Latest / You've Been Heard / 360- Cyber Crisis turned opportunity with Jason Torrez

Transcript

360- Cyber Crisis turned opportunity with Jason Torrez · You've Been Heard

• 0:00
  Speaker A: You're not building walls to keep the bad guys out. You need to believe in your heart they're already in your house. Because you will come into the job different. You will. You will run your shop differently if you believe you're already breached. Everybody's constantly under some form of inspection or attack. But there is a day, right, the day came, where we have something real to deal with, and when I. When I contacted our CTO and said, like, this is the morning, we knew this was coming, and here it is, and you can address that calmly, even with all of the unknown. It's. It's a. Yeah, we knew it was coming. Now we're going to rally the troops.
• 0:41
  Speaker B: So, anyways, welcome everyone back to dissecting popular IT nerds. This is. I've been off for, like, three weeks, so I don't know if anyone noticed or anyone even cared. It would be great. Maybe we'll get, like, you know, maybe someone out there, like, yeah, I missed you, Phil. But anywho, it's great to. To be back in.
• 0:59
  Speaker A: In.
• 0:59
  Speaker B: Jason Torres, you know, transformational technology executive, you know, extraordinaire, executive director, Information Technology at Is it Greed Holdings. Am I getting that correctly?
• 1:11
  Speaker A: Grady? Great.
• 1:12
  Speaker B: Grady. Okay, well, that's good. Just slap me around a little bit. But I want to start breaking these shows. Go ahead. That's.
• 1:19
  Speaker A: That's very common.
• 1:21
  Speaker B: I want to. I really want to make sure that we are more effective in breaking these shows up, because I can talk forever and go off on tangents. And you had some. Well, first of all, you've had a cyber event as of recent, and it sounds like it was a successful cyber event. Not that people want to have cyber events, but we know that it's just a matter of time. It's not a matter of if. It's just a matter or when. It's a matter of when and how bad it's going to be and how well prepared you are. So. And I think you made a good point, which is when you. When you do have a cyber event and you. And it does go the way I guess that's supposed to, like, how do you capitalize upon that? So I don't know where you want to go with that or what happened or. Or how you did capitalize on that or what people can learn or take away from this, but maybe it's. Learning from a cyber event is. Is topic number one.
• 2:11
  Speaker A: Perfect. Yeah. And so, Phil, one of the things that we first started talking about is, like, it's a huge space. When I stepped in to Grady Holdings. I was hired in to integrate IT and OT and to lead the IT function, not to lead cybersecurity, but part of the kind of standard onboarding that most people do. You go around and you get as many perspectives as you can. And I saw there wasn't a really focused effort on developing cybersecurity capabilities. So from a responsibility perspective, like, you know, someone needs to step into that. And so I spoke with, with my leader, my hiring manager, 72 hours in and said, hey, like, I need to lead this, right? I mean, we need someone who's going to take point on cyber security and aligning you with business objectives. So I say that first is like, I mean, if that didn't happen, then you're certainly not positioned to be able to weather the storm of a cyber event and to come out on the other side. But, but honestly, that allowed the, the conversation with senior leaders, you know, so with our C suite, with general managers and plant leaders around cybersecurity, rallying people around what needs to happen, and starting with, like you said, it's not if, it's when. And beginning to change the perspective of, you're not building walls to keep the bad guys out. You need to believe in your heart they're already in your house because you will come into the job different. You will, you will run your shop differently if you believe you're already breached. And so when the day came, and we've had lots of, I mean, everybody's constantly under some form of inspection or attack, but there was a day, right, the day came where we had something real to deal with. And when I, when I contacted our CTO and said, like, this is the morning, we knew this was coming and here it is, and you can address that calmly, even with all of the unknown. It's a, yeah, we knew it was coming. Now we're going to rally the troops. So, so part of, like, how do you, how do you come out on the other side and, you know, with the, with the attention that you've got of board of directors, of your executive leadership team, how do you then accelerate a cyber program to better position the company? I think you, it's best if you've already started, you know, because obviously, you know, there's a couple of pieces to that one, you're more likely to be able to weather that storm. But, but you're not storytelling through the whole thing, through the whole event already. Like, you've already kind of laid the foundation.
