Simply Solving Cyber - Jason Pennington

Welcome back or welcome to Simply Solving Cyber. I'm Aaron Pritz.

I'm Teddy Guzik.

And man, this is episode 4, Teddy. We've talked to attorneys that got into cybersecurity in the education space. We've talked to prior CIOs. We've talked to our last conversation with Chad was he had a triple play, time in industry and consulting and now in in a product, a cyber product company. So yeah, we're excited for this one.

And this one we have Jason Pennington, who is an electrical engineer by trade, who now runs the Indiana IoT Lab here in Fishers. You know, he had a lot of great insights. I've heard some great things about the IoT Lab. I've never had the chance to go there and check it all out, but I've heard it's pretty cool. Pretty awesome. Have you, have you been there?

I have been several times and had a couple events there, hosted a couple events there. So it's a cool space. But basically think about it as manufacturing and creative businesses that get together in a shared space. So it's not your typical coworking because while they have some office space and some common area and some networking area, they've got a whole backend of the building that's all manufacturing floor setup space for modular product development. They have all sorts of machines that I probably couldn't even explain half of what they do, but everything from 3D printers to fancy metal cutters and all of that. So it's a really cool place to explore technology and see companies working. So we'll probably hear a little bit more about that from Jason here in a moment. All right, now we'd like to welcome to the show Jason Pennington, who is the executive director at the Indiana IoT Lab. In Fishers, Indiana. Jason, welcome to the show. Thanks for taking some time to be with us. And like always with our guests, we want to first start just getting to know you a little bit more. And so walk us through your journey and kind of how you got to your role of leading the Indiana IoT Lab, a very cool opportunity to promote IoT and technology across companies in Indiana.

Yeah, well, first of all, thanks, Aaron. I appreciate the opportunity to speak with you this afternoon. So a little bit about me. As you said, I'm Jason Pennington, and I have the opportunity here with the Indiana IoT Lab to essentially provide a place where entrepreneurs, startups, and existing companies can collaborate together and work in this emerging tech sector. So how did I get here? You know, I can say it wasn't simply me, but I had a great opportunity. I worked for a Swiss company named Endress+Hauser for 20 years here in the US market. Through that opportunity, I had really a chance to have a very good firsthand working knowledge of a variety of industries, everything from oil and gas, food and beverage, a lot of those automation sensing type components. We had networking capabilities or just raw analog automation in the past. One thing I noticed over time, however, in my 20 years there in industry was it became a lot less about the unique sensor itself and a lot more about what could our users use, you know, those sensors, those information for, and what value could they derive out of these devices. You know, ultimately, you know, the chance to really disrupt myself, if you will, and take an entrepreneurial opportunity to move into the IoT lab with a longtime friend, now colleague, John Wexler, into this opportunity was something that was just very difficult to pass up. So, you know, through that time I had a great chance to visit and actually work in a lot of Six Sigma manufacturing environments as well as, you know, try to create value either with products or services from the types of factory and process automation equipment that we developed at Endress+Hauser.

Nice. And I think you're an engineer, electrical engineer by background, right?

Right. I started out at Indiana University in Bloomington, and I was a terrible statistics student. And in not so many words, decided that being a teacher wasn't for me. So I went down a marketing path. And while that was great, you know, perhaps at the time, I wasn't really aware of what a data scientist actually was. It was a lot more about, you know, the statistics for the sake of marketing and, you know, other types of product-oriented launches. And, you know, through that experience, I, I did— I was able to go back to, uh, Purdue here in Indianapolis and do electrical engineering, uh, as a, as an evening degree. Um, well, yeah, I guess fairly rounded degree.

Yeah.

And like me growing up, uh, my dad was Purdue undergrad and IU MBA, so a little bit of—

you're kind of house divided.

Yeah, exactly. So of course I picked, you know, Purdue football and IU basketball, you know, early on before I went full-fledged IU. But definitely seeing both sides of universities, it's definitely best of both worlds. So you got a well-rounded background, it sounds like.

