The SOC That Changed Everything: 10 Years of Lessons, Growth, and Grit

WEBVTT
00:00:08.720 --> 00:00:11.839
Welcome to another episode of our Behind the Shield podcast.
00:00:11.919 --> 00:00:15.119
And for a very short time, I'll be your host, Gary Damer.
00:00:15.439 --> 00:00:19.120
This is our tenth year of delivering the NSOC 360 services.
00:00:19.199 --> 00:00:21.760
So we decided to do an anniversary edition.
00:00:22.719 --> 00:00:26.160
Every service worth keeping has an origin story.
00:00:26.719 --> 00:00:32.799
Not the polished version written after the fact, not the slide deck version, the real one.
00:00:33.280 --> 00:00:37.200
The kind that starts with a customer problem and a hard requirement.
00:00:37.520 --> 00:00:42.640
And a question that keeps showing up after everyone else has gone home.
00:00:43.280 --> 00:00:44.719
Who's watching now?
00:00:45.920 --> 00:00:49.359
That's where the NSOC 360 began.
00:00:50.719 --> 00:00:54.640
Years ago, we were building and securing the Dell Cloud for U.S.
00:00:54.640 --> 00:00:55.039
government.
00:00:55.600 --> 00:01:04.079
Dell needed more than an architecture, more than a FedRAMP package, more than a set of controls documented in their system security plan.
00:01:05.120 --> 00:01:18.560
They needed people watching this environment, actively managing instances, supporting continuous monitoring, and producing the evidence required to operate in a federal cloud on U.S.
00:01:18.719 --> 00:01:20.000
soil by U.S.
00:01:20.079 --> 00:01:20.640
citizens.
00:01:21.200 --> 00:01:23.359
We still needed a security operation center.
00:01:23.680 --> 00:01:24.640
So we built one.
00:01:25.280 --> 00:01:34.159
We're a small company based in North Wilkesboro, North Carolina, and taking on problems a lot larger than our zip code should suggest.
00:01:34.799 --> 00:01:37.120
That's always been part of our story.
00:01:37.599 --> 00:01:52.799
We built the space, we put the monitors on the wall, and then we developed the actual part that matters, the operating procedures, the escalation paths, the response playbooks, shift schedules, the ticketing and reporting.
00:01:53.519 --> 00:01:59.280
We supported the cloud from inception through the initial provisional authority to operate in 2016.
00:01:59.920 --> 00:02:02.159
That work changed with this company.
00:02:02.560 --> 00:02:11.360
It taught us that security operations is not just a room, it's not a wall of monitors or a dashboard or a collection of expensive tools.
00:02:11.680 --> 00:02:16.240
Security operations is a discipline, it's the habit of watching.
00:02:16.800 --> 00:02:19.680
I'll be honest about what cost me personally.
00:02:20.000 --> 00:02:24.560
For a long stretch, 24 by 7 coverage meant I didn't sleep well.
00:02:25.520 --> 00:02:28.479
Somebody has to be awake at 2 in the morning.
00:02:28.639 --> 00:02:32.879
And for a while, I felt responsible for every one of those hours.
00:02:33.759 --> 00:02:37.120
Then we hired Chad Spears, the runner security operations center.
00:02:37.759 --> 00:02:39.439
I've said this to him directly.
00:02:39.759 --> 00:02:45.199
Once Chad came on board, I started sleeping through the night much better.
00:02:45.840 --> 00:02:53.199
He's our chief information security officer now, and that says everything about how that hire kind of worked out for us.
00:02:53.759 --> 00:02:56.719
From there, we built the bench underneath him.
00:02:56.960 --> 00:03:02.800
We grew our own out of Wilkes Community College in Appalachian State and the schools that surround us.
00:03:03.439 --> 00:03:06.560
Ten years later, some of those first hires are still with us.
00:03:06.960 --> 00:03:11.439
Jeremy Powers hits his own 10-year mark this year.
00:03:12.159 --> 00:03:19.360
We're recording this in the building that we bought the house, the operations center, in North Wilkesboro, North Carolina.
00:03:20.080 --> 00:03:22.479
One wall away from our security operations center.
00:03:22.960 --> 00:03:29.599
BNSOC 360 is the service, it's the engine behind our defend pillar of everything we do now.
00:03:29.840 --> 00:03:35.599
You build it right, you operate it well, you prove continuously, and you defend it always.
00:03:36.159 --> 00:03:41.360
Ten years of asking the same question and answering it every single night.
00:03:41.840 --> 00:03:43.199
Let's get into it, Chad.
00:03:43.439 --> 00:03:44.400
Take it away from here.
00:03:44.639 --> 00:03:47.199
Welcome to this episode of Behind the Shield Podcast.
00:03:47.280 --> 00:03:53.039
I'm your special guest host today, Chad Spears, uh Chief Information Security Officer here at Infusion Points.
00:03:53.199 --> 00:04:00.560
And this is a uh a special episode here for today, uh, with some special meaning, especially near and dear to my heart.
00:04:00.719 --> 00:04:06.800
Uh, we're going to be discussing the 10-year anniversary of our VNSOC here at Infusion Points.
00:04:07.039 --> 00:04:15.599
Really, what um uh I consider to be uh the the start of my career here at Infusion Points.
00:04:15.759 --> 00:04:20.959
And uh it's near and dear because um kind of worked my way up through that.
00:04:21.040 --> 00:04:24.959
But not only that, it's more so the individuals that make up the VNSOC.
00:04:25.040 --> 00:04:32.399
So whether you know it here at Infusion Points, um, we have a security operations center that operates 365-247.
00:04:32.879 --> 00:04:45.839
Um, and I'm blessed and fortunate enough to be the individual that gets to talk about it, um, explain it to our customers, um, take it to market, and the opportunity to try to grow it.
00:04:46.079 --> 00:04:56.000
However, it would never be possible without the individuals behind this uh the shield, if you will, uh that keep that running day in and out.
00:04:56.160 --> 00:05:01.920
And uh we've gotten a phenomenal team that allows us to do what we do here at Infusion Points.
00:05:02.160 --> 00:05:10.079
And they're really the ones that are sitting there and looking for our customers and monitoring uh for those things that would go bump in the night.
00:05:10.240 --> 00:05:14.879
And it is unfortunate that every now and then I might get a call in the middle of the night and get woken up.
00:05:15.040 --> 00:05:23.279
Um, but it makes me proud to know that uh the team is on staff and the team is is taking care of our customers, and that's truly what we're here at about Infusion Points.
00:05:23.519 --> 00:05:46.560
So for this special episode of uh Behind the Shield this time, we're gonna be bringing in some of those individuals that are hunting for those things that go bump in the night and get their perspective and talk a little bit about how things have changed over the years here at Infusion Points and how long they've been with us and maybe some good and some of the bad of the uh VNSOC 360 here at Infusion Points.
00:05:46.720 --> 00:05:48.800
So our first guest we're gonna be bringing in.
00:05:48.879 --> 00:05:49.680
Uh I've got Mr.
00:05:49.839 --> 00:05:50.720
Levi Church.
00:05:50.800 --> 00:05:50.879
Mr.
00:05:50.959 --> 00:05:52.000
Levi, come on in.
00:05:54.800 --> 00:05:57.120
We'll let Levi get settled here.
00:05:59.439 --> 00:06:00.079
You're a natural.
00:06:00.160 --> 00:06:02.720
So Levi, let me ask, is this your first time on the podcast?
00:06:02.959 --> 00:06:03.839
Uh second time.
00:06:04.079 --> 00:06:05.199
Second time on the podcast.
00:06:05.439 --> 00:06:07.519
All right, so you're you're a natural at this point.
00:06:07.759 --> 00:06:10.560
So uh let's um let's get things started here.
00:06:10.639 --> 00:06:16.800
So Levi, uh tell us number one, how long have you been in the uh security operations center here at Infusion Points?
00:06:16.959 --> 00:06:20.800
I've been in the Security Operations Center for about two and a half years now.
00:06:21.040 --> 00:06:21.759
Two and a half years.
00:06:21.839 --> 00:06:25.519
So is that your first position when you came in to the to Infusion Points?
00:06:25.680 --> 00:06:29.279
Uh started out going through the internship program, which was my other podcast.
00:06:29.439 --> 00:06:31.839
I was able to talk a little bit more about my experience through that.
00:06:31.920 --> 00:06:34.240
Um, and then transferred into the security operations center.
00:06:34.480 --> 00:06:34.800
Awesome.
00:06:34.879 --> 00:06:37.680
So what what shifts have you primarily worked in the SOC?
00:06:38.000 --> 00:06:44.959
Uh I've worked anywhere from third shift weekends, third shift during the week, second shift during the week, first shift, um, primarily first shift now.
00:06:45.120 --> 00:06:45.279
Okay.
00:06:45.439 --> 00:06:46.399
Primarily first shift.
00:06:46.480 --> 00:06:51.600
So kind of worked your way from that third shift to the second, and now we got you on first a little bit.
00:06:51.759 --> 00:06:53.199
Um, but let's talk about it.
00:06:53.279 --> 00:07:00.879
So I mentioned uh in opening up that sometimes I'd get those late night phone calls about some things that was popping off when things needed to get escalated.
00:07:01.120 --> 00:07:12.160
Um how has your time in the security operations center over the two years kind of how have you seen that change from third shift to second shift, now first shift?
00:07:12.240 --> 00:07:14.000
What's what's the difference in those shifts?
00:07:14.319 --> 00:07:19.439
There's a big responsibility shift a lot of the times when it comes from second to third to first shift.
00:07:19.600 --> 00:07:22.319
Um also alert uh volume-wise.
00:07:22.399 --> 00:07:26.639
So usually first shift we receive a lot more alerts compared to second, third shift.
00:07:26.720 --> 00:07:26.959
Right.
00:07:27.199 --> 00:07:31.279
But I will say, granted, second and third third shifts, usually when you're getting the phone call.
00:07:31.439 --> 00:07:32.240
Sorry, Chad.
00:07:32.319 --> 00:07:37.680
Uh but um usually because it's a little off the wall stuff compared to first shift, most of first shift is kind of normal.
00:07:37.920 --> 00:07:47.519
Yeah, it's unfortunate that just in in the field that we're in, that uh the volume may be less, uh, but I would say the criticality is higher, right?
00:07:47.759 --> 00:07:56.319
Second and third shift, if those alerts are coming in, um I mean, by and large, you a lot of US-based companies here that we're monitoring for.
00:07:56.480 --> 00:08:06.720
Uh and so, you know, we do have some companies that have uh branches in uh in other areas, but uh generally we're not gonna see that 3 a.m.
00:08:07.040 --> 00:08:09.040
activity happening from organizations.
00:08:09.199 --> 00:08:17.439
And so when that does happen and we get those alerts, um, it's 90% of the time going to be something that needs to be investigated a little bit more in depth.
00:08:17.600 --> 00:08:23.040
And so, yeah, I mean, again, you guys are the ones that that allowed me to sleep better at night.
00:08:23.120 --> 00:08:28.959
Uh, I know Gary used to joke about that as well, that he pushed that responsibility down to me and it allowed him to sleep better at night.
00:08:29.120 --> 00:08:35.440
But, you know, at the end of the day, um, you guys are the ones that really uh carry the burden of that.
00:08:35.519 --> 00:08:36.720
And so I really appreciate that.
00:08:36.799 --> 00:08:38.639
Let me just start off by saying that.
00:08:38.799 --> 00:08:42.399
Um, talk to me about, you know, you said you've been here two and a half years.
00:08:42.480 --> 00:08:52.080
Talk to me about kind of some of the growth that you've seen in the Security Operations Center and then some of the things that, you know, we were doing two and a half years ago and how that's even transformed now for our customers.
00:08:52.399 --> 00:08:55.759
Oh man, it's changed tremendously since I've first started.
00:08:55.840 --> 00:09:04.799
Um, a lot of the different workflows, like we have more AI implemented workflows now, um, that has reduced alert triage time by a massive amount.
00:09:04.879 --> 00:09:08.879
Um, it takes us half the time to triage an alert compared to when I first started.
00:09:08.960 --> 00:09:09.279
Right.
00:09:09.440 --> 00:09:18.720
Um, and our seam like broad depth, like transferring to new seams with more in-depth information in them, has really made a big difference in our security operations center.
00:09:18.879 --> 00:09:19.440
Yeah, definitely.
00:09:19.519 --> 00:09:30.799
I mean, as the the tool sets progress and um I'll say skill sets uh increase as well, bringing in new tools, and that's what allows our skill sets to grow as well.
