Leading Cyber Change: Allan Friedman on the Revolution of SBOM & Future Cybersecurity Initiatives

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda loop.com.

Alan Friedman is a senior strategist at CISA, the cybersecurity and infrastructure security agency, where he coordinates all of their cross sector activities with SBoM. On SBoM, the software bill of materials, Alan is widely known as a change agent. Not only did he help shepherd SBOM into reality, but he had done similar things at NTIA in the world of vulnerability disclosure and vulnerability management, and also in improving the security of Internet of things devices and the ability to keep these devices patched in the field. So Alan is a real change agent. And of course we talk about SBOM and what it is, what executives need to know about it, but perhaps more important, we get insights into how Alan thinks and how he has made changes in big organizations in and out of government. Enjoy. Alan Friedman, welcome to the oodacast.

Well, thanks so much for having me, Bob.

Alan wanted to get you on the oodacast for so long because you're such an icon in the community and I really appreciate you being here.

No fun to chat. I'm glad we could schedule this.

Yeah. So for those who don't know you, can you give us a bit of your foundational story and how you got involved in all things cyber and SBoM?

Sure. So I, I often describe myself as a failed professor, so undergraduate in computer science and from Swarthmore College, which was a, it's a small liberal arts school. I was really interested in cryptography at the time, sort of was a, a wannabe cypher punk in the the late 90s and realized I wasn't really good enough at coding to do it professionally and I wasn't really good at enough at math to prove things professionally. But one of the nice things about going to liberal arts college is it also meant I got exposed to write the classic liberal arts education and can, you know, drop a little philosophy or French literature as needed. Cool.

So that was undergraduate and then you went on to get your doctorate degree. Yeah.

So having realized that I was not going to be a professional software engineer or a professional mathematician, looked around and said, you know, again, this was at the tail end of the crypto wars in the 90s and said, you know, let's actually dive a little more into the public policy. This was when Larry Lessig had come out with his mantra that code is law. Let's try to actually explore that. So I ended up getting my PhD in Public Policy and half my committee was in computer science and half my committee was in Sort of either policy or business. And so one, it was a lot of fun. First part of my research career was just telling every engineer thing that every economist knew, and every economist things that every engineer knew, which, you know, I, I called disciplinary arbitrage. But of course, for your defense, they're in the same room, so you actually have to show that you've done novel work. And. And it was a lot of fun. I postdoc in computer science and realized. No. Right the first time, still not a computer scientist. And by then I was a mediocre cryptographer, I was a mediocre economist, I was a mediocre modeler. And my, my punchline is, when you're mediocre at that many things, you sort of end up in Washington, D.C. you.

Know, you're saying that with a big smile on your face, and it makes me chuckle because I know I've never seen you be mediocre at anything, and you're phenomenal at leadership and management, which I want to get into in a little bit. But back to your journey in Washington, D.C. what was your first position there?

So I joined the Brookings Institution, which is sort of one of the old guard OG think tanks here in D.C. as sort of their first cybersecurity expert. It was a lot of fun, right? I was pretty young at the time. I was 30. And, you know, being on all these Inside the Beltway panels and trying to both do novel research, but also popularize and understanding that security isn't just about technology, it's about organizations, it's about processes, it's about incentives and actually make some progress on that. And after a few years of doing that, one of my early mentors, a guy named Ari Schwartz, who was at the White House at the time, said, hey, instead of just writing about cybersecurity policy, do you want to try to make it? And so I spent five years and realized that I was not going to be the world's greatest writer of academic research papers. And so given the chance, the initial, my initial thing was, you know, in D.C. you often rotate in and out of the government. So I thought, you know, two years, get. Get your ticket punched and come out. And much to my surprise, I. I enjoyed working in the government and found that I was not terrible at it.

Cool. And that was in Department of Commerce.

That was in the Department of Commerce at a tiny little agency called the National Telecommunications and Information Administration. So they were sort of the. The fcc, which does lots of telecom and Internet policy, is an independent commission. The president can't tell them what to do. The NTIA sits inside the administration. And so we, you know, reported up through the Secretary of Commerce to the White House. And the remit was to sort of take advantage of what was very popular at the time, around 2014, 2015, which was the multi stakeholder model. This was what the United States was advancing for broader questions of Internet governance. Which is to say, rather than having a bunch of countries vote on everything, let's actually pull in the broader community, get perspectives from different parts of the technical ecosystem, different parts of the nonprofit and advocacy community, and try to find common ground. And so they asked me to come in to think about how that could apply to cybersecurity. So how can we, without creating new regulations or new laws, actually make some progress in improving cyber security? And I sort of used the framing of a market failure. Right. We all talk about a market failure in security. What can we actually do to make that market function a little better?

