WEBVTT
00:00:05.280 --> 00:00:06.080
Hi I'm Dr.
00:00:06.160 --> 00:00:08.800
Natalie Foster Johnson and welcome to Pretty Secure.
00:00:09.119 --> 00:00:11.199
We are kicking off our first episode.
00:00:11.359 --> 00:00:16.960
Yes, I said our first episode of Pretty Secure, and this is this is that thing you dream of.
00:00:17.039 --> 00:00:26.399
I've I've had such an amazing career, and a couple of my friends I love said that I should share that and I should I should get into the world of digital media.
00:00:26.559 --> 00:00:27.199
Go figure.
00:00:27.359 --> 00:00:29.199
I hate the sound of my voice, people knows that.
00:00:29.359 --> 00:00:35.119
But I think that we have an opportunity here to give back to our community, and it's about resilience.
00:00:35.280 --> 00:00:39.200
It's about education, it's about bringing each other up in a sincere way.
00:00:39.439 --> 00:00:41.119
I am here with my first guest.
00:00:41.520 --> 00:00:42.880
John, do you want to introduce yourself?
00:00:43.280 --> 00:00:43.439
Sure.
00:00:43.520 --> 00:00:48.240
John Masserini, uh currently uh uh founder of Senecon Security.
00:00:48.320 --> 00:00:53.520
Uh I do a lot of VCSO work, a lot of uh board advisory services, a lot of mentoring.
00:00:53.600 --> 00:01:00.000
Uh and um just love the fact that you you invited me and and uh appreciate the time we're spending together.
00:01:00.320 --> 00:01:14.640
And if people don't know, John is also uh one of my beloved members of CyberC South Florida, uh 501c3 that supports the the growth of black and brown career changers, young folks, anyone who feels that cybersecurity is a place for them.
00:01:14.799 --> 00:01:17.680
Because um, one of the things you guys know is it's my tribe.
00:01:17.760 --> 00:01:20.560
It's about giving people what they need to be successful.
00:01:20.719 --> 00:01:24.000
Uh, I think both of us have had a wonderful career in cybersecurity.
00:01:24.159 --> 00:01:26.000
I have had an absolute ball.
00:01:26.079 --> 00:01:30.959
Um, but there's so many people fighting to get into cybersecurity and and technology.
00:01:31.120 --> 00:01:46.799
So, what we need to do with Pretty Secure is create a threshold, create a connection so regular folks, people in between career, even our seasoned veterans like like John, can find somewhere that they can come to and find relevant information to help them grow.
00:01:47.599 --> 00:01:50.879
I came up with some some weird questions, actually asked my AI.
00:01:51.120 --> 00:01:53.439
Um what should I ask John?
00:01:53.760 --> 00:01:59.599
John has has seen things that people we probably won't see, and I don't want clearance to see.
00:02:00.000 --> 00:02:05.040
Um, but I want to make sure that this episode, this first episode, has something for a little a little bit of everyone.
00:02:05.200 --> 00:02:10.960
So let's talk about our CISOs, because I think our CISOs, that that tone at the top, that ability to lead.
00:02:11.039 --> 00:02:20.000
Um, I feel like they they get they get some heavy weight, and with everything happening with the SEC rules, and the I I think the world waking up for cybersecurity, we need to talk to them first.
00:02:20.240 --> 00:02:27.199
So you've served as CISO across so many different organizations, and you now advise as a founder, a mentor.
00:02:27.360 --> 00:02:32.240
Um, what are the bus biggest misconceptions that CISOs are going through right now for cybersecurity?
00:02:32.719 --> 00:02:41.439
So I think uh, you know, the the biggest challenge a lot of CISOs have is, you know, they inadvertently bring a lot of legacy with them, right?
00:02:41.599 --> 00:02:44.319
Um I've been doing this for 30 years.
00:02:44.560 --> 00:02:52.000
Uh the CISO role that I had uh 20 years ago is very different than the CISO roles that are that the CISOs face now.
00:02:52.240 --> 00:02:52.479
I bet.
00:02:52.879 --> 00:03:06.719
Um yeah, so so you know, it's there's still, you know, for for good or for bad, um, when you look at the executives and and the boards, there's still a lot of, you know, the the security is that black hole.
00:03:06.879 --> 00:03:09.680
Money goes in, what do we really get out of it, right?
00:03:10.319 --> 00:03:21.759
Um we've had we have a lot stronger models today that talk to the return on investment uh of security and and the true benefit that it brings uh to the organization.
00:03:22.080 --> 00:03:38.400
You know, one of the one of the kind of driving um uh uh kind of teachings that I that I like to um, not just to CISOs, but when I do board advisory work, is really around, you know, I I compare it to a car, believe it or not.
00:03:38.719 --> 00:03:39.039
Okay.
00:03:39.199 --> 00:03:39.439
Right?
00:03:39.919 --> 00:03:44.240
Um how fast would you drive a car if you never had any brakes?
00:03:44.560 --> 00:03:45.199
I wouldn't.
00:03:45.520 --> 00:03:47.199
I've done that in my my high school years, honestly.
00:03:48.639 --> 00:03:49.039
Right, right.
00:03:49.599 --> 00:03:50.879
We'd be the Flintstones, right?
00:03:50.960 --> 00:03:52.240
We'd be peddling, right?
00:03:52.719 --> 00:03:54.560
That's how security is, right?
00:03:54.719 --> 00:03:56.000
Security doesn't stop you.
00:03:56.159 --> 00:03:59.120
Security is no longer the organization of no.
00:03:59.520 --> 00:04:08.560
We're there to allow you to go, to allow the businesses to go as fast as they can, as fast as they want, knowing we're gonna be able to stop if something bad happens.
00:04:08.800 --> 00:04:09.439
Okay, right.
00:04:09.599 --> 00:04:15.039
And that's a really different kind of vision than a lot of people deal with, right?
00:04:15.120 --> 00:04:19.519
It's a a lot of people look at security as strictly a technology issue, right?
00:04:19.600 --> 00:04:19.839
Right.
00:04:20.079 --> 00:04:24.319
A, you know, I don't want to be in, I don't want to be in the headlines, right?
00:04:24.560 --> 00:04:30.399
I don't I don't want to have to deal with the SEC coming in and doing an audit or something because we had a breach.
00:04:30.560 --> 00:04:32.399
So protect me from that.
00:04:32.720 --> 00:04:38.160
When the right approach is, how can you help me drive business, right?
00:04:38.319 --> 00:04:40.879
How can we integrate that company we just bought?
00:04:41.040 --> 00:04:46.480
How can we integrate it faster and see the value of the purchase and the acquisition?
00:04:46.720 --> 00:04:48.399
How can it help our whole company, right?
00:04:48.480 --> 00:04:57.040
And security, you know, unlike technology in general or you know, finance or audit, security sees everything.
00:04:57.279 --> 00:04:58.319
We're in the middle, right?
00:04:58.399 --> 00:04:58.639
Yep.
00:04:58.959 --> 00:05:05.040
So so it it regardless of what's happening in the company, we get involved in it.
00:05:05.199 --> 00:05:10.000
So we have that one unique perspective that no one else can really bring.
00:05:10.480 --> 00:05:11.839
And we have a lot to offer on that.
00:05:11.920 --> 00:05:19.519
And that's where I think a lot of the CISOs today are, you know, when if they focus on that area and they're realizing that, right?
00:05:19.680 --> 00:05:22.720
And you know, we have some great CISO friends down here.
00:05:22.959 --> 00:05:28.079
And the success, when you look at them, they're successful because they understand that, right?
00:05:28.319 --> 00:05:34.480
They're not just throwing money after tools or that they don't just want to hire the biggest, you know, number of people they can.
00:05:34.720 --> 00:05:36.639
They want to solve the business problems, right?
00:05:36.720 --> 00:05:40.480
And and that that's really when you look at successful CISOs, that's what they're trying to do.
00:05:40.879 --> 00:05:46.959
Um I I heard it phrased as we have to stop looking at security as a cost center.
00:05:47.360 --> 00:05:48.079
Exactly.
00:05:48.319 --> 00:06:01.920
Um and and more mature organizations, I'm not picking on anyone because I feel like everyone is in in their different step depending on your regulation, depending on um who's you know what who's got breached lately, honestly.
00:06:02.240 --> 00:06:08.160
Um but we again have to see it as a tool that enhances business as opposed as that cost-centric.
00:06:08.319 --> 00:06:10.800
Because in and in reality, it it is truthful.
00:06:10.879 --> 00:06:12.720
A lot of the tools cost a lot of money.
00:06:12.959 --> 00:06:13.279
Of course.
00:06:13.600 --> 00:06:24.480
And uh PCI, whether it's ISO, whether whatever, whatever your requirement in, you have to understand where you are in your your risk prioritization and and make those choices as a CISO.
