Paul Kurtz, Iconic Cybersecurity Leader and Founder of TruSTAR on cybersecurity strategy

Informing your decisions with intelligence analysis and insight brought to you by the team@oodaloop.com.

Hello, I'm Bob Gourley, the chief technology officer of OODA LLC. Welcome to the Oodacast. Today we have Paul Kurtz, the founder of Trustar. Hello, Paul.

Hello. How are you, Bob? Great to be with you.

Yeah, thanks for coming. Paul. There's so many interesting insights I want to extract from you. You had such interesting career and so many lessons learned along the way. And I've had the pleasure of knowing you for several years and I really look forward to asking you a few foundational questions here. But first I want to give people a highlight of your background. You joined the government 1985 or so.

86Ish.

Yeah, 86ish with the Department of State. And first I want to ask what motivated you to do that? Why does a young man pursue going into the federal government in the mid-80s?

Yeah, it's a great question. And you know, I was, if you will, I was going through college. I was always very fixated on foreign affairs and most particularly around Middle Eastern affairs. The Middle east, still a problem, still a challenge, was very much a problem and challenge then. And I had a couple of professors in college that really got me excited about it. So more or less I fought my way into a gloriously unpaid position as an intern at the State Department working in the Middle east or the Near east affairs public affairs office. And that was literally days after I graduated from college and served as an unpaid intern for, I guess, four or five months, which wasn't met with a lot of, a lot of excitement from my parents. But they were supportive of me and that was the beginning of a government career.

Well, I remember those days now. I was a young Navy intelligence officer around then, and that was. The Cold War was still raging and there was a very evil communist menace to fight. But we were starting to get these murmurs internationally of terrorism and the rise of terror and the potential there. There were things like the embassy bombings and later on there would be the Pan American Airlines Flight 103. And terrorism really started to heat up and the counterterrorism mission was starting to get taken much more seriously by the government. And you got pulled in a lot.

Yeah, I got pulled in a lot. I still remember the ticker, literally when it was a ticker, when Pan Am103 went down and I was in the office when it broke. And I think, you know, there was, you know, the problems with Hezbollah, the relationships that were budding between nations and terrorist Groups in the Middle East. Al Qaeda didn't exist at that time, but it was becoming a hotbed of activity while at the same time you're right, we were getting near the end of communism, we were getting near the end of the fall of the Soviet Union. And so it was the international dynamics. I mean we say every year that there's a lot going on, but it was definitely an interesting time in the late 80s. But I think, you know, Bob, if you will, what it afforded me to do because of being an intern, I basically volunteered to do anything they would let me do and that included working overnight. When they stood up task forces to look after a particular problem, I just, you know, volunteered. I said look, I'll come in and I'll carry coffee or I'll run paper around and, and I'll do what it need, whatever needs to be done just to be exposed to the problem and to be exposed to the decision making process as best I could.

Interesting. And later in your career you get pulled into the White House and how did that happen?

Well, I'd spent a fair amount of time working on the Middle east and then I got into the intelligence analysis business and that was right before the first Gulf War. And my job was to look after missile system missile proliferation. And it so happened that the country that I was given to my portfolio was Iraq. And of course the Gulf War started and the Scud missile started flying and really I just kind of, that was the beginning. That was really when things started to get very interesting because you know, being the Scud missile analyst there in the middle of the first Gulf War that led to going out to Iraq as a weapons inspector. Following the Gulf War that led to a broader portfolio on WMD that led to getting into the policy shops and looking into nuclear non proliferation as well, which ultimately led me into places like North Korea. Spent some time on the ground in North Korea as an inspector and had made some good connections with great mentors and people like Richard Clark. And it came time in around 98, really fast forward that he had been down at the White House for a while and was looking for a new director of counterterrorism and, and he asked me if I'd be willing to come down. And this is really when UBL was active. Al Qaeda was really taking off. And I went down to the White House in 99 and served in the White House on a counterterrorism team. My job there was to coordinate amongst all the agencies that may have intelligence to bring to bear on the problem. So that's FBI, CIA, NSA, the folks at DoD elsewhere and try to fuse that data as best we could. And then of course, we know what happened. Right, right. We were unsuccessful. And that still is very much a, if you will, a 911 is informative point in anybody's life who is old enough to remember it. But it was absolutely a big deal for me because my job was to try to bring those pieces together and obviously there was failure.