• 4:33
  Speaker B: So let me, let me ask you this. So it sounds like it was Not a, like security was not like an expectation of the job or something that was on maybe, I don't know, a job expectations list or something. It kind of sounds like maybe like security wasn't part of your role, but it is assumed to be part of your role, is that correct?
• 4:54
  Speaker A: When I came in, it definitely was not part of the responsibilities we discussed. But, but you know how it is.
• 4:59
  Speaker B: So, so yeah, yeah. I mean, because obviously if something went wrong and you know, security took down the company and everything, who are they going to look to? And, and is it safe to assume that even if it wasn't part of your role, but if it did happen, they'd still blame you anyways?
• 5:11
  Speaker A: Oh, if it smells like technology and a manufacturing organization, yes. Yeah, there is. Some people would certainly assume you're responsible for the outcomes of that system that you own. So yeah, yeah, I mean, so I.
• 5:26
  Speaker B: Think there's just, I don't know, something to be said about, I mean, from a general leadership perspective, if you want to be successful as an IT leader, really pay no attention to the, I don't know, whatever the piece of paper is that HR gives you at the beginning that they're trying to hire for.
• 5:44
  Speaker A: I would say it is one of many inputs. Like they've just explicitly told you what they think on day minus five. But as soon as you get in there, and honestly before you get in there, whether it's a brand new company or a brand new position or just your responsibilities change, that's just an input. Someone thinks this. Now you own that conversation of saying that's accurate. That's a small subset, that's the most important. Like now you own setting those.
• 6:10
  Speaker B: Talk to me about this story in this event and what happened and rolled out for what you can, I mean what you're allowed to, you know, know.
• 6:18
  Speaker A: So a lot of this is going to be fairly common. You know, from what I'm seeing, it's still not super sophisticated. The bad guy still has to get in and in this case the bad guy impersonated a, an IT admin. Right. And so there was some social engineering. They knew enough about the company, they knew the name of an IT admin. It's not a huge company, but some simple LinkedIn, I'm sure. And it was enough information to try to communicate with a few of our office workers and that led to, you know, PC takeover. And then there's just the pre existing conditions that allow threat actors to, you know, elevate privileges to move around in a network. And so there was never in this, in this case, like the, that's the entry point. And then there was no deployment of malware. There was no super sophisticated. Once you're in, it just was leveraging existing legitimate tools. And the bad guys brought some of their own tools, but they were copies of legitimate tools, which is why lateral movement was, was possible. So we've got, so Grady has got technologies and processes and partners in place that monitor and catch this. So here's, here's the. It didn't get awful because unusual behavior was detected through our systems and services. And then that morning we've got an incident response process in place. We executed that. It came with, you know, that, that collected the information that I needed to make the decision that we would sever Internet connections to the outside world from all of our plants. And, and, and then it rolled right into.
• 8:02
  Speaker B: So like a step by step policy of some sort was in place.
• 8:05
  Speaker A: Enough to get us to the point where I could make a call. Yes. Now, it wasn't perfect and we, you know, those things are living documents. Fortunately, in 2024, Grady's Board of directors and executive leadership team supported the investment in basic governance, risk and compliance activities. So that we have an incident response. So we have risk management processes in board employees, which we exercised there. And they were successful. But, but after that it's chaos. And, and I'll tell you, we'll take some luck. And, and one of the things that I learned that where our incident response policy was our plan, I should say what, our, what our plan was a little deficient in is it happened to be that the threat actor, I think was working out of Europe. And so Grady is a North American company. When I had to make the call, when we, when we observed this malicious behavior, most of my guys were still home. And so when I severed the Internet connection, anyone in the office has lost their Internet connection. And that would have made it really hard for us to collaborate, to communicate. But it just happened to be that everybody was home. So by severing the Internet connections at our factories, all of our IT people were working remote. If we, again, if we'd have been in the office, things would have got more complicated. And so there's, that's a lesson learned. Anybody's incident response plan has to account for. If you know, how are you going to communicate if you have to sever your Internet connection?
