Latest / Identity at the Center / #249 - Cyber Insurance with Jason Rebholz of Corvus Insurance and YouTube’s Teach Me Cyber

Transcript

#249 - Cyber Insurance with Jason Rebholz of Corvus Insurance and YouTube’s Teach Me Cyber · Identity at the Center

• 0:05
  This is identity at the center. If it has anything to do with
• 0:10
  IAM, this is the go to podcast now your hosts Jim McDonald and
• 0:17
  Jeff Stedman. Welcome to the Identity at the
• 0:22
  Center podcast. I'm Jeff and that's Jim.
• 0:24
  Hey, Jim. Hey, Jeff, how are you?
• 0:26
  Oh, not so bad yourself. Good man.
• 0:28
  Just getting off a four day vacation, a four day holiday.
• 0:33
  You know, it was Thanksgiving in the United States and I actually
• 0:36
  did some cooking, so I cooked a Turkey.
• 0:40
  I get this. So my younger son, he's 16, he's
• 0:45
  dead. Everything's really good in this
• 0:47
  Thanksgiving dinner. But the Turkey's dry like boom.
• 0:54
  It's definitely. Not good.
• 0:55
  It's definitely an art to cook a Turkey.
• 0:56
  I let me think I didn't cook anything.
• 0:59
  I ate things, I cleaned up. That's usually my what I do is
• 1:02
  is helping clean, but I also had family in town, so they actually
• 1:06
  did a lot of cleaning too. So yeah.
• 1:09
  Yeah, I remember, you know, growing up as a little kid and
• 1:13
  just like all the men would just go out and watch football and
• 1:16
  you know, sit there and now it's like you become an adult and
• 1:20
  you, you have to chip in, man. Yeah, we had a pretty decent
• 1:24
  turn out, I think. So it was mostly my wife's side
• 1:26
  of the family. It was actually all my wife's
• 1:27
  side of the family and my aunt in our place here in North
• 1:31
  Carolina think it's the biggest gathering we've had for family
• 1:34
  since we moved here. It was good.
• 1:36
  We watched football day eight and just kind of connected and
• 1:40
  talked and stuff like that. People from out of town came in
• 1:44
  on my wife's side, so it was good.
• 1:46
  Now I'm taking my niece back to the airport in about an hour.
• 1:49
  So we want to make sure that we get that like we get wrapped up.
• 1:52
  So I can send the last of them on their merry way, and then
• 1:55
  next week and I can actually have maybe more of a vacation.
• 1:58
  Yeah, well, I think it's like a little taste of the upcoming
• 2:02
  holidays. So it's always tough coming back
• 2:05
  to work after four days off, especially when you know, you
• 2:08
  know three or four weeks into the future you're going to have
• 2:10
  a a nice couple of week vacation, but still excited to
• 2:14
  be here doing the the podcast. Just excited to be happy to be
• 2:21
  alive, Happy to be alive. But yeah, our guest today is
• 2:26
  pretty special. He's somebody that I've been
• 2:28
  seeing and following a lot on LinkedIn.
• 2:31
  He's like a burgeoning industry celebrity.
• 2:34
  He's got his own YouTube channel and everything.
• 2:36
  But you know, I don't introduce the guest.
• 2:38
  That's your job. Yeah, let's let's get introduced
• 2:41
  in a second. I do want to point out that when
• 2:44
  people hear this, I will have already attended the.
• 2:47
  My Identiverse regional event in New York City which is taking
• 2:50
  place on December 1st, so people here this will be December 4th,
• 2:53
  but there is another regional event taking place in Chicago on
• 2:56
  December 5th. So hopefully be able to check
• 2:58
  that out if you want to get in free.
• 3:01
  Not that you have to use our link because it's free anyway,
• 3:03
  but it shows support for our show.
• 3:05
  We'll have a Bitly link with our codes to be able to kind of show
• 3:08
  support for that, but I actually had some people ask me if I'm
• 3:10
  going to the Chicago one because I think people will just assume
• 3:12
  I'm still in Chicago. And no, I will not be there.
• 3:15
  I do not live in Chicago anymore.
• 3:17
  I'm actually going to the New York City one and I will have
• 3:19
  already attended. So maybe the next time we
• 3:21
  record, I'll have some thoughts on sort of that conference and
• 3:24
  what it was all about because I think it's the first time they
• 3:25
  were doing it. But why don't we get to our main
• 3:28
  topic? We're gonna talk about cyber
• 3:30
  insurance. We've got Jason Rebholtz, He's
• 3:32
  the Chief Information Security Officer at Corvis Insurance and
• 3:35
  the Teach Me Cyber YouTube channel.
• 3:37
  Welcome to the show, Jason. Hey, thanks for having me.
• 3:40
  Thanks for taking the time. Jim mentioned you've got a few
• 3:42
  different, you know, irons in the fire.
• 3:44
  It's always great when we see content get on there.
• 3:46
  I mean, Jim and I are big fans of YouTube, so we're definitely
• 3:48
  gonna get into the YouTube channel.
• 3:50
  But we always like to find out, you know, where I guess started
• 3:52
  from a kind of a background or origin story perspective.
• 3:56
  How did you get into the field of cybersecurity?
• 3:58
  Yeah, it was. It's one of those things that
• 4:00
  was just a complete accident. I I started off early in high
• 4:03
  school where I was learning how to program and I just was not
• 4:08
  into it. I mean, I could do it, but I
• 4:09
  just did not enjoy it. And so my my teacher at the
• 4:13
  time, who I I still keep in touch with, said hey, you should
• 4:16
  look at computer networking. And then that led into me
• 4:18
  discovering the security aspect of it and I just went down the
• 4:21
  rabbit hole and so. You know, if I look at my
• 4:24
  career, it's just a a series of just insane timing and crazy
• 4:30
  opportunities that came my way. And I just jumped on those.
• 4:33
  And so, you know, I went to school before computer security
• 4:37
  was a thing. And so I got a background in
• 4:40
  computer networking, systems administration and security
• 4:44
  baked into all of that. And then, you know, got my first
• 4:47
  job at Mandiant. I applied for a job I wasn't
• 4:50
  qualified for and they just started looking for college
• 4:53
  hires at that time. And so that really kicked off my
• 4:56
  incident response career and you know, just completely loved it.
• 4:59
  And you know, one thing led to another where I did a bunch of
• 5:02
  startups. And you know, that's how I found
• 5:04
  myself, where I was building incident response companies and
• 5:08
  then ultimately got burned out doing incident response and
• 5:11
  said, you know what, let me give this siso thing a try.
• 5:14
  And you know, all these things and the culmination of
• 5:17
  everything I've done in my career really led me up to the
• 5:19
  perfect opportunity at Corvis Insurance, where I spend part of
• 5:24
  my time doing internal security. I spend part of my time doing
• 5:28
  and running a threat Intel team to see where these threats
• 5:31
  going. And then I spend part of my time
• 5:34
  supporting our risk advisory team, where I like to think of
• 5:37
  it as how can we do security for 10s of thousands of companies,
• 5:41
  really supporting them and their security programs.
• 5:44
  And so I I'm just somebody that I've got to be doing a lot of
• 5:47
  different things to really kind of keep myself engaged.
• 5:50
  And when I found myself leaving the IR world, suddenly I wasn't
• 5:54
  working 80 to 100 hours a week. And so I was like, I guess I got
• 5:57
  to fill that time with something and, you know, stumbled into the
• 6:01
  game of, you know, creating content for LinkedIn and then
• 6:04
  ultimately YouTube. And you know, that's that's how
• 6:07
  I keep myself busy these days. So tell me a little bit about
• 6:10
  Corvus Insurance. Is it a speciality provider or
• 6:13
  is it a large firm? I don't want to turn this into a
• 6:15
  commercial, obviously, but help me understand sort of like the
• 6:18
  position you're coming from and your mindset.
• 6:19
  As kind of, yeah. So Corvus Insurance is a cyber
• 6:23
  insurance carrier. So that is what we do every day
• 6:27
  and it's all we do. And so the cool thing about it
• 6:31
  is you know a lot of people think about insurance companies
• 6:34
  and they think of like these stodgy companies that don't
• 6:36
  innovate everything like that. And so we actually are part of
• 6:40
  the insure tech industry, meaning we are bringing
• 6:44
  technology to bear into how do we underwrite risk.
• 6:48
  And more importantly for me at least is how do we actively
• 6:52
  manage risk for our policyholders.
• 6:55
  And so you know part of this is we have an external scan that I
• 6:59
  know everybody hates. You know it's just a very
• 7:02
  pinpoint thing in security. We're just looking at the
• 7:04
  external side, but it's how do we take that information and tie
• 7:09
  that into the ability to predict the the likelihood of somebody
• 7:14
  having an incident and the severity of that incident.
• 7:17
  So it's a security tool in some sense, but you know security is
• 7:22
  secondary to how do we collect this information, then look at
• 7:25
  all of the security information behind that and tie that into
• 7:29
  traditional underwriting practices to really get a tight
• 7:32
  machine built there. And so, you know, that's kind of
• 7:35
  the start of it. But where I really nerd out is
• 7:38
  how do we take this information and really drive the most
• 7:41
  effective security controls for a policy holder so that we can
• 7:45
  say definitively, hey, companies that don't have this control are
• 7:49
  three times more likely to have a security incident than
• 7:52
  somebody that that doesn't have that or that does have that.
• 7:55
  And so that's where it gets really fun is you can really
• 7:58
  drive the conversation forward with data and you're really
• 8:02
  levelling in the bar and just inching that up and up and up
• 8:07
  over time until we really just create more secure companies or
• 8:11
  at least help people get to a more secure state.
• 8:14
  How much influence do you have on, I don't know, requirements
• 8:18
  for cyber, cyber insurance? Do you, you know, kind of go out
• 8:22
  there and say, hey, here's the things that our, you know,
• 8:24
  policy writers or adjusters or whatever it might be, need to be
• 8:27
  considering? Do you get involved with
• 8:29
  questionnaires? Do you?