Well, I want to ask you about that because, you know, it is personal for all of us that were alive around that age. But I had met you a couple years before 9 11, maybe it was 99, maybe 2,000. As I was at the Department of Defense's Joint Task Force for Computer Network Defense, we had responsibilities only for DoD when it comes to cybersecurity. But the process that Richard Clark had put in place was to coordinate across government when it comes to cybersecurity. And he would bring us into every VTC or you know, multiple White House meetings and lots of collaboration. And that's where I met you as part of that cybersecurity effort. And here's the part I want to ask you a couple questions about that. But one is just because of your portfolio, I want to tell you something. I thought on 911 first, as soon as the second attack occurred, I started producing intelligence for my consumers. We wrote and I wrote, you know, I'm only supposed to think about the cyber domains. So I wrote about the cyber threat and I started off my piece saying, based upon the size and scope of this, I believe it's probably a well resourced adversary, someone along the lines of an organization led by Osama bin Laden. Just a rough estimate. So I could then give my, you know, what the cyber threat would be. Now first of all, I got a lot of pushback from others saying it's too early for me to be making any kind of estimate like that. We don't know the facts, let's wait. But I'm saying, look, I just said, you know, we have to assume it's that kind of adversary. But of course the cyber threat is different than the terror threat. The terror threat, you know, they want, you know, mass casualties. The cyber threat can't really bring that. But still we analyzed it. But let me tell you a second thought and get your reaction. I worried because cyber had been my life for like two solid years trying to improve our cybersecurity posture. And I felt that day like I had ignored the terror threat and that maybe the nation had spent too much time thinking about cyber and not enough thinking about counter terror. Would you react to that thesis?

I guess to cut to the chase, I probably disagree with that and here's my basis for saying it. There was a great deal of emphasis on counterterrorism toward the end of the Clinton administration. There have been some significant problems on the counterterrorism side and there are some resources and assets being put against it. But what wasn't happening was that we were. There was still the fiefdoms within the US government which came out loud and clear in the 911 report that followed. And cyber was forming up and it was out there. People were tracking. I started tracking it in the beginning of 2001 and you know, from looking at like say for example, Code Red, which was August of 2001 and remember we have Y2K. And so there are a lot of resources and assets that were brought together for Cyber and Y2K. And if I'm kind of hopping around a little bit, I will say this. We went all in for Y2K and to make sure that when the clock ticked that we didn't really have a significant problem and really nothing happened. And you as well as I remember the commentary after that, well, you know, wasn't that big of a deal, you know, so let's not pour a lot of money into it. But as we went forward, you know, we're seeing challenges with Microsoft, we're seeing increased numbers of tax. We were that those in the government who really were following it were aware that there are challenges that needed to be addressed. And I remember immediately after 911 Nimda hit and we were, I was in a situation room constantly and we were trying to restore Wall street, bring Wall street back up online. And at the same time we were hearing about NIMDA which was affecting financial networks. And so we paused a little bit at that point in time. I remember thinking about, well, what's going on here? You know, is there a connection? And ultimately there wasn't a connection. So it was really a confluence. And I really don't think that the topic area of cyber security was really taken seriously until later in the 2000s and 2008, 9, 10 timeframe, that's where you know, because I use. I ran a association called the Cybersecurity Industry Alliance. And when you go up to Capitol Hill and there were certainly some staffers that cared deeply about it who remain active in the industry today, but there was a lot of like we were being way too technical about it and there was there the Hill couldn't absorb it. A lot of folks in the executive branch couldn't absorb it. So now I think we're in a totally different place, obviously. But it was a very interesting time.

