Fantasy Hacker League

Welcome to the great security debate.

This show has experts taking sides to help broaden understanding of a topic.

Therefore, it's safe to say that the views expressed are not necessarily those of.

The people we work with or for.

Heck, they may not even represent our own views as we take a position for the sake of the debate.

Our website is greatsecuritydebate.net and you can contact us via email@feedbackreatsecuritydebate.net, or on Twitter, Twitter ecuritydebate.

Now let's join the debate already in progress.

So would that be the equivalent of us having a russian or mandarin welcome message in our system?

So when somebody breaks in and sees it that they are like, oh, well, this is a local, I'm not going to attack this.

Exactly.

Yeah, but that goes back to the idea.

Remember the old idea of the message that says, hi, you've come to this system.

Illegal use is not permitted.

Remember the build splash screens?

I don't think that worked at all.

But what did work was someone that was like, hey, great work on getting into our system.

Would you like a job?

Just like to say like you kindly wouldn't mind leaving.

Greatly appreciate it.

But this was awesome.

So there was an article, there was an article about that.

There was an article about this is, I think it did not relate to institutional hacking.

You know, those that were, you know, they were rooted in organized crime or state sponsored, but others that found those kinds of messages, apparently there's some percentage, and this, I wasn't planning on this so I don't have the reference ready, but I'll put it in the show.

Notes before via text or find it.

But there was a massive drop in the number of, in the number of times the person would see, see that and would then just stop or not do the final extortion because they were there just to, they were there just to play.

But seeing that, yeah, that, that confirmation, that affirmation apparently was quite well received.

So is that, is that going the new robots TXT or security?

Txt.

Thank you.

You found a great thing.

We really appreciate it.

Would you like $5 AI algorithm, right.

Get that embedded in the AI, be nice, treat the attacker with some respect, some level of glorification, and then kindly ask to leave.

Yeah, what could go wrong?

What could go wrong?

Yeah, really?

As you guys are walking through the institutionalized hacking groups, nation states, and then the criminal begin to wonder, is that like a minor league?

Do they start bringing them up at some point that, hey, you've, now we're moving you up to the pros.

You got to.

Maybe.

Maybe we could start doing this.

The hacker draft.

There you go.

You've been drafted by the Milwaukee.

By the milwaukee.

The Chicago.

I can't even think of a good word.

B or c.

That Chicago crackers.

You could create a fantasy hacker league, right?

Like, drafted sandworm, first round.

Booyah.

Getting into that Iot, baby, right?

Like, ooh, who'd you pick up?

Right?

Like, oh, I went after that nigerian prince that does, like those.

That phone scamming stuff, right?

Try to pick up some low hanging fruit points, right?

Maybe on a late Sunday game.

And then it could all be like the Yankees.

But there's an ethical problem here.

Most you'd have to, like, agree to follow the rules that you would only use the assets that you've acquired and not go after others.

So it.

Otherwise, it'd be like the Yankees who just break the luxury tax every year.

Screw it.

We're buying everything.

We'll pay the extra money.

I mean, if we're doing this fantasy, I think you could pick up a defense that's on the blue team as well.

Like, you could pick companies to see, and if they don't, aren't in a.

You know, in the.

In the news for a breach for a time period, you're picking up some points.

This could be, you know, like, football season.

Like, I did fantasy football again this year.

Gonna admit I got back in.

I kind of been removed from some leagues.

Not forcibly removed, no.

But, like, a previous company I worked at, so.

And I can say when I was at Aisha, I no longer work at Aisha, but I was so close with those people, I still consider them family, right?

I was still part of their league for, like, another year or two.

And when, like, I came in second or first, like, two years after, I'm not there, and they're like, james, we're probably gonna have to remove you.

A lot of new people here, and they really want to be part of the league.

And we had to tell them they couldn't.

And then some guy from outside the company wins.

I'm like, totally get it.

Right?

Like, breakup.

It's not.

It's not you, it's me.

It's.

Oh, no, it's me.

It's you.

So, like, now I, like, I joined my current company's league GT's, and I find myself now doing that.

Am I doing the audible book in the car?

Do I get a little bit of that fantasy sports check?

Should I be picking somebody up?

Next thing you know, I'm like, an hour into listening fan, and I'm like, I just wasted an hour of my life.

This was pointless.

Because no matter what they say, like, last week, they told me to play Calvin Ridley.

Zero catches, complete die.

No, look at, this is like, if it was a year long league.

Like, this is only so many weeks, right?

But if you had a year long fantasy hacker league, right?

What defense do you pick up that you hold all year in the hopes that they don't end up in the news on the dark web?

You know?

How many people, like, I'm sitting there listening to fantasy sports.

How many more people would log in to be like, man, I wonder if there's anything on the dark web.

I'm gonna totally poop on Eric this week, right?

He's gone down, right?

Like, people would actually probably be more diligent.

Like, you're not even gonna believe it.

Zero day, I thought it was.

And this becomes much more.

This becomes much more possible now with SEC disclosures.

So you can actually take your rate.

You can take your results based on the ten k and eight k filing.

This is interesting.

I think we're onto something.

And maybe if you don't want to pick individual companies, you could pick the.

What are the codes called that define the different verticals that people are in the business codes.

Oh, the sick code.

Go by sick code.

Like, if you got stuck with healthcare right now, right?

It's be like, oh, my God, I can't believe I'm picking twelve.

I'm totally getting pooped on with healthcare, right?

Like, you know, you're putting up zero points, all right, on a monthly basis, just saying, like.

But you can have a multiplier on that.

If a week goes by where healthcare isn't in the news for a breach, there's a multiplier.

Right.

Because you took a high risk category.

Yeah.

So maybe you get four x, right?

Or if it ends up as a tie, it's like that money back that they're.

I listen to the radio and they're like, you know, that you can bet on blah, blah, blah.