00:09:31.039 --> 00:09:32.320
You mentioned AI.
00:09:32.720 --> 00:09:38.720
Um, and it's kind of like that's a must nowadays uh time to triage, as you mentioned.
00:09:38.879 --> 00:09:46.000
But also, I you know, I'm just so impressed with the depth of information uh that it can pull and how quickly it can pull, right?
00:09:46.080 --> 00:09:57.039
You know, if we're we're correlating a single event or single alert that comes in, um, it can very quickly go back, look at the last 72 hours and say, hey, all of that maps back to this single alert as well.
00:09:57.200 --> 00:09:59.279
And so it paints a wider picture for us.
00:09:59.360 --> 00:10:03.200
So it's really cool to see that tool set change um a little bit.
00:10:03.279 --> 00:10:09.120
And it's cool to hear you talk about that as well, that uh we're seeing value in that for our customers.
00:10:09.519 --> 00:10:19.039
Um, so when it comes to the you know, fielding alerts and fielding alarms, uh, I'm we're gonna we're gonna talk about the good and the bad here.
00:10:19.360 --> 00:10:20.399
Give me some of the bad.
00:10:20.480 --> 00:10:29.679
What what is the the worst parts of being on shift and for third shift and second shift that maybe maybe some of our viewers out there don't even really think about these types of things?
00:10:29.919 --> 00:10:30.639
Oh man.
00:10:30.879 --> 00:10:35.440
Well, I know at least a big thing is fighting the sleep.
00:10:35.600 --> 00:10:39.039
I would go through four or five energy drinks in a night sometimes.
00:10:39.200 --> 00:10:42.000
Um, but fighting the sleep definitely has its challenges.
00:10:42.159 --> 00:10:48.879
And then uh having to give Chad a phone call at you know three in the morning, uh definitely not happy to hear from you.
00:10:49.120 --> 00:10:54.080
But uh, but he gets the job done and he'll be there and help you to help you uh with any incident that might be going on.
00:10:54.240 --> 00:10:55.519
That's definitely one of the biggest things.
00:10:55.600 --> 00:11:00.080
I know we struggle that with that a lot on second and third shift is whether to call, whether to not call.
00:11:00.480 --> 00:11:04.399
Because I know any of our customers don't want to get woken up at 5, 6 a.m.
00:11:04.559 --> 00:11:06.159
or two, three o'clock in the morning.
00:11:06.399 --> 00:11:10.399
Um obviously I wouldn't want to get a phone call that late or that early in the morning.
00:11:10.559 --> 00:11:21.759
Um yeah, and and that's one of the things that you know I always lead when we're when we're talking with our customers and we're bringing them on board that um I always tell you guys to err on the side of caution.
00:11:21.919 --> 00:11:26.240
And uh I will apologize for waking them up at three in the morning.
00:11:26.399 --> 00:11:31.440
Um and and and we'll we'll we'll we'll discuss it all day long.
00:11:31.600 --> 00:11:37.919
Um, but I would rather you get that voice confirmation from the customer that, hey, they know something's going on.
00:11:38.159 --> 00:11:43.200
Um we need them to to wake up, get the sleep out of their eyes, and work with us for just a minute.
00:11:43.279 --> 00:11:47.840
Um and and typically, you know, knock on wood, uh, that doesn't happen a lot.
00:11:48.159 --> 00:11:52.720
But when it does happen, we need that uh, you know, we need their full attention.
00:11:52.799 --> 00:11:57.919
And you know, you guys have already started taking action at that point, right, to help remediate the threat.
00:11:58.080 --> 00:12:00.799
Um, but again, we got to get them engaged and get them involved.
00:12:00.879 --> 00:12:09.600
And so I know that our customers, yes, as as much as they don't like being woken out of up out of their slumber as as well as myself, uh, I don't mind it at all, man.
00:12:09.679 --> 00:12:11.200
It's it's it's part of the job.
00:12:11.440 --> 00:12:16.879
Um reminds me of when I was in the military uh in you know in the infantry, right?
00:12:16.960 --> 00:12:24.799
You you get that uh little nudge in the middle of the night, like, hey, it's your time, your your your hour for firewatch, and it's like, well, this is just this is just part of it.
00:12:24.879 --> 00:12:27.919
Let me let me lace up, but put my boots on and and get to work.
00:12:28.080 --> 00:12:32.879
And so um, so yeah, and then to hear you talk about fighting the sleep, it's interesting.
00:12:33.039 --> 00:12:41.919
I I came in the SOC um one afternoon, and you know, I I know you guys, y'all, some of y'all are gamers, and so, but I didn't know that it was to this level now.
00:12:42.240 --> 00:12:47.440
But they're consuming not only energy drinks, but then I see like pre-workout back there, and I'm like, oh, who's going to the gym?
00:12:47.600 --> 00:12:49.200
And they're like, oh no, we don't go to the gym.
00:12:49.279 --> 00:12:54.240
This is just to uh to keep us up throughout the night and to help us uh some of the gamers do it.
00:12:54.320 --> 00:12:56.399
And I was like, well, that's that's interesting.
00:12:56.480 --> 00:12:59.120
Let's let's not let's not take that to an extreme.
00:12:59.200 --> 00:13:06.000
I don't necessarily know how 900 milligrams of caffeine reacts on the body, but uh, but it was kind of funny to see that.
00:13:06.159 --> 00:13:11.279
And, you know, kudos for you guys for getting creative and doing some of the things that you do.
00:13:11.440 --> 00:13:22.080
I know um, you know, every now and then we even kind of, you know, we've got cameras within the facility as well, but you're doing kind of perimeter checks internally to just make sure everything's good to go, just to kind of get up and move for a little bit, because you're right.
00:13:22.159 --> 00:13:25.519
Um, I've been in here on one of those third shifts in that late night, man.
00:13:25.600 --> 00:13:34.320
Uh, it's always about that two o'clock time frame that uh you start getting that little cold chill, and you're like, man, I just want to, my body wants to start shutting down.
00:13:34.559 --> 00:13:42.240
But um it's it's cool to hear y'all talk about that the struggle is real, uh, but then how you guys are combating that as well.
00:13:42.320 --> 00:13:46.720
And y'all are y'all are awesome and and troopers for for pushing through that.
00:13:46.960 --> 00:13:48.960
So we've talked a little bit about the bad.
00:13:49.200 --> 00:13:51.440
So let's continue down that path a little bit.
00:13:51.600 --> 00:14:11.279
Talk to me about maybe, and again, we won't get uh obviously we'll be discreet in this, but um maybe one of the worst events or alerts that maybe you've received uh and had to kind of combat, and it could be a false positive or whatever it is, but you know, one of the things that kind of got you uh got your senses heightened the most.
00:14:11.679 --> 00:14:14.720
Yeah, um, I can think of maybe one or two times.
00:14:14.960 --> 00:14:22.559
Uh there was one time it was a this actually turned out to be a false positive, but uh we got an alert for a remote code execution.
00:14:22.639 --> 00:14:25.120
Uh critical severity, not good.
00:14:25.519 --> 00:14:27.759
Um ended up getting in contact with a customer.
00:14:27.919 --> 00:14:29.120
Turns out it was completely blocked.
00:14:29.200 --> 00:14:30.320
I had no clue at the time.
00:14:30.399 --> 00:14:36.399
Uh got on a call with the C-suite executives, and I'm sitting there trying to, I think it was my first month in the talk, I believe.
00:14:36.559 --> 00:14:48.000
And so I'm talking to all these C-suite executives and uh their IT like leads on their security team, and uh just trying to explain what I'm seeing, and like I couldn't really explain it as good as I thought I could.
00:14:48.240 --> 00:14:51.120
So I had to transfer into my laptop, like, okay, this is what I'm seeing.
00:14:51.200 --> 00:14:52.159
I'm seeing these logs.
00:14:52.240 --> 00:14:57.440
This is what, and then I scrolled down and I saw it was blocked, and I was like, oh man, I'm so sorry.
00:14:57.840 --> 00:15:01.440
So I was like, there shouldn't be any action on your guys' side where you we should be good to go.
00:15:01.600 --> 00:15:08.480
Yeah, but I mean again, even in that, I I think it does show the customer that, hey, listen, we're on shift, uh, we're seeing something.
00:15:08.559 --> 00:15:14.399
Yes, it was it was a blocked piece, but uh it's kind of like that uh emergency alert system, right?
00:15:14.480 --> 00:15:15.679
Like this is not a test.
00:15:15.759 --> 00:15:19.679
Uh um it's kind of like a fire drill in the middle of the night, keeping all their tests.
00:15:20.159 --> 00:15:22.080
Like a Dwight Shroot fire drill, you know?
00:15:22.480 --> 00:15:23.519
Make it really real.
00:15:23.679 --> 00:15:24.320
Yeah.
00:15:24.799 --> 00:15:27.279
Uh for the office fans out there.
00:15:27.440 --> 00:15:32.720
Uh, but uh yeah, I mean, it it shows that uh it shows the human side of it as well.
00:15:32.799 --> 00:15:32.960
Yeah.
00:15:33.039 --> 00:15:41.039
Uh, but but also I think it was that that probably allowed you to gain a little more confidence and even in talking to those executives.
00:15:41.279 --> 00:15:47.519
Listen, we we like to uh help folks learn around here by throwing you in the deep end sometimes and be like, swim.
00:15:47.840 --> 00:15:54.639
Uh and and so there's there's some good and bad that comes from that, but actually, man, I've always seen positive come from that.
00:15:54.720 --> 00:15:57.919
There's the the most growth happens from those uncomfortable times.
00:15:58.000 --> 00:16:04.399
And so I would say being in a part of the main any incident like that uh is a big learning curve.
00:16:04.480 --> 00:16:08.639
Uh because you know you go into it and you kind of have that Dunning Kruger effect where you think you know more than you do.
00:16:08.799 --> 00:16:09.039
Oh, yeah.
00:16:09.200 --> 00:16:17.200
And then as you learn more, you realize you don't know anything because cybersecurity is so broad and there's so much stuff to learn that it's really hard to get a grasp on it until you get thrown into the fire.
00:16:17.279 --> 00:16:17.440
Yeah.
00:16:17.600 --> 00:16:21.279
And then that's whenever you you're learning on the fly, you're learning from the professionals.
00:16:21.360 --> 00:16:23.759
So, like, for example, that was escalated up.
00:16:23.840 --> 00:16:34.480
So I had, you know, people that have been in the industry longer than I have learning, teaching me stuff on the fly during an incident, which is which is uh invaluable learning, in my opinion.
00:16:34.720 --> 00:16:35.120
I love it.
00:16:35.200 --> 00:16:36.240
Yeah, yeah, exactly.
00:16:36.399 --> 00:16:40.960
Always learning, always uh realizing that you're not the smartest one in the room.
00:16:41.120 --> 00:16:46.320
I I think I I try to hold that mentality as well and just soak up as much as I can uh anytime.
00:16:46.399 --> 00:16:51.279
And and man, a lot of times when I'm on with you guys, you guys are teaching me things and it's just it's phenomenal.
00:16:51.440 --> 00:17:01.759
And so uh I love seeing it, love knowing that uh Levi, you're you're on shift and helping uh find those things that are going bump in the night for our customers.
00:17:01.840 --> 00:17:10.799
So I appreciate you coming on the podcast today and um giving us a little bit of insight as to what the last two and a half years has kind of looked like for you uh here at Infusion Points.
00:17:11.119 --> 00:17:11.440
Yep, sir.
00:17:11.680 --> 00:17:12.240
Thank you for having me.
00:17:12.400 --> 00:17:12.799
Yeah, man.
00:17:12.960 --> 00:17:16.480
All right, and for our next guest speaker, we have Mr.
00:17:16.640 --> 00:17:22.160
Eric Bowles, who is our security operations lead here at Infusion Points.
00:17:22.240 --> 00:17:25.519
Um, and Eric's career started with us uh in a different manner.
00:17:25.599 --> 00:17:30.720
He actually started off as one of our security operations analysts and worked his way up the chain.
00:17:30.880 --> 00:17:32.880
And so I'm very excited to have Eric join us.
00:17:32.960 --> 00:17:34.240
Eric, jump on in here.
00:17:36.240 --> 00:17:38.880
Let you get mic'd up, get the headphones on.
00:17:38.960 --> 00:17:39.680
How you doing, Eric?
