Security Podcasting Origin Story – Security Boulevard Chats EP11

Hey, everybody. Welcome. Welcome to, uh, security Boulevard Chats.

The podcast version, the podcast version of the website, uh, security Boulevard Gall, uh, great to be doing with this with you. You know, just full disclosure, you and I started doing a security podcast in 2004. That was our very first podcast we ever did.

It Was on security though. And was on security. Yeah.

The time. Still Doing it 20 years later, Mitchell Got it going. Yeah.

And we're still fixing cross lakes. I think we, we can grow by them, but okay. We're stuck in security.

I like in the time machines, It was like the wagon wheel ruts. We can't get out of it. Mm-Hmm.

No, we have actually expanded on a lot more things. So, um, well, well, let's first of all talk a little bit about, you know, why we first started doing podcasting on security. Maybe we, why we're still doing podcasting on security.

Right? And when this was actually your brainchild, I think you got it from idea from maybe Brad Feld or a few F folks about starting a podcast on security. But there was a group of us, maybe a dozen or so yeah.

That we're starting to Do podcasts. 0 thing was going on, right. Intranets and RSS feeders, which, you know, empowered the blogging.

And then from blogging, we got to podcasting. Brad felt, definitely got me started on the blogging. Um, and then we saw the podcast sorta come up outta blogging, if you remember.

Right. And, and, um, and you and I were both at still secure at the time, and, you know, and we, and we started doing it then because look, it was a different world. Security was, you know, we didn't call it cyber, it was security or InfoSec.

It wasn't the big deal. It isn't. I always thought it was a big deal when niche.

I guess that's, no, It was still a very, you know, vertical nichey. It was niche. It was very, it was a niche business, a cottage industry in many ways.

And, and the why, while people in security always thought it was the most important thing, the fact of the matter was the rest of the world gave lip service to it. Mm-Hmm. And I didn't understand it.

And so, yep. And so part of the blogging and podcast thing was to make security, make people more security aware, more security conscious. Um, we also, A lot of people moving into security as the importance of it was out through all the things going on.

And I know we kind of took it on as our mission to help more people perform a security job in the products we were creating. And the podcast and blogging. Uh, 'cause you know, know cis admins or, or network admins are settling now security people.

Well, what do I wanna do? What's, what does that mean? Yeah, I'll go to SANS and get my training, but help, I need some resources.

And that was part of why we did this. You know, I, I did a, a video interview today, Mitch, you can probably find on Text Strong TV with the, uh, chief Security Officer of CloudFlare. Mm-Hmm.

I'm trying to think the fellow's name. I think it was Grant. Uh, yeah, I know Grant was his first name.

I'll get you his name. Yeah. But much like you, didn't you, this guy's a rockstar.

You'd love talking to him, but much, he's about our age, I guess Mitch, maybe a few years younger, but he's been in security since the late nineties. Grant Boor z Mid mid nineties to late nineties, 30 years. Grant bor, ZKU, I think is His name.

Right? Grant Boor. Zku.

And, and Grant, grant went to school for an got an accounting degree. Mm-Hmm. Not an engineer, not a coder.

Perfect. For security. You know, how he got into security?

He bought books. He bought books Real and not eBooks and not, not Kindles. He went to the bookstore, he'd read a book, and when that was done, he'd go back to the bookstore and buy another book.

And over the last 30 years, grant has been, well, Grant's been a CSO for about 20 years. Mm-Hmm. Including at two of the largest banks in the world.

Uh, he's worked for some nuclear power companies. And, and now of course, he's chief security officer at CloudFlare. And we had this conversation today.

Hmm. So here's a guy didn't have any formal computer or technical training. Right.

All self-taught. My story is, I don't either. I, I went to law school.

Right. And I mean, if any of us, you're the one who has at least some technical engineering background. Yeah.

Computer science, but business too. Yeah. But, um, but yet we found our way into decent careers, maybe grant more than us.

Mm-Hmm. Uh, decent careers around security. And yet today we have all these, I call 'em kids, but all these folks who are coming outta school with a concentration in cyber and cyber this and cyber that.

And what's the most common question we hear from these people? How do I break into this business? Mm-Hmm.

How do I get my first job? How do I get my foot in the door? Mm-Hmm.

