->
00:31:29.839Where are we getting those folks now?
00:31:29.839 -->
00:31:31.359The ether?
00:31:31.359 -->
00:31:43.920Like i if if we're making all these hoops and and and honestly, like in they there's no congruency to the things that we're asking folks to do to get into the field.
00:31:43.920 -->
00:31:52.559Not even to mention that you see those jobs and they're still trying to pay junior level money.
00:31:52.559 -->
00:32:02.960So I I just don't understand what we're we're setting ourselves up for a tsunami of we don't have people to fill the roles that we need.
00:32:02.960 -->
00:32:05.519And and another thing that really just irks me.
00:32:05.519 -->
00:32:13.759Yeah, you can tell this whole the whole subject does, but the thing that does irk me is the cyber field in particular goes, oh, there's no good people out there.
00:32:13.759 -->
00:32:14.559Wait a second.
00:32:14.559 -->
00:32:20.079Yes, there are tons of folks that I know would be phenomenal, but we don't let them in.
00:32:20.079 -->
00:32:27.200We don't have pipelines, we don't have bridges, we don't go out into communities that potentially like mine, right?
00:32:27.200 -->
00:32:31.440Like uh my origin story, I didn't mention tech till many years later.
00:32:31.440 -->
00:32:36.720You uh we don't go out into communities and say, hey, there's you know, tech could work.
00:32:36.720 -->
00:32:37.200Yes.
00:32:37.200 -->
00:32:38.160This is a path.
00:32:38.160 -->
00:32:42.240This is a way to, you know, to improve improve your uh your situation.
00:32:42.240 -->
00:32:44.880It's it's it's maddening.
00:32:44.960 -->
00:32:51.359Well, you know, one of the problems that I find is that the people who are putting those positions don't even understand them.
00:32:51.359 -->
00:33:13.920So a lot of times they'll go to a chat GPT or some AI source and ask it to write a job description and they'll post it, and then the person or whomever will get into the interview and they'll either ask about, you know, the bullet points, the 500 bullet points, and then the person interviewing be like, oh, we just put that in there.
00:33:13.920 -->
00:33:18.720Have you ever that I that I've had that experience, and I'm sure a lot of people have had that experience.
00:33:18.720 -->
00:33:24.640And so, well, we'll well, just you putting that in there has turned away so many applicants.
00:33:24.640 -->
00:33:35.920I'm sure if you've ever been on LinkedIn, and you always know if a job is actually a legitimate job based on the, you know, how they put the number of how many people apply.
00:33:35.920 -->
00:33:38.799Like if it's over a hundred, it's probably not a real job.
00:33:38.799 -->
00:33:44.400But if it's honestly if it's like 30 people apply, it's like it's probably a real job.
00:33:44.400 -->
00:33:44.960Maybe, yeah.
00:33:44.960 -->
00:33:46.480Yeah, it might maybe a real job.
00:33:46.960 -->
00:33:47.920The chances are better, right?
00:33:47.920 -->
00:33:49.039You're still playing roulette.
00:33:49.359 -->
00:33:51.359Yeah, because it's like, okay, a hundred people apply.
00:33:51.359 -->
00:33:53.440Why are you telling it's just like why am I gonna apply?
00:33:53.440 -->
00:33:55.200It does it's like nonsensical, right?
00:33:55.200 -->
00:33:55.519No.
00:33:55.519 -->
00:33:59.440And you had this beautiful saying kind of out of your Genesis story.
00:33:59.440 -->
00:34:08.559Um, your it starts with your mom saying, Mijo, I want you to talk about that and like how that really got you having a firm um foundation.
00:34:09.119 -->
00:34:21.360So it was, you know, again, you know, I I did school, went to business school, did the financial advising, and my and my and my undergrad wasn't a financial advising degree, right?
00:34:21.360 -->
00:34:22.559It was it was philosophy.
00:34:22.559 -->
00:34:30.559So my mother at this stage of life is going, okay, Mijo, you know, plantate con lo pie firmamente debajo.
00:34:30.559 -->
00:34:32.639Like put your feet firmly underneath you.
00:34:32.639 -->
00:34:39.519If you're gonna make this change, make sure you're going in eyes open, you're doing your research.
