Full Transcript for Still Getting Cloud Wrong. Here’s what to Fix. With Simon Vernon

criminal forums with people figuring out, you know, exploits and vulnerabilities and malware, and well, one thing led to another. 00:03:43.680 --> 00:03:47.680 Just pointing out this is an international podcast, but there's no statute of limitations in this country. 00:03:47.759 --> 00:03:50.240 Now you're probably wondering why I'm asking you all of this. 00:03:50.960 --> 00:03:51.599 I I am. 00:03:51.680 --> 00:03:51.919 Yeah. 00:03:52.000 --> 00:03:53.199 What's with the random questions? 00:03:53.280 --> 00:03:54.800 Isn't it supposed to be about the guests? 00:03:55.039 --> 00:03:55.360 It is. 00:03:55.520 --> 00:04:12.560 Well, this is about the guests, because I know I'm being incomprehensible even by my normal standards, but I'm going to bet that at least one of our listeners, one of their listeners who isn't listening under duress because they're in prison or there's some court order that mandates they have to do this as punishment, they have had their massive geekdom enhanced by dealing with today's guest. 00:04:12.879 --> 00:04:26.720 Because not only has he designed some of Sans's most important and successful courses, he's pioneered and run some of the most celebrated Sans experiences, those capture the flag and other hands-on practical exercises that are continuing to produce the new generation of James lines. 00:04:26.879 --> 00:04:32.480 Now that may be a prospect with fill you with joy, or maybe fill you with horror, but I leave that to you, dear listener. 00:04:32.800 --> 00:04:34.000 Why choose Kieran? 00:04:34.160 --> 00:04:37.279 Why not joy and horror simultaneously? 00:04:37.439 --> 00:04:38.319 But yeah, you're right. 00:04:38.399 --> 00:04:40.240 And yes, this is where it all comes together. 00:04:40.399 --> 00:04:41.519 I see your plan now. 00:04:41.680 --> 00:04:59.279 If you've ever been to Cyber Threat, that's our brilliant threat conference that we run every year in London for hands-on geekery of the highest order, or at all sorts of different events, frankly, you will have felt and lived the buzz of some of the greatest cybersecurity experiences on earth, but at least the legal ones per our introduction. 00:04:59.439 --> 00:05:02.879 And we're going to be discussing this further with our incredible guest today. 00:05:03.040 --> 00:05:05.680 And of course, much more of the podcast goes to standard recipe. 00:05:05.839 --> 00:05:06.319 And length. 00:05:06.560 --> 00:05:09.519 Because today we're joined by a true great. 00:05:09.759 --> 00:05:30.959 The man who not only develops designs and runs all these incredible exercises that lets budding hackers, reverse engineers, malware analysts, and more practice hands-on, but also teaches three of Sans' most important courses, all on cloud security, on which he is a deep expert, a world-renowned practitioner. 00:05:31.120 --> 00:05:45.920 And somehow, in between that, he finds time as well to be the chief security officer for a data center company, a board member, an advisor to some nonprofits, and a highly skilled recreational auto mechanic, perhaps reflecting some of his earlier pre-cyber career in Land Rover. 00:05:46.079 --> 00:05:48.399 Starting to make me feel quite incompetent here, Kieran. 00:05:48.560 --> 00:05:54.399 He's been lauded by leaders all over the world, and he's won as well as written a lot of cyber competitions. 00:05:54.560 --> 00:05:57.120 And to be clear, the ones he won are not the ones he wrote. 00:05:57.279 --> 00:06:02.160 He is the director of research and development of the Sands Institute, the legendary Simon Vernon. 00:06:02.319 --> 00:06:03.040 Welcome, Simon. 00:06:03.120 --> 00:06:04.319 Thank you for coming onto the show. 00:06:04.639 --> 00:06:05.600 Thank you for having me. 00:06:05.759 --> 00:06:06.560 Much appreciated. 00:06:06.800 --> 00:06:07.920 We are delighted to have you. 00:06:08.079 --> 00:06:13.600 Now, in that record-length introduction, for which we apologize, hopefully some of it was at least deservedly flattering. 00:06:13.680 --> 00:06:20.399 Uh, when James wasn't inciting young people to cybercrime, he was talking about the way in which you develop all sorts of talent. 00:06:20.560 --> 00:06:22.399 But I want to talk about how you developed your own skills. 00:06:22.560 --> 00:06:24.079 So we asked everybody this question. 00:06:24.240 --> 00:06:26.319 So you've been with Sans for about eight years. 00:06:26.399 --> 00:06:28.399 There's a whole community of fans of yours out there. 00:06:28.480 --> 00:06:32.879 They've been through your Capture the Flag exercises and or they've been on your cloud security courses. 00:06:32.959 --> 00:06:35.360 But they may not know a great deal about your earlier career. 00:06:35.600 --> 00:06:40.480 Maybe, like me, not much is known about it because according to James, I was born before records began. 00:06:40.560 --> 00:06:45.040 But in your case, how did you get into this whole business and how did you end up where you are now? 00:06:45.199 --> 00:06:48.480 Well, I'm not that much younger than you, so it's quite a long story. 00:06:48.720 --> 00:06:49.199 Go for it. 00:06:49.279 --> 00:06:51.120 Um but I will keep it relatively brief. 00:06:51.360 --> 00:06:53.519 That'll be a first in this podcast, but go ahead. 00:06:53.839 --> 00:06:58.959 I also had uh rather a mischievous edge to me, especially uh in my younger years. 00:06:59.199 --> 00:07:02.319 My first ever computer, I think, was in the late 1980s. 00:07:02.399 --> 00:07:02.639 Wow. 00:07:02.720 --> 00:07:05.839 It had a rubberized keyboard and a tape player attached to it. 00:07:06.319 --> 00:07:12.399 As part of the learning process of that, I spent an entire day writing this huge amount of code. 00:07:12.560 --> 00:07:14.639 I can't even remember what language it was in. 00:07:14.720 --> 00:07:20.560 And then when I executed it, a man ran up a pyramid and then down the other side, and then the program finished. 00:07:20.800 --> 00:07:21.439 And that was

it. 00:07:21.600 --> 00:07:25.680 And to me, that seemed like a colossal waste of time and energy. 00:07:25.839 --> 00:07:33.279 But he did teach me a lot of things that meant I could then explore and work out what these, you know, newfangled devices could do. 00:07:33.519 --> 00:07:38.399 I also had an exceptional teacher at my uh first high school, who was a chap called Mr. 00:07:38.560 --> 00:07:46.160 Ferber, um, who I never got the opportunity to thank, but he incited me to push the boundaries of really what was possible at that time. 00:07:46.560 --> 00:07:54.639 He got me into things like BBC computers, he got me into electronics, and that really carried forwards everything that I did from that point onwards. 00:07:54.720 --> 00:08:00.240 So from about the age of 12, 13, if we had anything electronic in the house, it came to bits. 00:08:00.399 --> 00:08:03.040 By the time I was 14, most of it went back together. 00:08:03.199 --> 00:08:03.439 Right. 00:08:03.680 --> 00:08:05.040 Sometimes functionally. 00:08:06.639 --> 00:08:09.519 Much to the annoyance of my parents who were very patient. 00:08:09.680 --> 00:08:11.600 Did it ever have new features, Simon? 00:08:12.000 --> 00:08:14.240 Well, I mean, new features, spare parts. 