Cybersecurity architect Brook S. E. Schoenfield, who played jazz with Chuck Berry and Bo Diddley, discusses his 25-year evolution from networking to security architecture. He argues that threat modeling and developer-centric security matter more than tools, and that AI alone won't solve coding vulnerabilities.
Chapters
¡Hola!
Hi, I'm John Maxwell. When the top companies in the world are looking for trainers, speakers, and coaches, there's one name that stands above the rest, and that's Maxwell Leadership. Our certified team members have gotten proven results for companies all over the globe, and our reputation, I'm proud to say, is second to none. Some of our members have risen to the top of their profession, including the one you're going to meet today. I proudly introduce you to my friend Bob Fabien Zinga.
Welcome to the Leadership and Success Podcast with your host, Coach BZ, where we help you lead with purpose and succeed with impact. If you're ready to grow into the kind of leader others want to follow, this podcast is for you. If you're determined to elevate your success and leave a lasting legacy, this podcast is for you. As my mentor, Dr. John C. Maxwell, reminds us, everything rises and falls on leadership. Our goal is simple, to inspire you, challenge you, and equip you with insights that can transform the trajectory of your leadership journey. Welcome aboard. Welcome aboard to another episode of the Leadership and Success Podcast with Coach BZ.
How do you define the strategy for SOC analysts looking at alerts so that they can do the best job possible? So you've got to get past the marketing stuff and we have to get to what does the tool actually do and what does it provide and at what level of surety. Since nothing's 100%, can we get to some level of surety? And that's where the human comes in. Double-checking, triple-checking. Which brings us to AI. Is AI gonna save us? At least not at today's state of the art. There's an error rate built into every AI by the very nature of the way it's trained and the way it's set up. There is an error rate, or you bet, and they try to get those error rates quite low, but doing certain things will amplify the error rate or diminish it depending upon what you do, depending upon how precise your inputs are and, and, and other things. And, and how well trained it is, or you can get word salad, which we have, by the way, at Resilient gotten word salad out of supposedly well-trained models. It's pretty funny.
Context.
Lots of context. The point is, it's probabilistic, which means that it has an error rate. Again, we're back to risk. There is an error rate that is, that is determined, that is assured. And, you know, the thing about humans is we don't know what our error rate is.
Alright, welcome to another episode of the Leadership and Success Podcast. We have a very special guest for you. And before we get started, as is our tradition, we're going to start with our moment of gratitude. This is where we take just a short moment to be grateful for something every single time we meet. So if you would maybe close your eyes, take a deep breath and put yourself in your happy place. And right there, what are you grateful for? I think today I am grateful to be an American, grateful to live in a country we call it the home of the brave, right? The home of the free. But I also understand that freedom is not free. As you probably have noticed this entire week, I am wearing a black ribbon on my LinkedIn picture because of the 6 soldiers who gave their life for this war we started with Iran. Really unprovoked war, but we started it and 6 soldiers have died. And the one who really broke my heart is the 20-year-old, right? He's only 20 and they have 2 kids. One is 24, the other one is 18. And I can't imagine them dying so young, but he died wearing the uniform of his country. And I am grateful for people like that who are willing to do that for you and for me. All right, so type in the comment what you are grateful for today. And also let us know where you are joining us from, what city, what state. And since we've gone global, which country if outside of the US. And also if you have a question for my guest, go ahead and type it in the comment and we're gonna be answering your question live. All right, so let me see if I can properly introduce our guest today. Today I am going to be speaking to Brooke S.E. Schoenfeld. He's a globally respected cybersecurity architect, author, and thought leader who has spent decades helping organizations design systems that are secure by design. That's so important. It's not having security added on after the fact, but having security baked into the design of the software. So Brook is the author of several influential cybersecurity books, I believe more than 7, but just to name a few, uh, Secrets of Cybersecurity Architects, Securing Systems: Applied Security Architecture and Threat Model, Building Insecurity at Agile Speed with James Ransom, and he's been a contributor in the book Core Software Security: Security at the Source. So throughout his career, Brooke has led security architecture initiatives at organizations such as Cisco, Autodesk, and Intel Security McAfee, mentoring security architects and helping companies integrate security into the fabric of their systems. Really funny story. I was enlisted in the Navy as an IT seaman. I went to a network security class and my professor said, "Hey, do you guys know what network security is? Cisco." So according to him, if you were able to manage all of the Cisco firewall and switches, that was network security. But anyway, Cisco, they definitely have great, great product for sure. So Brooke is also a founding member of the IEEE Center for Secure Design. And longtime advocate for developer-centric security and threat modeling. So for those working in cybersecurity, DevSecOps, or sometimes it's called SecDevOps, or software engineering, Brooke's work has shaped how we think about secure architecture and resilient system design. So ladies and gentlemen, without any further ado, please help me welcome to the Leadership and Success Podcast, the one and only Brooke Traunfeld. Good morning.
Good morning. How are you? I just gotta ask you, yes. What year was that when he said Cisco was?
Yeah, that was 2000. It was right before I became an officer. So I became an officer 2007. Must have been 2005. 2005.
Okay, they were a little late. By then we had realized that attacks had moved up the stack and web infrastructure and application team at Cisco was now the largest part of InfoSec because, yeah, things had changed. So they were a little behind the times. In 1998, I would have said, yeah, exactly. When I took over that team as the technical leader, it was the least important team. They actually said to me, you know, we want to keep you. We just did these RIFs. And but your current position, yeah, it's not working. Would you be willing to be our application security architect? We've been looking for one for 18 months. It was a step down because network was everything. That was in 2001. But by 2005, things had changed.
True, true, true. But sometimes it takes a while for the military to kind of catch up. But of course, my professor was extremely biased. So I knew that. So maybe one of the first questions I want to ask you, Brooke, is, uh, what is one thing you are grateful for today?
You know, the people this industry has brought me. I, I actually will say this to my spouse time to time. Oh my God, the incredible humans I have been gifted to interact with. Brilliant, incisive, thoughtful, caring deep. I can't believe I'm so lucky to know the people that I know in this industry. And believe me, when I got to Cisco, I was like, I don't know if I can deal with these people. But oh, the people this industry has brought me. There are a lot of— I mean, of course there are some very not nice people and divas, of course. But the people that I have met have been by and large really driven by care and depth, which, by the way, gets to leadership right there. But I am deeply grateful for my circle of friends and network that have come to me. I am enriched every day.
That is really powerful. So our first comment from the audience, we have Shevy. I have interviewed her. So make sure to watch the interview from Mobile. Alabama. I used to live in Tuscaloosa. So happy Sunday and International Women's Day. And I do have a tribute for International Women's Day toward the end of the show. And she said she's grateful for family and spending time with some amazing women yesterday, joining from Alabama. Thank you so much, Hebe, for being there with us. So let me ask you this then. What is something about your books that most people may not know when they first meet you?
Cybersecurity is maybe my 6th or 7th career.
Wow, really?
Yeah. And, and, uh, and, uh, you know, I, I was really determined when I was a child to be either an archaeologist or a paleontologist. And then I really got into anthropology when I went to college. I was like, this is it for me, this is it. Except I couldn't get a job. But I was also really diving into music, which led me to playing for people like Chuck Berry and Bo Diddley.
Really? Yeah, you did?
Yes. And then I got into jazz and I spent 20 years trying to form a jazz career while doing some other things, but, you know, and teaching and whatnot. And then I became a professor at Cuesta College and Cal Poly. So, you know, oh, and in there, in there I was a salesman and accountant for my mother's business. Wow. Business. So You know, I had a lot of— did a lot of things before I got to high tech.
So yeah, that's amazing. And I can't believe you played for Chuck Berry. My father used to listen to his music. Were you ever recorded on any of his albums?
No. No.
Wow.
That is one of his bands.
Wow. That is— that is—
that is a great story though. He walks in and he says, I don't need another guitar player, you can go. And I said, okay. And he said, no, no, wait, because he wanted to hear what happened. We drop into a standard blues and I play exactly the right thing, and he looks at me and he says, you can stay.
Wow, coming from him, that must mean a lot. Do you play any other instrument besides guitar?