Thanks. Thanks. For that context, there's something else from that time period that is so directly relevant today to corporate strategists and business leaders that I want to talk about. And that is what I observed of you and Richard Clark. When it came to strategic planning, you guys early on recognized the need for a national cybersecurity strategy and set about doing that. And as I recall reading this strategy, I was struck with the fact that not only was it the first real strategy, but you did something else in that that was even more important than the strategy was the process behind the strategy. It wasn't the plan. It was the planning. It was the way you went about building a network and getting input from people that had never communicated before on these matters. You reached far beyond the White House and far beyond federal government into academ and the commercial world to establish communications with people and let them know their input is important. And in doing so, you produced not just a cybersecurity strategy, but a community. And it reminded me of what they would teach us in the military when it comes to building war plans, when they underscored the fact that no plan survives first contact with the enemy, but the process for building that plan can endure and can help you when you're executing. And so that was something I wanted to say and would love your comments on that. This point that you guys created not just a cybersecurity strategy, but the first real network across the nation for dealing with cyber.

Yeah, I think the best thing about the cyber strategy when it finally came out was the network it created. It was almost less so the document. It was a network. So how do you create the network? And what happened in the wake of 9 11? Dick took on responsibility for the cyber side. And prior to 9 11, we had talked about putting together a strategy, and he jumped into that fee first. And rather than spend his time inside the Beltway, he's like, let's get outside the Beltway and let's go to California. Let's go to New York. Let's go to, you know, Redmond, wherever it may be, to track down the people who are actually building the products and building the capability. And not just. Not just going into the nascent cybersecurity vendor space, but, you know, the Ciscos and everybody who's building the hardware and software. And we went around the country as we built out the strategy and we took a lot of input and vast majority of that input ended up in the strategy strategy. But Bob, just as you said, it created a network. Network started popping up in each one of these cities. And when we ultimately published the draft strategy, what did Dick do? And Howard Schmidt to his credit was very active in this as well. He went out to all the cities and met with people, we reviewed it and took in more input and then ultimately was finally published. And that was really the beginning of a national level effort. And I would argue it's different than you know, if I look at the obviously the non proliferation business, you know looking at WMD or even counter terror cyber was really something different because you, there are so many people that are involved, you know, the software producers, the hardware producers, the users critical infrastructure across the board. So the level of consultation and inclusion was significant. And we've come a long way not to say that there's a lot of work that remains to be done.

Yeah, that is definitely, it sticks out to me as one of those best practices. That is an exemplar that people in corporate America today should think about as they're building strategies for any topic, putting.

It put together a document and put it out for circulation and comment and in fact we'll talk about this a little bit later. I have a document that I've been working on for the Cloud Security alliance and I'm going to a lot of people I trust and trying to get their input, seeing if they'll look at it. And it builds, you know, it builds some good insight as to how people look at a particular problem and it's a great practice to do.

And let me mention one other thing from the old days before we get into modern times because it's another example that I think sheds insight into your spirit and the approach of Richard Clark. At the time it was one of these major events, you know in starting in 99 there was, well there was the I love you worm and Anna Kournikova and Code Red and then nimda and all this is occurring as you know the world is going chaotic and 911 had happened and I recall one of the secure video telecollaboration sessions that you guys had hosted, you were asking my organization for inputs on what we can do for the nation to mitigate the problem with nmda and one of the leaders of my organization said something to the effect of hey, we are just Department of Defense, there's nothing we can do. This is something for industry. We can't do Anything. And I remember Dick's quote back was he said something like, just like Hannibal, when he was told he can't cross the Alps to invade Rome. He said, we will find a way or we will make a way. And that really stuck with me because I watched you guys and sure enough, a few days later you have a meeting in the White House with representatives from across industry where you're talking about ways that we can collaborate in mitigating a big problem like this. And it caused me to dig even deeper into this guy Hannibal, who in my mind was maybe he's the ultimate hacker. He had the persistence. He was not going to quit when people told him that it's impossible. Just like you and Richard Clark were not going to quit just because it's impossible. And that is another lesson that stuck with me through the years is the need for us defenders to be persistent and not give up just because it hasn't been done before.