00:34:39.519 -->
00:34:48.800She was the best career coach at that point in time to make sure that, hey, I wasn't just gonna, you know, try this for a year or two and then say, oh, this is not for me.
00:34:48.800 -->
00:34:53.760Um, because she had she had seen that obviously with undergrad and then the financial advising.
00:34:53.760 -->
00:35:01.360Um but even then, what what kills me now is that somebody can do that, can do the research.
00:35:01.360 -->
00:35:08.000I have tons of folks that reach out on LinkedIn, I'll sit with them, I'll, you know, I have a saying with my my CISOs, I'll talk to them all.
00:35:08.239 -->
00:35:08.400Right?
00:35:08.559 -->
00:35:11.679If they reach out, I'll make a half hour, let's how can I help you?
00:35:11.679 -->
00:35:12.480How can I be a service?
00:35:12.480 -->
00:35:14.480I like starting the conversation that way.
00:35:14.480 -->
00:35:19.360And they'll tell me, hey, I have it, I have it planned out this way, this is what I'm getting into.
00:35:19.360 -->
00:35:27.920They'll tell me, they'll tell me some deep part of cybersecurity, and they'll have a roadmap all the way to get there, right?
00:35:27.920 -->
00:35:36.079And and it warms my heart, but then it also makes me sad because like they're not gonna get the chance in a lot of cases to get there.
00:35:36.079 -->
00:35:38.880They've they have a better roadmap than I did when I started.
00:35:38.880 -->
00:35:43.199They have their feet f more firmly underneath them than even I did, right, according to my mom.
00:35:43.199 -->
00:35:47.360And it's still the the pipeline's just just not there.
00:35:48.159 -->
00:35:59.039You know what's interesting because I I think a lot of similar to artificial intelligence, a lot of CEOs and a lot of um a lot of business owners, everyone's like, we gotta get this AI thing, right?
00:35:59.039 -->
00:36:00.719Most of them don't even know what AI is.
00:36:00.719 -->
00:36:01.199Oh no.
00:36:01.199 -->
00:36:04.639They think it means Chat GPT, and it does not.
00:36:04.639 -->
00:36:09.679And so I I feel like the same thing is happening when it comes to cybersecurity.
00:36:09.679 -->
00:36:17.440Like no one realizes that artificial intelligence, generative AI is a subdomain, and that there are all these different pieces of artificial intelligence.
00:36:17.440 -->
00:36:19.280It's been around for a very long time.
00:36:19.280 -->
00:36:31.039And I'm wondering how do you get leaders to one understand cybersecurity and without giving without using fear tactics.
00:36:31.039 -->
00:36:32.800Like how what does that look like?
00:36:33.360 -->
00:36:44.800I think the the best advice I ever got and that I hold to mind is I'm a business problem solver whose tool is cybersecurity.
00:36:45.360 -->
00:36:45.920Oh, I like that.
00:36:46.320 -->
00:36:51.519Since turning that perspective around, and again, shout out to my director as well as my CISO.
00:36:51.519 -->
00:36:53.840I'm blessed with a great leadership team.
00:36:53.840 -->
00:36:56.559Um love working for those two.
00:36:56.559 -->
00:37:05.599If you're then able to say, hey, what are the business problems that you're facing, I might be able to help you.
00:37:05.599 -->
00:37:12.480Here's how I can help you in my lane, you start then going, wait a second.
00:37:12.480 -->
00:37:25.039The person you're talking to starts going, wait, they're not just trying to beat me over the head with cyber, they're not just trying to wave around IT terms, or they're not just trying to, you know, throw IT at me and then just just trust me, right?
00:37:25.039 -->
00:37:26.559Sources trust me, bro.
00:37:26.559 -->
00:37:29.119No, that's not that's that can't happen.
00:37:29.119 -->
00:37:34.960But if you sit there and listen, and and it's funny because it goes recursively, obviously, back to like my sales background.
00:37:34.960 -->
00:37:44.960That's how you know you sit there and try to qualify the customer, understand like what is the problem that they're coming to you for to solve.
00:37:44.960 -->
00:37:59.599Speak to the benefits, speak to the outcomes, speak to what new future your solution can offer versus I'm just gonna lock this down and you know, you you can tell.