• 9:28
  Speaker C: At dissecting popular IT nerds, we expect to win and we expect our IT directors to win. And one of those areas where we know that we can help you win is Internet service providers. As an IT director tasked with managing Internet connectivity, few vendor relationships can prove more painfully frustrating than, than the one with your Internet service provider. The array of challenges seems never ending. From unreliable uptime and insufficient bandwidth to poor customer service and hidden fees. It's like getting stuck in rush hour traffic. Dealing with ISPs can try one's patience even on the best of days. So whether you are managing one location or a hundred locations, our back office support team and vendor partners are the best in the industry. And, and the best part about this is none of this will ever cost you a dime.
• 10:20
  Speaker B: What conversations would you have had with your peers that no one else in the company would have had any clue what you're talking about? And the reason why I asked that is sometimes when you get a bunch of IT guys together and if, if you're, if your C levels are sitting like, kind of like, like a fly in the room, like listening to the conversation, they would have absolutely no clue what, what you guys are saying. So I, in other words, so if you had a group, if you had some peers, you know, to bounce ideas off while you're in the situation, like what would that conversation look like? I'm just curious, like, is there, is there anything sophisticated in there you're kind of curious about? Like, I'd just love to dig in on this because I don't know, it's just cool. And there'd be no one else I could talk to about this.
• 11:00
  Speaker A: Yeah, well, so I would, I guess there's two pieces to that that I, that I would want to address. One is on the technical side, like being able to go through that vast amount of all of the logged events that you have, whether it's the network. And we've got a small network team, so they're the only ones that can make sense of suspicious data transfer activity and what's legit and what isn't. The. We needed to process logs from all of our servers to figure out which accounts we're using, which things. And so we're doing like extracts, log extracts, and we've got a small group of people that know how to analyze that stuff. We've got our own EDR tool in place and you have to have the working knowledge of that to make sense of those logs. So we don't really have a full on SIM which aggregates and tells us right now or at the time of this event. But so there's that, right, there's that piece of it. We've got lots of different disciplines, small Teams that are trying to make sense of their data and then to have the conversation across the. Until, like to connect all those dots. Right. So there's that part, the other part on our senior leadership, on our plant general managers, that's not telling them anything about the impact of the business. Like they have no idea. We have to, we have to help them understand. When I sever an Internet connection, what's it mean to your ability to make and ship parts? And, and so there's a learning on the IT side about knowing when the Internet goes down, you can do everything you want, but you're going to have a problem printing, shipping labels. So you're going to have a problem at eight hours.
• 12:32
  Speaker B: Yeah, yeah. So how long was the, how long was this? I don't know. What do we want to call it? SNAFU.
• 12:42
  Speaker A: I think of it in like three different timelines. There was the 24 hours, but real.
• 12:48
  Speaker B: Quick, you said, you know, it was a known actor also. So like, what was it? What was it again?
• 12:53
  Speaker A: Cactus is the name of the bad actor, the threat actor that, that, that we were involved with. But there's there's many, many, many of them out there. I mean, this was a big learning experience for, for all of us. So I would look at like there's the first 24 hours. There was the time when we identified the activity was going on. We separated in connection and we were figuring out what's it mean to the business. We knew very quickly that there was no production impact. We could continue like our factories were melting iron making parts and could ship parts of. We found out that one issue was going to be with those printing and shipping labels and that's because our ERP is in the cloud. But this goes back to kind of risk management, the conversation from the top down on what are your key business processes that drive revenue and how do your information systems support those? We need to know that up front. So we within 24 hours have resolved the print issue. And so we're building and we're shipping. No customer impact. That's, that's remarkable. And so that was, that in itself was an enormous win. So that's the first timeline I think of like getting to the point where we know our customers are going to get their parts on, on time. Then there is the period of forensic investigation. There's the period of the conversation with our customers on what happened, what's it mean to you, what are we doing? And so, and in that period, you know, you'll have some customers who are severing EDI orders who are severing or are disallowing, you know, your email, any collaboration. So they're waiting for basically a letter of attestation from someone saying that the company is safe to do business with again. So that period took about two weeks, about two weeks of as 17 days. You know, those were, those were pretty much 16, 17 hour days for about 17 days straight to get through all of the data collections collection, to do everything you need to do to remediate any of the indicators of compromise, which in this case it was, we had to rebuild some servers that, you know, as, as, as is the case with, with many of these you find things that indicate there was some level of compromise. You restore from backups and, and all that stuff. So that was about two weeks to where we had all of our Internet connections back up. All of our customers who had been working with us through this have restored email, EDI and all that stuff. And then the third, I'd say still ongoing, which is what did you do after the event? So now there's other things that you need to do after you've restored all services, which for me I'll share. One of the big learnings that I had out of this is for companies who have cyber insurance policies. When you need to enact, when you have to execute that, your cyber insurance carrier is probably going to bring in an incident response team. That incident response team is going to need certain tooling to be able to see the forensic evidence to in the end send the letter of attestation. If that's not lined up before, you are lining that up from legal paperwork to the deployment of tools in the middle of the fire. And you don't want to do that.
