Ron Gula Applies a Hacker Mindset to Investing, Public Awareness, and Philanthropy

Informing your decisions with intelligence analysis and insight brought to you by the team@oodaloop.com.

Hi, I'm Matt DeVoe, the CEO of OODA and thanks for joining us on the Oodacast. And today we have Ron Gula, who I believe we first met probably in the late 90s, had parallel paths starting kind of from a DoD intel community perspective and then becoming entrepreneurs and have collaborated off and on since those years and even more in recent times. So Ron, welcome to Udacast and I'd love for you to give your background with regards to your career trajectory.

Hey Matt, thanks for having me here. So am I inside your OODA loop? Is that, is that the joke that we can talk about now that I'm on the show?

Absolutely.

Awesome. Thanks for the opportunity to spend some time with you today. Yeah, as you said, I got started in cyber before Cyber was cyber mid-90s. I was in the Air Force working at the National Security Agency and got to do a lot of stuff that back then. Not a lot of people knew what a pen test was back then or what information operations, all these kind of cool names and acronyms were. But it exposed me to all the good and bad of large bureaucratic organizations, the power they have and how slow they can move and whatnot. And I've been in cyber ever since. Got to work at BVN where they kind of invented the Internet and put the at sign in the email and stuff like that. So I got exposed to a lot of folks who work there. I got to work at US Internet working, which is one of the first cloud companies. And I kind of joke about that, but everybody's cloud, cloud, cloud right now. But in the late 90s you had networks and you had on prem. Everybody had a very defense minded, perimeter minded thing and got to work at U.S. internet working and fend off hackers from people attacking there. Had an idea to do better intrusion detection system at the time he had Net Ranger, we had iss, you know, really, really stuff that kind of made the field and you know, put together a team with my wife Cindy and did the Dragon intrusion detection system. It was one of the first Linux based packet capture things out there. You know, there was no school, there was no, you know, entrepreneur classes for people coming out of the Air Force and whatnot. But we were able to sell that and you know, get some awards from like, you know, cybersecurity magazines and whatnot. Got to go work at Anteris Networks where we sold that too. And while I was there I met Jack Hufford Jack was on the M and A team and after working Dragon for Interesis for a couple years, we started Tenable Network Security. So Jack Hufford, Renaud Derrison, Cindy Gula, we were all running the early days of Tenable and grew that we probably spend more time talking about Tenable, but basically spent 1312 years of my life or so there was thinking about vulnerability management, continuous monitoring, configuration, hygiene in a lot of different types of environments. Tenable, I left that a couple of years ago, started Google Tech Adventures and now I invest in cybersecurity both as a philanthropist, as an LP in cybersecurity funds and as a direct investor in cyber companies. So let's talk cyber. Matt.

Excellent. So that mid-90s from a penetration testing perspective were the glory years I felt like because you could have such an impact and I would find my doing an assessment at SOCOM&LO and behold you're briefing the head of a socom, right you're briefing the combatant Commander equivalent at the time. So now it's a little bit mired in the bureaucracy, but those definitely were fun days in the early years with regards to looking at those networks. I would love to dive a little bit deeper into Tenable. I mean Tenable became one of the most successful cybersecurity companies. It's a great model for others. It's now publicly traded, providing a ton of value. What lessons did you learn over that decade plus tenure at Tenable that you would like to convey to emerging entrepreneurs?

So I think a lot of the big lessons that kind of came out of there and I've always wanted to kind of do this with Renaud and Jack at the same time. And even Amit now he took over for me after I left. Cause the technology has continually changed. So the biggest commitment or the biggest thing I learned is like the commitment that we made to investing in what was next. So when we started Tenable it was really server side auditing. We were connecting to Solaris computers, Linux computers, Windows servers and doing some sort of audit. And the unsophisticated people would do an un credentialed vulnerability scan and the people who kind of knew better would do a credentialed scan. And we do configuration auditing, patch auditing, vulnerability auditing and try to trend that and whatever. But, but if you look where Tenable is now, we have to do mobile talk to MDMs, we have to talk to SaaS providers, you have to talk to the domain controllers which are not just Windows anymore. There was a whole revolution in virtualization of operating systems, there was a whole evolution of compliance frameworks. You know, like when, when PCI didn't exist. When we started Tenable, that came out after. So we had to constantly look ahead and really try to avoid just answering what our customers wanted, but also kind of predicting where things were going. That's the biggest thing I tell our portfolio companies today. You have no idea what's coming 10 months from now, let alone 10 years from now. If you're not involved with it, you're going to be caught, blindsided.

This is a great way. Obviously this is called the oodacast and we're big fans of the OODA loop. So it sounds like you had a great decision cycle. So how were you feeding those observations? How were you developing the observations around where the market was going and making sure that you had the agility to reorient in order to address those market needs instead of just going stale around one approach?