And if your team doesn't win, but you tie at this, you get your money.

It's like, we don't want you to be upset.

We just want you to bet more.

That's right.

Or we're going to give you five.

We're going to get.

For every bet you make, we're going to give you five more dollars that you have to spend here.

It's like Kohl's cash or these other goofy ass mechanisms to try and just get you back into the store, Dickie.

And think about the different parlays you could do.

Because I hear those two where they're like, you know which one I really like right now?

I really like the idea of, you know, I forget it.

The Sam Darnold over his passing yards, right?

Be like, sweet.

Whoever gets hacked this month, I'm taking the over that they go ahead and pay the ransom.

I'm betting ten k over on bitcoin.

Should we now talk about manipulation of the results?

Oh, I'm going to bet heavy.

I'm going to bet heavy on Cisco getting breached and then I'm going to deploy my own hacking team to breach Cisco in that week.

And then I'm going to make a ton from both.

Just love responsible for any actions taken from the information or game that we may purport here.

Is that legally none of this is real and none of the.

None of the names that we've named are actually on our list to hack.

I won't.

I actually think that would be a ton of fun.

Like, it would be one of those things, like, hey.

Like, oh, it could be part.

No, I shouldn't even say that.

I did not just say that.

Like, you're distilling security meetup once a month where it's like, we're just doing a quick check in.

Just let you know where the leaderboard stands right now.

Danny Ayla really riding high at the top.

Drafted really well.

Got a little sleeper there, right with his flex play.

He did lose.

He did lose 30 points because he got called by the FBI for his accuracy of choices.

Dan was thinking long term, got to give the guy a lot of credit going into the playoffs, knowing that there was a presidential race on the line and the fancy bear might pick up their game.

Bam.

He nailed it big.

Give it all to Dan.

Team name tariffs for you.

Did you guys read the article about Microsoft creating the fake azure tenants to pull fissures into their honey pots in all the things that they saw?

No, I didn't.

Soup is pretty.

This was really cool.

I'm gonna.

I'm gonna pull this up here, right?

Cuz, like, now, again, going to the fantasy side, I don't know that anybody would be picking up a Microsoft, right.

As like a sleeper pick for doing something this crazy cool, right?

But again, low dollar value idea, fantasy line.

Boom.

Microsoft comes in, drops in some fake Azure tenants.

And.

And if I read this.

So Microsoft was using deceptive tactics against phishing actors by spawning realistic looking honey pot tenants with access to Azure to lure cyber criminals in to collect intelligence about.

But who did they charge for the e five licenses?

You.

We all know those aren't free, but with that collected data, Microsoft can map malicious infrastructure, gain a deeper understanding of sophisticated phishing phishing operations, disrupt campaigns at scale, identify what was cool though, and I'll have to go through it.

I'm not going to read the entire thing right now, but when I was looking at it last night, like they were catching like some of the information they got, this wasn't just like a nation state.

They were getting information from everybody.

Right?

Like nation state.

The, the 17 year old, the 13 year old that was just over in Europe or some guy over here that was literally ended up in that honey pot.

Nice.

Interesting.

Really interesting.

Good on that.

A lot of cool information there.

That's creative because I mean, for the longest time, the Microsoft stack and not unique to Microsoft AWS is also at fault for this as well, right.

That if you look at the amount of techs that have come out of low cost or free tenants email and stuff that have been able to be spun up there, we actually, we were having a conversation with our email provider.

So not naming who they are, but they were like, hey, we see that you put a hard block on anything that was coming from an, on Microsoft.com domain.

Yeah.

Because I think there's a lot of providers out there that don't understand what that actually stands for.

Right.

That anything net new.

Your tenant is something dot onmicrosoft.com.

if you see any email from there, that should be a dead giveaway that somebody's screwing around with you.

Yeah, that's funny because I thought the m's on your shirt and hat there stood for Microsoft.

Oh, well, I thought that was Microsoft Field behind you.

Eric lives in Windows 95.

For those of you that were watching the video while listening, I said that comment while Eric was taking a big swig of water and he literally just.

Almost like, yeah, almost had to protect my tech here recording it.

It was like a Gallagher event.

Well, the idea of attack, the idea of honey pots like that is, you know, obviously not new, but be able to extend it that way is good.

I think we need to do more of that.

It's hard to, it's hard to find the time inside your organization to actually spin up those kinds of things unless you have a really big, really mature organization like Microsoft resurgence now.

Right.

Because I obviously talked about Microsoft doing it.

As we look at we've started, I mean, under the coin of like the deception vertical, you saw a TiVo come up, get acquired by Sentinel one.

Pretty cool stuff they're doing, and it's not unique to them in that space.

This is the new wave that, hey, we finally, for the longest time, acknowledged somebody's going to get in, but if we can now start feeding them some crap data and get them to jump for one of these things, we can start to pick up earlier on what they're after, what they're doing.

Preston.

See, I did think that was not beating anybody up here either, but I thought Ativos deception technology was some of the better technology in the market.

The acquisition, though.

So like at that same time when you had crowdstrike by Preempt and then Sentinel one bought a TiVo and everybody was looking at it, not necessarily for TiVo's deception technology, but more on some of the stuff they were doing around identity.

And everyone's like, yep, we just bought an identity solution.

We're going to integrate one agent, still one agent, right.

And at the end of the day, like after a set period of time when x number of engineers, or I'll just call them like, the overlays are no longer there anymore, I don't know that there was a core understanding of how to position the deception technology of a TiVo, and it was really good stuff.

And it was like all that momentum that they had talking about it.

And I'm not going to say that I know stuff that I don't know, but when you have a lot of salespeople or engineers that all leave a.

And then you have the rest of the company that's trying to work on the identity piece, it was like the deception technology kind of almost got left behind in the story.

Yeah.