00:17:39.839 --> 00:17:40.319
I'm pretty good.
00:17:40.480 --> 00:17:40.880
How about you?
00:17:41.119 --> 00:17:41.839
Doing great, man.
00:17:41.920 --> 00:17:44.880
I appreciate you taking some time to jump in the podcast room here with us.
00:17:45.039 --> 00:17:56.559
So again, we're uh we're going over, it's our our 10-year anniversary of uh Security Operations Center here at Infusion Points and uh you know, bringing some individuals in, getting some unique perspectives.
00:17:56.640 --> 00:18:04.720
Um I've already mentioned in opening up that um at the end of the day, it's the team back there that that really just keeps the wheel moving.
00:18:04.880 --> 00:18:07.039
And uh that that's the engine, right?
00:18:07.119 --> 00:18:16.000
At the end of the day, I just I'm a talking head and I get to go around and um tell our customers about it and and and you know promote our services and and I love doing that.
00:18:16.079 --> 00:18:25.599
Um, but I'm always super proud that that I've got a team back there, but but but as well, more importantly, uh somebody like yourself that's leading that team that I can lean on.
00:18:25.680 --> 00:18:30.960
And so, number one, thank you for being part of the team and helping lead and drive this here at Infusion Points.
00:18:31.119 --> 00:18:33.519
Um, talk to me a little bit about uh your career.
00:18:33.599 --> 00:18:35.039
How long have you been with Infusion Points?
00:18:35.279 --> 00:18:36.720
Been with Infusion Points for five years.
00:18:37.119 --> 00:18:37.680
Five years.
00:18:37.839 --> 00:18:41.759
So talk to me about when you first came in at Infusion Points, what shift were you working?
00:18:42.000 --> 00:18:45.279
Uh, what was your primary functions when you first came on board here in Infusion Points?
00:18:45.519 --> 00:18:50.960
Um, well, you know, at first I did training, um, coming in on first Monday through Friday with Alex and the guys.
00:18:51.440 --> 00:18:57.519
And then after that, um, you know, got a little bit more access to everything, started working weekend shifts.
00:18:57.599 --> 00:18:59.759
Um, I was working lunchtime to midnight.
00:18:59.920 --> 00:19:00.319
Oh, wow.
00:19:00.559 --> 00:19:04.559
And then I would come in two days during the week, get the rest of my hours.
00:19:04.799 --> 00:19:05.200
Yeah.
00:19:05.440 --> 00:19:05.759
Yeah.
00:19:05.920 --> 00:19:10.319
So so started off primarily as that security operations analyst role.
00:19:10.559 --> 00:19:17.359
Um, and then, you know, throughout your career, we we've grown into the actual lead over the security operations center now.
00:19:17.440 --> 00:19:26.000
Talk to me about that growth um and you know, that period of time and that transition, like kind of what what happened within your career?
00:19:26.079 --> 00:19:27.920
What what was some of the challenges?
00:19:28.079 --> 00:19:38.160
Um, what do you think was one of the primary things that helped you in your growth and um you know, excel your career here at Infusion Points?
00:19:38.640 --> 00:19:44.640
Yeah, um, I think just the sheer like quantity of things to learn.
00:19:44.720 --> 00:19:44.880
Yeah.
00:19:45.119 --> 00:19:49.839
Um you know, we've got so many different customers, so many different tools that we use.
00:19:50.319 --> 00:19:56.000
And um, you know, getting to see that and learn how to use all of it is a really good motivator.
00:19:56.640 --> 00:20:01.680
Um and you know, it it takes some time to learn everything too.
00:20:01.759 --> 00:20:05.119
It doesn't come overnight, especially when you've never worked in like IT before.
00:20:05.759 --> 00:20:15.279
Um, you know, it took a couple of years to really get confident in myself as an analyst and um, you know, just constantly trying to learn from everybody around me.
00:20:15.599 --> 00:20:15.920
Yeah.
00:20:16.160 --> 00:20:19.920
I think that's um probably for me, right?
00:20:20.000 --> 00:20:28.960
When whenever um we were looking for individuals to help lead the security operations team and the analyst team in particular, um, that that's one of the things, right?
00:20:29.200 --> 00:20:30.799
Is the confidence, right?
00:20:30.880 --> 00:20:32.480
And and let me touch on that a little bit, right?
00:20:32.559 --> 00:20:45.920
Yeah, it's one thing to be confident in fielding the alerts and and understanding, okay, hey, what's what's this log saying, what this alert's saying, um, you know, what tactic, TTP is happening right here within this customer's environment.
00:20:46.079 --> 00:20:54.960
But more importantly, right, as a lead, it it's it's important to find somebody that's got that confidence in communication with the customer and and and in communications.
00:20:55.039 --> 00:21:02.319
And that's one of the things that quite honestly, um we uh definitely seen in you, Eric, and was uh super impressed with.
00:21:02.400 --> 00:21:06.480
You know, I remember kind of watching you through our MSI calls.
00:21:06.559 --> 00:21:16.720
And for those out there that may not understand exactly what that is, well, that's a monthly security index call that we have with our customers where we go over the things that were happening within that month with the customer.
00:21:16.880 --> 00:21:22.160
Because again, uh, you know, the goal is to have as little activity as possible within the environment.
00:21:22.319 --> 00:21:25.599
We want clean, clean activity and and clean environments.
00:21:25.759 --> 00:21:29.599
But I will say, I've I've told the guys this, and Eric's probably heard me say this.
00:21:29.759 --> 00:21:34.720
Um like I get nervous when there's not a lot of an act activity going on.
00:21:34.880 --> 00:21:44.079
Um and so the the other piece as well is we want to ensure that the customers are uh, you know, they're they're getting their money's worth, if you will, right?
00:21:44.160 --> 00:21:49.279
Hey, they're they're paying for our service, and that service doesn't just include us being a canary, right?
00:21:49.359 --> 00:21:51.920
Um, but hygiene of the environment is very important.
00:21:52.000 --> 00:21:59.759
And so watching you with the customers on those MSI calls and the and the confidence that you kind of showed to me there of creating that relationship.
00:22:00.160 --> 00:22:16.799
With the customer because that's very important as well with the number of customers that we have, being able to sit down and talk with them on a first name basis and be like, hey, you know, I know this server within your environment, or I know this account, this activity, or this user that we constantly see things from.
00:22:17.279 --> 00:22:19.920
To be able to get on that level with the customer is very important.
00:22:20.000 --> 00:22:27.920
And so that was definitely one of the things that stood out uh to me when watching you and the progression of your career.
00:22:28.240 --> 00:22:32.000
Um, talk to me how the day-to-day differs a little bit now, right?
00:22:32.079 --> 00:22:36.319
So we were in that analyst role where you were the one fielding the alerts, right?
00:22:36.480 --> 00:22:38.880
Creating the tickets, doing the remediation pieces.
00:22:38.960 --> 00:22:41.599
Uh, to now you're the one that's really kind of driving the team.
00:22:41.680 --> 00:22:46.079
And then I I just I come to you whenever I need something done or something like that.
00:22:46.160 --> 00:22:52.799
So talk to me a little bit about that that transition and how that day-to-day looks now and um the good and the bad of that.
00:22:53.279 --> 00:22:53.680
Yeah.
00:22:53.839 --> 00:22:58.880
Um, so I'm a little bit removed from you know, monitoring all day anymore.
00:22:59.200 --> 00:23:03.759
Um, but it's really I'm I work just about all day.
00:23:04.160 --> 00:23:12.480
I mean, um, you know, something going on in the middle of the night, um something going on in the weekends, you know, it's it's all the time.
00:23:12.559 --> 00:23:14.400
And um it's a it's not bad.
00:23:14.880 --> 00:23:16.079
Um I enjoy it.
00:23:17.599 --> 00:23:23.359
You you mentioning um the piece about you know being able to get with the customers on a first name basis and everything.
00:23:23.599 --> 00:23:26.400
Um you know, I'm being able to do that a little bit more.
00:23:26.799 --> 00:23:29.359
Um you know, field calls with the customer.
00:23:29.519 --> 00:23:37.200
Um, you know, if they have a question or a problem, get on there and you know, be able to get that more personal relationship going now.
00:23:37.920 --> 00:23:43.599
And um you know, I I really enjoy it um working with all our customers on that level.
00:23:43.839 --> 00:23:51.519
Um, it's it's nice to you know not be the bad guy calling an LI anymore, but um for sure.
00:23:51.680 --> 00:24:01.519
But you know, it you you mentioned you're not in the day-to-day and you're not filled in the alerts, and so it's different, and you do get to create a different relationship with the customer.
00:24:01.680 --> 00:24:12.480
Um, but I know that one of the things you're you're a little uh you're a little humble in this and you won't say this, but I have seen you um get on and be the shield, if you will, for the customers, right?
00:24:12.559 --> 00:24:19.680
When whenever we're uh having to give unfortunate news or something like that, that hey, we we mitigated this and you guys need to do that.
00:24:19.839 --> 00:24:24.000
Um I I've I've seen that and and that's just that's part of it's part of leadership.
00:24:24.079 --> 00:24:25.519
And so uh I appreciate that.
00:24:25.680 --> 00:24:26.799
I love seeing that growth.
00:24:26.960 --> 00:24:31.920
I mean, look, at the end of the day, the the job we're in when they're hearing from us, it's never a good thing, right?
00:24:32.400 --> 00:24:37.839
Um, and so you know, even if it it even if it's something that's been mitigated, right?
00:24:38.000 --> 00:24:40.720
Like that's still not a it's not a not a good thing.
00:24:40.880 --> 00:24:47.279
It's like at the end of the day, hey, we stopped this, we seen this, and that's all well and good, but that still means that this happened.
00:24:47.440 --> 00:24:49.920
That means that the customer was still targeted in some manner.
00:24:50.079 --> 00:25:00.240
And so um, yeah, it's you know, we unfortunately at times are going to be delivering um and taking up people's times and things that they don't they don't have time for.
00:25:00.319 --> 00:25:01.839
They don't want to have to be worrying about.
00:25:01.920 --> 00:25:07.680
And, you know, there's a lot of things that we do where uh within our contracts where we just take care of those things for customers.
00:25:07.759 --> 00:25:16.559
But at the end of the day, we still get with them on these monthly calls and have to, you know, disseminate, hey, all of this happened within your environment and uh we need you to do a little housekeeping.
00:25:16.640 --> 00:25:21.440
Nobody likes to be told that they need to they need to clean up the house a little bit, but uh it's needful.
00:25:21.599 --> 00:25:26.480
And so uh yeah, I appreciate you you definitely taking the the leadership and doing that.
00:25:26.559 --> 00:25:37.359
Talk to me a little bit about now, you know, less of the customer piece, but what's the interaction like with the team uh being that that lead uh for the guys on first, second, and third shift you stated?
00:25:37.839 --> 00:25:42.400
Um well I think right now we've got the best sock team that we've had in my time here.
00:25:42.799 --> 00:25:48.160
Um you know, I I try to keep a good, you know, morale with everybody.
00:25:48.319 --> 00:25:48.559
Sure.
00:25:48.799 --> 00:25:52.480
Um everybody's really good at working with one another too.
00:25:52.720 --> 00:25:55.599
Um, you know, they they really make my job easier.
00:25:56.400 --> 00:25:59.200
So you you touched on morale.
00:25:59.440 --> 00:26:03.279
That's interesting because people don't understand that.
00:26:03.440 --> 00:26:11.440
Like for our viewers out there, if you want to understand what it's like being a security operations analyst, let's say second, third shift, okay.
00:26:11.680 --> 00:26:25.759
I want you to wake up in the middle of the night and I want you to go sit in your living room and I want you to turn on the uh the broadcast testing system, uh, where it's just all the stripes down the TV, and I want you to just sit there and stare at that.
00:26:26.000 --> 00:26:28.400
Do that for about eight hours, okay?
00:26:28.640 --> 00:26:30.480
And a lot of times that's what it can feel like.
00:26:30.640 --> 00:26:33.920
It's like, oh my gosh, alert, alert, alert.
00:26:34.000 --> 00:26:36.799
And and then we hear about things like alert fatigue, right?
00:26:36.960 --> 00:26:40.640
And that will weigh on the morale of people if you're not careful, right?
00:26:40.720 --> 00:26:46.079
And so ensuring that we uh work to give people time off, right?
00:26:46.240 --> 00:26:49.440
Hey, healthy work life balance is very important as well.