We always invested a lot in engineers. A lot of times people think that a company like Tenable was made mostly from cyber offense, NSA people. But the reality is there's a lot of engineering that goes into making a delightful product. A product that's fast, a product that is comprehensive and it works. And we had a good following. So we got a lot of different feedback and it was pretty cool. I would go to a conference, I had a lot of confidence I would raise how many people use Tenable, Most of the audience raises their hand and whatnot. How many people had a bug? A lot of people raised, how many had that bug fixed within 48 hours or a week or something like that. And so not only just having the ability to innovate and put stuff in the product, but have the ability to kind of rapidly fix things. So a lot of people who've used nessus, they have, there's a plugin architecture, and the plugin architecture has the ability for us tenable to basically ship new content, new functionality with a plugin update. And people are really used to that now. But when we did that early on, it was a really unique thing. It gave us a lot of ability to overnight add, the ability to maybe do malware detection, for example, or add support for a new type of operating system. I remember at one point we added support for support for 12 different flavors of Linux and that kind of stuff. So that really helped us do those kind of updates and get that content out there.

Excellent. Did you do it all informally or did you establish kind of like customer review boards or customer input boards to drive that engineering Talent asides from just the ticketing system where you're doing something that was a little bit more future looking with the customers themselves.

Yeah, sometimes we knew we had to do something. So for example, the government has a standard called scap, Secure Content. Forget what the A is analysis protocol. But that's like this XCCDF xml. There's like laboratories that certify your product. So we knew we had to do that. That, you know, center for Internet Security, they had something like that too. But what we learned is that you simply can't just sit down, sit down and write content. Make an API that other plugins are. You have to have kind of a structure. And every couple of years we kind of had to retool, redo the APIs, maybe take something that was written in the interpretive code called the NASA, the NESSUS attack scripting language, you know, to basically make that maybe a little bit faster, move some things into the core of nessus, that sort of thing. So we were constantly, always looking for ways to increase performance, add more checks, that kind of. So like, you know, there's the Y2K bug, you know, for a while, you know, we had just like six digits in like the NESSUS id. Now there's. They're a lot bigger. So, you know, things like that. You'd be surprised how often I still see engineers and developers struggle with that. Whether it's a dlp, an intrusion detection system, cloud auditing. I see sort of the same things we struggled with at Tenable, just kind of reinvented and reimagined in a lot of the portfolio companies we're working with.

Excellent. So your new endeavor is Gula Tech Adventures. So the naming seems very deliberate. So what are you trying to imply with the Adventures component to it? Can you tell us a little bit more about what you're focusing in on? I understand it's investing in philanthropy and kind of community engagement, but would love to learn more about exactly what you're doing.

Yeah. So Cindy, my wife Cindy, who worked with Dragon and was a key member of Tenable, she kind of named it. So we're on an adventure here because everybody says gouletech ventures and sometimes I won't correct them and whatnot. But we are equally split in both investing and what I'm just going to call raising awareness, call it influence, call whatever you want. Trying to push the cyber message for people who are inside the cyber bubble and they're living on Twitter and they're doing their pen tests, they don't realize how little people outside the cyber world can relate to what they're doing or understand the threats or even understand some of the basic technology issues that are kind of facing the average citizen of the United States today. So we named it Adventures. So we could focus on both investing in technology that I think will make a difference and, but also investing in philanthropy, which could be more bringing more people to this career field, could be spending time with politicians, could be time doing things like this. I love doing interviews, I love doing talking to folks. But I also really in particularly love having cyber conversations with people who are outside of our industry. Like we'll do panels for real estate people, we'll try to think for financial advisors. Just trying to bring cyber to these non cyber people. It's really hard to communicate what we do, but it's an adventure regardless.

Yeah, I think that's critical. You know, that's something that I do personally I don't talk a lot about, but once per quarter I present for free to a group that normally wouldn't be able to hear from me. So I think at the end of 2021 I spoke for a Rotary Club based out of Arizona where they had the interest, they knew it was something they should be paying more attention to, but normally wouldn't get exposed to that. So I love when you talk about kind of reaching out and getting the concerned citizen to understand a little bit more about what we do and what is at risk. Those are important things I think for us to do from an engagement standpoint. And we have the luxury of having been entrepreneurs and been successful in our careers and being able to free up some of the time and resources to do stuff like that as well. From an investment perspective, what types of solutions are you looking for? What gets you excited about the market after having been in the market for over 25 years?