00:37:59.599 -->
00:38:01.360And sometimes it even happens to me.
00:38:01.360 -->
00:38:05.039Like I I try to practice this a lot, but you can tell folks' eyes will glaze over.
00:38:05.039 -->
00:38:07.199Yeah if you start going off in the cyber world.
00:38:07.199 -->
00:38:09.519Cool, you're showing off that you know some terms.
00:38:09.519 -->
00:38:09.920Yes.
00:38:09.920 -->
00:38:10.639Amazing.
00:38:10.639 -->
00:38:11.119Yes.
00:38:11.119 -->
00:38:12.880But they're coming into you to solve a problem.
00:38:12.880 -->
00:38:16.159So go back to that and and and talk to that.
00:38:16.159 -->
00:38:18.960Then I think, and you don't have to bring up the fear.
00:38:18.960 -->
00:38:26.000You you know, that that's kind of understood a little bit, where it's like, hey, listen, if you don't do this, then it's out in the open and that's all she wrote.
00:38:26.000 -->
00:38:27.440But you don't have to harp on that.
00:38:27.440 -->
00:38:28.639How can I help you?
00:38:28.639 -->
00:38:30.159What am I solving for you?
00:38:30.159 -->
00:38:32.079What pain point am I getting rid of?
00:38:32.079 -->
00:38:34.159Cool, I have a cyber tool that can help that.
00:38:34.159 -->
00:38:34.719Right.
00:38:34.719 -->
00:38:36.000And if I don't, be honest.
00:38:36.559 -->
00:38:42.000Now let me ask you, you provided our students with kind of some tips and safety tips about cybersecurity.
00:38:42.000 -->
00:39:03.679Do you ever use things like um you can give us some examples of you know some of the things that but do you ever use analogies to for people in kind of higher positions, executives, for their personal life so that they can kind of better understand so that you don't get those those gay glazing over.
00:39:04.079 -->
00:39:04.480Absolutely.
00:39:04.480 -->
00:39:27.599I I always I like to bring it back to one one of the the the things that I jumped on in terms of getting into IT really to begin with was one time my my mom, you know, she's from Puerto Rico and she said, Omar, I want to learn about this email.
00:39:27.599 -->
00:39:29.039Help me with this email, right?
00:39:29.039 -->
00:39:30.480She had never sent an email.
00:39:30.480 -->
00:39:34.480Not you know, it wasn't it wasn't part of her her skill set there, right?
00:39:34.480 -->
00:39:39.199But she knew that it was a way to maybe potentially talk to the folks back home.
00:39:39.199 -->
00:39:40.079Right.
00:39:40.079 -->
00:39:57.280And I just remember walking her through, it was the simplest thing for me, but just patiently answering her questions and and walking her through, setting up her Gmail account, and seeing just like her eyes lit up with this is magic.
00:39:57.280 -->
00:39:58.159Wait a second.
00:39:58.159 -->
00:40:03.360I can s you know, I I'm reconnecting back to my home country.
00:40:03.360 -->
00:40:09.840Like, you know, yeah, she has the phone, of course, and that but like being able to, you know, have that asynchronous communication.
00:40:09.840 -->
00:40:15.039And then obviously that were was the training wheels to then getting her like more on the internet.
00:40:15.039 -->
00:40:15.519Sure.
00:40:15.519 -->
00:40:15.840Right?
00:40:15.840 -->
00:40:17.440Then then the whole world opened up for.
00:40:17.440 -->
00:40:27.440And it's just it just I always remember that in terms of then coming back to, hey, what what are you trying to do here?
00:40:27.440 -->
00:40:27.760Right.
00:40:27.760 -->
00:40:41.039The analogies that I that I bring up, I usually just bring them back to whatever the per the a person will tell you, I always say like, they'll tell you like what their pain points are and what their hopes and aspirations are.
00:40:41.039 -->
00:40:44.880They'll hint at it in the first like five to ten minutes of talking to you.
00:40:44.880 -->
00:40:45.280Mm-hmm.
00:40:45.280 -->
00:40:46.239If you're listening.
00:40:46.239 -->
00:40:46.719Sure.
