Swords, Subpoenas, and Software with Drew Tharp

Thanks for tuning in to Simplifying Cyber. I'm Aaron Pritz, and we're here today with special guest host Todd Wilkinson and Drew Tharp. And I'm going to give a little summary of what we're going to talk about because you probably saw in the opener we were cutting shit with swords and fruits and champagne that we're now drinking. But Drew has been an avid sword collector, over 120 since high school. You saw as we champagne the, as we sabrage the champagne, that it was actually easier than I thought. But I would say we're gonna talk about how we got into swords fencing and really how some of these things connect to cybersecurity. So Drew, welcome to the show.

Thank you, thank you.

Glad to be here. Give us a little intro about you and how you've been in and around cyber and legal and kind of where did you, Where did you come from? Where are you today?

Yeah, yeah. The boring stuff. Got it.

Yeah.

So I am— I'm an attorney. I work for several different companies and, and also help out here at Reveal Risk with some, some contracting things. And so I've been involved in cybersecurity and SaaS contracting and things like that for about about 12 years, um, and I've worked for Fortune 500s, multinationals, and also, uh, smaller startups helping them, uh, try to get their contract management systems up and running and, and that sort of thing.

Awesome.

Yeah, and in the contracts, obviously a lot of times companies are upping their game of what they're requiring— cyber insurance, unlimited liability. Yes, lots of things that are a tough dance, especially for a boutique and a Fortune 200 to work out like where do you land in the middle somewhere?

Yeah, yeah.

Middle.

The, the, the risk is especially outsized for, for, um, cyber issues because obviously if you, if you have a breach that can be, you know, that can cost millions and millions and millions of dollars. And, um, uh, unfortunately they're, they're fairly common. So we have to, so the, the insurance requirements can be difficult, especially for smaller boutiques to meet those challenges.

But yeah.

And within pharma, med device, you spent a lot of time there. What are the emerging things that are on your mind of concerns, both contractual as well as cyber program, as you limited or involved in that?

Yeah, absolutely. I mean, I think 3 things come to mind when it comes to the biotech pharma space. One is obviously protecting your data, your, and your intellectual property. I think a lot of the breaches that we see in the biotech space are sometimes aimed at actually stealing intellectual property, not just getting some data so that we can go, you know, find some emails to send people and that kind of stuff. Steal some Social Security numbers. A lot of it is focused around actual corporate espionage. And so, so I think that's something that we have to keep in mind. Another issue that I see coming up more and more often is on BAAs, business associate agreements, where a lot of times the, the business associate who's trying to contract will send a pretty onerous agreement that includes limits of liability, includes sometimes even subrogation or indemnity. And basically they're trying to shoehorn real legal issues into what's effectively a data sharing agreement, right? And when you try to shoehorn those in, then you have somebody who's not accustomed to looking at those issues an IT person, uh, um, uh, looking at that agreement and going, okay, whatever, and signing, signing away some very important rights on that BAA. Um, we actually talked before, um, it kind of reminds me of the Disney World, uh, thing where Disney World actually put some terms and conditions about their physical locations into the Disney+ terms and conditions. Which resulted in some people having issues at Disney. I don't remember what it was, probably slip and fall or something, but then they have these issues and they couldn't sue Disney because they'd agreed to arbitration in the Disney+ agreement, and that bound them to Disney World as well, which is, which is at best disingenuous, at worst unconscionable. So I think that a lot of people, or I think a lot of companies are or a lot of places are trying to kind of slip some of those past the radar by having a quote unquote lower level person sign a low risk agreement like a BAA or a CDA with some onerous terms.

All they were trying to do is watch Star Trek online.

Exactly, exactly.

Kids were over.

Exactly. Star Wars, I believe.

Yes, Star Wars.

I'm sorry. Yeah, yeah, sorry.

Disney hasn't acquired.

Not, not yet. Not yet. I, I mixed up my genres.

No, Paramount's next, I'm sure. It's on there.

So does anybody know what happened to Cody? Did he get cut with a sword? I, I, I don't understand.

Well, yeah, we took him out.

All right. Well, the, the body cut in half. Take one for the team.

Exactly.

Anyway, thanks Todd for joining.