00:08:14.399 --> 00:08:14.800 Yeah. 00:08:14.959 --> 00:08:16.399 And that then continued. 00:08:16.480 --> 00:08:32.159 Now, I did get myself into a little bit of trouble when I got to my second high school, where I had an ongoing battle of the wits with my uh deputy head teacher, who was also the IT operations manager, about who was running the school network. 00:08:32.320 --> 00:08:32.639 Ah. 00:08:32.960 --> 00:08:41.600 And he won, but he kind of cheated because they asked me to not come back to school for a little while to give him the opportunity to bring things back into reality. 00:08:41.759 --> 00:08:45.600 If you'd been American, this would have been a Hollywood high school movie classic. 00:08:45.759 --> 00:08:47.120 It would be in the all-time list. 00:08:47.200 --> 00:08:48.720 Um we've we've missed a trick here. 00:08:48.879 --> 00:08:53.600 It was good fun, and I have recently been invited back to the school to actually help them solve a problem. 00:08:53.759 --> 00:08:59.200 They have some students who were uh playing poker during the lunch break with the parents' credit cards. 00:09:00.240 --> 00:09:00.559 Okay. 00:09:00.879 --> 00:09:02.480 We'll help them lock a few things down. 00:09:02.720 --> 00:09:04.399 Well, this is the sequel to the movie. 00:09:04.639 --> 00:09:07.200 So yeah, I was kind of kept away from computers for a little while. 00:09:07.440 --> 00:09:08.320 Yeah, can imagine. 00:09:08.480 --> 00:09:12.320 And I was basically told that I wasn't allowed to sit around the house all day because that was dangerous. 00:09:12.399 --> 00:09:26.559 And so I had to be out of the house and uh I got myself a job working in a garage, and before I knew it, I was taking electronics apart in cars which were just going through this transition of having very basic electronics to having onboard ECUs. 00:09:26.720 --> 00:09:28.399 And then it just went from there, really. 00:09:28.639 --> 00:09:34.080 About five years later, I discovered that computers hadn't changed in any way. 00:09:34.320 --> 00:09:41.039 I still fully understood exactly what they were doing, and it was an off-chance chap who turned up in a garage who had a computer that didn't work. 00:09:41.200 --> 00:09:48.320 I fixed it for him as well as several other things, and he paid me more money than I'd earned in the entire week in the garage. 00:09:48.480 --> 00:09:48.639 Wow. 00:09:48.960 --> 00:09:54.000 I realized that actually I could probably do this, earn a little bit more money, and be warm in the process. 00:09:54.159 --> 00:09:54.399 Right. 00:09:54.559 --> 00:09:55.200 And that was it. 00:09:55.360 --> 00:09:57.440 But I still have all of my mechanics tools. 00:09:57.519 --> 00:10:05.120 I've got a 35-year-old Land Rover, which I mean, if anybody owns a Land Rover, you'll know if you want to use it, you have to fix it first. 00:10:05.360 --> 00:10:05.519 Right. 00:10:05.679 --> 00:10:07.440 You have no idea what you just offered. 00:10:07.519 --> 00:10:08.320 That was a mistake. 00:10:08.480 --> 00:10:10.399 Just please hang on after we've stopped recording. 00:10:10.639 --> 00:10:19.279 Now, look, we've so much to get through, and we could spend the whole podcast talking about your double career in cyber and tech and computing and in mechanics. 00:10:19.440 --> 00:10:21.519 But I'm gonna go straight to where we are now. 00:10:21.600 --> 00:10:27.360 And James, I'm sure, will ask you some very insightful questions because he's smarter than me about the role of practical learning in cyber and so on. 00:10:27.519 --> 00:10:28.480 But let's dive straight in. 00:10:28.639 --> 00:10:30.480 You and I have worked together last December. 00:10:30.559 --> 00:10:38.240 We were in London at Cyber Threat, and I was essentially a glorified compare saying the next excellent speaker, and they were all excellent, is so-and-so. 00:10:38.480 --> 00:10:44.159 But whilst I was doing that, you were running an incredibly complicated competition for 400 people. 00:10:44.320 --> 00:10:48.559 They were all loving it, they were baffled, frustrated, and joyous in equal measure. 00:10:48.720 --> 00:11:01.679 So I'm trying to research all of this, and I encounter the phrases Jupiter Rockets, Telnet International, Control Shift Delivery, and Operational Meltdown, which sort of reminds me of the name of my brother's sort of record collection of bad heavy metal bands in the 1980s or something like that. 00:11:01.840 --> 00:11:10.080 Now there'll be people here listening who say, I know exactly what all this stuff is, but there are others who might think, well, you know, that was also my brother's 80s record collection. 00:11:10.159 --> 00:11:12.639 So what are these things and why are they called

what they are? 00:11:12.960 --> 00:11:17.679 So these are our CTF ranges that we've been building over the last eight years. 00:11:17.919 --> 00:11:27.039 So go back 10 years, I got invited onto a Sans training experiment for eight weeks where I lived in a hotel, was taught by James. 00:11:27.279 --> 00:11:28.000 Sorry about that. 00:11:28.240 --> 00:11:36.559 And as part of that process, we also did a lot of things like hacking environments, we built systems to attack and defend, we played net wars extensively. 00:11:36.720 --> 00:11:39.919 And one of the things that I took away from that was training is brilliant. 00:11:40.159 --> 00:11:44.559 Training sets the standards and gives you the opportunity to find out things you didn't previously know. 00:11:44.720 --> 00:11:51.679 Whereas the hands-on practical experience is absolutely critical to that learning process because you have to have somewhere to practice. 00:11:51.759 --> 00:12:06.000 And if you go into a SANS course, you will come out with a vast amount of new knowledge, but you've spent an entire week trying to listen to everything that's coming out from the instructor, and you don't necessarily get a massive amount of time to practice. 00:12:06.080 --> 00:12:06.240 Right. 00:12:06.399 --> 00:12:08.799 And it's the practice that makes things real. 00:12:08.960 --> 00:12:16.000 Because the course content that gives you a foundational knowledge that tells you that this kind of vulnerability can be exploited in this way. 00:12:16.080 --> 00:12:22.480 And as James used to tell me, you know, well, it can be exploited in that way, but actually you can also do it in these ways as well. 00:12:22.639 --> 00:12:38.159 I'd have distinct recollection of myself on the Dunning Kruger curve, being sort of the happy and ignorant at the top, and then spending uh three or four days with James before realizing that actually I was in the valley of despair, which is where I've spent most of my cyber career since. 00:12:38.399 --> 00:12:39.919 At least it's wet and warm down there. 00:12:40.240 --> 00:12:45.600 Well, James will have uh much more interesting and insightful follow-up questions, but I just given the story. 00:12:45.679 --> 00:12:48.639 What did you put on James's evaluation form at the end of the course? 00:12:48.879 --> 00:12:49.519 We must know. 00:12:49.759 --> 00:12:50.320 I can't remember. 00:12:50.399 --> 00:12:52.399 I think my brain had actually melted by that point. 00:12:52.559 --> 00:12:53.919 That was Operation Meltdown. 