Episode 02: Tech Talk

Hello everyone, welcome to the May 10th Bay ICT Tech Talk, and today our guest speaker is Bob Fabien Zinga, who is head of security for an organization called Directly. And really, Bob, thank you for joining us. I know you're very busy. I wasn't surprised that there was another meeting that was hangover because that's what my day is like. But anyway, welcome, and I'm going to let you get right into talking about your topic. And, um, what we usually do is, you know, you share whatever you, whatever you'd like to share. I know what you told us you were going to tell us about was, you know, risk in the face of new incidents and exploits like SolarWinds and the things we're talking about, uh, risk with teleworking and, uh, impact of the human factor. So Take it away.

Okay, uh, I guess before we get started, uh, is anybody on this call, uh, has it like a specific question or something they would like me to cover specifically?

Well, first of all, most of the, most of the, uh Participants here are students. We have a couple of faculty, uh, and, uh, so again, it's up to you. What we can do is you could just say, hey, I'm here, ask me questions, uh, or, uh, you can say that, you know, here's some things that I was prepared to talk about. It's up to you to just open it right up to questions if you'd like to.

Okay, okay, uh, in, in that case, uh, let's Let's talk about SolarWinds for a second. I actually recently wrote a paper for Forbes just about that. It seems like this really was an incident like we've never seen before, right? Never before have people been able to use like a network monitoring software like they did for SolarWinds to be able to eavesdrop on some of the very, really the best protected companies in the world, right? Even including the US government and the Department of Homeland Security. So the 3 biggest things I kind of got out of that is, and I know not everybody agrees with it, I was actually on the roundtable with quite a few CISOs, I think it was 2 weeks ago. I made this statement and one of them really didn't agree with me. He's like, "No, that cannot be true." But the more I think about it, the more I believe it is true that all computer systems are vulnerable. So it doesn't matter how much protection you have. If you have a computer, you turn it on and you connect it to the internet, it is vulnerable. And I also believe that most organizations in the world may already have been compromised, but they just are not aware of it, right? So I'd like to be very careful for security professionals to brag and say, well, we've never been compromised, we never had a data breach, we've never been on the first page of the Washington Switch Journal or whatever. Our platform is secure. Well, maybe it's already been compromised, but again, you just don't know about it yet, right? So I, as a security professional, I'd rather work on the assumption that my software might be compromised and I need the evidence to show it than to brag and to feel like everything is fine just because I'm following the best practices. One thing that comes to mind is the security best practices, I guess, with time they do change. Just like 10 years ago, it was a completely different landscape as it is today, right? I remember when I was working for the University of Alabama and for the US government 10, 15 years ago, back then pretty much everything was on-premises, right? We had data center servers and so forth. But today, the great majority of organizations, especially in Silicon Valley, they pretty much have everything in the cloud, right? So I believe the security principles pretty much stays the same, but the way we apply them do, do change. But anyway, the main point for me really is everything that is turned on and connected to the internet, well, is going to be compromised sooner or later. So that's number one. And number two, the other point I try to make with risk is security is more than just technology, right? Usually when we talk about security, we talked about technology, about processes, and about people. And in my experience, people have usually been the weakest link, right? And that's why cybersecurity awareness training is extremely important because you can have the best technology in the world, some of the best processes, but if your people are not— I don't want to say smart enough, but if they can be I guess, engineered, right? That's why social engineering comes into play, where people can actually work with their feelings or entice them to click on links or download attachments. Usually, that is how the bad guys are going to be able to get into your so-called secure network. So the culture of the organization is extremely important, and security needs to be a part of the culture of the organization. And everybody in the organization, from the CEO all the way down, really need to take this quite seriously. Because another thing I have also seen in my experience is usually when somebody is a senior executive in an organization, they feel like rules don't apply to them. They can just do whatever they want, download whatever software they want, and pretty much do whatever they want when they want to do it, which is, which is not right, because Everyone, absolutely everyone, should be able to abide by the acceptable use policies and whatever processes are in place, especially those who are senior leaders of the organization. Like, even with phishing, which I believe is still probably the most important way for bad guys to get into a network and access sensitive data, there is even a term now in security where we talk about spear phishing. That's, that's when they are really focusing their phishing campaign only to the members of the senior leadership team of the organization and getting them to click on links or download malicious attachments so they can eventually get access to the network. But really, I believe the most important point I have to make about security in general is for most organizations today, security really, really needs to be elevated. So I've been in the Navy for about 17 years now, and I guess I moved to Silicon Valley back in 2014, so 7 years ago. One, one big difference I've seen between the military and industry is that in The military, more specifically in the Navy, security is extremely, extremely important, right? Security first. And part of the reason is because if we are not secure in the Navy, people are going to die, right? So it is of the utmost importance. And that's why in the military, it takes a very, very long time for us to deploy new software because we have to make sure— It is secure. Whereas when I moved to Silicon Valley, most organizations I worked for, we have kind of like a 2-week sprint cycle where we deploy software every 2 weeks, and the software is not always secure. Actually, you can count on the software not being secure, and