So today where we're at, and we're recording this In February of 22, we're really trying to look for technologies that are going to defend the nation's cyberspace. So it's not that we have stuff in our portfolio that we don't think is going to do there, but some things are more strategic than others. And I'm not going to go through all the portfolio because I'll give you a good example. So we're investors in Huntress Labs. Huntress is basically an Endpoint security product, which is one way of looking at it. You could say, hey, the world doesn't need another endpoint security product. Especially when you got great companies out there like CrowdStrike, Sentinel One and whatnot. But Huntress go to market, was the SMB working with managed service providers, not even managed security service providers. This was a market that's really, really underrepresented. Most people who have a dentist or a car dealership, they probably have outsourced it using stock antivirus. And anybody in cyber knows that stock antivirus just is not going to stop ransomware. You have to be hunting. And so Huntress is an investment that we're really happy with the investment. We got a lot of great co investors in there, really good team. They led the fight against the revil ransomware late last year. That's a very strategic investment for us. We're very happy how that's going on. But if you look at offense versus defense, if you look at what can we do to change the fishing equation so my mom and dad don't get fished with something really, really good targeting their bank account. We've made investments in all of these areas and we're looking to make sure we can help create the next 10 tenables but also really make it harder for people to to do the type of hacking. We love hygiene and hunting, but we also like security engineering. Like if things were more secure by default, you wouldn't need to sprinkle compliance and hunting on top of that if you had a lot more confidence in the data that you were using and the applications you're using. So we try to invest in those areas as well.

Excellent. We like to talk a lot about critical infrastructure in this space and that's important. But if you just look at that small and mid sized business market, it's a critical infrastructure in of itself with regards to the economic opportunity that it provides. So focusing resources in that market makes sense from a strategic perspective for certain. Are there other examples of kind of strategic missions that you get excited about? It doesn't have to be a current investment. Maybe it's a segment of the market or an approach that you're seeing.

I'll give you a good one. So with tenable we got to look at a wide variety of markets. So that power generation market, OT universities, healthcare, whatever. Tenable. We were always pointing out problems. We could scan the biggest networks and tell you what your flaws were, but we really couldn't tell why they were there. Was it a procurement issue? Is it a process issue? Are people not doing it? Is it contract violation? You don't have visibility that when you're talking just IP addresses. I'm a really big fan of IT automation. There's a company called OOMNITSA that really automates almost everything you want to do in it. And if you go back to the mid-90s, early 2000s, if you were in it, you talked about Cobit and Itil and people like Gene Kim, the former CTO of Tripwire, would talk about visible ops. How can we run IT networks so that they're delightful, that projects happen on time and users are delighted and whatnot? We lost sight of that. All the focus now is on DevOps, not on really good IT management. So I want to bring more automation to large it. I want to make things repeatable and easy to manage. And I think that goes a long way for not only securing our network, but just running networks the way they should be run and with the business in mind of why they're there in the first place.

Cool. Yeah, I like that approach. It also solves the kind of the human based skill set gap that we have as well. Right. The more that we can automate and have done, where we can focus our human resources, where we don't have as many as we would like on maybe some of the more complex problems or the things that can't be automated.

And this is an area where some of the philanthropy work we're doing and some of the public policy work overlaps with the technology. And this is why we go on an adventure. So if you think about an OT network, really high uptime, you don't want to touch, you don't want to make a change, right? If you're going to make a change, you got to inform everybody. It's got to be tested, it's got to be really there. So there's not a lot of changes that happen in these big OT networks, but the uptime on them is huge. Unlike an IT network which might be running, might have a new browser because somebody wanted to try a new browser today, and who knows if that breaks the app or whatnot. It's just not run with the same standards and uptime. To me, this is a really big problem with cybersecurity though, because here you have this IT network that is actually probably a lot more important to the core of the business. It's probably how they work with their partners, how they collect revenue, how they communicate with their employees. And most boards and corporate leaders who are not technical, they really have no idea of the technology risk that's out there. So this is the type of thing I can go to talk to Congress about it, I can go talk to academia about IT and say, look, we need to do more in this area about informing corporate leaders about not only the risk, systemic risk of cybersecurity, but why can't they use more technology to achieve their business goals and just kind of think about it the same way as you're running an OT network or maybe the same way an airplane is run. So we're really passionate about stuff like that. Excellent.

So I'd love to shift and talk a little bit about the threat environment. What do you see as some of the biggest threats that we face over the next five to ten year window in cyber or outside of cyber?