00:40:46.719 -->
00:40:52.239If you're focused on I'm smart and I'm just trying to tell you something, you'll miss the signs.
00:40:52.239 -->
00:40:57.519But if you sit there and you just take a beat and you they'll folks will tell you.
00:40:57.519 -->
00:40:59.199Folks will tell you what's important to them.
00:40:59.760 -->
00:41:11.119Well you know what I love about that, and especially the the example of your mother, is that the older generation, they I feel like they are being targeted so hard right now.
00:41:11.119 -->
00:41:28.239Um and it's it's just so interesting because the naivete that happens and it's it's sad because they are not able to distinguish if someone's lying to them and selling something and it always comes on a phone call.
00:41:28.239 -->
00:41:43.920How, you know, for our audiences, a growing audience, how would how would you recommend they protect themselves or their caretakers help them navigate like difficult like, you know, um calls and all the stuff that floods their inboxes?
00:41:44.000 -->
00:41:56.880I always say, and this is this is still for all the tech solutions that we've come up with, one of the main ways that an enterprise gets compromised is still social engineering.
00:41:56.880 -->
00:42:00.239So it's a great, it's a great topic that that you're pivoting to.
00:42:00.239 -->
00:42:07.840Now with AI, the old school ways of saying, well, the grammar's bad, that's out the window.
00:42:07.840 -->
00:42:22.000Uh even non-native English speakers can use an LLM to craft an amazingly worded uh targeting message to an audience that they don't speak the native language of.
00:42:22.000 -->
00:42:22.880So that's out the window.
00:42:22.880 -->
00:42:32.000So grammar, um, you know, you can spoof email addresses, all the technical things are still they're they're increasingly less of a checklist that you can go to.
00:42:32.000 -->
00:42:41.519But still the main thing that I try to instill in in any security awareness training that I I support take a beat.
00:42:41.519 -->
00:42:52.719If there's if there's a sense of urgency that's coming from the other side of that communication, take two beats.
00:42:52.719 -->
00:42:55.840It very it doesn't it's not fail-safe.
00:42:55.840 -->
00:43:00.400Could very well be, you know, you might get that panicked phone call from a family member.
00:43:00.400 -->
00:43:01.679It happens, life happens.
00:43:01.679 -->
00:43:14.800But nine times out of ten, if they're going, you have to do this now, uh, wait a second, your your your stuff is compromised, click here, or calling you, hey, I need this, I need your information, we're doing an investigation.
00:43:14.800 -->
00:43:17.519Or uh this is the help desk.
00:43:17.519 -->
00:43:18.159You know.
00:43:18.159 -->
00:43:25.519If there's a sense of urgency being foisted on you, that should ring alarm bells.
00:43:25.519 -->
00:43:25.920Sure.
00:43:25.920 -->
00:43:28.239Do a little bit more due diligence there.
00:43:28.239 -->
00:43:29.519Take a step, right?
00:43:29.519 -->
00:43:34.639Not to mention why would a help desk be calling you if you didn't call them to get help, etc.
00:43:34.639 -->
00:43:40.000But that's a little bit more, I feel it's it's not like that one rule I can say.
00:43:40.000 -->
00:43:49.599But if someone's trying to get you to do something quickly, you the hairs on the back of your neck should come up and then take a couple steps and really examine.
00:43:49.599 -->
00:43:51.679Then you can start understanding.
00:43:51.679 -->
00:43:55.199Okay, then uh the other tips might start to show themselves.
00:43:55.199 -->
00:43:57.039Like why are they calling me?
00:43:57.039 -->
00:43:58.320Where is this coming from?
00:43:58.320 -->
00:43:59.679Is there an extra letter?
00:43:59.679 -->
00:44:03.199In the address that you wouldn't have noticed if you didn't take that step.
00:44:03.199 -->
00:44:06.239But that social engineering is always keyed in.
00:44:06.239 -->
00:44:10.159And again, sadly, like you say, it's targeting those populations.
00:44:10.159 -->
00:44:14.719But if it's urgent, double check it.
00:44:14.800 -->
00:44:15.360Absolutely.
