Simply Solving Cyber - Steve Lodin

Welcome to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we are excited to be here with Steve Lodeen. He's the VP of Corporate Security at Sallie Mae, and he has some interesting sidebar topics to talk about it. But before we get into that, let's meet him. Let's hear how he got into cyber and hear a little bit about his story.

Good afternoon, gentlemen. I'm Steve Lodeen. I work at Sallie Mae. I've been there now 10 years. I'm Vice President in charge of cybersecurity operations and the IAM team. As you might remember, Sallie Mae split the company about 9 years ago now. I ended up on the Sallie Mae side, separate from the Navient side. Really enjoyed Sallie Mae. It's a financial services institution. We're fairly mature. We step above where the size of the company really is, because we only have 2,500 employees and contractors. So it's not a huge company. But we really attempt to spend a lot of time preventing so that we don't have to do detecting and responding.

Nice.

But we've got a good solid team and not afraid to spend money on solutions and technology. Yeah.

Who got the cooler building in the split-off? I passed by both of them.

We got the crappy building to start with, but after a year or two of not representing a bank, we're now located at Keystone Crossing across from Ruth's Chris and the Ironworks Hotel.

Oh yeah, not a bad spot to be for food.

Yeah.

Good restaurants. Awesome. All right, let's get into how you got into cyber, how you found your way in and how you stayed in.

I got an electrical engineering degree focused in computer, computer engineering as my bachelor's. Went to work for General Motors division, Delco Electronics, but I worked in their advanced development for instrument displays. Really cool. We'd work on concept cars. We would do advanced displays. A couple examples. We took the technology from Hughes Aircraft in their head-up displays and put it into cars. The head-up you see in a BMW today is based on the design from Delco back in the early '90s as the technology that was created to do heads-up displays.

Very cool.

Yeah. And actually, the guy that did the mirrors to get that to show on the windshield properly is here locally in town working for Proofpoint as a data scientist.

Oh, wow. Great. Gotcha.

Well, how did you both get into cyber? That's a pretty big jump. Or maybe not.

No, it's the place to be. So when I was doing that, I ended up managing the systems that helped create the EPROMs that would go into controllers for displays and radios and, and the car brake system and everything else.

Yep.

Managing computers globally for Delco. And then I focused on the security side in that system admin team. I got a GM fellowship to go back to school, focused on computer science and computer security as my major. GM at the time did 50 fellowships a year. Globally, they would send you back to school, pay for that, and pay half your salary at the same time.

Nice.

Excellent deal.

And probably at that point, finding a degree in security was not that common, right?

No, it didn't exist. Purdue had some of the well-known people in the security industry in their computer science team, including Gene Spafford, Spaff.

Yep.

So I basically went over there, studied under Spaff for a year and a half to get a master's degree.

Yep.

It was Coast Lab at the time. It's now Sirius. You guys are probably familiar with Sirius. Excellent organization to round out the security side. Had a blast there. Staff introduced me to so many interesting people and things. One of the outputs there, before CVEs existed, it was the CERT that would publish vulnerabilities. I have a CERT 96-03 that's assigned to me for finding a random number generator bug in Kerberos so that you could break Kerberos in a couple of seconds.

No way.

Yeah. The ticket granting ticket could be compromised.

Yep.

So I spent time talking to MIT that owned Kerberos at the time. Los Alamos National Labs had me out to explain what the issue was because they used that to protect national systems.

Yeah.

So getting more technical is on your development plan. I'm hearing that.

I'm just kidding.

One of the other interesting things back in history You guys all are familiar with vulnerability scanners.

Yeah.

Today it's Qualys, Nessus, Rapid7. Uh, when this first came out, before there were public ones, SATAN came out. Are you familiar with that?

I'm familiar.

Security Administrator Tool for Analyzing Networks. SATAN.

Nice.

The people that created that were friends of SPAFF, so I got to be beta tester. I learned that when you apply vulnerability scanners to devices that are not prepared, they crash. So. I took down manufacturing lines at Delk Electronics that created instrument clusters.

Satan's tester. That was not on my agenda here, but I'm glad we covered it.