I'm here now.

I think let's go back to swords cuz I think that's what we came for, that, you know, we make some connections here. But Drew, I think when we were prepping before the show here, you were talking about fencing was kind of your path into sword collection.

Yes.

So what we got into was the four quadrant fencing. Fencing model, which I think has a lot of applicability. And we're not going to do what the classic RSA conference, at least 3 to 5 topics on Sun Tzu, Art of War, but let's at least talk about fencing strategy and things that we might be able to learn from that.

Yeah, absolutely. Well, and, and I think, um, I, I think that it ties in really well to cybersecurity today because when I learned the four quadrant strategy, which I'll explain here in a moment. Um, I was, um, it really changed the way that I fenced, and that also I think can really change the way that we think about cybersecurity. So the four quadrant strategy says that there are, that a strategy can either be passive or active, and it can be defensive or offensive, right? So that gives you 4 quadrants. And if you ask most people, they'll say, yep, it's a, it's an aggressive offensive strategy. That's the norm, right? I'm, I'm gonna go get 'em. I'm gonna chase 'em down.

Chasing the threat actors. That's all they got, right? Right.

That's what they're saying.

On the defensive. Yeah.

Right. And then there's, and then most people think of defense passivity. We're gonna set up firewalls. We're gonna set up things that people, keep people from getting in, that sort of thing. So you've got, uh, you've got aggressive offense and you've got passive defense. But where most people aren't looking and aren't working is in the passive offense and the aggressive defense. And you can actually have aggressive defensive strategies and you can have passive offensive strategies. So in fencing, uh, a an aggressive defensive strategy is actually called second intention. And, um, I want to talk about that, uh, in a minute and how that might relate to cybersecurity. And then in fencing, a passive offensive strategy is a press. It's a— it's an attempt to, to gain space, to, to push them towards the other end of the strip, but not necessarily attacking them. The whole time, right? It's just that, that pressure, that push on them. And I think that can be applicable as well.

Nice. Is there a connection into the Muhammad Ali rope-a-dope?

Yeah, yeah, certainly.

Passive defense.

Yeah, yeah, that would definitely be— well, I, I think that'd be an active defense probably, right? But no, no, it's a passive defense. Yeah, yeah, yeah. Uh, it's, it's, um, Yeah, that can definitely be a passive defense. And I think that, uh, yeah, sure.

We'll get into more of those connections as we progress. But as we were champagne-ing the, uh, or champagne-ing, sabering the champagne earlier, by the way, cheers, fellas.

Yeah, cheers.

There's no clink because these are plastic. They look classy on the, on the camera. So yeah, Drew, you taught us pressure. Applying pressure, a seam, and one clean strike.

Yes.

Which is kind of what a breach looks like, right? Like there's a weakness.

Yes.

There, you know, the seam and there's some sort of pressure, whether it's social engineering or urgency, sense of urgency and, you know, panic. And then that one clean strike you're in. So, um, it definitely feels like, especially in healthcare with some of our healthcare clients have heavily been a target. In both ransomware and BEC since COVID really.

Yes.

There was kind of a pass on healthcare before that, and then really during COVID the threat actors went all in, and it's a shame, but it's the reality now.

Right.

But what else can we learn from kind of the four quadrant model and ways that individuals could both reduce the seams as well as be more, maybe we can talk about Active offense, or really, I think we said aggressive defense.

Aggressive defense.

It sounds like the best option on the other end of the table, right? Yes.

Yes. So, you know, I really like your analogy with the opening the champagne bottle because you're exactly right. It's about pressure. It's about, and it's the pressure that's inside the bottle too, right? And so you can reduce that pressure. And actually we talked before the show, you said, hey, I want to set up these champagne bottles, and I said, make sure you cool them before we come in.