Yeah, and I'm glad you did, Alan, because I think if someone would have posed that challenge to me in that way, I would have said, oh, you can't do that, so don't even try. But observing you from the outside, you not only tried, but you really made a big difference in several areas. I want to talk about SBoM, of course, but prior to SBoM, what were you involved in?

So the, the first two efforts we looked at were vulnerability disclosure and IoT patching. And these were again at the time, the hot topics. And I think it's easy to forget in 2023 how recently vulnerability disclosure was a very fraught, controversial topic. And one of the things that we tried to do at NTIA was to say, let's, let's have this conversation yet again, but let's do it in a little more structured space and bring together both sides. And it was the first time that that conversation had happened sponsored by a government agency of any government. And one of the nice things about having an American flag behind you is lots of the big companies that have a presence in Washington, D.C. they sort of have to pay attention, right? They want to make sure that nothing's going to, you know, get into their rice bowl. And so the large corporations showed up. And once those were there, I could go out to my friends in the security research community. I'd been sort of going to hacker conferences for a little while now and saying, hey, these companies are coming, so we need you there as well. And putting them in the same room and using their I statements actually, I think helped us envision what collaboration might look like. And the short story I tell about this is some folks from the hacker community stood up and said, I don't know, this is a government process. And Alan's wearing a suit jacket and he's friends with all these lobbyists, so I don't really trust you. And the companies stood up and said, I don't know. Alan's got longish hair and seems to be friends with all these hackers. We're not sure we trust you. And they looked across the room and said, we're not so different, you and I. We both hate treatment. And that's only a slight exaggeration. It was once they both realized how vulnerable they were, that they could actually not have complete agreement, but at least find common ground. That's good. And we had some real leaders who helped set the stage. Notably, Dan Kaminsky gave our introductory talk that really pushed, I think, the whole community to understand the importance of disclosure on both sides and made everyone realize that the stakes were high to find a good solution.

Alan, this is the first I've heard of the Dan Kaminsky connection here, and there's so many wonderful things about this man that we all lost far too early, far too soon. And I had no idea he was participating in your efforts like this and played that role.

No, it was very helpful. And he also was very good at bringing other people to the table of saying, hey, here's another experienced hacker. Here's some of the people who were involved in the early stages of this discussion. And so again, not just leading by example, but also bringing his, his expertise and his network to the table. Awesome. He's missed.

Yeah, very much missed. So after vulnerability disclosure and vulnerability work.

We did some fun work on IoT patching. And again, a lot of this vision is to say, let's not solve the entire world. Use this tool of bringing communities together to, to focus on as much focus on discrete things. And so at the time, people were, policymakers were beginning to have conversations around, oh, IOT security. We've got the, you know, the right. The S in IoT stands for Security was. It was the common line. And rather than try to solve everything, let's look at one issue that we know needs to be addressed, which is field upgradeability out there in the world. There will be risks. Let's talk about how to update it. And so we did some work that, you know, didn't solve the problem, but it sort of laid out how do you ask for field upgradeability? Like what? Some simple language to describe it. And then also Doing a technical dive. When we say something is patchable, what does that mean? And sort of having a cross sector, cross tech way of describing the various steps. And both of those in turn were sort of used by other regulators, other industry guides and things like that. Right. And then we looked around for what the next topic was going to be at NTIA and it seemed time to tackle the idea of SBoM.

So how did that idea come about? And can, can you give us some insight into that?