After that, it was a couple of years at E&Y doing consulting. And then when it was time after my second kid and E&Y was nationalizing their practice, I decided to find something local. Went over to Roche Diagnostics. 6 months in there, they said, we're globalizing our IT function. Would you like to come to Europe and stand up the security function for Roche globally. So I spent 3.5 years in Europe, met some of the most amazing European security people, and still have friends and contacts over there.

In Europe, where are you based?

Uh, I was a year in Mannheim and then 2.5 in Basel, Switzerland. And, uh, the interesting thing about Roche, I loved working there. I had one meeting in 3.5 years that was not in English. Great global company. And I'm sure you're familiar with that concept in Lilly.

Yeah. Yeah. Switzerland was pretty easy if you tried to talk French, if you knew a little. Actually, I had a friend that moved over there for 3 years and she learned French in advance and no one would talk it with her. It's like, "No, I hear an English accent. We're only talking English." Right.

That's funny.

Yeah. No, that was a blast. I really enjoyed that. After Roche, I spent a little bit of time starting up Ponderance with Landon, Ron, and Jeff, and then went over to Sallie Mae. I replaced Brian Brush, who you guys might know is at GuidePoint now, but he went to Qualys, left Sallie Mae. I went, filled back in on his side, focusing on vulnerability management, threat detection. And since then, I've grown the team, really enjoy building here in the city, the successful team that we have.

Been part of a few split-offs from a cyber standpoint. How long did that take you guys to get things kind of separate and operational?

We went through an interesting process. Sallie Mae, prior to the split, was 100% anti-off-prem. Everything was on-prem data centers. You couldn't do anything that left the company. When we split, we decided that the cloud is not bad, so we did—

Can't avoid it.

Cloud SaaS, Workday, ServiceNow, Office 365. But we had a managed data center. We spent 5 years in that managed data center, and now 4 years ago we migrated all of our virtual and physical assets in that managed data center over to Amazon. Got rid of all the physical side as we did that. But we've spent now 4 years in Amazon. The original approach there was lift and shift. We took our virtual machines in the managed data center, stripped off the managed data center side, added on some of our tools and spun them up as EC2s and not a horrible experience. It took longer to convince the regulators that we were ready to move to the cloud. But since we've made that lift and shift, we've been gradually doing digital transformation and going to serverless, microservicing all of our workloads and moving them into separate account structure, managed account structure in Amazon.

That's excellent. Speaking of cool tech stuff, so in our prep call you were discussing their involvement with the, like, the local startup community, but give us some insight on that and some cool stories and kind of how you're engaging that community.

Yeah, so from a startup side, we generally find ourselves struggling on the GRC side to have accurate measurement in the tools and technology that we're using because they're more advanced. So let's take as an example Salesforce. Yep. Not a lot of people are using Salesforce, not just for CRM, but our customer interface is through Salesforce now.

Yep.

There's not a ton of tools to, you know, traditional to give strong governance on top of access control and authorization. So for us to feel more comfortable, we were taking a look at what was out there. Just so happens a couple years ago, there was a person at Salesforce that went off, started his own company called AppOmni. That basically takes a look at Salesforce. Since then, they've expanded into other cloud SaaS applications to be able to do GRC on top of. But we take a look at those types of companies. We spend time at the Security Innovations Network, SINET.

Yep.

And RSA Innovation Sandbox to take a look at startups to solve specific needs that we have. When we first went to the cloud, we were looking at the cloud management tools on top to make sure you're not doing stupid things, right?

Of course.

The stupid thing at the time was public S3 buckets. Everybody was losing data because of S3 buckets. Oh yeah. We took a look at the market at the time. These names won't make any sense to you because they don't exist now, but Evident.io, RedLock, uh, Dome9. And we ended up making a selection. It was Dome9. That Israeli company got bought by Check Point. It's now CloudGuard and Check Point. But we've been using that since day one. Wow. It was first a tool to make sure that we didn't do stupid things and we had automation to prevent S3 buckets from being public, as an example. Now it's our GRC measurement tool. We're assuring that the automation we have in our AWS Config that gets applied to new accounts and new systems is valid on everything that we have. So we do a post-compliance check and that's our reporting tool now is the ITGRC function.