00:06:25.199 --> 00:06:34.319
Um, my next question was um you often talk about aligning those cybersecurity um requirements and needs with business outcomes.
00:06:34.560 --> 00:06:38.800
What is your advice to security leaders who are struggling to get buy-in from their board?
00:06:38.959 --> 00:06:43.040
So this is those middle managers, folks that are in in the trenches.
00:06:43.199 --> 00:06:48.319
Like, how do you sell the value of cybersecurity to that board person that doesn't understand?
00:06:48.800 --> 00:06:50.639
Well, and and that's the challenge, right?
00:06:50.720 --> 00:07:10.399
Uh the challenge is getting, you know, a lot of the uh a lot of the mentoring that I do is for those individuals who have come up through the technology organization uh and who are, for right or for wrong, anointed to be the CISO, right?
00:07:10.720 --> 00:07:18.959
Um whether it's because of a breach or whether it's just because of an audit that happened and they said you need a CISOs, now you're the CISO, right?
00:07:19.279 --> 00:07:30.160
Um getting that that level uh of CISO to understand the business value, and it's not just technology, because that's where they grew up.
00:07:30.319 --> 00:07:32.639
That's where a lot of the mentoring comes in, right?
00:07:32.959 --> 00:07:45.439
Um a lot of people, and this is I think it's regardless of whether you're in security or whatever, a lot of people who are working through their career are scared to ask for a mentor, right?
00:07:45.600 --> 00:07:52.160
They're scared to go, look, I I need help to understand how the business side of this works.
00:07:52.560 --> 00:08:01.279
Believe it or not, most boards, most executive teams will acknowledge that and and actually be very respectful of it, right?
00:08:01.759 --> 00:08:11.680
Um getting that assistance and and and finding that person who can help bridge that gap is only gonna be better for the organization, right?
00:08:12.399 --> 00:08:18.959
Um so getting them to understand that is is really it's a hard conversation because it's hard.
00:08:19.199 --> 00:08:23.279
Look, it it's hard for me as a person to ask for help, right?
00:08:23.600 --> 00:08:29.920
You you put me in this position, I'm gonna knock it out of the park and and I'm I'm gonna be everything you think I can be.
00:08:30.560 --> 00:08:33.919
But you know, we don't have we don't let our kids do that, right?
00:08:34.000 --> 00:08:35.360
We don't let students do that.
00:08:35.519 --> 00:08:39.039
Why should we do that as we go through our career as professionals, right?
00:08:39.200 --> 00:08:45.840
So um, you know, understanding that the value that mentorship brings um is really critical.
00:08:46.000 --> 00:08:57.279
But that's you know, even if you can't get the mentorship, there's plenty of organizations out there that, you know, go honestly, go hang out with other CISOs, right?
00:08:57.440 --> 00:09:01.039
It's uh I I don't want to say we commiserate, but we commiserate.
00:09:03.840 --> 00:09:07.360
Um you know, every organization is different, right?
00:09:07.519 --> 00:09:08.559
But that's that's a given.
00:09:08.720 --> 00:09:16.720
So what works for one company won't work for another company, but understanding how they got to where they are is very valuable, right?
00:09:16.879 --> 00:09:26.879
So just sitting down, you know, having a meal, having a drink, whatever it is with another CISO or a bunch of CISOs, there's a tremendous amount of value in that networking.
00:09:26.960 --> 00:09:33.600
And I think that a lot of people overlook that as just, oh, you know, we're we're just gonna get together and have a fun time.
00:09:33.759 --> 00:09:33.919
No.
00:09:34.159 --> 00:09:35.279
But there's value to it.
00:09:35.440 --> 00:09:36.240
There, there really is.
00:09:36.320 --> 00:09:39.039
And and and I think getting them to understand that.
00:09:39.200 --> 00:09:52.799
And the other thing that does is really is um, you know, I'll be honest with you, getting students and and people coming into our our our careers, you know, they're shy, right?
00:09:52.879 --> 00:09:59.120
We we've all you and I have mentored a lot of people who I think by design though, tech people are geeks.
00:09:59.440 --> 00:10:00.240
COVID didn't help.
00:10:00.559 --> 00:10:01.360
COVID didn't help.
00:10:01.759 --> 00:10:05.679
Um, we we talked to the kids about, you know, how do I get that first opportunity?
00:10:05.840 --> 00:10:07.360
You know, how do I create value?
00:10:07.519 --> 00:10:08.639
How do I get that buy-in?
00:10:08.960 --> 00:10:10.879
I think they're all around the same premise, though.
00:10:11.200 --> 00:10:16.399
And and it's sometimes it's hard in getting getting your thoughts together.
00:10:16.559 --> 00:10:19.679
And unfortunately, if you if you have the breach, that makes it kind of easy.
00:10:19.759 --> 00:10:20.080
Yeah.
00:10:20.320 --> 00:10:21.919
But it's it's it's a lot.
00:10:22.000 --> 00:10:26.080
It's a it's uh it's the reason why we created pretty secure with me and my team.
00:10:26.240 --> 00:10:30.080
I want to make sure that everyone is getting getting nourished, if that makes sense.
00:10:30.559 --> 00:10:31.120
Absolutely.
00:10:31.279 --> 00:10:31.600
Yeah.
00:10:31.840 --> 00:10:33.679
Um and next question.
00:10:33.840 --> 00:10:34.000
Sure.
00:10:34.240 --> 00:10:37.600
And AI, identity, resilience are all shaping our industry.
00:10:37.679 --> 00:10:42.240
And I I I I hate that the word resilience is becoming a buzzword because you know it's my favorite.
00:10:42.559 --> 00:10:49.120
But looking ahead in the next three to five years, um, what capabilities do you feel that every organization should prioritize?
00:10:49.200 --> 00:10:52.720
Um don't say AI, I'm taking AI away, no AI governance.
00:10:52.960 --> 00:11:00.320
And to stay in line, because I I know we're here in Palm Beach, Florida, and just some of the amazing things that are coming down the pipeline with quantum.
00:11:00.559 --> 00:11:05.919
Um, what do you what do you feel the next three to five years are going to look like for tech and separately cyber?
00:11:06.480 --> 00:11:16.399
So um, well, the separately kind of kind of that that that's a curveball because I I think they're, you know, look, they're they're merging more than they're separating.
00:11:16.720 --> 00:11:17.039
They are.
00:11:17.679 --> 00:11:26.720
Um I I am a a firm believer, and I've been saying this for years, that our last bastion of security is identity.
00:11:26.879 --> 00:11:27.039
Yep.
00:11:27.279 --> 00:11:27.600
Right?
00:11:28.000 --> 00:11:42.879
Um, I there's no way you're going to control AI with between all of the agents and everything going on with what's being deployed in enterprises right now, without understanding the agency of what those agents are doing, right?
00:11:43.279 --> 00:11:45.200
That is based in identity.
00:11:45.440 --> 00:12:00.639
And we need to get we we fundamentally need to change our approach to identity from a oh set up a user account so somebody can do work to being, you know, a the the true core of our security programs.
00:12:00.879 --> 00:12:03.919
Um that's exactly what the book was about, right?
00:12:04.159 --> 00:12:21.919
So um, you know, I I don't think anyone will be able to build a successful security program without understanding that and how it it it will impact the organization and the security program in I don't even think it's gonna be three years.
00:12:22.080 --> 00:12:23.279
I think it's gonna be less than that.
00:12:23.679 --> 00:12:26.960
Yeah, and the way things are changing, he just did like a quick nugget, guys.
00:12:27.039 --> 00:12:28.000
He just went over the book.
00:12:28.159 --> 00:12:29.759
You tell me about the book.
00:12:30.240 --> 00:12:36.720
Uh so the the book is um you know years of standing on a soapbox and talking about identity management.
00:12:37.039 --> 00:12:37.360
I understand.
00:12:37.440 --> 00:12:38.799
I had one for critical infrastructure.
00:12:39.519 --> 00:12:40.320
There you go, right?
00:12:40.480 --> 00:12:46.879
So it's really about how to um to build in uh uh an enterprise identity operating system, right?
00:12:47.200 --> 00:13:11.679
Uh so it so it it touches on everything from you know the the very basic fundamentals about identity management, um, all the way through uh virtual directory services, identity warehouses, uh and you know esoteric things like distributed identities and and you know manage identities on on uh uh um Bitcoin-like infrastructure.
00:13:12.399 --> 00:13:12.879
Yeah, yeah, yeah.
00:13:13.679 --> 00:13:16.000
Um, and and everything in between.
00:13:16.159 --> 00:13:28.240
And and you know, it really is w when you start looking at um all of the challenges that you know, especially over the last couple of years with AI, it's really come to light, right?