00:12:54.000 --> 00:12:55.840 That was literally Operation Meltdown. 00:12:56.080 --> 00:12:58.320 If I recall, it said something like, make it stop. 00:12:59.679 --> 00:13:02.159 Something about a hot butter through chicken, I believe. 00:13:02.320 --> 00:13:02.960 Ah, yes. 00:13:03.200 --> 00:13:05.519 I actually remember that, even though it was many, many years ago. 00:13:05.600 --> 00:13:15.039 I was talking about a blind return-oriented programming exploit, which um I had misclassified in a hands-on exercise as medium difficulty, much to the amusement of the class. 00:13:15.120 --> 00:13:30.080 And I demonstrated how one would achieve it and use the phrase like a hot chicken through butter, which of course is quite close to what one should say, but a lot more smashy and messy and maybe actually a beautiful metaphor for that particular exploit technique. 00:13:30.240 --> 00:13:38.080 But anyway, look, with Kieran's weird naming obsessions out of the way, tell us a bit more about the practical hands-on things you do. 00:13:38.159 --> 00:13:44.240 So you run these capture the flags and let people train their brains with hands-on skills and work in teams together. 00:13:44.399 --> 00:13:49.519 You've developed an applied skills analysis platform, cool acronym, ASAP, like that. 00:13:49.679 --> 00:13:56.480 And I know firsthand you're really passionate about this stuff and enabling the cybersecurity community to better itself. 00:13:56.639 --> 00:13:58.240 So, how did you get into it? 00:13:58.480 --> 00:14:00.320 Why are you so passionate about it? 00:14:00.399 --> 00:14:01.600 And what's it all about? 00:14:01.759 --> 00:14:04.080 Um, there's a lot of big questions. 00:15:11.490 --> 00:15:12.929 Why do I build CTF? 00:15:13.089 --> 00:15:15.649 Well, again, I have a very distinct learning pattern. 00:15:15.809 --> 00:15:17.569 If I do something, I remember it. 00:15:17.809 --> 00:15:19.889 Other people are really great at reading stuff. 00:15:20.049 --> 00:15:24.289 There's a vast amount of people who can just watch a video and then repeat something from that. 00:15:24.449 --> 00:15:25.169 I'm a doer. 00:15:25.329 --> 00:15:25.649 That's it. 00:15:25.729 --> 00:15:27.250 That's as simple as it comes down to. 00:15:27.409 --> 00:15:36.849 And I believe a lot of people need that hands-on practical experience in order to make a lot of the theory that they're learning and a lot of the academic side of it real. 00:15:37.089 --> 00:15:46.289 So James actually uh recruited me into SANS and then asked me to basically turn some of the original CTF environments into cloud-based platforms. 00:15:46.449 --> 00:15:55.089 And then over the last seven years, we've just run with that and gone beyond where we, I think any of us really imagined what we'd actually be able to do with a CTF. 00:15:55.329 --> 00:16:05.729 With the ASAP platform, we've kind of twisted it and we've actually turned it into an analysis platform that allows us to measure abilities and skills within individuals and with teams. 00:16:05.889 --> 00:16:23.490 So we can actually identify gaps within a SOC team, for example, or an instant response team by challenging them in a CTF environment to solve a whole series of problems in order to be able to then focus their energy on, you know, this is where your gaps are, these is where your, you know, additional training may be required. 00:16:23.649 --> 00:16:25.889 And this is what we'd recommend you do

from there. 00:16:26.049 --> 00:16:31.889 And I think that being able to play in a safe space is absolutely vital, especially in this current climate. 00:16:32.049 --> 00:16:40.289 I received an email a couple of weeks ago from somebody anonymous who invited me to try and break into a system as part of a CTF challenge. 00:16:40.610 --> 00:16:43.969 And when I looked into it, it looked terrifyingly real. 00:16:44.129 --> 00:16:45.889 And I suspect it probably was. 00:16:46.049 --> 00:16:52.689 It was actually somebody trying to incite me to break into something that they wanted access to, which is horrifying. 00:16:52.849 --> 00:17:01.169 But again, with the introduction of AI into security and the fact that the attackers are always at ahead of the curve when it comes to adopting new technology. 00:17:01.329 --> 00:17:12.769 You know, we have got to get people hands-on in safe spaces and being able to defeat the attackers, defend systems, and you know, we give them the opportunity to come across some technologies that they've probably never seen. 00:17:12.930 --> 00:17:13.650 I love that, Simon. 00:17:13.809 --> 00:17:15.009 I think it's so important. 00:17:15.170 --> 00:17:18.450 And two things I draw out of that that I underline personally. 00:17:18.610 --> 00:17:22.769 The first, this this practicing as a team and understanding the gaps. 00:17:23.009 --> 00:17:30.450 It's really easy to look at individuals and their own skill profiles and forget to look at them in macro from a cyber capability perspective. 00:17:30.610 --> 00:17:39.089 And I know a lot of security leaders are now thinking more holistically about that capability and how they want to build it over the coming years, which I think is really important. 00:17:39.250 --> 00:17:41.009 And then there's this second part of it. 00:17:41.170 --> 00:17:46.450 Do you want to practice when it's in production and the cyber criminals are doing it to you? 00:17:46.529 --> 00:17:52.769 Or do you want to practice in theory with patience and calmness and learning outcomes before that happens? 00:17:52.930 --> 00:17:59.730 And it's just such a critical thing to give yourself and your team the time to learn, to fail, to grow. 00:17:59.890 --> 00:18:02.210 And that's what these types of activities are really about. 00:18:02.370 --> 00:18:03.970 Sorry, Kieran, I'm in your way of a question. 00:18:04.370 --> 00:18:13.250 No, let me jump in there because when Simon said very powerfully and genuinely something I'll remember, that you personally learned something by doing it rather than say reading about it. 00:18:13.410 --> 00:18:16.130 I've jolted back in my chair because I had two reactions. 00:18:16.289 --> 00:18:21.490 One was reconsideration of life choices, given that I spend most of my time teaching in an ancient university. 00:18:21.650 --> 00:18:28.529 And number two, I'm guessing that this is one of the reasons because you do a lot of these exercises, a lot of this practical hands-on learning in