Um, I play a lot of instruments rather badly. Of course, I can lay down a bass line or whatever. And wow, and yes, because because in there I was a substitute teacher, um, at one point for the schools in San Luis Obispo area. And because of that, you have to go and you have to get a C scale at least on a trumpet or a trombone or a—
wow.
So, you know, I can, I can get a sound out of a lot of instruments. Don't— you really don't want to see me scratching on a violin, but yes, I can get a sound out of it.
Uh, wow, that's amazing.
Work with little kids, right? And yes, I've conducted orchestras rather badly because I'm sight reading the music, you know, and that's not that easy for me, you know, scores.
Man, that is incredible. Okay, we're going to have to talk offline because I really love music. It's played such a very important part in my life. I was 7 years old when my father forced me to learn how to play the piano, but it's been one of the best things I've ever ever done in life. Because I don't know, I feel like when you are kind of musical, you can even apply it in science and technology, the way you do math and everything else. I always fall back to music too. When I go through a hard time, I'm challenged, it soothes you. I mean, it inspires you. It's just part of my life, period. Like every time there is a milestone in my life, there is like a soundtrack attached to it. I remember exactly what I was listening to during 9/11 and when this COVID thing came to California and all of those things. So it's incredible. All right, so let's get back to you. So let's start at the very beginning. What drew you into cybersecurity? You always told us you had like 6, 7 careers before you ended up into what I believe you were born for. But what drew you into cybersecurity and software security architecture?
Yeah, that's a great question. So it's a bit of an accident. But the draw-in is, is different than the accident, right? So I was a chief designer at a software house. I had been director of software, of software development there, and I was a technical leader there leading a bunch of projects and, and whatnot, and, and a chief designer along with another guy, brilliant guy, Stephen Malinowski, really fabulous, dear friend, and, um We were kind of the chief designers, if you will. And because I wrote TCP/IP stacks at that time.
Wow.
Yes, I did indeed. And helped with our real-time operating system. You know, worked with Steve Jobs.
So was all of this just self-learned?
Well, yeah, I mean, of course, I had some university training to start out. But then I just—
wow—
boogied down, right? And it grew. It grew over time. And the thing is, I really am kind of an engineer in the sense that I don't like just working on something. I got to know how it works. So that led me down to very low-level debugging and understanding, you know, the deep computer science of the CPU and how it talks to the memory and what the registers do. You know, all of the really deep stuff. Okay, so I'm a chief designer there, one of the two, and I write TCP/IP stacks. And my boss comes and says, we got to stop paying this kid to come in. It's very expensive. Could you change the access controls on our Cisco router?
Wow.
I said, I bet I could do that. First thing I did was crash it, of course.
Yes.
But I learned, I learned, you know, figured it out. And this is, by the way, before really just the beginning of the web. Wow. So this is 1998, '99, something in there, right? This is before the web had really taken off the way we think of it today. It was there. But I'm a digital, I'm a internet native. I was participating in the internet before the web. So at any rate, I'm, I'm, I'm, I'm like, sure, I can do this. And I started noticing there were some weird traffic. Hmm. So I said, I gotta find out what this is. What is this? So that took me down the rabbit hole to figure out the traffic. And then we had— I mean, this is my second incident, by the way, cyber incident. I'd had one much before where I cleaned up a worm, so that's a different story. But, but I wasn't into it, you know, it was just something I had to do. Um, but, uh, we had an incident, you know, they said, what, one thing led to another, would you, would you, would you, um, now that you know how to do the network, can you put us on a DMZ? Can you bring up a VPN? I'm sure, sure, sure, I can figure that out. Right. And so it was a slow burn, if you will. But then I started—
you become a system engineer—
and I couldn't figure out why we were losing disk space. And it turned out to be child pornography with the FBI, the whole bad stuff, really major.
And then you got the FBI involved.
I had to.
Yes, yes.
I had to let them know there was this horrible stuff on our machine that had to be right. I mean, if there's one thing that I am really against, it's abusing children.
Absolutely.
Boom. Let's not go down that rat hole. But, but still, you know, yes, that really pushed on my own personal integrity and morality really hard. I had a young daughter at that time, right?
Wow.
So, you know, uh, there are some things that are non-negotiable, period. And so, you know, we, we cleaned it up, and I said, I gotta learn about this. And so I brought up tools. First, I brought up the Navy's, you know, open source, um, network watcher— I forget what it was called— um, which put me into knowing who Michelle Crabb, now Michelle Gell, was. So there's a little You'll see as we talk about this, there's more to that as time goes on.
Yes.
Um, but, uh, because she is now one of my dearest friends, but that was a long time ago. I didn't know her at the time. And then I brought up Snort because I did networks. I knew how to look at packets and, and stuff. I mean, this is what things— I'm one of the people to ever find a bug and convinced Apple that they had a bug in their Mentat stack. You know, I mean, I think I was living. And so it just kind of sucked me in. And it wasn't until I was at Cisco, I went to Cisco to learn, to be honest, was kind of done at InnoSys. And I went to Cisco to learn to work with these amazing people. Yeah, like Michelle Gell, not Crabbe anymore, got married. And, and, and Steve Atchison, who helped write OpenSSL. Not OpenSSL, OpenSSH. And so anyway, I was working with these amazing people. I mean, when I got there, I have to tell you, I thought I knew. And the first time I was in a meeting, I got about this big. And I went, I am never saying another word in these meetings because I don't know.
Yes.
I went from big guy to very little guy. Those little moments are not bad for a person's growth.
Absolutely. Yeah, it's kind of like being a big fish in a small pond and being a very small fish in a very big pond. It's humbling, but wow, that is quite amazing. So what was the moment where you realized that security architecture would become your life's work?
It's when— so it's when they asked me to step down from— I had been designing future what we now call a SIEM, or security information manager. And I was now an application security architect, and I wrote Cisco's very first— or pulled together Cisco's and wrote some of it— Cisco's very first coding InfoSec coding guidelines. And, you know, that was sort of what I was doing. And I looked at database security. I got to look at the Java runtime engine really deeply, figure out how bad or good it was. There's some really cool things. But wow, then, um, they had me doing projects with people. And, you know, every project had to come in and be assessed in 10 minutes. And they gave me that job, sitting in those meetings to figure out in 5 or 10 minutes whether they needed more InfoSec. And I was exposed to a huge amount of stuff. And because I'd been a designer They were— people in security with design background were unicorns. Yes, I had no idea at the time, but they were absolute unicorns. People either came from sys administration or law enforcement or intelligence agencies or law enforcement, or, you know, a lot of great FBI people I've met over the years. Um, I know there must be terrible FBI people, but I just never met one. Yes, just to say that it's kind of interesting.
But excuse me, excuse me, do you need some water?
I do.
Um, take your time.
Thank you.
This is just fascinating, man. You, you've really met a lot of, uh, history makers, people in the industry that have really built, uh, this industry, right? We stand on their shoulders today. It's incredible.
We do. So, so at any rate, um, I had this experience that very few people had.
Yes.
And so it made me able to talk to the actual architects in a way that other people were struggling with and to understand the problems in a way that other people— not everyone, but some of the people— were very focused on the exploit or very focused on the you know, that's, that's what we do in cybersecurity, or the, or the cure, or what's, what's in the industry standards. Whereas I could really understand the, the problem in an architectural and structural way. And that made me a bit of a unicorn, which made me, you know, and, and it just— I realized this is really important at some point in that first maybe year a year and a half at Cisco— this is 2000, 2001, 2002— um, I realized this is really important. Wow, this is really important. And not only that, I mean, one of the things that happened after 9/11 is we all got brought into the— so I served too, but in a way you might have not imagined. Everyone was drafted into what would become Homeland Security because we recruited critical infrastructure all InfoSec people at Cisco, period. Not citizens, US citizens. And so that was an interesting moment because it wasn't asked. We were just told, you're critical infrastructure, you are part of the defense of this country, period. Wow. We'll do this. And you are drafted. It's that simple. No arguments, no nothing. You're gonna do this work. And I mean, I'm happy to do the work, don't get me wrong. Yeah, I do consider myself a patriot with, um, wow, my own thinking.
Uh, but absolutely, thank you for your service. That is, I, I didn't realize that.