So this is not, this is a conversation I've had with a couple tech CEO's recently that I think certain technologies, they have to start recognizing that their position is not only a market position and where they fit from a technology stack perspective perspective, but also from a maturity roadmap and the companies that theyre targeting, and I dont think they often get that, that certain companies are further along that, hey, ive got a lot of legacy tech debt.

Ive got to pay down.

Ive got to fix the architecture now that weve got that and thats where were going to spend our time.

Now we can start bolting on some of the cooler technologies and start to take advantage of that.

But if you don't buy the new cool tool now, you'll, your company will die.

That's where some of the pen testing I shouldn't call it pen testing as a service.

The sass, PTA solutions and breach and attack solutions.

So I'm talking like.

And if we're going to name names like the Pantera, the horizon threes, the on defense, etcetera, what I thought was cool is some of them, or at least one in particular, is now working in the honey pot piece.

So it's almost like working in tripwires.

So, like, as you're doing your.

Your patch Tuesdays and then your breach and attack Wednesdays, to confirm that all the patches were done correctly, appropriately, or if you deployed a new this, that it was configured correctly, and then they're leaving behind, as they're doing those simulations, leaving little things behind right when they find gaps or this or that for whoever comes next to hit the bell.

Interesting.

I'm like, that's actually pretty cool tech.

So instead of just giving me, like, I do a pen test once a year, twice a year, right?

I put this in.

Yeah, I get the breach and attack simulation part.

You can scan way more ips really, really, really fast.

But then I got a lot of work to do.

If you leave something behind that rings a bell right now, it's like, sweet.

Now it's that honey poppy.

Sorry, go ahead, Eric.

No, I was just going to say, I think that's a perfect example of an evolution that's super cool, but still predicated on the earlier tenants.

And, you know, I'll pick on the CIS 18, right.

That until you know what assets you have, where those assets are, that deploying something like that, you're doing a shotgun approach of thinking that you understand where it's being deployed and what you're protecting, when actually some of your biggest risks probably fall outside of that known container of assets you have.

Knowing both you and Dan, though, I mean, you guys would sign a document if your bot management came to you and said, dan, do you know where 100% of all of our assets are?

Sign this document that.

Yes, you do.

No, no.

Right?

Like, now, there are things out there from an asset discovery, et cetera.

But again, you get into that, like, what are we capable of doing on our own, right, from a maturity standpoint?

And then what would we invest in to help us figure that out faster?

And if you're one of these companies that I'll say, like, let's say Fortune 500, right?

Like, if you're this big today and you've been around that long and have so many legacy old assets out there, deception technology would be really cool to put in there, right?

Because I don't even know where everything is.

Right.

But if I could get some stuff at different gates, right.

To be alarmed or get stuck in.

Sweet.

And maybe I'm investing in some type of asset discovery solution.

But.

But a very large but.

Um.

The idea of putting.

Yes, I have the large but, um.

But putting things in.

Into an environment where you don't understand the environment.

Not even.

Let's not even say fully, let's call it 80, 90% throwing a mechanism in there, and then you end up spending a lot of time chasing against things that may or may not be true.

That, to me, is a resource strain that combined with spending whatever it was on the tool that you'd only getting 20% of usefulness out of in the first place.

I am so fundamentally stay at basics until you are to a maturity point where you can make small, measurable steps forward.

That throwing that stuff in.

In an environment, unless you know you're wasting both your own money and your resources money.

And that's why they named it a honey pot.

So, honey on the glycemic index, very, very, very low.

So when you look at fructose versus glucose and that process, from a diabetic standpoint, it is way healthier for you, regardless of how much of it you eat or where it spills.

Right.

Like, that's why they call that a honey pot.

Yeah, but I'm out $100,000, and I sent seven people running after you after stuff that doesn't matter.

Yeah, that's not Brian.

Hashtag cyberpubear.

Well, you tell the board, like, yeah, but, guys, it's super low on the glycemic index.

Like, this is way healthier for us.

But I bought a honey pot.

Are we using it?

Well, no, but we bought it right now.

Hopefully, you're not running it on vmware.

And it now just went up ten x 20 x in cost.

Oh, two, actually.

I got a great how to pull that together.

You're correct, Daniel.

I will agree with you.

Because outside of being low on the glycemic index, the idea of honey and where honey comes from, if you're buying honey at the grocery store, mass produced, coming in a jar from God knows where.

Yes.

You're getting the good sugar.

Tell us something.

Is that a Michigan cup that Dan was just drinking from?

Yes.

Oh, my gosh.

It is that back up.

There it is.

Okay.

All right.

Just wanted to call that out.

Yes.

Because I.

I reuse and do not throw away from.

It's from the game.

From the Wisconsin Michigan basketball game I went to.

But if you're worried about your security, your posture, right, the idea that maybe we have some allergies in there, things start to flare up in the spring or during, you know, election season, et cetera.

It's the local hunting, right.

In your environment that is best for you.

That's the stuff that they give a little bit into your cereals, your tea, etcetera, to your children.

Its like giving yourself a little bit of that sting of every plant in the environment in very low dose amounts with the sugar and other things in there, right.

So that your body ends up building up immunity to the pollens, right.

And thus reducing down those seasonal allergies.

So, Dan, to your point, totally agree.

If youre just throwing random honey in there aint going to work.

You got to figure out your local environment and go get a honey pot.

That makes sense for the allergies in there, right?

Like, come on, guys, local honey.

What?

And now what if we just start becoming, what if we get local cyber bees?

Can we just better, because they're, they.

Understand your environment even better.

Like what happens when you, like when you have all these almond orchards and everything else that are bringing bees from Michigan out there and then those bees hang out, but they don't really know the environment.

Hang out with a bee, they shouldn't have come back with a little something something and boom, beehive dead.

Right.

Like you got to know the local environment.

Absolutely agree with you there, too, Eric.