Yeah, absolutely. I think to lead Dick, when he looked at the cyber problem, He figured there was no way he was going to master what this space looked like. And the best way was to get out there and build bridges there. But there's a lesson in leadership here. You can't lead unless you're willing to call a meeting or meetings and get people around the table to share ideas, to duke it out, if you will, and try to find and pound a way ahead and persevere. And I remember there were many occasions where we were trying to get things done and we would just hit, we would hit walls and we would literally put the project to the side for like two or three weeks and we come back at it, call another meeting and we might be able to get the right people around the table and we leap over the wall and sure enough there'd be another wall. And a lot of this really, truly is perseverance in the bureaucracy. I think there's a lot of folks that are out there, a lot of people who think that Washington is a bureaucracy. People are trying to work 9 to 5 and they don't care about really getting things done. But that was not the case. And it wasn't, you know, that was the case for all the people like on your team and other agencies that we dealt with. People wanted to find a solution, but they did need leadership. And when you have a cross cutting problem like cybersecurity, where no one really owns it, DOD didn't own it, own it. You know, there isn't a civilian agency that owned it. It was kind of everywhere. But yet we all depend upon the cyber infrastructure. And you know, Dick really to his credit, said, no, no, we got to keep plowing ahead here. And sure enough, you know, and we didn't make, we didn't make a lot of friends too. We created some, you know, not so wonderful relationships along the way. But I would argue ultimately we were successful and beginning to put a foundation in place for the future. And it's just, you know, like the very stubs of the foundation. Don't want to over claim or overstate success because it was literally just the beginning. Right.

All right, I'd like to talk about now today, a couple things you're involved with if you're okay. I'd love to talk about the Cloud Security alliance and the volunteer work you do there. Would love to talk about trustar and what you've built there, and would also love to talk about the future, especially your ideas about the future of cyber intelligence.

Sure.

Can we start with the Cloud Security Alliance? What is that?

Yeah, so this is it. I got to give credit here to Dave Cullinane, the former CISO of eBay. He got together with Jim Reavis, who's been active in so many spaces in security and training organizations. About 11 or 12 years ago, Jim and Dave came to me and said, look, we're going to launch this cloud Security alliance and would you be interested in being a founding board member? And I was like, heck yes. And at that time I was doing some consulting work and I was actually doing some consulting work for Companies that were SaaS platforms that were building their capability up in the cloud. And the job I had taken on for one in particular was making the case to others that ultimately the cloud would be more security than a continuous deployment of an on prem world, you know, where everybody has their own hardware and software to maintain and keep up to date and upgrade. And that ultimately if we went to a multi tenant architecture up in the cloud, we'd probably be able to do a lot better, be a lot more efficient. And so that was how I kind of dropped into the cloud. But over time, sure enough, the Cloud Security Alliance, 11 years now, has built itself into a global organization with chapters around the world. And it's a lot of grassroots activity. Jim Reavis, who's the CEO of the organization, is a grassroots type guy, which means that he's not pronouncing that, you know, we will do this project and this project and this project and only those projects. He lets a lot of it come up out of the chapters. The board of directors of the organization is more guidance. You know, it's, you know, it's, it's, it's like that sounds like a good initiative or maybe you might want to dial this one down a little bit or maybe combine a couple of things. But really it's an interesting organization the way it's taken hold. So it's now with COVID we have a lot of organizations that were making plans to head to the cloud, but those plans have accelerated because having all your employees on site and tending to all these hardware and software capabilities on prem has become a challenge. And so there's a greater rush into the cloud.

Cool. Great. That's good context. And I've observed the Cloud Security alliance for years and it participated in several of these work groups. And now I'm in our local chapter here in the D.C. virginia, Maryland area and participate with the Cloud Security alliance and such a virtuous organization. And I think that's a great mega trend. You just mentioned about the accelerating into the cloud. But let me ask you this. I mean, I think every enterprise today has at least a proof of concept going on in the cloud, and many are moving more and more workloads there. And as you mentioned, it's accelerating because of the pandemic. But Paul, can you give us your views on the percentage of workloads that are in the cloud now? And what I mean by that is every corporation I know has at least a proof of concept running in the cloud. Many of them have real corporate workloads running in the cloud and depend on it. Others may have 70% of their business running in the cloud, and maybe some minority may be 100% cloud based. But my feeling is it's like the beginning of a big tidal wave and there's a lot more cloud transition to occur. But I wanted to ask your view on that. Are we at the beginning of the wave or has the wave washed over us?