Sure. So first, always like, very good, very much not. My idea had been around for a while, championed by people like Josh Corman in the security world, by Jeff Williams at oas. And so it had been around for a while. And in fact, the thing that I find really fascinating is a lot of our modern software security practices from DevSecOps, we kind of stole from heavy industry, from classic industry, going all the way back to the Toyota revolution and Deming and then through the quality revolution in the 80s. And then, you know, the, the DevOps community looked around and said, oh yeah, we can, we can use a lot of that in the software world. So the idea had been around for a while and people were starting to implement it. But again, one of our concerns was to say this. Any solution we have needs to scale for all of software. We can't just have a healthcare solution because there was some great work that was starting to percolate through the fda. We can't have one solution just for modern applications because there was some great work happening in the owasp. We, we can't have one solution for the licensing side of transparency because there was great work that had been going on for a while at the Linux Foundation. We need to sort of pull folks together and define the basics. And so, you know, at our first meeting, we sort of had a public meeting in Washington D.C. saying, We're going to talk about this. I didn't use the term SBOM when we first started talking about it because it was radioactive. In Washington D.C. a congressman, former Congressman Mike Royce, had proposed the idea that everything the DoD buys should have a software bill of materials. And industry was not wild about it, to say it mildly. And the lobbyists lined up to one could say nuke it from orbit, but at very least make sure it didn't go anywhere. And I even had mentors that I trusted saying, hey, don't pick up this issue, it's too radioactive in Washington. One of the nice things about knowing that you can get another job if you want to, which many of us in security do It's a luxury, but it also means that we can be a little bolder and experiment. So I said, let's talk about it. So we first started talking about software transparency and then over time we started using the term SBOM again. And the initial vision was just saying, hey, how do we make sure that when we talk about this concept we're all talking about the same thing and then move on to why do we want it, what are the use cases and how do we implement it at a very basic level. And a lot of the work has been just sort of building that community and trying to get as many people excited about the potential as possible.

Well, Alan, now that you mentioned it, I guess I have to admit when I first heard that you guys were doing this, my reaction, maybe it's very human, was not again, you know, what do these guys think they're doing? But I tell you, I came around over time, of course, and still at the foundational stages of this though, I can, I can tell that early progress must have been very important to you and seeing the community run towards this must have like given you wings.

You know, we, it was always a mixed bag. There have been people even quite recently who have said, oh, it's not ready yet, or we can't, we can't make any progress on this until we've got formal standards and things like that. And the irony is there are even companies who, while on one hand they're funding lobby groups, just say, oh, this is impossible. Or at very least now let's slow down, let's, let's not move too quickly, right, which is a sign of progress, rather than saying, we can't do this, to saying, well, we can do this later. But meanwhile, the same companies, their product security teams are saying, have an S bond, we're ready to post them. So I think there is, there's a lot of progress that's been made on just helping people adapt to the idea that this is important.

Yeah, great, cool. It does remind me of so many initiatives I've seen throughout my life in so many rooms where I've seen computer scientists especially just kind of fold their arms like this. And yeah, we tried this before, this will never work. Here's the 12 reasons why it never worked. And obviously you have innovated and pushed through and created something of value here.

And so, and, and by the way, it's not just the technical side, there's also a lot of market obstacles. Right. If you're trying to address something in a two sided marketplace, right, the people who make software and then sort of the consumers of software, the buyers of software. Then you need to sort of address both sides. And the good news is once you've actually made some progress, there will be that self sustaining feedback loop. But it's particularly hard to get both sides of the market to understand the value.

Right, Cool. Can you tell me about, let's see, the transition to cisa.

I was really excited to come to cisa. As your listeners and viewers probably know, we are the Cyber Security and Infrastructure Security Agency. We are America's line of cyber defense. And we do a bunch of work, everything from operational work to, and helping organizations sort of understand real time threats to sort of these, these larger projects. And I, I loved NTIA. My little team there had a bunch of PhDs and experts. We were almost like a little mini think tank. But for this topic I think it is, you can think of it as a startup getting acquired. So it made sense to be at a small agency to get started. And then once we sort of had taken off a little bit, then going to a large organization, more resources and the ability to tie SBOM into a broader cybersecurity agenda made sense. And it's a great team. I'm not someone who spends a lot of time sort of talking about how amazing political appointees are, but it is really, it's nice to see great leadership and accessible leadership and also leadership that's willing to sort of reach down and say, hey, I want to hear about this particular issue. And so I, you know, I really enjoy working here. Cool.

Well, Alan, I'm very public about the fact that I'm a huge fan of CISA and I see the incredible and unique role that that organization plays for the community. And I'm definitely a member of the fan club.

Well, thank you.