00:13:29.519 --> 00:13:36.320
We there are fundamentally programs that are running that you cannot tell.
00:13:36.480 --> 00:13:41.759
A, it's not a human, and B, it looks like malware, right?
00:13:42.000 --> 00:13:44.320
It's doing things automated, right?
00:13:44.559 --> 00:13:52.559
You have one agent fire off another bunch of agents, fire off another bunch of services, connect to APIs, do all this kind of stuff, and you go, that's kind of ransomware, right?
00:13:52.639 --> 00:14:00.000
I mean, it's it's out there gathering all this information, but yet it's something that is encouraged and supported within the infrastructure.
00:14:00.159 --> 00:14:14.559
So without knowing what agents can do what, what tenancy they have, who who is ultimately, what human is ultimately responsible for the decisions that agent makes, you're never going to have control over it.
00:14:14.799 --> 00:14:22.720
And the reality is the government and you know, all the regulators are now hyper focused on how you're managing AI and enterprises.
00:14:22.879 --> 00:14:25.039
So it's kind of all coming together.
00:14:25.279 --> 00:14:25.600
Okay.
00:14:25.919 --> 00:14:30.559
And you're not going to manage all of that if the only thing you have is Azure.
00:14:31.440 --> 00:14:31.679
Right?
00:14:32.000 --> 00:14:33.600
We're not taking a jab set Microsoft.
00:14:34.000 --> 00:14:36.480
We're not no, the point is, right?
00:14:36.639 --> 00:14:41.679
Everybody, that's everybody's foundation for users is is Microsoft, right?
00:14:42.240 --> 00:14:45.519
It's not a jab, it's a fantastic business model, right?
00:14:45.679 --> 00:14:47.200
Yeah, no, make yourself the prime.
00:14:47.919 --> 00:14:48.320
Exactly.
00:14:48.639 --> 00:14:52.320
No, it's this, it's an amazing time to be in technology.
00:14:52.799 --> 00:14:53.039
Really?
00:14:53.440 --> 00:14:57.120
Um AI, quantum, you know, what's the comic gave it?
00:14:57.200 --> 00:14:57.600
You said you're right.
00:14:57.679 --> 00:14:58.639
It's not three to five years.
00:14:58.720 --> 00:15:00.799
It's probably 18 months, I would think.
00:15:00.960 --> 00:15:01.200
Yeah.
00:15:01.440 --> 00:15:08.639
Um, with all the different models and the holes, and and and it's just it's time for us to take serious our discipline.
00:15:08.720 --> 00:15:17.600
I always looked at cybersecurity, um, I I don't know if it's in its infancy, in the sense that it it is progressing organically.
00:15:17.840 --> 00:15:23.600
Like I think about how nursing or psychology or some of the other disciplines are much, much older, much, much more established.
00:15:23.759 --> 00:15:26.320
Cyber uh cybersecurity is in that growth phase.
00:15:26.720 --> 00:15:37.120
And we as practitioners, we as future practitioners have to, you know, get on your soapbox and and express what's going to be necessary to keep us safe.
00:15:37.279 --> 00:15:37.600
Yeah.
00:15:37.840 --> 00:15:44.559
And we've seen so many different breaches, we've seen so many different, you know, my kids, my my kids' information is already on the dark web.
00:15:44.720 --> 00:15:45.279
Yeah.
00:15:45.519 --> 00:15:47.519
That's just the truth of the matter.
00:15:47.759 --> 00:15:57.519
Um So I think conversations like this, um, books, it we all need to continue to do that lifetime learning, and and it's changing so fast.
00:15:57.679 --> 00:16:01.200
I don't want anyone to think that I have an answer or John has an answer.
00:16:01.279 --> 00:16:04.399
Um, but it's it's it's an an amazing time to be in tech.
00:16:04.799 --> 00:16:11.039
I I was having Greg, I was having a conversation uh last week with with someone completely non-technical.
00:16:11.360 --> 00:16:11.519
Okay.
00:16:11.840 --> 00:16:19.279
Um, and they were talking about how you know they went and did the um the DNA test and how they found out all the roots and all that kind of stuff.
00:16:19.360 --> 00:16:21.759
I said, Well, how do your kids feel about that?
00:16:22.159 --> 00:16:23.200
And she goes, Well, what do you mean?
00:16:23.279 --> 00:16:31.600
I was well, well, now all of your DNA, which your kids now share, now all of that information is is in the public domain, right?
00:16:32.080 --> 00:16:37.440
If there's a breach, whatever, but now some company has the DNA of your kids.
00:16:38.000 --> 00:16:39.279
Did you ever give that any thought?
00:16:39.440 --> 00:16:39.600
Right?
00:16:39.840 --> 00:16:40.879
The average consumer doesn't.
00:16:41.279 --> 00:16:42.879
No, and and you know what?
00:16:43.519 --> 00:16:45.039
Nor should they, right?
00:16:45.360 --> 00:16:47.120
Ultimately, nor should they, right?
00:16:47.200 --> 00:16:52.399
I mean, I I don't I don't know if many people approach life like we do, right?
00:16:52.879 --> 00:16:53.679
I'm not doing that.
00:16:54.159 --> 00:16:54.960
I'm not doing it either.
00:16:55.840 --> 00:16:56.159
Yeah.
00:16:56.320 --> 00:16:59.120
Um, but you know, the reality is, and that's what you think about, right?
00:16:59.200 --> 00:17:06.559
So did that did that mother violate the privacy of her children by sharing their DNA, right?
00:17:06.720 --> 00:17:10.000
It's but that's the slope that we're rapidly getting to.
00:17:10.160 --> 00:17:10.720
Yeah, right.
00:17:11.680 --> 00:17:27.359
Yeah, and that's it, that's that's where we when you start thinking about all the different things that aren't necessarily security, but maybe the intersection of privacy and security and you know, consumer, and it just it's it's the next 36 months are going to be wild.
00:17:27.680 --> 00:17:28.480
And I giggle.
00:17:28.720 --> 00:17:31.519
And there are other countries that are a little more progressive than than where we are.
00:17:31.839 --> 00:17:32.240
Just a little bit.
00:17:32.480 --> 00:17:33.119
Just a little bit.
00:17:33.279 --> 00:17:37.920
Um, and it's you know, other places we're we're choosing to opt in and not opt out.
00:17:38.240 --> 00:17:38.880
Correct.
00:17:39.200 --> 00:17:42.559
And that that should speak something like boom.
00:17:42.640 --> 00:17:42.799
Yeah.
00:17:42.960 --> 00:17:51.279
Where you know it it's I try to remind my kids and my young folks in my in my world, even my mom, I'm like, you have to understand that you are you are the product.
00:17:51.440 --> 00:17:56.720
Like you are what they want, you the scrolling, your marketing, your your raw data.
00:17:56.799 --> 00:17:59.200
And we we we as consumers have to look at that.
00:17:59.519 --> 00:18:07.519
And we have our own level of cybersecurity and and just restraint, I think, that we should have at least that forethought before we do that.
00:18:07.680 --> 00:18:10.799
I mean, that and that might be good for her, you know, that might be okay.
00:18:11.200 --> 00:18:12.079
Not okay for me.
00:18:12.319 --> 00:18:13.200
Yeah, I get it.
00:18:13.359 --> 00:18:18.240
But we all need to see where we are in that spectrum and and 100%.
00:18:19.599 --> 00:18:21.200
Um, last question.
00:18:21.440 --> 00:18:32.480
And this is for my career changers, this is for my career developers, and I I get a lot of outreach um on this topic more than anything, because I think everyone is trying to figure out how to break into cyber.
00:18:32.720 --> 00:18:37.200
And I I tell my students all the time, do not tell me you work in cybersecurity.
00:18:37.359 --> 00:18:38.960
That's like saying you're a doctor.
00:18:39.200 --> 00:18:40.240
Are you a leg doctor?
00:18:40.319 --> 00:18:41.200
Are you a foot doctor?
00:18:41.279 --> 00:18:42.480
Are you a butt doctor?
00:18:42.640 --> 00:18:43.599
You can't tell me.
00:18:43.839 --> 00:18:49.359
You you uh I think one thing that's so unique about this discipline is that it's so diverse.
00:18:49.920 --> 00:18:53.920
Um, there are folks who have never coded anything that have worked in cybersecurity for 20 years.
00:18:54.000 --> 00:18:57.680
There are folks that never leave the command um command line.
00:18:57.839 --> 00:19:12.400
Um, for our students, career changers, early career professionals listening today, what qualities separate someone who is simply in cybersecurity from someone who is truly becoming a cybersecurity leader?
00:19:17.279 --> 00:19:33.279
Um so I I think you know, one of the things that I look for um every one of my organizations I've built the teams.