• 8:31
  I guess you know, tell me, how much, how much pain do we need
• 8:34
  to associate with you when it comes to getting those getting
• 8:37
  those questions filled out? This is the interesting part and
• 8:39
  I think this is something that nobody appreciates, at least I
• 8:42
  didn't before I I started at an insurance carrier.
• 8:45
  And so, you know, I, I came into the insurance industry thinking,
• 8:49
  oh, we're going to update all the applications and we're going
• 8:52
  to get all this great data and we're going to make it so much
• 8:54
  easier for everybody. And then you realize that you
• 8:58
  are one small player in a very large industry that is doing
• 9:04
  something the way it's been done for hundreds of years.
• 9:08
  And so that's where you get. Kind of the, the, the headwinds
• 9:12
  in the insurance space is it's slow to change for a reason
• 9:15
  because you know a lot of things they're doing have worked for a
• 9:18
  very long time. But the interesting thing in
• 9:20
  cyber is in order to really push the bar on required controls,
• 9:26
  you have to be somewhere in the same playing field as the other
• 9:29
  carriers, right? Because at the end of the day,
• 9:31
  you're still running a business of an insurance carrier.
• 9:33
  And so if you put too many controls in place or create too
• 9:37
  much friction on, you know, trying to get a win a policy
• 9:41
  with somebody, they're just going to go to somebody else.
• 9:45
  And so it actually is a really interesting forcing mechanism to
• 9:48
  say what really matters in security because instead of the
• 9:53
  100 controls that would be on my wish list, you know I got to
• 9:56
  pick 10 or 15 and maybe I'll get one extra control every year
• 10:01
  that we want to push. And that's a really good balance
• 10:03
  between the underwriter and the security teams to make sure that
• 10:07
  we are being stringent. So it doesn't become, you know
• 10:09
  what third party risk management is today where you have a
• 10:12
  questionnaire that's 250 questions long and maybe 15 of
• 10:15
  those actually matter in the grand scheme of things.
• 10:18
  And so that's that's kind of the fun of it is you really kind of
• 10:21
  force yourself to pick the right bets.
• 10:24
  And you've got this YouTube channel now.
• 10:26
  It looks like you've been doing it for about a year.
• 10:27
  How long have you been in the? Cybersec content.
• 10:32
  You know, creator or game. So it's been.
• 10:35
  About two years now. I think it'll be two years in
• 10:38
  February. And it it started when I was
• 10:42
  building out the threat Intel program for Corvis.
• 10:45
  Because it's like the the origin story here is I was literally
• 10:49
  reading a an article on on one of the popular news sites.
• 10:54
  And I won't say who it is, but I'm reading it and I'm like this
• 10:59
  is one of the most advanced things I've ever read And I've
• 11:02
  been in security for a long time.
• 11:04
  I was like there is maybe 1% of the security population that's
• 11:09
  going to understand what's being said here.
• 11:11
  And I and I would go as far as to say the person writing that
• 11:14
  article had no idea what they were talking about because it
• 11:16
  was just way too advanced. And so I was like, you know
• 11:19
  what? I'm reading this and I have a
• 11:21
  much simpler take on it. And so when I look at my
• 11:25
  background doing incident response for over 10 years, my
• 11:29
  whole thing was, how do you take an enormous amount of
• 11:33
  information from everything that you're investigating it and boil
• 11:37
  that down into a package that ACEO can understand to make the
• 11:42
  most informed decisions? And so my superpower really
• 11:45
  became, how do I take all this technical stuff and decipher
• 11:49
  that for a less technical audience so that they can be
• 11:52
  effective in their job. And so I said, you know what?
• 11:55
  I'm reading this stuff anyway. I might as well just start
• 11:57
  posting some LinkedIn posts on it.
• 12:00
  And. And that was it.
• 12:02
  It started from there. And I started gaining some
• 12:04
  traction. And then I met somebody, this
• 12:07
  guy Gary Riddell, who's became a really good friend of mine.
• 12:10
  And he said, hey, you should, you should look at a YouTube
• 12:13
  channel. And I was like, you know, that's
• 12:15
  that seems, you know, ridiculous and whatnot.
• 12:17
  And so I think it was October of last year.
• 12:20
  I was like, all right, let me just give this a shot.
• 12:22
  And I did my first video where I did 0 editing.
• 12:25
  I was just like, I'm going to do this in one take and just see
• 12:27
  what happens and then, you know, curiosity gets gets a hold of
• 12:31
  you. And I was like, all right, well,
• 12:32
  let me try to edit some of this stuff.
• 12:34
  And then you learn a little bit of editing.
• 12:36
  And, you know, I wanted to create some animations to help
• 12:38
  me better describe some of the technical concepts.
• 12:42
  And then all of a sudden, you know, you're paying attention to
• 12:44
  analytics and YouTube and you're like, oh, this video is taking
• 12:47
  off. Maybe I should create some more
• 12:49
  videos around that. And then, you know, that's
• 12:51
  really how I found myself in there is just, yeah, you kind of
• 12:54
  follow the data where it goes and see what's working and
• 12:57
  what's not. And yeah, it's been, it's been a
• 13:01
  crazy journey just learning all these different skills that, you
• 13:04
  know, you never thought that. That you'd be doing, but you
• 13:07
  know, here we are. Sounds very familiar story for
• 13:10
  for us. We could probably geek out quite
• 13:13
  a bit on sort of you know, producer to producer, editor to
• 13:15
  editor conversation. But you might have answered the
• 13:19
  one follow up question that I want to get into and that is how
• 13:22
  do you choose which content you put out there?
• 13:25
  Is it the analysts like you mentioned?
• 13:26
  Because I'm looking at your YouTube channel and you've got a
• 13:28
  lot of stuff recently around things like pass keys and
• 13:31
  password managers. And sort of things like that.
• 13:34
  Are you seeing something in the analytics?
• 13:36
  It's like, yeah, people are are eating that crap up.
• 13:38
  We got to put more videos out about it or you know, is there,
• 13:41
  is there a sort of a method to the madness like how do you
• 13:43
  choose content? So it it comes down to the
• 13:45
  platform. Now for for LinkedIn, it's much
• 13:49
  more around what are current events that are happening.
• 13:52
  And you know, my system is not complex.
• 13:54
  I'm. I'm reading the news and when
• 13:56
  I'm reading something, I typically have some visceral
• 13:58
  reaction, right. Whether oh, that's interesting
• 14:01
  or, well, that's not right or oh, this would be, you know,
• 14:04
  there's there's something to double click on here.
• 14:06
  And so from there, that's where that's just inspiration for the
• 14:09
  daily posts. And you know, from there, I've,
• 14:12
  I've got a newsletter now and I see, you know what, there's
• 14:15
  something that I want to say more about or you know, there's
• 14:18
  more to this story than what I can fit in a LinkedIn post.
• 14:21
  And now I've got some information for a weekly
• 14:23
  newsletter. I tried that in YouTube and it
• 14:27
  didn't work at all. And So what what was interesting
• 14:30
  with that was where it first started taking out, taking off
• 14:34
  was with the LastPass breach. And so that's when I was still
• 14:39
  doing my typical process for LinkedIn where she's like, OK,
• 14:42
  this is a major breach. I'm going to do a YouTube video
• 14:44
  on it. And you can see it's still early
• 14:46
  days. I didn't have like fancy lights
• 14:48
  and all the other, you know, stuff that I have today.
• 14:50
  And so I just, you know, did this quick recap, doing stuff
• 14:53
  that I would typically do for LinkedIn, and that video took
• 14:56
  off. And so I was like, oh, OK,
• 14:58
  that's interesting. You know, if people are looking
• 15:01
  at LastPass as something interesting.
• 15:03
  And I was looking at the comments of people like, oh,
• 15:05
  what do I do? Which password manager I go to
• 15:07
  and said, all right, well, maybe I'll just make a video on the
• 15:10
  best password managers. And then that one started taking
• 15:13
  off. And so I was like, all right,
• 15:14
  well, this is interesting. I got some more comments around
• 15:16
  it and then I stopped listening to it and I was like, I'm going
• 15:19
  to do all this other stuff related to things that are
• 15:21
  interesting to me. And those videos did terribly.
• 15:25
  And so I was like, I think it was probably March or April of
• 15:28
  this year. I was like, OK, I remember I was
• 15:31
  literally having this conversation with my wife.
• 15:32
  I was like, I think I'm just going to go all in on this
• 15:34
  YouTube thing and just follow where, you know, people want to
• 15:36
  listen to, which is like the most obvious thing.
• 15:38
  But again, when you're in the middle of it, no one ever, like,
• 15:40
  really pays attention to that. And so I put out a video, I
• 15:44
  think it was on bit Warden, and that just took off.
• 15:46
  I was like, all right, well, let me just go through and do some
• 15:48
  more deep dives and kind of see where it is.
• 15:50
  And that's really what it's been been becoming.
• 15:52
  And as I look at it, you know, what people are really trying to
• 15:54
  protect is how do I, how do I authenticate into these?
• 15:58
  And my password is so central to, you know, my validation or
• 16:02
  verification of who I am. And then I said, OK, well, I'm
• 16:06
  seeing this passkey stuff. And I was like, that's the next
• 16:08
  evolution of passwords. So maybe I'll do a video on
• 16:11
  that. And that was an experiment.
• 16:13
  And it didn't really take off until Google came out and was
• 16:15
  like, hey, we're going to make passkeys default And then that
• 16:17
  one shot off, right. And so I'm just looking at it as
• 16:21
  people have this problem today where they have an endless
• 16:25
  number of websites and applications that they need to
• 16:27
  authenticate to and no real good way of trying to remember all
• 16:31
  those things. They're just trying to make
• 16:32
  their lives easier by like using a password manager or hopefully
• 16:36
  everyone eventually switches the pass keys so that we can, you
• 16:38
  know, combine security and usability together.
• 16:40
  And so, yeah, I'm I'm, that's the vein I've tapped into.
• 16:43
  Now who knows where it's going to lead?
• 16:44
  But I think that's the beauty of the data is you just kind of try
• 16:47
  things out, see how it performs and then lean in where it makes
• 16:50
  sense. Jason, I really love the
• 16:51
  channel. I've watched a lot of your
• 16:54
  videos. I think if you did more gym fail
• 16:56
  videos, you probably get thousands more subscribers.