Our industry's done a really bad job of talking about who the threat is. You'll see a lot of keynote people say, hey, we're at war. All right, well, are we at war with China? Last I checked, we're not really at war. Maybe it's a cold war. Those kind of things don't really resonate well with the general public. But, but the other thing we're doing is as an industry, if you went to any marketing presentation from any vendor, that vendor is the cure for all things. Any cyber problem you have, we're going to stop it. We're going to stop ransomware, we're going to stop malware, and it's tough. So we really don't have this really good sense of what the threat is and what we should do about it. To the general public, when we see something like Colonial Pipeline, we don't have this gut reaction of what do I need to do to take personal responsibility for these threats. We certainly don't tell people, hey, look, most of the ransomware industry is on your network. They have the telemetry. It takes them a week, maybe two weeks to find ransomware before they can do anything about it. So by the way, the products you have probably don't work. I mean, that's a really tough message as an industry to put out there. The other thing we're not saying is that you're on your own. Last I checked, the NSAs might be interdicting threats before they get to the United States, but they're not watching this conversation. The FBI certainly is not watching this conversation. State police is not watching this conversation. If they're somehow Russian actors or Chinese actors changing the words I'm saying or in your network or whatnot, it's on us to do it. That's not the message that we've put out there. No wonder we haven't really made a lot of progress in taking down botnets or encouraging more information sharing or having a better idea of that. Until we have maybe a Covid level response for cyber, I think we're always going to be playing catch up. So I have a little bit more glum view of that because there's more work going on cyber than ever before. But I think the threat is drastically outpacing and we are very underinvested when it comes to dealing with the kind of threats the nation's seeing.

What sort of manifestation of the threat. What do you think would happen that would drive that Covid level response to the cyber risk environment?

I think something that would borderline a science fiction movie. You know, we had the Colonial pipeline and you know, before the colonial pipeline incident happened, people would talk about that. They're going to say, oh, you know, someday an outage might happen, you know, there might be a death, you know, in a hospital or. I think it's got to be something on such the next level. It's so hard to kind of even suggest something like that because most people who are in cyber don't think it could happen. And even when we do talk about it, people who are outside of cyber, we have no credibility because almost anytime we put our foot out or say this is really important, like log 4J wasn't a big deal. Now maybe that's because everybody patched everything and most of the intrusion protection systems out there, we're tuned to it. But most people still, they're kind of worried about the supply chain. They're kind of worried if something's made in China. But then my laptop, my phone, parts of my car are all made in China. So it's really hard for the general public to figure out what's a threat and what's not a threat. Until you have a massive, massive, massive outage. I don't think you're going to see that Covid style response. We're always going to be in this gray cyber, cold war type of war footing.

So you think something that has a kinetic impact, an outage of a power grid, that's sustainable. What about from an economic perspective? Does that worry you at all that an attacker might have a sustained impact on our information infrastructure as it relates to economics, stock market, banks, et cetera.

I think from a terrorism point of view, there's an opportunity for a terrorist to have a dramatic impact, something akin of taking out the World Trade Center. They could shut down the stock market, they could do things like that. But again, that borderlines the stories of science fiction and CBS miniseries and whatnot. But when you look at the actual theft of what's happening with our country on one hand, you could say, well, we could try to stop it. I'm all for auditing our supply chain and trying to be smart about our people, our partners and the technology we're using. I certainly don't want people to build products and have them use backdoors that are libraries disguised from Russia or China. But the reality is this type of engagement might just be the cost of having an open and free society versus dictatorships and closed society. This might be a struggle that we're going to be having for the next 50 years. And it's just the way it is because when you talk to good people from China and Russia, they just have different attitudes towards intellectual property and what's available. I struggle sometimes saying, are we at war? Yeah, there's a lot of stories out there where companies have had theft from China and they've been able to take those things and turn them into profitable joint ventures. So it's a really interesting and difficult way to try to address all that.

That was a wake up call for me when I interacted with folks around Chinese IP property rights perspectives over a decade ago and the realization that if you look at it over history, they feel like there was lots of innovation and invention that were shared over the past 2,000 years that the entire world benefited from. So just because intellectual property protection laws and legal frameworks existed in the past century, when the United States and other countries have had a period of innovation, does that mean that Chinese citizens shouldn't benefit from that innovation? And when that was explained to me as kind of the backdrop for some of this IP theft, it definitely changes the framework. Now it becomes about prosperity and innovation and betterment of the citizenry. Doesn't make it right, but I think our understanding of the threat needs to be more nuanced, as you were talking about, than just they're trying to steal our stuff. There's usually an international backdrop to it that is a little bit more complex.

And this really what comes down to is that the world is in such a complex place. Cyber people have such a hard time separating maybe security issues from privacy issues or availability issues. But then when you start talking about the supply chain and you start talking about the economic impact and the risks involved with this, maybe it's a shame on us as a society for consuming things, whatever we're consuming from Amazon or whatever we're buying from people who've built highly efficient, just in time, shipping things we're so accustomed to. Oh, I ordered some shoes and they're coming Friday instead of Thursday and oh my God, that's going to ruin my week. And really, it's quite the miracle that those things are happening and we have reliable power, clean drinking water, that sort of thing. I don't think we're spending enough time as a country teaching people how things work, who we rely on, who our partner, what is our place in the world. And it's definitely a good time to reflect on all of that stuff.