the community. 00:18:28.690 --> 00:18:31.730 You do a lot of it for free and you organize it where people don't have to pay. 00:18:31.810 --> 00:18:32.610 That's a very good thing. 00:18:32.769 --> 00:18:36.690 And I'm guessing you're trying to get people involved who wouldn't normally have the chance to show their potential. 00:18:36.930 --> 00:18:43.730 So a lot of organizations try to do stuff in the community, you know, they try to be good corporate citizens, but actually it's quite hard to have an impact. 00:18:43.890 --> 00:18:50.370 It does feel like you've managed to build a community of people who have been through these processes of stayed in the industry, have stayed in some form of the community. 00:18:50.450 --> 00:18:52.370 So, can you tell us a bit about the community aspect of this? 00:18:52.450 --> 00:18:53.170 How did you get started? 00:18:53.250 --> 00:18:53.810 How does it work? 00:18:53.890 --> 00:18:55.330 What are your hopes for it in the future? 00:18:55.570 --> 00:18:59.410 This was a bit of a crash course during the early days of COVID, actually. 00:18:59.570 --> 00:19:06.690 It was discussions with Sans, with James, that we really needed to keep the community together and to keep people communicating. 00:19:06.930 --> 00:19:11.330 Now, traditionally, cybersecurity people aren't necessarily brilliant at doing this. 00:19:11.490 --> 00:19:18.850 So we wanted to create an environment where people could come, they could share information, they could chat about the games or challenges. 00:19:19.009 --> 00:19:21.410 We could bring the people together to be able to talk. 00:19:21.570 --> 00:19:23.730 And this is where we created boot up CTFs. 00:19:23.890 --> 00:19:29.170 So boot up CTFs are the community-based CTF environments that we've now expanded upon. 00:19:29.410 --> 00:19:32.690 In fact, we ran about 110 of those events last year. 00:19:32.850 --> 00:19:34.370 They're all community-based. 00:19:34.610 --> 00:19:39.090 We run them for very specific demographics, uh, regions in the world. 00:19:39.330 --> 00:19:44.370 I've just run one, for example, for the historically black colleges and universities in the US. 00:19:44.450 --> 00:19:47.650 I'm running one for women in cybersecurity next week. 00:19:47.810 --> 00:19:50.769 We've got an AWS one coming up very shortly. 00:19:51.009 --> 00:19:57.650 So these are all tailored towards that particular demographic, but they're also really accessible and really simple. 00:19:57.810 --> 00:19:57.970 Yeah. 00:19:58.130 --> 00:20:00.050 They are Jeopardy-style environments. 00:20:00.210 --> 00:20:02.769 There's no progress that you have to follow. 00:20:02.930 --> 00:20:04.930 You can just jump in and jump out whenever you want. 00:20:05.009 --> 00:20:09.810 And we normally run them for about 48 hours to take into consideration different time zones. 00:20:09.970 --> 00:20:13.090 And we have built a really robust community around this. 00:20:13.170 --> 00:20:21.570 And there's tons of information that's been published, sometimes slightly annoyingly, because people document the challenges, which, you know, creates issues for us. 00:20:21.650 --> 00:20:22.610 But yeah, I can see that. 00:20:22.769 --> 00:20:25.170 Otherwise, the feedback for them is generally very good. 00:20:25.330 --> 00:20:25.730 Amazing. 00:20:25.890 --> 00:20:31.410 Well, Simon, I could talk about CTF challenges for a long time, but we're going to resist that temptation. 00:20:31.570 --> 00:20:33.570 We're going to move on to other geeky stuff. 00:20:33.730 --> 00:20:34.610 Could get really geeky. 00:20:34.690 --> 00:20:37.090 Kieran, you can mute if you want to or go make a cup of tea. 00:20:37.330 --> 00:20:38.610 Yeah, I'll go and do Wordle. 00:20:38.690 --> 00:20:39.730 It'll take me about half an hour. 00:20:39.890 --> 00:20:41.570 Oh, I'll see if you can get a one-hit wonder. 00:20:41.730 --> 00:20:45.970 Look, Simon, so Jupiter rockets, the Rangers are, of course, you've said, in a public cloud. 00:20:46.210 --> 00:20:58.610 And building these massive hackable environments where huge numbers of teams can come together and practice exploitation and defense and investigative practices is quite an interesting architecture and technical challenge. 00:20:58.769 --> 00:21:04.370 Not something that would have been very easy to do prior to the advent of many of the cloud technologies we have today. 00:21:04.529 --> 00:21:08.050 It's kind of something we take for granted in a lot of enterprise infrastructure. 00:21:08.289 --> 00:21:15.170 And if you look at your work or your courses, they're going to kind of learn a lot about how to do cloud more securely. 00:21:15.330 --> 00:21:23.490 But it is funny, isn't it, that we kind of take it for granted and yet there are still so many misconfigurations and kind of odd issues going on in the cloud. 00:21:23.650 --> 00:21:30.529 It really by now shouldn't be a particularly sexy attack opportunity for cybercriminals, and yet it is. 00:21:30.769 --> 00:21:39.009 So cast your mind back to just over a decade or so when Kieran was in very, very late middle age and the cloud was new. 00:21:39.170 --> 00:21:44.529 I mean, at least the cloud we recognize today, just like for so many AI is now. 00:21:44.769 --> 00:21:58.610 And the sort of AI we're talking about now is a bigger change than cloud was then, I would argue, but still a lot of fretting, a lot of worry that the cloud would be like so much other technology, cheaper, better performing, but not very secure. 00:21:58.769 --> 00:22:00.610 Some of it turns out more expensive. 00:22:00.850 --> 00:22:12.529 Tell us a bit more about your work getting on top of cloud security and what you think are some of the biggest lessons in how people have evolved their cloud design and infrastructure over the past few years. 00:22:12.769 --> 00:22:22.370 It's funny how you compare actually cloud with AI, because they're very similar to a degree in the way that they've been

adopted by organizations, enterprises across the world. 00:22:22.529 --> 00:22:24.610 Cloud has been around for a long time now. 00:22:24.769 --> 00:22:28.930 And you mentioned, you know, people still making the same mistakes as they were in the beginning. 00:22:29.090 --> 00:22:29.810 And it's true. 00:22:29.970 --> 00:22:41.570 Unfortunately, because the cloud has grown into this enormous, the most complex Lego set possible, that we are still getting some major implementation errors. 00:22:41.730 --> 00:22:48.769 And it all really comes down to education, reinforcing good practical experiences, and good training. 00:22:49.009 --> 00:22:58.690 So, you know, I teach an engineering class, we teach an architecture class, and the same challenges that we are facing, that organizations were facing 10 years ago, are still facing today. 00:22:58.769 --> 00:23:01.009 It's just that the technology's moved on somewhat. 00:23:01.170 --> 00:23:06.769 You also mentioned things like the, you know, the cloud being this cheaper option potentially, and it turns out that's not all. 00:23:07.330 --> 00:23:07.730 Is the case. 00:23:07.970 --> 00:23:08.610 Rarely, even. 00:23:08.850 --> 00:23:18.610 And so we're now in a situation where organizations are moving back to on-prem services and effectively just running an entire hybrid model, which again increases that complexity. 00:23:18.769 --> 00:23:20.289 And then we throw AI into the mix. 00:23:20.529 --> 00:23:29.009 By the way, Simon, I gotta tell you before you go AI, I do have this acronym, because you know we love an unnecessary acronym in cybersecurity, but I've been using it and I think you'll love it. 00:23:29.250 --> 00:23:30.050 RINFOL. 00:23:30.210 --> 00:23:31.970 Run it now, figure out later. 00:23:32.289 --> 00:23:33.009 That's very good. 00:23:33.170 --> 00:23:33.410 Yes. 00:23:33.570 --> 00:23:35.410 Otherwise known as it's working. 00:23:35.490 --> 00:23:36.370 Don't touch it. 00:23:36.610 --> 00:23:38.370 Back away from the machine. 00:23:39.009 --> 00:23:41.330 Many a banking mainframe I've seen. 00:23:41.570 --> 00:23:44.050 I'll just go and check if Rinfall.com was available. 