And it's like, something's a mismatch. 'cause you got all this training, but you can't get a job. And then at the same time, all we hear about is the security gap.

The, the, the security skills. Gap skills shortage. Yeah.

Skill shortage. Yeah. And we can't get enough qualified people to work in security.

It, Mitch, it doesn't add up. Yeah. It, it's not all this reason.

But if I think back, you know, when we hired security people, back then you hired a fire firewall engineer, you hired a network, you know, somebody set up the DMZ and honey pots and that kind of thing. Right. And somebody just set up a monitoring system or whatever it was today.

It, it seems like when we're hiring security people, we want 'em to know 12 things already and they're coming outta school. So, I mean, what do you learn in school? You learn how to learn, right?

Yes. Yeah. You learn some good content, but a lot of that is now you gotta really learn it in the real world.

And so, you know, I had this conversation, um, it was actually with, um, with the CTO at Splunk talking about you, you have to hire people knowing that you're gonna train 'em, knowing that you're gonna educate 'em. It just, it just has to happen because they don't come equipped with everything you're gonna need. And what you think you're gonna need when you hire 'em is not what you're gonna need six or 12 months, months from now.

So you wanna hire people that can learn and apply that, that, that is much important. It's about the skill as opposed to what are the 12 technologies that you should have? Absolutely.

Three of 'em, you're doing good, or six. So I think that's part of it. We sort of set ourselves up to fail by looking for people u purple unicorns on Mars.

Well, there's three attributes of which, none. You're not gonna, you're not gonna find anybody that way. So grow your people, help them develop.

To me, that's part of why we're, we're stuck where we Are. It's that. And it's, then we also say, not only do you have to have these 12 attributes, but you have to have that done them for 12 years.

Yeah. But these things were only around, you know, for, for five years. So how the heck am I gonna have 12 years worth of experience doing a trip?

You can't have the job. You Had to work a triple shift. Yeah.

So it, it is, it, it, you know, and by the same token though, Mitchell security or cyber as we call it today, has never been bigger, has never been more important, has never been more of a priority. And it is, you know, things we only hoped and wish for when we first started podcasting, to, to raise aware, raise awareness, and the, and the profile of security have all come true. Sometimes not for good reasons.

It's been the result of, of, of Bad things happening. Yeah. Bad, bad things happening.

But nevertheless, you know, we, we've seen tremendous, and I'll tell you something else, I think in spite of the mother of all Breachers that we've had. Yeah, right. There's an article I saw on the Yahoo Finance about this.

Was it 26 billion records or some nonsense? It's an, it's an aggregation of all the other breaches into one breach. Yeah, exactly.

Into one big breach in spite of the mother of all breaches. I would put forth the proposition that we're actually more secure. We're doing more around security today than we ever did.

There are more vectors, there's more attack surface, the bad guys are better, smarter, faster. But overall, our security posture is much, much better today than it was 20 years ago. Oh.

We'd be falling down at every, every turn. Right. Dealing with that incident if we were still there.

No, no. I mean, 20 years ago, security was a rounding error on the spreadsheets. It was you and talking about what some of the differences are.

When you and I started in security, security, i, I call it in a, in a nice way was security was for the monks. The few people who knew security that nobody else could understand what the heck they were talking about. And they went and did their thing and everybody else kind of went, huh.

I don't get it to now security isn't just network security and protocols and T-C-P-I-P and firewall rules and nice things like that. Yes. It's all that stuff.

But we're talking about compliance, we're talking about data privacy, we're talking about software. Right. APIs and applications.

We didn't get into software architecture and security 15, 20 years ago. No, no. I, I heard an interesting stat today, actually.

It came outta that interview I did with Grant at CloudFlare. They just did an API security report. 57% of internet traffic is API.

Absolutely. Akamai would back that up too. Yeah.

They, Yeah. Well, between Akamai and CloudFlare, I think they carried near one half of traffic on the internet. CloudFare is like 25% and Akamai's about the same.

Mm-Hmm. Okay. So, you know that, that's certainly in there.

But you know, you mentioned network security, Mitch, and, and that's where kind of as we said, that's where security started for most people. Mm-Hmm. Me Certainly.

I think you as well. My first fire and, um, 98. Yep.

I was doing managed checkpoint firewalls at a company called Yep. opsec. But anyway, you know, one of the people who were big in network security back then is our friend Marty Rush Mario.