00:19:34.079 --> 00:19:44.319
So, you know, there's there are definitely people who uh will never be a CISO for very valid reasons, right?
00:19:44.720 --> 00:19:50.880
Um when you sit down, you meet with them, you see how they interact, you know they love the tech, right?
00:19:51.359 --> 00:19:57.759
They have zero desire to go sit in board meetings or to be you know in project meetings or anything like that, right?
00:19:58.000 --> 00:19:58.559
That's a part of it.
00:19:58.960 --> 00:20:05.759
So you know, there's there's a part of this discussion that needs to understand where the ultimate goal is, right?
00:20:05.839 --> 00:20:08.400
And certainly for the new career people, they have no idea, right?
00:20:08.480 --> 00:20:09.680
It's way too fair, right?
00:20:10.640 --> 00:20:15.519
But being a CISO isn't necessarily the ultimate goal, right?
00:20:15.680 --> 00:20:30.480
Being that chief security architect, being that, you know, chief identity, you know, manager, whatever it is, there's so many, to your point, so many different career paths in our in our industry right now.
00:20:31.279 --> 00:20:31.519
Anybody.
00:20:32.799 --> 00:20:33.839
That's the part that's killing me.
00:20:34.960 --> 00:20:39.599
And honestly, I mean, there are people who want nothing to do with tech and who are still in cybersecurity, right?
00:20:39.680 --> 00:20:41.839
They do GRC and they do policy and they love it.
00:20:42.000 --> 00:20:42.240
Yep.
00:20:42.400 --> 00:20:42.640
Right?
00:20:43.039 --> 00:20:58.000
So, you know, they that's understanding that this industry can provide you with virtually any career path you want, is really it's both the benefit and the challenge of it, right?
00:20:58.240 --> 00:20:59.200
Very much so, right?
00:20:59.440 --> 00:21:02.559
You know, it takes a lot of soul searching, right?
00:21:02.720 --> 00:21:06.480
When when when I got into it, you know, it was a little simpler, me too.
00:21:06.720 --> 00:21:08.240
It was the last simples, right?
00:21:08.480 --> 00:21:08.640
Yes.
00:21:09.279 --> 00:21:31.200
I mean, you know, I I uh I was telling, you know, uh the story a while ago about you know, I I moved to Charlotte one uh with a with a with a consulting firm because a bank that was our our client wanted to put a stock trading platform on this new thing called the internet, right?
00:21:31.839 --> 00:21:36.480
Um you know, and I and I think about you know my kids now, right?
00:21:36.640 --> 00:21:40.000
They they don't know a world without that, right?
00:21:40.559 --> 00:21:44.240
Um I I remember putting together token ring networks, right?
00:21:44.319 --> 00:21:47.839
And I you know the vast majority of people who listen to this would never even know what that is.
00:21:48.079 --> 00:21:48.559
Oh, Google.
00:21:48.960 --> 00:21:54.400
So you know, so you know, the the world has changed so drastically.
00:21:54.480 --> 00:21:57.839
And to the cut point we were just having, it's still changing, right?
00:21:58.319 --> 00:21:59.759
And we'll continue to change AI and quantum.
00:22:00.160 --> 00:22:02.160
Quantum, you know, it wasn't that long ago.
00:22:02.240 --> 00:22:05.440
We were going, come on, quantum really, is it really going to bother us, right?
00:22:05.599 --> 00:22:05.920
Yes.
00:22:06.240 --> 00:22:14.079
And and you know, I that's another soapbox I kind of get on because as security professionals, I don't think we're proactive enough in some cases, right?
00:22:14.720 --> 00:22:15.599
That's another episode.
00:22:15.680 --> 00:22:17.440
We can come back and talk about that one.
00:22:17.680 --> 00:22:27.839
But but that you know, the reality is between quantum and AI, you know, there's you know, understanding and trying to get back to to your direct question.
00:22:29.440 --> 00:22:31.920
Take every opportunity you can.
00:22:32.240 --> 00:22:38.000
If someone says, go on this project, your answer should never be, I don't know how to do that.
00:22:38.079 --> 00:22:39.759
The answer should be, I'll figure it out.
00:22:40.319 --> 00:22:40.640
Right.
00:22:40.960 --> 00:22:46.720
Um, and and that's really, you know, for a lot of us old timers, that's all we had to do.
00:22:46.880 --> 00:22:48.000
We had to go figure it out.
00:22:48.240 --> 00:22:55.599
And I think when you look at um a lot of the people who've been successful, that's really kind of their their moniker, right?
00:22:55.759 --> 00:22:58.240
They figured out how to be successful.
00:22:58.400 --> 00:23:08.319
That's when when I when I hire people, especially people who are just getting in the industry, uh degrees, certifications.
00:23:08.400 --> 00:23:09.839
I mean gotta be hungry.
00:23:10.000 --> 00:23:12.559
Yeah, but but I also want you to be curious, right?
00:23:12.640 --> 00:23:18.960
I want you to, I want you to I want you to get passionate telling me how you set up that lab at home, right?
00:23:19.119 --> 00:23:24.880
Or how you failed five times trying to install Linux on your Windows workstation, you finally got it to work, right?
00:23:25.200 --> 00:23:31.680
That's the kind of curiosity and drive that I think makes good cyber professionals.
00:23:32.160 --> 00:23:42.720
And it really, you know, it kind of goes a long way because everything we do, if we look at the SOC, every day is trying to unwind what you see and trying to figure it out, right?
00:23:42.960 --> 00:23:43.759
That's what we do.
00:23:43.920 --> 00:23:46.079
So John, I want to thank you.
00:23:46.319 --> 00:23:46.799
Thank you.
00:23:47.039 --> 00:23:49.839
It is always a pleasure to sit at a dance with you and hang out.
00:23:50.160 --> 00:23:51.839
All we're missing is like good coffee.
00:23:52.079 --> 00:23:55.599
Um I want to thank you guys for listening with us today.
00:23:55.759 --> 00:23:58.079
Um, we are planning to do this.
00:23:58.240 --> 00:24:01.279
Um, everyone knows that um I love my community.
00:24:01.359 --> 00:24:04.559
I think that this is gonna be part of me giving back.
00:24:04.640 --> 00:24:10.400
Um, if you enjoyed the episode, uh go ahead and share it with someone who you think can take value from it.
00:24:10.559 --> 00:24:12.880
You know, listen to it wherever you get your podcast.
00:24:13.119 --> 00:24:18.880
Um, my closing question, John, what is something that someone can do?
00:24:19.119 --> 00:24:24.640
Um take one thing for next week that someone can do to help them be just a little bit more resilient.
00:24:25.279 --> 00:24:27.279
A little bit more resilient.
00:24:27.599 --> 00:24:30.400
Um boy.
00:24:30.960 --> 00:24:32.720
That was your last question.
00:24:33.039 --> 00:24:34.000
Just a simple thing.
00:24:34.079 --> 00:24:41.200
We're not we're not gonna take it long because at the end of each episode, I want to leave our audience with that thing from your perspective.
00:24:41.359 --> 00:24:43.920
Maybe it's maybe it's leadership, maybe it's even your home.
00:24:44.079 --> 00:24:48.000
I love the example you gave with the young lady and giving her DNA away.
00:24:48.160 --> 00:25:00.960
These are all different topics that our community needs to hear about, whether it's through a book, whether it's through a podcast, whether it's through a Google, we need to start being more conscious of our data, of what privacy and and what privacy should mean to us.
00:25:01.119 --> 00:25:09.200
And as we continue to build ourselves wherever you are in your spectrum of cybersecurity or AI, that we we need to can challenge ourselves.
00:25:09.359 --> 00:25:12.319
So is there is there one take, and there might not be a takeaway, you know.
00:25:12.480 --> 00:25:20.319
Is there one takeaway that you would suggest to our our our listeners, our viewers, that um you think that is that value add for them?
00:25:22.160 --> 00:25:26.000
Um you know what?
00:25:26.079 --> 00:25:28.640
I I'm gonna fall back on what I just said.
00:25:28.960 --> 00:25:31.519
Find a way to be curious about something, right?
00:25:32.079 --> 00:25:40.079
Do something, you know, uh that I again find that old laptop and do something with it, right?
00:25:40.240 --> 00:25:45.039
Um convert your iPad to a Kindle reader, whatever it is, right?
00:25:45.680 --> 00:25:52.240
Be find a way to be curious, especially for those people who are just getting into the industry.
00:25:52.480 --> 00:25:59.920
Find a way to be curious and and find a way to be able to explain it and talk about it.
00:26:00.240 --> 00:26:00.559
Yep.
00:26:00.880 --> 00:26:02.079
Thank you so much for joining us.
00:26:02.160 --> 00:26:03.519
We'll see you guys next time.