• 16:13
  Speaker B: All right, so explain that a little bit more detail. So just in real layman's terms, guys, do this so that this doesn't happen.
• 16:19
  Speaker A: Yeah, so one, you know, if you have a cyber insurance policy, make sure you understand the terms and conditions. You need to understand which incident response company is going to get pulled in in the event that you actually have an event and you didn't know which EDR tool that cyber insurance or that incident response team is going to require that you have deployed to collect the evidence so that they can confirm and write that letter of attestation. And if that's it, again, if it's not lined up, what you will find is that you're going to be working through legal agreements and the terms and conditions of those legal agreements. You might be deploying new tools across your environment and While you're just trying to do the forensic investigation and just restore. And it's, and it's for the right reasons, but so be proactive. And this is, you know, something that we are working on now to make sure it's all lined up. When we work with great people, we work with great people and great teams, it is no slide at all. I mean again, we were, we were fortunate to have weathered this well.
• 17:17
  Speaker B: But so how do we capitalize on all this? I guess the question. And you know, we had talked last time about influencing executive management without really telling how is this all. How is a negative, a positive? I guess. And how do we, I mean 16 to 17 days to remediate and get customers to like accept you again, is that, is that good? Is that bad? Is that, how do we, is that, is that normal? Is that, is that, you know, better than average? What. You know what is that? Because 16 to 17 days in the manufacturing world of people not buying from you or something like that I would imagine could be a little painful.
• 17:56
  Speaker A: Oh yeah. Well, and this one again, the fact that no production impact is enormous. So you can find data in lots of different places. I like the Verizon data breach. There's. There's a tons of reports that'll give you different metrics. I think you can safely say that the average time of. Let's call it an actual. If this had progressed well.
• 18:15
  Speaker B: Hit, hit on a couple because that might be helpful to some people. So you got Verizon data breach. What else do you got? Let's just hit on a couple of those. Cause it might be nice to bullet.
• 18:21
  Speaker A: Point here in the episode trying to think of some other ones. I mean that's the one that I would start with.
• 18:25
  Speaker B: That's the only, I guess chatgpt on that one.
• 18:30
  Speaker A: I'm liking perplexity a lot lately.
• 18:32
  Speaker B: That's the one I use Perplexity for cooking recipes. I'm just telling you it's nails. Nails it every time people are like, you are an amazing cook. I'm like, hey, this is the first time I did this.
• 18:42
  Speaker A: First time I did this anyways, so well. So I, I would say okay to capitalize on it. Ideally, you've already built a foundation, right. So you kind of know this is what I would. How I approach it. Like I know what, how I tend to operate and what some of my strengths are. So I played at those. When I'm trying to build the foundation in advance about in this case a cybersecurity program. I also for that foundation you got to learn the business, right? You got to know what the business is trying to become. That vision. You need to know what the board of director and the executive management teams goals are for the company. You need to understand the strategy. You got to align IT and cyber security strategy to that, right? So already. Already be talking why would we do cybersecurity? It's not, it's not an IT to protect IT systems. You know, it is in the case of Grady. When I joined Grady was the second largest North American iron cast manufacturer. We wanted to be one part of the way to do that was our i4O program that requires security. You know, there's, there's a. I. We want to keep the business out of the news, right. Avoid these events as much as it's possible, you know, and the impacts of those. So part of it is build the foundation up front, talk the language of the business, understand what the business is trying to accomplish, align in this case cybersecurity strategy to that. I think that's, that's. And you have to own that conversation. As we talked about before, when I was brought in, it wasn't explicitly stated, hey, you need to tighten cybersecurity up to protect the company. It was that fell in with what I thought someone needs to do and who's most qualified to do it. Well, I'm not an expert in the world on it, but probably I'm going to take that and put some shape to it. So if you lay that foundation when you get into the event, you're positioned to be able to talk about what do we need to do to first as best we can, prevent the next event from occurring or minimize the impact of the business. And that's the way that I talk about it.