And, uh, you know, Marty of course was the, uh, founder of Snort Mm-Hmm. The open source IDS and then of course built on that source fire, which he sold to Cisco and Marty's now the, uh, CEO of it's Nat topography, I believe. Mm-Hmm.

Yep. And, but still doing network security. He is, well, you know, he kind of did real well and took a little time and found his next thing.

Guess what? It's network security still. But, you know, Marty did a byline article up on Security Boulevard and it, uh, it's interesting.

It's, uh, don't mystify network security in 2024 include on-prem and cloud. Yeah. And I think part of that, Mitchell, is when you tell, especially people who don't have 30 years in the business, Hey, uh, What about your network security posture?

They tend to di one of two things. Either they discount the cloud because they say, look, the cloud is kind of my wan it's outside my network. My network is still my land.

Right. And, and that's network security to me. I'm still putting big boxes in front of the moat right.

At, at the drawbridge. And, and they just think of sort of that on-prem, if you will, network security. Mm-Hmm.

Or they go the other way and say, look, the cloud's blown up. Network security. When you say network security, I'm really talking about cloud security now because, and, and when I talk about network security and cloud, it's really IAM right.

Identity and access control identity and access management. Because what I'm doing with my network securities, I don't have that choke point anymore. Mm-Hmm.

Where I could choke everything. But where I do have that choke point is where I allow you onto my infrastructure, whether it's in the cloud or, or what have you. And, and Marty makes the point that, hey, you know what, network security includes both Mm-Hmm.

And, and by defining it as one or the other, or one is more important than the other, you kind of miss the, the totality of it. You need to kind of have a holistic view, if you will, of Your assets wherever they are. And, and that's been a big push, not only in net topography, but with a lot of companies, Mitch, where job one, you can't protect what you don't know.

Mm-Hmm. You have Mm-Hmm. And, and so really kind of defining your attack surface and your assets.

And if you think, if you think about it, I mean, yes, there are cases where what you're doing on prem is, is because you, you can't do it in the cloud. Maybe regulatory reasons, data protection, whatever it might be. So there are cases where it needs to only be on prem and it's not gonna talk to other things, uh, that might be in the cloud.

On the other hand, most, most of us, if we're not fully in the cloud, most of us are hybrid. Right. We're both, we call it private cloud, public cloud, or on-prem and public cloud.

It's both. And we do VPCs between the two. And it isn't, let me secure one and then I'll secure the other and just connect them with a, a vp C, you want the same policies, you want your policy orchestration to happen in similar ways between those environments.

You don't want 'em to get outta sync. You have to audit both. You have to, you have to do all the same things in the cloud.

You had to do one in the onsite, uh, on-prem data center. You just might do 'em a little bit differently with the services that you're using or some of it is done for you. Right.

You don't have to do as much of those heavy lifting in it. And, and it seems that that's part of what Marty's point is, is you gotta have a holistic view of security. It's not just network security if you're on prem or network, if you're in the cloud cloud security.

Agreed, agreed, agreed. Um, and, and Marty's a good guy to, to make that case. Actually.

It's a great article that you definitely want to check that out. Absolutely. So, Mitch, going from the, you know, 20, 30-year-old network security to today, can't, you know, I have to bring up ai Of course.

We're more than 10 minutes in, we're allowed. Yeah. Uh, there's an article I saw, again, part of Security Bloggers Network on Security Boulevard about the use of, of ai, generative AI and cybersecurity.

And, and to me, the, this kind of, there's two aspects of AI and security. They're kind of like binary star system that orbit each other. Mm.

mm-Hmm. One is how do we use ai, generative AI to make our cybersecurity better? Mm-Hmm.

Right. How can we be more effective cybersecurity utilizing generative ai, but the dark star that, you know, circles that is what can we do to secure our generative ai? Right?

Mm. We it has to be secured. We have to make sure that the information in there, you know, it doesn't fall into the wrong hands if it's proprietary.

And, you know, there, there's a whole mission of, of securing ai and I'm afraid when these stars Poisoning and new things we gotta protect From, right? Yeah, exactly. And at some point, did these two stars circling each other, combine and supernova into some singularity or black hole or what, um, The event horizon?

Uh, what do you think? Well, you, you know, it's, it's, it's kind of one of those inevitabilities, right? So AI is happening.