00:44:15.360 -->
00:44:29.119And you know, it's interesting because when I I think also avoidance, for lack of a better term, is like putting on there are blockers you can put on home phones so that they the caller has to talk and explain themselves.
00:44:29.119 -->
00:44:36.880With text messaging, now they text you for anyone who's out there when someone's texting you about a job.
00:44:36.880 -->
00:44:42.239I actually have one person who keeps calling the spammer back.
00:44:42.239 -->
00:44:44.000Those are fun.
00:44:44.000 -->
00:44:45.280Those are fughts.
00:44:45.280 -->
00:45:02.000There are vulnerabilities in some of their some of the way they communicate to each other.
00:45:02.000 -->
00:45:09.280What are some tips that you can give parents when it comes to to that if you if you were like a kid?
00:45:09.280 -->
00:45:13.519I feel like sometimes a kid with a cell phone is not too much of a good idea.
00:45:13.679 -->
00:45:16.719It's uh it's one of those things and it's something I'm facing now, right?
00:45:16.719 -->
00:45:19.920I I have a two-year-old and I know that conversation is coming.
00:45:19.920 -->
00:45:26.480Uh she's already very keen on what's mom or dad doing on the laptop, what's mom or dad doing on the phone, right?
00:45:26.480 -->
00:45:27.760She notices that a lot.
00:45:27.760 -->
00:45:38.159And one of the things that I've I've seen, and because this is a question I've been asking myself to my peers, what what are you doing, what's going on?
00:45:38.159 -->
00:45:42.000I think you have to take sadly, not sadly, but uh it's an extra step.
00:45:42.000 -->
00:45:46.800You have to take an active role in what they're doing with those devices.
00:45:46.800 -->
00:45:55.360Um does the person need to have communication capabilities if they're playing Roblox.
00:45:55.360 -->
00:45:56.719What why?
00:45:56.719 -->
00:45:57.039Yeah.
00:45:57.039 -->
00:45:58.880Who's on the front?
00:45:58.880 -->
00:46:15.679Having the conversations appropriately at whatever age they're at and saying, listen, this is not just the character that you're talking to on this Discord server or in in this uh chat room before you you know you drop in and play a couple rounds of of battlefield or whatnot.
00:46:15.679 -->
00:46:17.760It's these are other people.
00:46:17.760 -->
00:46:18.239Yes.
00:46:18.239 -->
00:46:18.639Right?
00:46:18.639 -->
00:46:24.079And and there's very little that they need to know about you in order to play, right?
00:46:24.079 -->
00:46:27.039You don't want to be the no fun folks, because then what's gonna happen?
00:46:27.039 -->
00:46:28.320They're just gonna work around you.
00:46:28.320 -->
00:46:28.719Sure.
00:46:28.719 -->
00:46:32.400So you know, engage and understand that, yeah, yeah, there's there's need for this.
00:46:32.400 -->
00:46:43.519But I'll tell you what, personally for me, that that cell phone conversation is gonna be is gonna be a difficult one because I just, you know, now we're seeing it's kind of a recursive loop, right?
00:46:43.519 -->
00:46:44.159A sine wave.
00:46:44.159 -->
00:46:46.559You're seeing schools go, you don't need it all day.
00:46:46.559 -->
00:46:47.039No.
00:46:47.039 -->
00:46:48.159Deposit it.
00:46:48.159 -->
00:46:55.440So, you know, I get the tug of you want to be able to communicate, but at what cost?
00:46:55.440 -->
00:47:00.000You're seeing countries now determine that under 16 you don't need social media.
00:47:00.000 -->
00:47:00.320No.
00:47:00.320 -->
00:47:03.360More of those, and I'm I'm kind of in favor of that.
00:47:03.840 -->
00:47:04.480No, I agree.
00:47:04.480 -->
00:47:17.519I mean, I I I I observed my my son actually, he was playing chess and some way the setting was on like a he was playing the computer, but the computer was actually another person.
00:47:17.519 -->
00:47:21.039And the person had a name, and I was like, whoa, whoa, whoa, who is this?
00:47:21.039 -->
00:47:26.239And then I had to go to a setting, it was like buried to like turn it off.
00:47:26.239 -->
00:47:29.840And so all these things, because you know, who doesn't want their kid to play chess?