• 20:42
  Speaker B: And what was the response of executive management?
• 20:45
  Speaker A: It's been overwhelmingly supportive in the. One of the asks that I had of our senior leaders is you have to provide air cover. So not everyone's going to understand what's going on with this and there's going to be a lot of problems out on the floor. Even though we can make and ship with Internet down, there are inconveniences. And one thing that, you know, I had to, I had to say this is what support looks like. General managers and executive leadership team. Everything else is deprioritized. And if you hear of clever people trying to find ways to restore Internet connections via hotspots or whatever, stop it. Can't do that, right? Because people are, they're gonna try to solve their problems. So one, everybody Demonstrated an understanding and support in the moment. Beautiful. And then on the, on the other side, as I begin to present, okay, these were the activities that we conducted during the event to get us through it. This is what we found and to best position us to prevent or to minimize impact in the future. This is what we must do. So the alignment of cyber insurance carrier with the incident response team with the EDR tool, that's me coming to leadership saying that cost us time. And in an event, you know, that old adage of time is money. There is an incredible magnifier in an event regarding time and money. If you are wasting time in an event, the threat actors can. It's just massive the impact that can happen in a short amount of time.
• 22:23
  Speaker B: Right. So that the. I almost want to have, I think, a roundtable around. A roundtable event around all of the things that you learned from a cybersecurity event that you didn't know before the event that you should have had in place after the event. Would that be useful?
• 22:40
  Speaker A: Oh, yeah. And so I think that's great to call out. It's also important to know you are not alone. So, you know, you might, some leader might feel the drama to focus on the problem and not deliberately, but effectively go it alone. And that is not what needs to happen. You are surrounded by your partners and ideally you've built relationships with other peers out in your network that can help you navigate this every step of it.
• 23:15
  Speaker B: We need like an emergency button in the community. We need to like, like a red alert, red alert. Someone's having an event who can come to the table right now and help. And help, I don't know, brainstorm this or Word, I don't know, whatever it is, Cyber Smith this or something like that. But was there people that you, Was there anyone that you were able to call on outside that were. Outside of. Maybe the like. Is. Is there people that you call on in times like this that are very helpful?
• 23:39
  Speaker A: Absolutely. Right. So. So one, your formal partners, you know, and the people in this case that you get, that you get kind of assigned to work with those. Those people are there to help you. So Grady partners with Trend Micro right now for EDR and mdr. And so they're, I mean, and they were wonderful the way that they partnered with us around the clock until we got to a good position. The IR team that we worked with through, through our cyber carrier Iron Gate, can't speak highly enough about them. They did a wonderful job at what they were doing. But, but for me, you know, I'm, I'm part of Society for Information Management Detroit, a wonderful organization here in southeast Michigan full of leaders who support each other. I'm a part of the CxO Forum and CSA. So there are these, these organizations that, that I highly encourage everyone to plug into. Like my take on those is you are part of a network whether you like it or know it or not. So go figure out how they work and meet the people and understand how those systems work. And, and so it's sensitive conversations, right. So you can't have like all details out on the table but you know, you can reach out to and you can say I'm in a situation right now and so, you know, other ciso can you meet with me and talk through effective communication? Like I reached out to several. I reached out to one person in particular and I hope she doesn't mind me mentioning her name. But Darlene Taylor is a wonderful person. I reached out to Darlene. She connected me with a few other people who were wonderful enough to share their time as we talked through the preparing for the post event. Like how was it on the other side? You make sure that with the attention that you have, you address the gaps that you must.
• 25:21
  Speaker B: And let's touch on that. So capitalizing on or post post cyber event or capitalizing on a post cyber event, was it a, was it a PowerPoint presentation in front of a board? What was it? What did it look like?