Great point.

Are you advocating for a cyber bee in every, in every port?

It is actually kind of funny that you bring this up because I was talking to somebody last night.

We were grabbing some beers and talking about how their sales.org is structured differently from a company they were previously at.

And the kind of the national marketing and push for sales versus being able to create regional pockets that start to understand organizations and where they are.

And just the vast difference between the coasts, Midwest, and the speed at which companies are moving what they're actually looking at.

But if you try to take that holistic approach, just like bees and honey, right.

You got to have that local touch.

Yeah.

Yeah.

You really do.

I want to flip to something else, though, in that discussion.

And it's about resources and budgets.

The fact that throwing money at tools, throwing resources at tools, it was, you know, this was a lot easier in a day in which the, we were seeing information security budgets stay or grow.

I think we're starting to see the, well, we've, now, I think we can all agree we've seen the end of the, of the unfettered growth of security and security budgets.

The, there's just, I guess we're having to do more with less for the first time in a very long time.

And as a result, we started to hear more from people about, I guess, overwork, unhappiness in work, doing things they don't want to do.

I mean, I'll be very frankenous.

I, if I have to fill out one more security questionnaire, I'll probably throw something, which, by the way, my afternoon is filling out security questionnaires.

But the, but there's all sorts of this going around in organizations.

Real quick, what I'm hearing, Brian, is GTS should actually send Dan a questionnaire about his involvement in the upcoming Michigan, Michigan state tailgate to understand the controls that he has around the environment, what's being brought.

I got, my controls were all thrown out the door when they made it a late game and now have completely made me unable to go.

The, the, just the idea here that we're starting to see real pull on this environment.

I think organically this and our field has already been one that's very taxing mentally because of, because of the topic area, because of continuous bombardment, because of continuous threats.

There's never a downtime, there's never a good day to take a vacation day.

All of those kind of things that come in just naturally in the infosec field, but then later on to it, we need you to do even more.

We need to take the existing people and use them in more ways, despite the fact that the outside threats are growing and we can't buy the tools we need to, and we need to, um.

Or we can buy the tools, but we can't really get the people to run them.

I guess I I'm, I'm really curious about impacts.

I'm really curious about the experiences you guys have had and seen with people, you know, people you work with, obviously keep names out of it.

Uh, but you know, that how this is starting to play out and what can we do about it as a field?

I'll say, go ahead, Eric, if you want.

I was going to say I've seen a massive.

How do I say this?

Almost everyone that I work with on a personal basis, from my job standpoint and what I do in terms of companies I work with, I would say one out of the ten is okay or intent where they're at, the others are not.

And then across that entire ecosystem, I have, like, I guess I got to take this, like, with a grain of salt.

But I have never in my life seen as many security projects pushed, hunted or kicked in the last six months.

And I'm like really, really surprised.

Even companies that have gone through situations, I'll refer to them as incidents.

Right.

Or even breaches for that matter, from a budget standpoint, be very, not just conservative, but as like, just kind of like, hey, we're cutting a.

We're cutting, we're cutting.

Yeah.

From my perspective, I begin to wonder if we're all right.

So I think we can agree the days are gone of money being thrown after an issue without questions and justification.

Right.

I think that was the boom that we saw in security.

So as the money dries up, that is just being thrown around forces you into a position that you have to be better at justifying.

Why?

Why should I invest in this?

What do I get as an organization?

What's my risk offset to be able to make that, that investment?

And I think we're starting, this is going to shed a new light that we have not evolved enough as security leaders being able to tell that story that we cannot continue down this path of bolt on technology after bolt on technology just for the sake of, oh, this is super cool, it does something new, right.

That I think that we need to start looking through the lens that as we think about all these different tools.

And I think it's fascinating now that if you look at a lot of the different security technology, not as much the ups, the kind of new starts that are coming in and disrupting some of the industry, but we're starting to see the acquisition palos buying them, checkpoints buying them and starting to.

Not that I'm advocating that we go back to an era of platforms because we've done that on an episode, I think everybody refer back to that, you know exactly where we stand.

But you're starting, unless it's a fantasy hacker season, it will be on a platform.

But you're starting to see this Venn diagram now with so much overlap on what is offered from these different platforms.

And I think that now more than ever, we are in a heightened level of tool scrutiny that we need to be able to not only try to seek out net new spend, but take the hard path and starting to repurpose spend that were constantly having to start looking at some of your partners that you already have in the ecosystem and sort of like, was yesterdays decision the right decision today?

Or can I take that spend and maybe find somebody that's almost as good in the space that I bought them for, but also adds this, this and this feature to give us a broader perspective.

And I think this just, this is where we had to be to start working harder and understanding and rationalizing what we're doing.

Yeah, there's probably, Dan, if I could.

I was gonna say, if I could interject there, too.

Eric, I really do agree with you.

But I also think to the point of that, like, I look back, not because I planned any of this, but like, 16 years in automotive working for the same company.

Even at the end of ten years, it was very hard to understand the entire business that Aishin did right.

16 years did give me a very, like.

That's why I always revert back to automotive from like, a large supply chain.

The idea of quality control, production control, etcetera.

It's very easy for me to go back to that because I was in it so long.

But when people change from vertical, vertical to vertical to vertical, every company, two to three years, if you're a good extrovert and you can understand business well, and you can tell that story, great.

But the number of people that were in security, that were introverts, that just got promoted because they were the security guy and understood that security environment, I see a paradigm shift in two things.

One is there is not a limited budget.

There never was.

But throwing money at stuff just doesn't happen anymore.

So you really got to be able to explain it, right?

It used to be like, quality problems in manufacturing.

That was our number one line, right?

So as things happen, you just threw money at it, right?

But at some point, you're like, why don't we just go back and rebuild the entire line on the next generation vehicle and remove all this added bolt on crap that we were doing.