I think we're somewhere in the middle of the wave. I think there are probably some seminal events along the way. I think one of the big developments, at least inside the Washington area, was the intelligence community being more willing to use assets in the cloud. The other example, I would say, is the creation of Fedramp, the accreditation compliance process for federal agencies to use the cloud. I think that sent a signal that the cloud was really here to stay. It wasn't going to go away. There is going to be some compliance obligations here, at least in the federal space. And I think concurrently, at the same time, the finance industry or financial industry was going headlong into the cloud as well, because they just saw the efficiencies of leveraging the cloud more and looking at data centers and how they could, how they could do more with less and have a lot more flexibility. You know, it's interesting. In the, in the, in the 80 or, excuse me, the 2000s, there was this big. We were hitting the pain points on infrastructure and maintaining infrastructure, leaving out security right now and that it was changing out all this hardware and software all the time and making those adjustments and we had to go into a space of automation. And part of that was, you know, it's going to be a heck of a lot easier to do this in the cloud. And so I think we're probably midway through that space. The idea of maintaining a bunch of hardware and software on prem for even big enterprises now, I think is becoming, you know, Not a great idea as much as it used to be. And I also think that, you know, we'll start talking about this now, but, you know, when we look at the security space, given the shortage of analysts and people that are schooled in security and cybersecurity, I think there's going to be a lot of consolidation to the security space as well. And we're going to see a lot of the security managed in the cloud. And you're not going to necessarily, if you're a small company, have to have Bob the guy or Ed the guy, or Susie the woman who's looking after security. There's going to be an expectation that that's going to be handled elsewhere. It's not going to be handled on prem. I just think it's a natural progression to where we're going. But first of all, we had to get into the cloud for some of our operational capabilities, capabilities I think security is following right behind. Great, thanks.

Well, Paul, let me shift now and ask about trustar. You saw a need and you created trustar. What is trustar?

Well, Trustar, it goes back into my time at the White House around 9 11, believe it or not, because I came out of the White House and obviously scarred by the experience of trying to get people to share intel what was going on around Al Qaeda. And looking forward into what was going to happen in cyberspace, I was like, you know, we're going to have to be able to manage and fuse data effectively. And what we've seen over the past 20 years, almost 20 years, is the creation of a lot of tools to address the cybersecurity problem. And all these tools have been created with the best of intentions to Address problems. But what we haven't really thought about was how do you get all these tools to integrate and automate? And what's been left on the side or on the ground is how do we handle all this data, all this intel? And so where we have been focusing our energy is not so much looking out and saying, oh, these are the bad guys and this is the best intel you can get on the bad guys. And bringing that into the enterprise. What we've been really focused on is how do you marry the data, the output from your internal security stack tools, make sure you're melding that together from a SIM or EDR or if you're using a case management system or an orchestration platform, how do you make sure all that data comes together and how to make sure you can also leverage the external data. That has been our singular focus over the past six years. And the problem has been in creating that is what I call traversing the valley of death. And the valley of death here is that you have all these tools taking out data in different formats and different protocols and different rating schemes. And if you're an operator inside of an enterprise, making sense of all this ends up to be a whole ton of data wrangling day. We have to have the ability to have a more data centric approach to security. Not saying throw away all the tools or threat Intel's bad. It's to say, no, no, we've got some good tools here, but if we're going to have a tool, it's got to have an API, it's got to be able to work and we got to be able to fuse the data appropriately. We have to be able to do that securely. We have to be able to extract value and bring it into the enterprise users that need it. And we also need to do that between organizations as well, whether it be, you know, the retail sector or the IT sector or whatever it's going to be. So that has been our singular focus. And Bob, honestly it's been a bit of a slog as we brought it along because there is a mentality up here in a lot of people's mind, it's like, well, there's got to be a tool for that, this problem or that problem. And we have to counter our desire to buy a new tool and instead think, no, how am I going to integrate and automate what I have today? That should be the first question that you have. And that's where we're really trying to be helpful at True Star.