That's excellent.

Very cool.

Yeah, we like startups, and we generally pick 2 or 3 different startups a year that we end up working with. Yeah, inventory management is that— inventory management is that first thing you see in regulatory frameworks and compliance, right?

Right.

Understand your inventory. We have 1,000 different inventory tools but not really one good master king of inventories. We have a CMDB tool, but Yep. If you've ever tried to do CMDB, it's a pain in the butt.

Oh man.

Yeah.

So thinking of the early startups and you're, you're somewhat placing bet, or they're early in their journey. Some journeys can go well, some cannot go well. Without naming names, can you share a couple examples of a big win bet and maybe a big lose bet? And did you fail fast and move on or pivot? Like, any insights for the group or for the our community on that front?

I think the app OmniOne is good for us because they're continuing to expand their view on different cloud SaaS services. It's not just Salesforce anymore. So we've had a couple of good successes there. The one that failed for us— one of the golden rules that we established in going to the cloud and talk to our regulators about was having a software-defined perimeter around our environment, making sure that it was well managed in the cloud. So based on relationships, we ended up going to a small company called Vitter at the time, based out of San Jose with some ex, um, three-letter agency security people at the company. One of the first really good SDP, software-defined perimeter solutions. There's a couple other that were in the market at the time. We chose them. They got bought by Verizon and about a year after Verizon had that, they decided Yeah, we're done. So it just went belly up and they gave us, you know, a 6-month notice to go find another tool.

Right. Unavoidable sometimes if the interest wanes in one of those acquisitions or it's not hitting the market sleeve that they thought it would or whatnot.

Yeah, likely.

A question for you too. Obviously extremely talented on the technical side and in an industry that's highly regulated and cyber is at forefront. Any advice to some of the others that are in industries that aren't so regulated or cyber may not have as much executive support to go buy tools and how do you kind of vet tools and when they need one and then focus on process and any insight there?

Well, two approaches. One is to look at regulatory frameworks, if you have any that you can apply there, or best practices like the CIS Critical Security Controls. In our case, we do have regulatory-focused ones, the FFIEC Cybersecurity Assessment Tool that measures maturity and the CRI profile that also measures maturity. Where we find gaps, we can spin up projects to address that. If you don't have that, the best practices, and we talked about managing your inventory, if you can start with those best practices like CIS, you can go down the list and find gaps that you need that are ranked high in terms of risk.

Excellent.

What you could do is to start to focus on your industry and identify the latest breach that happened in your industry. Ransomware is happening everywhere.

Sure.

So if you want to find some nearby cross-industry related competitor and point out that they got busted for this ransomware, this cost them this, let's spend a little bit of money to prevent that from happening. Find the right tools and make sure that you're covered there.

That's great insight.

Third-party assessments is the other great opportunity to identify risk and help you focus on what you need to address first. Yep.

So Steve, you've been in cyber for a long time. Let's assume cyber wasn't a thing or that wasn't a viable career path, which I think will never— there will never be.

I got it.

Never be a time.

Yeah. Until you can get rid of attackers.

Yeah. I don't think ChatGPT is going to be replacing senior cyber leadership. But what would you do if that wasn't an option and you had to pick something else?

Well, if the planets aligned— before I get to the planet alignment, I would love to be a professional golfer, but I'm just an amateur. We have fun in this community here in town, getting a few of us together and golfing occasionally. Yeah, um, that would be nice if that was my profession, but it's not. But if the planets were aligned back in the day, I would have loved to have become an advanced theoretical physicist and studied more about the universe, from the infinitesimally small muons and quarks and everything else that's been discovered, all the way up through the black hole. The black hole, we've learned a ton in the past few years. First, it was theoretical that a black hole existed, right? But the, the size and mass and, and what happens in a black hole is amazing. And I, you know, if you retire and end up going back to school, the math— I've forgotten so much math that I couldn't do it that way. But I'd really love to, to follow the, yeah, the black hole community.