• 16:59
  But. I think stick to this, you're in
• 17:01
  the right lane. I think people should, our
• 17:04
  listeners, I encourage you guys go out there and subscribe to
• 17:08
  the YouTube channel and also connect to to among LinkedIn
• 17:12
  because you do like like weekly calls and things like that.
• 17:16
  And it's like, wow, what a great opportunity to learn.
• 17:19
  And I want to learn from you about cyber insurance.
• 17:23
  And you know, I've worked with a lot of folks who are responsible
• 17:25
  for filling out applications for the companies.
• 17:28
  Trying to figure out, OK, what do we do strategically to better
• 17:32
  our posture for cyber secure cyber insurance.
• 17:36
  But what I don't want to do and what I think you do a great job
• 17:39
  of with your channel is like don't lose people.
• 17:42
  And I want to start with a very simple question of what is cyber
• 17:45
  insurance? Yeah, cyber insurance is your
• 17:49
  way to recover and respond to an incident.
• 17:54
  And that that can mean a lot of different things for a lot of
• 17:57
  different people, right. But, you know, take the parallel
• 17:59
  to car insurance. If you get into an accident, do
• 18:03
  you want to pay the bills to get that car repaired or the bills
• 18:06
  for, you know, you know, who knows what that the person that
• 18:09
  you got into an accident with is going to do?
• 18:11
  You know, whether they sue you, whether whatever.
• 18:13
  That is a huge financial impact. And for a lot of people they're
• 18:17
  not going to be able to deal with that financially.
• 18:20
  And so you know, that's something where it's kind of the
• 18:22
  end of the line for them at that point and they may never really
• 18:24
  fully recover financially from that.
• 18:27
  And cyber insurance is the same concept when it comes to a hack.
• 18:32
  And so if you get hacked and you know whether it's a ransomware
• 18:36
  event where all your systems get encrypted and you need help
• 18:39
  getting back up and running, whether that's you, you accident
• 18:43
  your finance team accidentally wired money to Aceo, who was
• 18:47
  claiming he needed an urgent wire transfer only to find out
• 18:49
  that it was an attacker located overseas.
• 18:53
  Those are incidents that can cost you millions of dollars and
• 18:58
  there's no business that's just going to write that check
• 19:00
  willingly. And so cyber insurance exists to
• 19:03
  help offset that cost. And I think that's, that's the
• 19:08
  pureplay vision of it. But cyber insurance, it's still
• 19:12
  relatively new in the grand scheme of insurance.
• 19:15
  But what I personally love is that there's so many other value
• 19:19
  added things that you can get from that, right.
• 19:21
  You get access to incident response vendors that have been
• 19:25
  vetted and know the process to make sure that they're going to
• 19:28
  give you the best response process that's as efficient as
• 19:31
  possible and get you back up and running and have little or fewer
• 19:35
  issues working with the insurance carrier because they
• 19:38
  have a relationship there. And so you know that's one area
• 19:42
  you've got in the Insurtech space.
• 19:44
  You know you've got, you know we're doing scans on a monthly
• 19:46
  basis for you. We're we're doing dark web
• 19:49
  monitoring for you to see are you having compromise
• 19:52
  credentials pop up, is malware installed on your system.
• 19:56
  And so, you know, these are the type of scenarios where we can
• 19:59
  get ahead of an incident, I mean literally just the other day.
• 20:02
  This is just before Thanksgiving.
• 20:04
  We found that one of our policyholders had their VPN
• 20:08
  creds that were sold to an Access Broker.
• 20:11
  We notified them and now they're getting started in responding to
• 20:15
  that and cleaning it up in their environment before a ransomware
• 20:18
  event, right? Like those are things you would
• 20:20
  never think your insurance carrier is going to do for you.
• 20:24
  But to me, like this is how an insurance carrier really can
• 20:27
  support you is by giving you these value added services as
• 20:31
  part of your policy that you wouldn't even know to ask for.
• 20:34
  Because the whole name of the game is insurance, carriers are
• 20:37
  there to help pay for a claim when you have it.
• 20:41
  But it's in both interests to not have a claim in the
• 20:43
  beginning. And So what can you do with your
• 20:46
  insurance? Care to try to reduce the
• 20:48
  likelihood of that that incident upfront.
• 20:49
  You know, that's that's really where the fun is, at least for
• 20:51
  May. Yeah, that's a really great
• 20:53
  point and thought of it that way.
• 20:55
  It's kind of like how with some health insurance companies,
• 20:58
  they'll pay for your gym membership, right?
• 21:00
  If you're working out and living a more healthy lifestyle, you're
• 21:03
  less likely to need to go to the doctor, get a surgery and things
• 21:07
  like that. Now, I've heard the saying a lot
• 21:11
  of times, there's those companies that have been hacked.
• 21:13
  And those that don't know they've been hacked.
• 21:16
  Is that true? Because if that's true, then it
• 21:18
  kind of like, you know, my idea of insurance is that, you know,
• 21:22
  you get car insurance, everybody gets car insurance, a million
• 21:25
  people get car insurance and 1000 have accidents.
• 21:28
  So basically it's the other folks are paying for the
• 21:32
  misfortune of of a small percentage, but if everybody's
• 21:35
  been hacked, everybody's going to need to be paid out.
• 21:38
  That's not a very good position for the insurance company.
• 21:41
  Yeah, it's, it's one of those things where, you know, I, when
• 21:44
  I grew up, in instant response, I was at Mandiant when Kevin
• 21:47
  Mandia used to say it's not a matter of if, but when, right.
• 21:51
  And so that that had been drilled into me so much that I
• 21:55
  have dreams of that saying now. And so I I think there's there's
• 21:59
  truth to that, right? It's not that everybody is
• 22:01
  hacked at the same exact time and the the challenge here is
• 22:06
  that you're always going to have some element of evil happening,
• 22:10
  right. But it's almost like it's almost
• 22:13
  like bacteria where you have bacteria in your body, but some
• 22:17
  of that's healthy bacteria, some of it's bad, but it's at such a
• 22:20
  low level that you're not even going to notice it.
• 22:22
  And you're you know your typical, your your immune system
• 22:25
  is really going to be able to handle some of the foreign
• 22:27
  things that are coming in, right.
• 22:29
  But it's when something extra bad happens, whether it's the
• 22:32
  flu, you know, or is it or can we say COVID?
• 22:36
  Now are we beyond that, where it's OK to use that as an
• 22:38
  example, but there's things like that.
• 22:40
  We just got demonetized. Thank you.
• 22:43
  There are things like that where your body is just not equipped
• 22:46
  to handle it, right. And so that's when you're going
• 22:47
  to go, you're going to get some medicine, you're going to use
• 22:49
  your health insurance, right. So I think it's very similar in
• 22:52
  cyber where you know you're always going to have some level
• 22:56
  of something happening, but not every security incident rises to
• 23:00
  the level of a a catastrophic event.
• 23:04
  But insurance is meant to be there for those catastrophic
• 23:08
  events where it just crosses that threshold, where it just
• 23:11
  like I can't do this by myself anymore, I need some help.
• 23:15
  And that's when you're going to tap into insurance.
• 23:17
  So what can cyber insurance cover, or should you look at it
• 23:21
  as what it can't cover? What's the right way to look at
• 23:24
  that? The right way to look at it is
• 23:26
  through a conversation that you have with your insurance broker.
• 23:28
  So you understand what it is you're buying, right?
• 23:31
  And I say this is one of the things where I see a lot of
• 23:34
  organizations get mixed up because they have a perception
• 23:39
  of what's covered, which is a lot of things, but it's not
• 23:44
  always the case. And so I'll give you the
• 23:46
  clearest cut example. So I I Co founded a company
• 23:50
  called MOX 5 and MOX 5 specialized in what I called
• 23:55
  ransomware recovery. And so this was when you got
• 23:59
  into an incident ransomware incident and you needed support
• 24:02
  getting back up and running, MOX Five would bring in IT resources
• 24:06
  to help out. They're basically surging your
• 24:08
  your capabilities to get you back up and running quicker.
• 24:11
  And so the thing that popped up all the time was that we would
• 24:18
  get into a situation where suddenly the person who got
• 24:23
  hacked wants to completely rebuild their network, and they
• 24:25
  want all the latest and greatest things to rebuild that network.
• 24:30
  The challenge is your insurance policy typically is only going
• 24:34
  to get you back to where you were before, just like car
• 24:36
  insurance, like you get into a car accident, you're driving,
• 24:39
  you know, a Ford Focus or, you know, Tesla, whatever, You're
• 24:42
  not going to suddenly be able to buy a Ferrari.
• 24:43
  Like, that's just not how it works.
• 24:45
  And so there's just that disconnect where it's just like,
• 24:48
  oh, well, I needed to do these things to get back up and
• 24:51
  running. And it's just like, well, hold
• 24:54
  on, maybe that's not the case. You know, you're really looking
• 24:57
  at what's reasonable and necessary to get back up and
• 25:00
  running. And that almost never requires
• 25:03
  you to build your, rebuild your entire network.
• 25:05
  And so there are little caveats like that that pop up from time
• 25:09
  to time. And that's why it's so important
• 25:11
  for you to talk with your broker to really understand what is my
• 25:15
  insurance policy cover, is it going to be enough based on my
• 25:18
  environment and you know what my expected costs are going to be.
• 25:21
  And so it really needs to be tailored down to to that
• 25:24
  organization, you know that. And that's especially true in
• 25:27
  when you're dealing with larger companies.
• 25:29
  So Jason, talk to us about some of these key factors for being
• 25:34
  qualified for cyber insurance. I mean, do do organizations
• 25:38
  sometimes just get? Denied coverage and if they are,
• 25:43
  you know, affirmed coverage, is it because they have, they're
• 25:47
  kind of perfect across the board or is it OK to have some
• 25:50
  deficiencies? This is never a game of
• 25:53
  perfection. If we had mandated every single
• 25:56
  control you know across the board that was on the wish list,
• 26:00
  we wouldn't be in business very long.