Generative AI is accelerating things. 'cause it's, you know, now everybody has access to it and everybody wants to figure out how to use it. Um, and there are people doing interesting things in security.

Like, you know, one of the first things I saw was helping you with getting information out of our systems, right? It might be an observability or security monitoring or sim or something, but it's still hard to pull information out of those things. Put it into context that you can put it in a report.

Or if you're doing a, uh, incident management situation, correlate this stuff together and tell me what really matters between that data. And so people are using it in interesting ways like that for compliance reporting and, and for incident management. I think the next thing you know to really think about is, well, the bad guys are using it, right?

They're using AI to, whether it's creating fake videos and audios or using it to, uh, you know, find innovative ways that practice. We have to find innovative ways to, you know, thwart those things. And I think that's sort of the arms race of AI in the security world.

It's a, it's a new, we always were in an arms race, but now we've got, you know, nuclear weapons instead of conventional. Yeah. No, we, we've got the next generation of, of weapons there, right.

The, the literally the hbos of it. Yeah. You know, Mitch, I did a, uh, a text drunk TV interview a few weeks back with, um, and let me just make sure I get this, his name right here, James Murphy.

Um, and, and James is the, uh, he's at a high executive, I think he's SVP of security or CISO over at Visa. Mm mm-Hmm. Wow.

And, uh, There's a big job. Yeah. He's SVP Global Head of Risk and Identity Solutions at, at Visa.

And, and, you know, it was how the evolution of AI enabled technology is enabling fraudsters in 2024 mm-Hmm. So first of all, people don't realize, right? Yeah.

Visa is a credit card company, right? The amount of money they spend on security every year is equivalent to a small country's GDP oh oh bad. Right?

They, they spend with b with billions with a B right. On security. And they're already seeing massive amounts of AI enabled fraud.

Mm-Hmm. Whether it's better phishing kind of stuff, deep fake, uh, uh, you know, video, email, Mm-Hmm. Messaging, smishing, all of that, and admiring other kinds of traffic that are AI enabled and, you know, improved by AI that's creating, I mean, and they're trying to stay one step ahead of it.

Give them credit. Yeah. But it, it is, it's gonna be a battle for the next couple years, man.

There's no other ways around. I don't know what else to tell you Or more. I mean, I just, yeah.

It's, it's a new world. I mean, I'm not saying that the old stuff doesn't apply. It still does, but it's, you know, it is, uh, you put you put tools in the hands of people and they will do not just the expected, they'll do the unexpected with it.

Right. And that's, that's, maybe it's an ED case, maybe it's one that goes mainstream, but, and you can't wait for it to happen. Right.

You have to be engaged. So when it does happen, you can recognize it what it is and try to figure out how it's doing what it's doing and thwart it. Yeah.

And I think that's one of the things about ai, especially generative ai, is it's not deterministic like writing an algorithm. You know, it isn't, if I put a B and C in this algorithm, I'll get d is the answer. And it'll happen that way every time.

No, I get different answers out of this. So how do you test for something in a generative AI system that you know, is Yeah, this variance we're gonna see or No, that's, that's weird. It's not just, you know, hallucinating, hallucinating, but it's doing something it shouldn't do.

Why is that happening? Is that a security issue? That's an excellent point.

Is it a security issue or is it a feature? You know, is it because it's not supposed to give you the same thing every time? Mm-Hmm.

You know, and by the way, I, I, I don't have it in front of me, but I was solicited this week with a pitch. You know, there's a lot of companies coming out there that, you know, their whole reason for being is spotting generator of ai, uh, fake Mm-Hmm. Or just anything generated by generative ai.

Mm-hmm. Right. I mean, look here at Textron, we've got people submitting articles all the time and, and I've gotten pretty good.

Our editors are much better at it, at looking at like a submitted article and say, yeah, this looks like it was Gen ai Mm-hmm. Generated. Right.

It's too flowery, it's too whatever. But, you know, but those get better every day. And we need, we're gonna need technology.

Actually, that's what it was. It was a company that somehow was, was gonna be able to, uh, not watermark, but watermark your likeness, your, you know, your stuff. Mm-Hmm.

Now I remember Sandy Carter, remember Sandy Carter used to be a Mm-Hmm. SVP at IBM, then she was a SVP, I think at, uh, AWS she's with a new company now, Unbound Domains or something like that. Hmm.