Similar to that old comedian sketch. I forget who it was that talked about the miracle of flying. He doesn't complain about flight delays because at the end of the day he gets to get in a metal tube and fly thousands of miles on trips that would not have been possible, you know, just a couple generations ago.

That's well said, well said.

We tend to take some of that stuff for granted. What has happened over the past several years that has surprised you the most? You know, either an adversary, innovation or something that's happened, or you felt like you were caught a little off guard?

Well, Covid, I think was the biggest thing. And it's a good thing for it. Of course it's a horrible thing for to deal with. And I'm not going to get political about how we handle it or whatnot, but the reality is we're struggling as an industry. How do you secure all of those people working from home? And of course, if all those people working from home is an acceptable and good thing, what does this mean for government agencies who have big bureaucratic buildings around Washington D.C. maybe we can move some of those people out to Texas or Oregon or someplace where economic development would be really an interesting thing. Maybe it means that the concept of an org chart and a team and being at the office completely changes. And that's just an amazing thing. And maybe it also means that living in California and having a higher cost of living and then moving to a lower cost of living, like maybe Aspen or I meant Austin, something along those lines. Those kind of issues are having dramatic ramifications for, for the industry. And I think in some cases it's actually really, really good for getting more minorities into cyber and to just it and coding in general gives people a lot more opportunity to kind of get exposed to more things. Because if you're stuck, maybe you're stuck in inner city or you're stuck wherever you're at now you have the opportunity to work across the entire nation and we're so hurting for people. It's going to be a good opportunity. But those are the big things I think were grappling with as an industry. And I think we're going to still grapple with it for the next going forward.

Anything from an adversary perspective that surprised you over the past several years?

There's so many people who predict so many things in cyber. When something happens, somebody predicted it. So botnets were predicted before botnets happened. Botnet then botnet takedowns were something that was predicted. Shortly after that we had backdoors and solar winds. That's predictable. You know, that's been predicted. And I'm not saying that these people were right and they were exactly right or whatnot, but there's very little that I've been like. I think what's not been interesting or not has been that interesting is just like how maybe non interesting AI has been. I mean, there's a lot of investment in AI. I still have yet to see it really impact cybersecurity. I've yet to see somebody saying I don't need to have my cyber staff anymore. That third headcount I was supposed to hire, I bought the AI Cyber 9000 from Blah Blah, Blah Co. And I'm good to go. Right. It hasn't happened yet. Right. And so, you know, could it happen someday? It might, but I just really have been pretty disappointed with that kind of technology. Quantum's another one. You know, a lot of people have said, hey, someday Quantum is going to break our crypto, so we have to do this quick. Crypto. I'm not seeing that. And then of course, when it happens, there's going to be thousands and thousands of people who said, oh, I predicted that. They might have predicted that, but they haven't really had the effect on the industry to swap out how we're doing key management, how we do TLS encryption. So that's what surprises me, I guess, just how complacent the world can be with some of these flaws that are in cyber. Because at the end of the day, it's still an amazing technology that we can have a zoom session and do these things. But it's really interesting where we're going and the ramifications of that for like social media. Do you want to have this conversation in the metaverse? Well, maybe those platforms can deplatform us. And that's probably much more surprising than I think anybody was expecting.

Interesting. I do feel like at times in the cybersecurity industry we have a bit of a pessimistic approach as new technologies are emerging or new solutions or I've even made the argument that we've been stuck in a Little bit of a cyber winter equivalent to the AI winter where you had this period of there was some gradual innovation, but nothing that was kind of truly innovative. How do we spark folks to be a little bit more optimistic or what would you focus on? If you're trying to drive real change solutions, not incremental advances in existing capabilities, but kind of new models for how we think about cybersecurity that might be disruptive to even the underlying technology stack that we're used to using today.