I—

they need to be chilled champagne bottles. And the reason why that is, is because the pressure inside the champagne bottle will rise if it's warmer, because gases expand in— so more spray, more explosion, right? And, and it can actually completely destroy the bottle, just, just blow up the bottle when you try to do the Sabrage. So that really makes me think of, are you working— when, when you're a cybersecurity professional or a CISO, are you working with the business to reduce the internal pressure to make sure that things that aren't necessarily cybersecurity related— when I think of that pressure building inside the bottle, I think of it in the healthcare space, right? Business surgeon. The pressure is there because you've got PHI, you've got HIPAA requirements, you've got lives on the line, right? That creates that pressure. And obviously in healthcare, it's easy to think about how that pressure is built up. But as people are listening to this, in your business, where is the pressure building and how can you release the pressure, relieve the pressure that's not necessarily cybersecurity so that when the breach does happen, you're not all running for the door trying to get out.

No, that's good. Let, let's go back to your story. I think in my intel report here, I think, uh, maybe we found out that you, in middle school, you were into Dungeons and Dragons. Mm-hmm. And then that got into real fencing, fencing lessons, fencing teams. Um, what has that, and then obviously your sword collection hobby.

Mm-hmm.

Um, what, what have some of those skills have you applied into your legal profession?

Yeah, absolutely. I actually remember when I was in law school, the NCAA released a commercial that was a fencer, a collegiate fencer fencing, and then it kept juxtaposing and cutting into the courtroom, showing them fencing and then doing litigation activities. And I was like, oh, that's really cool. That's my life. That's awesome. And so I think that there absolutely are connections between fencing and legal. You know, it's, it's, it's competitive. It's, it's adversarial. At the end of the day, in both legal aspects and fencing, there's only going to be one winner. You have to— and you have to be strategic about who you're talking to. And a lot of times it's about the other person more than you. A lot of times the other person, if you know them, if you've fenced them before, if you've worked with them, or if you've competed against them before, you can know what kinds of things they're going to do while they're in the ring. Exactly. Exactly. And so, so I think that that is true in law too. You know, as, as I become more experienced, I know more of the players and more of the the places. I think actually it's funny, even you, Aaron, have sent me some things to review and I've been like, oh yeah, I know what they're going to do. They're going to push on this, this, and this because I've signed contracts with this company before and I know what they're going to request. And so, I think that that's a big connection there.

I was going to say, I see that in cyber all the time. There might be a laundry list of things they're worried about, but when you really get down to it, there's 2 or 3 things that really matter to them and the business. The ones they're going to come back with and make sure are right. So knowing, knowing those pinch points or their own pain points and why they— why it matters to them, usually that helps lower that pressure a bit.

Awesome. Absolutely.

Uh, Todd, any questions that you want to ask them?

Well, I, I was— the, the, the, the offensive pressure you apply in there, like, what is your strategy when you're going into it? Are you, are you the type of person that leads on the offense? Do you kind of test with your defenses? What's, uh, share some of your secrets.

Yeah, when it comes to like a contract negotiation, I— is that what you're asking about, or more on the cybersecurity?

Well, I was going to say on the fencing side. What's your, uh, what's your fighting style?

What's my personal fighting style? Um, I, I was taught, um, when I was on IU's fencing team to be a Swiss Army knife, and that has become my style. Um, I'm not great at any one particular thing, But I'm pretty good at a bunch of things and I use that as a strategy. So I wouldn't say that I stay in one quadrant. My whole goal is to score a point in each of the quadrants or in each of the kind of ideas, um, in the first few points of the bout, because if I push you then you decide, oh, I can't be defensive. He's going to be aggressive. And then if you come and you be aggressive to me and I defeat you defensively, then you go, oh, what can I do? And you— I try to whittle down your choices until you're at a point where you're just like, I don't know what to do. And then I just hit you until I'm done. Nice.

Finish up.

Yeah, exactly.

The follow-on to that, if we pivot that to cyber and some of the own contracts that we have to deal with, how does that approach carry over? Do we kind of let the other side lead? What are your thoughts there?

Well, I think that, you know, I'm not, I'm definitely not as, I'm not an expert on cybersecurity like you guys are, but I think that a lot of times the you're going to be in a defensive posture no matter what, because unless you are literally a cybersecurity company, you're not going to be able to stay on top of what's going on, what every single person is doing, right? And it's always the attackers, whether this is going to Sun Tzu or, or fencing, it's always the attackers who are going to have the, the opening move because they, they have to. Um, by, by nature, if you're defending, you're, you're waiting. Um, and so I think that when we think about that though, I, I think that we think about how the, um, how threat actors can use that, their, use these tactics against us. So one example is they actually can be aggressively defensive because you may think, well, you know, we're on defense, we're waiting for them to come try to attack us. And that's true. But what they may do is bait you. And this is called a second intention action in fencing. It's when I try to get you to do something knowing what you're going to do and then take advantage of that. So it feels very much to you like I'm giving you an opening, like I'm saying, here, come attack me here.

