Latest / You've Been Heard / 349- Beyond traditional perimeter security with Trent Heiser

Transcript

349- Beyond traditional perimeter security with Trent Heiser · You've Been Heard

• 0:00
  Speaker A: You've got to start down the road of. Okay, if your firewalls are coming up for a refresh, start looking down the road of a SASE model that has the zero trust built in. You know, where you can do reverse proxy, you can do some of these functionalities, or if you're going and moving more toward cloud with your identity, you know, make sure that you're implementing a either a PIM or a pam.
• 0:23
  Speaker B: Hi, nerds. I'm Michael Moore, hosting this podcast for dissecting popular IT Nerds. I'm here with Trent Heiser, Chief Information Officer at QC Supply. Hey, Trent, how's it going today?
• 0:33
  Speaker A: It's doing well. Thank you for having me.
• 0:35
  Speaker B: Yeah, very good to have you on the program. It's time for our Icebreaker segment. We call this Random Access Memories. I ask a question and then you respond with the answer that comes to your head first. So, Trent, your first question is, how do you balance your IT related work or study with your personal or social life?
• 0:56
  Speaker A: I don't have a personal or social life, really. So the big thing of it is I end up in my computer pretty much all day and all night. And even my significant other, she's in IT too. So we live around our computers.
• 1:11
  Speaker B: Well, that makes it easy, doesn't it?
• 1:13
  Speaker A: Yep.
• 1:15
  Speaker B: So what is the most annoying or frustrating IT related myth or misconception that you have encountered or debunked? Oh, I asked a good question there.
• 1:27
  Speaker A: Yeah, you did. So I would say one of the things that I keep coming across is the myth about Java being free still.
• 1:39
  Speaker B: Oh, interesting go into that one.
• 1:41
  Speaker A: Yeah. So, you know, Oracle changed, you know, when they bought Java, they changed their licensing, I think it was in 2021 or 2020, something like that. And then they weren't. My take on it is they weren't making enough money. So in January 2023, they changed it again. And with that, they basically opened it so they could charge you based on the number of employees you have, whether you have Java installed on all the desktops or not. People think that still Java, you can just download it because you can still go and download it. So they think it's free, but it's not.
• 2:15
  Speaker B: It's not free. Java is not free. Well, and you know, Java is interesting because it's. It's one of those compile on the actual computer applications, and it's interesting because it leads to a lot of processing power on the actual endpoint itself and rather on the server. So I've never been a fan of Java for that I've never been a.
• 2:40
  Speaker A: Fan of Java either. And I love the fact that you have like Azul java, you have OpenJDK, you know, you have all these open source platforms now that are available that are going, okay, we don't like what Oracle did with Java so we're going to try to make it better. And they're doing, you know, they're trying so hard to make it better.
• 2:58
  Speaker B: Yeah, they are, they are. That's a, that's a good point. Absolutely on that. All right, here's your last question. What is the most fascinating or intriguing IT related fact or phenomena that you have learned or discovered? Yeah, another stumper. I've, I'm getting, I'm getting good questions here tonight.
• 3:19
  Speaker A: Yeah, I think so. It would be.
• 3:23
  Speaker B: This is a tough one.
• 3:24
  Speaker A: Can you ask question one more time here?
• 3:26
  Speaker B: Sure, yeah. Oh, this is, he's asking me to repeat the question like I'm on a game show. I love this. Exactly what is the most fascinating or intriguing IT related factor phenomena that you've learned or discovered? I know the wheels. There is literally smoke coming out of his ears right now, guys.
• 3:46
  Speaker A: Yeah, I know, it's, it's amazing. So, you know, I would say that it's got to be around, it's got to be around cyber security. Right. And what, and let me go a little further into that is it's normally about the people and cybersecurity and the incidents that are going on there. Those are the things that really, those are the things that really surprise me and get me going on. Just like when I start talking about cybersecurity, I start talking about the people aspect and awareness training. These are the things that are like basics that aren't being done and you see it over and over again.
• 4:29
  Speaker B: You know, that's so true. There are so many. I come across this all the time. I end up working with a lot of business businesses and a lot of different businesses and it's, it's amazing to see how many businesses just completely disregard items that they should be doing that, you know, that are just basic checklists and basic housekeeping stuff. You know, we see so much businesses that, you know, go out to get cybersecurity insurance and stuff like that. And you know, they fill out a questionnaire, the cybersecurity insurance company will give them a, something to run on their network and then they get the insurance and move on. And, but they, but they disregard what's on that question where it's on the questionnaire for a reason. Right. I mean, if you're not training your employees about the risks about cybersecurity and what can come at them. That's one of the worst possible ways. I mean, didn't MGM get hacked because.
• 5:34
  Speaker A: Of a user MGM got? It's actually help desk. I was just reading about this again because of something that I was working on and their help desk got it.
• 5:45
  Speaker B: Oh my gosh.
• 5:46
  Speaker A: Because they didn't, they weren't doing user verification when someone called to the help desk.
• 5:51
  Speaker B: See, it's just the most basic things that, that end up getting them and the fact that it was part of their IT team was. It's even worse. Yeah, but it's gonna happen to everybody. You know, I, I've personally been in organizations where I've seen it happen on multiple occasions. You know, yeah, people, you know, I.