Second thing there is that help that you were getting.

You had the people working in security today, the cisos, the directors, the admins, et cetera, are working longer hours than they have for a long time.

I can say that just sitting in my position and having it on the phone at some of the hours I do, where when they were some of these analysts that were like, when I was contract, I was done at 8 hours.

At 9 hours, I'm working more hours for less pay.

Like, I'm not even sure why I wanted the full time position, because I don't see a road at the end of the tunnel, because I've been passed up two times already, because there's no budget to promote me right.

And I'm like, that is a very disheartening thing to hear.

Sure.

So I'm gonna go tangential for a bit.

I think the, if we start to boil this down on introvert versus extrovert, that's a crutch.

Yeah, right.

Totally agree.

It's way more nuanced than this.

I just had this conversation with one of my peers and came out of leading a two day strategy session.

I mentioned to him at the end, I go as an introvert, I go this is going to suck.

That I had to lead it because it was the right thing to do and it made sense to do it from security focus and just the lens that I was coming from.

But you pay for it at the end, the next day just completely drained.

With that in mind, I go back to something Earl Dubie said at one of the talks back at CSa.

He was doing a fireside and he looks at everybody.

He goes, you think you want to be a ciso, you don't want to be a ciso, right.

That everybody looks at it.

That, oh, it's the title, it's the control, it's all of these things.

But there is, there needs to be a retrospect that you can be an introvert but you still have to find those opportunities because that's part of the job to be able to connect in with people.

If you go in purely tech focused and go, I'm just going to do the typical gremlin, no lights, not going to talk to anybody, thats not the right role for you.

And yes, you are going to add a ton of stress to yourself in doing that.

But I look at it as youre talking about the amount of time that has to be spent.

And Im going to preface this, Im not advocating that leave your companies in a precarious position, but have had conversations with a number of people that put in way, way, way too many hours and what they end up doing is, but if I don't put in the number, the hours, then this is going to fall apart, the metrics are going to look bad.

I go yeah, but you're actually masking an underlying issue because you're doing that.

That if somebody looks at your metrics, pick on a help desk, right.

That if I look at abandon calls or how long first time resolution, stuff like that, you're making it look like nothing's wrong.

And this is, it's counterintuitive.

But if you don't step back and put healthy boundaries in place to protect yourself, to protect your team, that is going to continue and it's going to get worse.

Yep.

A hundred, a hundred percent.

And the way to affect change is to in there.

What is, what causes the, what causes the pearl?

It's the sand, it's the agitation.

What causes change in an organization is the pain.

And I use that term lightly, but sometimes you have to have, the organization needs to understand that there's pain or there's no impetus to change it.

Right now.

None of this is negligence.

None of this is, you know, abandoning it all.

But in cases where the, the catalyst becomes, we clearly know, we clearly see we have a need for this because something's not getting done.

Things are taking too long.

We're not meeting SLa's.

All of these kinds of things are the inputs that gender generate the necessary kind of change and help understand in the bigger priority, guess what, security leaders.

This is exactly what happens in the rest of the organization.

The people who aren't in guardian fields, in protector Fields, who don't feel this ethical, heartfelt need to solve all the problems and make sure that, no, that the breeze will never hit their faces, those kinds of things.

Um, and we got to change some of that.

Everything that I just heard.

Yeah.

Was, was correct.

But I think there's also some other elements here I think it less has to do with.

I think you guys are both talking about things at a personality level, but I think there's something a little more about we need to take it up one more level and look at the type of role that's involved, the type of CISO role, the type of security function that's there.

I, um.

And then that helps to dictate the kind of person that can go into that role, you know.

Um, as it happens, I'm doing a, um, uh, are two of our, of the show's friends.

Um, yeah, Jess Byrne and Jeff.

Jeff Pollard from Forrester are just finished a new update to their, what it, their future of the CISO research, in which there have been six archetypes of cisos.

Uh, it's really good research.

Um, it's paid research.

So if you're a Forrester client, go to it.

I'll put the podcast version of this into the, uh, the public podcast into the show notes.

Uh, but, uh, go take a look at the research.

But as it happens, in December, I'm, they asked me to come out and do some, do a panel at their security and risk summit, uh, in which we're going to talk exactly about this, about the archetypes.

And I think the archetypes like the, um, the post breach Ciso, like the policy and risk CIso, like the transformational ciso.

Like all these kinds of things dictate different personality types, different needs, and they're in different focuses.

Like, there's one that's more of an operational, see?

So, like the run, run the bank kind of person, which I have no interest in.

Like, as soon as it gets to running, it's boring to me and I'm out and I want to, I fall into different categories.

Um, I think that has less to do with, you know, with my, what has a lot to do with my character traits.

But I think it's an under important to understand the nature of the job you're stepping into in the organization.

Uh, and look at the characteristics you bring.

So I don't think it's the introvert extrovert that, you know, the run the bank one, the operational can very easily be done by an introvert because it's just crank or the policy, the policy wonk one absolutely could be done by an introvert.

I agree with you.

And I think in a lot of cases that sometimes it takes time for somebody to figure out what is it they really want.

Right.

If I look back to early my career, that I had a conversation with a recruiter, and one of the comments I made at the time is I don't want to go into an organization and build up a security program again.

Now that I look back at that, boy, was I wrong, because I started to recognize the same thing, Dan.

I have no interest in just being there to run, to keep the lights on.

Steady state bores the crap out of me.

But at the same time, I also recognize that if we almost think about this in the context of crossing the chasm, right, the early adopters and stuff, that as you look at a company that does not have a security program today, while should be only a few of them, I'm probably not the right fit for that as well.

Because I see there are those cisos out there that are much better at having, much better on a personal level, that are connecting with people and being able to help them understand why there's a need to start investing in this whole new area that we've really never paid attention to before, or just falls as an add on hat to somebody else.

There's others out there.