Great, that is good context. Do you also help collaborate among teams and across organizations and between organizations.

Yep, yep. So if you go within an organization at the, at the smallest scale, you can like, look at how we help a soc, but then you take the SOC and you have a TI team, a threat intelligence team, often they are not able to work together as effectively as you would like. And so we can help those teams work together. And by that I mean making it so they can be looking at the same data and the systems, the security stack can be updated automatically. But then when you start to, to step away from the SOC and the TI team, then you get the fraud team inside of an enterprise. And so you can help bring those folks into play. But then you can look outwardly, you can look into your peers. So if you're in retail sector or the IT sector, finance, health, whatever it might be, you can begin to collaborate more easily with others. Could get into supply chain issues or supply chain collaboration as well. And we do work in all of those areas. And I just think the future is going to be more about collaboration, but it's not going to necessarily be as we would traditionally think about it in terms of you and I talking like this back and forth. I think it's going to be there's going to be data of value in one company that will be valuable to another company, and you're going to decide to exchange that data and you can do so without exposing proprietary information or. And the type of data that is exchanged, I think it is important to talk about too. It's not that you're sharing that you've been hacked. It's sharing data about suspicious or malicious activity that it's suspect and you're looking to share it with others so you can get greater insight to get, get greater fidelity on what's actually going on rather than you trying to arbitrate and figure out everything that goes on your enterprise. Makes a heck of a lot of sense to work with others. That's where we're talking. And this is where I think information sharing gets a bad name. Because information sharing, you know, from. You've been. You go back this far too, Bob. You go back to 1998 and it was like, well, you know, if you have a problem, you know, and you've experienced it, share with us. Well, great. Until you talk to a lawyer. And even then, even if you got a lawyer who's wonderful, they're gonna say, by the time you get the approval, it's gonna ravage everybody else. So it's to focus on the suspicious Event info that's so important.

Great, thanks. Good context. And that leads me directly to, I mean, all those observations have first of all fueled your approach at trustar. But I also see you have written a paper that you shared an early draft with me on, and frankly, it's very influential to my views of threat intelligence. And I was wondering if you could share a few of your ideas there as you talk about the future of intelligence and what you think our next steps should be.

Yeah, well, I appreciate you raising here. I think when I look at how we've defined intelligence for the past 20 some odd years in cyberspace, intelligence is seen as the external data about the adversary, you know, the charming kitten, whatever, whatever the name of the malicious actor might be or whatever the observables or indicators of compromise might be coming from an external threat provider. And that's all, that's all great. But what I want to see us do is begin to redefine intelligence because there are actually two definitions of intelligence. There's the one I just described, which is, you know, the plans of malicious actor, what they may be trying or intending to do. But there's intelligence of our ability to bring together, to infer, to judge, to predict what might happen next or to reason. And we need to get to a place where we can take a large amount of data about what's happening in our enterprise and make intelligent decisions about that, to triage the data and to refer it to an analyst based upon, you know, five or six different tools or systems and refer it to an analyst to take it to the next level or use computer systems to help us, you know, judge something to be severe and then automatically update defenses. And I think, I feel like it's going to take some effort to turn this ship, but I think it's vital that we do because if we don't, we're going to continue, as one of the reviewers said to me, he said, we are in a, if you will, a cyber war that has precipitated a tool war. And so long as we have a cyber war and a tool war, the adversaries are going to win because we're just going to keep on coming up, up with a new darn tool to, you know, to take care of whatever the problem is. And it's going to be much like the, you know, the Cold War. You know, we're going to, we're going to overspend, we're going to spend, we're not going to be able to keep up on the spending until we actually start Putting all this data together and getting smart about it and intelligent about it. And so this paper is focused on the creation of what I call secure intelligent ecosystems, where you're able to bring the data together, you were able to discern patterns in the data, you're able to take those patterns and use it to update your defenses quickly. And the model of which I point to, and it's not a one to one comparison, is what has happened in the autonomous vehicle industry. They've broken down the problem into three pieces. Sense, understand and act. You know, you have all these sensors deployed on the car, all those sensors pull in data that has to be made sense of by the computers and then it tees up actions for either the driver or the computer to take actions to steer the car. It's remarkably similar in cyber. We have all these sensors deployed that we're trying to capture this data to help us understand whether or not we're secure. We need to fuse that data together more effectively than we've been in the past and then kick it into taking action. And I'm, I'm hopeful we'll make progress on this front. I think in the absence of really starting to fuse data more intelligently, we're going to be having the same discussion again in our 10 years. Right.