• 25:34
  Speaker A: Uh, there were a couple of slides, but more of it was, more of it was the daily conversation that I was having with our C suite through the event. You know, it wasn't, it wasn't a waiting for. It's. We're a relatively small organization, around 2,500 people. It's a billion dollar revenue company. But, but I'm you know, in daily conversation with RC suite and so so through that having a pulse on the conversation and then to the best of my ability sharing the impactful information of what do we need to focus on again? I very much focus on what are we going to do to prevent it from happening again and when it happens again what are we going to do? Minimize the impact and dollars and dates and most impactful to least impactful and like I think that's.
• 26:26
  Speaker B: Is there any one thing that you that like the biggest learning or biggest takeaway from. From this. I mean I had all kinds of bullet points for us to talk about. We were going to talk about, you know, real AI versus use cases and everything and would AI have saved the day here and XYZ AI guys, how could, how could AI have saved the day here? I mean, what did it have, you know?
• 26:48
  Speaker A: Yeah, well, so I now I'm doing lots of evaluations on the tooling but for me, okay, so that alignment that I've mentioned several times, that's a big thing and it's something that everybody can do and it's something that can save you time and can position your incident response team to be able to see historic telemetry data as opposed to coming in and dropping a tool. And I'll be able to see from today forward which is only has certain value. So that's that. That is a big one. Go do that if you haven't already done it.
• 27:17
  Speaker B: What does that look like specifically?
• 27:19
  Speaker A: Okay, so I'll give you some names on this. If you work with the cyber broker, cyber insurance broker, find your cyber insurance carrier. I would initiate the conversation and say I want to proactively align my insurance carrier with my instance or response team and with my EDR tool because. And ideally I want to discount on my premium because I'm picking your preferred vendors. So put me in touch with two or three of your preferred vendors on. They're already going to tell you the cyber insurance carriers. Right? That's what the broker does. But then ask them, put me in touch with two or three of your IR teams that you preferred IR team. So it's going to be Arctic Wolf, it's going to be Kivu. It's going to, I mean there's a handful Iron Gate. I don't know all of them and I'm not pretending to be an expert in this space, but this is based on my experience. So go have a conversation with them, talk about the retainer fees. Talk about if you can use the fees you're paying for retainer to apply to things like pen testing and tabletop exercises, the stuff that you're going to need to do anyway. But if you don't have an event, don't just give them your money and do nothing. They will let you spend that credit down on stuff that you need in other areas of cyber. And then you have to talk through what's the supported EDR tool because again, you don't want to be in the middle of it and then have them tell you, oh, if you don't have CrowdStrike installed, go install CrowdStrike and no knock on any of the tools. Right, but, but I'd ask him the same thing. What are the EDR tools that your IR teams are going to require be installed when, when they get engaged and then you have to have this discussion around, okay, does my tool fit? If it doesn't, can they go get to be a preferred tool with the IR team or whatever? Right, but you gotta, you gotta have that and there's costs associated with that. But that goes to the story that you're telling of times money. And if you're gonna spend a little bit of money upfront, well, maybe here's this. And I feel like I'm scattered around. Here's a look.
• 29:04
  Speaker B: This is nice. This is very nice because this is kind of like unifying everything into one box and making it kind of like this streamlined security packaging of some sort, if that even does exist. But it does exist, but it doesn't exist. You know what I mean? In other words, everyone should be playing together in the same sandbox nicely, is essentially what you're saying.
• 29:23
  Speaker A: Yeah, yeah. Well. And yeah, I think part of what we can talk about regarding tooling and roadmaps will fit into this. But, but here's, here's the thing that I learned. If you have an event, you are going to pay somebody, right? You're either going to pay the threat actor because they got all the way to ransom, right? You're going to, maybe you pay a, maybe you don't, right? Or you're probably going to pay your partners. You're going to pay your partners to make sure that you've got the tools in place to prevent it from happening, or you're going to pay your partners to help you remediate all of those things after the event. So you're paying no matter what, you're probably going to pay the threat actor a hell of a lot more than you would pay your partners to get the tooling in place. And so, so I think that's another takeaway I, that I got on this. Now, we didn't have to.