then with time, with several iterations, they go back and fix whatever vulnerabilities happen to be in the software. And also another big difference I've seen is in the government, sometimes it seems like budget is really no limitation at all, right? Whatever we need, it looks like Congress always finds a way to give it to us. And in the military, it seems at times that if we ever run out of money, right, we're just gonna print more dollars. But in the industry, Silicon Valley, for sure, the budget is extremely limited. We have very, very limited resources, and the goal of the business is to make money and to be profitable. So I have seen a lot of businesses, especially when I used to be a consultant with a small to medium-sized company, where they would kind of give lip service to security and tell the customer or prospective customer, yes, we really, really care about security, and look, we are compliant with you know, SOC 2 Type 2 or ISO 27001 or whatever security framework. But in my experience, it looks like many companies, they just put enough money to become compliant. But there is really a very, very big difference between compliance and security. It is not one and the same thing. And if you don't believe me, right, you just have to ask Target. So being compliant is one thing and it is a best practice and definitely something we should continue to to do, but I believe every organization really, really needs to prioritize security from the board level all the way down to the most junior employee of the organization. Security has to be a priority. Something we used to say when I was a program manager at Scalewar is we really wanted to have security baked into our culture, into our software, and not be bolted on afterward. And what I have really seen in the industry more times than not is they usually focus on the functionality of the application. They focus on selling the software, and security many times is kind of like an afterthought. So another paper I wrote for the Strike First magazine about kind of how to lead the security function in an engineering-centric organization. I mentioned that when you are working for an organization that is very much engineering-centric and they focus on developing software code very, very frequently, many, many times, especially when you first get started, you really have to focus, I think, on making sure that the software you are developing is as secure as possible. And initially, in my experience, probably the best thing to do, or some of the first things the security professionals should kind of focus on, is to really try to focus on red team exercises, right? Things like making sure you have some type of bug bounty program That is when you invite security researchers around the world to come test your software and find vulnerabilities before the bad guys do. And if they do, you then reward them depending on the severity of the findings. And then you work to fix those vulnerabilities again before they are exploited by the bad guys. Also having more pentests, right? The best security practice across the board is to do a pentest at least once annually, but really for engineering-centric organization, I really, really recommend doing it at least once every quarter, at least more than once a year. And one, Technique I've used that seems to be working pretty good is to even have like a web automated penetration test. There are a couple of vendors that do that, but basically as soon as your code is deployed, you can actually have this web platform go through the code and pretty much execute a web application pen test in real time and kind of let you know what the vulnerabilities are and and give you, again, a chance to fix those before the bad guys kind of discover them. And of course also having quarterly or monthly vulnerability scans so you can find out from within the organization kind of what the level of patching of security risk might be with the endpoints within your—

infrastructure.

And eventually, though, I think for a secure— for an engineering-centric organization, the end goal is to really shift security all the way to the left, meaning you want to find out whether the software has bugs and vulnerability before it is published. So have it as close to the developer as possible. That is really where I believe organizations should really aim to be. Well, before the code is merged into the main repository, that it is tested for at least the top 10 OWASP vulnerabilities And then if they are found, that also gives you a chance to train the developer to kind of know what's acceptable, what is not, and how to fix these issues. Another thing I mentioned, social engineering earlier. We are human beings and we are creatures of habit, right? We tend to be doing the same things over and over and over again. As an example, I was told, I think this is true, but I was told, I'm sure everybody who's ever used Windows has heard of the blue screen of death, right? Anyone on this, on this call? And somebody told me that it's something at Microsoft that they were actually able to pinpoint to one principal developer. He was pretty much making the same mistakes over and over and over again, and that blue screen of death pretty much went through all of the version of the Windows operating system until the most recent one. But really, the point being, if people are making mistakes, more than likely they're going to be making those mistakes over and over again in the future. So if you can do a security scan right before the code is deployed and the developer can find their mistakes and be able to fix it, then that is going in the long, long long term, right, gonna bring you a great return on investment where your software is going to be a lot more secure than otherwise. And it's gonna cost the organization a lot less money to fix the problem before they are created than to try to fix it after the software has already been deployed. But really, this last point I think is probably the most important. Organization shouldn't just be providing lip service to security and trust, but we really need to put our money where our mouths are, right? If security is important to senior management, it shouldn't have the smallest budget in the organization, right? And it is really something, and I believe I am seeing a change across the industry now. I am a member and a volunteer for the Private Director Association. And a lot of corporate board, even here in California, there seems to be a push that at least a member of each one of those corporate board is very familiar with cyber. Because ultimately, the board of director is responsible to kind of manage the risk and also kind of set the strategic direction of the organization. And security has to be that important. So that's, that's kind of what I, I wanted to start sharing. If anybody has a question or a comment, I'll start one.