Yeah, well, I didn't, I didn't, I, I, it wasn't a choice, you know, we got drafted. It was just the thing. Um, it was a little surprising at the time, but it served has served me well as many things. But there we were. And you realize, I began to realize that we're really getting dependent on software. Now, I've developed that over the last 25 years a lot. Yes. And I have some data and whatnot we can go into if you like, or you can listen to other things where I have cited that, that data for the audience. But I realized how important software has become. It's become critically important. Obviously, our water, our electricity, everything is dependent on software in our life way.
Yes.
But my favorite picture, and I use this picture, thank you, National Geographic, without their permission, but I did quote, I did, you know, try to be good.
Give them credit. Yeah.
This picture, it's a picture of Central Asians They're out there with their sheep and their horses. So they're clearly living a different life way. Yes. Well, they've got their smartphones up and they're taking pictures of the guy taking pictures of them.
That's incredible.
And just think, just think for a moment what a gift a smartphone is.
Yes.
Out in the, in the, you know, in the steppe of Central Asia. Instead of guessing what the weather's going to be, you've got it right here.
Yes.
If you lose a sheep, you can call Dad and say, "We lost a sheep, Dad. I'm sorry," right? Instead of riding for 3 days to tell them, "We lost 3 sheep." Wow. I mean, think of what a boon. But that's software. And I really want to make it this important to everyone in this audience. Human beings, not all human beings, there's still about a billion of us, más o menos, who are living different life ways and are not dependent. But the rest of us, 7 billion approximately, are really dependent on software every single day.
Yes, yes.
So I began to realize, as I began to come to terms with this, this is important. And this might be a place where I can just shift even the littlest bit Yes. To make the world a better place, because I'm really driven by that.
Absolutely.
Just a wee bit. I mean, I've spent a lot of time in my life doing various different things to make the world a better place, including playing music. Um, but this is a place where I might just move the needle a little bit, even if it's one degree, even if it's a quarter of a degree. Have I done something with this life that is worthy?
Wow.
And that is what drives me. And that's what sent me down the rabbit hole to learn as much as I possibly can, to understand every one of these things, to get it, to really understand what is risk and what are we doing wrong. And we'll come back to that.
Wow, that is really, really powerful. Very inspirational. Wow. So like you say, you spent decades working in security architecture, company like Cisco, Autodesk, Intel Security, McAfee. So, how has the discipline of security architecture evolved over the past 25 years? And where do you believe it still falls short today?
Ah, this is a great question, and thank you for that question. First off, we were really concerned with getting control back in the day, getting control of the wild-haired developers. I was a wild-haired developer. What the heck? I mean, that's not actually what developers are, right?
Yeah, I guess they used to be what, smelly in the back of the office?
Yeah, yeah, yeah. I mean, well, that was Cisco. I mean, nobody cared what you wear. People wore shorts every day and flip-flops, and as long as your t-shirt wasn't too torn, it was fine. Nobody cared. Nobody cared as long as you did your work. Now, when you get in front of customers, this is a different story. But, um, but, you know, in terms of the office we've treated each other as human beings. You don't care what people wear. Some people wore very nice clothes, some people looked very ratty, doesn't matter. Okay, so, but treating people, anybody, as dangerous or stupid and putting them down is always a bad idea. It just never works, right? You know this, you know this deeply, so your audience knows this, but That was kind of the attitude, which is what led me eventually to developer-centric security, something, you know, that I invented to just try to get people to shift their thinking. But nevertheless, it was sort of reining in the wild tribes who would do anything they wanted. And I'll never forget though, Laura Linney, who has gone on to a fabulous career at Microsoft working on standards bodies. She took me to my first, uh, um, where we were doing, you know, I was supposed to go in and figure out the security of this project, and, and I was, she was mentoring me and I was following along, and, um And we came out and she said, "Brooke, we're not the cops. We're trying to help these people be successful securely." It was really good advice. Really good advice. And that's the big shift. That's no longer— maybe some old InfoSec people are still trying to control the wild tribes. But we understand. I mean, developer-centric security. I mean, if you ask any AI, it'll tell you, you know, that's always been around forever, developer-centric security. And I'm like, no, I invented that. You can go to my website, look at when I invented it. But yes, but it doesn't matter. It's become folklore because we— and that was quite a compliment if you think about it. Absolutely. The idea is we're partners in a process. Laura was right. We're here to make them successful, and part of that success is enough security to meet their security needs, and not everything needs the same security level, right? A little utility, or, or, or the— and I was just writing this in this book we're writing about AI security, um, I, um, where, um, you know, when I'm running an LLM that's not talking to anything on my own machine, the security problems there are very different than, say, our product that has an AI available to the public.
Public, yeah.
That's a, you know, that's a very different problem and a very different security posture. And so you got to realize that. So that, you know, that, that way of thinking has really shifted over time. Really. And, and I think our tools have become better.
That is really amazing.
There's one other thing, if you don't mind. Please, we'll get back to this because I saw that question in your, in your thing. Um, we've centered on threat modeling as the foundational technique. That wasn't true. It was implicit before. We were doing threat modeling. There's no other way to do this, but we weren't talking about it in quite the same way than we are today. We've centered on threat modeling, but threat modeling is not the answer. It's the means. It's a technique we use to achieve a security architecture or a security posture, right? It's a— it's a technique. It's not the thing. It's not the end gate. It's the path through. And at this point, it's the only path through. I'm I'm sorry to say. So if you don't threat model your— and the thing is, we all threat model to some degree or other, except that idiot who's driving down the road and nothing could ever happen to him and he's perfect, his driving is perfect. The rest of us are all defensive driving, hopefully. And yes, and, uh, you know, that's, that's a threat model, by the way. So it's not weird, it's not something we don't do. It's just that it takes a lot more technique for doing it for a system than it does You know, I mean, driving has its own techniques, of course. So at any rate, um, coming back to that, uh, the big challenge I think today is getting us enough and getting away from perfection to getting something. I just spoke about this last week, I think. Um, we got to get away from perfection. Actually, it was this week. We got to get away from perfection because there's too much code. The cost of code has collapsed with AI to trivial. Instead of hiring someone like you or me, we're expensive compared to an AI at $20 a month, or free. Not free, really, but you know, we are the product for the free. Yes.
Well, the world is changing. I'm really grateful for all of the important contributions you made into our industry. So let's talk about why architecture matters more than the actual tools. And I also like your mindset. Like, people talk about threat modeling as being an end to itself, but no, it's only a means to an end. So many organizations focus heavily on tools and technologies. Why do you believe architecture and design are far more important than tools when it comes to building truly secure systems?
Well, I don't know if they're more important, but they're a piece that must not be neglected. I don't want to I don't want to use a scale here.
Yes.
Um, the state of the art is there's a bunch of stuff we have to do that are interlocking and overlapping because nothing is sure. And this goes back to the Turing proof. Alan Turing, brilliant man, um, mathematician, and, and helped originate, you know, the analog computer, you know. Um, let's not go into that history, but, you know, it's It's all there for people to look at. But no, he didn't invent the computer. That goes to Ada Lovelace, um, in 1848, I believe. Um, but, uh, nevertheless, um, it goes back to the Turing proof, 1936. The problem is because there's a near infinite way with Turing-complete languages to express anything that the solution set rises to infinity. And therefore— and you can look at the proof. I'm not a good enough mathematician to really assess the mathematics. I just know the theory here. But nevertheless, the point is that we can't prove— as Ekster Dijkstra so quippingly said, you can't prove software doesn't have bugs. You could prove it had— does have bugs. You could prove it has bugs. You can't prove it's bug-free. And while there are some mathematical proofs, um, that, that can get close to something is correct, we certainly can say it's implemented correctly, but does it have an error in implementation? Or, you know, some problems there. So anyway, we're left with this— put it together in pieces across the scale. If you don't start and think about your structures, you're going to end up reworking stuff at the end. So classic mistake over and over and over, and it's still true. I still hear people say this, and I mean, we work with a lot of companies, and people say, well, it's not done, we don't want to do the threat model now.
Yeah, yeah.
The point is you start the threat model as you start to ideate and think about it.
Yes.
Because you got a plan for putting this stuff in. And it's hard to put in— some of the things are easy, some of the things are hard. Some things have tools, some things don't.
Yes.