Yeah, we're, we're pretty fortunate to have that opportunity in the state here.

Nice. So tell us a little bit about Indiana IoT Lab and how it came to be with John Wexler and kind of some of the state support and what you guys are focusing on right now.

Yeah, so the, the IoT lab, we started a couple years ago, um, actually I'll say 3 years ago now. Uh, the IoT lab was an idea. It really started as an idea that sprung out of, um, our, our overall history with an initiative called Launch Fishers. And Launch Fishers was a, uh, very much an entrepreneurial idea that started, uh, really in the basement of our local library with you know, maybe 10 people. It was the state's first, first coworking site.

Okay.

And it was really kind of a unique concept, you know, 8, 9 years ago now. And, uh, over time, uh, LaunchFishers is now 600+ members, maybe a couple hundred companies associated with it. And, uh, you know, really now approaching $150+ million venture capital from the companies that have come out of there. Wow. I'll say one thing that was very evident, however, and maybe the timing was just right for me, was with some of this new connected tech, really disruption going on in certain industries like manufacturing and agriculture with this connected tech, there started to be some companies that perhaps, you know, they either didn't belong at LaunchFishers or they were looking around for different opportunities simply because they needed access to different types of amenities than you might find you know, in a standard office space. So the IoT lab, with a few stakeholders, a couple of local companies, one was ClearObject, one was Flexware Innovation, and then certainly the city of Fishers, we were able to come together with this idea of creating a space. So the IoT lab is a space at its core, but what makes us a little bit unique is that, you know, kind of concrete and steel feel. We have laser cutters and CNC machines and 3D printers and, you know, these sort of assets like developmental networks and, you know, the ability to experiment in a very FCC-neutral zone, if you will, to create this connected technology. So, you know, in any given day here, you may be drowned out. You know, it's a little bit purposeful inefficiency to have a neighbor who's developing natural language processing technology and making audible noises every day, while the next company over is, you know, perhaps casting stereo cameras for the sake of providing retail analytics through 3D computer vision. There's just really some fascinating technology going on here, being developed here, and it's that, you know, kind of almost crowd-based, you know, accountability when you start surrounding people with complementary technologies as well as like-minded individuals, ultimately you'll just have the geekiest conversation and 10 minutes later, you have a new idea coming out of those interactions. So it's been really fun. It's been really interesting and a lot of curiosity. And now we're even to a point where we're gonna start launching our first company out of the IoT Lab with some tech that we developed here.

Nice. And when you say the company next to you, having done several tours and, uh, use the facility, I would, I would say when you walk in, just to try to visualize for the listener, it kind of looks like maybe a traditional co-working with some dedicated company space. But then the back half, right after your connected home mock-up, which is kind of a really cool— I want, I want to come back to this, but it's a really cool, um, it looks like a physical kitchen and you living room and things like that, and everything is connected and interacting. But then you go back into the back and it's almost like an open ceiling shop with various companies that have partitions where you see a lot of the laser printers and physical machining tools and things like that. And then most recently you gave me the tour of the kind of the mocked up IoT lab, which is a manufacturing space that companies can come in and build out their ideas within a simulated environment, or not even simulated, a real environment to kind of try on some of these technologies?

Yeah, so our space, to your point, Aaron, our space is about 25,000 square feet. The initial, you know, call it 10%, 2,500 square feet or so in the building is absolutely beautiful. We have some really awesome aesthetic and decorative partners that helped us make this really look and feel like a world-class office. And then it becomes very intentional with a very static-free, robust environment for a variety of technologies that are being worked on here. Most of our facility was formerly a high-volume machine shop, so we have a lot of power, the smooth concrete, the I-beams, infrastructure everywhere. And then true to our mission, we don't really have physical build-out space here. We partition everything off with very mobile, you know, either whiteboards on wheels or industrial type of lockers. And as our companies need space to either contract or expand based on their runway and where they are with their developments, we're able to then, you know, really expand out or contract their office space in a very, you know, friendly commercial real estate type platform. To that point, that gives us a lot of flexibility here, you know, to have that kind of community spirit where if people have space and they don't need it, they're willing to maybe give it up a little bit. Or, you know, if we need to grow space, we don't really have anything that confines us, you know, to that physical dimension.