• 30:08
  Speaker B: Yeah, no, no, it's, it's, it's actually, it's beautiful. It's straight to the point and I think it's very clear, which is, is this alignment of all these things. And if you didn't do it ahead of time, then you would have wasted double or triple that amount of time kind of like stumbling over your feet during the event, trying to get these different things in place. Is there anything just, just in general before we wrap this up? Because I think it's a beautiful conversation and you know, we had talked a lot just, you know, behind the scenes about, you know, you know, influencing executive management without telling and in a way that they understand and get excited and because you can't just use all the same terminology that say, I don't know, real high level IT guys use because they would gloss over and get lost. And you had mentioned taking responsibility and then we'd also, I had written down some notes on last time that was, you know, what do you do when you know what you have to do but you can't do it? Yeah, that's because it wasn't, you know, it wasn't approved in the budget or something like. Because I don't know what I don't, I don't know. But I'll leave you with those thoughts and you tell me what's your first thing that comes to mind, the thing.
• 31:19
  Speaker A: Well, that I'll just jump to that, that last question because that's the most recently asked. Ideally you've already got a plan B and a plan C and a plan B. And so if you don't get to do what you want to do because you know you need to do it, hopefully, like we've been through this enough times to know more than, you know, you don't always get what you want. So. So hopefully you've thought through. If that's not going to play out like that, then what I think one of the notes that I took as I was thinking through that is that's an opportunity to go back to know how you want to show up at a moment like that. Right. So you're a leader and people are watching you and that's an opportunity for you to demonstrate leadership. Like you and your team probably came up with a good logical plan and now that can't be the way that it operates. And you could go back and complain and blame and waste time and show no responsibility. Right. Or you could go back without complaining and blaming and you can say the world's changed. What, you know, the assumptions we made are not valid anymore. And so because of that, we're going to do this or again, go. And one of the other notes I took was, you're not alone, so don't tuck into your shell, but instead reach back out. And that could be your, you know, your partners in the business. It could be, you know, the. If it didn't go the way that it needed to go, is it because people didn't understand? And if they didn't understand, that's on you. You own that it. If it's because of budget, well, that's the world we live in. And so what are you going to do? But I think you could also look at reaching out to your partners outside again, like, hey, let's talk through this situation. Can I get some guidance? What do you think about. But you own it, right? I mean, I think again going back to how do you want to show up at the moment, that could be a career defining moment. It could be a time that rallies the team around and shows them that they're capable of embracing and like thriving in that kind of a situation. That could be good opportunity.
• 33:14
  Speaker B: What's the environment year? What's your general feeling this year? I'm just curious. I mean we're, you know, we're through March, we're through the first quarter of the year. What's your general feeling about just manufacturing the United States IT jobs in general? I kind of, I mean I kind of get the feeling that, that hiring is down or I don't. Or is there going to be a.
• 33:40
  Speaker C: Where are we at right now?
• 33:42
  Speaker A: Okay, I'm no expert here. I'll throw some things out but I'm certainly biased over, you know, the past week of events, two week of events with tariffs and things like that. So my take on that is there's a bunch of uncertainty that's out in the market right now and until we get to some stable, some understanding of like where is this going? I think there's going to be that volatility which is, and I think fear is going to prevent some investment. That's my kind of guess. Right. There's, I think there's going to be the leaders who are kind of like, man, let's see how this plays out.
• 34:13
  Speaker B: Yeah. So then you being one that is response able and ability to choose your own response as IT leaders, what do we do? Just keep managing and hoping, hoping we have a job next month or no. But you know, maybe it's like what, what should we be doing, you know, to survive? To survive because I've got people that, you know, are still looking for jobs. I've got people that are still, you know, whatever company shut down, there was a merger, I was made redundant, like you know, whatever it is, or I just what should we be doing as IT directors to take over the world?