And these are w three domains. Hmm, okay. Right.

Web3 domains. Yep. And, and it's really about taking control of your identity so that, you know, they, they kind of put your identity in the blockchain, if you will.

Mm-Hmm. And I, I don't have a, by the time this podcast airs, we'll have the URL and I'll give you the URL to that same Carter interview. Yeah.

But you know, you, you identifiable stuff will be in the blockchain and you can give it that blockchain hologram is the best way I could explain it. Mm-Hmm. Um, so that people know it's authentically you and from you, or by to a mutable way to figure out to tie it back Yeah, yeah.

Identity. Unless they hacked the blockchain, which, you know, quantum maybe, but, um, but yeah, that's a pretty cool thing. So I immediately, after hanging out with her, I went on and I, I claimed a shimmy.

com, the domain, but that was just a regular web domain. Mm-Hmm. But I, you know, you could do like a shimmy XA shimmy dot go Ahi, uh, NF or whatever it is.

And, um, so I took AHI dot go. It was cheaper than AHI X. That's 'cause they, this just what we need is more domains, right?

Yeah, exactly. But I figured, let me stake my claim in, in Web3. Right.

Uh, we, we were talking, I think it was the last podcast we did about web two. Oh. And now it's Web3 and, but it, it's, you know, know there's gonna be all we, we need a cyber solution around this Mitchell to, to manage IP, to, to stop deep fakes.

We need it for a lot of good reasons. Mm-Hmm. We do.

We do. And you know, the idea of watermarking, I think, if I remember right, it was mid Journey that recently announced they're gonna start watermarking their images. So you can tell it was generated Right Now you can, a lot of times you can look at it and tell it.

But, you know, deep fakes kinds of problems. Well Rep, you know, reputable diamond places are doing that now with Mm-Hmm. What they call, you know, non earth created lab created diamonds.

Yeah. That in like very micro that you can only see with the, you know, the jewelers piece. Yeah.

Mm-Hmm. Yeah. You could see it'll say, you know, lab created or something like that.

Mm-Hmm. Um, because you really, you know, and I don't know enough to know what I don't know, but supposedly you really can't tell a lab diamond from an earth diamond, um, because very good, you know, they're, that they're made in the same kind of process except one is done in days and the other's done in millions of years. Really good.

And, uh, so there's a little difference in price, a little more than a little, but, um, quite a, but we're gonna need the same kind of things. I mean, again, that's I think part of just another aspect of the cyber mission that we weren't even thinking of 25 years ago. Not even on the radar, you know?

No, But you know, back to what we were, you know, when we started doing this 25 years ago, that wasn't part of cyber No. Or part of security. Security wasn't cyber.

It was, yeah, exactly. Very, very different world. Um, you know, is, there was also a really, um, interesting, I believe it was a webinar, if I remember right.

There's a webinar on logging's, not dead long live logging. You know, you still need once. Yes.

Right. So I, I gotta talk to you about that one though. Oh, okay.

Tell me about that. There was a webinar scheduled. Um, unfortunately it had to be postpone postponed.

I think there wound up being a speaker conflict. Oh, okay. But it's gonna be, it's gonna be a webinar coming up.

I don't know if you were on the call when we were going over that with the team earlier. I did hear about it on the call. Yes.

I, you know, so, but it's an interesting concept, right, Mitch? Because when we first started doing security Yeah. You had logs and logs were used for forensics.

Mm-Hmm. So you kept your logs in your log files and then, you know, 180 days after the attack you found out there was an attack. And then you said, you know, Mr.

Checkoff, go back to the logs and tell me what you see there. Right. And, and you go back to these, you said, Why only keep them 90 days?

Oops. Right. Well, very sorry, captain.

We only kept them 90 days. Damn it Scotty. But, um, you know, but that's what we used logs for.

And then, you know, then with the advent of sim technology, you know, reading log files, parsing logs, files and trying to get actionable intelligence and semi real time from a log file became a thing. My two sense is it never really worked. 'cause it's, it's just still not real time.

And, and, uh, but we've gotten better with, with AI and with things like that in doing that. So let's hope for the best and, and see where we, where we go from there. It, it's an interesting problem.