00:26:49.519 --> 00:26:59.200
Um, I mean, there is a human, there's a human aspect of this that we have to think about and always filling and and swatting down things down uh can weigh on a person.
00:26:59.359 --> 00:27:08.960
You know, we often say, um, I heard it uh as I was coming up in my career, and it it still holds true today that uh the threat actor has to be right one time.
00:27:09.359 --> 00:27:11.039
We have to be right every time.
00:27:11.200 --> 00:27:14.000
And uh man, that there's a lot of pressure in that.
00:27:14.160 --> 00:27:20.079
And so uh you need to be able to remove people from that that stressor a little bit and let them have a little reprieve.
00:27:20.240 --> 00:27:25.039
So yeah, hey, I appreciate you being human and bringing up their morale piece because you're right.
00:27:25.119 --> 00:27:26.640
Yeah, it is a challenging job.
00:27:26.799 --> 00:27:31.680
It's not all sunshine rainbows in a security operations center, uh, unfortunately.
00:27:31.839 --> 00:27:41.519
Although we do have a phenomenal team and we do a phenomenal job here at Infusion Points and the tooling and things like that have gotten better throughout time, and I think you would even attest to that.
00:27:41.680 --> 00:27:45.519
Um, but you know, at the end of the day, there is still a human piece to this.
00:27:45.599 --> 00:27:51.440
So the way I've always described it is um you've watched the TV show Lost, right?
00:27:51.599 --> 00:27:52.240
Oh yeah.
00:27:52.480 --> 00:28:04.799
Um I can't remember the guy's name, but the guy that was trapped in that vault, having to press the button to save the world, that's that's what it feels like sometimes on weekends or and don't let that timer run out.
00:28:05.039 --> 00:28:08.000
Yeah, you gotta be there ready to, you know, take care of it.
00:28:08.240 --> 00:28:14.079
You know, I it's so funny you bring that up because that was about the time that I really started losing interest in the show.
00:28:14.319 --> 00:28:18.400
Uh and and I was like, I this is like, are they ever gonna get found?
00:28:18.559 --> 00:28:20.720
And then you realize that no, that's the point of the show.
00:28:20.799 --> 00:28:22.319
And yeah, I was gone at that point.
00:28:22.400 --> 00:28:28.240
But you're right, it's it can be monotonous, it can be mundane, and it can just feel like uh a groundhog day every day.
00:28:28.319 --> 00:28:33.440
Um, but again, that's why we we try to do it some, you know, things like threat hunting and things like that, right?
00:28:33.519 --> 00:28:38.079
To to really continue to flex that muscle and and stay active within the environments.
00:28:38.319 --> 00:28:41.920
Um, so yeah, I mean that's that's a great analogy.
00:28:42.000 --> 00:28:44.240
I would have never kind of thought of it in that manner, but you're right.
00:28:44.319 --> 00:28:45.920
Uh there's a lot of that.
00:28:46.160 --> 00:28:52.960
What's really cool though is now some of the things like uh AI that we're bringing in and and even some of the automations, right?
00:28:53.119 --> 00:28:53.839
It's really weird.
00:28:54.000 --> 00:28:59.599
Automation feels like almost like an old word now, an old antiquated thing now, because we have AI.
00:28:59.759 --> 00:29:09.759
Um talk to me a little bit, you know, just briefly about some of the AI integrations and where you really think that's gonna help and how we're seeing that improve, the team, uh, but also for our customers as well.
00:29:10.079 --> 00:29:10.559
Yeah.
00:29:10.720 --> 00:29:17.119
Um so like the lowest level baseline, um, we've got analysts that are building their own agents with Copilot.
00:29:17.440 --> 00:29:23.359
And um we're able to throw the customer's SOP into it as like a context file.
00:29:23.440 --> 00:29:23.599
Yeah.
00:29:23.839 --> 00:29:32.559
So whenever we come across a log or something and we want to review it with Copilot, you know, we can ask it, you know, what's going on with this alarm?
00:29:33.119 --> 00:29:35.519
Um, you know, do we need the ticket in?
00:29:35.759 --> 00:29:43.599
And it'll go through the SOP, how the customer wants us to act, and um go ahead and create a ticket, let us know recommendations and everything.
00:29:43.759 --> 00:29:46.160
So, you know, that speeds up just initial alerting.
00:29:46.480 --> 00:29:46.640
Yeah.
00:29:46.880 --> 00:29:54.160
Um then um we're you know, we're also working on the um AI for XPD4 to come.
00:29:55.119 --> 00:29:58.880
Um that's that's gonna be really interesting as well.
00:29:59.039 --> 00:30:05.599
Um again, you know, that that's taken even more human aspect out of that first piece I just mentioned.
00:30:05.680 --> 00:30:05.920
Yep.
00:30:06.000 --> 00:30:10.160
You know, we're not having to go find that log and throw it in the AI, it's gonna be coming to us.
00:30:10.400 --> 00:30:10.799
Right.
00:30:11.039 --> 00:30:13.839
And yeah, that's so that's so powerful, right?
00:30:14.000 --> 00:30:16.960
Because uh, we were just talking about that a little bit earlier, right?
00:30:17.279 --> 00:30:20.319
How that data enrichment that's gonna happen from that.
00:30:20.400 --> 00:30:26.559
But you know, I had not even thought about the the context piece that and leveraging the SOP on the communication chain.
00:30:26.640 --> 00:30:28.400
Uh, that's actually pretty ingenious.
00:30:28.480 --> 00:30:30.559
I I love hearing that you guys are doing that.
00:30:30.720 --> 00:30:33.039
Um, but yeah, I mean it's just speed, right?
00:30:33.119 --> 00:30:33.839
At the end of the day.
00:30:33.920 --> 00:30:49.119
And what I've seen across the board, um, it's allowed all of our analysts, and this was the goal here at Infusion Points, but uh allowed all of our analysts to kind of elevate to a completely different level because at the end of the day, uh, the tier one security operations analyst is is no longer a thing.
00:30:49.200 --> 00:31:00.160
Um and uh, you know, our our goal is to fully have, you know, that agentic SOC team so that everybody's operating at that tier three or engineer level that we have on shift.
00:31:00.240 --> 00:31:04.079
That doesn't mean that we're not gonna have a security operations center that operates 365 247.
00:31:04.480 --> 00:31:06.400
Um that that's that's part of who we are.
00:31:06.480 --> 00:31:08.480
That's embedded in us here at Infusion Points.
00:31:08.960 --> 00:31:14.720
But um it it's we're gonna operate at a different level for our customers, and I think it's gonna be so beneficial.
00:31:15.200 --> 00:31:18.559
Well, Eric, listen, man, um, I appreciate you jumping in with us.
00:31:18.720 --> 00:31:20.960
We got uh a few more we're gonna roll through.
00:31:21.039 --> 00:31:25.759
And uh, man, I'm telling you right now, let me just close it out by saying this.
00:31:25.920 --> 00:31:29.759
Uh, you are the ones that are now feeding the calls in the middle of the night.
00:31:29.839 --> 00:31:33.119
And uh I know that if I hear from anybody, I'm gonna be hearing from you.
00:31:33.279 --> 00:31:36.880
Um, so let me just say from the bottom of my heart, thank you.
00:31:37.119 --> 00:31:38.799
And uh keep on doing what you're doing, man.
00:31:38.880 --> 00:31:39.839
You're doing a phenomenal job.
00:31:40.079 --> 00:31:40.400
Thank you.
00:31:40.640 --> 00:31:43.359
And um, thank you for the opportunity for all of it.
00:31:43.440 --> 00:31:44.880
I love working here.
00:31:45.039 --> 00:31:45.599
Awesome, man.
00:31:45.759 --> 00:31:46.240
Appreciate it.
00:31:46.480 --> 00:31:46.720
Thank you.
00:31:46.880 --> 00:31:54.079
And for our next guest here on the podcast today for the 10-year anniversary of the Security Operations Center, we have our Security Operations Engineer lead, Mr.
00:31:54.240 --> 00:31:55.200
Alex Earhart.
00:31:55.440 --> 00:31:56.559
Alex, jump on in.
00:31:56.880 --> 00:31:57.680
Thank you.
00:31:59.519 --> 00:32:02.160
Get you all set up, get you mic'd up here.
00:32:02.720 --> 00:32:03.119
Yep.
00:32:03.359 --> 00:32:03.839
Awesome.
00:32:04.000 --> 00:32:05.759
Thanks for being on with us today, Alex.
00:32:05.920 --> 00:32:23.599
Um, as you know, it's the Security Operations Center 10-year anniversary, and um just had you know several of the guys jump in and talk about their experiences in the Security Operations Center and um you being in the security operations engineering role and the lead over that team.
00:32:23.839 --> 00:32:30.240
Wanted to kind of get your perspective, but also you didn't start off as the security operations engineering lead uh and in that position.
00:32:30.480 --> 00:32:39.839
So talk and start off telling us a little bit about how you came to Infusion Points and uh you know how long you've been here and kind of where you started and what what you've been doing.
00:32:40.000 --> 00:32:40.319
Yes.
00:32:40.480 --> 00:32:46.000
Um, so I started, I think it's eight years ago, going on nine, somewhere around that range.
00:32:46.319 --> 00:32:52.319
Um I was just a student at the community college, and Randy Gamble took us on a tour here.
00:32:52.559 --> 00:32:58.960
And on the tour, on the tour, uh you guys said he needed bodies, and I was like, well, I'd love to get the opportunity.
00:32:59.119 --> 00:33:08.640
And I think I talked to Jeremy like the next day, and uh yeah, I was just green, wanted to get some experience and got the got the opportunity to learn from the best.
00:33:09.279 --> 00:33:09.680
Love that.
00:33:09.759 --> 00:33:23.759
I mean, coming in, we so for those of you that don't know, we we do have uh local uh local community college here in Wilkes uh that we have a great relationship with, but also uh even universities around us, uh Wick Forest, but then also Appalachian State as well.
00:33:23.920 --> 00:33:35.119
And we will do tours uh every now and then of Security Operations Center and and bringing those students in, kind of allowing them to kind of get eyes on um of the Security Operations Center and kind of the inner workings of it.
00:33:35.200 --> 00:33:43.279
Uh it's kind of eye-opening to see that something like that exists here in the county of Wilkes and in the western part of North Carolina.
00:33:43.519 --> 00:33:52.160
And so, yeah, I remember when you came through, and uh you're right, we were looking looking at bodies uh in that day and time, continue to build out the team.
00:33:52.400 --> 00:33:55.519
Um, and uh I I love the drive, right?
00:33:55.599 --> 00:34:09.679
Uh the fact that you were looking and and willing to take any step that you could uh to get in the door, and and that's what we look for here at Infusion Points, just that humble, hungry, and smart individual uh that's looking to further their career.
00:34:09.760 --> 00:34:14.719
And so when you started off, what shift were you primarily working uh when you started off as an analyst here?
00:34:14.960 --> 00:34:19.920
Uh the shift no one wants, which is third shift and weekends and holidays, which was fine by me.
00:34:20.000 --> 00:34:21.119
I'm fresh out of college.
00:34:21.199 --> 00:34:24.559
I didn't expect to be able to get the best shift there is, you know, peck and order and everything.
00:34:24.639 --> 00:34:25.440
But uh Right.
00:34:25.599 --> 00:34:25.840
Yeah.
00:34:26.000 --> 00:34:26.400
Yeah, yeah.
00:34:26.480 --> 00:34:33.519
We we talked a little bit earlier to uh to Levi as well, and he talked about that that late night third shift and uh that 2 a.m.
00:34:33.840 --> 00:34:34.320
3 a.m.
00:34:34.559 --> 00:34:35.360
kind of lull.
00:34:35.599 --> 00:34:38.639
And uh everybody says they get cold right around that time.
00:34:38.719 --> 00:34:43.360
I don't know what it is, but uh just because there's no one in the building and then it gets cold.
00:34:43.679 --> 00:34:46.239
I think it's the perfect time to to to learn though.
00:34:46.559 --> 00:34:55.199
It's like when it you know, you have a lot of downtime at four in the morning, you know, customers aren't doing what they do during their business day, but right um gave me a lot of time to study.
00:34:55.519 --> 00:35:07.920
Uh back in the day when we used Alien Vault to go through that course we had, and right now, you know, learning Greylog or learning open search gives you gives you time to play around in like our testing environment to figure some things out.
00:35:08.239 --> 00:35:08.559
Awesome.
00:35:08.639 --> 00:35:10.480
Yeah, so let's let's dive in a little bit about that.