I think in social engineering and phishing, I think that's the lure, right? The first action is getting you to do something benign. And then the second one, once you've had a little bit of trust or an interaction, the second one is really where the payload is delivered.

Exactly. Yeah, and in order to pull that off, you have to kind of know what's gonna make the person move, right? If you send me an email and it comes from, you know, a bunch of random letters at, you know, hotmail.au.co, I'm gonna go, "That's stupid. That's somebody attacking me." But if you send me an email that has the, that's masked so that it appears as though it's one of my friends or family, then that's obviously going to work better. And so I think that's the bait. That's the, uh, yeah.

Yeah.

That's awesome.

Uh, well, it's not awesome, but that's what, that's real world. That's what happens. Um, so when we were chatting the other day, we, we discussed kind of AI and the trends that you're seeing. And obviously, uh, we can talk about some of the, the lawyers that have kind of, uh, not been prepared as they used it and didn't make it their own and hallucinated. But we also talked about Harvey AI. So maybe cover both those topics, tell us what Harvey AI is and go from there.

Yeah, sure. So Harvey AI, I think, and I don't want to be a promoter here. I'm not affiliated with Harvey at all. I just have a client who uses Harvey and they've requested me to use their instance to do some things. And frankly, I've been really impressed with it, what it can produce, what it can do, how it can streamline work.

And I think Harvey was named after the Suits character Harvey.

Is that right? Yeah, I think that's right. I think that's right. Which I pointed out, I find kind of funny because they tell us, they tell the lawyers that they're selling it to, use it like an associate. But Harvey's not the associate. Harvey, it's the partner. The partner, but Mike probably wouldn't have been as quick as a name, right? So I have used Harvey and really think that it has a lot of advantages. I think that it has some major issues still too. And of course, anybody who's in job preservation mode right now, AI isn't perfect. You obviously need to hire me, but why do you still need a lawyer? When you've got Harvey AI that can do a lot of the things that you may hire a lawyer to do. And to me, it's really about threat assessment, which ties back to cybersecurity as well, right? It's about, it's about looking and deciding where certain risks are. What I've noticed with Harvey, for instance, is it saves me a lot of time because I can plug a contract in and I can say, Hey, can you review this for me? And Harvey will determine what particular clauses are important, what particular clauses are outside of industry norms, things like that. But at the end of the day, it's not— Harvey doesn't know, is this an important customer that's going to make or break our year? Is this something that we're willing to take a risk on? Harvey doesn't know that. Know the risk context, which is something we talk about all the time. When you bring a contract to me, I go, you know, I don't like this term, but if you want their business, it's probably something we're going to have to accept. And that's your choice. And I totally understand it.

Or spend more back and forth parrying and 18-month MSAs and things like that. Exactly.

There's this concept in cybersecurity of what's your risk appetite? How much risk are you willing to take on? Absolutely. And that is a hard thing to quantify, and it's a lot of personal intuition. It's a lot of knowing who to talk to in the context of what's happening in that moment. And that, that one is hard to put down into like an algorithmic process that AI can take on.

Absolutely. And that's exactly the same in legal too, right? It's, it's, I think we actually have a very similar, I think that we have a very similar profile to the business when we're partnering with the business because I don't think they want to spend money on either of us. We're not fun. We don't produce, you know, the return on investment is not instantly identifiable and, and something that you can, uh, that you can write to the state, to the shareholders about. But you'll find out real quick if you don't have quality there. You'll find out real quick, oh, uh, we have gaps and, um, And yeah, it's, it's, it's hard to convince people of your value.

So two last questions and one question Cody usually asks all of our guests, and we, you've already given us a bunch of Drew fun facts and personal stories, but what is one fun fact that most people don't know about Drew Tharp that we've not already covered?