On the whole thing you were talking about with the shift left, can you explain that in terms for more, and think a little earlier in career, like, like if you were to get hired into, to like the first or second level jobs into these kind of things, what is it that it would look like when you're, when you're doing that shift left? So for example, if you're, if they were hired into a job and they were doing it the old way, sort of IT 1.0 versus the newer way where you're trying to get up the stack better, explain what that looks like to somebody that hasn't been doing it for 10, 15, 20 years, right?

Yeah, so I really believe that is critical, right? Because almost every day today you will hear in the news, or at least every other day, there is a data breach somewhere. So there is obviously something that we are generally doing that is just not working, and we probably need to kind of think outside the box or rethink the way we have been doing security. So when I say shifting security left, what it really means is first, security is a priority in the entire organization. Actually, one thing I want to kind of add to this just as a background. When I moved to Silicon Valley in 2014, the first organization I ever worked for, I really felt like the engineering department didn't care at all about security. I mean, absolutely not. Not at all. And it almost seemed like security and engineering were really butting heads almost every day. We didn't have the same vision. We were not aligned at all. And in most of these organizations here, people in engineering, they get paid a lot of money. They are very talented. They are usually the reason why the company is in business in the first place, and you really do not want to get in their way, right? But then again, you kind of realize, okay, my job in security is to make sure that we develop the software as quickly as we can, but we need to make sure that we're following the best practices and we are secure, right? So kind of like Stephen, what you mentioned, like in the All the ways, I still remember when I used to work for big organizations where we used to have everything on premises, right? We would develop the code. Sometimes it would take a couple of months or so, not every 2 weeks like I've seen here in Silicon Valley. But then once the code is out, we would have beta testers and so forth and find those vulnerabilities and then and try to kind of fix them after the fact. And I think that is still valid, but I really believe what is even better is to really do the security testing, the security assessment as close to the developer as possible, right? So again, I am really thinking, I guess it is two ways. Top-down, I think is important. If you work for an organization and senior management or the board doesn't care about security at all, they just look at security as an expense and they don't really see the value. I think that is a mistake. So I do believe that senior management absolutely has to support the security program, but I also believe that it needs to go from the bottom up as well. So basically the security function needs to permeate throughout the entire organization. It has to become part of the culture. And part of that is to also train and develop the developers, those who actually create the code, to make sure that they understand how to not just develop code and application, but do it in a safe and secure way, right? Following the best practices and making sure they at least check for the top 10 OWASP vulnerabilities, right? Because in the great majority of The data breaches we have seen, usually the software was vulnerable to at least one of the top 10. So the thing with security too is I firmly believe is, I kind of alluded to it earlier, you cannot be 100% secure. Even by doing the best practices, even by shifting everything to the left, it is definitely going to greatly improve your security posture. And reduce the avenue of attacks, but it cannot make you 100% safe. I think the only way for your software to be 100% safe is to really turn off all of the computers and disconnect them from the internet. Then nobody's going to be able to get into your software. But as long as it's turned on and it is connected, there's going to be a way for someone to get in. In many ways, I look at it as job security, right? Being in the security industry, because the bad guys are always going to find a way to get in, but then the good guys too have to improve their game. And it's kind of like a mouse and cat game. They get better, we get better, and we have a counterattack to the attack, and then they don't just give up. And abandon, right? They come up with innovative ways of finding vulnerabilities and exploiting them, and then we have to get even better. But more specifically to your question, Stephen, I think what that looks like at the very beginning of shifting security left, it might annoy your developers a little bit because they're gonna feel like they are slow, right? They're not developing the code and publishing it as quickly as they used to because they are going to have to stop for a few moments to actually check their code and see if the code is vulnerable to any of those top 10, top 20 OWASP vulnerabilities. And once any one of those vulnerabilities have been validated, then the developer is going to be taught 'Okay, this is a problem and this is how you fix it.' This way they will not be making this mistake over and over again. And then once the, uh, their code passes the security check, then it is merged into the main repository and then deployed. So again, by doing so, you have less and less non-vulnerabilities in your public code, but also you are finding those vulnerabilities very, very early on. So really, in the long run, the organization is saving a lot of money and also growing and developing some software developers who are more aware of security vulnerability. Does that answer your question?