So, it's like cloud computing. You can scale up and scale down. There's no No physical barriers, right?

That's right. Yeah, exactly. So, you know, at some point then that really gives us the ability to have, you know, a fairly crowded atmosphere here. You know, on the other hand, we, you know, we're purposefully not at capacity so that the companies that we do have here have the ability to scale in a very comfortable way.

Nice.

So what does it take? What does the process look like for a company joining the IoT Lab? Is there, you know, like an application? Is it like any other work, shared coworking space or anything like that? Or is there a more selective process? Or what does that look like?

Yeah, so generally speaking, we don't like to accept a tenant, for example, like over the phone or blindly through, through our web-based inquiry. So We have members here, so just a general membership, if you will, much like any fitness club. We just, you know, maybe exercise a different muscle here. You can join the IoT Lab. We have a very set fee, and with that you have 24-hour access. We will train you on any of the equipment here, be it oscilloscopes or laser cutters. It doesn't really matter. We offer that every other Friday. For the tenants that are here, we do like to have that kind of face-to-face and build some rapport. Build some relationship and make sure it's going to be a fit. You know, for some companies that haven't necessarily worked in a shared space, it does kind of look and feel different. In some cases, that's by design, and in other cases, you know, we just simply can't help it. But, you know, one thing that's just incredibly cool about this, if you imagine, you know, we have a couple of companies here that are several hundred million in previous exits. High degree of respect and just acumen and pedigree in their respective fields. And to bring in a young company, for example, the 20-somethings fresh out of school with just an incredible idea, imagine surrounding them with these kind of 40 to 60-year-old serial entrepreneurs and that mentorship. This is what good looks like. You know, here's a very diverse team with, you know, that's almost just a choreographed ballet from conception to market. And, you know, we've been able to see some of those interactions take place and it's just such a, you know, a positive thing that is so hard to quantify, right, for a young company. They're learning things just by being associated with some of these companies that you're just not going to find you know, through the best MBA program.

Oh yeah, definitely.

So talk to us about, uh, your thoughts on cybersecurity and IoT and how you see the threats and opportunities to, uh, gel those capabilities together to enable more for businesses.

Yeah, so it's definitely, um, important. If I, if I look back, one of the very first, um, events that we supported here. So we're very heavy on community building. We offer our building, you know, at zero charge for these kind of community meetup.com, other types of organizations that are really focused on the networking and community building with respect to connected tech. I vividly remember one of the very first programs that we did, it was all about you know, the idea of designing security into your IoT product. And this was really about at the time that GDPR started proliferating out about a little bit. California, for example, had just kind of adopted their own version of GDPR. And, you know, through, through that, we started having more of our own little internal companies, small internal companies kind of moving from that dev environment to more of the professional-grade electronic platform. And, you know, to see just some of that mindset follow through with that work of really designing security in from day one. And again, it's almost kind of that, you know, paradox here in an entrepreneurial way, sometimes first to market and the fast to market is creating a competitive advantage or first mover advantage, you know, with respect to some of the connected products, I think to take a step back and playing in a much broader, you know, connected atmosphere, interdependency almost, that security has become really something top of mind for us here. And whether that's, you know, kind of the crypto chip embedded in the electronic, whether that's a soft defined you know, numeric type key, all the way up through like a gateway or a network server. You don't necessarily see anyone here purely relying on the application server, the cloud, if you will, provider to be that first and only line of defense anymore.

Yeah, that's a great point. We were doing a podcast with Mitch Parker, the CISO of IU Health, and one of his tips for people getting into cybersecurity or enhancing is make sure you understand encryption regardless of the vantage point of the business that you're in, because there's so many different options and encryption can, can fail or it can be underwhelming for what your business needs are. So definitely connecting the dots between those two talks. There's definitely some base understanding of encryption that, that, that companies can take to enhance what their product can do, or they trust that it can invoke from a consumer standpoint.