Not to say I can't do it, but there's others out there that do it way better.

But once that need is realized, to be able to come in and then build out a program hundred percent like that's.

That's what I see as my sweet spot.

Yeah.

But I think the mismatch is a lot of what's causing people's challenges too.

Don't get me wrong.

Organizational constraints, environmental constraints, economic constraints, costumers, customer constraints.

Where people aren't buying this, it has to do with this across all this is not just.

In fact, I'm going to specifically exclude security software.

That's a byproduct, it's trickle down portion.

But if you look at just revenues in general, people buying things in the b two c world, things costing more so you can buy less, salaries not necessarily going up in association with that.

In the b two b world, everyone is contracting their budget, so everything is cutting.

So there's outside forces that we can't avoid.

No matter whether I'm in the right role for my, the right role archetype for my personality or my characteristics or nothing.

So then you have, and I share this with both of you, and I'll put this into the show notes.

It was Blackfog had a, had some research recently on cybersecurity.

Leaders under pressure is the title of it.

24% of currency sellers are looking to leave their role, but 55% are open to new opportunities.

The 24% are actively looking to leave, which I guess in a 10% churn world isn't too much higher than a normal churn life.

Uh, but 54% over half would take something if it showed up.

Um, but here's the part that, that's really interesting.

93% say stress and job demands are driving their decision to leave.

Um, the stress that the job.

So, you know, it's fine to say, I'll put on my best, um, chief people officer hat for just a minute and say, look, you know, it's, it's fine.

We can always hire another one.

There's a lot of people out there.

No, there's not, says the narrator.

But any kind of churn like that in a role that's become so business specific, so sorry, so business important, it's part of selling, it's part of go to market, it's part of internal operations.

Anything like that that causes a ripple.

It's.

It's.

It's almost like when you change a CFO or almost like when you change, you know, a cooze.

I dare say we're not quite at the same level yet, but I think a level of impact or level of ripple, but I think it definitely is getting there.

So this is pretty big, this number of churn, this amount of overstress this amount of job demands and environmental.

So what can we do about it?

How can we fix it?

Short of hiring more people and working less hours?

Saw the light bulb over Brian's head go on.

No, that's just because Kelly turned on.

The turned on the lights article that also highlighted to the number of hours that somebody's working today versus when they.

Versus having somebody that was a staffed not staff employee, but staff augmentation, somebody that was a contract employee.

Like, but I'm being paid the same amount of money.

Like, this just isn't worth it.

My stress level is higher.

I also look, I think in the last year or two, especially with companies being breached, this is going to go to culture.

And it's not just my personal opinion, but, like, what I sit and witness now in my chair in working with companies across North America, in a japanese culture, working at Aishin, if somebody screwed up the launch of a vehicle, they didn't get fired.

They had something that they referred to as a window seat, right?

And, like, in american culture, you'd be like, so you're telling me if I screw something up, you're going to give me a window seat on a high floor?

Dude, that sounds awesome.

But the reality is there you get a window seat on a high floor to look over the world, right?

It's reflection as the world goes by.

But you're kept there to understand the problems that were faced.

Like, they don't get rid of you, they're going to build you up to become better.

There's not a single CIsO alive that I think would say, yeah, I'm working for a large company, and I know if we get breached, they're going to keep me on to make sure that I get better.

No.

And with what I've seen in the last six months, like, the feelings that people have gone through when there's been something bad that happened, think about when you.

When you have true fear, you resort to self preservation.

You start to make decisions just to protect yourself.

I have witnessed some very startling stuff where it's like, I.

I tried to do everything I could.

Now I'm fearing for my job.

Now I'm fearing for my not life, but I'm fearing for my job and my well being, right?

And I'm working so many crazy hours, I don't know if I even have time to go find something, right?

And they're not happy.

And there's a personal like that impacts your family.

Dan, that presentation you sat on with Christy Fosi.

Oh, yeah.

When she talked about, like, what changed from COVID till now.

The ability to work more hours is what changed.

Right.

When you're not in the office.

Although.

Although, to be fair, that's been the case for remote workers since well before.

COVID But now you have, like, as it in that stressful executive leadership position.

That 30 minutes drive home to go pick your kids up was a time to kind of.

And now I totally agreed with her.

I am still on a call as I'm picking up my kids, right.

And when they're getting into the car, I haven't even had a moment to let 30 minutes to unwind, to get ready to be that parent.

I'm like, guys, guys, I got five more.

Yeah, right.

Yeah.

No, I get it.

As somebody who commuted, I took a train every day and it was 45 minutes of the best time of my day because I'd get up in the morning, it was early in the morning.

And you get up and you'd read.

I'd read the financial Times that I read the Wall Street Journal and I read the Tribune.

And then I'd listen to 20 minutes of music.

And then I'd get there and it was.

And then on the way home, same kind of thing.

It was ability to, like, really put compartmentalization between your life.

This is also before BlackBerry, but this is also before blackberries.

Wall Street Journal for me, can you summarize this?

Right.

So instead of, oh, I got it.

Such a cop out.

Unpopular opinion.

AI is a cop out.

At the expense of sounding unempathetic, though, to that, I get it.

There is a real fear around job loss and what's going on at the end of the day, we knew this going in.

This isn't anything new.

Right.

Like, I came into the current role that I'm in, knowing that if something happened at some point, I'm going to be finding something else.

Now, if we would have put the lens back, I think if we go back all the way back to TJX and target some of the bigger original breaches, right.

Then a lot of us at that time would have said, all right, it's a death sentence.

Right?

I went through a breach.

Now I'm not going to be able to find another job.

That's not the case anymore.

Right.

There's almost an element that it's a badge of honor that I've heard Cecil.

Those that are trying to break into the Cecil ranks that were shut out because they've never gone through an incident or a breach because they don't have that experience, that experience.