00:35:10.639 --> 00:35:16.880
So, what is it that you think actually really helped uh take your career to the to the next level?
00:35:17.039 --> 00:35:17.199
Right?
00:35:17.280 --> 00:35:26.400
You came on part-time initially, uh, then we brought you on full time, but what is it that was kind of been that that pinnacle moment for you that's uh allowed you to take that next step in your career?
00:35:26.639 --> 00:35:27.760
Oh, there's a couple things.
00:35:27.840 --> 00:35:32.800
Uh the thing I think helped me the most was asking people, you know, how do I do this?
00:35:33.119 --> 00:35:38.639
Because one thing I noticed on when I was working second and third, when you call people, they're not not the happiest, which I don't blame them.
00:35:38.800 --> 00:35:39.519
Now I get called.
00:35:39.840 --> 00:35:40.880
I'm not the happiest either.
00:35:41.119 --> 00:35:41.440
Understood.
00:35:41.760 --> 00:35:46.079
But uh if I could, you know, ask Josh, like, hey, what are you what are you doing?
00:35:46.480 --> 00:35:48.719
Like, can I do this instead of calling you next time?
00:35:48.800 --> 00:35:48.880
Yeah.
00:35:49.119 --> 00:35:51.519
Stuff like that, where I'm like, I feel bad calling you, right?
00:35:51.760 --> 00:35:54.800
Because you know, you're probably eating dinner with your your wife and kids or something.
00:35:54.960 --> 00:35:55.280
Yeah.
00:35:55.920 --> 00:36:00.159
Like, if I can learn this, then Josh doesn't have to do it, or you don't have to do it, or Jeremy doesn't have to do it.
00:36:00.239 --> 00:36:00.400
Yeah.
00:36:00.559 --> 00:36:05.840
So just doing that over the I think it was two or three years, you know, moving shifts between that time.
00:36:06.239 --> 00:36:07.440
Yeah, that definitely makes sense.
00:36:07.519 --> 00:36:26.239
And I mean, um really just that mindset of wanting to be a sponge and and soak up as much information as you possibly can, but um, you know, the ability to kind of grab hold as well and and take on additional things is is one of the things that's very unique here at Infusion Points that we look for in individuals as well.
00:36:26.400 --> 00:36:29.039
And so uh it's awesome to hear you you say in that.
00:36:29.119 --> 00:36:36.400
And then also just you know, I heard you mention uh spending extra time studying, uh, which is very important, you know, education leaning here at Infusion Points.
00:36:36.480 --> 00:36:46.639
And so always learning um is a critical thing for us, especially in the Security Operations Center, because it is the threat actors and the attack vectors, they're always changing.
00:36:46.800 --> 00:36:54.719
Um, although I will say there's a lot of wash wrench repeat as well, but uh there's always something new to learn out there, and so that's very important.
00:36:55.360 --> 00:37:00.880
Talk to me now a little bit about uh, because it's a little unique, a little different, right?
00:37:00.960 --> 00:37:09.920
We have the security operations analyst side, which we had Eric on earlier talking with him, and now uh we have representation for the security operations engineering side.
00:37:10.000 --> 00:37:21.840
So talk to me a little bit about that and and what that looks like and how the teams work together for the overall betterment of the security operations center, but also the overall betterment of infusion points and our customers.
00:37:22.159 --> 00:37:34.480
Yeah, so my side of the house from the engineering side and my team, we we mainly ensure that all the tools the analysts are using is what they need and operating how they need to use them.
00:37:34.639 --> 00:37:37.119
So, for instance, a lot of it is our SIM technology.
00:37:37.599 --> 00:37:49.280
So my team's responsible for deploying, maintaining, doing the operational pieces of the SIM, making it better, and then working with the analysts to be like, okay, is there anything you guys need in here that would make your job easier?
00:37:49.519 --> 00:37:56.159
You know, you know, doing some training with them, like, hey, if you need to make an alert, here's what you need because you know they're in the environment, looking at the customer, talking to the customer.
00:37:56.320 --> 00:37:56.559
Right.
00:37:56.800 --> 00:38:04.880
So we can give them the tools or the knowledge to like, you know, manage the alerts, you know, tweak them as needed, but just ensuring it's operating as intended.
00:38:05.119 --> 00:38:05.760
Yeah, I love that.
00:38:05.840 --> 00:38:06.639
I mean, I love that.
00:38:06.719 --> 00:38:09.199
And I love the concept that we've kind of come up with that as well.
00:38:09.280 --> 00:38:21.519
It's you know, um, the last thing that you want the analyst to be having to do on their shift when they're supposed to be monitoring and ensuring that our customers are secure is constantly battling the tooling, right?
00:38:21.599 --> 00:38:22.639
The management of the tooling.
00:38:22.719 --> 00:38:25.760
And so we've got a team that uh uniquely handles just that.
00:38:25.920 --> 00:38:27.360
They do the deployments as well.
00:38:27.440 --> 00:38:29.760
It allows us to onboard a lot quicker as well.
00:38:29.920 --> 00:38:41.440
Uh, and and you know, I like to say anytime that I sit down with a customer, as soon as the first log comes in, for all intents and purposes, that customer's live because we have data coming in that we can be alerted on anything at any point in time.
00:38:41.679 --> 00:38:43.920
And so at that point, the service is live.
00:38:44.000 --> 00:38:53.440
Um, and so that allows our analyst to run while the uh the the engineering team is maybe even still doing some of the onboarding and bringing systems on.
00:38:53.599 --> 00:38:57.119
So uh I love how we've kind of got that segregated out a little bit.
00:38:57.360 --> 00:39:01.760
And uh again, working with the analyst to say, hey, look, what do you need?
00:39:01.840 --> 00:39:10.800
What makes your job easier, better, uh, what provide you more insight is very unique and important uh to what we do in the security operations side.
00:39:11.119 --> 00:39:32.079
Uh what are some other things other than I I know you guys are touching a whole lot more, especially nowadays with FedRamp 20x um than just the the SIM technology and you know the EDRs and and and all the things that you would think when you think security operations, but what are some of the other things that your team's currently touching right now and and where are we kind of driving uh from an innovation perspective?
00:39:32.400 --> 00:39:47.679
Yeah, that's uh ever-growing list these days, but um yeah, you mentioned 20x, that's that was a big focus of quite a bit of the team members uh over the past, I want to say like eight months, really, from like new to in the first concept of like what are we gonna do, how are we gonna do it.
00:39:47.920 --> 00:39:56.880
So engineering checks, because uh I don't know if you mentioned it in the other segments, but we have the audit shield where we protect the customer from the audits.
00:39:56.960 --> 00:39:59.840
You know, security operations engineers were a big part of that.
00:39:59.920 --> 00:40:01.280
You know, we would go through the audit calls.
00:40:01.360 --> 00:40:03.760
So we knew a lot of the evidence that was needed for an for an audit.
00:40:03.920 --> 00:40:04.159
Yeah.
00:40:04.320 --> 00:40:08.960
Um so it's taking the same things we were showing and then making code to then show those things.
00:40:09.280 --> 00:40:09.519
Right.
00:40:09.599 --> 00:40:16.159
And so some of the audience members may be being like, well, what in the world is the security operations center doing in as part of the audits?
00:40:16.239 --> 00:40:17.679
It actually makes a whole lot of sense, right?
00:40:17.760 --> 00:40:19.840
So so these guys are the ones that have insight.
00:40:20.000 --> 00:40:20.960
So let's think about it.
00:40:21.039 --> 00:40:32.400
You have security tooling that's set up, you have security mechanisms that are set up within environments, uh, but it's up to these guys to prove it uh via log sources and uh constantly monitoring the tooling, right?
00:40:32.480 --> 00:40:36.960
And monitoring for up-downs or whatever it may be, uh, and just proving that the tooling's working.
00:40:37.039 --> 00:40:46.480
And so there's no better person than or better team to work with the auditor than the security operations team because they know, oh yeah, hey, uh we've got logs for that.
00:40:46.559 --> 00:40:47.760
We see them come in constantly.
00:40:47.840 --> 00:40:48.559
And let me show you those.
00:40:48.639 --> 00:40:53.920
Let me pivot back 90 days, 180 days, or whatever it may be, um, to prove that.
00:40:54.000 --> 00:41:11.280
And so, you know, when we talk about the the life cycle of that, and I don't want to go down this rabbit hole too much, but uh I I know early on when when the guys were having to sit through these audits, um it became a whole lot of like Groundhog Day because you're pulling the same evidence over and over and over again.
00:41:11.519 --> 00:41:20.159
And, you know, talk to us a little bit about how the team at the very beginning started looking at that and and how you guys was like, hey, let's let's grow this and pivot from this.
00:41:20.480 --> 00:41:32.719
Yeah, I think it was maybe the second or third FedRP audit we went through, like, man, these are the same questions, looking at the same logs, doing the same things for I don't know, three, four hours a day for a week or two.
00:41:32.960 --> 00:41:33.119
Yeah.
00:41:33.360 --> 00:41:40.559
Um I think it was Jeremy's idea to, hey, if we know what they're gonna ask, why don't we just go have all this ready on a nice clean dashboard for them?
00:41:40.960 --> 00:41:47.199
So we could take four hours worth of calls and be like, okay, let's just schedule a two-hour block with us.
00:41:47.440 --> 00:41:51.440
We'll knock out everything you need, and then it makes our life easier, makes the auditors' life easier.
00:41:51.679 --> 00:41:54.079
Uh, because no one, no one wants to sit there for that long.
00:41:54.320 --> 00:41:54.559
Yeah.
00:41:54.639 --> 00:41:54.800
Yeah.
00:41:54.880 --> 00:42:00.480
I remember when we first did that, the auditors was like, oh my lord, you you don't know how much easier you just made my life.
00:42:00.559 --> 00:42:03.679
Uh, and the fact that even we had it laid out by control families, right?
00:42:03.840 --> 00:42:08.960
So as they're going down their checklist, they're like, oh, well, here's this control family, and there's the evidence I need.
00:42:09.119 --> 00:42:16.719
So yeah, we were always kind of marching down that path, and and now we've got a fully dedicated team in the security operations engineering side.
00:42:17.199 --> 00:42:24.239
Um kind of overall question for you here, going back and thinking, you know, again, this is the 10-year anniversary in your time here.
00:42:24.320 --> 00:42:26.000
You said you've been here close to eight years now.
00:42:26.320 --> 00:42:27.679
Seven, eight, nine, somewhere around there.
00:42:27.840 --> 00:42:29.840
Yeah, it's all starting to run together, I'm sure.
00:42:30.079 --> 00:42:40.559
But uh, talk to me about just overall, the overall change that you've seen uh as even coming on part-time to now where you're at in your career here at Infusion Points.
00:42:40.719 --> 00:42:44.159
What's just the overall sentiment in change that you've seen?
00:42:45.119 --> 00:42:46.159
There's been a lot of change.
00:42:46.480 --> 00:42:50.320
The biggest one I've seen is the kind of a mindset, if you call it that.
00:42:50.480 --> 00:42:58.960
Um we used to do things a very standard by the book way, on-prem, and then maybe two or three years in size here.
00:42:59.039 --> 00:43:00.320
We made a huge shift to cloud.
00:43:00.719 --> 00:43:06.559
And now I think we're making a similar shift with the the new FedRAMP rules with the 20x and CR26.
00:43:07.119 --> 00:43:19.199
Yeah, I I've I've uh voiced that like FedRamps have been a huge change for us uh in the 20x side, and I've equated it a lot to that cloud shift that happened probably about five, six years back.
00:43:19.360 --> 00:43:31.360
Uh, but I've also even I feel like the AI innovations, um that whole thing is just a completely different mindset and shift that's happening even right now, uh right before our eyes.
00:43:31.440 --> 00:43:40.000
And and it's it's hard to imagine where AI's come even in the last six months and what it will possibly be the next year to come.
00:43:40.239 --> 00:43:53.599
Um, and so really leaning into that, and that's one of the great things too about having uh your team uh researching that, leaning into that, and and getting that tooling in the hands of our analyst as well, because that's that's very important.
00:43:53.760 --> 00:43:54.480
Because guess what?
00:43:54.559 --> 00:43:56.880
It's already in the hands of the threat actors, we know that.
00:43:57.039 --> 00:43:59.440
And so uh, you know, us.
00:44:00.079 --> 00:44:07.840
Being able to combat that, we're gonna have to combat that, uh, leveraging the same types of technologies because it can't always just be give me more bodies, right?