Yeah, I got plenty more questions that I can keep going with, but other people should go ahead and come off of mute and ask them, or often we have them typed into chat.

And also one thing I want to make sure, right, I started my career, I think it was back in 1997, and back then I was definitely looking up to people in the security function. And it was, I think we are a relatively young community or industry because I think when I first got started, security was more of a hobby, right, than a real profession. But today we are, no? Chief Information Security Officers. And I mean, it is a real profession, and definitely I feel like I'm very privileged to be in cyber, but it is really an industry of the future. So in many ways, I have become one of the people I used to look up to when I first got started. But the truth is, I don't know everything and really nobody does because in this industry, it is not like it used to be, I don't know, 20, 25 years ago where you went to school, you learned something and then you were done with learning, right? I actually feel like sometimes my knowledge becomes obsolete like within a year, a year and a half or so. Basically everything I know is no longer gonna be valid and I need to keep on learning, right? Like I said earlier, the bad guys that don't just give up. So I need to keep reading and learning. And education is extremely, extremely important. And also going into brand new system, like I remember the big jump we did from having everything on premises to the cloud. We've never done the cloud before. And yeah, the security principle remains the same, but definitely the way you apply the security controls are completely different. I think if you are going to be in security, you really have to be pliable and be comfortable working in an environment where you don't always have certainty, where it is ambiguous and you have to make a decision. And also very important, being very much willing to learn.

So I did one of these calls 3 or 4 weeks ago, and we had 4 or 5 of us that had been various versions of exec security presence. And one of the students on that call was asking, how do you get used to the idea that somebody's gonna attack and no matter what you do, it's gonna get broken into, right? So I had my answer off of that one, but I find that's one of those ones where everybody's experience puts the words in a different order. So I wanna hear your answer to that kind of a question.