00:00:05.280 --> 00:00:06.080
Hi I'm Dr.
00:00:06.160 --> 00:00:08.800
Natalie Foster Johnson and welcome to Pretty Secure.
00:00:09.119 --> 00:00:11.199
We are kicking off our first episode.
00:00:11.359 --> 00:00:16.960
Yes, I said our first episode of Pretty Secure, and this is this is that thing you dream of.
00:00:17.039 --> 00:00:26.399
I've I've had such an amazing career, and a couple of my friends I love said that I should share that and I should I should get into the world of digital media.
00:00:26.559 --> 00:00:27.199
Go figure.
00:00:27.359 --> 00:00:29.199
I hate the sound of my voice, people knows that.
00:00:29.359 --> 00:00:35.119
But I think that we have an opportunity here to give back to our community, and it's about resilience.
00:00:35.280 --> 00:00:39.200
It's about education, it's about bringing each other up in a sincere way.
00:00:39.439 --> 00:00:41.119
I am here with my first guest.
00:00:41.520 --> 00:00:42.880
John, do you want to introduce yourself?
00:00:43.280 --> 00:00:43.439
Sure.
00:00:43.520 --> 00:00:48.240
John Masserini, uh currently uh uh founder of Senecon Security.
00:00:48.320 --> 00:00:53.520
Uh I do a lot of VCSO work, a lot of uh board advisory services, a lot of mentoring.
00:00:53.600 --> 00:01:00.000
Uh and um just love the fact that you you invited me and and uh appreciate the time we're spending together.
00:01:00.320 --> 00:01:14.640
And if people don't know, John is also uh one of my beloved members of CyberC South Florida, uh 501c3 that supports the the growth of black and brown career changers, young folks, anyone who feels that cybersecurity is a place for them.
00:01:14.799 --> 00:01:17.680
Because um, one of the things you guys know is it's my tribe.
00:01:17.760 --> 00:01:20.560
It's about giving people what they need to be successful.
00:01:20.719 --> 00:01:24.000
Uh, I think both of us have had a wonderful career in cybersecurity.
00:01:24.159 --> 00:01:26.000
I have had an absolute ball.
00:01:26.079 --> 00:01:30.959
Um, but there's so many people fighting to get into cybersecurity and and technology.
00:01:31.120 --> 00:01:46.799
So, what we need to do with Pretty Secure is create a threshold, create a connection so regular folks, people in between career, even our seasoned veterans like like John, can find somewhere that they can come to and find relevant information to help them grow.
00:01:47.599 --> 00:01:50.879
I came up with some some weird questions, actually asked my AI.
00:01:51.120 --> 00:01:53.439
Um what should I ask John?
00:01:53.760 --> 00:01:59.599
John has has seen things that people we probably won't see, and I don't want clearance to see.
00:02:00.000 --> 00:02:05.040
Um, but I want to make sure that this episode, this first episode, has something for a little a little bit of everyone.
00:02:05.200 --> 00:02:10.960
So let's talk about our CISOs, because I think our CISOs, that that tone at the top, that ability to lead.
00:02:11.039 --> 00:02:20.000
Um, I feel like they they get they get some heavy weight, and with everything happening with the SEC rules, and the I I think the world waking up for cybersecurity, we need to talk to them first.
00:02:20.240 --> 00:02:27.199
So you've served as CISO across so many different organizations, and you now advise as a founder, a mentor.
00:02:27.360 --> 00:02:32.240
Um, what are the bus biggest misconceptions that CISOs are going through right now for cybersecurity?
00:02:32.719 --> 00:02:41.439
So I think uh, you know, the the biggest challenge a lot of CISOs have is, you know, they inadvertently bring a lot of legacy with them, right?
00:02:41.599 --> 00:02:44.319
Um I've been doing this for 30 years.
00:02:44.560 --> 00:02:52.000
Uh the CISO role that I had uh 20 years ago is very different than the CISO roles that are that the CISOs face now.
00:02:52.240 --> 00:02:52.479
I bet.
00:02:52.879 --> 00:03:06.719
Um yeah, so so you know, it's there's still, you know, for for good or for bad, um, when you look at the executives and and the boards, there's still a lot of, you know, the the security is that black hole.
00:03:06.879 --> 00:03:09.680
Money goes in, what do we really get out of it, right?
00:03:10.319 --> 00:03:21.759
Um we've had we have a lot stronger models today that talk to the return on investment uh of security and and the true benefit that it brings uh to the organization.
00:03:22.080 --> 00:03:38.400
You know, one of the one of the kind of driving um uh uh kind of teachings that I that I like to um, not just to CISOs, but when I do board advisory work, is really around, you know, I I compare it to a car, believe it or not.
00:03:38.719 --> 00:03:39.039
Okay.
00:03:39.199 --> 00:03:39.439
Right?
00:03:39.919 --> 00:03:44.240
Um how fast would you drive a car if you never had any brakes?
00:03:44.560 --> 00:03:45.199
I wouldn't.
00:03:45.520 --> 00:03:47.199
I've done that in my my high school years, honestly.
00:03:48.639 --> 00:03:49.039
Right, right.
00:03:49.599 --> 00:03:50.879
We'd be the Flintstones, right?
00:03:50.960 --> 00:03:52.240
We'd be peddling, right?
00:03:52.719 --> 00:03:54.560
That's how security is, right?
00:03:54.719 --> 00:03:56.000
Security doesn't stop you.
00:03:56.159 --> 00:03:59.120
Security is no longer the organization of no.
00:03:59.520 --> 00:04:08.560
We're there to allow you to go, to allow the businesses to go as fast as they can, as fast as they want, knowing we're gonna be able to stop if something bad happens.
00:04:08.800 --> 00:04:09.439
Okay, right.
00:04:09.599 --> 00:04:15.039
And that's a really different kind of vision than a lot of people deal with, right?
00:04:15.120 --> 00:04:19.519
It's a a lot of people look at security as strictly a technology issue, right?
00:04:19.600 --> 00:04:19.839
Right.
00:04:20.079 --> 00:04:24.319
A, you know, I don't want to be in, I don't want to be in the headlines, right?
00:04:24.560 --> 00:04:30.399
I don't I don't want to have to deal with the SEC coming in and doing an audit or something because we had a breach.
00:04:30.560 --> 00:04:32.399
So protect me from that.
00:04:32.720 --> 00:04:38.160
When the right approach is, how can you help me drive business, right?
00:04:38.319 --> 00:04:40.879
How can we integrate that company we just bought?
00:04:41.040 --> 00:04:46.480
How can we integrate it faster and see the value of the purchase and the acquisition?
00:04:46.720 --> 00:04:48.399
How can it help our whole company, right?
00:04:48.480 --> 00:04:57.040
And security, you know, unlike technology in general or you know, finance or audit, security sees everything.
00:04:57.279 --> 00:04:58.319
We're in the middle, right?
00:04:58.399 --> 00:04:58.639
Yep.
00:04:58.959 --> 00:05:05.040
So so it it regardless of what's happening in the company, we get involved in it.
00:05:05.199 --> 00:05:10.000
So we have that one unique perspective that no one else can really bring.
00:05:10.480 --> 00:05:11.839
And we have a lot to offer on that.
00:05:11.920 --> 00:05:19.519
And that's where I think a lot of the CISOs today are, you know, when if they focus on that area and they're realizing that, right?
00:05:19.680 --> 00:05:22.720
And you know, we have some great CISO friends down here.
00:05:22.959 --> 00:05:28.079
And the success, when you look at them, they're successful because they understand that, right?
00:05:28.319 --> 00:05:34.480
They're not just throwing money after tools or that they don't just want to hire the biggest, you know, number of people they can.
00:05:34.720 --> 00:05:36.639
They want to solve the business problems, right?
00:05:36.720 --> 00:05:40.480
And and that that's really when you look at successful CISOs, that's what they're trying to do.
00:05:40.879 --> 00:05:46.959
Um I I heard it phrased as we have to stop looking at security as a cost center.
00:05:47.360 --> 00:05:48.079
Exactly.
00:05:48.319 --> 00:06:01.920
Um and and more mature organizations, I'm not picking on anyone because I feel like everyone is in in their different step depending on your regulation, depending on um who's you know what who's got breached lately, honestly.
00:06:02.240 --> 00:06:08.160
Um but we again have to see it as a tool that enhances business as opposed as that cost-centric.
00:06:08.319 --> 00:06:10.800
Because in and in reality, it it is truthful.
00:06:10.879 --> 00:06:12.720
A lot of the tools cost a lot of money.
00:06:12.959 --> 00:06:13.279
Of course.
00:06:13.600 --> 00:06:24.480
And uh PCI, whether it's ISO, whether whatever, whatever your requirement in, you have to understand where you are in your your risk prioritization and and make those choices as a CISO.