But I want to keep talking now about SBoM, if that's okay. So you, you bring SBoM to CISA, you have this big mission. And one observation from me going into the pandemic, the RSA conference, right as the pandemic was starting, S bam was being talked about there by just so many people. And so that was an indicator that there was traction starting. Then we all hunker down in this for the pandemic come out of it. The next rsa, which was about a year and a half ago, it was like the RSA theme was S bomb. Not officially, but every single person I was talking to was talking about SBoM. And then the most recent one here, February of 2023, no, April 2023. It was definitely on everybody's lips. It was the dominant conversation of that entire conference. To me, that was a signal that the community is now moving out on this. Meaning you've done a really good job of getting people to accept that there's a positive function for the S bomb and there is a market for buyers and sellers. So that was my observation.

You know, I will say and I love having that outside perspective, so thank you for that. In April of 2023 there are two observations I had. One, it was, you know, patting myself on the back a little bit with a reverse compliment. This was the first year that RSA didn't accept any of my talks in about 10 years and RS I took that as good news because it meant that there were enough other talks and enough other messengers around sbom they didn't need me. And that again, that's a success point. And the second piece was, you know, in, in RSAs of the past, I've made the rounds of all the receptions and the expo floors and the, the private meetings. Have you heard about Sbong? Let me tell you about Sbong. Hey, is this idea of S fund didn't have to do that in 2023 even for folks that weren't in the appsec world, that weren't in the supply chain world. Right, because supply chain is on everyone's radar. But even folks that weren't of that world at least knew about it. And I think that is sort of one of those core pieces of saying this is now, this is now going to be part of our world. We still have some work to do, but it's an accepted part of our security toolkit. The way that threat intelligence or other things just even if everyone doesn't use them, they know what they are good.

And this is probably a good time now for me to ask you to the non technical business executive CEO of a corporation who has never heard of SBoM. How do I explain that to this person in a way that lets them understand what this is?

So I'll give you a two sentence and a two minute explanation or the one sentence explanation really is why on earth would I buy from someone who couldn't tell me what they were selling me? Right. Even if you don't have the metadata yourself, we need to know that the people who are making our software know what's in their products slightly longer example. And, and you probably have heard me use this example before. I, I took it, I took the particular story from a woman named Audra Hatch because we like to talk about Twinkies So I keep a packet of Twinkies on my desk and if you're just listening, I'm, I'm holding this up to the camera now and on the back you can see there's a list of ingredients. So the first question is, why would we expect more transparency from a non biodegradable snack than we would of the software that runs our government systems, our national security systems, our critical infrastructure? Right. Transparency is part of that. But to pull the metaphor out a little bit, that list of ingredients is not magical, it's just a data layer. That list of ingredients by itself won't protect you from your family eating something they're allergic to, especially serious allergy. It won't keep me on my now rapidly faded into memory 2023 diet. It won't by itself keep me on a religious diet or a plant based diet or whatever it is that's important to your own personal values and risks. But you cannot do any of those things without the list of ingredients. And so that helps you understand the role of SBOM in our ecosystem, which is it's a data layer on which we are going to build the tools and the practices that allow us to understand our own unique risks. Some people just care about vulnerabilities, some people just care about country of origin or national security risks. Some people are worried about open source risk and sustainability. SBOM is useful to map from the software I have to the types of risks that I'm worried about. Got it.

That's a good explanation and clear, I think, for the non technical executive as well as the technical folks who maybe are not exposed to it.

Right.

Let me shift a little bit and ask you a few other questions about this whole journey that you have described because again, as an outside observer, you've been in a position to help the government understand need for change and help industry and academia move towards collective visions on things like vulnerability, disclosure, IOT security and patching and SBoM. Frankly, you've been a good leader and a good manager and you have been a change agent in places that are not known for change. And I wanted to ask if you have lessons for others in this regard. How does a person make change in government the way you have?