00:23:44.210 --> 00:23:45.009 Just back in a sec. 00:23:45.170 --> 00:23:46.130 I'd be careful with that one. 00:23:46.210 --> 00:23:47.410 It might be something you don't expect. 00:23:47.730 --> 00:23:49.090 Make sure we have Safe Search turned on. 00:23:49.410 --> 00:23:49.970 I don't know how to do that. 00:23:50.130 --> 00:23:51.810 Anyway, Simon, you were going to tell us about AI. 00:23:51.970 --> 00:23:57.330 Yeah, so AI's really, again, sort of change the dynamics of what cybersecurity is doing. 00:23:57.490 --> 00:24:05.890 We've all of a sudden got this tool that, you know, there's a lot of talk that it potentially has the ability to replace human element or human interaction. 00:24:06.050 --> 00:24:06.930 And I don't think it does. 00:24:07.090 --> 00:24:11.490 We've had a lot of talk from evangelists online that it's going to solve a lot of the problems. 00:24:11.810 --> 00:24:17.730 I think it's going to solve some problems, but it's going to create, and it has been creating whole new problems in itself. 00:24:17.890 --> 00:24:20.529 And again, it's how organizations adopt this. 00:24:20.690 --> 00:24:23.730 Now, with the cloud, there was a lot of hesitation. 00:24:23.970 --> 00:24:29.810 Organizations were not running full speed head blind into running infrastructure in the cloud. 00:24:29.970 --> 00:24:42.850 They were actually quite reserved about it because it was contained to the engineering teams that required you to understand software-defined networking, whereas the network engineers actually had appliances to play with and poke and prod. 00:24:43.009 --> 00:24:46.289 AI is very different because AI is touched by everybody. 00:24:46.370 --> 00:24:52.289 So every person in the organization is going to use AI, whether the organization wants it or not. 00:24:52.450 --> 00:24:59.410 And I literally had a conversation yesterday with a small team of people, and they have concerns about how AI is being used. 00:24:59.570 --> 00:25:02.610 They've got potential data leaks that have already happened. 00:25:02.769 --> 00:25:04.450 This thing's not going slowly. 00:25:04.610 --> 00:25:06.450 The adoption for it is vast. 00:25:06.610 --> 00:25:10.289 And the policies that organizations put in place just cannot keep up. 00:25:10.529 --> 00:25:12.930 So this presents us a whole new series of challenges. 00:25:13.090 --> 00:25:21.970 And of course, from my perspective, this is brilliant because it means A, I can now write a lot more code and be a lot more productive because that's really what AI is. 00:25:22.050 --> 00:25:23.250 It's a productivity tool. 00:25:23.410 --> 00:25:28.050 But also we can introduce that into the CTF environments and we can experiment with this. 00:25:28.210 --> 00:25:36.930 And in fact, we did at our last cyber threat event where we actually had a phone system where you could dial up an AI bot and you had to convince it to give you some credentials. 00:25:37.170 --> 00:25:37.970 That was awesome. 00:25:38.210 --> 00:25:39.170 That was awesome. 00:25:39.330 --> 00:25:44.769 Before you and James geek out even further on AI, as I both expect and even hope that you will. 00:25:45.009 --> 00:25:47.970 Can I just ask you a little bit about where you think AI is? 00:25:48.130 --> 00:25:56.210 I was really interested that you mostly concurred with James's framing of the cloud and AI experiences in terms of adoption, in terms of the narrative and so forth. 00:25:56.370 --> 00:25:59.250 But now you're saying, look, everybody is using it. 00:25:59.410 --> 00:26:01.250 It is different in some key ways. 00:26:01.410 --> 00:26:04.289 And I just wanted to ask, here's a nice easy one, you know, what is AI? 00:26:04.450 --> 00:26:09.570 And what I mean by that is when you're talking about organizational adoption, you know, there've been all

sorts of predictions. 00:26:09.730 --> 00:26:12.450 In the past few years, there are all sorts of predictions of where it's going. 00:26:12.610 --> 00:26:16.850 But with any technological revolution, there have been bits where expectations have been overshot. 00:26:17.009 --> 00:26:22.850 There have been bits where things have been much slower in terms of development, and there have been things that have been predicted that haven't happened at all. 00:26:22.930 --> 00:26:29.410 And we're getting all sorts of predictions about robotics, about interaction with the physical world, about the takeover of various professions and so forth. 00:26:29.570 --> 00:26:36.450 So, where should organizations really be looking in terms of which bits of AI matter most for their effectiveness and for their security? 00:26:36.690 --> 00:26:40.930 So, from an effectiveness perspective, it really should be treated as a productivity tool. 00:26:41.009 --> 00:26:46.450 It is there to expand or speed up processes that humans are interacting with already. 00:26:46.690 --> 00:26:52.130 The whole let AI go off and do its own thing is terrifying from my perspective. 00:26:52.289 --> 00:26:52.529 Okay. 00:26:52.690 --> 00:26:58.930 And from a security perspective, it's even more terrifying because as humans, we're really good at missing things. 00:26:59.009 --> 00:26:59.170 Yeah. 00:26:59.250 --> 00:27:01.970 And the AI tools have been trained by humans. 00:27:02.210 --> 00:27:17.810 So people have to come to the realization that at the moment, and with the versions and with the types of AI that we're currently running, there are still going to be some fundamental flaws in there and that we, you know, we shouldn't really be trusting them with things as critical as security. 00:27:18.210 --> 00:27:23.410 That said, they can speed up a lot of those sort of remedial processes, the data hunting, etc. 00:27:23.570 --> 00:27:30.690 And I use it, you know, we use it extensively, particularly around things like log investigation, second cloud infrastructures. 00:27:30.850 --> 00:27:34.610 It is good for a lot of those implementations, but we have to double check it. 00:27:34.690 --> 00:27:36.690 We have to verify everything it's doing. 00:27:36.850 --> 00:27:45.890 And the conversation I had yesterday with a company was they have a product development manager who was essentially blueprinting what some infrastructure should look like. 00:27:45.970 --> 00:27:59.009 And he was then immediately sending that off to the development team in the hope that they were going to build it without really any consideration of the architecture of what was needed to be built, how it was going to be implemented, and how it was going to work with everything else. 00:27:59.170 --> 00:27:59.250 Yeah. 00:27:59.490 --> 00:28:02.529 So it was almost like they'd skipped the step to get there. 00:28:02.769 --> 00:28:02.930 Right. 00:28:03.009 --> 00:28:09.490 And I can't resist asking you this as a follow-up,