00:06:25.199 --> 00:06:34.319
Um, my next question was um you often talk about aligning those cybersecurity um requirements and needs with business outcomes.
00:06:34.560 --> 00:06:38.800
What is your advice to security leaders who are struggling to get buy-in from their board?
00:06:38.959 --> 00:06:43.040
So this is those middle managers, folks that are in in the trenches.
00:06:43.199 --> 00:06:48.319
Like, how do you sell the value of cybersecurity to that board person that doesn't understand?
00:06:48.800 --> 00:06:50.639
Well, and and that's the challenge, right?
00:06:50.720 --> 00:07:10.399
Uh the challenge is getting, you know, a lot of the uh a lot of the mentoring that I do is for those individuals who have come up through the technology organization uh and who are, for right or for wrong, anointed to be the CISO, right?
00:07:10.720 --> 00:07:18.959
Um whether it's because of a breach or whether it's just because of an audit that happened and they said you need a CISOs, now you're the CISO, right?
00:07:19.279 --> 00:07:30.160
Um getting that that level uh of CISO to understand the business value, and it's not just technology, because that's where they grew up.
00:07:30.319 --> 00:07:32.639
That's where a lot of the mentoring comes in, right?
00:07:32.959 --> 00:07:45.439
Um a lot of people, and this is I think it's regardless of whether you're in security or whatever, a lot of people who are working through their career are scared to ask for a mentor, right?
00:07:45.600 --> 00:07:52.160
They're scared to go, look, I I need help to understand how the business side of this works.
00:07:52.560 --> 00:08:01.279
Believe it or not, most boards, most executive teams will acknowledge that and and actually be very respectful of it, right?
00:08:01.759 --> 00:08:11.680
Um getting that assistance and and and finding that person who can help bridge that gap is only gonna be better for the organization, right?
00:08:12.399 --> 00:08:18.959
Um so getting them to understand that is is really it's a hard conversation because it's hard.
00:08:19.199 --> 00:08:23.279
Look, it it's hard for me as a person to ask for help, right?
00:08:23.600 --> 00:08:29.920
You you put me in this position, I'm gonna knock it out of the park and and I'm I'm gonna be everything you think I can be.
00:08:30.560 --> 00:08:33.919
But you know, we don't have we don't let our kids do that, right?
00:08:34.000 --> 00:08:35.360
We don't let students do that.
00:08:35.519 --> 00:08:39.039
Why should we do that as we go through our career as professionals, right?
00:08:39.200 --> 00:08:45.840
So um, you know, understanding that the value that mentorship brings um is really critical.
00:08:46.000 --> 00:08:57.279
But that's you know, even if you can't get the mentorship, there's plenty of organizations out there that, you know, go honestly, go hang out with other CISOs, right?
00:08:57.440 --> 00:09:01.039
It's uh I I don't want to say we commiserate, but we commiserate.
00:09:03.840 --> 00:09:07.360
Um you know, every organization is different, right?
00:09:07.519 --> 00:09:08.559
But that's that's a given.
00:09:08.720 --> 00:09:16.720
So what works for one company won't work for another company, but understanding how they got to where they are is very valuable, right?
00:09:16.879 --> 00:09:26.879
So just sitting down, you know, having a meal, having a drink, whatever it is with another CISO or a bunch of CISOs, there's a tremendous amount of value in that networking.
00:09:26.960 --> 00:09:33.600
And I think that a lot of people overlook that as just, oh, you know, we're we're just gonna get together and have a fun time.
00:09:33.759 --> 00:09:33.919
No.
00:09:34.159 --> 00:09:35.279
But there's value to it.
00:09:35.440 --> 00:09:36.240
There, there really is.
00:09:36.320 --> 00:09:39.039
And and and I think getting them to understand that.
00:09:39.200 --> 00:09:52.799
And the other thing that does is really is um, you know, I'll be honest with you, getting students and and people coming into our our our careers, you know, they're shy, right?
00:09:52.879 --> 00:09:59.120
We we've all you and I have mentored a lot of people who I think by design though, tech people are geeks.
00:09:59.440 --> 00:10:00.240
COVID didn't help.
00:10:00.559 --> 00:10:01.360
COVID didn't help.
00:10:01.759 --> 00:10:05.679
Um, we we talked to the kids about, you know, how do I get that first opportunity?
00:10:05.840 --> 00:10:07.360
You know, how do I create value?
00:10:07.519 --> 00:10:08.639
How do I get that buy-in?
00:10:08.960 --> 00:10:10.879
I think they're all around the same premise, though.
00:10:11.200 --> 00:10:16.399
And and it's sometimes it's hard in getting getting your thoughts together.
00:10:16.559 --> 00:10:19.679
And unfortunately, if you if you have the breach, that makes it kind of easy.
00:10:19.759 --> 00:10:20.080
Yeah.
00:10:20.320 --> 00:10:21.919
But it's it's it's a lot.
00:10:22.000 --> 00:10:26.080
It's a it's uh it's the reason why we created pretty secure with me and my team.
00:10:26.240 --> 00:10:30.080
I want to make sure that everyone is getting getting nourished, if that makes sense.
00:10:30.559 --> 00:10:31.120
Absolutely.
00:10:31.279 --> 00:10:31.600
Yeah.
00:10:31.840 --> 00:10:33.679
Um and next question.
00:10:33.840 --> 00:10:34.000
Sure.
00:10:34.240 --> 00:10:37.600
And AI, identity, resilience are all shaping our industry.
00:10:37.679 --> 00:10:42.240
And I I I I hate that the word resilience is becoming a buzzword because you know it's my favorite.
00:10:42.559 --> 00:10:49.120
But looking ahead in the next three to five years, um, what capabilities do you feel that every organization should prioritize?
00:10:49.200 --> 00:10:52.720
Um don't say AI, I'm taking AI away, no AI governance.
00:10:52.960 --> 00:11:00.320
And to stay in line, because I I know we're here in Palm Beach, Florida, and just some of the amazing things that are coming down the pipeline with quantum.
00:11:00.559 --> 00:11:05.919
Um, what do you what do you feel the next three to five years are going to look like for tech and separately cyber?
00:11:06.480 --> 00:11:16.399
So um, well, the separately kind of kind of that that that's a curveball because I I think they're, you know, look, they're they're merging more than they're separating.
00:11:16.720 --> 00:11:17.039
They are.
00:11:17.679 --> 00:11:26.720
Um I I am a a firm believer, and I've been saying this for years, that our last bastion of security is identity.
00:11:26.879 --> 00:11:27.039
Yep.
00:11:27.279 --> 00:11:27.600
Right?
00:11:28.000 --> 00:11:42.879
Um, I there's no way you're going to control AI with between all of the agents and everything going on with what's being deployed in enterprises right now, without understanding the agency of what those agents are doing, right?
00:11:43.279 --> 00:11:45.200
That is based in identity.
00:11:45.440 --> 00:12:00.639
And we need to get we we fundamentally need to change our approach to identity from a oh set up a user account so somebody can do work to being, you know, a the the true core of our security programs.
00:12:00.879 --> 00:12:03.919
Um that's exactly what the book was about, right?
00:12:04.159 --> 00:12:21.919
So um, you know, I I don't think anyone will be able to build a successful security program without understanding that and how it it it will impact the organization and the security program in I don't even think it's gonna be three years.
00:12:22.080 --> 00:12:23.279
I think it's gonna be less than that.
00:12:23.679 --> 00:12:26.960
Yeah, and the way things are changing, he just did like a quick nugget, guys.
00:12:27.039 --> 00:12:28.000
He just went over the book.
00:12:28.159 --> 00:12:29.759
You tell me about the book.
00:12:30.240 --> 00:12:36.720
Uh so the the book is um you know years of standing on a soapbox and talking about identity management.
00:12:37.039 --> 00:12:37.360
I understand.
00:12:37.440 --> 00:12:38.799
I had one for critical infrastructure.
00:12:39.519 --> 00:12:40.320
There you go, right?
00:12:40.480 --> 00:12:46.879
So it's really about how to um to build in uh uh an enterprise identity operating system, right?
00:12:47.200 --> 00:13:11.679
Uh so it so it it touches on everything from you know the the very basic fundamentals about identity management, um, all the way through uh virtual directory services, identity warehouses, uh and you know esoteric things like distributed identities and and you know manage identities on on uh uh um Bitcoin-like infrastructure.
00:13:12.399 --> 00:13:12.879
Yeah, yeah, yeah.
00:13:13.679 --> 00:13:16.000
Um, and and everything in between.
00:13:16.159 --> 00:13:28.240
And and you know, it really is w when you start looking at um all of the challenges that you know, especially over the last couple of years with AI, it's really come to light, right?