00:47:29.840 -->
00:47:30.320Of course.
00:47:30.320 -->
00:47:35.280But then you have some you don't know who this person is playing chess with it with the you know, a kid.
00:47:35.280 -->
00:47:41.039And so it just becomes um, you know, really, really tricky.
00:47:41.039 -->
00:47:41.280Yes.
00:47:41.280 -->
00:47:46.719Um and I love that you f you picked up the idea that schools are turning away from technology.
00:47:46.719 -->
00:47:52.639You know, and in my my opinion is that as a parent, you have to be involved.
00:47:52.639 -->
00:47:56.960I mean, there are there are no perfect parents, you can't be everywhere with your kids.
00:47:56.960 -->
00:48:01.679But I feel like, just like I feel with SEI, our goal is to empower our kids.
00:48:01.679 -->
00:48:05.440Obviously, when they're younger, you have to intervene and play an active role.
00:48:05.440 -->
00:48:10.159But at the end of the day, we're sending them out, especially high school students, we're sending them out into the world.
00:48:10.159 -->
00:48:12.320We're not gonna be there, you're not gonna be there, right?
00:48:12.320 -->
00:48:20.639And so you want them to have be like, mm, I remember Omar was on coding conversations and he said, he said I should not do this.
00:48:20.639 -->
00:48:23.760So that we kind of, you know, we're teaching them, right?
00:48:23.760 -->
00:48:25.199Um I love that.
00:48:25.199 -->
00:48:33.519So, Omar, if you could leave a voice message for your younger self um on uh day one in cybersecurity, what would you say?
00:48:33.920 -->
00:48:43.280It's uh it's a phrase that my my father used to say to me, you know, he's not he's not with us now, and and it's something that I hear uh and especially on days when Barcelona soccer plays, right?
00:48:43.280 -->
00:48:43.840Which was today.
00:48:43.840 -->
00:48:45.599And they've they won three nothing big.
00:48:45.920 -->
00:48:46.480Oh congratulations.
00:48:47.440 -->
00:48:48.800A banner day for me today.
00:48:48.800 -->
00:48:51.360Um Tranquilo, mijo.
00:48:51.360 -->
00:48:52.639Like relax.
00:48:52.639 -->
00:48:54.159Relax.
00:48:54.159 -->
00:48:59.440It's you're not late, you're on time for where you need to be.
00:48:59.679 -->
00:48:59.920Okay.
00:49:00.800 -->
00:49:02.079It'll work itself out.
00:49:02.320 -->
00:49:02.559Okay.
00:49:02.800 -->
00:49:07.119Because I remember again as a career switcher, I felt like I was behind the eight-ball.
00:49:07.119 -->
00:49:11.599I felt like, wait a second, all these people uh have ten years on me.
00:49:11.599 -->
00:49:13.519I'm just trying to break in, right?
00:49:13.519 -->
00:49:14.960I'm 30, what am I doing?
00:49:14.960 -->
00:49:16.320Oh no.
00:49:16.320 -->
00:49:20.719And just that's something I tell myself and it's it's funny.
00:49:20.719 -->
00:49:31.519Now it's advice I give, and I always preface it with, you know, f if uh you know, if my wife were in the room, she'd laugh because like there's definitely nothing tranquilo about how I was trying to break in.
00:49:31.519 -->
00:49:33.039I was trying to make up for lost time.
00:49:33.039 -->
00:49:36.079But you know, you're you're running your own race.
00:49:36.079 -->
00:49:38.639You gotta be better than you were yesterday, and that's it.
00:49:38.800 -->
00:49:39.039Yeah.
00:49:39.199 -->
00:49:39.679That's all.
00:49:39.679 -->
00:49:42.480That's that's really what I because I think I'd enjoy it more.
00:49:42.639 -->
00:49:42.880Yeah.
00:49:43.119 -->
00:49:43.920To start, right?
00:49:43.920 -->
00:49:51.519You know, I I'd I'd again my wife, you know, there's gonna be a time when you're not an analyst and you're gonna look back and remember those days fondly.
00:49:51.519 -->
00:49:52.800And I said, What are you talking about?