So think about this— is a classic misunderstanding in the old days was security is non-functional. Wrong. If you're a bank, believe me, authentication and authorization are really functional. Everybody expects to only look at their account, and only authorized people will look when they want to help them at their account, right?
Yes.
And so those are functions. Those are features you have to have or you're not a bank.
Boom.
End of story. So, you know, those are security things. They're security controls. OK?
Yes.
So some security is functional. Some security is not. And in order to get those features, those security features, those security behaviors is the way I used to think about it. But my friend Isar Tarendasch, who, by the way, you should have on your show, likes to think about it as values. If a system values privacy, if a system values integrity and values confidentiality, then it will, by its nature, do the right thing. This is a brilliant shift, I think, in our thinking, by the way, and I credit Isar with it, not mine. And by the way, I'm really keen to always credit other people because we stand, we work collectively, and we stand on the shoulders of giants, as you said. But nevertheless, value, if a system values availability, then it will be available And those, that's the triad, of course. Ah, confidentiality, integrity, and availability. Classics. And we'd like to add privacy and safety.
Yes.
But nevertheless, those values, if it values those things, if it shows those kinds of behaviors, if it demonstrates in its working those behaviors, then you begin to manifest a security posture. Okay, the only way you're going to get everything except coding security is by planning it in and thinking about it. Hence, you figure out what to do through threat modeling, and then security architecture is you figure out how to do it, and where to do it. And the why is the threat model, the what is the threat model, and then how and, and where come from security architecture. So really, they're intimately related. Threat modeling is the technique, security architecture is the discipline. Unfortunately, security architecture as a term is dual-loaded because it also means that collection of controls and protections and mitigations that build security posture. So that's the technical definition, but it's also a discipline. I'm a security architect. And so it's that discipline that builds that And that kind of brings you to where, you know, to where, why security architecture is important. The only way you get these other things is by thinking about them and considering them, not by just coding your way into a morass.
Yeah, thanks so much for sharing that. And I think that is so, so critical. So one of your core philosophy is developer-centric security, which you, you mentioned earlier. What does a healthy relationship between the developers and the security teams kind of look like?
And by the way, a couple of my programs have achieved what I'm going to say, so this is not aspirational. Yes, and it doesn't mean we disagree, we agree about everything, but when you're a team and you're all trying to achieve the business goals the software is intended to deliver, you get this wonderful synergy and collectivity. There are special skills that, say, a security architect such as myself brings to the table that the other people don't necessarily have. So as an example, I've taught thousands of people how to threat model. So not a brag, it's just a fact of being a teacher, right? And lots of people have gone through my, my, my classes over time. So, you know, eventually, you get a sense where people struggle, where anybody can learn to threat model, or almost anybody, I shouldn't say 100%, but, but most people, because we get it, you know, it's not that hard to get at some base level. But the The problem is a security architect or someone who's really good at threat modeling will have the range of all the things to think about. All the different threats that are applicable to this kind of architecture and this kind of system, these kinds of inputs, you know, it's very specialized, that piece of information. And yeah, a lot of us carry it around in our heads, but, you know, there aren't a great number of tools I'm going to get to some tools. There are some tools now, but there weren't for years. So we carry it around in our heads and we look at an architecture, we go, yeah, you got this kind of an input, this kind of an attack. So yes, you know, how exposed is that? And you do this little calculus in your head.
Okay.
Problem here is people know a couple of things. And the same 4 things have been remarkably stable over the last 20-some years. And that's what they think of and nothing else. So that's what the specialist brings is no, we got to think about these other things too.
Yes. Can you list those 4 things that you've—
Yeah, absolutely. It will be coding security.
Yeah.
Or the tools that we use to find coding mistakes, secure coding mistakes. That's one. Number 2, encryption. Usually in transit. Yeah, sometimes at rest, but, but usually in transit, like HTTPS. That is the secure part of, of HTTP.
And, and toward the end of the show, I want to ask you about, uh, quantum computing and encryption.
Yeah, let's, let's come back to that because that's good. And it's coming fast. Yeah, faster than we thought. Uh, but, uh, yeah, uh, let me derail here. Authentication and authorization. These have been remarkably stable over my entire security architecture career since 2001, 2000, straight ahead. And I'm like, wow, some things, some things, or protecting secrets. That's another thing people will think about or do badly. But Yeah, you know, it's funny. Can I just tell all the coders in the world, all of you coders, no, your code will not protect your secrets. I'm sorry. It's really trivial to find them today with tools like Frida. No, don't do it. Just don't do it. So yeah, I've just, just a few months ago, I found another system with a secret to the code. Guys, don't do that.
Looks like it should be best practice by now, but I guess people don't.
Well, it is. It's been best practice. It's the same thing we wrote in those first coding guidelines 25 years ago.
But okay, let's, let's talk about this. Why do people don't do what they know they should do?
Especially, I think they don't know that they should do. I think there's a lot of not understanding, and I think it comes to the numbers of programmers. Okay.
Yeah.
First off, Evan's data estimates there's about 27 to 30 million professional programmers on planet Earth. How many of them work with a, with a solid AppSec team? Like, you know, like at Cisco or whatever? Yeah, I'm going to take a wild guess. And this is based on some back of the napkin thing. So it's, it's got to be no more than 5 million and probably more like 2 or 3 million. Who work at like the Ciscos and the SAPs and the Oracles. And those have very long-running— the Microsofts, they have really—
yeah, I was, I was gonna say about 10, 10%. So 3.5. Yeah.
Yeah, something like that. And it doesn't matter whether the number is 2 million or 5 million, it just doesn't matter. And it doesn't matter whether the number is 25 million or 35 million. There's tens of millions of programmers who are not working within AppSec. So they only know what they've sort of gleaned from the headlines and the this and that. I'm going to assume the goodness of most of those people, because I haven't met a developer in 15 years who looked at me and said, ah, security, that's somebody else's problem. By now we all know it's got to be in the code. But what to do and how to do it, that is unfortunately not so widespread. So I'm just gonna, I'm just gonna opine that there's millions, and I don't care the number, millions, probably tens of millions of programmers here doing the best they can and don't know what to do.
Yes.
And so they make the same bloody mistakes over and over again.
I normally ask this question toward the end, but let me ask you now. If you had the ear of every software developer in America, right, for the next 60 seconds, what would you tell them? To do first thing tomorrow morning?
Go ask an AI, what are the 10 most— because every AI, every public AI, every foundational model can spit this out in seconds and tell you, don't do this, don't do this, do this, do this, do this. You know, they've all been trained with the OWASP materials. They all spit it out. Just ask your friendly AI, what are the things I should pay attention with a 5 things I should pay attention to today in my coding.
Yes. Wow. Amazing. So, man, time is running so fast. I think we only have about 12 minutes left, but let me talk about at least this one book. I think it is really, really critical. This one, Building in Security at Agile Speed. I think this is the book for today. So this book really addresses security in modern development environment. Why did this book have to be? Written?
Well, we'd written it with, with, um, um, um, Anmol Misra, uh, Core Software Security, and we realized it was long in the tooth. We, we were just developing and just putting into play the first agile security, security development lifecycle while we were writing that book. Okay, and my chapter, which is about 30,000 words, Chapter 9 in there, um, uh, you know, tries to explain that, but we needed to update it. And James came to me and said, we gotta update because now we've had all these years of practicum, we know how this stuff works. You did all that research at Intel, you know how other SDLs don't work, you know, let's, let's write the book, let's really write the book. And you know, when James comes to me, I follow him into pits of hell, basically. He comes to me and asks me to do something, I'm like, yes, boss, absolutely, 100%. Yeah, I'll go. So he wrote all that because James, James is, in my opinion, the guru of working in organization for the betterment of cybersecurity. He's just unbelievable. By the way, he was in naval intelligence, so don't hide anything from James because he'll get it out of you anyway. He was an interrogator, not, not the, you know, the old ones who make a relationship and get you to spill your beans. Um, and so James, uh, James is— you don't hide things from James. You got to be worked transparently. That's the thing. So James came to me, he said, yeah, probably too much information about James, but, um, I, I think the world of him. And he—
well, he's definitely invited on the show for sure.