maybe even taking you back to capture the flags and practical learning and so forth. 00:28:09.650 --> 00:28:14.289 So you learn by doing, you're designing, you're bringing AI into all these exercises and so forth. 00:28:14.529 --> 00:28:17.970 So you're looking really, really closely in a really hands-on way. 00:28:18.050 --> 00:28:22.690 You know, you're doing everything short of live fire at what the defenders can do and what the attackers are doing. 00:28:22.850 --> 00:28:24.289 What in terms of two things? 00:28:24.450 --> 00:28:32.210 One, I suppose techniques is interesting you, and that sort of cliched question about who does AI favor, attackers or defenders. 00:28:32.370 --> 00:28:33.410 What's your perspective on that? 00:28:33.650 --> 00:28:34.210 Oh, no. 00:28:34.450 --> 00:28:36.130 Including that's a terrible question. 00:28:36.210 --> 00:28:37.330 That's an acceptable answer. 00:28:37.570 --> 00:28:41.090 Uh again, that very much depends on the individual's ethics. 00:28:41.170 --> 00:28:41.330 Yeah. 00:28:41.490 --> 00:28:46.610 You know, what their objectives are and how prepared they are to implement some of their objectives. 00:28:46.769 --> 00:28:46.930 Yeah. 00:28:47.090 --> 00:28:53.890 Some of the techniques I've seen from the AI perspective and from an attacker's perspective is actually targeting human nature. 00:28:54.050 --> 00:28:56.690 And I think this has taken a very dark turn. 00:28:57.009 --> 00:28:57.570 Really interesting. 00:28:57.730 --> 00:28:57.890 Yeah. 00:28:58.050 --> 00:29:00.529 We all know what phishing is, we all know what vishing is. 00:29:00.690 --> 00:29:05.009 Now all of a sudden, we've got tools that can handle things like translation. 00:29:05.090 --> 00:29:05.330 Yeah. 00:29:05.570 --> 00:29:08.610 We no longer need to rely on poor translation. 00:29:08.690 --> 00:29:12.529 You know, the attackers can just translate whatever they want into whatever language they want. 00:29:12.690 --> 00:29:13.009 Yeah, yeah, yeah. 00:29:13.170 --> 00:29:19.090 Which means they can write code in one language and have it compile in another language, they can write emails, they can vish. 00:29:19.250 --> 00:29:27.250 All of a sudden, it's opened up a vast area or surface of an attack that previously was, you know, getting better. 00:29:27.490 --> 00:29:29.170 If you wouldn't mind, Simon, to build on that point. 00:29:29.410 --> 00:29:30.210 Or just to interrupt. 00:29:30.370 --> 00:29:31.009 Yeah, exactly. 00:29:31.170 --> 00:29:34.050 Well, you know, I hadn't spoken for a while and I do like attention. 00:29:34.289 --> 00:29:34.769 Bye. 00:29:35.090 --> 00:29:45.410 It is, Simon, is it's the case that a lot of the folks who are building these technical inserts and artifacts and so on aren't exactly notorious for their gregarious social skills. 00:29:45.570 --> 00:29:49.890 And now with AI, it's not just that they can translate to other languages or have better spelling. 00:29:50.130 --> 00:29:55.890 Their ability

to please people in conversations, to adapt to social preferences. 00:29:56.130 --> 00:30:05.090 I mean, that's one of the terrifying, you know, features of AI that's led to some elimination of models and the way that people have felt the need to anthropomorphize it and turn it into their friend. 00:30:05.330 --> 00:30:12.370 Well, think about what that does for our attackers who may be more technical and less human manipulative and understanding in their nature. 00:30:12.529 --> 00:30:15.250 So it's even bigger than the translation thing, isn't it? 00:30:15.410 --> 00:30:15.970 Oh, it is. 00:30:16.050 --> 00:30:17.570 I mean, it's into mimicry. 00:30:17.650 --> 00:30:30.850 And as we know from psychological studies over the last 20 years in things like uh neurolinguistic programming, if you can mimic the behavior of an individual you're communicating with, you're more likely to be able to get them to do something. 00:30:31.009 --> 00:30:35.490 And then this is a horrifying aspect of AI because it actually is very good at this. 00:30:35.650 --> 00:30:47.090 You know, attackers can scope out and identify the traits, the language, the behaviors used within an organization and become a part of that organization in order to then leverage further access. 00:30:47.170 --> 00:30:55.009 And we've seen this over the past six to 12 months, uh, really gaining traction, not just through phishing either, but through voice prompts, et cetera. 00:30:55.170 --> 00:30:57.170 It's getting a lot more difficult to detect. 00:30:57.410 --> 00:30:58.050 Yeah, it is. 00:30:58.130 --> 00:30:59.810 And I'll share a couple of stats from my perspective. 00:30:59.970 --> 00:31:04.130 You could refute these violently if you like, Simon, or agree, up to you. 00:31:04.289 --> 00:31:11.410 And then I've got a couple of questions on the back end of this to try and make it useful to our listeners as they think about cloud and AI today. 00:31:11.650 --> 00:31:17.890 You know, look, I've seen these wonderful headlines and kind of application of these technologies for defense and offense. 00:31:18.130 --> 00:31:21.730 And the obvious question is well, does the world get more secure? 00:31:21.890 --> 00:31:37.490 We we saw the huge plunge in the stock market in cybersecurity companies due to the preview release of an effect and you know, an LLM for improving code quality and reducing vulnerabilities, which, by the way, is a fantastic use case for this type of technology that I thoroughly encourage. 00:31:37.650 --> 00:31:39.330 But the details matter, doesn't it? 00:31:39.410 --> 00:31:40.370 Because two things are true. 00:31:40.610 --> 00:31:47.330 Firstly, having more of this stuff out there, more agents, more AI, likely to increase the surface area of attack. 00:31:47.490 --> 00:31:57.330 So even if you reduce the number of vulnerabilities in your code, there's more stuff, there's more surface area, which might take us to a place where frankly we're just as exposed as ever. 00:31:57.490 --> 00:31:59.410 But there's also all this research out there, isn't there? 00:31:59.570 --> 00:32:06.289 There's, you know, kind of Opus 4.6's vulnerability density increased 55% over its predecessor. 00:32:06.370 --> 00:32:13.570 And, you know, VeraCode kind of released a report saying security performance stays flat regardless of model size. 00:32:13.810 --> 00:32:27.330 And uh there was another one, I think it was Endor Labs, who'd said that, you know, these models that are producing these fewer false positives and improving code security also generate code that's vulnerable 25 to 75% of the time. 00:32:27.570 --> 00:32:41.650 So I get this real sense that we're admiring the improvements, which are wonderful, and missing this bigger point that it's gonna create a ton of other baggage that leaves us in a world where we're just as exposed and frankly, maybe more exposed. 00:32:41.810 --> 00:32:44.050 Oh god, I've gone full doomsday scenario. 00:32:44.210 --> 00:32:45.009 Simon, help me out. 00:32:45.170 --> 00:32:50.529 Can you give me some pragmatism here on how you think this is gonna play out for organizations over the next couple of years? 00:32:50.690 --> 00:32:51.650 Go for the middle ground. 00:32:52.130 --> 00:32:54.610 Unfortunately, I'm not gonna give you any pragmatism at all. 00:32:54.769 --> 00:32:57.009 I'm actually gonna reinforce what you just said. 00:32:57.170 --> 00:32:57.490 Oh no. 00:32:57.810 --> 00:33:04.450 So the stock market and a particular type of organization actually took a tumble over the last three months, which was SaaS products. 00:33:04.690 --> 00:33:04.850 Right. 