• 26:02
  And so the way that that that I look at it and and this is, is
• 26:07
  fair to say across most of the insurance, cyber insurance space
• 26:10
  is there's typically a small number of required controls and
• 26:16
  these controls will change based on the size of your
• 26:20
  organization. It will change on the industry
• 26:24
  that you're in. You know if you're in a higher
• 26:25
  risk industry, there might have more controls that are going to
• 26:29
  be required. But typically what you find is
• 26:33
  there's a requirement for some sort of advanced AV.
• 26:38
  I'm going to say that generically here because what
• 26:40
  we're really looking for is EDR and point detection and
• 26:43
  response. That's kind of the the golden
• 26:45
  child that we look for. For most.
• 26:48
  You've got things like backups, secure and resilient backups,
• 26:54
  and then my personal favorite, MFA for remote access to your
• 26:58
  environment, for access to your e-mail.
• 27:01
  And those are, those are three of probably the most common
• 27:04
  controls you're going to see. You'll see a smattering of, you
• 27:08
  know, for large organizations, maybe it's going to be a secure
• 27:10
  e-mail gateway to make sure that we're addressing some of the
• 27:13
  phishing threats. Some people like to see phishing
• 27:16
  awareness training and things of that nature.
• 27:18
  But like the three that I always go back to as being the
• 27:22
  mandatories, MFAEDR and strong backups, and that's really going
• 27:26
  to help us deal with some of the most common business e-mail
• 27:30
  compromise attacks and certainly some of the most common
• 27:34
  ransomware attacks as well. Now, I know in my past of
• 27:37
  working with regulators, a lot of times you can say, all right,
• 27:40
  we are implementing something in three months.
• 27:43
  A lot of times they went to see that you had a road map and that
• 27:46
  over time you were sticking to your road map and implementing
• 27:49
  technology on the insurance side of the house.
• 27:53
  Does having something in the road map even help?
• 27:57
  It it can, but it's not something that I would bank on,
• 28:00
  right. And and the reason for this is
• 28:01
  because your insurance coverage starts on a certain day and it
• 28:05
  ends on a certain day, right, typically 12 month period.
• 28:08
  And so if the intent is that we want to see that control in
• 28:12
  place and you say you're going to get it done in 30 days, but
• 28:16
  you don't, then basically the policy was written under context
• 28:22
  that's no longer accurate. And so sometimes what you'll see
• 28:25
  is an underwriter will go in and say, hey, we're going to issue
• 28:28
  this policy contingent on you doing this activity.
• 28:33
  Well, you know, install and control within a 30 day period
• 28:36
  and if you don't, the coverage might change, right.
• 28:39
  And so that's known as the like the industry lingo is that's
• 28:41
  called a subjectivity, right. And so you see those from time
• 28:46
  to time. But typically what we know an
• 28:49
  underwriter is really looking for is does the control exist,
• 28:52
  right. And can you sign off, Can you
• 28:54
  attest that it is in place for, you know, all users or whatever
• 28:57
  it might be? So that's the ideal, you'd say,
• 29:00
  you know, it's you get into a risky area if you're you're
• 29:03
  going in where there's too many subjectivities there.
• 29:06
  Yeah. I'm also wondering like who is
• 29:08
  cyber insurance for? I'm assuming that large
• 29:11
  enterprises it's for them. I'm assuming, you know, bigger
• 29:15
  medium sized enterprises for them.
• 29:17
  We had Bob Lord from SISA on the podcast and he was the SISO at
• 29:23
  the Democratic National Conference, DNC and there were
• 29:30
  less than 200 employees, right? And yeah, and he said we're
• 29:36
  below the security poverty line. I just love that line.
• 29:40
  But I'm wondering if you're below the poverty, the security
• 29:43
  poverty line, is it like cyber insurance isn't for you it?
• 29:47
  So is there some kind of like breaking point where the size of
• 29:51
  the organization matters? If you look at it, first of all
• 29:53
  Bob is, I'm a huge fanboy of Bob.
• 29:56
  He's he's one of my favorite people and I think what he's
• 29:58
  doing is amazing. And so anytime he says
• 30:01
  something, I'm always listening, right.
• 30:03
  You know as it relates to organizations, you really,
• 30:08
  whether you're a small business or like an Amazon sized
• 30:11
  business, right? Like you have to look at cyber
• 30:13
  insurance because you know even just looking back at my time
• 30:16
  doing incident response, I would say the vast majority of
• 30:20
  companies that I was working with, they were sub 200 people,
• 30:25
  right? And there's always a time where
• 30:28
  you're working with companies that are less than 10 people,
• 30:30
  right? And so there's a, there's a
• 30:32
  reason why there's there's a lot of insurance policies that are
• 30:34
  sold for organizations that are less than 10 million in revenue,
• 30:37
  right. And those, those are the the,
• 30:39
  the organizations that are going to be more susceptible to
• 30:42
  phishing attacks, right. And so we see a lot of wire
• 30:45
  transfer fraud in the SMB space because there's fewer controls
• 30:50
  there, there's fewer processes set up for security.
• 30:54
  And so things like wire transfer are just more likely to happen
• 30:57
  there because you're just somebody who's probably
• 30:59
  overworked and has is wearing too many hats and they're just
• 31:02
  moving too quick. And so you know for really any
• 31:05
  business, it's really important to make sure that you're
• 31:08
  exploring insurance, cyber insurance, it just might, you
• 31:11
  might just need a much lower limit for your coverage.
• 31:14
  And so that's where it's less of a question of do I need it yes
• 31:18
  or no and more of how much is reasonable for me as a as a
• 31:23
  company, whether I'm, you know, a five person company, even a
• 31:26
  solo practitioner versus you know a hundred, 201 thousand
• 31:30
  2000, you know, 10,000 plus company.
• 31:33
  It's just like how much you need to reasonably respond to an
• 31:36
  incident. That number is going to change.
• 31:38
  I'm wondering what are some of the mistakes people make when
• 31:42
  they apply for cyber insurance? I heard you talk about this and
• 31:44
  I thought the answer was so awesome.
• 31:46
  Let's see if we get the same answer and if not then I'll
• 31:48
  produce the the biggest. Mistake that I see is and we're
• 31:53
  not doing anyone any favors with this by the way, but so many of
• 31:56
  the applications are yes, no questions and for anyone that
• 32:02
  has ever filled out a cyber application, it's impossible to
• 32:07
  answer every one of those questions with yes or no.
• 32:10
  And it go beyond just cyber insurance like any third party
• 32:13
  risk management questionnaire, you just can't answer those
• 32:17
  things because there's insecurity.
• 32:19
  It's always a well, it depends, right.
• 32:23
  And you know it's it's just an artifact of the game.
• 32:25
  It's really difficult to ask a question that's going to
• 32:28
  encompass all possible scenarios in there.
• 32:30
  And So what I always tell people is when you're filling out this
• 32:34
  application, a lot of times this is getting filled out with APDF
• 32:38
  and there are margins on that PDF.
• 32:41
  Write some notes in there, right, Because the underwriters
• 32:44
  see that. And so if you need to expand on,
• 32:48
  hey, you know, this is what we're doing with MFA.
• 32:50
  You know, this is what we have rolled out.
• 32:52
  You know, we're doing X with our our administrators.
• 32:54
  But you know, for our normal users, maybe we have this right.
• 32:57
  That is all really important context to give because that's
• 33:02
  the thing that is lacking in yes no questions is the context.
• 33:05
  And so I always encourage people make sure that you provide that
• 33:08
  context within reason. You know, we're not asking it
• 33:11
  for all your dirty laundry, right.
• 33:13
  But like give some context there because one, it might get ahead
• 33:18
  of a scenario where you misinterpreted the question,
• 33:21
  which happens a lot. And so, you know, that's a
• 33:23
  conversation that can happen then to clarify that.
• 33:26
  Or sometimes we see it where, you know, they misunderstand
• 33:30
  what the control is and they mark it.
• 33:32
  No, but they actually have it. In fact, they have something
• 33:34
  better. And so that's the type of things
• 33:36
  you know have to fill in those margins to make sure that you're
• 33:40
  really displaying what your security program looks like in
• 33:45
  the in the most accurate and best light possible.
• 33:48
  It sounds like organizations maybe need like a Chief
• 33:50
  Verbosity Officer to make sure that they're answering these
• 33:53
  questions. You know, it's like when you get
• 33:55
  you know, if you know you, you're familiar with this as
• 33:57
  well, right? You do like an interview.
• 33:58
  It's like, yes. No, OK.
• 34:00
  Come on man, give me something to work with you, right?
• 34:02
  Like help me, help you. Jim asked a lot of really good
• 34:04
  questions and I kind of have a bunch of follow up things.
• 34:07
  I kind of have been lumping them together.
• 34:09
  You talked a little bit about sort of like the process of at
• 34:12
  least at a high level of the incident management like
• 34:14
  something's happened, right. Here's the things that your
• 34:17
  insurance provider should be helping with.
• 34:19
  Can we talk through that a little bit more?
• 34:20
  I just kind of want to understand, OK, an incident has
• 34:23
  occurred. When do you get involved?
• 34:26
  I assume as early as possible. Look, can you kind of just walk
• 34:29
  me through it? I don't want to tell you a
• 34:30
  secret sauce or anything like that, but tell me like, what is
• 34:33
  this, you know, what is the role that you're playing as a cyber
• 34:36
  insurer with an organization that's gotten?
• 34:38
  Breached. So the most important thing is
• 34:40
  to notify as early as possible, right?
• 34:42
  And so there's a little cheat code that you can use where you
• 34:46
  can just put an insurance carrier on notice that, hey, we
• 34:49
  might have an issue at hand here, right?
• 34:52
  And so that is early stages. You're not providing formal
• 34:56
  notice or anything like that, but it's just enough to say,
• 34:59
  hey, we think we might have a problem, what can we do or what
• 35:04
  should we do right and so. What does that mean?
• 35:07
  Is that like a legal term notices.
• 35:10
  Yeah. It's a there's it's a first
• 35:12
  notice of loss is like that is a legal term in the claims world
• 35:16
  of like that's the first time that the carrier is receiving
• 35:20
  information that you have experienced a security breach
• 35:23
  and are requesting or. You know, basically formally
• 35:26
  filing a claim with the insurance carrier.