00:44:08.000 --> 00:44:10.159
We know that that's never gonna be the answer.
00:44:10.320 --> 00:44:15.760
So, so yeah, yeah, I like hearing that, the fact that there's just been this huge mindset change.
00:44:16.079 --> 00:44:23.840
Um, and I think we've seen the progression and the growth of infusion points, the maturity of infusion points throughout the years, which is pretty cool.
00:44:23.920 --> 00:44:46.320
Um, I can definitely tell you that I've seen the maturity throughout the SOC uh throughout the years, and and then the fact that you know, we had a security operations team um and it was one larger team, but then even splitting that off into kind of an engineering and analyst team now, um, and having individuals that are marching in the same path, same direction.
00:44:46.559 --> 00:44:52.800
Um, but at the end of the day, um one's over here sharpening the spear and and the other one's actually using the spear.
00:44:52.880 --> 00:44:57.599
And so I I love the fact that um we kind of have things laid out like that.
00:44:57.679 --> 00:45:04.400
And and it's been a long time coming, but uh you know, we've been operating like this for what two, three years now, even?
00:45:04.960 --> 00:45:05.360
Yeah.
00:45:05.599 --> 00:45:07.280
So well, awesome.
00:45:07.440 --> 00:45:11.760
Uh well, let me ask you, I mean, what's uh what's the future hold?
00:45:11.840 --> 00:45:14.400
Where do you what do you expect to see infusion points in the next five years?
00:45:14.559 --> 00:45:16.000
We're talking about the 10-year anniversary.
00:45:16.079 --> 00:45:18.960
What what do you what do you think is on the horizon for the next five for infusion points?
00:45:19.119 --> 00:45:21.599
I honestly don't know because I never thought we'd be here five years ago.
00:45:21.760 --> 00:45:22.239
Oh wow.
00:45:22.320 --> 00:45:23.119
So wow.
00:45:23.360 --> 00:45:24.960
I mean, like I said, the big shift.
00:45:25.039 --> 00:45:27.920
You never very true, you never know what five five years is a long time.
00:45:28.159 --> 00:45:29.360
Five years is a long time.
00:45:29.440 --> 00:45:39.679
I know um, you know, we we try to take things day by day, but also I think from a business perspective, we're always looking on the horizon, you know, eyes on the horizon, trying to figure out what is to come.
00:45:40.079 --> 00:45:44.400
Um and I think personally, I feel like we'll see more of this.
00:45:44.639 --> 00:45:59.760
We'll see more of this growth, um, more sophistication, uh, more tools, um, and just faster delivery for our customers, uh, which at the end of the day uh allows them to be overall more secure as well.
00:46:00.159 --> 00:46:05.519
So well, Alex, any parting words for the 10 years?
00:46:06.000 --> 00:46:06.719
It's been a blast.
00:46:06.800 --> 00:46:08.239
Let's do it again in 10 more years.
00:46:08.400 --> 00:46:10.159
Uh all right, we'll schedule it 10 more years.
00:46:10.239 --> 00:46:11.039
Go ahead and put it on the books.
00:46:11.280 --> 00:46:12.159
Caitlin back there.
00:46:12.239 --> 00:46:13.840
Go ahead and mark it on our calendars, please.
00:46:14.320 --> 00:46:14.639
Awesome.
00:46:14.719 --> 00:46:16.880
Well, Alex, I appreciate you being with me today, man.
00:46:17.199 --> 00:46:19.599
And uh we'll see you on the next 10-year episode.
00:46:19.840 --> 00:46:20.320
Sounds good.
00:46:20.400 --> 00:46:20.800
Appreciate it.
00:46:20.960 --> 00:46:21.360
Yep.
00:46:21.679 --> 00:46:29.199
And for our last special guest here for the Security Operations Center 10-year anniversary.
00:46:29.360 --> 00:46:41.599
Uh, we have a very special guest, uh, one that's, and I'm telling you right now, I've just grown a phenomenal relationship with over my uh lifetime here at Infusion Points and the years that I've been here.
00:46:41.760 --> 00:46:50.159
And it's an individual that uh is a special guest for us because he has been here the entire life cycle of the Security Operations Center as well.
00:46:50.320 --> 00:46:58.320
So uh when he was brought on here at Infusion Points, uh he was brought on to serve in the Security Operations Center as it was being stood up.
00:46:58.480 --> 00:47:05.199
Um and so as that birth was happening here at Infusion Points, so was uh his career starting here at Infusion Points.
00:47:05.280 --> 00:47:06.800
And he's been with us the entire time.
00:47:06.960 --> 00:47:09.199
And so, a man that needs no introduction, Mr.
00:47:09.280 --> 00:47:11.840
Jeremy Powers, come on in and join us.
00:47:13.760 --> 00:47:15.440
How are you doing, sir?
00:47:16.000 --> 00:47:16.960
I am doing well.
00:47:17.039 --> 00:47:17.679
How about yourself?
00:47:17.920 --> 00:47:18.480
I'm doing great.
00:47:18.960 --> 00:47:20.880
Throw headphones on, or you want to go without them?
00:47:21.199 --> 00:47:21.360
No.
00:47:21.920 --> 00:47:27.760
You're a fellow gamer, I know, so you no stranger to the headphones.
00:47:28.159 --> 00:47:28.400
Mr.
00:47:28.480 --> 00:47:30.079
Jeremy Powers, thanks for joining us.
00:47:30.159 --> 00:47:31.199
Thanks for being here, man.
00:47:31.360 --> 00:47:38.480
As I mentioned before uh before I get started, um first off, sincerely thank you.
00:47:38.639 --> 00:47:43.679
Um I I'm gonna be very honest right here on on camera.
00:47:43.840 --> 00:47:49.360
Um, I remember starting at Infusion Points, and and I've been here going on eight years now.
00:47:49.599 --> 00:48:00.079
And uh I remember whenever I came into the sock, like looking to you, and you were like this just this superhuman figure in the sock that if you couldn't figure it out, go to Jeremy.
00:48:00.239 --> 00:48:06.880
And uh if if the the regex king over here, this this dude right here could regex in his sleep.
00:48:07.039 --> 00:48:19.360
And uh man, I was just so blown away by the skill set that you possessed and and just how you knew everything and how you helped handle all of our customers and and the inner workings of the sock, but not only on first shift, but then second and third.
00:48:19.440 --> 00:48:25.440
And and I think we've kind of seen that, you know, all those individuals look up to you, as Alex mentioned, right?
00:48:25.519 --> 00:48:27.679
He he reached out to you when he came on.
00:48:27.840 --> 00:48:39.039
And um yeah, I mean, so so honestly, for for my career, thank you, because I remember coming in and having long conversations with you, and man, just what you told me here at Infusion Points really, really helped me.
00:48:39.119 --> 00:48:45.199
And so, yeah, it's cool to be able to talk with you and have you on because you've been here for 10 years.
00:48:45.360 --> 00:48:47.360
So let's jump right in, man.
00:48:47.760 --> 00:48:54.960
What did Infusion Points look like 10 years ago when you came on and we were first standing up the Security Operations Center?
00:48:55.440 --> 00:49:04.320
Uh I mean, it was brand new, so it was uh it was a big change for me too, because my background I'd came from just general IT.
00:49:04.480 --> 00:49:04.800
Right.
00:49:05.039 --> 00:49:16.880
I'm an old man, so I had just a general uh computer science degree and was doing just IT and admin and stuff for a corporation that made car parts.
00:49:17.199 --> 00:49:22.400
And they moved out of the country, so it gave me the opportunity to go back to school.
00:49:23.360 --> 00:49:25.840
I went back to school, went into networking.
00:49:26.079 --> 00:49:28.400
Uh at the time, as I said, I'm an old man.
00:49:28.480 --> 00:49:37.760
There was no cybersecurity degree at that point, so I went into the night networking and took the cyber classes and got the certifications that I could.
00:49:37.920 --> 00:49:38.159
Right.
00:49:38.480 --> 00:49:44.239
And uh like Alex, uh I had the same as Randy over at the college.
00:49:44.320 --> 00:49:54.800
And uh I don't know how he got hooked up with uh infusion points, but they set up some sort of program or something and uh brought us over here, and uh that's how I got involved.
00:49:54.880 --> 00:49:57.280
And like I said, it was just being started.
00:49:57.760 --> 00:50:08.000
Uh I think I remember my first day that I started here, they were actually building a capture the flag rig to take to uh a competition.
00:50:08.239 --> 00:50:08.559
Yeah.
00:50:08.800 --> 00:50:10.800
Yeah, that I remember the capture the flag rig.
00:50:10.880 --> 00:50:21.840
That thing sat actually almost in our podcast room whenever I came on board, which has been converted into new construction and into our podcast room, but that thing actually used to be back here in this area.
00:50:22.079 --> 00:50:24.239
Um, so it was just being stood up.
00:50:24.400 --> 00:50:30.239
How many at that point, how many employees, how many customers did we have uh within the SOC, that is?
00:50:30.559 --> 00:50:38.800
I I mean think it was just one customer when I started, maybe two when I started, and then they was in the SOC counting me three people.
00:50:39.039 --> 00:50:39.199
Okay.
00:50:39.360 --> 00:50:51.840
Yeah, and that tracks because for those of you that don't know the history of the Security Operations Center, it was stood up to meet a need of one of our customers and uh really just took on a life of its own at that point, right?
00:50:51.920 --> 00:50:56.559
It's like, hey, this is a service we can continue on, um, and a needed service.
00:50:56.719 --> 00:51:05.360
But but as you're mentioning as well, like cybersecurity was kind of a it wasn't a new thing, but it was a it was a new thing, if that's uh an okay way to say it.
00:51:05.519 --> 00:51:14.079
I mean, uh yeah, people knew they needed security, uh, but I don't necessarily people knew to what level they needed security at that point.
00:51:14.159 --> 00:51:20.800
And so, so yeah, it was it was kind of new um and you know continued to grow from there.
00:51:20.960 --> 00:51:27.280
So so talk to me about kind of the day-to-day uh when you came in and when you were, you know, 10 years ago.
00:51:27.440 --> 00:51:31.440
What what were you doing 10 years ago uh for those customers?
00:51:32.400 --> 00:51:44.000
Uh it was still a lot of the same stuff, but it was just it has changed tremendously, but uh it was still just uh seam and protecting their network, uh the same kind of things.
00:51:44.239 --> 00:51:46.239
Uh it's just evolved.
00:51:46.320 --> 00:51:49.679
Like I said, when we first got here, they was way less people.
00:51:49.760 --> 00:51:50.960
We've grew tremendously.
00:51:51.039 --> 00:51:53.920
I I mean it's amazing how much we've grew in 10 years.
00:51:54.000 --> 00:52:05.440
And just I was watching, I I cheated and sat in and watched Alex's interview, so I heard him, but the same thing at what he said, I'll reflect on that, is in the last five years, the change.
00:52:05.519 --> 00:52:06.880
I mean, it's it's crazy.
00:52:07.199 --> 00:52:09.599
Yeah, but at the beginning it was slow.
00:52:09.760 --> 00:52:14.639
Uh it's a lot I was learning, I was going from a job, you know, changing jobs.
00:52:14.719 --> 00:52:20.559
I was still in uh you know, IT computer type things, but uh cybersecurity was a lot different.
00:52:22.320 --> 00:52:30.079
Uh also with cybersecurity, or at least here, you wear a lot of different hats, and so you never know what's gonna happen from day to day.
00:52:30.159 --> 00:52:32.880
So it's it's exciting, and that's what drawled me to it.
00:52:32.960 --> 00:52:38.239
I really like the job because uh it's not a job where you're gonna get stuck in a rut.
00:52:38.400 --> 00:52:47.360
You're not gonna be like, man, I don't want to get out of bed tomorrow and go to work because you know I gotta do the same old thing every day, every day.
00:52:47.519 --> 00:52:50.559
Like it's uh you're constantly learning.
00:52:50.639 --> 00:52:52.000
So it was exciting.
00:52:52.079 --> 00:52:53.199
That's how I would describe it.
00:52:53.360 --> 00:52:53.840
Exciting.
00:52:54.000 --> 00:52:54.239
Yeah.
00:52:54.400 --> 00:53:00.000
I mean, uh, especially in its infamacy growing up uh and and growing that that service line.
00:53:00.079 --> 00:53:06.480
But even today, you know, I've I've used the word as as we've been on the podcast here that uh some of the shifts, there can be some mundane tasks.