And my tiny brain can't like process how that large can just eat something and it goes away.

Is your secret hacker alias Black Hole, or have I revealed something that I shouldn't have?

Actually, I sent my cybersecurity ops team on a red team against me to find my hacker name back in the day. I did end up writing a Palm Pilot application to crack passwords.

Palm Pilot, there we go. Now we're talking. Now we're talking.

It was called Palm Crack. But yeah, no, they did not find it. They did find my yearbook online though.

That's awesome.

Let's assume budget wasn't an issue.

Yep.

And you're a technology-focused guy. You've been in tech and cyber for a long time. Is there a limit of number of tools or like all of the cool tech that you can buy? At what point have you said, okay, process and getting to scale is so imperative before we add in tool XYZ on top of what we already have? What's your thoughts there?

Yeah, that's a great question. You can continue to add tools. And if you think about the pendulum swing, you start off with not enough tools and you get breached or you lose data or you have accounts compromised. So you apply a whole bunch of tools, the pendulum swings over and you get more visibility, but you start to lose scale on people and resources to manage that. When you get to more than a handful of tools, you can't have the people to monitor the consoles.

Yep.

So then you're shifting back to one of two things. Making sure that all your logs go to a single console and you can evaluate based on that one console all the different logs, event correlation, everything else happening. That takes time and effort to get the right rules and not have a whole ton of false positives.

Yep.

Easier said than done. Logistics matter.

Yeah, definitely. Then the next phase of that is vendor consolidation. Well, let's take a look at Vendor X and all the tools they have. They may not be best in breed, but we're down to one console for all that vendor's tools. And experience says that those vendor tools are all different original vendors and they're not well integrated in that one console anyway.

Yeah. Sometimes vendors themselves, they've made so many acquisitions that even in the platform it's like, yeah, that's integrated, but integrated light. We're still working on that.

Right. It's not in our same IAM to IDP tool for that. No, we hear that a lot. And then you get the 45 name changes per year with one particular vendor in mind.

Nice, nice.

Somebody thought it was a good idea. New name, new brand. Marketing.

Yeah. And one thing we hear too through a lot of leaders in the area is retention, growing your talent base and your staff. And what are some things you're seeing in the area as far as how to attract talent and then how to grow talent? Because sometimes it's just— Yeah, sometimes it's not available. And so you're having to get young guys out of college or ladies and help guide them on their path to cyber and maturity. So any thoughts around that?

Yeah. If you take a look at what motivates people, it's money. It's quality of life, it's who you work for, and it's what you do. So having those things all kind of meld together and be able to have a reputation-based story definitely helps. Supporting training— if you have people that want to get out and get certs, if you have them want to go to Black Hat, DEF CON, be able to support them in their learning process definitely helps. From my perspective, my teams have changed from let's go out to Black Hat and DEF CON to more intimate security conferences. We go out to the Wild West Hacking Fest in the Black Hills of South Dakota, run by Black Hills Security team. It's a great little community-based, kind of similar to the old DerbyCon that existed previously. Dave Kennedy actually speaks out there, so it's got some flavor like that.

How about the ISACs? I know Pharma life sciences background, the healthcare ISAC has been an amazing network and just I've continued now I'm on the supplier side. So that was one of our first big things that we sponsored. But are the ISACs big in where you're at?

The ISAC for FS ISAC is the starter, right? It's the starter ISAC. Very mature. We generally go to the conferences on one side. When we completed our shift into the cloud presentation that I gave 2019, I think was moving a bank 100% in the cloud to the FSI SAC. Yeah, I actually had two presentations, rooms were full. I always would ask the question to start off the presentation, how far are you on in your cloud journey? Yeah, no, thinking about it, fully in. And it's a great event, everybody on the banking side is in the cloud somewhere.

Yep.

At that time, was it low? No, was it pretty high?

It was higher than publicly known.

Okay. Interesting.

Nice.

And it helps for people to be talking about that because sometimes the internal paranoia or worries are sometimes like, hey, did you check around with your peers and what can you learn? Like, how do you avoid this pitfall? Or here's something that really worked well for us, like, do this.