00:49:52.800 -->
00:49:55.280I want to get promoted, I want to continue, I want to hard charge.
00:49:55.280 -->
00:49:57.360And she was a hundred percent correct.
00:49:57.599 -->
00:49:57.760Yeah.
00:49:57.920 -->
00:50:01.679There's days I'm like, oh, I remember when I was just a risk contract analyst.
00:50:01.679 -->
00:50:03.119Those were amazing days.
00:50:03.119 -->
00:50:05.039I had so much, it was great.
00:50:05.039 -->
00:50:10.320Um you know, not that I don't like where I'm doing or where I'm at now, but it was just it was a different time.
00:50:10.320 -->
00:50:17.360And I I think, you know, being more present, relaxing, tranquilo, chill, it'll come.
00:50:17.920 -->
00:50:18.559I love that.
00:50:18.559 -->
00:50:32.639I I feel like I just had that conversation in regards to being an AI and building algorithms and was talking to a bunch of people, uh, and I said, you know, do you ever feel like you're going too slow?
00:50:32.639 -->
00:50:34.559And they were like, everyone feels that way.
00:50:34.559 -->
00:50:34.719Yeah.
00:50:34.719 -->
00:50:36.239Everyone in this room feels that way.
00:50:36.239 -->
00:50:38.800We all feel like we can't, we're developing too slow.
00:50:38.800 -->
00:50:43.760And uh it's just so I guess it's I think in God's time is the way to look at it, right?
00:50:43.760 -->
00:50:44.239Absolutely.
00:50:44.239 -->
00:50:46.880And so we're rounding out our conversation here with Omar.
00:50:46.880 -->
00:50:48.159We have a lightning round.
00:50:48.159 -->
00:50:48.400Okay.
00:50:48.400 -->
00:50:49.679And so this is how it goes.
00:50:49.679 -->
00:50:54.000Now, a lot of guests try to say both, but you have to pick one.
00:50:54.000 -->
00:50:54.480Okay?
00:50:54.480 -->
00:50:55.679It's gonna pin you down.
00:50:55.679 -->
00:50:59.440All right, so I'm gonna give you two choices and you you gotta pick one, okay?
00:50:59.440 -->
00:51:00.400Which one you prefer?
00:51:00.400 -->
00:51:02.800Okay, so let's kick it off with the most important one.
00:51:02.800 -->
00:51:03.599Coffee or tea?
00:51:03.920 -->
00:51:04.880Bustello, coffee.
00:51:05.039 -->
00:51:05.280All that.
00:51:05.280 -->
00:51:06.000All day.
00:51:06.000 -->
00:51:07.039Did you use the press?
00:51:07.039 -->
00:51:07.840Do you do the press?
00:51:07.840 -->
00:51:09.039Uh no, not that fancy.
00:51:09.039 -->
00:51:09.760Not that fancy.
00:51:09.760 -->
00:51:11.119No, no, no, no, no.
00:51:11.119 -->
00:51:14.239Uh control alt delete or stay on this page.
00:51:14.559 -->
00:51:15.360Three finger salute.
00:51:15.360 -->
00:51:16.320Control alt delete.
00:51:16.320 -->
00:51:16.800Absolutely.
00:51:16.960 -->
00:51:17.280100%.
00:51:17.280 -->
00:51:18.400I love that.
00:51:18.400 -->
00:51:20.320Morning meetings or afternoon meetings?
00:51:20.320 -->
00:51:21.280Afternoon meetings.
00:51:21.280 -->
00:51:21.760Okay.
00:51:21.760 -->
00:51:22.239Oh, yeah.
00:51:22.239 -->
00:51:24.000Um, iPhone or Android.
00:51:24.000 -->
00:51:24.719iPhone.
00:51:24.719 -->
00:51:26.400Work from home or in the office?
00:51:26.719 -->
00:51:27.199Work from home.
00:51:27.519 -->
00:51:29.039Slack messages or email?
00:51:29.440 -->
00:51:30.800Am I in trouble?
00:51:30.800 -->
00:51:37.199Because I prefer like Slack messages, but I will be the first one to email if I need a receipt.
00:51:37.199 -->
00:51:40.960Like if it's official, if it's some, if I you know, and and I feel the same way.