But yes, you should, because James is— and, and he's a raconteur, and he just is so articulate and But, you know, he can work in organizations. So he wrote all the management stuff and I wrote all the technical stuff. And then we read each other's stuff and, and, and, you know, worked it back and forth. Then you go through copy editing. That's how you do a book and stuff. But so it all kind of goes together. But we decided to write everything we knew up to that point into this book and pour it in there. So there are long sections where we take a little bit of core software security. We said, we said this before. But actually, this is what we should have said, and this is how it really works. So there are actually long things, or where we really— Core Software Security got it right, we just plugged it in and said— that's why we could turn the book out in, in like about 15 months, is because we, we did use a lot of Core Software Security because it was right, it's correct. But, you know, we, we, we really wanted to update it, really update it. And bring it into the modern world so that— because there are places where people work waterfall. And we always show our, our security development life cycles or our life cycles as a flat linear progression. And for any piece of code, it is kind of that way. But agile is the way the world works today.
True.
That's just because it's so much better.
Yeah, even, even the military, because we're still using, you know, Waterfall back in 2011. And when I came to Silicon Valley in 2012, it was a shock of my life. You know, these people having 2-week sprint cycle. I'm like, what in the world? Because in Italy, it would take 6 months or a year before we change any of our code. But anyway, it is quite a different mindset. So what are some of the biggest challenges you think organizations face today when trying to integrate security into Agile and DevOps.
You know, unfortunately, it's the same, same things that I've seen for decades. I just worked with a major last year with a major enterprise, huge, about their whole program, their whole product security program. I can't tell you who, of course, but, but nevertheless, they were experiencing some of the same junk we had back at Cisco, where developers are overwhelmed. They don't trust the tools. There's too much, too much control and too little creativity and too much sharing and too little sharing and too much, you got to do it this way. And it's the only way. And, and if you, if you're having a problem, too bad for you. That person was asked to leave who was leading that. I don't care if you have a problem. This is security. That's so old mindset.
Just trust me.
Again, developer-centric. We got to realize that we're working with creative people doing creative work and that it doesn't always go the way to plan. You know, no plan survives first contact. You should be very familiar with that, BZ. And you know, this is watery and it's dynamic and it's plastic. And you've got to work with that sense of unsureness and be ready for it and be willing to enter into it. And so, we revamped their entire product security thing for them. So that they could meet their goals and they could pull in some of the— they had lots of disparate companies. They'd acquired a lot of companies and they were still working the old way that they worked, and they didn't account for that. They had one true method and it wasn't going to work for people as different as writing, you know, firmware versus web, you know, CI/CD, that is continuous integration, continuous development, continuous integration. And where you're updating code constantly. These things are very different in form, and so they weren't really accounting for that. So, you know, the same kind of problem. So they had a lot of friction.
Yes, yes.
Have a huge amount of friction. The moment you have friction between development, engineering, and security, you've lost the battle. It's over.
You're done.
You ought to go home.
For people listening, then, what practical steps can teams take tomorrow to improve, you think?
That's very important. First, go listen. So I'm going to tell a story, and unfortunately I'm known for telling stories because that's good. I like— but I'm gonna tell a story. When I got to McAfee, the past administration— and I'm not going to call these people out by name, you'd have to do your research. No, I never do that. Uh, but they had gone around and told people you have to threat model, and people said, okay, teach us how. And they said no. Only us security architects. It's too sensitive and secret.
What?
So the developers all went, okay, that's security full of nonsense. And they said, you've got to run the static analyzer. And I want you to use, you know, look for everything. So one team had 76,000 findings.
Wow.
In their queue. Guess how many they fixed? Zero, right? I mean, once you get to an overwhelm of 2,000, you're done. You're like, I'm not gonna do anything with this.
I'm done.
I can't deal with this because I have to get features out the door. It was a mess. So what did I do? And this is what, what you can do tomorrow if you're experiencing any of these problems. Go listen to the problems of the developers, get their view, and start incorporating their view. It may be incorrect. Yeah, yeah, don't argue, just listen. That is the thing I do when I take on a new company. Not, not kind of not where I'm doing right now, but if I were to lead a new company, and I did it certainly at McAfee, at Intel, you know, all these different companies I've been at, I go and I really listen to the developers. I really listen to, to the managers, to the directors who have whole groups, and what do they think is important. For one thing, I got to find out who's with me and who's not. Because I got to work around the people who are not.
Yes.
I got to work with the people who are with me and use them at every level. And so I'm going around really listening. This is the most important thing. You got to know what the world is, because you will find people who are passionate about making things better. And that's your army.
That's powerful. That's what it shows, a lot of emotional maturity. Now, one thing when I come to Silicon Valley is like, The IQ, I think, is completely off the chart, but our EQ in this region is extremely low. But I would appreciate you saying listening, which kind of takes me into this leadership domain of security architecture, security in general. You have led very large teams of security architects and mentored many in the profession, and you've definitely made a huge contribution to our industry for sure, making our world a lot better, I think. So what leadership qualities you think are essential for someone who wants to become a great security architect like you, or even just a security leader?
I don't think it's different than any other leadership. You know, when we were talking about this, you said it's at base love. I mean, yeah, that's something to aspire to. But sometimes I work with people I don't love, but I still have to work with them. And so I think it's caring passionately. I'm going to go something a little lower and say I aspire to love. And sometimes I reach that. And I love that about you. But I'm going to go with the more practical caring passionately, but not just about the result. Yes, you have to care about results. But you also have to care about each team member and the team and how the team functions. When I was— I was lucky enough to have great managers, people like Michelle Koblas and, um, and, uh, Nazrin, Nazrin Razai.
Um, uh, you know, I mean, Michelle Koblas was my VP when I was at Trivantis, by the way, one of my—
right. And I love Michelle deeply. She is a very, very close— remember what I said is great I'm grateful for Michelle's friendship.
What a small world.
Fabulous, right? So anyway, not, not to name check my dear friends, but nevertheless, um, they supported me deeply when I said, first we're going to build the team and there will be mistakes. I will try to prevent anything catastrophic from happening. Yes, but there will be mistakes because I'm going to focus on the team. And they said, "Go, Brooke, go. We trust you." Wow. And that, you know, focusing on the team and how it functions and trying to get some work out the door, absolutely, knowing there's going to be mistakes. So, you know, it's a great little story. Vinay Bansal, who is also a dear friend, a co-inventor of Just Good Enough Risk Rating, the original version, Brilliant, gone on to an incredible career. He came onto my team and he was telling Nazreen all the time, "Hey, this Brook guy, he never makes decisions. He doesn't know how to lead." He's, you know, Indian subcontinent, a little more hierarchical in his impression. You know, he complained all the time. He didn't know that I was purposely empowering the team and watching for the thing for the bad things to try and prevent them, but still letting them make mistakes, letting them go so I could build this empowered team.
Yes.
And he said, you know, I now know that I built a team that could move mountains. It's one of the highest compliments I've ever gotten anywhere.
Amazing.
You know, um, and that was the idea. And I looked at him and I said, that was the idea. That was the idea. But you got to take the time. You got to care. You got to care about each person. Are they getting a little of what they want? Because when we work at a job, of course, we do a lot of things we don't want to do. That's why we get paid. But nevertheless, you got to make sure everyone is getting some of what they want, some of what excites them, while working towards their strengths and working around their limitations because people don't change unless they want to change. So the, I think the leader who comes in and says, well, I'm going to give you some feedback. And that doesn't really work. I mean, maybe about one thing that you can really shift about the way you're approaching your writing. You can do that.
That's it. Doesn't scale.
But, but it's got to be really specific. You're not going to change people. You got to work with who they are. But you're building a team with these different strengths and different this crazy quilt of a team made out of individuals is fascinating. And if you don't care about that, so you got to care about it all and passionately, I think. And if you do, the rest will take care of itself. But also, as you said, you got to have some EQ. So there are some dos and don'ts. You never, you always praise in public. You give feedback in private.
Yes. Yes.
And feedback is something you can do, not something you can change. I don't like your energy. If you don't like their energy, fire them and get somebody else because you're never going to get around that.
Yes. Wow. I really appreciate you saying that. Technically, we are out of time. Can you give me 5 more minutes before we land this plane?
Oh, absolutely.
Okay. Thank you. So for the last segment of this podcast, I want to try to get into your head a little bit, kind of see some of the leadership principles you have followed that have made you such a success as you are today. What do you believe is the greatest lesson you have learned in life, in leadership in general? One of the greatest lessons.