• 35:29
  So this would be you know the equivalent of with car insurance
• 35:31
  if you're like filling out the online app to tell them that hey
• 35:34
  I got into a car accident and I'm looking to seek
• 35:36
  reimbursement for whatever expenses.
• 35:39
  So that's like the for that's that's when it's just like, OK,
• 35:42
  you're officially going to have a claim on record at that point
• 35:45
  when when you're saying first notice of loss.
• 35:48
  But if you're just going and saying, hey, I'm going to put
• 35:50
  you just want to give you a heads up, there might be an
• 35:52
  issue here. You know, somebody might make a
• 35:54
  note of it, but you know, it's it's it's just kind of a a pin,
• 35:58
  if you will, in the conversation until you get more context.
• 36:02
  Is there a negative thing that can happen?
• 36:05
  Sort of like, you know, the boy who cried wolf too many times.
• 36:08
  Is there a spot where it's like, man, this company keeps
• 36:11
  informing of potential things that might be happening?
• 36:14
  Does that carry something with it?
• 36:16
  Or I guess you know, how do you get around that?
• 36:18
  Like of course you be notified, but you also don't want to.
• 36:21
  You know, maybe trigger something that might be also
• 36:24
  negative. I feel like this is, you know,
• 36:26
  maybe like a relationship between a kid and their mother.
• 36:28
  So it's like, I don't even know all the secrets, right.
• 36:30
  But, you know, just tell me the things that are going to put you
• 36:33
  in jail sort of situation. Right.
• 36:35
  And it's, it's, it's just one of those things like, you know it
• 36:38
  when you see it, right. And so it's, I wouldn't say that
• 36:41
  there's a formal guidance or principle around it, right.
• 36:45
  But like you know, the general rule of thumb is if you think
• 36:48
  this is going to cost you money where you're going to have to
• 36:50
  bring in outside people or you know anything like that or
• 36:54
  you're like you have some questions of hey, is this an
• 36:56
  issue or not. It's just better safe than
• 36:58
  sorry. And most of the time you know
• 37:02
  it's, it's nothing, right. And the times when it is
• 37:04
  something you're going to be filing a claim anyway.
• 37:06
  So it's kind of no, no love loss sort of scenario there.
• 37:10
  And so you know, come renewal time, the emphasis is going to
• 37:13
  be on how many claims, actual claims have you had versus when
• 37:17
  we look at as a carrier, hey, what is our partnership look
• 37:20
  like? Are you, you know, are we having
• 37:22
  a two way conversation here where you're really interested,
• 37:25
  invested in your security program which is going to
• 37:28
  include when there is an incident just letting somebody
• 37:30
  know, you know, that goes a long way because for for me at least
• 37:34
  that's saying hey, you're taking this seriously like this isn't
• 37:38
  you trying to hide the ball. It's not you trying to, you know
• 37:42
  paint yourself in a better picture.
• 37:43
  It's just like the whole point of getting insurance is that if
• 37:46
  you do have a claim, we're here to pay it.
• 37:47
  So it's like we'd rather have that transparency then, you
• 37:50
  know, get the call at 2:00 in the morning that you need to be
• 37:52
  bailed out of jail sort of situation like just give us a
• 37:55
  heads up, you're going to a party 1st and you know we'll be
• 37:57
  ready. We'll have our phone off mute
• 37:58
  sort of situation here. OK.
• 38:00
  So we've filed notice. Like what happens next then take
• 38:03
  me through like so at that point you're getting in touch with a
• 38:07
  claims manager and depending on your insurance carrier, you
• 38:10
  might get in touch with a technical resource in addition
• 38:12
  to that claims manager. You know the claims, this
• 38:14
  manager is your conduit into the insurance company that you're
• 38:19
  going to submit your invoices to and the claims managers
• 38:22
  reviewing those invoices and working on determining coverage
• 38:26
  and whatever is covered, which is almost you know most of the
• 38:29
  time it's everything is issuing the payment back to the the
• 38:34
  policy holder. And so that, I would think of
• 38:37
  the claims person as that is my conduit into the insurance
• 38:41
  carrier. And that first conversation is
• 38:44
  very, very important because they're going to ask you for
• 38:46
  information of what happened, right.
• 38:49
  And you're not going to have the full story and that's OK.
• 38:52
  But the idea is that the claims manager is looking at what is
• 38:56
  the situation on the ground and what service providers do we
• 39:01
  have that make the most sense for you, right.
• 39:05
  And so they're looking at the industry, the size of the
• 39:07
  company, the threat actor, the type of attack.
• 39:11
  And we do this enough where we know, OK, you know what, this,
• 39:14
  this company is this size, it's this threat actor.
• 39:17
  Well, we just had 15 engagements with this one service provider
• 39:21
  who has a really good playbook for responding to this type of
• 39:24
  situation. We're going to give them a call.
• 39:26
  We're going to put you in touch with them, right.
• 39:28
  And so the claims manager becomes this conduit where
• 39:32
  they're really just a facilitator and they're going to
• 39:34
  say, OK, great, now that we know the details, we're going to
• 39:38
  recommend to you that you engage with these companies, right.
• 39:41
  You know, you have a lawyer who specializes in privacy law.
• 39:45
  They're often times they're called the breach coach.
• 39:47
  We're going to bring in a forensics provider to do an
• 39:50
  investigation into it. Maybe we need to bring in some
• 39:53
  additional IT support for for that.
• 39:56
  And so they're there to really connect you with them.
• 39:59
  And so at that point you're going to jump on that call, do a
• 40:02
  scoping exercise and then you're going to get statements of work
• 40:05
  from all these service providers direct to you, right.
• 40:08
  And at that point you're, you're engaged with these providers and
• 40:11
  you're you have just started the incident response process and
• 40:14
  you're going through that whole thing.
• 40:16
  And so as you're going through and responding certain
• 40:20
  information for invoices and stuff finds its way back to the
• 40:23
  carrier and you know this is where it's really, really
• 40:26
  important that. If you're if you're looking at
• 40:28
  saying, hey, in order for us to get back up and running, we
• 40:32
  think that we need this big purchase, talk to your claims
• 40:36
  provider, right. And so like this is where it's
• 40:38
  just like I can get ahead of some of these coverage issues.
• 40:41
  You know claims person isn't going to give you a claims
• 40:43
  decision upfront, but they can really help shape what is in
• 40:47
  bounds for you, right? And most importantly, what is
• 40:49
  out of bounds, like avoid these landmines at all costs because
• 40:53
  that might not be reimbursable. And so as you're going through
• 40:56
  that process, if you're having that dialogue, you're going to
• 40:59
  be in a good position to really maximize the amount of money
• 41:02
  that you're getting back from all these invoices that you're
• 41:05
  paying out. And so you can't, you go through
• 41:07
  that whole process and the insurance carrier is there with
• 41:09
  you along the whole way making sure you're good.
• 41:12
  And then you know, depending on your insurance carrier, One of
• 41:15
  the things that we do that I love is we'll jump on a call at
• 41:18
  the end and say, OK, great, you just went through a terrible
• 41:20
  experience. Let's just talk about it.
• 41:23
  And, you know, we have, we can give a little bit more of, you
• 41:26
  know, one-on-one attention to make sure.
• 41:28
  Let's talk about your remediation plans.
• 41:29
  Like how are you doing with that?
• 41:31
  And all that information can be bundled up to go over the, the
• 41:34
  underwriters say, hey, like, yeah, they had an incident, but
• 41:36
  here's all the great things that they did afterwards.
• 41:38
  And this is how they're they're working to advance their
• 41:40
  security program. And those are all things that
• 41:42
  the underwriter will look at come renewal.
• 41:44
  Because I think it's a little bit of a fallacy where it's just
• 41:46
  like you have one claim and you're you're out of there,
• 41:48
  Right. Does it happen?
• 41:50
  Yeah, sure. Right.
• 41:51
  Especially if it's a really bad claim.
• 41:54
  But if you go in and you can show that you're in a good
• 41:57
  position, underwriters take that in consideration among all the
• 42:00
  other things that they're looking at.
• 42:02
  So you mentioned bringing in other third parties into this
• 42:05
  relationship with the claims adjuster or sorry, the claims,
• 42:09
  the claims person as well as breach coaches, right
• 42:13
  remediation response, those sorts of things, large company.
• 42:18
  Typically you need Msas in place and all sorts of legal
• 42:22
  agreements. But when you're in the middle of
• 42:23
  a breach, speed is really one of the things that really needs to
• 42:26
  be present. How much planning needs to go
• 42:30
  ahead of time to say, OK, you know, we've engaged this
• 42:34
  organization to be our cyber insurance provider and oh by the
• 42:37
  way, you know that cyber insurance provider has this list
• 42:40
  of different providers that they use, right.
• 42:43
  And we'll recommend in in a certain case.
• 42:45
  Do I as the organization go out and say, OK that's great, thanks
• 42:49
  for advice. Let me go start working on Ms.
• 42:51
  As and so we have them in place. So it really is just send me a
• 42:54
  statement of work pre, you know maybe pre approved pricing
• 42:56
  things like that because I don't know about you but I get stuck
• 42:59
  in legal stuff all the time with contracts and it takes a long
• 43:02
  time, you know for for people to to agree on the language right
• 43:07
  from a convert from a contract perspective.
• 43:09
  Is that something we should be doing ahead of time?
• 43:11
  Or are there shortcuts that could be taken sort of in?
• 43:14
  The moment feel like you were an A+ student because that is
• 43:17
  definitely like the A+ thing to do.
• 43:20
  Most companies don't though, right.
• 43:21
  And so this is where you know, I always, I adapt to Warren
• 43:25
  Buffett saying of you know save when you can, not when you have
• 43:28
  to for cyber to prepare when you can, not when you have to
• 43:31
  because typically by that time you're scrambling.
• 43:32
  And so that is one of the things that I would definitely
• 43:35
  recommend is if you have a preferred provider, you know or
• 43:39
  if you look at the panel and say, hey this is the company I
• 43:41
  want to work with, just get an MSA or at a minimum just to have
• 43:44
  your legal team review the MSA ahead of time and just kind of
• 43:47
  get to the point where maybe you're not signing it, ideally
• 43:50
  you are and you're good to go. It just helps.