And I'm sure, and Dan, hashtag truth.

I literally had someone reach out to me and say, hey, we're looking for somebody.

This guy gone.

And we're looking for somebody that has experience of going through a breach.

Literally, like, that was requirement a.

And then came BCD.

I mean, it's no different than some of the other executive ranks that are out there with the.

And I think in a lot of cases, we would agree in a CE role role, especially in bigger companies, that you could screw things up terribly, get a wonderful parachute, and then go do it again somewhere else.

Sure.

I don't think cecils have risen to that ranks.

Just my personal view, just throwing that out there.

Cisos haven't risen to those lengths yet, but I am starting to see some of that grow now.

And knowing certain people that, in their current contracts, had built in language there, what happens if I get let go because of some type of event?

So I think we're growing in that direction, and that comes with the territory of holding bigger roles, making bigger decisions.

And, I mean, look, for the longest time, we've been asking, we want a seat at the table.

We want a seat at the table.

All right, you got a seat at the table.

And now we start to look back and go, well, I'm afraid of the risk of what happens with that.

Ask for it.

Yeah.

And I don't think this comes back to two things.

Um, a theme that we've.

We think we've all, both you and I have said a lot, Eric.

I think, Brian, you agree with being the CISO is not for everyone.

And the.

And what I.

In the podcast, the Forester podcast, I think Jeff said it perfectly, and I texted him right afterward because he said it was a quote, you don't want to be the CISo.

And it really, you really don't.

99% of people, security practitioners, et cetera, don't.

You really don't.

And if you do, you probably don't understand the role.

And then there's the 1% that do.

Uh, because we are gluttons.

We have the right.

We have the right personalities, we have the right interests, et cetera.

But it's not a role for everyone.

It is not the next bigger role.

And I think this is really important, as people do career planning.

It is not the next bigger role for a networks director, or it's not necessarily the next bigger role, and it shouldn't be seen as that because guess what?

It's a business job.

It is not a technical job anymore.

And if it is still in your organization a technical job, you're doing it wrong.

Like, hopefully there's not a ton of ctos that listen to this.

But I'm going to go out there and say, like, I hope there are.

Because that means we're getting good, good viewership.

Even CIO's maybe don't want to be in that position anymore.

But to be the CTO working with the CIO and the CISO, it's like, yeah, I use the word digital transformation in my interview.

I use the word AI in my interview and I know that I can pull in and get massive budget because I'm the chief technology officer.

I need to change things and get all this new tech.

That's what technology does, right?

Like I'm saying that half jokingly.

I'm not also look at it when I see the amount of money spent in the data storage, the, all the weird data analytics, the amount of money being spent on consultants to come in to consult on AI right now and come on in and it's like, and I'm talking to your same security team and they literally just told me like, yeah, we're going to push that again.

But this is.

Yep, we know we need that.

We're going to push that.

This is where we have to start being creative.

So I think the one thing that I see, and maybe it's just because being in the industry that I want to see it this way, I think security is uniquely positioned and having purview across the entire organization.

We have to understand purview is in.

The Microsoft product purview or purview as.

In you're not licensed to say that word.

Yeah, Microsoft, no purview.

Thanks.

Not a sales pitch.

I have no idea what it actually means because they keep changing the names and so I just give it up.

I don't get it.

Yeah, when they mention it now, I'm sorry, what tools did I originally know that you collapsed in there?

That you're now asking me to pay another license?

Okay, off the.

But I do want you to come back to this.

I'm going with the think.

I think we're uniquely positioned to see across the organization.

And if we only use the lens of our propeller hat and look at it from our own security perspective, we've missed the opportunity.

There are opportunities to fix inefficiencies, to draw, draw, drive innovation across the organization.

And this goes back to a conversation I was having with a vendor that plays in the OT space and protecting the plant floor.

And as I was talking to them, I go, you guys have not hit economies of scale yet that your install base isnt big enough, that your cost structure is now going down.

And what that means is that to try to purely position yourselves as a security organization, a security play, the cost is so high you're not going to gain traction.

But if you find the right maturity level and the CSO that actually views themselves as part of the overall business organization, you can start to reposition it.

That hey, I can now use this technology to get better data off of my machinery.

I can aggregate it, I can use it to make decisions that directly has a business impact on, by the way, it's way more secure that's put in there, which is an added benefit.

That's we need to be the.

So I don't.

Brian, I need.

I need to come into this one.

Yeah, I need.

There is, there's so much about what you just said that needs to be.

I want to repeat it.

The information security, and I'm purposely not using the term cybersecurity because this is above that.

This is about information.

It's about data flow.

It's about.

It's a broader topic.

Is so well positioned to be the new enterprise architect for the organization.

I just finished about five months worth of data mapping activities and some of this is related to the privacy portion of my role.

But it's also equally to.

Yeah, if you don't know what you've got and where it's moving, how can you protect it?

Portion of my job.

And I can argue, and this is across 15 brands, I could argue that I am one of a very handful.

Count them on one, maybe slightly into two hands, people that has a true understanding of the whole organization.

And I don't say that to be glib.

I don't say that to be bragging.

I say that to be that we, through the nature of what we do, in order to protect it, you've got to understand it and you've got to understand how we sell it.

You've got to understand how we, how people buy it.

You've got to understand where it sits.

All of the above.

And I think that that then lends to a change in information security leadership, which changes to be much more advisory.

And this comes back, Brian, to your CTO question, your CTO comment that, that the CTO then becomes an extension and enabler to execute that.

The CISO says, here's how we're going to do it.

We'll advise you, we'll give you the information, we'll come bring back the things that you're doing, and we will tell, will help give you the risks.

It really becomes a risk advisor and a policy one a little bit and a little bit of organization.

But also, I mean, I find myself advising on how to sell.

I find myself advising on how customers will want to buy this.