Yeah. And when you think about those types of conferences, you've got that, um, closed community sharing methodology, so you're more open to talk about issues and how you resolve them. It's really good to hear how other banks and financial institutions are doing that. It's also driven some private community participation amongst my team members. They have other communities that they're able to share behind the scenes information, what's going on early, you know, before it hits the news type stuff.

Yep.

We've talked about the startup community, your golf tribe that you have in cyber, your unfound passion towards black hole research that may— Yeah. That's your swan song.

I'd like to visit one someday.

There you go. Who knows what will happen? Will you come back?

Send me a text.

Although my wife did not like my idea to send my ashes into space when I die.

Maybe half of them. Can you negotiate?

I'll work on that.

Kind of last thing, stay on the community theme. What do you do for fun in addition to the golf in the community? Anything interesting?

Yeah, there's a small group of us that get together. We call ourselves a security cabal, but there's a technology person here in town retired that is also a book author, and he's written a bunch of technology murder mystery type of books, and he's in the author community as well. But he has been using a couple of us here in town to vet technology ideas as he puts them into his book, like crypto-based malware, like talking to the law enforcement community, how do you do that best. So it's myself, a person that I mentioned earlier that works at Proofpoint, and also a former FBI agent, and we make sure that the stories he's telling and the integration with technology get integrated into his book properly to make it more reasonable in his writing.

That's probably good. My wife spent many years in healthcare as a bedside nurse, and all of the shows on TV, she's like, oh my God, are they not talking to anybody? This is not how it works.

The way Grey's Anatomy is not real.

Yeah, yeah, that one specifically.

But yeah, yeah. And that's when you look back on the technology shows— Mr. Robot was pretty darn real. Yeah, for the most part. And they people behind the scenes consulting with them. But out of this book, basically, we all get characters in the book too. So the former FBI agent is an FBI agent in the book, and I'm actually a security person working in the casinos for a mob boss. The name of the character is Steve Modine.

Modine, that was close. Excellent. If you know, you know.

That's great.

And he recently supported Carr Global. They had an employee appreciation week and they had a donation of getting a character named in the book. So one of the local security people on the team won that, and his character got put in the book as his nickname in real life.

Oh, that's excellent. We actually had Leon here earlier this season, so—

Yeah, Bill Havlin, that works for him, had his character put in the book based on winning that raffle. Very cool.

What is the book name if people want to check it out?

The author is Ross Carley. You can find him on Amazon. That's his pen name. He's also— okay, locally named, um, are you allowed to reveal? Ross. So yeah, no, they're, um, the first book was based on actually Delphi and losing some code, uh, that he called the company Oracle. Delphi, Oracle, get it?

Ah, nice.

It's based in Indianapolis. It's got a private investigator that has PTSD, and it's kind of interesting series.

Nice. So Ross Carley, Amazon, if they search for that, it'll come up. Cool.

Awesome. Very cool. So, a question I want to ask too. So fast forward 15, 20 years and Steve's hanging up the cyber lanyard. And what do you want to be a legacy or be known by here in the indie community, indie cyber community?

I think just being able to have demonstrated that I'm a good guy to work for, work with. I generally know my stuff and learn as we go along. I don't have any major, I would like to to solve post-quantum cryptography issues or something major like that. But I really enjoyed the security community. Had opportunity to leave many different times, but I'm not leaving security. I love the work I do. I love the people I work with. And here in Indianapolis, we have a really good community that's supportive and lots of friends and colleagues here.

Well, as your spaceship is flying into the black hole, perhaps the quantum challenge that you don't think you can solve—

I'll solve there.

It will be so much clearer. I see what everyone's missing here.

Chinese were right.

Well, that's excellent. Yeah, we appreciate that. And again, this is why we do our podcast, for listeners, and to share that. I think that we try and build more of that sharing mentality in the community. I think that the rising tide raises all ships, so the more we can share and enable each other and share the stories and grow from there.

Yeah, thanks for talking to us, Steve. Really appreciate it.

Enjoyed it. Thanks.

Awesome. Everyone have a good day.