Thank you for the compliments, it's very nice of you. And I don't have any magic sauce. And in fact, most recently at the conferences in Vegas, I've had this realization which is sort of embarrassing that it happened so late, which is part of it is I, I'm, I realized I'm in marketing I never thought of myself as in marketing and as you know, in infosec marketing kind of has a bad reputation. But a lot of it is just being willing to go out there and just talk to anyone and everyone and say, here's a problem, here's a potential solution and here's a low cost way of getting your feet wet and exploring this idea. The second, I think, and kind of a truism right, is it's really all about the community. We're very happy that, that CISA can be this facilitator, this nexus, but we don't make it about cisa. We make this about the broader ecosystem. One of the things we're doing is we're working with our partner countries around the world to make sure they know this isn't an American issue. And we're trying, in fact, this is in the National Cybersecurity Strategy Implementation Plan of we've committed to building an international council of technical experts from governments around the world so that we, we have their perspectives and everyone's sharing each other. So this idea of the community comes first and then also having, dare I say, a sense of humor about it. There are lots of programs, whether government or company run, that are sort of seeped in consultant speak and you need the note takers and you need the frameworks for this. But we try to make it fun. So for example, our meetings where we try to bring the whole community together to update on progress, we call them the S Bomberamas. And I love that CISA has sort of given us that freedom to be a little playful and to show that we don't take ourselves too seriously even as we're doing this important work. And then the last piece I think is one of the benefits, and touched on this a little earlier, where having the personal freedom to take some risks and having support, support from leadership to take some risks allows you to sort of not just pick the obvious topic that's going to produce some pretty obvious guidance that everyone's going to nod and smile but won't really move the needle to saying let's try to be a little bold and ambitious and if it doesn't work out, it's okay, but at least we can try to pull this community together and doing our homework. And so you can tell I'm sort of picking this up as we go, having people who can be connectors across a network. You know, I've, I've had the luck of being in the cybersecurity space for, oh gosh, 20 years now and, but I've been in many different corners, Right. I've been in the telecom world world, I've been in the academic world, I've been in the encryption world. And so knowing all these communities and knowing who to talk to. Right. So, hey, and you know, saying, gosh, I need someone who knows about the suppliers for the energy world. Well, I'm going to talk to Bob because. Right. He knows that world and can connect me to. Go talk to these three people first and then they'll talk to you. So building on that network model also sort of lets you build the community with the right people.

Thanks. I think those are all good tips. And the way you discuss the being in marketing also really resonated with me. So I have seen great marketers and the very best, they're always accurate, honest. They build a vision that compel people to move towards that vision. And a good marketer is worth their weight in gold, even though not everyone's a good marketer. So I think I definitely see the importance of that collective vision. And so you also talked about having a good team and that's definitely critical. But I want to ask another question about this. If you're amenable, based upon your background, you had computer science, you had policy, which included several of the softer disciplines. And it makes me think, you know, I get asked all the time, what would you recommend for me or for my son or daughter as a career path who's interested in cybersecurity? Should they study computer science? Should they study the software sciences? And you make me feel like the answer is, why not both? You know, if you want to do 100 technical computer science, go for it, we need you. Please do. But why not mix in liberal arts and study poetry and art and philosophy and history and the classics?

So from a studies perspective, I agree. I will say that I have been writing a Bachelor of Arts in computer science from a small liberal arts school for over 20 years to have a reputation as a bit of a technologist. And, and part of that is because I, I've sort of sought out technical discussions and, you know, I'm, I'm not a great engineer, but I always, you know, the analogy I used when I was postdoc in computer science is I will understand the first 10 minutes of any talk. The why we're trying to solve this problem and then the what we're doing, the how is not directly important to me, but maintaining that familiarity in the technical world as it evolves is key. The other thing that, just in terms of the advice to the utes these days is advice that was often bandied about when I was younger was, you know, do what you love and you'll never work a day in your life. Find your passion. And I think that's terrible advice to give to a young person. Right. There are people who are lucky enough to find their passion in their early 20s. I spent my entire 20s in grad school. I had a great time. I read a million interesting, different things. I had a great bar in Cambridge, Massachusetts, and I had a chance to travel and speak to different audiences and work with different professors. It took me into my mid-30s to realize that I wasn't going to succeed as a professor because the thing I didn't like was sitting in a room by myself. And so that's something that a lot of us really have to discover the hard way of what are we good at? And so the other piece is, you know, try a bunch of things, and in worst case, you'll get experienced in a bunch of things and you'll ideally figure out what. What you're interested in.

Yeah, that's good advice. One other question, and you tell me if this is an unfair question, because you don't have to answer it. But I'm thinking S curves, you know, the technology. S curves, where there's a technology and it's just kind of moving along. It's so hard as you're shepherding that technology, but then it starts to take off and it just really goes exponential, and then it kind of flattens out again. And I wonder, some of these things you've been talking about probably have followed a S curve kind of approach, like vulnerability management. There's still so much work to be done there. Disclosure of vulnerability. So much work to be done. But there's been incredible progress, and now others are leading that progress, Iot. There's so much work to be done, but there's been incredible progress and others are leading an SBoM. We've already said you've changed the world. Maybe it's gone through its S curve, however, and maybe it's at a point where we can take someone with your talents and say, you know, what's next? Maybe you should be applied to the next big tech thing that needs exponential growth.