And it's a role that I never thought that the CISO, or in my case, chief security and trust officer.

And I think that's really important.

This is the evolution from CISO to trust that that isn't quite as broad or widespread.

That's what I wanted to say.

Go ahead, Brian.

Wholeheartedly, 100% agree.

Network security infrastructure, what you just said there, like CTO, mapping out where all your data is, right?

Mapping out where all your data is coming from, understanding your network and how it was set up and why it was set up.

When it comes time to go through a change or network team or infrastructure teams working on this, if you have that security background to say, hey, guys, this is who we, this is how we've been doing things.

This is who we've been working with.

But there's a better way, right?

Let's look at how we could either a simplify this without having to bolt on security tools later, right?

Like, I look at some of the network as a service companies.

You could do that yourself if you were going through a big transition or a big change.

Even my daughter agrees, right?

She's throwing the brush out like, dad's going through a transition with his beard.

We could brush it right now, same thing.

And then I like, even when we were just talking about the secure web browser, right?

At the end of the day, like, is that a security budget or is that something that would be useful for so many other groups within the company of other problems that it solves and efficiencies and everything else, instead of making security, try to sell it as a security tool, right?

Like a group, we stop thinking about it.

A security budget.

We think about it as an enterprise budget with security components to it.

It democratizes security into everything.

It is not security versus everybody.

It is not us versus them.

It is everything has a security budget.

Comment about creative and using it at the expense of becoming Matthew McConaughey Wolf on Wall street and chest thumping here.

Going into this year and looking at the economics, there was no way that we weren't going to have some type of business impact, right?

Consumer spending is linked to interest rates.

Interest rates were out of control.

When that gets out of control, people don't want to spend on discretionary goods.

Right.

I'm going to pull back.

So what does that do?

That hurts an organization.

So knowing that going in, we were flat on our budget, which was actually a great opportunity to show throughout the course of the year that we repositioned our spend in different tools to find where we could take that money, be neutral, but reapply it to something, gain features without having any additional impact to the financials of the organization, and yet coming out in a way better risk position.

Yeah.

It also breeds an organizational philosophy of mutual benefit rather than fiefdoms.

And my budget, my, my budget, my tools, my world and swim lanes and that kind of stuff.

And I know there's some organizations that really revel in that, you know, stay in your lane stuff, but I think the more we do blended where we are, um, we're, we're ble embedded advisors across all units.

We're trusted advisors.

This comes back to the trust piece.

It's not just customers talking about asset discovery tools earlier.

Right.

And why that could be important.

We were talking who's like, where could security help a team?

Like what team is responsible for purchasing all these said assets and keeping track of all of them?

Sorry, guys, your budget, I'll help you figure out what the best solution or tool is with your budget.

Right.

And you over there, it team that does the patching and everything else.

Did you know there's tools that help integrate into this salesforce solution that you guys bought in the service?

Now here's one to take a look at versus this piece of turd that you were about to go buy.

Did you know that my buddy down.

The street told you you liked it and his cousin makes good daiquiris.

Did you know that?

My sim takes in all the logs from the entire enterprise.

You know what, you don't need to buy an additional APM.

You don't need to buy additional logging solution.

Just tap your, your developers put API tools, use the APIs and build something cool to query it.

It's all there.

We don't need to buy twice.

Yeah, same kind of things.

And it's not, this isn't unique to technology as well.

No.

You could use this in the context of headcount and stuff.

I mean, there's been times where I've taken headcount out for our team because as you start to look at others around you, knowing full well that if they don't get key positions, what happens?

Things roll.

I don't want to say downhill because it makes it sound like security's sitting at the bottom of the hill taking everything else.

But when we need to action something, we need to move the needle.

The resources that we would typically try to influence outside the arent going to be there.

And therefore it puts us in a position.

We have to do all of the work ourselves.

Youve got to be a strategic part of a much broader team and totally agree with Dan that if we continue to sit there in just this myopic lens, my budget, my people, my tools dont touch, were going to continue that everything that weve gained as a security community is going to start to devolve.

We're going to lose that seat and.

Dirty little secret to close out the show.

If you're enjoying what you do, if you're doing broad work like this, that's meaningful.

You're going to, you're not going to notice the extra time you're spending quite as much.

You're not going to feel it.

It's not going to feel quite so pained.

And the reality is we do need to do more with less in this world.

We can't just say, I hit my 37.5 hours, I'm done for the week week.

It just doesn't work that way.

So finding ways to keep it enjoyable, to keep it meaningful, to not get knocked down in the, in the GR, in the drudgery and not let that take over helps with the burnout.

It helps with, with keeping motivated and keeping our organizations motivated.

It's really important.

And that's what helps keep the organizations that we serve as safe as they can and helps us be part of the broader business that we sell.

We are the business.

We've said this time and time again, it is not security and the business.

We are the business.

And on that note, we're out of time.

Thanks again for joining us.

We love having you as listeners and as viewers.

If you're listening to us on a podcast, hop over to the YouTube channel YouTube.com little security debate.

And if you're listen.

If you're watching us on YouTube, go to your favorite podcast app and find a way to commute to work and listen to us in the car on your way back and forth.

As part of the segregation between home and work, you can find us by searching the great security debate in your favorite podcast application.

Eric Brian, thanks again for another great debate.

You can find us on our website.

We're part of distilling security.

Distillingsecurity.com securitydebate.

You can find all of our episodes.

Uh, you can find us on YouTube at security, at great security debate.

You can find us on LinkedIn, uh, great security debate, search for that, but also part of distilling security.

Uh, and, uh, you can email us in, uh, security debate at distillingsecurity.

And, uh, we'll get back to you.

And if you've hung on this long, go to the YouTube, find this video, go to the bottom and write, I made it till the end.

In the comments, we'll look for them and we'll give you a shout out.

Thanks for being here.

We'll see you again on the next great security debate.