00:53:06.559 --> 00:53:12.320
And there are certain things that have to continually be done for our customers, but you never know what the next alert's gonna hold.
00:53:12.400 --> 00:53:17.440
You never know uh it's it's for individuals that really like putting puzzles together, right?
00:53:17.519 --> 00:53:18.719
I mean, that's a lot of what it is.
00:53:18.800 --> 00:53:21.840
It's it's doing the reverse engineering and figure out what's going on, right?
00:53:21.920 --> 00:53:24.320
Is this malicious when it comes to securing our customers?
00:53:24.480 --> 00:53:31.440
So yeah, it's it's cool to hear that that was uh kind of the case even back then, uh, when you're coming up.
00:53:31.519 --> 00:53:37.599
And so talking on that, you touched on the growth a little bit and the growth that we've seen over the last five years.
00:53:37.679 --> 00:53:55.840
What do you think um in your your eyes, uh speaking specifically to the security operations center here, what's been the moment that you're like, oh wow, like we've hit a whole new level now when it comes to growth uh in your in your eyes uh through the 10 years of of the security operations center?
00:53:56.239 --> 00:53:58.000
I don't know that there's one moment.
00:53:58.079 --> 00:54:00.400
There's a couple or a few.
00:54:00.639 --> 00:54:00.960
Okay.
00:54:01.199 --> 00:54:08.719
Uh I would say the first big change here would be about eight years ago when you came on.
00:54:08.880 --> 00:54:11.920
Oh and uh hope that was a change in a good direction.
00:54:12.079 --> 00:54:13.920
Yeah, it was a change in a good direction.
00:54:14.239 --> 00:54:19.119
But I would have say that was the first big change in how operations went here.
00:54:19.280 --> 00:54:26.639
Uh you came in and added a lot to it, uh organized the site quite a bit, uh, added structure.
00:54:26.880 --> 00:54:41.599
Well, and then I would say the second biggest change is the about whenever the huge shift to the moving to the cloud and all that happened, and then uh I mean you can't I couldn't answer this without mentioning AI.
00:54:41.679 --> 00:54:45.199
I mean, AI's changed the world, so yeah, no doubt, no doubt.
00:54:45.440 --> 00:54:46.960
It's isn't it crazy?
00:54:47.119 --> 00:54:51.119
So, like I I'll go back and touch on uh your your answers there.
00:54:51.280 --> 00:54:52.480
Number one, thank you.
00:54:52.639 --> 00:54:53.920
Uh I appreciate that.
00:54:54.079 --> 00:55:04.400
I mean, uh me coming in and and any of the changes that were made was only possible because of the group of individuals and the team that we had in the SOC and you being part of that team.
00:55:04.480 --> 00:55:11.039
Again, I told you, man, looking to you for the answers, like, hey, I can say something, but Jeremy, is that did I say the right thing?
00:55:11.119 --> 00:55:13.119
And and is that the right direction we should be going?
00:55:13.199 --> 00:55:17.760
And so definitely leaning on you um and those those group of guys that are back there, man.
00:55:17.920 --> 00:55:20.559
Uh, you guys are the ones that have made it all possible.
00:55:20.800 --> 00:55:33.280
Um, the cloud shift, man, that was that was huge for us because I remember what you you guys were deploying like VM boxes for on-prem uh to pick up traffic and stuff like that, and and for the monitoring there.
00:55:33.440 --> 00:55:35.039
But cloud changed everything.
00:55:35.119 --> 00:55:38.320
It allows it allowed us to move so much faster, I think.
00:55:38.559 --> 00:55:46.800
Um, and just in deployments and really just our sophistication of our capabilities.
00:55:47.039 --> 00:55:59.119
Um and I think it opened up a different customer set too that we were able to kind of uh monitor for, you know, uh, don't get me wrong, we still have some customers that are have some on-prem solutions and things of that nature.
00:55:59.360 --> 00:56:05.760
But um really by and large, you know, especially for the federal customers, uh cloud is kind of where where they live right now.
00:56:05.920 --> 00:56:10.800
And then you're mentioning AI, which I absolutely love because I will echo that as well.
00:56:11.039 --> 00:56:15.280
AI almost feels like to me, and you've heard people compare it out there to like the internet age, right?
00:56:15.360 --> 00:56:20.079
When the internet came about, it has just significantly changed the way that things operate.
00:56:20.320 --> 00:56:22.079
So so touch on that.
00:56:22.239 --> 00:56:24.960
Let's uh let's let's have a little fun here then.
00:56:25.280 --> 00:56:31.519
Let's go back 10 years ago and let's think of a simple task that Jeremy Powers was having to do.
00:56:31.760 --> 00:56:36.559
And now talk to me about 10 years later, how you're completing that task.
00:56:36.800 --> 00:56:41.280
Well, I will just say that 10 years later, then it has become a simple task.
00:56:41.599 --> 00:56:42.400
So there you go.
00:56:42.480 --> 00:56:42.800
Yeah.
00:56:43.119 --> 00:56:53.360
But uh yeah, I would say just what you commented on earlier, and I because I do that a lot, I do a lot of regex, uh, just parsing of raw logs and things like that.
00:56:53.599 --> 00:57:13.039
And uh if anybody has ever looked at the amount of logs that come in from like we'll just say a firewall, and then trying to parse all that, it can take uh depending on the uh the firewall and then how thorough you want it, it could take uh days, weeks to parse all that.
00:57:13.119 --> 00:57:21.039
And and now I've gotten it to where I can, with the help of AI, parse out stuff in under a day and have a whole firewall knocked out.
00:57:21.280 --> 00:57:21.519
Yeah.
00:57:21.760 --> 00:57:27.679
I mean, it it's that in itself, like just such a simple example, but man, the time savings.
00:57:27.760 --> 00:57:33.440
Like I I remember watching you, you know, we would bring on different customers, and it's all right, well, here's this new flavor of firewall.
00:57:33.519 --> 00:57:43.599
And, you know, okay, there's no parsing rules out there readily available, so it looks like we're gonna be doing this the manual way and working with them uh to get everything parsed out or working with yourself to get everything parsed out.
00:57:43.679 --> 00:57:56.159
And now uh I I've seen you, you're like, oh yeah, I've got that firewall, but I've got an entire catalog built as well of all these other solutions uh thanks to AI that's uh we can leverage uh in parsing these logs out.
00:57:56.320 --> 00:58:00.559
Um what do you think about when it comes to like investigating threats and stuff?
00:58:00.719 --> 00:58:03.360
Like again, 10 years ago, how how was that happening?
00:58:03.599 --> 00:58:06.239
And then now how's that happening and how is it a quicker?
00:58:06.480 --> 00:58:08.960
I'm assuming we're gonna be pretty much the same answer here, right?
00:58:09.039 --> 00:58:21.920
It's gonna be a manual piece, but now leveraging AI and and maybe even let's let's touch on uh the team a little bit from there as well, because I do feel like there's been more sophistication throughout the years, right?
00:58:22.079 --> 00:58:25.840
As we've been able to grow more sophistication within our team.
00:58:25.920 --> 00:58:27.840
And so I think they handle things a little bit differently.
00:58:27.920 --> 00:58:32.239
But what's your your mindset on that as far as how we're doing threat investigation now?
00:58:32.559 --> 00:58:34.639
Yeah, I echo a lot of the same things.
00:58:34.719 --> 00:58:37.119
I I think the team we got back there is excellent.
00:58:37.280 --> 00:58:47.199
And I mean, it doesn't matter how good AI is if if you feed it something into it, they the team back there still has to look at it and be like, okay, yeah, this is not nonsense.
00:58:47.679 --> 00:58:48.400
Right, yeah, exactly.
00:58:48.639 --> 00:59:01.760
But uh yeah, that I think the teams grew good, but with the help of AI and everyone just growing in knowledge and you know, more people uh infusion points as a whole, it's just become easier.
00:59:02.000 --> 00:59:04.159
Yeah, yeah, I I would agree with that.
00:59:04.400 --> 00:59:18.960
The growth of the company overall, and and I I believe I'd be telling it right if I were to say this, you know, the 10 years of the Security Operations Center is one of the things that has allowed, and and we've talked about this throughout the years, that has allowed Infusion Points to grow.
00:59:19.039 --> 00:59:25.119
Because at the end of the day, you know, we have our service where customers come on and and we provide excellent service to them.
00:59:25.199 --> 00:59:28.079
So we keep that that recurring customer set.
00:59:28.239 --> 00:59:43.360
Um, and we continue to grow that recurring customer set, which then allows other service lines here at Infusion Points to uh take risk and do things and uh grow and focus on other areas while we take care of the uh the security side of the house.
00:59:43.440 --> 00:59:48.320
And again, that's been made possible by by a phenomenal team like like you guys.
00:59:48.480 --> 00:59:52.000
And um, you know, now I think you're on the security engineering team.
00:59:52.159 --> 01:00:04.719
Talk to me about how that looks different, and it may not look so much different for you because you've always kind of been doing the engineering side, but but talk to me about how about how things are a little bit different now from the engineering perspective uh than what they were 10 years ago.
01:00:04.880 --> 01:00:09.199
I mean, like you said, a lot hasn't changed because I'm still doing a lot of the same things.
01:00:09.280 --> 01:00:12.559
And like I touched on earlier, you never know what you're gonna do.
01:00:12.639 --> 01:00:15.679
So you could come in one day and do something totally new.
01:00:15.840 --> 01:00:20.559
So I I would say it's maintained, just being exciting, ever-changing.
01:00:20.800 --> 01:00:30.719
Yeah, that's about I mean, just being on engineering is a little different because you're doing different tasks, you ain't monitoring and stuff, but the background cadence of it, I'd say, is more or less the same for me at least.
01:00:31.039 --> 01:00:31.440
Gotcha.
01:00:31.519 --> 01:00:31.840
Okay.
01:00:32.239 --> 01:00:34.480
That's interesting though, but I mean, you know, the tooling.
01:00:34.960 --> 01:00:35.280
Oh, yeah.
01:00:35.360 --> 01:00:39.280
Well, the tooling, I mean, the whole field, everything around me has changed.
01:00:39.360 --> 01:00:39.599
Yeah.
01:00:39.840 --> 01:00:40.079
Yeah.
01:00:40.239 --> 01:00:42.880
Yeah, everything that's changed dramatically.
01:00:42.960 --> 01:00:44.960
That changes with AI week to week.
01:00:45.039 --> 01:00:45.760
You never know.
01:00:46.000 --> 01:00:49.679
You never know what's gonna advance there, but for sure.
01:00:50.079 --> 01:00:52.880
So, all right, let's get into some fun stuff here.
01:00:53.039 --> 01:01:04.880
Um, I've asked a few guys that's been involved with the SOC for uh an extended period of time uh some of these same questions, but uh you're you're unique because you've been here all 10 years of the Security Operations Center.
01:01:05.119 --> 01:01:08.559
And so, you know, I'm sure that there's gotta be some stories.
01:01:08.800 --> 01:01:15.920
Tell me about maybe the worst day as a security operations analyst engineer or or part of the security operations center.
01:01:16.000 --> 01:01:18.960
Like what's what's one of the worst days?
01:01:19.039 --> 01:01:25.840
Uh, and it could be from anything from an attack perspective uh or things being down, or what just what is it?
01:01:25.920 --> 01:01:28.559
Like what was one of the things that's kind of memorable in your mind?
01:01:28.800 --> 01:01:29.920
Uh I'll say memorable.
01:01:30.000 --> 01:01:32.239
I don't know that I would class it as worst.
01:01:32.480 --> 01:01:36.960
I mean, it was bad for for the world, but I would say it was the crowd strike event.
01:01:37.360 --> 01:01:39.360
Oh man, I yeah.
01:01:40.000 --> 01:01:42.000
Oh, God, I remember getting that call.
01:01:42.159 --> 01:01:43.360
You called me.
01:01:43.599 --> 01:01:52.880
Listen, for for our viewers out there, Jeremy Powers has a knack for calling you in the middle of the night and being like, we got a problem.
01:01:53.199 --> 01:01:58.960
And the way he says it, it's like like, oh God, everything's down.
01:01:59.119 --> 01:02:00.159
Like, this is terrible.
01:02:00.320 --> 01:02:03.039
And Jeremy's like, this is bad, bad.
01:02:03.199 --> 01:02:05.679
And and and immediately I'm awake, like, what's going on?