Yeah, I kind of alluded to it earlier where I say, right, in the security industry, really, it's impossible to be 100% safe. No matter what we do, eventually somebody is going to find a way to break in. And another way I've looked at this is I have to be right 100% of the time. The bad guys only have to be right once, right? And it doesn't cost them anything. Today, for example, when someone sends an email, I mean, it costs them pretty much nothing, and they can take one email and send it to like a million people. We don't need a million people to reply back or click on the link or download the attachment. We just need one person to do it, just one. And you don't want to be that one, definitely not in my organization, right? So it is really a team's effort. And I think it is getting better, but I think it is definitely a mistake. And I've seen a few of my peers who are quite arrogant and they're like, oh yeah, our software is secure. And they would, some of them, would be, I think, silly enough to even dare the hackers, okay, come on, and if you can do it, hack my system. Well, eventually they will find a way because, again, to me as a security professional, we have to be 100% right, but the bad guys only have to be right once and that's it, right? And then many times too, they may be into your network, but you may not be able to actually find them, or you will not be able to know that your perimeter has been breached. And like, kind of like what happened with SolarWinds, right? They were in some of the most secure networks for about 9 months and nobody knew they were there. And they were just snooping in and listening in and kind of having a network map of the entire network. So those things do do happen, and I really believe as a security professional, you really, really have to work with senior management, with the board of directors, and really have them understand that there is no silver bullet, right? Just by hiring you, or even if they gave you a budget that is almost unlimited like we do in the Navy, it's no guarantee. Like, again, the bad guys only have to be right one time. So You really have to develop, I think, a defense-in-depth approach so that if one control has been breached, you have additional control that's going to give you time to discover and then try to remediate the issues before it is too late. But you really, really have to be on your guard. And that is just the the way, the way it is. If you are not comfortable working in an environment that is ambiguous, then security is not for you. But for somebody like me, I tend to get bored pretty easily, and I can tell you, since I've been doing security full-time, no two days have ever, ever been the same. So I think it is encouraging, inspiring even, right, knowing that Everything I know, I guess Socrates is the one who said it, right? All I know is that I don't know anything. Or the more you know, sometimes the more you know of what you do not know, right? I think it was Rumsfeld who talked about the known unknown and then the unknown unknown. But just having that attitude of humility, knowing that no matter how long you've been in this field or how many organizations you have worked for, you do not have a single answer. It is a team sport, and it really takes an entire organization working together and being aligned in order to be successful. But even then, you know, you may still get breached. So really, I think the mind and the will to learn, I think, is extremely, extremely important and doing the very, very, very best you can with the resources you've got and also documenting the process. What I mean by that, for example, in my organization, since I've been doing security full-time, I really see myself as an advisor, right? Many, many times in security function, you really do not have the direct delegation authority to for example, tell somebody in IT or engineering what to do. They don't report to you, right? But what you can do, and which I try to do better and better, is, okay, this is a risk, right? And I believe it is an acceptable risk, and I'm gonna let senior management know, okay, and this needs to be fixed. Now, I do not have to make the decision to fix this. I do not have to make the decision to approve the budget to fix it, but it is my job to let them know, there is a risk and I believe this risk needs to be fixed. And then I will take that risk and for example, take it to the VP of engineering. Okay, this is a problem, it needs to be fixed. Now, if they tell me, no, we are not going to fix this, or we are just going to ignore it, that is fine, but I want it to be documented. So this risk went from the security department to the engineering department. And if anything happens because of that risk that I told you 2 or 3 months ago that you decided to completely ignore, Don't fire the CISO, don't fire the head of security. It's not my problem. I told you about it. So I'm going to keep my job and I'm going to let you know. Basically, it is— I am transferring the risk from the security department to whatever department is really responsible for approving the budget and then prioritizing it within the organization, right? So I feel like in In our industry, that is something that definitely needs to be done, and hopefully the lifetime of CISOs is going to be more than 2 to 3 years per organization the way it is nowadays. All right, I hope that answers your question.

I was a CISO for 8 years at 2 different companies, and by the way, it was my organization that found the SolarWinds attacker, so they were only in my place for a few weeks. Um, but I was the CISO at FireEye. So, um, let's double down on that one though, because that actually, uh, the people on these calls have— there's, there's different versions of what people think of when they're talking cybersecurity, right? Because some people would be thinking, how do I write secure code? Some people are talking, how do I do investigations? There's a whole GRC side of thing, the risk and audit and compliance side of things, right? So yes, um, what you were talking about, being able to, um, like transfer the risk to a different department in the company— my experience as as CISO was a little different than that because, like, for example, I— there were some business units that they would accept all possible risks. They didn't care at all because they just wanted to make their numbers, right? And in my position, I ended up having to go like, okay, you don't get to take that risk on behalf of the whole company just because your tiny little business unit wants to do this one on, right?

Yes.

Take it, take a slightly different direction. So the human being side of that one is a little bit more than do I have a risk register and who owns the risk and do I have a risk exception, right? There's the managing through influence side of the security job, right? How do you lead and specifically, how do you lead somebody who doesn't report to you? In that case, you're literally saying, you as the VP of security or the VP of engineering who outranks me in a different organization, I need to influence you to do the right thing. And it's not just accepting crappy risk because you don't feel like doing security. Talk about that one because that's messy, right? That's like human being messy, right?