We have to use new language. So I think when you teach cybersecurity to children, to people In K through 12, a lot of the terminology we use, it's very militaristic. Here's your firewall, there's your red team. Even the word security can be deemed like a policing thing. And a lot of minorities that can have not the right psychological reaction with that. It's not like an enabling thing. So one of the things we try to push at Google Tech Adventures is this concept called data care. We're stealing from the healthcare industry. A lot of people understand that not everybody in healthcare is a brain surgeon, but not everybody's a nurse. People do insurance, there's a whole ecosystem there. And cyber is a lot like that. You have people who do MSSPs, people who are offense reverse engineer, people who've designed implants for the intelligence community all the way down to hi, I'm Larry and I'm here to patch your computer. You know, once, you know, once a month. There's other people who are talking about, you know, we need to talk about cyber like, you know, a cyber civil defense type of thing. Something on par with what the nation went through in the 50s when we were getting ready to fight, you know, fight the Russians with an all out, you know, nuclear type type of war. I think we need new ways to talk about the technology that connects with people because you know, the next Generation is on TikTok, they're seeing 30 second TikTok videos. And I don't think you and I are dancing on TikTok at the moment, you know, so we have to find ways to communicate with those folks. I think Hollywood's a good way to communicate with those folks. But we need better examples of what a career in technology, what a career in it, how impactful that can be for a family, for an individual self esteem, for the ability to fight. We pretty much say, hey, go into it and defend the network from China all on your own. Right? That's not a great way to encourage people to get in here and innovate and change things. So language and how we talk about what we're doing needs to change.

So it's good. Definitely. That's how we wound up owning the domain homelandsecurity.com Back in 1999, we were sitting around a table with folks from DOD and from local law enforcement and the cops at the table said, hey, can we stop calling this Homeland Defense because it's not Department of Defense? And said, well, what should we call it? Well, let's call it Homeland Security, which is a little bit more of a broader mission. Of course, that has its own connotations now a couple of decades later. Another aspect though that you touched upon as well though, is workforce recruitment, getting a next generation interested in cyber technologies. There's stuff like the cyber games. I had fun with the keynote that I gave where they actually brought in a video game live streamer with his own followers to be the emcee of the event to try and get folks that understand, hey, if you like playing Fortnite, maybe you will like cybersecurity. But I also feel like in this industry we have a lot of gatekeeping with regards to certifications and degrees and things of that sort. So do you think we need a trade type program for cybersecurity? Because I certainly know and I would love your experiences. Some of the most brilliant people that I've hired in the past had no college degrees or had just real world experience tinkering in systems or being sys admins. So do you think we need to, I don't want to say lower the bar because I don't think these are less skilled people, but lower our expectations with regards to the role that certifications and degrees play in building the cybersecurity workforce.

So I get asked this question a lot and I try to point out the fact that folks like yourself, folks like myself, most people who I know who are accomplished in this field kind of invented it and made things up along the way as they went. Maybe they were self taught in some fields how protocols work, but maybe other times they were inventing new ways to do threat sharing and in your case, threat fusion, intrusion detection, whatever those things is. I've got similar conversations with the founders of Crown Strike and Mandiant and Sourcefire and whatnot. So but then we have this feeling like, well, how do you impart this knowledge on the next generation? And you've got academia, which is kind of stuck in how academia does academia. I mean, healthcare has made a lot of advances, but the human body hasn't changed a whole lot in the last hundred years. Whereas it wow. CPU processing power concepts of like the cloud. I mean, that is rapid, rapid change. And traditional academia is not good keeping up with that. Neither is certifications. You know, certifications, they struggle with the same problem, right? I'm a Red Hat certified person. Well, in What? Red Hat 7, Red Hat IBM, Red Hat Centos. It moves so fast. So I really have a hard time saying, here's how to teach people. And then if you look at where we're going to be 10, 20 years from now, this gets into that whole prediction, who's right, who's wrong. I think the kind of decisions we have to make and the kind of things are. You're seeing a lot of no code technology come out. You're seeing a lot of assembly of programs. I don't think the general public realizes that when they're playing whatever they're playing, Wordle or Angry Birds, 90% of the code they're looking at wasn't written by the people who are doing it. It's all assembled and whatnot. So should we be teaching creativity? Should we be teaching some? I got asked by some very senior politicians, should we have a cyber academy the same way we have Army West Point, Naval Academy and whatnot? And I said no. And they looked at me kind of crazy and I go, look, airplanes. Biggest advance in airplane was space. Look, you need a space force. But cyber is still. It's still evolving. I mean, maybe the next world war is going to be fought inside the metaverse. You know, maybe it's going to be implants in Iot systems and we're not even going to know it because these AIs are going to fight, fight the battle for. So, you know, I tell people if they want to be successful, they should do something that they're inspired by. And, you know, that's the thing I really like to see with people. You should go do something that you're inspired to do, not because somebody told you you should be a C programmer or whatever. Some of the happiest people I know in cyber who are the most successful, they literally get to do whatever they want. You know, people who do reverse engineering and hunting and malware. It's like being Sherlock Holmes. You get to investigate any technology that you want. And it's a really an amazing career field. At the same time, though, it's not, you know, everybody can't do that. There are certain things that we need help with. Compliance, policy, control of privacy, control of data. And as these things mature, I think you're going to see people more like the healthcare industry where you're aligning to maybe I want to be a brain surgeon or a nurse or go into assurance. I think you're going to see that in the cyber industry. I think it's going to get called something else than cyber, but it's going to definitely be a little bit more productized and job categorized.