So that's something that my bosses here at CISA are sort of asking me is, you know, hey, you know, just done that initial thing. What's. What's the next thing? And there are a couple of ideas that we're cooking. One of them is, is slightly similar to the idea of SBoM but looking at network behavior. So if someone wants to sell me some software and I'm going to put it on my network, shouldn't they be able to tell me roughly what it's going to do on my network? And so what can we do to bring together different parts of the technical, network and software community to be able to say in a standardized, machine adaptable way, machine readable way, this is what this device or this is what this application is going to do on my network. And so that will really lower the cost and raise the effectiveness of, of allow listing and locking things down. And again, not my idea, but one of those ideas where we can sort of start to build a community, take advantage of CIS's leadership to start to create something. So that's, that's one of those ideas that we're, we're hoping to sort of move, make some progress on moving forward.

Awesome. Sounds exciting already. And definitely think that's worth doing, frankly. Kind of A final question I wanted to ask Alan. How can people learn more about this stuff? I know people are already aware, many are aware of the Espanorama, but if you're not, how do people get engaged with your activities and how do we learn more about what's going on?

Sure. So one, I'm going to plug sbom cisa.dhs.gov or cisa.gov sbom for the website and I'll plug those more in a moment and we'll repeat them about eight or nine more times. But first, I sort of want to help people understand in, in terms of the maturity. We're now at a space where it's not just one common idea, the community. Just as software is incredibly diverse, the community around SBOMs has become incredibly diverse. And so there are, you know, the cloud, native world. This is easy for them. This is, they're, they're well past this and are looking at machine generated, securely generated attestations that start with SBoM. But they sort of looked at this. You know, there's a command and docker called SBoM. You know what it does gives you an S bomb. Now when I use that example on stage with, you know, some friends who are heads of product security for large organizations with thousands of products, a lot of them are legacy, a lot of them are ot. They hate that because it doesn't apply. And the good news is there are now five or six great organizations devoted to helping OT manufacturers and some more organizations aimed at the healthcare device space and things like that. So we've seen this community grow and so it's no longer just a is there an S bomb? It's an S bomb for my corner of the world, for my sector, for my technology, for my use case. And then how do we use that? So that part is advancing. One of the things we're trying to do at CISA is to be that common nexus for the world around us. So we have our website cisa.govsbom I was really impressed at how quickly CISA was able to create that. The website does need an update, but that's coming soon. Or you can send us a note to learn about our working groups@sbomisa dhs.gov because one of our missions is not just to promote this idea and to coordinate it, but to be honest about what are the parts that we don't know how to do yet. What does SSBOM mean for SaaS products? What does SBOM mean? If we want to sort of make sure that we could have end to end automation, how do we move this data around? Right. Suppliers have thousands of customers, large customers have thousands of suppliers. What are some of the scalable ways and automation ways that we can share metadata about software, not just S bomb. That's a starting point. So there's a lot of work to be done. We'd love your help. And one of the things that, as I mentioned, that I love about my work is everyone can join. So we've got leads of product security for Fortune 100 companies, we've got representatives from two person startups, we've got people who just have a passion for open source and everyone in between. So sbomisa.dhs.gov, cisa.gov sbom awesome.

Thanks, Alan. Thanks for that. I'll make sure we capture those in our show notes. And also I want to say thanks for your time today. This was really informative and helpful and much appreciated.

Well, thanks for the invitation. Big fan of your podcast, enjoyed the flattery, but I think there really is a lot of work for folks who are interested in driving change to make it. There's a lot of opportunities right now in cyber security.

Well, Alan, you're an exemplar and you're also, I think you'd be a good recruiting poster for folks who are interested in government because you proved that you can come into government and make a huge difference in the world.

There's a reason why I'm still here. It's been a lot of fun and we get to work with all kinds of great projects and people. So Bob, thanks for having me on.

Cool thanks Alan.

Thanks for listening to this OODA Loop production For the latest analysis on cybersecurity, technology and global risks, please visit www.ooda loop.com.