00:33:05.009 --> 00:33:14.050 So software as a service of all of a sudden their really stable consumer base has now been disrupted because anybody can write an app. 00:33:14.210 --> 00:33:32.610 So we now have a situation where the encumbrance who have spent millions in research and development over the last 10 years or so are now being phased out by organizations because they've realized that rather than pay a particular license, they can get a developer in who knows how AI works and then write a custom application for them. 00:33:32.769 --> 00:33:46.930 And then that brings you back to this surface area of attack statement you made as well, which is yes, we have now more advanced tools in AI that can identify flaws in code, bad practices, all those kind of things. 00:33:47.009 --> 00:33:51.330 But we've also got 10 times more people without any experience writing code. 00:33:51.490 --> 00:33:53.170 So is it gonna get any better? 00:33:53.330 --> 00:33:54.769 What could possibly go wrong? 00:33:55.009 --> 00:33:56.130 What could possibly go wrong? 00:33:56.210 --> 00:33:56.450 Yeah. 00:33:56.529 --> 00:33:58.610 It's a less than ideal situation. 00:33:58.769 --> 00:34:05.410 And I think again, it's gonna take a while for not just the early adopters to get beyond this point. 00:34:05.570 --> 00:34:29.250 It's gonna take a while for the

organizations and for the teams who are a little bit slower to pick up new technologies to get into this state, which means that actually we're probably gonna be facing a worser scenario in the next year or two than we already are at the moment before we get to an improvement state, unless there is another huge leap in the technology and an advance in the technology. 00:34:29.489 --> 00:34:30.610 Yeah, no, that makes sense. 00:34:30.769 --> 00:34:36.289 Well, look, I've I've got one more thing for you, and then I promise I'm gonna get out of the way, Kieran, because I'm hogging up a lot of time here. 00:34:36.529 --> 00:34:38.050 I'm learning by not doing. 00:34:39.170 --> 00:34:42.289 So, much like people with a lot of AI, frankly. 00:34:42.529 --> 00:34:48.610 So, Simon, I want to get back to something practical for our listeners here on both cloud and AI. 00:34:48.690 --> 00:34:50.369 So, I give you a hard assignment. 00:34:50.610 --> 00:34:57.889 Two points on how people need to pay attention to cloud security here in 2026. 00:34:58.050 --> 00:35:06.130 Two things that you think are particularly important that a security leader goes and checks their technical team are doing, mistakes that are common. 00:35:06.289 --> 00:35:16.769 And then two things in AI where you'd do the same and validate being used a certain way, or you've got a certain policy, or that you're looking at a certain area of technology you think matters. 00:35:16.930 --> 00:35:22.849 So for both of them, two specific things that you think are worth paying attention to that people can go check. 00:35:23.090 --> 00:35:26.130 I'd like to say, I got a million things I'd like to say on that one. 00:35:26.289 --> 00:35:38.530 Um I mean, the two that tend to cause the most problems for organizations in the cloud is identity primarily in the cloud environment, managing users, and just doing the basics. 00:35:38.690 --> 00:35:42.130 I mean, again, I was reading an article uh written by a pen tester. 00:35:42.450 --> 00:35:51.010 He was talking about an organization that had spent, you know, two million dollars on an EDR, an XDR, they've got uh endpoint detection and response. 00:35:51.090 --> 00:35:54.050 They had a pen test and they were breached within two hours. 00:35:54.130 --> 00:36:01.409 And they were breached within two hours because they had a hard-coded credential stored in a file, stored in a server somewhere, unsecured buckets, etc. 00:36:01.650 --> 00:36:08.210 All of those traditional weak spots inside a cloud environment implementation, they're the things you want to watch out for. 00:36:08.369 --> 00:36:12.769 And you don't need a vast array of expensive tools to do that. 00:36:12.930 --> 00:36:16.849 You just need, you know, eyes on and some skilled professionals. 00:36:17.010 --> 00:36:22.450 The next challenge to that one then is to expand that out onto management of your on-prem infrastructure as well. 00:36:22.610 --> 00:36:24.849 And the cloud now is part of on-prem. 00:36:24.930 --> 00:36:29.090 In fact, your on-prem is gonna become your on-premise cloud. 00:36:29.250 --> 00:36:31.010 And that is where everything is going. 00:36:31.250 --> 00:36:42.610 So, you know, handling again identity from those two distinct environments is proving difficult for organizations, especially when they're trying to drag some legacy systems along with them. 00:36:42.849 --> 00:36:45.490 From an AI perspective, oh, this is easy. 00:36:45.650 --> 00:36:47.090 You just gotta train your staff. 00:36:47.250 --> 00:37:03.010 You've got to provide and give them incentives to use the technology appropriately, show them the potential problems and the flaws in the way that the technology is implemented, and provide them with the tools that they need in order to be able to use those resources properly. 00:37:03.170 --> 00:37:06.849 The next part of that one is manage the actual communications. 00:37:07.170 --> 00:37:22.289 I had a very, very odd scenario a couple of weeks ago where an organization implemented a very strict policy across the entire organization, made all the staff sign a document, basically went through the whole tick box exercise for ISIL 27001, Cyber Essentials, et cetera. 00:37:22.369 --> 00:37:30.289 And then the CEO was using his own personal Chat GPT account and actually posted information about his clients in that account and created a breach. 00:37:30.530 --> 00:37:30.769 Wow. 00:37:30.930 --> 00:37:37.570 Just from that kind of default activity, it was logged in on his computer on his enterprise, and it was on a personal account on his phone, and that was it. 00:37:37.730 --> 00:37:39.409 What an incredible answer. 00:37:39.730 --> 00:37:43.889 We could unpack that for hours, but actually it was so succinct, I suspect. 00:37:44.050 --> 00:37:49.570 Some people would just clip that bit out and use it as advice for their organization for quite some time to come. 00:37:49.650 --> 00:37:52.210 But so let me ask you hopefully a slightly easier question. 00:37:52.369 --> 00:37:55.650 It's a hard one to ask because I'm trying to bring lots of things together that we've talked about. 00:37:55.889 --> 00:37:58.690 Love the remark about your on-prem cloud. 00:37:58.849 --> 00:38:06.610 You're talking about the challenges of AI adoption and all the complicated things we've talked about today and the fast pace of change and so forth. 00:38:06.769 --> 00:38:09.570 We are talking about an industry where quite a lot of people feel under pressure. 00:38:09.730 --> 00:38:16.289 Now, anyone who's encountered you, we can't speak to how you're feeling on the inside, but I hang around with you at conferences and you're about to go on stage. 00:38:16.450 --> 00:38:22.769 You have legendary status in parts of the community, but you wear it all lightly with a famous cap on your head during the CTFs. 00:38:22.849 --> 00:38:26.369 You've this huge area of hinterland of interests outside of work. 00:38:26.530 --> 00:38:30.289 You