So do we need, if we don't need an academy, do we need, I don't want to the wrong term, but the one that's coming to mind is like cyber playgrounds. Do we need kind of areas where people can log in, get access to technologies, experiment, not have any specific goal in mind to better learn or pursue some of these passions? How do we bridge that gap with regards to what they might be interested in working on and the technology that they might be able to access on their own means?

Yeah, I really feel there's two types of learning. There's the spoon fed, show me the YouTube, quick video. What do I need to know? What are the talking points? What are the Cliff Notes? And for a generalist, I don't need to read every New York Times bestseller to understand what they're about and what the main message is. Messages are. But for somebody who's a subject matter expert and they want to have a career in technology, technology is going to change. So unless you figure out how to learn new things, whether you're exposed, maybe your library gets a cyber range, maybe your local economic development team has a cyber range that people can play and test with stuff. Maybe it's just learning the fact that you can do that at Amazon at a very, very low cost or DigitalOcean or Linode or all these other kind of kind of places. Whoever you are though, if you're going to be going into technology, you have to learn how to learn new things. And there's a lot of ways to do that. Like I said, YouTube and cyber ranges is just one of them. Maybe there's other models out there. Like the next fortnight might be more about building blocks for cybersecurity and stuff than just shooting John Wick and whatnot.

I definitely see that with my kids. I have my daughter who's in college, but I get 17 and 13 year old boys. They definitely are more attracted to those environments where you can actually build the Minecraft, the Roblox, the things that allow for that creativity, or even incorporation of coding that seems to have the most amount of stickiness for them, or the things that they get the most Emotionally attached to, or they can be in there and build and explore. So maybe that's a model. And of course, I'm a big fan as well. Kind of the hacker spaces and giving access to technologies. So maybe we need more of those where people can go in and get access to 3D printing or get access to compute resources that normally wouldn't be accessible to try out what they learned about in that YouTube video.

Yeah, I'm all for that. And our foundations exposed us to a lot of different programs out there that a lot of these hacker spaces will combine robotics with programming, with cyber with web design and graphics design. And that's great. Other programs are, hey, we're just going to do cyber for young women. One of the winners of one of our grants was Girl Security, which is basically trying to tie national security education and cyber security for young women. You know, so there's so many different programs that are. That are out there. You know, there's, there's, there's a lot. And, and it's, you know, you got the fear of missing out. Everybody has that. They're online. Social media really kind of does that. But I'm. I always tell people the world's so big, the country's so big and has so many opportunities. You should find something that, that inspires you and go do that. Like, don't, don't just do something because somebody told you, because you're probably not going to be happy with it. But if you're curious, inspired by something. Man, we have so many resources for people these days, but the inspiration has to be within that. Everybody doesn't have the same interest.

And to pursue their own passion as opposed to trying to emulate others. And maybe that brings a little bit more of that optimism that I'm looking for into the equation as well, because they're pursuing that kind of true passion. If you and Cindy had to go all in, push the chips in the table and make one last investment, where do you think you would get the biggest yield if you had to pick today?

Wow. So biggest return.

Not monetary, but in benefit.

Yeah. Well, I would love to find a way to have. There's so many, like, how do we untie this? Right. I personally would like to have a phone desktop communication system enclave that I could control when I was at nsa. Anybody who's worked in the dod, you have this concept of skip. I've got a private network and I trust everybody on that. And I can do a lot of stuff. I can do file sharing. I can basically operate with these people. And as soon as you go into the real world, you lose that. You know, I send you a file, I have absolutely no control over who you give it to and what you do and who. And if I tried to control it, I have to get you to use one of my apps, right? Buy into my PKI infrastructure and stuff like that. It gets really, really hard, really, really quick. So I spent a lot of time with Marcus Raynham and Marcus always talked about, look, privacy's over. You know, everything is out there. We're so interconnected. Any security and privacy you think you have, it's kind of really, really an illusion. So the thing I would love to do is try to find some sort of app, combination, hardware, device, service, whatever you want that really brought that control. And not just technical, because I've been pitched a lot of stuff, something that would appeal to my parents, that they would instantly recognize I should use that versus this stuff that I'm using right now. Because the general public just so it's got to be very, very broad. Like that's what I would be looking for. So anybody has something like that. I have a five slide pitch deck I'm looking for. You can contact me at Gula Tech and we'll get you some funding.

I'll link. As you know, I'm a huge Fan of the 5 slide pitch deck stuff, so I'll link that video below. I won't make you explain it again here on this podcast, but it seems to me like what you're describing really is a technology stack and set of tools for digital self sovereignty. So is that an accurate portrayal of kind of what you're trying to accomplish or what you would try to accomplish with the.