Right. And, you know, just like anything else, we have some subject matter experts in and around the community here that our members either hear every day or they are very active in our meetups. We've had some of these workshops and we actually record these and create a repository. We had the opportunity, oh, in the winter of last year, so still pre-COVID, one of our last in-person meetups. We had a gentleman from a company called Glassboard as well as a company, a Lafayette-based company called SensorHound, and they each have a very strong, you know, acumen and pedigree in the physical security space. So we had really a nice, very educational workshop on something like RSA or elliptic curve cryptography, VPN, all these different kind of methods, and in the concept of, you know, electronics, microcontrollers. What might that do, you know, for designing, you know, your physical thing, if you will, and how those kind of played out with labs. We've also, you know, had those recorded sessions with our Blockchain Meetup here to talk about, you know, creating hashes and what's that really mean in the context of, you know, securing each and every transaction that goes through a Hyperledger or more of a connected interdependent network of supplier-consumer, producer-consumer, if you will. So it's a big topic for sure.

Yeah, I know one of my favorite IoT— favorite, it's not a great story, but you hear the examples of like the casino that had the fish tank thermometer heating device that was compromised to get into the casino, or the connected coffee maker that was compromised to be the vector in. And I'd love to hear, you know, Teddy with his background in penetration testing and kind of unveiling these gaps. I'd love to hear the two of you kind of talk a little bit, dialog a little bit on how IoT and penetration tests can coexist together to solve the problems before the problems are out in the wild.

Oh, yeah. Yeah, definitely. I mean, from my perspective in the penetration testing thing, realm, I guess, anything is compromisable. Anything that's connected is compromisable. And then from there, just determining what it is, how that thing is connected to other things and networks and internal systems and data would be— that's really where your vulnerability lies. While it's not really in the coffee maker itself or in the fish tank thermometer. Like, so maybe you heat up the fish tank to a little bit too hot and your fish don't make it. Or, but really where your, your, your risk lies there is, is in what is that connected to? So, right.

Yeah. Using it as the jumping off point into the broader connection.

We have a, I have a lot of times talking to, talking to people, to clients, they'll try to claim, you know, a printer will have a vulnerability that They're not like, you know, it's just a printer. We're not too worried about it. But it's like, you know, that's an end to something else. That's a stepping stone into your environment. So that should be treated the same way any other high-critical system on your network should be treated as well.

So Jason, how do your clients and the community at Indiana IoT Labs, how do you guys talk about preventing some of these issues that we're discussing here?

Yes. Well, in many cases, I think it depends on the company and their tech as well as, you know, where are they in the evolution or this evolutionary path to market. So we can easily kind of start at the hardware level and move up to, you know, almost as an umbrella, like a NIST model, if you will. You know, in many cases, a startup is not going to have a SOC, you know, sitting behind them watching their first 10 units. In that sense, I think we have a lot of consulting here with those companies on what does that first customer install, those first customer-type installations look like for the sake of iterative product design. And that may be creating an ad hoc network and moving a lot of those first field tests to a local server. That you share with your partner versus using extensive cloud-based data. In other cases, we've been able to work with a couple of our scale-up companies here who have actually brought in companies like Reveal Risk or Ponderance or others in this local market to do that overall evaluation, the penetration testing, and much more of a, you know, consultative professional service. So, you know, at the At the end of the day, I think there's a lot of value in knowing what you don't know. Right. You know, so we can certainly get you started pointing down the right path, but when it gets really, you know, to a critical point where you're holding customer data and you're making a value proposition statement to a potential account, you know, that's where we need to, you know, engage somebody like, again, in our case, it's been Reveal Risk or Ponderance. So, you know, just that's who we have access to. You mentioned Mitch earlier. Certainly, if I had something very critical in healthcare, I don't know that there's anybody better I'd want to go to than him.