• 34:50
  Speaker A: I'll still throw a few things out and I probably hit this from a few different levels. But so one regarding I our people like, you know, I think our, our value is not determined by whether the current employer can employ us. You know, I think our value is determined by what's your skills and, and are you investing in, you know, in your development? I, I would encourage everyone have an opinion on what you think the most valuable skills are right now. I would, you know, given my recent experience, I'm probably going to be biased towards cybersecurity as a space that's going to have demand and good cyber folks are, I think it's still the demand versus the availability is, is, is heavily in favor of those with those skills. So cyber is a good place to go to go skill up in I think certainly data and analytics and if you want to call it AI, all that stuff. But I think that that's a space that you see is going to be around that's not going anywhere. So, so I think have an opinion on where you believe skills are heavily in demand and then go skill up in those areas. Find not only like, you know, go take the classes and things like that, but you know, have a conversation with your, with your leadership and with your peers around. Are there opportunities for me to plug into business activities where I can skill up in this space, like align my career development aspirations with business needs? So I think there's stuff that you can be doing over on that side regarding our people.
• 36:22
  Speaker B: Now because there is a lot of, I mean there's a lot of AI hype, but there's a lot of AI reality as well, which is how much time before many things are made redundant and how do we leverage that?
• 36:36
  Speaker A: Yeah, yeah.
• 36:38
  Speaker B: For everyone, for everyone out there listening. We do have our AI for everyone that's been on the podcast that's part of our secret community invite only that. I want to just remind everyone that if you've ever been on Dissecting Popularity Nerds and you're in the community already, which we've got about 124 CTO, CIOs, whatever in the community. The AI Roundtable event is coming up and you can go to the events section and sign up for it. The actual date of that event is Wednesday, April 23rd, 11 o' clock Eastern, I believe. Is that right? EDT? No, no. What's EDT? No, no, it can't be. It must be like 3 o' clock Eastern and like 11 or 11 o' clock or something specific. But because I'm traveling right now, I'm. I don't know what time zone I'm looking at, but anyways, it's in there. The AI Use Case Roundtable, Wednesday, April 23, which is going to be a great event. I think we've got, I know we've got dozens of people signed up for it already to come and just talk about hype versus reality and What AI use cases have actually been implemented like real AI use cases? Not just the hype. How is, how have people used AI to actually make a difference? Which to your last point there, scaling up in either cybersecurity AI and then obviously data and being able to take company data and make sense of it and I don't know, do stuff with that to grow the company and become billionaires. I guess that would leverage it's value inside the company. Jason, it's been an absolute pleasure having you on the show. Any final thoughts or words of wisdom or anything like that?
• 38:13
  Speaker A: Just to follow up on what your last topic was. So I'll mention I read a great PDF several years ago called the Mediocre Programmer and I think it's from a programmer that's based out of Ann Arbor. I wish I could remember the person's name but. But anyway, the person clearly is not a mediocre programmer. But the thing that I love the most about that is about his prescribed way for learning big topics. So he talked directly to me when I read, you know, you start learning something new and then you read seven paragraphs in and you've already seen five things that you don't know. So you're like, man, am I ever going to get this. So his his way that he proposed to learn something big like AI is okay, pick something, right? Go figure. You're going to learn one aspect of it and have a notebook that you're tracking of the terms that you don't understand and write it down every time. And if you do that, eventually you're going to write down the same terms. Some of them are going to be multiple times and you can basically just count the times that that topic comes up. That's the next thing you should go learn. So it helps you to break down a big massive topic like AI or machine learning or these things and not feel overwhelmed and hopeless about being able to actually learn it. So the Mediocre program, I'm pretty sure it's a free PDF that's out there, but that I use that learning method for these big things. And again, not that I'm just a. I'm certainly not selling Perplexity, but pair those two things up and I mean you can get a plan.
• 39:33
  Speaker B: I. Yeah, I mean seriously, I started out with perplex. Perplexity. Give me an award winning sweet potato pie recipe. And I made that sweet potato pie and it came and I gave it to my friend from Jamaica who loves sweet potato pie and he was like, this is the best pie I'VE ever had, so. And that, you know, that's. That's saying something. And then I use it for many other recipes. And so that's my secret. That's when I have to. When I have to cook dinner at night.
• 39:58
  Speaker A: That's.
• 39:58
  Speaker B: That's my secret weapon.
• 40:00
  Speaker A: Great speaking with you. I've been looking forward to this conversation for quite a while, so thank you.
• 40:04
  Speaker B: I'll stay. Thank you, sir.