That is actually quite critical. That is why the last article I wrote for Forbes, I was saying that security is more than just technology, right? I really believe— well, I don't know how I came to that conclusion, but I think I was 17 years old and I just knew that no matter what you do in life, there are 3 things I believe. You have to be good at. One of them is technology. The other one is leadership. The other one is business. It doesn't matter if you are a technology executive, doesn't matter if you are a banker, it doesn't matter if you are a doctor. My, my original dream, by the way, before I got into cybersecurity was to become a medical doctor. But even as a future medical doctor, I felt like I needed to understand the business of medicine. Yeah, it's, it's good. I'm, I'm gonna be saving lives and healing people and so forth. But the bottom line is I need to be profitable. I need, I need to make money to provide for my family. So I needed to understand business. Even if you are in the nonprofit, and I've worked with quite a few nonprofit organizations, your mission may not be to make money, but to make the world a better place in whatever area of your interest. But the bottom line is you need to understand business. You need to understand how you raise funds and how you spend the funds. And hopefully, you know, you are spending less, I mean, you are spending less than the revenue that is coming in. Otherwise, the nonprofit is going to close the doors, right? So it really, no matter what you do, I think you have to have business sense. And then number 2, you need to learn technology. Today, really technology is part of our lives. So really, even if you are at Walmart or Target, the grocery stores, pretty much now they are using computer self-checkout and things. The register, it's all computer. Even the car we drive now, it is really, All modern cars are really supercomputers on wheels. That is really what they are. So the Internet of Things, people use their phone to watch TV and stuff. So technology is everywhere. You have to be pretty good at technology. You kind of have to be computer literate, no matter what you do. And then number 3 is what you are referring to, Stephen, leadership, right? My leadership mentor, told me when I was 17 or 18 years old that really leadership is all about influence. And I think those are soft skills. It's not hard skills. It's not really all of the tech skills you have to have, but those are extremely, extremely important skills in the security function, not just in security, but I really believe no matter what you do, but more specifically, we're talking here today about security. Leadership is really working with people and sometimes it gets messy and it's not, easy, right? And the thing with security, again, in my experience is you don't always get to make the decisions, right? In the Navy, it's a little bit different. When you do cyber for the Navy, you are pretty much, you know, the sheriff in town. You tell people to jump and they ask, you know, how high, right? So you are in charge and you tell them exactly what to do. But in Silicon Valley, that is absolutely not the case, at least in my experience. Engineering will definitely laugh in your face because they know they develop software that brings in millions and millions of dollars. They actually help pay for your salary. Usually when security reports to engineering, it's kind of like, I believe there is like a conflict of interest, right? Because your boss cannot be the policeman. They can pretty much shut you down right then and there. Ignore anything you tell them. So that is why I believe people skills is extremely, extremely important. Knowing how to negotiate, knowing how to work as a team, knowing how to influence people, kind of focusing on the mission of the organization, and then trying to really get the security program aligned to the business function. I think that is absolutely crucial, and that is what's going to make you or break you, in my opinion. But really, leadership is not a science, it is an art form, right? It comes with experience and you just have to learn to be in tune with other people and kind of develop this emotional intelligence where you are self-aware first, aware of yourself, your feeling, your emotion, but also aware of other people. And sometimes it's also about finding this ally, the sponsor within the senior executive team who really, really cares deeply about security too, right? Hopefully in every organization there is at least one or two of those people where the VP of engineering may not care about security at all, but the CFO, the chief financial officer, or the chief legal officer really, really does. And those people have very, very, very much influence on the board of directors and the majority of the senior membership, and those people can be the one to actually drive your program forward from the top down. But I really believe, as a security professional, when you first get started, I think the technical skills are pretty important. And I remember the days where a lot of the IT professional gurus, nerds, like we used to call them, will kind of be in the back of the organization, not having interaction with people or customers, and just write code or do whatever it is they do. But it looks like the higher up you get, the more you have to interact not just with people from different business units, but with customers as well. So you really have to be able to be influential, right? Hopefully, in most of the organizations I've been a part of, it's very important for the data to kind of drive to the decision. That too, I think, kind of needs you to be kind of like the business analyst, kind of not just find the technical reason to do something, but also the business reason why we should do it. What is the return on investment? A security professional needs to be able to talk to business leaders in a way that they can understand. Because sometimes it seems like we kind of speak technologist, like we speak this techie language that nobody else gets. And I think it doesn't help us. It doesn't help IT. It doesn't help security. We need to speak in terms that business people can understand. Like for a very, very long time now, most businesses have been dealing with financial risk and they know exactly how to treat it. And I really believe security risk should be at the very same level. They should be able to understand it in the same, in the same way. What are the risks to the organization? What does it mean to accept a risk or transfer a risk? Sometimes you may even want to have insurance, and sometimes it makes sense for an organization to say, no, we're just going to accept this because it's going to cost too much to remediate this vulnerability, right? It is better for us to just accept it, and if anything happens, the money we're going to spend fixing it is going to be much less than what it would have taken us to remediate the vulnerability. But it is definitely extremely important for security professionals to become leaders, right? Leaders of men in such a way that even if people do not report directly to you, where you cannot tell them what to do, but you are able to influence their decision. And I really believe in most organizations, the majority of people are willing to be led, right? They are willing to, they are open to a different point of view. And, but you just have to bring in, I guess, that level of expertise, not just in technology, but in business as well, and put it in terms that they actually can understand what you are talking about and what the risks are. Usually once you do that, they will find money in their budget and prioritize something that is obviously very important to you.