Right, right. Well, yeah, I think when you think about startups, you may not have something in production, you may not have something at scale. I think security by design and fixing the gaps or being intentional about your design so you minimize the gaps in your iteration. Is probably the best bang for the buck that you can do until you get to that point where you need to test it more broadly or test it with a client in production.

And that's, again, I mentioned the company earlier, a very unique technology out of the company SensorHound, really driven out of Purdue. You know, they've, they've basically created their own, you know, hardware-through-cloud type integration system, and they've been able to really consult and offer some of that support to to startup companies as well. So, you know, you imagine, you know, basically hard soldering one of their components to your thing, whatever that thing is, you know, at an electronic level, and then really having a handshake through their network server to actually get to any sort of an application-based cloud, you know, that's out there on the market. So, you know, from that perspective, we're adding another layer, whether it's, you know, 128, 256, given the certain risk profile of a real, real end user working with an early-stage startup.

Yeah, that's a good example. So in every show with every guest, we talk about— we ask the guests to think about one of the biggest challenges they've faced. And while we all love technology, while technology is a solution for many of life's problems, We have to give service to people and process, you know, the human factor and how you work with people to create processes to solve problems. So, give us an example of a large problem you faced and where people and process saved the day or was the hero of the solution that you generated.

Oh, that's a tough one. You know, in this case, I think You know, and I hate to be cliché by any chance, but, you know, I, at least at an experience level of 20-plus years in industry, you know, we've probably been through several economic cycles. And now looking at the current cycle we're in, you know, I think part of the biggest challenge we have is being able to interpret You know, the idea that, you know, these are events that actually promote the idea of innovation and creative problem solving. And, you know, given the opportunity, you know, understanding how these sort of, you know, very, very drastic changes to our economy, our way of life, our daily opportunities You know, when these type of drastic changes happen, you know, I think we have to see it as an opportunity. And, you know, perhaps now in a little bit more of a leadership role, I think it's a good chance to, you know, really to kind of exhibit and make sure, you know, certain characteristics, you know, are covered or at least discussed or recognized within the people here in our community. And that's, you know, there's a very big difference between a sense of urgency, a sense of desperation, and then, you know, flat out a sense of optimism, right?

Well, and I was going to say, with the IoT Lab itself, you're bringing people together to create processes to solve technical problems. So maybe talk about if you can share any specific examples, like what was an engineering problem that, you know, as you mentioned, you've got different companies, you know, within STEPS distance that are coworking together in the lab. Have you seen some problems get organically solved with that diversity of thinking from the community you create that you could share?

Aaron Pritzker: Yeah. I mean, there's a couple of really interesting ones that I'll talk about. Not necessarily that everything is a COVID-driven innovation, but to think about it in the broader scheme, the broader terms here. One of the most interesting things here is kind of this trend. A lot of our companies, when you, you know, in the past were working, you know, in and around the idea of this frictionless customer experience, whether that was payment, entry to a building, it was frictionless. Now, some of that learning, some of that acumen has almost turned into a touchless experience. So we have people right now working with, you know, gesture sensors, with proximity sensors, with other avenues, if you will, to create the touchless menu. The touchless screen, the touchless entry just based on gesture and proximity rather than, you know, here's a touchscreen that, you know, minimizes, you know, that HMI for the sake of minimizing touches. Yeah, there was still a touch, right? So we've seen this kind of frictionless theme become the touchless, right? You know, some of that, you know, imagine the building automation where everybody has a key fob, some dumb key fob that's administered based on a role. What are, what are the role-based permissions behind a key fob, if you will? You know, now there's been— we've seen innovations of, you know, we used to know where that person could go and not go and when they went there. And did somebody try to use a key fob to get into a room where they weren't allowed to go? And if so, how many times did they do it? Now imagine to take a step back from that, and now we almost have an automated contact tracing system. So should you see somebody in the workplace who potentially has tested positive for COVID, you know, you can easily go back and look at said employee's identification number associated with their fob and quickly automate, you know, a contact tracing system for everybody that's been in proximity with them based on the role-based permissions, you know, associated with that key fob. And I'll say the last, you know, in a little bit more of a unique and positive opportunity, You know, one of our, one of our companies right now is actively supporting a large life science customer here in town, whereby they're now trying to scale up automation to manufacture. Now, whether they're going to use that to manufacture vaccines or not, we don't know. You know, or I'll say we're not at liberty to say, but, you know, the idea is they would have a room, you know, a team of their engineers actually go out and do a factory acceptance test on these machines. Well, now we've been able to successfully create, you know, more or less that nice robust Pelican case with a series of cameras whereby we can actually send equipment to an OEM, virtually create an instruction whereby they have these cameras aligned around the machine, and then we can electrically tie into the machine, not only livestream the factory acceptance test, but we can give remote control to the life science company, to the machine, so that they can put it through their testing protocol and document everything without ever physically leaving their site. Wow. So in this case, what was a plane ticket, multiple days in a hotel, and now potentially exposure in an unknown environment, we've removed that barrier, sped up the the opportunity to bring in new technology to the factory and, you know, leverage this, this Internet of Things technology to do so.