I don't need to know it all. I do not need to know it all. I thought I needed to know it all and control all, and I had a horrible experience in my master's. My group just basically lambasted me for getting us an A, ensuring that we got an A. Um, they really didn't like that. Um, and I was a little control freak. And at some point along the way, I decided I'm just gonna be one of the group and see what happens. And suddenly I was a lot more likable, a lot more EQ, and learning, learning to control what I really need control over and letting everything else So I'm sure, you know, as a commander in the Navy that you want your group to come to the decision together, but you hold the responsibility if it's not the right decision or you have to make a decision, you're going to do it. That's the right thing. If I can get a, you know, within a reasonable time, no decision paralysis, right? None of that. You know, sometimes any decision is better than none, but But, you know, and in an emergency, we're not going to sit down and do consensus. No, the doctor rules when they show up and the patient is bleeding on the street.
Yeah.
And that's not a time to sit down and say, well, let's hear from everyone. How are you feeling? No, no, no, no, no. So, you know, you got to, you got to suss these things. But nevertheless, if you can come and if everybody feels like their input is part of things, you build this incredible strength. So me learning to step back and be willing to, to, to not know and to admit I not know has been powerful. The other thing that I did a lot of work around was learning how to listen, really actively listen. And I have practiced a lot because I don't do it easily. I'm a little neurodivergent. And I want to say what I want to say right now, right now in front of you.
Yes.
And so I have to work at it. It's hard for me to really listen and understand.
Well, I can tell you my wife is somebody who taught me how to do that for sure. If I was going to stay married, I needed to learn how to do that. So yeah, I can either be right or I can be happy. I prefer to be happy. So I've learned.
I'm with you.
That's powerful.
Listen and use those listening skills. And if you have trouble listening and you think you're supposed to know it all, go, there's lots of courses that help you work with this stuff. Or maybe you need therapy.
I don't know. There is one I'm reading right now, the 16 Indeniable Laws of Communication by Dr. John C. Maxwell. Great, great, great books. Definitely going to teach you how to communicate.
Oh, interesting. Good plug.
Yeah. But, okay. So let me ask you this. What do you believe is the secret to your success? Because you've done so much work and you've had a lot of, really, I think, very critical contribution to the security industry. And because you've written more than 7 books, I think it's 8 now. And everything you are doing, you've worked at great, great companies? What do you attribute your success to?
Now, I'm going to reveal something that very few people know. When I was about 30-ish, early 30s, I got really involved in activism for a short time. Hated the work, by the way. Love the people. But what I learned, I became a facilitator. And a negotiator and a mediator for many years. And I was kind of known in a small world for that, for those skills. And that facilitation skill has served me incredibly well. I'm a big proponent of Arnold Mindell, who has gone and done things like he'll sit with people who consider each other terrorists. And done mediation sessions with him. He's probably the greatest facilitator on the planet. And I'm really enthralled of a lot of his ideas. I had a very idealistic view of how human groups work. And reading Mindell's books kind of straightened me out. But that combined with facilitation is something that is fundamental to what I'm doing. But I don't ever have to speak about it. And I don't, I don't usually. This is probably the first time publicly I've ever admitted to it is that I've been a trainer and a facilitator and a workshop builder and a mediator for decades, more than I've been in high tech. Just slightly by about 5 or 6 years. And so those are fundamental to what I'm doing all the time, always. And hence, wow, all of the lessons in active listening and, you know, just tons of stuff. How groups come to decisions, you know, facilitating 5,000 people to come to a consensus decision, which I've done, by the way. A long time ago. It teaches you a lot about how groups can work and how decisions can be made and the power of— I mean, there's a lot of social science that proves that a well-functioning team that respects the contributions of a fairly diverse set of people can outperform the smartest guys in the room over and over and over and over and over again. Wow. Over and over and over again. There's a lot of social science from the '90s and early 2000s that backs me up. I think I cite some of it in my books. But it's really important to realize that when you've got a team that's working well, that's, that's it right there. So I bring this facilitation. It's a thing that, that not a lot of people know about me, but which is, is fundamental to my approach is that I believe in people's brilliance. Wow.
Arnold Mendel, I know he's written a lot of books. Is there any books that you recommend?
Yes, Sitting in the Fire. I want to recommend to anybody who's interested in how groups function, Sitting in the Fire, because it's not what we think, or at least not what I thought, and it's not hippie-dippie anarcho beauty. Human groups have dynamics, and some of them are kind of brutal. And so Uh, it's really important to understand that. And the other thing is there's no way that those of us, as we get older and we get some authority— it's called earned authority— you can't give that up. There's no way I can give that up. So what Mindell says is the only way you can serve the group is by being a fool with your earned authority, which means sometimes saying, hey, I wonder if we should do— and other people say Nah, don't do that. That's silly. We're not going to do that. That's okay. If I could give anything away, it would be my ego.
Wow.
It's in my way 90% of the time. And so, you know, one of my tricks, and it really is a manipulation, when things have gone bad, I go in and I say, yeah, it's all my fault. And I do talk about this in Secrets in the culture hacking chapter. I say it's all my fault, clearly. And it's interesting what happens. The high-integrity people will say, oh no, Brooke, we did this and we did that and we contributed this and you contributed this. And then pretty soon you're solutioning with friends and it's beautiful. And you smoke out all the jerks in the room because they say, yeah, it's you. Now you know. Yes, they've just revealed themselves. That's great information. Because now you've got to work around them. Because they're not playing with integrity. And you've smoked out all the really great people that you can count on.
Wow.
It's very powerful. And yes, manipulation, but it works.
You've just really given us a masterclass really in leading. This goes beyond, you know, security security architecture or security application. Wow, thank you. This is, this is definitely worth the price of admission. And everyone, again, I'm going to add this to the podcast digital library. Arnold Mendel, Sitting on Fire.
I love this book, by the way. Wow. I love this book. It taught me so much. And it disabused me of things that I wish were true, but are not true. And, you know, I mean, I have a very humanistic kind of approach to the world and to human beings. And I wish we were all lovely and empowered. And, and, you know, um, Karl Marx had a beautiful, beautiful, very incorrect utopia in mind, but that's not how people work. I'm sorry, I'm not a socialist and I am not a communist and I never will be. No, no, no, no, no. Because beautiful as the idea of a perfect worker state is, it's just Nonsense.
Not possible. Yeah. And wow, you know, but it's, uh, so what, what kind of things are you learning these days? I know leaders are learners. What are you learning now?
Oh my gosh, it's always, first off, it's always a plum of ourselves because I'm always surprised at another corner that I never saw before internally that I go, oh yeah, Oh yeah, that's something I'm gonna have to work with. Yeah. So it's always an internal journey, always. And I'm really grateful.
But just being aware of that, though, the awareness, that's pretty stunning, because most people are not even aware that they need to work on specific things within the character of their, their lives.
Yeah, well, you do. I mean, none of us is perfect, right? It's just like I said, egos. In the way. I mean, ego that I'm empowered and I'm a world-renowned security architect. I know that. Yes, you can't take that away from me. And it's, it's not really, you know, does that— my spouse likes to say, character and gifting are two separate things. Hmm. So you got to work on your character, your gifting, and where you're good and, you know, your success. You get that through hard work, yes, and diligence and study. But that's not necessarily being a good human being, which I aspire to be. I didn't say I am. Ask my wife.
That's really powerful.
But working on yourself. But what am I learning? I'm learning more about how to go into— this is really because I'm doing consulting now. I'm learning about how to parachute in as a vCISO and how much influence. You know, I'm used to like building this huge amount of influence where at Intel I can go and criticize the SDL and say, we got to do this differently. And people listen to me. You know, that's, that's a really different kind of influence than when you come into— and you do this, um, Bob, uh, so you know, um, you go into these companies, they're not going to trust you at all until you show some value, and you've got to continue to show value, and then over time, and you got to work around people's stuff and everything, and it's really complicated. And, um, being a VC, so You know, how much influence do I have? Well, I can suggest, but I'm actually not a business decision maker. So, I give you a strategy. I say, these are your major risks from my perspective as I understand the business. But am I making the decisions on which things to— no, they're going to tell me, this is what we're investing in. Go do this. Make sure the team is doing this. And you know, it's a really tricky I would say, I wouldn't say I'm struggling all the time. No, no, I can do this. But sometimes I got to really sit back. Yeah, that's a real growing edge for me. Yeah, you asked that question. That's a growing edge.