get so much done, you don't seem to, on the face of it, let it all get to you. 00:38:30.450 --> 00:38:33.409 But there's plenty of talk about this industry being under pressure. 00:38:33.570 --> 00:38:35.650 So two questions to finish off with. 00:38:35.809 --> 00:38:40.849 One is really, how do you manage to do all this with, at least in public, a smile in your face? 00:38:41.010 --> 00:38:45.889 And is there a more serious problem in an industry that you, by whatever means, have managed to avoid? 00:38:46.130 --> 00:38:56.769 There is a serious problem in the industry with burnout, and it's very easy to fall into that trap, and without noticing as well, the pressures that people who are working in cybersecurity are under. 00:38:56.930 --> 00:39:00.210 You've got to be constantly learning just to stand still. 00:39:00.369 --> 00:39:11.730 There is often more work that is possible to actually do as a single individual, then you know, add the training onto there, and then aren't incidents on if you're in that particular part of the industry. 00:39:11.889 --> 00:39:16.289 It is really difficult, and you do just have to take yourself out of it fairly frequently. 00:39:16.530 --> 00:39:22.050 Do something that's completely, you know, outside of that environment and just keep yourself grounded. 00:39:22.289 --> 00:39:26.450 I find it exceptionally easy, um, but that's just because I'm a massive geek. 00:39:26.530 --> 00:39:29.650 And to be honest, this is as much as my hobby as it is my job. 00:39:29.730 --> 00:39:36.130 And I am very lucky to be in such a position where I basically turn up to work every day excited. 00:39:36.289 --> 00:39:39.650 Um, in fact, I said to my wife this morning, she was leaving the house, she was like, What are you doing today? 00:39:39.730 --> 00:39:42.289 I was like, Yes, I'm building CTF challenges today. 00:39:42.450 --> 00:39:46.690 Haven't managed to do that for about three weeks because I've been doing some other things and running some events. 00:39:46.769 --> 00:39:47.889 So, how are you getting on? 00:39:47.970 --> 00:39:48.130 Yeah. 00:39:48.450 --> 00:39:49.090 I was great. 00:39:49.170 --> 00:39:49.970 Yeah, they were brilliant. 00:39:50.050 --> 00:39:51.090 I've had a lot of fun today. 00:39:51.250 --> 00:39:51.570 Excellent. 00:39:51.889 --> 00:40:03.889 Simon sits in his lab like an evil genius trying to recreate the machinations of cyber criminals and then do them in a way that's secure enough that lots of cybersecurity professionals can emulate that safely. 00:40:03.970 --> 00:40:10.050 And it's a fascinating problem to build something very specifically vulnerable and not more broadly vulnerable. 00:40:10.210 --> 00:40:11.970 It's a really interesting problem, isn't it, Simon? 00:40:12.130 --> 00:40:22.690 And only you, James, with that mind of yours, could take that wonderful, upbeat, positive answer about I'm so lucky because my hobby is my job, and say, yes, you're an evil genius. 00:40:24.450 --> 00:40:26.849 Well, I think it's flattery of the highest order, actually. 00:40:26.930 --> 00:40:27.889 It's highly creative. 00:40:28.130 --> 00:40:29.409 Evil for good, right, Simon? 00:40:29.570 --> 00:40:30.130 Evil for good. 00:40:30.289 --> 00:40:31.170 Another t-shirt. 00:40:31.250 --> 00:40:31.730 We've got one. 00:40:31.889 --> 00:40:33.329 That would be a very good t-shirt, actually. 00:40:33.490 --> 00:40:37.490 Yeah, that's the best idea we've had for a while for these fictional t-shirts that we never actually make. 00:40:37.650 --> 00:40:38.130 But there we go. 00:40:38.369 --> 00:40:39.809 Yeah, well, but one day we just might. 00:40:39.889 --> 00:40:41.090 There's a distinct possibility. 00:40:41.170 --> 00:40:43.170 That's probably a slogan of a company somewhere. 00:40:43.250 --> 00:40:47.250 So apologies if I just inadvertently promoted someone or breached a copyright. 00:40:47.329 --> 00:40:49.570 But uh, if not, someone should snap that one up, I think. 00:40:49.730 --> 00:40:50.610 I'm almost worried. 00:40:50.690 --> 00:40:51.409 And this is my fault. 00:40:51.490 --> 00:40:53.809 I've got us rambling again, just me and you, not Simon. 00:40:53.889 --> 00:40:54.930 He's been very articulate. 00:40:55.010 --> 00:41:07.010 And we might run out of time before your favorite bit, James, because I think, you know, having done cloud, AI, capture the flag, community outreach, state of the cybersecurity industry, I think we'll let him off a bit, except for your favorite bit. 00:41:07.170 --> 00:41:07.570 Go on. 00:41:07.730 --> 00:41:08.210 We have to. 00:41:08.450 --> 00:41:09.090 One must. 00:41:09.250 --> 00:41:17.570 So look, Simon, it's only fair if we ask people to listen to us, we give them something really practical and useful at the end. 00:41:17.730 --> 00:41:19.090 So absolutely, Simon. 00:41:19.250 --> 00:41:23.970 So we are asking you for your 30-second takeaway. 00:41:24.130 --> 00:41:25.170 It's my favorite bit. 00:41:25.409 --> 00:41:28.610 Simon, this podcast is about lessons for cybersecurity leaders. 00:41:28.769 --> 00:41:42.130 So if you've got just 30 seconds with a cybersecurity leader, what would you advise them here in 2026 to pay attention to, to ignore, or frankly, to give up their role to an AI and go and get into carpentry or motorsports? 00:41:42.369 --> 00:41:42.690 I don't know. 00:41:42.769 --> 00:41:43.329 What would it be? 00:41:44.130 --> 00:41:48.610 Uh my recommendation would absolutely be invest in your people. 00:41:48.849 --> 00:41:51.730 They are the ones who are going to make the biggest difference. 00:41:51.889 --> 00:42:01.490 And actually proving your security capability and not just claiming it is a massive win for anybody who's in cybersecurity leadership. 00:42:01.650 --> 00:42:03.490 My actual goal is really simple. 00:42:03.730 --> 00:42:11.409 I basically want to take teams of people into operational readiness by giving them systems to break, defend, recover, etc. 00:42:11.730 --> 00:42:21.570 But you've got to commit those resources to come and play those games so that they can practice without the pressure of somebody leaning over their shoulder, asking them, is it working yet? 00:42:21.730 --> 00:42:22.450 Is it working yet? 00:42:22.610 --> 00:42:23.490 Is it working yet? 00:42:23.650 --> 00:42:30.050 And that is as clearly expressed a 30-second takeaway as we've ever had, and a memorable one too. 00:42:30.210 --> 00:42:31.650 Thank you very much, Simon. 00:42:31.730 --> 00:42:34.769 It's been an absolute pleasure having you on the show. 00:42:35.010 --> 00:42:39.090 And unfortunately, that's essentially all we have time for. 00:42:39.250 --> 00:42:50.050 So all that remains for me to say, apart from thanking Simon and even thanking you, James, is to say you can leave us feedback at the podcast site, or you can email us at cyberleaderspodcast at sans.org. 00:42:50.130 --> 00:42:51.809 Tell us what more you'd like to hear, less. 00:42:51.970 --> 00:42:53.010 Tell us anything you like. 00:42:53.250 --> 00:42:55.730 And so with that, thank you very much for listening today. 00:42:55.889 --> 00:42:56.610 Thank you for listening. 00:42:56.690 --> 00:42:57.570 Keep cybering. 00:42:57.650 --> 00:43:01.490 So for me, Kieran Martin, and me, James Line, it's goodbye. 00:43:01.570 --> 00:43:06.369 And remember that when exploiting a binary, it's a lot like a hot chicken through butter.