• 43:53
  It's like it's one less thing that you have to worry about
• 43:56
  when you're in the middle of it. But that being said, you know, I
• 44:01
  I did 10 plus years of incident response, 99.9% of the times
• 44:06
  there was no MSA there. And even for the largest
• 44:09
  companies you were talking Fortune 500, Fortune 100
• 44:13
  companies. Just magically when there's an
• 44:15
  incident, a lot of the barriers that are put in place as
• 44:19
  protections are dropped. And so you know it might still
• 44:22
  be a day or two potentially for the especially the larger
• 44:25
  customers, but a lot of times what you find is like your house
• 44:28
  is on fire, you're not going to get picky with some of these
• 44:31
  things and you're just kind of work it out later.
• 44:33
  You know, it's about how do we get going as quickly as
• 44:35
  possible, but you can avoid all of that by doing it ahead of
• 44:38
  time, and it's not that much time up front to save to avoid
• 44:41
  the potential headaches down the line.
• 44:43
  It's amazing what happens when when an emergency comes along
• 44:45
  and really, really lets you really evaluate what parts of
• 44:48
  the process are immutable and which ones aren't.
• 44:51
  You talked a little about some of the key things that you look
• 44:54
  at from sort of must haves. EDR was one of them.
• 44:57
  MFA backups. What is the biggest bang for the
• 45:02
  buck when it comes to? Cyber cyber insurance coverage,
• 45:07
  is it, is it MFA? And I see like that's been sort
• 45:10
  of like the focus du jour for the last couple years is getting
• 45:13
  MFA. Is it something else?
• 45:15
  I guess if I'm just starting to get into this, I need to start
• 45:17
  building up my case or my capabilities to acquire Cyber
• 45:20
  assurance. What's the first thing I do?
• 45:22
  MFA is the de facto answer there, and the main reason for
• 45:25
  that is because enough underwriters know what that is
• 45:31
  and can say. Do you have it?
• 45:32
  Yes or no, right. And again in security, so it's
• 45:36
  it all depends, right. Like you know how many of you
• 45:38
  have it deployed to, you know what type of MFA have you
• 45:40
  deployed. But at the end of the day that
• 45:42
  answer is going to hold a lot of weight especially as it relates
• 45:46
  to you know whether you can get covered or not because there are
• 45:48
  some insurance carriers that are out there that'll say you're not
• 45:51
  getting the policy unless you have MFA in place.
• 45:54
  Whereas if you look at EDR and backups, which are still the two
• 45:58
  that I would say like you know, all three, like you got to have
• 46:01
  these things, but there's more latitude there, right?
• 46:04
  Because I mean, we could nerd out for hours on what exactly is
• 46:08
  an EDR. And you know, just because the
• 46:10
  marketing team says that it's an EDR provider doesn't mean that
• 46:14
  it is. And so there's a little bit more
• 46:16
  latitude there where she's like, OK, you're you're close enough
• 46:19
  to meeting the definition that it's OK.
• 46:21
  Whereas with MFA it's like you have it or you don't.
• 46:24
  And we haven't reached the point as an industry yet which is like
• 46:27
  this is what keeps me up at night where there's a mandate
• 46:29
  for phishing resistant MFA. Any form of MFA right now is
• 46:34
  better than nothing. And so you know that's where
• 46:36
  focus on that first. If you don't have it, just go,
• 46:40
  you know, go to the number one spot, get fishing resistant MFA
• 46:43
  in place, you're going to save yourself a lot of trouble down
• 46:45
  the line. And so yeah, like all things
• 46:48
  being equal, start there. Get that out there.
• 46:51
  It's going to give you the biggest bang for your buck.
• 46:53
  I thought there's a 5050 shot of you going with backups because
• 46:58
  it kind of seems like if your MFA is defeated.
• 47:02
  You know you can do a lot with backups, right?
• 47:05
  You know you can at least restore your environment if you
• 47:08
  get breached and they own your active director or something.
• 47:13
  I mean, even if they give you the key to decrypt things, you
• 47:17
  might not be able to get it decrypted, right?
• 47:19
  So having good backups might be the only thing that saves you.
• 47:23
  I would put that as the third place of the the, the, three.
• 47:27
  Right. And so the way that I think
• 47:28
  about it is and this is this is my bias from growing up in an
• 47:32
  incident response because I think very timeline based and
• 47:38
  and how an attack progresses, right.
• 47:39
  And so your front door MFA, right.
• 47:44
  And it's not going to stop everything, right?
• 47:45
  But weak credentials, you know, can lead to that account
• 47:48
  takeover. That's just it's you're asking
• 47:50
  for a recipe for disaster, right?
• 47:53
  And then from there, an attacker is going to have to move around
• 47:56
  the environment. That's where EDR comes in place.
• 47:58
  So I've got a better chance of of picking that up along the way
• 48:02
  before they get to an encryption standpoint.
• 48:05
  And then backups I put as the third because to your point like
• 48:09
  that is your Hail Mary when all S fails and assuming this is
• 48:12
  just a ransomware attack, right, when all S fails, your backups
• 48:15
  are your last line of defense, right?
• 48:17
  And so it's it's almost like if you look at kind of the aperture
• 48:22
  of how much stuff, bad stuff that these controls protect
• 48:27
  against. You know EDR is probably going
• 48:28
  to have the biggest aperture because you have you're just
• 48:31
  covering the widest number of types of attacks that you're
• 48:35
  going to protect against. You know MFAI think that
• 48:38
  aperture is growing wider especially with the use of you
• 48:40
  know SSO and things of that nature that are giving you
• 48:43
  direct access into cloud systems and everything like that where
• 48:46
  you're getting back into the infrastructure.
• 48:48
  And then that aperture for the backup, even though it's super,
• 48:51
  super important, it is very focused on a ransomware attack
• 48:55
  because now you have a lot of the extortion based attacks that
• 48:57
  are coming in just stealing data and they're just saying F it to,
• 49:01
  you know, trying to encrypt, encrypt systems because most
• 49:04
  people are getting better backups today.
• 49:06
  And so this is the fun of it. This is, this is going to sound
• 49:10
  ridiculous, right? But this is the fun of security
• 49:12
  is it's not a one-size-fits-all T-shirt.
• 49:16
  And so you really have to look at your environment to
• 49:18
  understand what controls are going to be most important for
• 49:22
  me and my environment, not necessarily what you know 1000
• 49:27
  other companies are saying is that like this is the thing that
• 49:29
  they paid attention to. So I haven't given this a lot of
• 49:31
  thought, but I want to make a football analogy here.
• 49:35
  Aaron Rodgers is MFA and Zach Wilson is, I don't know, a
• 49:39
  combination of your EDR and your backups.
• 49:43
  Not very good either of both of those, but man, they put a lot
• 49:46
  of things into their front door. Now they got, you know,
• 49:50
  obviously I think everyone knows what happened here.
• 49:52
  Rogers, he's, you know, kind of gone for the season or at least
• 49:54
  he's maybe coming back. So it doesn't matter.
• 49:56
  It's a wasted season for The Jets basically.
• 49:59
  I guess from a spend perspective, if I take that same
• 50:03
  analogy, should I spend most of my money on the MFA?
• 50:07
  Do I spend equal parts 3030, thirty is it, you know, most of
• 50:12
  it on the first two and sort of on the back end?
• 50:14
  Because in the real world, every company has budget.
• 50:17
  You know, decisions to make around this.
• 50:19
  Where do you see sort of the percentage breakdown between
• 50:22
  MFAEDR and backups? So it's I would say it's going
• 50:27
  to be. Dependent on how far along
• 50:29
  people are are in their journey, I think a lot of people are
• 50:34
  going to start with some basic stuff with MFA and they'll
• 50:36
  probably go the free route, right?
• 50:38
  And so you can get a no cost solution there.
• 50:40
  It's not the best solution, but it's it's it's pretty damn good
• 50:43
  right? Especially if you're using, you
• 50:45
  know, say you say you're using your Microsoft shop, right, you
• 50:48
  can get some pretty good conditional access controls in
• 50:51
  place with, you know, even push base so that you've got the
• 50:54
  number matching, you've got the Geo Geo location on the prompt
• 50:58
  and so it's not perfect, but it'll get you pretty far with
• 51:02
  the emergence of pass keys. Now you can even do that for
• 51:05
  somewhat free, you know, your mileage might vary there, right?
• 51:08
  So I feel like the return on investment on that is just the
• 51:11
  time it takes to do it. And that is way worth it, right?
• 51:15
  With EDR I I like to, I like to push for the the the good ones,
• 51:21
  right? Because there is a Cliff in EDR
• 51:24
  where you're buying the marketing data sheet versus the
• 51:28
  capabilities and so it's something that is still fairly
• 51:32
  affordable for most companies. You know it, it's per user,
• 51:35
  right. So it's going to, it's going to
• 51:36
  add up the larger you are. But you know that's where I
• 51:39
  would, I would bucket money. You know I don't know what the
• 51:42
  right breakdown here is but you know I would bucket quite a bit
• 51:46
  there And then your backups, your backups really like a lot
• 51:50
  of it comes down to how are you securing it, right.
• 51:52
  And again it's like this is this is honestly so many things in
• 51:55
  security like you can you can have a lot of security for free
• 52:01
  if you just configure it correctly in the 1st place.
• 52:04
  And so, you know, a good example of this is I see a lot of people
• 52:06
  go and buy the Cadillac of backups and then they join it to
• 52:11
  their Windows domain and she's like congratulations, you have
• 52:14
  just destroyed your chances of securing your network or you
• 52:18
  know, making a resilient network because now the attacker's just
• 52:21
  going to log straight into your backup server and delete
• 52:23
  everything, right. So maybe you go immutable,
• 52:25
  right? Like it's if you do it the right
• 52:27
  way, I bucket, you know, say I'm going to make these numbers up,
• 52:31
  right, you know, 33% of it on on your backup, you know, 30
• 52:35
  percent, 50% on EDR and what is at least 20% on NFA, right.