Yes. Wow. Okay. Because we are out of time, I'm not going to ask this, but I wanted to know, let me just ask you this as we get to a close. If you had one and only one day to live, what would you have liked your final contribution to be?
I would, with only one day, I want to go skiing and fly fish in that day because those are two passions of mine, and I want to play a little guitar. But I want to tell the people I love that I love them. And, and, you know, think about it. The people on Flight— was it 11? United 11 going down in Pennsylvania.
Yeah.
The messages they came off out of there were not ones of let's go attack, um, Arab states or these bad guys doing these terrible things. They were messages of love and I really, really love you, knowing they were going down. Um, if you have one day— if I have one day to live, let me put it for me, I'm going to tell the people I love just how much I care for them. And so I do try on occasion when I remember, because I am full of myself, to remind my wonderful circle of friends how much I appreciate them, and my spouse and my daughter and her family and my stepdaughters and their families. You know, this is really important. My, my brother-in-law is the treasure of a human being, and I value him greatly. You know, the people that really matter, it's powerful. Tell them you love them because who knows, you know, some fool drinking or taking too much meth— which, I live in Montana, that we have a lot of drunk drivers and meth addicts, um, too many, um, on the roads. They could just cross over and run into me at 70 miles an hour and that's it. Life is fragile.
Wow, thank you so much for sharing that. I appreciate that. Now, being a musician, is there a song that would be your life's theme or anthem?
Yeah, it's a song I wrote with my friend Bernie Gilbert, who is probably the most brilliant lyricist I know.
Did you publish it?
Yes. Oh, it's published and it's on a couple of my albums.
Wow.
It's on a couple of— oh, I got lots of stuff out there. But, uh, Brooke and Magic Brooke, um, no, I shouldn't reveal that. I try to keep these lives separate. But nevertheless, um, it's called The Great Blues Sea, and it's how music— really, it's about the blues, but music in general, um, it can move us, it can, it can heal us. Like water, like the sea, like, like the waters. And how, how many religions have used water as a metaphor for healing and, and passage and movement? Um, uh, not selling any religions here. Whatever your religion is, please practice it for good and peace.
Um, and, uh, that's quite meaningful. Wow.
And, and, but, but I love that song. And it's one of my songs that I never forget and can just pull out at any old time. And that I had to learn to sing because, trust me, I was really afraid of learning to sing. And I spent a lot of years learning to at least hold an audience. I may not be the greatest singer in the world. In fact, I'm not by a long stretch of imagination. But I can, I can hold an audience with this song. I was at a party That's amazing. And they said, well, you play guitar, you go to the mic and sing. And so I belted out this song, and you could just tell people, they went from, oh, this is a professional—
wow—
because I am. And, uh, it was just a really interesting reaction. I had arrived at a certain level of accomplishment. It was clear, um, because I—
man, that's amazing.
And, and I love that song, The Great Blue Sea. It's on my first solo blues album, The Great Blues Sea, um, and I also did a live version on, um, um, Love Like a Stream.
And, and as an artist, you just go by Brook, right?
I went by Brook, um, that was too hard, so I selected Magic Brook because I owned it on the web. And, uh, my, my last album, um my last album.
That's amazing.
Uh, did very well. It actually beat Lorena McKinnon out in January of 2009.
Get out of here, seriously.
Wow. Yeah, I love her work, by the way. I, I'm a big fan, but I'm also a big fan of Nueva York.
That's amazing.
Um, salsa, which you had playing at the beginning of this. Yeah, huge fan. Um, so I love that music, but, but I love her, her work, and, uh, I beat her out by a few points, um, with my solo. But I, I was working at Cisco with with a— as a single parent, there's no way I was going to tour on top of it. So, um, it just kind of went and went.
Just to make sure, this is you right here?
Yeah, that's me.
Get out of here!
By the way, that's my painting of, of a beach in California as well.
My goodness. Okay, everybody's going to be listening to this song right after the show. This is incredible. I could— you should have said— I want to ask you something about you that most people don't know. You are a published artist and you actually played with the one and only, the legendary, what's his name?
Chuck Berry and Bo Diddley. I actually played with Chuck Berry in one of his bands.
Get out of here, man.
And I worked for Bo Diddley for a good year and some.
You are so humble.
And the difference in these two human beings couldn't be more different, by the way. Wow. So guys, you guys— Bo Diddley, I'm just going to say, is one of the most wonderful human beings I've ever had the pleasure of meeting.
That's amazing. So for the first time in the world, people know about that, about you on this show right here.
Yeah, and I've been working as a jazz musician for decades.
But this is like a world exclusive announcement. Wow. Okay, everybody's gonna listen to this by the end of the show, The Great Blues Sea by Brook, or Magic Brook like he likes to be called. That's amazing. Okay, I think we have enough. We can end the show right now. But before we end, I do want to know What can my audience do to give value back to you? You've given so much to us. Really appreciate that.
Well, don't worry about buying my books. I think I get $2.50 apiece. That's not how you get rich writing tech books, by the way. But, you know, if my books, if you find them useful, please, you know, give back to you. Of course, my company, Reslient, if you're looking to solve software security with a tool. Our tool will take care of a great deal for you. It is AI-driven, that's the idea, and, and we do support it with deep technical expertise and, and professional services. So it's kind of a whole package together. You can hire me as a VSO. I love to teach threat modeling. It is one of the most fun things I can do. So happy to do that for you. And, you know, I'll give a pitch for our company, Reslient. I think we're doing some really interesting things and trying to do. And I'm working with some of the— just the founders is such an incredible team. I'll give them a shout out. Damilare Fagbemi, our CEO, a real visionary and also an author of the IoT book. And Michael Green, who was a VP at Intel, is just a treasure of a human being. He's our director, our Chief Product Officer. And so I'm really lucky to be working with them. And so, you know, yeah, I'll give you a shout-out. If you want leadership coaching, I can't compete with this guy. But I do compete with this guy. And it would be fun to do some work together sometime.
Yes. Wow. Thank you. Thanks so much for your time today. This is quite amazing because I know I've already used too much of your time. So to end, I'm just gonna ask, uh, what is— oh, before I ask that one, if you did have a magic wand and you could solve any problem in the world, any problem whatsoever, what is the one problem you'd like to solve first thing tomorrow morning?
Well, the only one that I have— well, of course it'd be nice to cure cancer and, uh, and feed everyone and end all the global wars. I don't have those powers. I have opinions, but I do not have much influence there. But where I do have some influence and have dedicated the last half of my life, or more than a half of my life at this point, is we got to do better with the software we're producing. We're producing huge piles. And now the cost of, as we said at the beginning, cost of producing software has collapsed because you can just tell your friendly sort of free AI to write me an app and, you know, it'll be as secure as the AI thinks it, and you tell it to secure it, which most people aren't going to. So I think if I could wave a magic wand, I would say let's get some readily accessible, perhaps free, very modest AIs that can help the AIs do it securely. Can we get that done? Because we're, we're, we're in a tsunami of unsecured code. It's written as secure as the AI can think of it. It can inference and probabilistic yet, which is really what's not thinking. It's a little bit different than that. But Powerful. I would encourage, if I could wave my magic wand, I'd say, OK, Google, OpenAI, Anthropic, Perplexity, please make sure that you've got something there to help secure the code you're generating as best as an AI can do it, because that would be an improvement. A little would be a lot.
Yes.
There's my magic wand.
Absolutely. Thank you. Thank you so much. Now, before we end, is there a question I should have asked you I didn't get a chance to ask? Anything else you wanted to share today?
Oh God, no. I've spoken so much.
Yeah. I think we've gone over by over 20 minutes. Sorry for that, but I really appreciate everything you've shared with us. So if you could go back, give a piece of advice to your 17-year-old self standing at the edge of this incredible, incredible career you have had, And I didn't know you were such a great musician as well, but definitely as a cybersecurity architect, what would you say to your 17-year-old self?