We're right up against on time on this. One of the things that we do as a net-net on that is for the students on the call, what we're talking about in the leadership and the influences, that that's where it gets down into having all those soft skills of being able to translate the nerd speak to the humans or being able to talk about the tech to the business. Yes, sometimes the world's best technician may not actually be the person you need when you got to go get budget or figure out how do I get more headcount or those kinds of things, right? So yes, all of those kinds of skills also matter. So this is not just a matter of how to become the best packet whispering code expert. We are right at 7 o'clock, so Olivia, do you want something? And by the way, Olivia, I want you to stick around after this call when we're done, but you want to finish it up here?

Uh, sure, yeah. And I have, you know, one more, one One more question for Bob. You know, one of the— and I put it in the chat— our programs in the community colleges, most of them tend to focus on infrastructure security. We have a few that deal— that are programs for application security, and some that are starting to develop DevSecOps programs. For the skills that you're taught, you seem to have really every, every other, other thing you're punctuating your points with being able to work with engineering, getting into the code and the applications for, um, what, what, what do our programs need to do to prepare, you know, our students to, uh, be in those kinds of roles?

Well, I really believe it goes back to something. As I said, if you're going to get in security, you really have to be willing to learn, right, and have the humility to know that you don't know everything there is to know. And there is so much that is out there that you don't know. I think being curious is extremely important. I think self-learning is probably more important than formal education. This is what I mean, especially when I went to school. Like I said, I was 17 years old going to college. I knew business, technology, and leadership were 3 things no matter what I ended up doing, I really needed to become very, very good at. But if I wanted to get into just IT, information technology, at the University of Alabama, they had a computer science program, but basically the only thing they would teach you is to learn how to code in 2 or 3 or 4 computer languages. That's it. That's all they would teach you. But information technology is much more than just, you know, coding in Java or C++ or whatever. It is so much bigger than that. Actually, the work I started doing full-time in 2002 as a computer technician, I didn't need to learn how to code at all. I was using, at the time, it was a Windows network, so I needed to know how to administer a server and the network and then trying to make sure I was doing it in a safe and secure way. And I understand that today you have opportunities to actually have a master's degree in cybersecurity, even some of you doctorate program now. So things, things are getting a lot better where people who decide to do computer science don't just learn how to code, but I think you do need to start somewhere, but you do have to be willing to learn, get experience. Another article I wrote for Bob Fabien Zinga, I talked about kind of like what it takes to get into the cybersecurity industry. And in my opinion, the most important thing is really experience, right? In the industry, people want to hire people who've already done what they want them to do, people who have done it somewhere before. That is extremely important. When I hire people, I need to know that what you're going to be doing for my company, you've done it for some other companies before. And sometimes that is not possible. That's why the second most important thing is formal education. But even with a formal education, I believe you really need to focus on hands-on learning. And in many ways, I feel like community colleges do it better than 4-year universities, especially when it comes to technology, right? And then third and last are industry certification like CISSP or Security+ and things. Like that, because you are proving to the employers that yes, I have the knowledge, I have the skills, and I have a third-party organization who's certifying that I do have the skills to do the job, right? So I think being willing to learn and just get some experience anywhere in the industry, entry-level position or whatnot, and start kind of building your career from there and having an open mind and always, always learning and when you can get third-party security certification as well. And I think especially when you are starting, that's going to be very good, but at a certain level, the certification don't mean anything anymore. I think if you look at my LinkedIn profile, I have maybe 28, 30 certifications now. Most of them are absolutely no good. I mean, I don't need them at all. I would let all of those expire except maybe for the CISSP because I have put too much energy and money and time into that one. But yeah, eventually they don't mean anything. But when you get started, I think it kind of forces you to actually get skills and then being able to pass an exam. Does that answer your question, Olivia?

Great. Thank you. Well, Bob, thank you so much for your time. For your time and insights and sharing of your experience. We really appreciate it. And—

Thank you.

Hopefully we can invite you back again and have you make you have a part— be a part of our partnership when we continue to look at these programs that we really need, you know, industry input as to how we continue to embellish them. So thank you so much. Thank you, everyone. I'm going to end the recordings. Bob, I have a really good question.