Episode 08: AI Nerd with Attitude

¡Hola!

Today I'm joined by Bob Zinga. He's the head of information security at Directly and also the information warfare commander for the U.S. Navy Reserve. He's kind of badass. But before we meet him, we got to listen to this. Welcome to AI Nerd, AI with attitude, where I try to make things as unnerdy as possible. Enjoy learning today about the latest trending technology. But before we begin, please subscribe, hit the notifications button, give it a like, and drop a comment below. Welcome to AI Nerd, AI with attitude. And today I'm going to give a bunch of attitude to Bob Fabien Zinga, who is the head of information security security at Directly. He's also kind of a badass because he's the information warfare commander for the US Navy Reserve. He may be a SEAL, we don't know. He may be a spy, we don't know. But what we do know is that he has joined me here today. Bob, how are you?

Great, great. I can tell for sure I am not a SEAL. That's a very, very special cadre of sailors.

But anyway, I'm very, very glad to be at That's what all spies say, that they're not a spy. And as a security guy, I bet you know how to pick— you know how to pick a lock? Can you pick a lock and manually pick a lock?

Uh, I have learned how to do that, yes, because physical security is actually part of information security.

Oh, are you wanted in any countries? No, no, just asking. I mean, you just admitted you know how to pick a lock.

When you become an information security professional, you kind of have to learn to do that.

So that's, that's amazing. All right, so tell me, tell me a little about you. So, uh, thanks for having us on. I'm gonna be quiet, and I tell everybody this, enjoy the moments I'm not talking. So, um, uh, I'm gonna mute myself. I'm gonna let you tell me about your journey, who you are, how you, how you got to where you are. And you know, you're, you're a cybersecurity, um, expert, but you've got to defend that now. Tell me why. So tell me all about you.

Well, it's a very, very long story. Yeah, so, uh, today I am the head of information security for Directly. I believe you just talked to my boss, my CEO Mike Delacruz. So we are an emerging leader in customer experience automation, helping companies deliver better customer service at scale. So we use artificial intelligence, machine learning, but we also— I think what Differentiate us from most of the competition out there. We also use human being, we call them expert or specialist, and providing a gig economy for them, but also helping our AI get smarter and also have human-like qualities. Anyway, so I am also a commander in the US Navy Reserves. So I guess, I mean, it's a very, very long story, but when I came to the US, I was back in 1996. My original dream was to become a medical doctor. So I was a pre-med student at the University of Alabama, Tuscaloosa. And for anybody who knows anything about college football, that's really the town to be. But anyway, so I was there. I earned my Bachelor of Science in chemistry and biology. I think I did it in 3 years only. And I was in the honors program there. So by the time I graduated, I had an honors thesis published. I decided to kind of skip the master's and go for the PhD, right? Because at the time, I was really considering going for the MD program at the University of Alabama Birmingham. However, that was in 1999. Back then, about 100,000 people in America died because of doctor's mistake. Basically, my idea of a doctor back then was a glorified pharmacist, right? I remember being in the pre-med program. I used to be in the well, what they called physician shadow program with the Honor Society for— was it Alpha Epsilon Delta?— for pre-med students, and I would shadow doctors at the local clinic there on campus, but I was really shocked to see that some of the doctors, they would talk to the patient and then kind of go back to the back room and look at this black book and kind of look at the symptom and kind of figure out which medicine to prescribe. I was like, no, if I'm gonna be a doctor, that's not the type of doctor I want to be. But anyway, make a very long story short, so I decided to go for the PhD so I would actually understand the science behind medicine and so forth and do research and then eventually get back on the MD track. But no, like they say, life happens to you. And I got married, I had a baby on the way, and I had to have a full-time job. And being a poor doctoral student, I think I was making about $8,000 stipend. Every single month for my graduate student assistantship back then. That just wasn't cutting it, so I ended up working full-time in tech, and then I got good at it. And when I was working on my Microsoft Certified Systems Engineer certification back then, I decided to study the security track, and that's kind of where I fell in love with security. And I had an opportunity to do cybersecurity full-time in 2005 working for the CISO, the first CISO of the University of Alabama, and 20 years later he is still there. Pretty, pretty amazing. But yeah, that is kind of how it started for me. So as far as my doctorate, I am what you would call the ABD, all but dissertation. So at some point in the future, I don't know if it's going to be possible, but if I want to be poor for another couple of years or so, I could probably finish my doctorate in microbiology. But anyway, doing security at the University of Alabama, I think maybe 5 years after I started, I had an offer from some crazy Californian folks who wanted to pretty much, you know, more than double my salary for a great opportunity at the Defense Language Institute. So I couldn't say no to that. So I definitely took the offer and packed my bags, got my family, and we moved to the wild, wild west. And we really never looked back. And from Monterey, I then moved to Silicon Valley in 2014. And I've been a part of a lot of high-tech companies, both private and public as well, like Groupon, and I also was a consultant, which was pretty cool. I had about a dozen customers, most of them small and medium size, but a couple of big ones. So I was really exposed to a lot of technology, and it was a really, really great experience until Draykly made me an offer almost 3 years ago to join the team as the head of information security.