• 52:39
  And if you break down what the actual costs are between all of
• 52:42
  those, that probably evens out somewhere along there.
• 52:44
  But it all depends on the size of your organization because the
• 52:47
  bigger you are, the more storage you need and you know, more
• 52:49
  robust backup. So that's a very long way of
• 52:52
  saying it just depends on your organization and you should do
• 52:55
  them all. I want to ask about rock
• 52:57
  climbing, but before I get to that, I want a quick take on
• 53:00
  where you see the future of cyber insurance going, what
• 53:04
  should. Companies be looking to
• 53:06
  implement now to keep pace for next year.
• 53:09
  In the year after that, I feel like Privileged Access
• 53:12
  Management is starting to see that more involved with
• 53:14
  questionnaires, So I'd love to get kind of your quick taste on
• 53:17
  that. And where do you see things also
• 53:19
  like AI and deep fakes? Are these?
• 53:22
  Things that we need to be concerned about as, you know,
• 53:24
  real people in the real world. Or is it still a little bit too
• 53:26
  far out and maybe it needs a couple more years to break?
• 53:29
  Yeah. We can do a whole podcast on
• 53:31
  that one. So you know related to Pam, if
• 53:34
  you're a large organization, to me that's table stakes.
• 53:37
  You need that in order to be successful with your IM program.
• 53:41
  It is a requirement for some carriers and so the larger you
• 53:45
  are, the more important that's going to become.
• 53:47
  Small organizations, you're probably not ready for it yet,
• 53:50
  and honestly like that it's probably a waste of money for
• 53:52
  you. In most situations.
• 53:53
  You probably can get away with using an enterprise password
• 53:57
  manager and just, you know, doing specific vaults.
• 53:59
  You can kind of hack your way to get to good security for a lot
• 54:03
  more for something that's a lot more affordable.
• 54:05
  But once you if you're dealing with on premise environments and
• 54:07
  stuff like that, it it just it gets way too complicated.
• 54:10
  Just go with the Pam. So if I have my way would where
• 54:14
  I think people need to be paying attention to and I where I think
• 54:18
  insurance carriers need to be looking closer at is phishing
• 54:22
  resistant MFA becomes mandatory because we're in a period now
• 54:26
  where we all accept that MFA is really important.
• 54:29
  You have some some insurance carriers that are mandating.
• 54:31
  You can't get a policy without that, but attackers have already
• 54:34
  created ways to bypass weaker. Forms of that SMS, you know push
• 54:39
  base, token base, specifically a one time password base.
• 54:43
  There is nothing practical that is bypassing passkeys right
• 54:48
  anything 502 and so in my in in Jason's perfect world we have
• 54:53
  every company who buys insurance has a fishing resistant MFA
• 54:57
  solution in in place preferably something you know passkey based
• 55:00
  that really puts us them in a position to stop a lot of these
• 55:04
  these types of attacks that are out there.
• 55:07
  I think you know with the whole AI thing the the 32nd response
• 55:13
  on this is I think a lot of the hype is overblown today.
• 55:16
  Attackers are not using it the way that media is portraying in
• 55:20
  in in a sense of like you know building these catastrophic
• 55:24
  abilities to hack into companies.
• 55:27
  I I think we're probably 2345 years away where we actually
• 55:31
  start seeing it implemented in the day-to-day operations of
• 55:35
  attackers. We will eventually get there.
• 55:37
  I think the beauty of it for most organizations is your
• 55:41
  defense strategy does not change with this.
• 55:44
  It just becomes more important that you get more coverage of
• 55:48
  your existing controls and that you become better at detecting
• 55:51
  and stopping these attacks before they get to the get go.
• 55:54
  Because a lot of the AI stuff is just going to drive towards
• 55:56
  efficiency gains. It's not going to change the
• 55:59
  playbooks that attackers have been using for the last 15
• 56:01
  years, because those haven't changed all that much.
• 56:04
  Yeah, it seems like the the. Playbook is social engineering
• 56:08
  and phishing, right? As one of the entry methods,
• 56:10
  right? And you know vulnerabilities,
• 56:12
  right? You got very few ways to break
• 56:14
  into an organization. You get that you're you're in a
• 56:17
  good spot and then the squishy center of your organization.
• 56:21
  If you have good detection and response capabilities, you can
• 56:24
  try to get ahead of it before the attacker goes and gets
• 56:26
  access to Active Directory, gains full control of your
• 56:29
  environment and then, you know, encrypts your environment or
• 56:32
  steals data or what have you. OK.
• 56:35
  Let's talk rock climbing, because I think that's one of
• 56:38
  the things that you do when you're not doing YouTube,
• 56:41
  LinkedIn being a seesaw, right? All the different things are out
• 56:44
  there. I It's been forever since I went
• 56:47
  rock climbing and I think my rock climbing career consists of
• 56:50
  a Lifetime Fitness wall about 20 years ago.
• 56:53
  I'm assuming you do a little bit more than that.
• 56:54
  Can you take me through sort of you know, what is when I say
• 56:57
  rock climbing, what does that mean for you?
• 56:59
  Like what is your normal? Yeah, so I I'm not one of those
• 57:02
  hardcore people who who go up outside and, you know, everyone
• 57:07
  always asks me, have you seen Freecell?
• 57:08
  Like, that's not me. I'm not.
• 57:10
  I'm not doing that stuff. I I think that's crazy and a
• 57:13
  little bit too dangerous for me. So I do spend most of my time
• 57:16
  indoors. I love top roping and lean
• 57:19
  climbing, which is basically where you're climbing up walls
• 57:21
  that are anywhere from 45 to 60 feet.
• 57:24
  And for me, what I love about it is it is the perfect blend of
• 57:30
  problem solving and puzzles is a lot of to do with security,
• 57:34
  right, and physical activity because you know, when you're
• 57:38
  doing it. To I I call myself probably like
• 57:42
  an intermediate plus climber for if there's any climbers out
• 57:44
  there like I'm, I'm a 512 climber, which is, you know, a
• 57:47
  fairly intermediate level professional climbers like at
• 57:51
  competitions, they're probably climbing 5 fourteens, 5 fifteens
• 57:54
  like stuff that I can only dream of ever doing.
• 57:57
  But for me, what I really enjoy is when you reach that 512
• 58:02
  level, again, it's like intermediate plus level.
• 58:05
  You have to look at it from the ground and see, OK, I'm going to
• 58:09
  move this hand here and I'm going to move my, you know, hips
• 58:12
  in here and do this, this and this.
• 58:14
  And you're, it's called projecting.
• 58:15
  And so you're projecting out and like really mapping out.
• 58:18
  What is your climb going to be? And then you get on the wall.
• 58:21
  You tend to just forget it all. It's like hopefully it's just
• 58:23
  like just embedded in your mind at that point.
• 58:26
  And then you have to put those pieces together and it's to the
• 58:29
  point where if you're literally off by two inches, you're you're
• 58:33
  falling off the wall. And so for me, I love that
• 58:36
  because it gives you the ability to, you know, really put this
• 58:40
  projection in place. You got this problem solving
• 58:44
  aspect there and the physical like just draining thing where
• 58:48
  you're hanging off of just your fingertips.
• 58:51
  To me, that is my euphoria because it's just it's, I don't
• 58:55
  think when I'm doing it, you're just acting and you're working
• 58:58
  on it and you know you're going to fail, Which is the best part
• 59:02
  because then you can really kind of try these things out and just
• 59:04
  tweak things over time. And then all of a sudden you
• 59:07
  know you're you're getting these climbs.
• 59:09
  And so for me, like that's my kind of analogy for life, is
• 59:13
  constantly test, experiment, tweak things, try it out, see
• 59:16
  what works, and then once you have that, it just becomes part
• 59:19
  of you and you don't think about it anymore, you just do it.
• 59:22
  So you mentioned 512 which I think is like this climbing
• 59:26
  measurement system, right? And if I remember this is, it's
• 59:29
  basically one is supposed to be like flat basically and five is
• 59:33
  like gear is required, that's like the first number.
• 59:35
  Am I right on that? The general grade.
• 59:37
  Typically when you're in a climbing gym, you're only going
• 59:39
  to see the numbers. Start with A5 and then you'll
• 59:41
  typically see the grades go from like absolute beginner.
• 59:44
  Like, you know, children's party level is like a 5-6 and then you
• 59:48
  get up to the 510. I think 510 is technically the
• 59:52
  intermediate level. It's like just where your things
• 59:54
  are getting hard and then once you get to five 11512, like the
• 59:58
  level of difficulty just jumped so much.
• 1:00:01
  And so I I've been working on five thirteens for two years.
• 1:00:04
  And still haven't gotten one right.
• 1:00:06
  So maybe, maybe this year is is my year for it.
• 1:00:08
  Who knows? How do you graduate from like
• 1:00:10
  512 to 513? Is it you complete a 513 and
• 1:00:14
  that means not you're a 513 Or do you have to like do a certain
• 1:00:17
  number of them to be like, OK, I'm now consistently hitting
• 1:00:20
  five thirteens and now I'm yeah, it's not like karate where
• 1:00:23
  there's like a belt system where like you, you pass a test and
• 1:00:25
  get it. Someone hands you like a rosin
• 1:00:27
  bag. Here you go.
• 1:00:27
  And there's like bowing. And yeah, somebody just repels
• 1:00:29
  from the ceiling and hands you an award.
• 1:00:32
  Yeah, it's nothing like that for me.
• 1:00:33
  The way that I look at it is what can I consistently climb
• 1:00:38
  and I call it flashing. So flashing is when you you get
• 1:00:42
  it clean on the first shot and so I can do that for more than
• 1:00:47
  50% probably close to the 75% of the 512 climbs that I do.
• 1:00:52
  And so for me it's like OK I I'm, I'm pretty consistent on
• 1:00:55
  the 512 and so I that's why for me I feel that I'm a I'm a 512
• 1:00:59
  climber you know 511 is what I warm up on at this point, right.
• 1:01:02
  And so I wouldn't call myself 511 because of that.
• 1:01:05
  So it's all, I think it's all subjective and I think that's
• 1:01:07
  the cool thing about climbing is even these.