Um, I, I, I think the fun facts that I'll give you guys, um, and this, this may make it harder for me to win at Two Truths and a Lie in the picture, but, um, uh, and it ties into the swords. Fun fact about me, I was a professional model. And I know those of you looking at the video right now are going, man, I mean, I obviously assumed that you were a professional model. And it was not a professional model for, uh, for, you know, ales. Um, it was, uh, I was a professional model, um, because I worked at a company that makes swords. Uh, it was actually an importer of swords. Called Cas Iberia, and this was in college. It was, it was fun. There was this girl I liked who lived in Tennessee, and so I went and followed her and went and worked at a sword company, and now I'm married to her. But I— it was, it was a fun place to work. And one day they said, hey, you actually sort of know how to use swords. And I said, yes, sort of. And they said, okay, can we dress you up in armor and go take pictures of you out in the field? And I was like, Sure. So I put on this full suit of samurai armor and I went out into the field across the road and, you know, just did some, did some movements with the swords.

Full, full crouching tiger, hidden dragon.

Exactly. Exactly. And pictures came out awesome.

Hidden dragon, crouching tiger.

Crouching tiger, hidden dragon. There you go. The pictures came out awesome. It was this, it was this field of, of wild grass and there were the mountains of Tennessee behind us and it just looked— and they were kind of foggy. It just looked awesome.

Very nice.

But then a couple weeks later, my boss there at the time came to me and he goes, hey, I need you to sign this and we're going to add $40 to your check this week. And of course, I was in college. I was like, I don't know, okay, whatever. And he handed it to me and I signed it and I said, what?

Before you were a lawyer?

It was before I was a lawyer, and I signed it. And I said, what am I doing? And he said, well, you've got to be in the model guild. You've got to be in the model union because we want to put your, your, the pictures that we took on Blade Magazine, which is a, you know, a magazine, a knife magazine. And I said, okay. And so there we go. I am, I was a dues-paying member of the modeling union.

Very nice. All right. And then last question. If you or your career were a sword, which one and why?

That's a good question. And one that you did not prepare me for. So I have to— yeah, yeah, I know.

There's a lot of AI-generated notes. There were a lot of them until just now. So I've got the upper— I'm, I'm doing offense. You are, you are, you are.

Are you going to use aggressive offense or, uh, you know, I, I think I'm, I'm, uh, I think I have to use passive defense because I think I was caught off guard here. Um, but when I think about it, um, you know, I think that I would say a rapier. A rapier is the sword that you'd normally think of as the Three Musketeers. Um, it's a, it's a, it's a longer, skinnier sword that's used for, um, for dueling in particular. And, um, the, the rapier was, it was a big, um, change in technology when it came around, uh, because what people were discovering is people were wearing less and less armor because firearms were becoming more and more common, and armor doesn't stop bullets. And so why, why wear big heavy pieces of armor when you don't need to. And so the rapier came around as, you know, firearms didn't start being great. You had one shot and then you needed a sword. And the whole idea was the rapier is if I can poke you from all the way over here and you're all the way over there, then, then I win. And so actually, it's funny, over time, they're we see, uh, there were laws put in place in places like Vienna and Paris and London that limited the length of rapiers because people were getting 50, 60-inch rapier blades.

Long range.

Very long range. And then of course knocking over people when they're walking through the streets and doing all this kind of stuff. And so, but to me, the reason why I say I, you know, my career, my, my philosophy is, is a rapier. Is because, um, it's all about setting up the right strategic decision point and then acting on that with, uh, with, uh, decisiveness.

So that makes sense. And all three of us desire to be skinny and we're all working on that.

Exactly, exactly, exactly.

I think Todd, you said suck it in right before we went live.

That was the plan.

No, I mean, if you asked me what I'd actually use in real life, it'd definitely be a Scottish Brudd.

Okay. Why is that?

Uh, cuz I'm a big guy and I like to hit things hard.

Okay. All right.

Awesome.

Well, Drew, thanks for coming on the show. Really enjoyed— this is probably my favorite episode and we've destroyed the most fruit and, uh, champagne. And, uh, yeah, appreciate it.

Yeah, absolutely. Thank you guys for having me. It's been great.

Awesome.

Cool.