It'd be like, I recognize the words you're saying, but nobody else in outside the cyber would understand what that means. Right. So it's sort of like on Star Trek, right, When Kirk calls Starfleet. You know, you don't, you don't see like an SSL negotiation thing going on. Right? You don't, you know, you never really. It's just kind of all there. I don't know if it's some sort of biometric they're using or whatever, but it's certainly not seamless. And I certainly believe that whatever we use in the future, it's going to have some sort of person we trust at the bottom. Maybe it's zoom, maybe it's Microsoft Teams, maybe it's something, maybe it's something that the Verizon does for us. But my point is everybody has to Trust somebody. And I think that is a problem because these platforms have the ability to, you never really know. Zero trust really just means you trust a lot less people and you end up trusting those people a whole lot more. To do what? Carry our medical information to store my passwords, to let me have sensitive communications with other people? That's a really interesting problem for society.

Part of it is about control and access to your own data. A quote from Richard Thiem at defcon. I don't know if you ever sit in on any of his presentations. He said, we are known better than we know ourselves with regards to the information collected about us. Yet we get very few, if any, opportunities to take advantage of that information for our own benefit. So in the model that you're describing, would we be able to capture some of the data around ourselves that are being collected on these platforms for our own benefit and determine how we want to aggregate it or how we want to analyze it? Or maybe there's the equivalent of our personal bots that nobody else sees but is able to tell me, hey, Matt, I saw you ate XYZ and then on the way home stopped and bought some Imodium. Maybe you have a food allergy or something of that sort. Where we're getting value from all this data and from our behaviors that is unexpected. Do you see that as part of this as well?

Yeah, I got a pitch once from a company that it's secure communications device. It went on the back of your phone, you know, and I said, well, you know, do you have a microphone on like. No, we don't have. Microphones can be turned into sensors. This is a secure text. So their, their security model was nailed. It was really, really good. It was just basic messaging, highly trusted type of, type of thing. I'm like, oh, that's really, really good. And then I said, what are your customers asking you for? And they're like, well, they want to use it to get on social media. And I'm like, you know, and it's. So that's the thing. It's like part of this is, yes, I want to control the data that's out there, but I really just want to be able to have a place where I can choose how I can work with and collaborate with them. You can see examples of this in our portfolio. We have a company called Enclave, which is like a secure overlay network. High sides. Another company that lets you do secure texting, file sharing and really have that. But from the vision thing I was talking about, none of them kind of are the same thing as a private network. And if you've ever been on a private network, you know what I'm talking. I have a lot of dod, I see people. It's a hard concept to bring out into the real world. We have a. Because that security model is really interesting. Right? It's just a network. I trust the computers on it, I trust the people on it. Soon as you hook any one of those computers up to the Internet, it's game over. And so I am trying to look for something. There's a science fiction, a couple science fiction movies about quantum communications. And again, if you're, if you can prove that you can do quantum communications, I will get funding. Just put it in a five slide pitch deck and you know, we can do it, but you know, we just haven't really seen anything like that. Practice in practice.

Excellent. This has been a great conversation. I enjoy every time that we chat. I do have one last kind of fun question for you, but is there anything else you would like to convey to the audience? I mean you understand kind of the community that we're interacting with. What do you think it's important for them to understand about this domain over the coming years.

If everybody in cyber can do one non cyber thing, volunteer at your church to do it. Give a talk at a high school about what a great career that is. Try to do something outside of cyber where you're the only cyber expert in the room, go do that. The world will be a better place, you'll be a better person. Because if you have struggle complaining this stuff, explaining this stuff to non cyber people, you probably don't know it as well as you should. And I think we all have to brush up on that kind of stuff. So that's my ask.

Excellent. I love, love that recommendation. So last question before I let you go. What is a recent book that you've read that you would recommend?

See, I got it right over here. I just got done reading Shards of Earth and the Big Ship at the End of the Universe. So Shards of Earth was. Shards of Earth was pretty good. It's a future world where these aliens like the Borg come in and just start disassembling planets. And it was good. I actually enjoyed this book Better The Big Ship at the Edge of the Universe. Sort of like they combined Harry Potter with Star Wars. Literally. Like everybody can do magic in like the Star wars universe. You have a lot of laser battles while they're casting stuff. It was pretty cool. I hope they make that into a movie.

Excellent. Cool. Two good science fiction recommendations. Love it. Well, thank you Ron for joining us on oodacast. Really appreciate you taking the time and as always, look forward to future conversations.

Thanks Matt. Thanks for the opportunity. Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity, technology and global risks, please visit www.ooda loop.com.