I agree with you, Paul, I really do. And I look forward to the final of the paper and I will spread that around broadly as soon as that's published.

Yeah, right now it's out for peer review on CSA's website and so you can pull it there and you can jump in and comment and rip it to pieces. And Bob, going back to the old days of the Dick Clark model of get everybody involved and have a piece of it and get their say. I'm all about that for this because I think it's that important. Good.

I'll put a link to that in our show notes and on our blog.

That'd be great. Thank you.

I absolutely love the approach of your use of the term intelligence because of course, from my old world that I came from, intelligence was governed by executive order 12333. It's about stealing secrets from your adversary. And in the corporate world and the nation as a whole, it is far more than that. It really should be this sense making and helping you understand in an interactive way like this.

I agree, I agree.

Well, Paul, I have one final question for you and it's about helping me understand more, and that is I wonder what your sources of information are. How do you keep yourself current? For example, what books have you been reading lately and anything you would recommend to us?

Well, I make a habit of spending probably a minority of my time reading about cybersecurity and spending a majority of my time reading things that have nothing to do with cyberspace. Because I find sometimes, especially when you look at history or you look at even philosophy, you can be sitting there reading and you're like, ding, ding. The light goes on in your head that like, oh, wait, this is applicable to a problem I'm seeking to solve. And so, you know, say, for example, there is. I just read the Courage to Be Disliked, which is a more philosophical book by Kashimi, if I'm pronouncing his name right. And a fascinating book, just looking at, you know, you yourself, how you make decisions, how you see yourself, how you interact with others. I was a little bit. Yeah. I'm not sure if I want to read this way, especially after reading the title, but it turned into a great book. To looking at a book by like, Scott Adams, Win Bigley.

I'm sorry, say that again.

What was it? Scott Adams published a book actually a few years ago called Win Bigley.

Win Bigley, Yeah.

And it's. And I actually tripped over it when I was reading Bob Woodward's Rage, because within rage, Jared Kushner talks about, well, if you really want to understand the president, read Winn Bigley. And it was eye opening in the way Winn Bigley is not all about Donald Trump. It's about the art of persuasion, how you have a discussion with somebody, how you might persuade someone to come around to your point of view. But even if they're not going to come around to your point of view, your point of view will be the topic of discussion because everybody will be, you know, going, but you become the topic of discussion, which sounds really familiar. And the one that is most germane to our field is that I just finished a little bit ago and it's in the paper is T minus AI, which is by Michael Kannon, if I'm pronouncing his last name correctly. And a fascinating book, a very quick read that I think most anybody can pick up and look at. And that's kind of more squarely in cyber. And so by doing reading a lot and not just watching CNN or MSNBC or Fox or one of those and just kind of sitting back and trying to set aside an hour or so a day to read, it's eye opening.

Great. Well, thanks. We're going to put links to all those books in our show notes here. Definitely appreciate it. It. And, Paul, thanks for all your time today. It's been very valuable, and I just really appreciate it.

Yeah. Thank you for asking me on. I appreciate it very much. It's always fun talking. Cool. All right.

Thanks, Paul.

Thank you, Bob. Thanks for listening to this. OODA Loop Production for the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.