I've definitely brought down the average IQ of this, this conversation. It seems like your real passion is to learn. And maybe at the time that, you know, there's what your parents and other people say because you're so smart, you should become versus what you really have a passion for and the speed of the passion. So I heard, I love learning, doctors move too slow, technology is really cool and fast and it's more in the pace of what I believe in. Maybe I misheard it, I don't listen very well, but—

No, I think there is definitely some truth to that. Yeah, I think when I was a kid, My parents definitely influenced me and my siblings too, right? Yeah, I think becoming a medical doctor was probably something, although I think I kind of wanted to, but I think my mother wanted it more than I did. Let's just put it that way. But this is the funny thing though. What I didn't mention is in 2004, so after 9/11, right? At the time I was not a US citizen or even a permanent resident of the US yet. So I tried to join the military. I talked to everybody, the Navy, the Air Force, the Army, and the Marines, but I really like the Navy number one and the Air Force number two. But anyway, all of them said no, can't join, right? You're not a citizen, you don't have your green card, so go back. Like with Terminator, I said I'll be back. And even prior to that, when I was a student at UA, I tried to join the ROTC program And part of the reason is because when I was 17 years old, I don't know where that came from, but I just knew in my heart, no matter what you did in the 21st century, you had to be good at 3 things. You had to become an expert in 3 specific areas. One is technology, because I felt like technology will just get more critical and integral to everything we do. Two, business. And number 3, leadership. So you had to become a better leader, you had to understand the basics of business, and then Also really be good at technology. Like even back then when I thought about becoming a medical doctor, well, I'm gonna be a doctor, I understand the science, that is great, but I still need to kind of have an handle on technology because everything doctors do today, you have to have computers, right? All of the machine they use to do tests and so forth, that's all technology. And then you're also gonna need, if you have your own practice, understand business and kind of try to make your practice profitable. So that was important. And then also being a leader, having a staff and being able to lead them in the vision of the company. But anyway, so part of those things I just effectively knew I wanted to become better at was leadership. ROTC said no. And then again, after 9/11, I tried to join all four branches of the military, they all said no. And as soon as I became a permanent resident, that was in 2004, Then I went back to my recruiter. Okay, you said I needed to be a permanent resident. Now I am. So how do I join? And then they're like, okay, you do have a degree. Maybe you can become an officer. Oh, but you're not a citizen. You can't get security clearance yet. So no, if you join, you have to be enlisted. I'm like, okay, let's do it. Let's get enlisted. Then the day after I became a US citizen, that was in 2006. So 2 years later, I went back to the officer recruiter. Okay, you said I need to be a US citizen in order to become an officer. Okay, I am a US citizen now. How do I become an officer? Process got started, took about a year and a half or so, but I finally became an officer. And this past April, I finally achieved one of my lifetime dreams to become a senior officer in the military. So I was commander. Commander, yeah.

That's, uh, next is captain, then rear admiral, then admiral. Is that correct?

Well, I'm not so sure about that. I've been in 17 years now, right? 3 more years, I can retire. And I think my boss has told me I should retire, so we'll We will see. We will see. Because being in the military does impact all of your family, right? Your spouse and your children. It is not a one-person thing. No telling how many birthdays and special occasions I have missed because of my commitment to the Navy.

Well, I always say thanks for serving because I never did, but I do appreciate the others that have. And, you know, I think coming up here in about, what, 10 days or so, we have Cybersecurity Month, right, in November?

And actually, it's October. It's right, right now.

It's right now.

Yeah. Oh, right. National Cybersecurity Awareness Month.

So what are your top, top 3 takeaways? Or if you need 5, do 5. For companies any size, what are the, what are the musts that must do for cybersecurity?