• 1:01:09
  Grades. It's all subjectively.
• 1:01:11
  There's not an official thing where she's like you have to
• 1:01:13
  have these three criteria in place to be at this grade.
• 1:01:16
  It's up to, it's up to the route setter and you know when when
• 1:01:19
  you get outside. I haven't done this right, but
• 1:01:21
  it's a little bit of a community thing where you kind of bounce
• 1:01:23
  ideas back of and forth off each other and you get a just general
• 1:01:27
  consensus of what it is. And so it's always fun in the
• 1:01:29
  gym because you'll see, like, the route setter will put it out
• 1:01:32
  as a 511 and you go and climb it and you're just like, oh, that's
• 1:01:35
  a heavy, that's a heavy 11, or that's a light 11.
• 1:01:38
  And you know, some people write on chalk with chalk next to it.
• 1:01:41
  It's just like you know, 5-10 plus sort of scenario because
• 1:01:43
  it's just people are built differently and they they're
• 1:01:46
  good at certain climbs and not at others and and that's the fun
• 1:01:48
  of it. It's just a very diverse sport.
• 1:01:50
  I was going to ask if there are controversies in the rating
• 1:01:53
  system. If it sounds like there are,
• 1:01:55
  there's that subjectivity to say, OK, my 511 might be someone
• 1:01:58
  else's 510 or 512, and that consensus is really what kind of
• 1:02:02
  comes to it. But I love the idea of like.
• 1:02:05
  Climber graffiti. Like no way this is a 511.
• 1:02:08
  This is a 510 plus, right? That's what it may be, Jim.
• 1:02:14
  You're in the you're in the gym quite a bit.
• 1:02:16
  How do you feel about rock climbing?
• 1:02:18
  I used to be a a rock climber, but I'm not really built for it.
• 1:02:23
  I'm kind of a bigger guy and I'd weigh over 200 lbs and that's
• 1:02:28
  you don't see many like really good climbers who weigh over 200
• 1:02:31
  lbs. Usually they're they're lighter
• 1:02:33
  people with really big forearms and like gnarly fingers because
• 1:02:40
  they've been like jamming their fingers in these like weird
• 1:02:43
  places. But I have, I've done multi
• 1:02:46
  pitch climbs and the other thing I don't have going for me is I
• 1:02:50
  have a fewer fights which I kind of like figured out like as I
• 1:02:54
  was doing it was like every time I do these climbs I just, I feel
• 1:02:58
  like I'm going to throw up. It's after.
• 1:03:01
  Prohibiting, yeah, yeah, It kind of takes the fun out of it, but
• 1:03:06
  I think it's super cool sport. The reason I really wanted to do
• 1:03:08
  it was like, I think the lifestyle is like, you know, I
• 1:03:13
  think of like the hippie climber, like the person in the
• 1:03:15
  VW bus who just goes around to all these places and does these
• 1:03:18
  crazy climbs and, you know, they don't have enough money for
• 1:03:22
  lunch, but they have like. $3000 worth of gear, stuff like that.
• 1:03:26
  So I'm going to bring up Stephen Sean again on this podcast and
• 1:03:32
  brought his name up like feels like so many episodes that he's
• 1:03:35
  over at Octa and he was he's really into climbing.
• 1:03:39
  He did the the flat face of Half Dome in Yosemite and he said
• 1:03:45
  that's a three day climb. So you get up, set up a tent,
• 1:03:49
  like hang off of the wall that that's next level.
• 1:03:53
  If you have to sleep on a wall, if you have to use the bathroom
• 1:03:57
  on the wall, like that's that's just too much for me.
• 1:03:59
  I just, I don't want to deal with that.
• 1:04:00
  Oh man, sleeping in a hotel bedroom is is enough for me?
• 1:04:03
  I don't know. Imagine sleeping off on the air
• 1:04:04
  in a wall. What about you, Jeff?
• 1:04:07
  I haven't climbed in forever. I am not built like a climber
• 1:04:10
  anymore. I would say pear shaped is
• 1:04:12
  probably where I'm at right now. I don't know, I I I was OK at it
• 1:04:17
  when I was you know much younger and and more in shape and.
• 1:04:21
  Body hadn't started to breakdown.
• 1:04:22
  I think it's cool. I have a lot of admiration for
• 1:04:24
  people who can do it. I live in an area here in
• 1:04:26
  Western North Carolina. You know, I live on the side of
• 1:04:29
  a mountain myself, so there's plenty of places to kind of go
• 1:04:32
  and do this. Yeah, I have nothing but the
• 1:04:34
  utmost respect for anybody who's willing to scale anything,
• 1:04:38
  especially, you know, when they're doing it without.
• 1:04:42
  Things to help them like pulleys and stuff like that.
• 1:04:45
  Like if you can do that kind of climbing, I think it's really
• 1:04:47
  cool. I think I think it's just it's
• 1:04:49
  amazing. And I, you know every once in a
• 1:04:50
  while I'll see those like YouTube videos where they're
• 1:04:53
  doing the speed climb up the top and like these got, you know
• 1:04:56
  these people are going up there. Like, I don't know how many feet
• 1:04:58
  it is, but they are flying and it's it's nuts to think about
• 1:05:02
  how quickly they're moving up a wall.
• 1:05:05
  Where most people are probably like trying to figure out just
• 1:05:08
  where do they even start, right. They've already projected their
• 1:05:10
  line, I guess. I don't know, you know, Jason,
• 1:05:12
  is that something that that you've seen those those videos
• 1:05:14
  where they're like you know, speed runners or speed climbers
• 1:05:18
  or what's climbing? So interestingly enough the gym
• 1:05:20
  that I go to, they they have a team for for kids and it's some
• 1:05:26
  of the best kid climbers in the in the world or in the US
• 1:05:30
  trained in this gym. And you want to talk about
• 1:05:33
  humbling is you know you have some of these kids and I'll,
• 1:05:36
  I'll sit there and watch them. They'll get up that wall in I
• 1:05:39
  think the fastest I've seen somebody do and this kid's going
• 1:05:41
  to be Olympic athlete. I know it.
• 1:05:43
  I think he got up in like 7 seconds and I don't know what
• 1:05:45
  the record is. I think it's sub six, but it's
• 1:05:49
  it's just insane. And that's where like I think
• 1:05:52
  that's the other thing I love about the sport is it doesn't
• 1:05:55
  matter what you want. Like, there are just going to be
• 1:05:58
  some people who are better and the people who put in the work
• 1:06:01
  are going to see the results, right.
• 1:06:02
  And so I remember when I first started climbing, I used to be
• 1:06:05
  really into weightlifting and I went with a buddy of mine who's
• 1:06:08
  a former Marine Stew, has the biggest hands I've ever met on a
• 1:06:11
  person. He's just like a complete beast.
• 1:06:13
  He's just like pure muscle. And you realize that when you're
• 1:06:18
  that type of body build, you're going to over exert yourself
• 1:06:22
  right and so. It's not about muscling yourself
• 1:06:25
  up there. It's about how do you find the
• 1:06:28
  most efficient movements to get up there.
• 1:06:31
  And you know when you do it right, it's it's mostly legs and
• 1:06:36
  you know you can climb forever and just certain slender body
• 1:06:39
  types, they're always going to be have a little bit of an
• 1:06:41
  advantage. You know there's a sweet spot on
• 1:06:43
  height. My My wife climbs with me and so
• 1:06:45
  she's shorter. I think she's like 554.
• 1:06:49
  And I'm 511 and you know, we we go back and forth with each
• 1:06:53
  other because she's like, you only got that because you're
• 1:06:55
  tall. And I was like, well, you could
• 1:06:56
  try harder, right? It's just like it's just not
• 1:06:58
  true. Like some people are going to
• 1:06:59
  have an advantage. But you know, that's that's the
• 1:07:01
  fun of it is like you've kind of find your specific area and what
• 1:07:03
  you love and you enjoy and you can push yourself on other
• 1:07:06
  climbs. Well, this sounds amazing.
• 1:07:08
  You make me feel like I want to get out there and I'm not going
• 1:07:10
  to do it, but you make me feel like I want to.
• 1:07:13
  Jason, you've been really generous with your time and I
• 1:07:15
  want to let you, you know, kind of get on with your day.
• 1:07:18
  We're gonna go ahead and wrap up this conversation.
• 1:07:20
  We're gonna have a bunch of links in our show notes so
• 1:07:22
  people can connect with Jason on LinkedIn.
• 1:07:24
  We'll have a link to your Teach Me Cyber YouTube channel, Corvus
• 1:07:29
  Insurance, where people want to learn more about what you do in
• 1:07:31
  in the real world. I'll call it.
• 1:07:34
  And yeah, for Jim and I, we're on the web, idacpodcast.com.
• 1:07:39
  We're on Twitter at IDAC Podcast.
• 1:07:41
  We're on Mastodon. At IDAC podcast at infosec dot
• 1:07:44
  exchange. Jason, have you gotten into the
• 1:07:46
  Macedon thing? I have not.
• 1:07:47
  I was never into Twitter before that collapse, and so I so
• 1:07:52
  you're. Healthy.
• 1:07:53
  OK, great. Exactly.
• 1:07:55
  A little bit of mental extra mental space for me.
• 1:07:57
  Right on, Yeah. So connect with us on LinkedIn,
• 1:08:01
  Twitter, et cetera. Like subscribe to show right.
• 1:08:04
  All the YouTube things are absolutely applicable to the
• 1:08:06
  podcast space. And yeah, we'll go ahead and
• 1:08:09
  leave it there. Jason, thank you so much for
• 1:08:10
  being part of this conversation. Hope you'll come back and and
• 1:08:14
  educate us some more. And with that, we'll go ahead
• 1:08:16
  and leave it for this week and talk with everyone in the next
• 1:08:18
  one. You've been listening to
• 1:08:20
  Identity at the Center. We hope you've enjoyed the show.
• 1:08:24
  Make sure to like, rate and review and we'll be back soon.
• 1:08:29
  But in the meantime, hit the website at
• 1:08:31
  identity@thecenter.com and find us on Twitter at IDAC Podcast.
• 1:08:39
  See you next time on Identity at the Center.