00:13:29.519 --> 00:13:36.320
We there are fundamentally programs that are running that you cannot tell.
00:13:36.480 --> 00:13:41.759
A, it's not a human, and B, it looks like malware, right?
00:13:42.000 --> 00:13:44.320
It's doing things automated, right?
00:13:44.559 --> 00:13:52.559
You have one agent fire off another bunch of agents, fire off another bunch of services, connect to APIs, do all this kind of stuff, and you go, that's kind of ransomware, right?
00:13:52.639 --> 00:14:00.000
I mean, it's it's out there gathering all this information, but yet it's something that is encouraged and supported within the infrastructure.
00:14:00.159 --> 00:14:14.559
So without knowing what agents can do what, what tenancy they have, who who is ultimately, what human is ultimately responsible for the decisions that agent makes, you're never going to have control over it.
00:14:14.799 --> 00:14:22.720
And the reality is the government and you know, all the regulators are now hyper focused on how you're managing AI and enterprises.
00:14:22.879 --> 00:14:25.039
So it's kind of all coming together.
00:14:25.279 --> 00:14:25.600
Okay.
00:14:25.919 --> 00:14:30.559
And you're not going to manage all of that if the only thing you have is Azure.
00:14:31.440 --> 00:14:31.679
Right?
00:14:32.000 --> 00:14:33.600
We're not taking a jab set Microsoft.
00:14:34.000 --> 00:14:36.480
We're not no, the point is, right?
00:14:36.639 --> 00:14:41.679
Everybody, that's everybody's foundation for users is is Microsoft, right?
00:14:42.240 --> 00:14:45.519
It's not a jab, it's a fantastic business model, right?
00:14:45.679 --> 00:14:47.200
Yeah, no, make yourself the prime.
00:14:47.919 --> 00:14:48.320
Exactly.
00:14:48.639 --> 00:14:52.320
No, it's this, it's an amazing time to be in technology.
00:14:52.799 --> 00:14:53.039
Really?
00:14:53.440 --> 00:14:57.120
Um AI, quantum, you know, what's the comic gave it?
00:14:57.200 --> 00:14:57.600
You said you're right.
00:14:57.679 --> 00:14:58.639
It's not three to five years.
00:14:58.720 --> 00:15:00.799
It's probably 18 months, I would think.
00:15:00.960 --> 00:15:01.200
Yeah.
00:15:01.440 --> 00:15:08.639
Um, with all the different models and the holes, and and and it's just it's time for us to take serious our discipline.
00:15:08.720 --> 00:15:17.600
I always looked at cybersecurity, um, I I don't know if it's in its infancy, in the sense that it it is progressing organically.
00:15:17.840 --> 00:15:23.600
Like I think about how nursing or psychology or some of the other disciplines are much, much older, much, much more established.
00:15:23.759 --> 00:15:26.320
Cyber uh cybersecurity is in that growth phase.
00:15:26.720 --> 00:15:37.120
And we as practitioners, we as future practitioners have to, you know, get on your soapbox and and express what's going to be necessary to keep us safe.
00:15:37.279 --> 00:15:37.600
Yeah.
00:15:37.840 --> 00:15:44.559
And we've seen so many different breaches, we've seen so many different, you know, my kids, my my kids' information is already on the dark web.
00:15:44.720 --> 00:15:45.279
Yeah.
00:15:45.519 --> 00:15:47.519
That's just the truth of the matter.
00:15:47.759 --> 00:15:57.519
Um So I think conversations like this, um, books, it we all need to continue to do that lifetime learning, and and it's changing so fast.
00:15:57.679 --> 00:16:01.200
I don't want anyone to think that I have an answer or John has an answer.
00:16:01.279 --> 00:16:04.399
Um, but it's it's it's an an amazing time to be in tech.
00:16:04.799 --> 00:16:11.039
I I was having Greg, I was having a conversation uh last week with with someone completely non-technical.
00:16:11.360 --> 00:16:11.519
Okay.
00:16:11.840 --> 00:16:19.279
Um, and they were talking about how you know they went and did the um the DNA test and how they found out all the roots and all that kind of stuff.
00:16:19.360 --> 00:16:21.759
I said, Well, how do your kids feel about that?
00:16:22.159 --> 00:16:23.200
And she goes, Well, what do you mean?
00:16:23.279 --> 00:16:31.600
I was well, well, now all of your DNA, which your kids now share, now all of that information is is in the public domain, right?
00:16:32.080 --> 00:16:37.440
If there's a breach, whatever, but now some company has the DNA of your kids.
00:16:38.000 --> 00:16:39.279
Did you ever give that any thought?
00:16:39.440 --> 00:16:39.600
Right?
00:16:39.840 --> 00:16:40.879
The average consumer doesn't.
00:16:41.279 --> 00:16:42.879
No, and and you know what?
00:16:43.519 --> 00:16:45.039
Nor should they, right?
00:16:45.360 --> 00:16:47.120
Ultimately, nor should they, right?
00:16:47.200 --> 00:16:52.399
I mean, I I don't I don't know if many people approach life like we do, right?
00:16:52.879 --> 00:16:53.679
I'm not doing that.
00:16:54.159 --> 00:16:54.960
I'm not doing it either.
00:16:55.840 --> 00:16:56.159
Yeah.
00:16:56.320 --> 00:16:59.120
Um, but you know, the reality is, and that's what you think about, right?
00:16:59.200 --> 00:17:06.559
So did that did that mother violate the privacy of her children by sharing their DNA, right?
00:17:06.720 --> 00:17:10.000
It's but that's the slope that we're rapidly getting to.
00:17:10.160 --> 00:17:10.720
Yeah, right.
00:17:11.680 --> 00:17:27.359
Yeah, and that's it, that's that's where we when you start thinking about all the different things that aren't necessarily security, but maybe the intersection of privacy and security and you know, consumer, and it just it's it's the next 36 months are going to be wild.
00:17:27.680 --> 00:17:28.480
And I giggle.
00:17:28.720 --> 00:17:31.519
And there are other countries that are a little more progressive than than where we are.
00:17:31.839 --> 00:17:32.240
Just a little bit.
00:17:32.480 --> 00:17:33.119
Just a little bit.
00:17:33.279 --> 00:17:37.920
Um, and it's you know, other places we're we're choosing to opt in and not opt out.
00:17:38.240 --> 00:17:38.880
Correct.
00:17:39.200 --> 00:17:42.559
And that that should speak something like boom.
00:17:42.640 --> 00:17:42.799
Yeah.
00:17:42.960 --> 00:17:51.279
Where you know it it's I try to remind my kids and my young folks in my in my world, even my mom, I'm like, you have to understand that you are you are the product.
00:17:51.440 --> 00:17:56.720
Like you are what they want, you the scrolling, your marketing, your your raw data.
00:17:56.799 --> 00:17:59.200
And we we we as consumers have to look at that.
00:17:59.519 --> 00:18:07.519
And we have our own level of cybersecurity and and just restraint, I think, that we should have at least that forethought before we do that.
00:18:07.680 --> 00:18:10.799
I mean, that and that might be good for her, you know, that might be okay.
00:18:11.200 --> 00:18:12.079
Not okay for me.
00:18:12.319 --> 00:18:13.200
Yeah, I get it.
00:18:13.359 --> 00:18:18.240
But we all need to see where we are in that spectrum and and 100%.
00:18:19.599 --> 00:18:21.200
Um, last question.
00:18:21.440 --> 00:18:32.480
And this is for my career changers, this is for my career developers, and I I get a lot of outreach um on this topic more than anything, because I think everyone is trying to figure out how to break into cyber.
00:18:32.720 --> 00:18:37.200
And I I tell my students all the time, do not tell me you work in cybersecurity.
00:18:37.359 --> 00:18:38.960
That's like saying you're a doctor.
00:18:39.200 --> 00:18:40.240
Are you a leg doctor?
00:18:40.319 --> 00:18:41.200
Are you a foot doctor?
00:18:41.279 --> 00:18:42.480
Are you a butt doctor?
00:18:42.640 --> 00:18:43.599
You can't tell me.
00:18:43.839 --> 00:18:49.359
You you uh I think one thing that's so unique about this discipline is that it's so diverse.
00:18:49.920 --> 00:18:53.920
Um, there are folks who have never coded anything that have worked in cybersecurity for 20 years.
00:18:54.000 --> 00:18:57.680
There are folks that never leave the command um command line.
00:18:57.839 --> 00:19:12.400
Um, for our students, career changers, early career professionals listening today, what qualities separate someone who is simply in cybersecurity from someone who is truly becoming a cybersecurity leader?
00:19:17.279 --> 00:19:33.279
Um so I I think you know, one of the things that I look for um every one of my organizations I've built the teams.