Well, I think the most important thing, I believe, is to have a person who is actually responsible for cybersecurity for the enterprise, right? It shouldn't be a function that is shared by a lot of people. There needs to be one person at the head. I think that is very important. Now, once you do that, what I've seen, especially with smaller companies, sometimes they are kind of forced to have someone in charge of cybersecurity or have somebody lead the cybersecurity function because they want to sell. And most customers, especially Fortune 500 companies they want to sell to, will not buy from them unless they feel like they take cybersecurity seriously. And what usually happens is they kind of have these checkboxes that they check they have someone, but then they don't really empower them to do anything. They may have the responsibility for cyber, but then they don't have the resources to actually be able to implement their strategy and get things done. So to me, number 2 may be more important than number 1. Not only you need to have someone in that position, but you really need to empower them to make changes and to implement their strategy. Cybersecurity has to really be— you need to get support from the very, very top. Senior management has to support the cybersecurity program. Otherwise, no, there is no— no reason to have it. The person in that role, man or woman, needs to have a voice, and you don't have to do everything they say, but you definitely have to listen to them and consult with them. They really need to have a seat at the table. I think that is very crucial. And then number 3, I would say, you know, kind of follow the best security practices. One thing I have noticed, especially with a smaller companies, very, very different from the Navy. Sometimes they don't even follow the simple practices for cybersecurity. Simple things like having not only having a very strong password, meaning it is complex and long, but also enabling 2FA, right, two-factor authentication, making sure that everything you do is encrypted, right? But in the 21st century, you absolutely have to have it. Without it, chances are pretty high your account will get hacked, right? Because for most people, most consumers out there, the only thing between their critical information and the hacker is a simple password. And I must tell you, I've been tracking this closely since 2009. The number 1 password in America today is like 123456 or password or password123456. 1, 2, 3. Those are very, very simple passwords, and those are the passwords hackers are going to try first. So if that's your password and you are listening to me, or if the PIN to your ATM card or whatever is like 1, 2, 3, 4, 5, you really need to change that. But anyway, so just following the basic cybersecurity principle and actually putting them into practice, I think, will help you a long way. Because I think many times all of the hacking and data breaches that we hear about, these hackers sometimes they— it is like a crime of opportunity, right? It's not like they are really going after you, but because you don't have any security controls in place and you're not even following the best security practices, it's so easier, right? So they— it is the lowest hanging fruit. So they just take advantage and then, you know, they exploit those vulnerabilities and get access to your data. So I think you really need to have someone who has the knowledge, the experience, and who has the support from senior management to start implementing those best practices across the entire organization.

I think just not buying people gift cards is a great way to start. I mean, that's a nice easy one, right? And I have been so beneficial, uh, from some, uh, apparently I have Nigerian princes in my family that left me a lot of money. I'm still waiting for it. I've given them quite a bit to travel here. They never seem to make it. They asked for one more gift card though. I'm not gonna do it.

I'm done. Yes, but really a lot of that has to do with common sense, right? Because many times these hackers aren't actually extremely smart, right? Because many times they find out about vulnerabilities because the vendors like Microsoft, every patch Tuesday, first Tuesday of every month, Microsoft will tell everybody, what is wrong with their operating system, where the vulnerabilities are. So you just have to read it and then you can figure out how to exploit that. But also many of them really attack you at the human level, right? It's social engineering. It has nothing to do with the technology at all. They kind of try to exploit your greed or fear and get you to give them access to some type of information they shouldn't have access to. And then From there, they can move across your organization and do some very, very bad things. It looks like we're running out of time.

It makes me as angry as Thanos when I see this happen. I just get really— Yeah, you are interesting. I gotta tell you, you would be a fun person to have a drink with, I would tell you what. I mean, maybe you don't drink, but I'll do it for you if you don't. That's fine. I can do that. I'm very good at it.

Tell me something.

Give me the future cybersecurity. You know, you're, you, you, well, you see things that you're, you can't talk about on the, on the site, you know, on the cybersecurity side. And, you know, I have a small stint working with Cyber Command out of the Air Force. Oh, nice. Not nearly to the level as you, but I've spent enough time in a SCIF here and there to have a conversation. So those aside, those types of things from the commercial side, and I'll tie it back to Directly, you know, you're passing a lot of information through chat and, you know, and I love that these smart forms pop up and these little pieces, but I'm also like, yeah, but I think that's for my comfort. Cause at the end of the day, I'm still entering the information online. So it's like, tell me maybe like, um, what you guys have done without making it so heavy on the security side of Directly that you've taken all this life experience and, you know, it's like the shameless plug time. Like one of the competitive advantages, the fact that you have a security information officer on a chat, I honestly don't think In startups you see that too much, actually. I haven't met very many people, yeah, head of security on a startup. It's, you know, it's the last thought, right? We're just trying to get customers, we don't worry about security. But you're there already, so what is your competitive advantage that you bring now into that startup?