01:02:05.760 --> 01:02:10.159
I'm like, all right, look, dude, let me call you back in like five minutes, get me, get my wits about me here.
01:02:10.480 --> 01:02:15.360
And I remember going into the living room at that point, turning the TV on, and the news was up.
01:02:15.440 --> 01:02:18.079
And I'm like, it's nothing going on right now.
01:02:18.159 --> 01:02:19.039
And it's like breaking news.
01:02:19.119 --> 01:02:20.639
And it's like airports are shut down.
01:02:20.719 --> 01:02:23.760
I'm like, why is an airport in Australia shut down?
01:02:24.000 --> 01:02:27.199
And then Jeremy's like still messaging me, everything's down.
01:02:27.360 --> 01:02:29.599
And then I'm seeing like banking systems are down.
01:02:29.679 --> 01:02:32.320
And I'm like, what is going on?
01:02:32.719 --> 01:02:36.239
And so I called Jeremy up and I'm like, all right, explain to me what's going on.
01:02:36.320 --> 01:02:38.320
He's like, every customer we got, every customer's down.
01:02:38.400 --> 01:02:38.800
They're down.
01:02:38.960 --> 01:02:40.639
It's like, what are you talking about?
01:02:40.880 --> 01:02:42.800
Like, man, like look, we got to slow down.
01:02:42.880 --> 01:02:44.320
Are we sure it's every customer?
01:02:44.480 --> 01:02:46.320
Well, pretty much almost every customer.
01:02:46.480 --> 01:02:53.039
If they're using, you know, this customer set is down and whatnot, and we're reading stuff about everybody going down.
01:02:53.199 --> 01:02:59.119
So the first thing in my mind when you call me, I'm like, all right, which foreign nation state is up right now?
01:02:59.440 --> 01:03:03.440
Because they're probably responsible for what's going on in the world.
01:03:03.679 --> 01:03:10.159
Um, and I remember like it was like, okay, hey, look, all hands on deck in the security operations center, meet me there in, you know, 20, 30 minutes.
01:03:10.239 --> 01:03:12.880
And you live fairly close, so you're here pretty quickly.
01:03:13.039 --> 01:03:18.000
But uh man, it took us a long time to get our head about us and figure out what in the crap was going on with that.
01:03:18.159 --> 01:03:27.760
Um, there's a lot more we could go into on detail in that whole situation, and I'm sure our viewers out there have read about it, but there was really not a whole lot of notification that went out about what happened.
01:03:28.000 --> 01:03:36.800
But uh then when we finally realized, okay, hey, look, uh this is this is not our our it's not our issue, if you will.
01:03:36.960 --> 01:03:41.760
Uh it is our issue, but a lot of folks were making knee-jerk reactions.
01:03:41.920 --> 01:03:42.320
You remember that?
01:03:42.400 --> 01:03:47.840
Like we had we had people that were already starting to re rebuild machines, not here at infusion points, but customer sets that were calling in.
01:03:47.920 --> 01:03:51.119
It was like, we're already starting to rebuild servers, and it's like, whoa, whoa, wait a minute, wait a minute.
01:03:51.199 --> 01:03:53.840
Like, calm down, let's figure out what's going on here.
01:03:54.000 --> 01:03:59.920
And then lo and behold, once CrowdStrike released what was going on, things just started miraculously fixing themselves.
01:04:00.000 --> 01:04:01.519
And that took a period of time.
01:04:01.679 --> 01:04:04.639
Uh, but yeah, that was pretty memorable.
01:04:04.800 --> 01:04:12.400
There's nothing gonna be more memorable in that than getting that phone call and Jeremy saying, This is bad, this is real bad.
01:04:12.719 --> 01:04:22.320
The reason I also initially said that I wouldn't classify it as worst or bad, yeah, is because that also demonstrated how excellent we are.
01:04:22.559 --> 01:04:23.760
Oh, I like that.
01:04:24.159 --> 01:04:31.679
I will say that because pretty much uh without warning, the world was took down.
01:04:31.840 --> 01:04:32.079
Right.
01:04:32.239 --> 01:04:37.119
I believe it was like around one o'clock, if my old man brain serves me correct.
01:04:37.920 --> 01:04:45.280
And uh one of the analysts called me, and at my house I have a whole station, like a mini sock set up.
01:04:45.440 --> 01:04:48.079
I stay logged in 24-7.
01:04:48.639 --> 01:04:51.360
And as soon as he called me, I was dead asleep.
01:04:51.519 --> 01:05:05.679
I woke up, went in there and looked, and I saw actually saw CrowdStrike hit my computer because right when I was looking at it, it was in the process of that rebooting, and then it came up to the the blue screen of what we was good.
01:05:06.480 --> 01:05:11.599
So I was like, as soon as I seen that, I was just like, I'm good.
01:05:11.760 --> 01:05:14.639
I'm just I just went and got my truck and came to work.
01:05:15.440 --> 01:05:18.239
And then when we got here, it escalated quickly.
01:05:18.320 --> 01:05:44.559
Yeah, but by the time I got a hold of you, I think I called uh Gary and Jason and uh Mike, and then to see everybody like trickle in and how the team we stood up like a Teams call and how just all of infusion points by the end within like a couple of hours, I'd say by 2 30, uh 30 40% of the company was in here working in the middle of the night for that.
01:05:44.719 --> 01:05:45.519
So it was amazed.
01:05:45.840 --> 01:05:52.239
It was, it was an all hands, uh even for our remote folks, we had a a teams call stood up and everybody was up.
01:05:52.480 --> 01:05:59.599
Everybody, uh whether they were impacted or not, whether they were customer facing, uh, you know, we even had kind of marketing and PR.
01:06:00.239 --> 01:06:06.000
Up as well because again, there's a lot that goes into things like that, then other than just get systems back up, right?
01:06:06.239 --> 01:06:08.480
There's a whole communication chain that has to happen.
01:06:08.559 --> 01:06:11.920
Uh incident response plans are activated, contingency plans are activated.
01:06:12.000 --> 01:06:15.840
So yeah, there's a lot of moving parts that were activated during that.
01:06:15.920 --> 01:06:20.079
And so yeah, I would say that would be a day that would go down in infamy.
01:06:20.159 --> 01:06:24.320
I know that uh there's a lot of folks that's would attest to that as well.
01:06:24.480 --> 01:06:29.760
Uh that was uh that was a scary one because again, we didn't just didn't know what was going on at first.
01:06:30.000 --> 01:06:37.679
Um and I was like, man, well, this is this is interesting, especially coming from my background where I've dealt in a large cybersecurity attack before.
01:06:37.840 --> 01:06:43.760
Uh and then seeing it on a global level, it's like, oh wow, this is my mind immediately goes to the worst.
01:06:43.920 --> 01:06:45.119
You know, the airports are down.
01:06:45.280 --> 01:06:47.199
It's like my mind goes to the worst.
01:06:47.280 --> 01:06:51.920
When I seen my computer hit that blue screen, I didn't think world catastrophe at that point in time.
01:06:52.000 --> 01:06:53.840
I was like, oh no, what's happening to us?
01:06:53.920 --> 01:06:56.559
You know, this is not good.
01:06:56.719 --> 01:06:57.679
Yeah, yeah.
01:06:57.920 --> 01:07:00.639
But uh yeah, I would say that would that would live.
01:07:00.800 --> 01:07:01.760
Um, all right.
01:07:01.840 --> 01:07:02.719
Well, how about this?
01:07:02.960 --> 01:07:03.679
Best day?
01:07:03.840 --> 01:07:04.800
Anything stands out?
01:07:04.960 --> 01:07:12.559
Well, like I said, I I could use that day again, like just how we came together and did that, but uh best day, I'd have to think on that one.
01:07:12.800 --> 01:07:13.039
Okay.
01:07:13.119 --> 01:07:13.840
Well, and that's fine.
01:07:13.920 --> 01:07:17.760
We'll I mean there's no I mean it's it's not because I can't pick it.
01:07:17.840 --> 01:07:21.119
There's I'll go back to being an old man.
01:07:21.280 --> 01:07:28.559
I've had not had a whole lot of jobs because I'm pretty loyal and I've I've stayed at the places I've worked at, but I've never worked anywhere like this.
01:07:28.639 --> 01:07:34.960
And I wouldn't class, I mean, you're gonna have bad days, but it's not like working anywhere else.
01:07:35.119 --> 01:07:38.079
There's no day that you're just like, man, this is bad.
01:07:38.239 --> 01:07:39.440
So like they're all good.
01:07:39.599 --> 01:07:53.840
Like, yeah, I can't think of like a day that like really stands out other than it's just observing how uh to me that that impresses me the most is when I see the whole infusion points as a whole come together and you get to see every part move.
01:07:53.920 --> 01:07:58.000
Like I I'll go back to the CrowdStrike thing because that it thoroughly impressed me.
01:07:58.239 --> 01:08:02.320
Yeah, you know, I I think that in itself says enough.
01:08:02.480 --> 01:08:24.560
Um I think we had I I don't know at the time how many customers we had, but for that to be a world event happened point blank, nobody knew what even what was going on, and by eight o'clock the next morning, every one of our customers had an email, was almost all of them was resolved by that point in time because we'd got that windows fixed, right?
01:08:24.640 --> 01:08:27.359
And had been displayed, uh pushing that out too.
01:08:27.439 --> 01:08:30.640
And and to see that, uh, I mean, that's amazing.
01:08:30.720 --> 01:08:34.640
That just proves how uh top of the game we are.
01:08:34.880 --> 01:08:35.680
Awesome.
01:08:35.920 --> 01:08:46.319
Yeah, I mean, um, the fact that you can't come up with a single best day, other I mean, obviously that was an impressive event, but it it's almost like every day is the best day, if you will.
01:08:46.560 --> 01:09:01.760
Uh I I know you and I, we we both have told uh a lot of the new folks that come on, and and even when we when we have tours and stuff here at the Security Operations Center, uh we talk about the fact that there's I've never worked for an organization like Infusion Points, and so I'm proud to say that.
01:09:01.840 --> 01:09:07.760
Uh I've worked for other organizations, and and unfortunately you're you're almost treated just like a number.
01:09:07.920 --> 01:09:12.560
Uh whereas here at Infusion Points, you know, they give the ability to spread your wings and grow.
01:09:12.640 --> 01:09:19.199
Uh, but also that they, you know, they give you the responsibility to help grow the business and you take ownership and pride in that as well.
01:09:19.279 --> 01:09:23.279
And so I think that in itself is probably a great way to kind of close this down.
01:09:23.439 --> 01:09:31.039
Throughout the 10 years of the Security Operations Center, the one thing that I think that I'm hearing everybody say is just is growth, right?
01:09:31.279 --> 01:09:35.359
Uh it's not stayed stagnant, it's not stayed the same old service.
01:09:35.520 --> 01:09:36.479
It's it's been growth.
01:09:36.560 --> 01:09:42.800
It's not only been growth in our services, but growth in our people, growth in our sophistication.
01:09:42.960 --> 01:09:47.119
By and large, uh it's growth in our commitment to our customers as well.
01:09:47.279 --> 01:09:52.560
For these 10 years, I mean, I I I can tell you, I I've been serving in eight of them.
01:09:52.720 --> 01:09:55.279
And uh man, I I couldn't be more proud.
01:09:55.439 --> 01:10:05.840
And Jeremy, you've been here for all 10 years of the Security Operations Center, and I won't speak for you on that, but uh I can personally say that I'm I'm I'm proud to be here for the eight years that I've been here.
01:10:05.920 --> 01:10:07.119
So oh definitely.
01:10:07.199 --> 01:10:10.960
I we every time we have a tour, if I'm in here, you can ask Gary.
01:10:11.039 --> 01:10:16.159
He he likes to uh call on me because he knows I've got to say it, but it's the best job I've ever had.
01:10:16.239 --> 01:10:18.720
I've never, never worked for any place like this.
01:10:18.960 --> 01:10:19.520
I love it.
01:10:19.760 --> 01:10:23.199
Jeremy, I appreciate you taking some time out and and getting behind the camera.
01:10:23.279 --> 01:10:24.159
We very rarely get Mr.
01:10:24.239 --> 01:10:30.000
Jeremy Powers behind the camera here at Infusion Points, and we may have to do it more often for myself and for Mr.
01:10:30.079 --> 01:10:31.199
Jeremy Powers here.
01:10:31.279 --> 01:10:34.079
Uh, I will catch you on the next episode of Behind the Shield.
01:10:34.720 --> 01:10:35.119
Thank you.