00:19:34.079 --> 00:19:44.319
So, you know, there's there are definitely people who uh will never be a CISO for very valid reasons, right?
00:19:44.720 --> 00:19:50.880
Um when you sit down, you meet with them, you see how they interact, you know they love the tech, right?
00:19:51.359 --> 00:19:57.759
They have zero desire to go sit in board meetings or to be you know in project meetings or anything like that, right?
00:19:58.000 --> 00:19:58.559
That's a part of it.
00:19:58.960 --> 00:20:05.759
So you know, there's there's a part of this discussion that needs to understand where the ultimate goal is, right?
00:20:05.839 --> 00:20:08.400
And certainly for the new career people, they have no idea, right?
00:20:08.480 --> 00:20:09.680
It's way too fair, right?
00:20:10.640 --> 00:20:15.519
But being a CISO isn't necessarily the ultimate goal, right?
00:20:15.680 --> 00:20:30.480
Being that chief security architect, being that, you know, chief identity, you know, manager, whatever it is, there's so many, to your point, so many different career paths in our in our industry right now.
00:20:31.279 --> 00:20:31.519
Anybody.
00:20:32.799 --> 00:20:33.839
That's the part that's killing me.
00:20:34.960 --> 00:20:39.599
And honestly, I mean, there are people who want nothing to do with tech and who are still in cybersecurity, right?
00:20:39.680 --> 00:20:41.839
They do GRC and they do policy and they love it.
00:20:42.000 --> 00:20:42.240
Yep.
00:20:42.400 --> 00:20:42.640
Right?
00:20:43.039 --> 00:20:58.000
So, you know, they that's understanding that this industry can provide you with virtually any career path you want, is really it's both the benefit and the challenge of it, right?
00:20:58.240 --> 00:20:59.200
Very much so, right?
00:20:59.440 --> 00:21:02.559
You know, it takes a lot of soul searching, right?
00:21:02.720 --> 00:21:06.480
When when when I got into it, you know, it was a little simpler, me too.
00:21:06.720 --> 00:21:08.240
It was the last simples, right?
00:21:08.480 --> 00:21:08.640
Yes.
00:21:09.279 --> 00:21:31.200
I mean, you know, I I uh I was telling, you know, uh the story a while ago about you know, I I moved to Charlotte one uh with a with a with a consulting firm because a bank that was our our client wanted to put a stock trading platform on this new thing called the internet, right?
00:21:31.839 --> 00:21:36.480
Um you know, and I and I think about you know my kids now, right?
00:21:36.640 --> 00:21:40.000
They they don't know a world without that, right?
00:21:40.559 --> 00:21:44.240
Um I I remember putting together token ring networks, right?
00:21:44.319 --> 00:21:47.839
And I you know the vast majority of people who listen to this would never even know what that is.
00:21:48.079 --> 00:21:48.559
Oh, Google.
00:21:48.960 --> 00:21:54.400
So you know, so you know, the the world has changed so drastically.
00:21:54.480 --> 00:21:57.839
And to the cut point we were just having, it's still changing, right?
00:21:58.319 --> 00:21:59.759
And we'll continue to change AI and quantum.
00:22:00.160 --> 00:22:02.160
Quantum, you know, it wasn't that long ago.
00:22:02.240 --> 00:22:05.440
We were going, come on, quantum really, is it really going to bother us, right?
00:22:05.599 --> 00:22:05.920
Yes.
00:22:06.240 --> 00:22:14.079
And and you know, I that's another soapbox I kind of get on because as security professionals, I don't think we're proactive enough in some cases, right?
00:22:14.720 --> 00:22:15.599
That's another episode.
00:22:15.680 --> 00:22:17.440
We can come back and talk about that one.
00:22:17.680 --> 00:22:27.839
But but that you know, the reality is between quantum and AI, you know, there's you know, understanding and trying to get back to to your direct question.
00:22:29.440 --> 00:22:31.920
Take every opportunity you can.
00:22:32.240 --> 00:22:38.000
If someone says, go on this project, your answer should never be, I don't know how to do that.
00:22:38.079 --> 00:22:39.759
The answer should be, I'll figure it out.
00:22:40.319 --> 00:22:40.640
Right.
00:22:40.960 --> 00:22:46.720
Um, and and that's really, you know, for a lot of us old timers, that's all we had to do.
00:22:46.880 --> 00:22:48.000
We had to go figure it out.
00:22:48.240 --> 00:22:55.599
And I think when you look at um a lot of the people who've been successful, that's really kind of their their moniker, right?
00:22:55.759 --> 00:22:58.240
They figured out how to be successful.
00:22:58.400 --> 00:23:08.319
That's when when I when I hire people, especially people who are just getting in the industry, uh degrees, certifications.
00:23:08.400 --> 00:23:09.839
I mean gotta be hungry.
00:23:10.000 --> 00:23:12.559
Yeah, but but I also want you to be curious, right?
00:23:12.640 --> 00:23:18.960
I want you to, I want you to I want you to get passionate telling me how you set up that lab at home, right?
00:23:19.119 --> 00:23:24.880
Or how you failed five times trying to install Linux on your Windows workstation, you finally got it to work, right?
00:23:25.200 --> 00:23:31.680
That's the kind of curiosity and drive that I think makes good cyber professionals.
00:23:32.160 --> 00:23:42.720
And it really, you know, it kind of goes a long way because everything we do, if we look at the SOC, every day is trying to unwind what you see and trying to figure it out, right?
00:23:42.960 --> 00:23:43.759
That's what we do.
00:23:43.920 --> 00:23:46.079
So John, I want to thank you.
00:23:46.319 --> 00:23:46.799
Thank you.
00:23:47.039 --> 00:23:49.839
It is always a pleasure to sit at a dance with you and hang out.
00:23:50.160 --> 00:23:51.839
All we're missing is like good coffee.
00:23:52.079 --> 00:23:55.599
Um I want to thank you guys for listening with us today.
00:23:55.759 --> 00:23:58.079
Um, we are planning to do this.
00:23:58.240 --> 00:24:01.279
Um, everyone knows that um I love my community.
00:24:01.359 --> 00:24:04.559
I think that this is gonna be part of me giving back.
00:24:04.640 --> 00:24:10.400
Um, if you enjoyed the episode, uh go ahead and share it with someone who you think can take value from it.
00:24:10.559 --> 00:24:12.880
You know, listen to it wherever you get your podcast.
00:24:13.119 --> 00:24:18.880
Um, my closing question, John, what is something that someone can do?
00:24:19.119 --> 00:24:24.640
Um take one thing for next week that someone can do to help them be just a little bit more resilient.
00:24:25.279 --> 00:24:27.279
A little bit more resilient.
00:24:27.599 --> 00:24:30.400
Um boy.
00:24:30.960 --> 00:24:32.720
That was your last question.
00:24:33.039 --> 00:24:34.000
Just a simple thing.
00:24:34.079 --> 00:24:41.200
We're not we're not gonna take it long because at the end of each episode, I want to leave our audience with that thing from your perspective.
00:24:41.359 --> 00:24:43.920
Maybe it's maybe it's leadership, maybe it's even your home.
00:24:44.079 --> 00:24:48.000
I love the example you gave with the young lady and giving her DNA away.
00:24:48.160 --> 00:25:00.960
These are all different topics that our community needs to hear about, whether it's through a book, whether it's through a podcast, whether it's through a Google, we need to start being more conscious of our data, of what privacy and and what privacy should mean to us.
00:25:01.119 --> 00:25:09.200
And as we continue to build ourselves wherever you are in your spectrum of cybersecurity or AI, that we we need to can challenge ourselves.
00:25:09.359 --> 00:25:12.319
So is there is there one take, and there might not be a takeaway, you know.
00:25:12.480 --> 00:25:20.319
Is there one takeaway that you would suggest to our our our listeners, our viewers, that um you think that is that value add for them?
00:25:22.160 --> 00:25:26.000
Um you know what?
00:25:26.079 --> 00:25:28.640
I I'm gonna fall back on what I just said.
00:25:28.960 --> 00:25:31.519
Find a way to be curious about something, right?
00:25:32.079 --> 00:25:40.079
Do something, you know, uh that I again find that old laptop and do something with it, right?
00:25:40.240 --> 00:25:45.039
Um convert your iPad to a Kindle reader, whatever it is, right?
00:25:45.680 --> 00:25:52.240
Be find a way to be curious, especially for those people who are just getting into the industry.
00:25:52.480 --> 00:25:59.920
Find a way to be curious and and find a way to be able to explain it and talk about it.
00:26:00.240 --> 00:26:00.559
Yep.
00:26:00.880 --> 00:26:02.079
Thank you so much for joining us.
00:26:02.160 --> 00:26:03.519
We'll see you guys next time.