Well, a couple of things, right? Because now also security and privacy, there is a whole lot of overlap. I think for small businesses and startups, part of the The pressure, I think, is going to be regulation as well. I think regulation is coming. But also a lot of the pressure many smaller companies see, especially from the time when I was a consultant, those Fortune 500 customers, right, or the US government. If you want to do business with Fortune 100 company or the US government, those organizations care a whole lot about security. So they are pretty much going to force you to improve your cybersecurity posture before they become a client. Like when I was a consultant, most of the customers we got was because they would receive 2,000 security questionnaires they had to fill out and they had to become compliant to SOC 2 Type 2 or ISO 27001 or all of those security frameworks and it was just above their head and they needed help. So my consulting team would come over, pretty much take over their security function. So there is that. So One thing I think that kind of differentiates us from the competition out there is ensuring that we have implemented the best security practices for our platform and all of the apps we deploy, making sure we ensure confidentiality, integrity, and availability for all of the customer data we have, including personal data as well. One thing we do at Jerty I haven't seen done a lot in Silicon Valley is we have a lot of what we call PII filters. So they specifically look for any personal data, whether it's, let's say, credit card, name, email address, or anything like that. And when it's found, it flags the data, and then no one can continue the conversation until we deal with it. And once the issue has been resolved, then the conversation continues. That is one thing. Another thing we do different from everybody else is once the question closes, we only keep it for 30 days. After 30 days, we completely get rid of all of that data, which is pretty amazing because I've worked for a lot of startups where they keep the data forever, at least until the duration of the contract, which could be years and years and years. But at Driftly, we kind kind of lowers that risk significantly by keeping it for 30 days.

Do you use the data though for training the model and then like normalize it and anonymize it?

Yes, the one we use for training the model doesn't have any personal data and just the context. But again, we keep it for 30 days only, which is pretty—

Is that a secret you just revealed about your backend system that a hacker's gonna use?

No, no, I don't think they will. But I think everybody who's out there doing security, they really need to think of ways to minimize confidential data on the platform. I think it's even better if you never receive confidential data at all. But if you do, try to keep it for as little time as possible.

If you just stay broke, you don't need financial data to give. So here's my last question. Are we in a matrix? Yes or no?

Maybe. I think it depends how you look at it. Well, you definitely are right now.

Oh God, what happened? We are in the matrix. It's not even a maybe at this point.

Just generally speaking, I think in life everything really rises and falls on the decision we make, right? I think for many people, they might consider themselves in the matrix in the ways that we have been conditioned throughout life and the way you got raised in your society to almost act automatically, right? As soon as something happens, you respond right away without thinking. It's completely unconscious. So, and so many times also people are like, okay, where did time go? Like I just woke up this morning and it's already like 9:00 PM or whatever. It's like they live their life, but they are pretty much sleeping, it's like zombies, right? So in that sense, yeah, I think you can say you are living in the matrix. But by becoming a better leader, I can't remember who actually said it, but you really have to find the space between the stimulus and the response, right? And then you have to make a decision. And one question I ask myself often is, okay, what is the wisest response that is aligned to the person I would like to become? Not who I am now, but who I want to be. What is the best response to this stimulus? By asking that question, I actually think, and I don't just automatically respond. I think about my conviction, my core values, and the person I want to be, and then I come up with the wisest response for the scenario. I think it makes me better, and it helps me manage my my time more? Like, another question I ask myself is, what is the best use of my time right now? Right? So I think as you become a better leader and you ask better questions and you, you think better, you feel better, and you respond better, I think you find your way out of the matrix.

That's a really nice, you know, once again, I'm further lowering the IQ of this, of this conversation for sure. I love that response to take that moment. Now, I don't know if you learned that in the Navy, because You definitely don't want to interrupt a senior officer, right? They're chewing you out. So you're like, what is going to be the best response to the person they need me to be in the next 12 seconds? So maybe there's a learned push-up related behavior with that.

I don't know.

Or running, little PT with that. Whatever, whatever horrible things you'd have to do if you did, said the wrong thing for sure. But I got to tell you that that's a, that's a great leadership trip. Trick, then I'm going to just make my own and not give you any credit for it. Just, you know, perfect leadership. Yeah, just taking all the credit for it. But no, that's great advice. Is what's the answer? It's almost like a fatherly answer. What's the answer I want to give you as opposed to the one I actually currently execute and believe in?

So who do you need to become? Absolutely.

I think that's a great ending note. And I really appreciate the time. And, you know, we had a little time before and after these things that to meet each other. And you're an incredibly interesting person. I hope to get to meet in person one day. Once this COVID thing becomes the next COVID thing, then we'll just worry about it then. But I do mean it. I really hope to get to meet you in person one day. And I truly appreciate the time.

Thank you so much, Tom. I'm really glad I got to meet you virtually first in the Afro Technology Council platform. I think what you're doing is very important. Thanks again for having me. I see you on today.

I appreciate it. I, I, it means, it means more to me than you can imagine. So thank you. Have a great day. I'll talk to you hopefully soon. I hope you enjoyed the video today. Thank you for listening, watching. Please subscribe, turn on notifications, hit that like button, and drop me a comment below. AI Nerd, AI with attitude.