Really, you're good enough. You know, I'm sorry to say our culture is really good at creating low self-esteem, and I really suffered from it badly. And I would say you're good enough. You don't have to prove anything. Settle down. And focus. And the other thing is, when I graduated, which I graduated at 17, because in the old days— I'm old— in the old days, things just put you ahead of grade, and then you, you were younger. And, uh, from high school, and, and they now, they have gifted programs, and it's different. But in those days, no such thing. They just pushed you ahead. And so you were the weak young one in amongst all the other kids. But I graduated 17, but they had you talk to a career guidance counselor. And he said, you know, I'm looking at all your stuff. He was the most bored human being I've ever seen in a job where he was really done. But he looked at me and he said, engineering. And I was not having any of it.
Wow.
I had just listened to him. Look where I wound up. An engineer.
I love it. Exactly. Exactly.
Right.
Wow. That is really amazing. And by the way, the reason why I asked 17 is because I graduated high school at 17. I started college in the US at 17 years old. So that's when I came to this country, I was speaking English and I had those big ideas and big dreams, but I didn't know how to go from A to Z. So that's why I want to go back there and say, hmm, knowing what I know now, what would I say to this young man? What should you know at this age? So that's why I ask all of my guests that. Thank you. Thank you so much for sharing. This is really powerful. Okay. Now the last question is, I like to end on a positive, very positive note. So what is something you are feeling optimistic about in 2026 right now?
The shift in my industry. It's no longer, it's no longer, what's this threat modeling stuff? What is this? No longer. Yeah, it's part of the zeitgeist. That we're not doing it is a different problem. And And we can work on that. But that shift, I'm really optimistic that, that people, the industry has got it. Yeah, it's got it, that we've got to think about how we design stuff from the beginning. And we do that through threat modeling. This is a big change. Because back in the day, we didn't even know we were threat modeling.
Yes, yes, yes. Well, yeah, I feel very optimistic about that and hopefully we're going to get less and less breaches going forward. All right. Thank you so much for your time and you've been so generous and your wisdom. Really appreciate that book. This is definitely one of the most insightful shows I've done in quite a while. So to end, what is one word that represents our shared experience on this podcast today? One word that comes to mind.
Joy.
Joy. Well, I am so grateful. Thanks again, Brooke. Really, really appreciate that. Wow, outstanding. All right, you've got it, everyone. This was really a masterclass, not just in cybersecurity, but I believe in life and leadership as well. Man, I'm so grateful to Brooke on taking the time to come and talk to all of us today. Security architecture pioneer, threat modeling expert, and best selling offer. I know he says, no, you don't have to buy his book, but especially this one, if you are in security, I think you definitely need to read it. Building in Security at Agile Speed. That's really the name of the game in Silicon Valley for sure. It's really security at the speed of thought, really. All right, so really grateful for that. I want to remind everyone, so for this week, our friend in the spotlight is Vice Admiral Joanna Noonan, United States Maritime Service. She's also a senior executive service member at the US Department of Transportation. And I think tomorrow I don't have any interview, Monday, so I'm going to continue. We're going to study the Book of Proverbs chapter 18 this time. And I'm using artificial intelligence. This is not a religious podcast. It's just about the ancient wisdom and the leadership lesson from the Book of Proverbs written more than 2,000 years ago. But I think it still has lessons, leadership lessons that are very much applicable today. And let me see. Okay, I'm going to end with, so as you guys know, the entire month of February, we celebrated Black History Month here, but now we are celebrating Black History Year. I felt like a month is just not long enough. So part of that, I kind of have two vignettes. So let me share my screen. Again, one thing I just learned last night, and I want everybody to know because I think the history needs to be corrected. I just found out that the very first African-American Black officer is not the Golden 13 like I was led to believe. Definitely not. We're not going to take anything away from them. 1943, they were the first 13. Black officers in the Navy, but the reality is Lieutenant William Lloyd Garrison Payne was actually the very, very first African American officer. This is a picture of him right here. I guess he did pass for white, but he definitely was African American. And not only that, not only was he the very first African American officer in the US Navy, which is my branch of service, but he also was the very first one to earn the Navy Cross, right? So that was then CS3 Doris Miller during Pearl Harbor. And also he was the very first one to actually be a captain of a warship vessel, right? And it was then my adopted mentor, Admiral Samuel L. Gravely. Again, props to them. We're not gonna take anything away from them, but The reality is Lieutenant William Lloyd Garrison was the first African American to do all of that. So anyway, you can read more about his life on my LinkedIn page. It's just amazing. The more you study history and the things you learn. And then another thing I like to do to celebrate now Black History Year, but also Women's History Month is something that happened on this date on March 8th, 1945, Phyllis Mae Daly was the very first African American to integrate the US Navy Nurse Corps because Blacks weren't allowed to be nurses in the Navy prior to that. And after her, a lot of other people joined. And I think I have a picture of her right here. She was the very first African American to join the Navy Corps. Corps as a nurse. So in ending the show, I'm going to play a short video. It's about 2 minutes, just about the Nurse Corps in the US military, and that's going to be the end of it. Thank you so much for watching.
They told Black women that they weren't needed in the battlefield, that they weren't needed in the hospitals, they weren't needed in uniform. But you know what always gets needed real quick? A Black woman's labor. Especially when America's at war. During World War II, the Army Nurse Corps made their racism real clear. Only 56 Black nurses were allowed to serve in it at first. Not because they weren't qualified, but because they were Black. Thousands of trained Black nurses applied, and these were all incredibly qualified women with skill, discipline, and degrees. But the Army had a quota, and white nurses didn't want to work beside them, let alone take orders from them. So the doors stayed closed. They didn't even want Black nurses treating white wounded soldiers. But guess who they did assign them to? The German prisoners of war. That's right, a Nazi can get better care than a Black GI. That's how deep the anti-Blackness ran, even on the front lines. And these women didn't just serve, they carved a path that wasn't supposed to exist. Della H. Rainey was the first Black nurse commissioned in the Army Nurse Corps. But she didn't stop there. She became the first Black nurse promoted to captain in the Army Air Forces. Mary L. Petty led the first group of Black nurses to Europe. She became the first Black woman to reach the rank of captain in the ANC. Margaret E. Bailey broke through again in Korea and Vietnam, eventually becoming the first Black woman promoted to colonel in the Army Nurse Corps. They were forced into segregated wards, made to treat prisoners before their own people. Denied promotions that they'd earned 10 times over. But they stayed, they documented, they built each other up. Because even when the system tried to make them invisible, they knew they were making history. By the end of World War II, fewer than 500 Black women had served in the Army Nurse Corps. That's less than 1% of the total. But their presence cracked open a structure that was designed to hold the line on white dominance. They were the first to desegregate parts of the US military. Long before Truman signed Executive Order 9981, they were the first to demand that life-saving skill matters more than skin color. And they were the first to teach white America, again, that without Black women, this country does not function. So you want to talk about service? Talk about them. You want to talk about patriotism? Talk about the Black nurses who were told no and still showed up. They didn't just heal bodies. They cracked open barriers with a stethoscope and a backbone. And they proved, like we always do, that just because you weren't invited to the war doesn't mean that you didn't win something in it. Thank you for tuning in to the Leadership and Success Podcast with your host, Coach Beezy. If today's episode added value to your leadership journey, Be sure to subscribe, share, and join us again for more wisdom nuggets on how to lead better and achieve greater success. Remember, leadership is the most critical skill of our time. The world will always need leaders to inspire others, drive innovation, and execute meaningful strategy. So why not count yourself among the bold leaders shaping the 21st century? Until next time, stay inspired, stay committed, and keep leading with excellence.
More from Bob
S250:E4🎙️LIVE 🇺🇸America 250: President Barack Obama Leadership, Service, and the Power of Hope
S250:E4🎙️LIVE 🇺🇸America 250: President Barack Obama (Multi Tracks Audio)
S5:E157🎙️ LIVE with CMD CMSgt Dennis L. Fritz, USAF (Ret.)(Multi Tracks Audio)
S5:E156🎙️ LIVE 🇪🇸 Leadership Lessons from the FIFA World Cup 2026 Champions (Multi Tracks Audio)
S250:E3🎙️ LIVE Leadership Lessons from America’s First Documented Family of African Descent 🇺🇸📖