Yeah, you're— I think a couple of things you said there, the use of identity or a dumb key fob to identify the user resonates with me as well as the gesture-based. So personal story, yesterday I was going to the grocery and things are pretty well figured out now with COVID but you they wipe down the carts. You go in, you've got your mask on. You can optionally wipe down the cart again. They've got plenty of sanitized wipes and such. You do your shopping and then you go to the end, which if you go through the line that has a cashier, they've got the plexiglass up, or the— which I usually try to just get in and do my own thing. You go to the individual checkout where you scan your own things. And then you punch in physically to the manual keypad your alternate ID, which is your phone number for most people, as well as hit the OK button to accept your credit card where everyone else has hit, where everyone else has touched that. And I think for the first week or two, like they were having reps go around and wipe it down after every transaction. But I haven't seen that happening in the last month like that. That behavior is gone. So you go to all this effort to protect the upfront portion of the experience, but then there's one point of failure in that whole transaction and it sits on one physical device or one physical keypad that every human is touching that checks out. So I think there's a huge opportunity there for different technology to solve that problem.

As someone that runs a physical space, I give those stores credit for doing as much as they can, but it's very difficult, right? You know, to cover every aspect in that overall risk mitigation strategy. But, you know, here again, where I think it's, you know, kind of a cool little innovation, if you will, is to, you know, imagine your iPad or that tablet, you know, with the touchscreen where you've been used to putting your finger on it and sliding left, right, pinching, squeezing, you know, the gesture. And, you know, now we're able to do that without ever touching the screen. Whatsoever. We've kind of added that additional step of confirmation just to make sure we don't have slow fingers. You know, it's a new technology for people to learn, but, you know, in this case we're able to go through a food menu or whatever the case and never touch the screen.

Yeah, that's great innovation. So for those wanting to get into IoT or see a tour of the IoT lab or evaluate their company, if it's a good space to them, what's the best way to engage with you and your community?

Yeah, right now, I would basically say it's reach out to us at info@indianaiot.com. And just, you know, ask for a visit, schedule a visit, you know, we'll do our best to either accommodate that in-person visit safely. And we just ask that we do that on a schedule today versus in the past being much more of an open door policy. Or by all means, I'm Jason at Indiana IoT. I'd love to talk to them one-on-one. And yeah, or if we need to arrange a virtual tour, I'm happy to get out of the chair and walk around with a FaceTime camera or whatever.

Nice. Well, awesome, Jason. It's been a pleasure having you on the show here and learning from your experiences and kind of that connection between IoT and cyber and solving tech issues with people in process. So we really appreciate the opportunity and wish you the best. And yeah, thanks so much.

I appreciate it, Aaron, Teddy. I appreciate it as well. And you guys have a great afternoon and hopefully we'll talk again soon. Indeed. Yeah, you as well. Have a good one. Bye.