Um, one of the companies I'm doing some work with is, uh, Comcast Technologies. And they've spun out one of their, you could call it observability, but it's not, it's, it's a product called Data B. And it's really k taking a data management approach, not a security approach, a data management approach to solving the myriad of information you want to aggregate altogether, correlate add context to, and then find out are we compliant in this part of the organization?

What happened with this attack here? Um, and they do things like even include organizational information. So you can say, well yes, this is the thing it happened on and that's who it belongs to.

You know, in a big company that's hard to track down. So people are, are taking some innovative approaches like saying, well, you know, data, data scientists have solved some interesting problem here with Data Lakes and some of the analytical tools. Let's see what we can do with that with, uh, all the myriad of data we get from logs for security.

Absolutely. Interesting. It'll be interesting.

And, and you know, it's funny, Mitch, as we store more, we first we pull our hair out and say, oh my God, what am I gonna do? How am I gonna pay for storing all this data? And then we get the ability to parse that data and you make actionable intelligence of it more.

And we say, okay, let's store more. And so we constantly store more and we constantly find more uses for it. But I always worry at some point, are we gonna drown in our own data here?

I mean it, or you know, it, it's, that's an arms race unto itself. It is. Well it's also why machine learning took off.

'cause we had so much data. So maybe there's a machine learning opportunity here. Well, you needed a certain critical mass of data to make the machine learning go.

Exactly. And, and I think we, we, we passed that already, but we're on our way. Hey Mitch, we're we're almost, uh, at the end of time here.

I wanted to just take a little time 'cause we didn't get into it in the beginning about, you know, what Security Boulevard Chats looks like going forward. Mm-Hmm. com.

com, uh, uh, content, but we'll also feature text Drunk TV interviews, some of our Security Boulevard or text Drunk Learning webinars, tech strong research of which you're the general manager. Mm-Hmm. And principal analyst tech, strong research, research on security and, uh, everything else, you know, within the Techstrong family.

But we'll go outside the Techstrong Of course. Yeah. You know, Absolute sites as well.

Network as well. And we'll also be featuring guests. Right.

It's important when we first kick these off that I think you and I sort of lay the foundation, but we'll bring people on. We should also mention that you, along with our friend Jennifer, Jennifer Manila hosts, uh, this the CSO Talk video series, which has its own podcast as well. Mm-Hmm mm-Hmm.

That's once a month where these will be more like every week, but people should tune into that. Uh, and then we're doing podcast companions to each of the tech strong sites. com, security Boulevard here for Security Boulevard Tech strong AI for our, uh, AI audience, digital CXL for our executive Digital Transformation Cloud Native now and Cloud Native now.

Right. For, for Cloud native. Thank God you and I aren't hosting all of those.

Mitchell. We just do DevOps and Security Boulevard, but uh, I just Leave Mike the mic on record. Yeah, we will.

We podcast just jack us in like, uh, what's his name? Red Pill. Blue Pill Neo.

Exactly. Um, but no, but Mike Ard will be hosting some of those and, and as well as Sharon Florentine, Amanda Ani, Bonnie Schneider doing Echo Insights as well. Um, Jody and Jody Ashley and Tracy Reagan doing Techstrong Women.

Yeah. And, and of course we do DevOps on bound as well, so there's a full lineup as well as, there's also one other one, Textron 55, which is really aimed at Gen Z folks. Naton Solomon will be hosting that.

So we've got a lot of podcasts, uh, here on Text Techron and they'll also be, and they're all videos. You can listen audio or video. They're on Textron tv as well as your favorite podcast, uh, platform.

So have at it. And, uh, Mitch, I'm looking forward to it. I am too.

And you know, we've kind of applied our learnings from podcasting before and recently and said, let's, uh, more narrow cast our topics around security for security folks, you know, cloud native for software. Yeah. Cloud people, et cetera.

And so that's why we've kinda rejiggered and started some new ones and, and, uh, worked with the existing ones. We have to tune it a little bit better to what our audience is asking for. And I think, think this is a great format.

So look forward to doing more of these with you. Of course. Absolutely.

Alright, Mitch, you want to take it home? Yeah. Well, you've, you've listened to another episode of Security Boulevard's Chats and we were, thank you for joining us today.

I'm Mitch Ashley. I'm Alan Shiel and you've listened to Security Boulevard Chats. Join us again another time.