00:51:40.960 -->
00:51:42.320I I definitely put that on people.
00:51:42.320 -->
00:51:42.719Yeah.
00:51:42.719 -->
00:51:43.119Right?
00:51:43.119 -->
00:51:44.159Why are you emailing me?
00:51:44.159 -->
00:51:45.679Like, are you trying to wait a second?
00:51:45.920 -->
00:51:46.639Are you trying to record?
00:51:46.639 -->
00:51:50.000Well, well, Slack I feel drives me a little crazy.
00:51:50.239 -->
00:51:51.280Oh no, the pings are nuts.
00:51:51.599 -->
00:51:54.000The pings are like, you're like, what's going on?
00:51:54.000 -->
00:51:55.760And it's like a hundred percent.
00:51:55.760 -->
00:51:57.199And no one follows the rules.
00:51:57.199 -->
00:51:57.519No.
00:51:57.920 -->
00:51:58.800No one follows the rules.
00:51:58.800 -->
00:52:02.800And that little message that says, oh, send it during hours.
00:52:02.800 -->
00:52:04.639No, they don't believe in their mothers.
00:52:04.639 -->
00:52:05.519It's like that.
00:52:05.519 -->
00:52:06.320Terrible.
00:52:06.400 -->
00:52:07.199I I can't stand it.
00:52:07.199 -->
00:52:07.679Okay.
00:52:07.679 -->
00:52:09.039Dark mode or light mode.
00:52:09.039 -->
00:52:09.760Dark mode.
00:52:09.760 -->
00:52:10.320Okay.
00:52:10.320 -->
00:52:13.199Password manager or I'll remember it.
00:52:13.519 -->
00:52:14.480Oh, password manager.
00:52:14.480 -->
00:52:14.800Okay.
00:52:14.800 -->
00:52:15.920Oh, yeah.
00:52:15.920 -->
00:52:17.199There's no way.
00:52:17.199 -->
00:52:20.320I can't remember all that.
00:52:20.320 -->
00:52:21.280Yeah.
00:52:22.239 -->
00:52:23.920Automation or manual control?
00:52:24.320 -->
00:52:24.800Automation.
00:52:25.280 -->
00:52:25.599Okay.
00:52:25.599 -->
00:52:30.559Biggest pet peeve, just click approve, or can we circle back next quarter?
00:52:30.880 -->
00:52:32.880Oh, can we circle back next quarter?
00:52:33.280 -->
00:52:33.519No.
00:52:34.079 -->
00:52:37.280The best time to sort something is yesterday, and the second best time is today.
00:52:37.280 -->
00:52:38.880I don't like I'm no.
00:52:38.880 -->
00:52:40.320Don't call me, I'll call you.
00:52:40.320 -->
00:52:41.360Let's figure this out now.
00:52:41.760 -->
00:52:45.760I love that because then the to-do list becomes uh it's never gonna happen.
00:52:45.760 -->
00:52:46.239100%.
00:52:46.239 -->
00:52:48.960Once we go into the to do to-do list, we're done.
00:52:48.960 -->
00:52:50.320It's not gonna happen.
00:52:50.559 -->
00:52:51.199It's a myth.
00:52:52.719 -->
00:52:53.360I love that.
00:52:53.360 -->
00:52:55.280Well, thank you so much, Omar.
00:52:55.280 -->
00:52:57.199It was a pleasure to see you.
00:52:57.199 -->
00:52:58.559And where can we find you?
00:52:58.559 -->
00:52:59.360I think on LinkedIn.
00:52:59.519 -->
00:53:00.400Yep, LinkedIn, Dr.
00:53:00.400 -->
00:53:01.119Omar S.
00:53:01.440 -->
00:53:01.840I love that.
00:53:01.840 -->
00:53:02.159Dr.
00:53:02.159 -->
00:53:03.840Omar S on LinkedIn.
00:53:03.840 -->
00:53:04.880Thank you so much.
00:53:04.880 -->
00:53:08.400Thank you for joining us on today's episode of Coding Conversations.
00:53:08.400 -->
00:53:11.440Remember to like and subscribe and check out our swag.
00:53:11.440 -->
00:53:12.639Thank you again.