• 6:12
  Speaker A: I was going to bring up that like, you know, you, you talked a little about, about the, the, the risk and the insurance, you know, doing the cyber, cybersecurity insurance questionnaires. And I've come into organizations and they're like, oh yeah, we just fill it out every year. It's like. But do you actually know what you're filling out? No, we just fill it out.
• 6:32
  Speaker B: It's amazing to me that that's the case. The cybersecurity is such a, Cybersecurity is such a big important with today, especially with the new, all the new tools out that just make everything so easy. I mean there are programs out there right now that just program for you in like minutes. It's not, and I'm not even joking guys. There are literally programs out there that will program in min. And if you think that the, that the, you know, cybersecurity. If you think that the cybersecurity folks that are not here to help you, right? If you think that those folks are using, aren't using those for bad reasons, you're, you're absolutely wrong. They are 100% using it for bad reasons. They are writing malicious code. They are finding ways to do it and that makes cybersecurity all the much more important.
• 7:32
  Speaker A: And you know, you bring this up and you, you know, you talk about your chat GPTs and things like that in an IT security construct. Now if you're not using those types of things to help you get better, then you are so far behind the malicious, the bad actors that are out there that are, they're using it and they, so they know how to utilize a zero day just like that. You know, they can do vulnerability piling or they can take advantage of vulnerabilities you know, multiple at a time. And they're doing it because they're using an AI to generate the scripts for them so they don't have to.
• 8:12
  Speaker B: At dissecting popular IT nerds, we expect to win, and we expect our IT directors to win. And one of those areas where we know that we can help you win is, is Internet service providers. As an IT director tasked with managing Internet connectivity, few vendor relationships can prove more painfully frustrating than the one with your Internet service provider. The array of challenges seems never ending. From unreliable uptime and insufficient bandwidth to poor customer service and hidden fees, it's like getting stuck in rush hour traffic. Dealing with ISPs can try one's patience even on the best of days. So whether you are managing one location or a hundred locations, our back office support team and vendor partners are the best in the industry. And the best part about this is none of this will ever cost you a dime. You don't even have to be smart anymore to be. No, you just have to know what.
• 9:08
  Speaker A: You want to ask to do.
• 9:09
  Speaker B: Yeah, and, and, and Trent, I mean, I look, I looked at your profile because I make the joke. I cyberstalk everyone before I get on the podcast with them. Right. You're a certified ethical hacker.
• 9:21
  Speaker A: Yeah.
• 9:21
  Speaker B: Right. I mean, right. So you know, you're, you are in all sense of purposes a hacker, but a ethical one. And there, there are people out there that can do, that can do hacking. Right. With almost zero IT skill set.
• 9:40
  Speaker A: Yeah, I mean, that's the thing is, like I said, if you know, if you know what to ask the AI and how to ask it, you can get the scripts to hack anything you need to.
• 9:51
  Speaker B: A lot of people think that it's, you know, hey, AI has these safeguards that are put in place and in some cases you're right. If you ask IT to write a malicious code for you, it's going to go, no, I don't want to do that. But if you say, hey, listen, I'm working on a project to, you know, write, you know, to expose how they write malicious code and all this type of stuff. And I need to see certain, if you ask it the right way, there's no, no safety protocols on place. That thing will spit out the right information.
• 10:23
  Speaker A: But take it beyond ChatGPT. Go to the dark web and look at the AI, the maliciously made AI sitting out.
• 10:30
  Speaker B: Oh yeah, on the Dark Web.
• 10:32
  Speaker A: I mean, you know, we were just talking about chat GPT, but there's so many different malicious AIs that are on the Dark Web, and they're made to.
• 10:41
  Speaker B: Do that and not. And also mention, you know, one thing to mention here is that you can actually, you know, you can actually get and create your own AI model. You can train it and put it, you know, keep it off the networks and just train it yourself to write this stuff on your own computer. It, you know, it does, as long as it has training data. You know, as long as it has a base amount of training data and you fed it enough information, it can go to town. So, yeah, you know, not only can you obtain AIs from the dark Web or other sources, you can obtain the models, you can obtain training data, and then you can feed it additional data to make whatever you want. And you can keep it off the network in a completely separate area. And once you get the data, just move it to another spot. So, yeah, we're in an interesting time right now. And the mere fact that you can replicate images of people and videos of people and audio of people at the same time, that you can create malicious code, it's a really interesting and kind of scary time to be in right now. Because what is real, right?
• 12:01
  Speaker A: Yeah, exactly. You know, the Zero trust, you know, you talk a little bit about, so zero trust, which is a big thing that we're trying to get to on a lot of systems right now. Well, it doesn't only apply to systems anymore. It's zero trust. In my. Look at it, it's zero trust. With everything that you're seeing and doing anymore, you can't trust it.
• 12:22
  Speaker B: That's a great point. And let's talk about the Zero Trust model, right? Is basically a way of. I like to call it the Mulder approach, right? The trust no. 1 theory basically continuously authenticates both the user and the device, and also the location of where that device is reporting in from, and only gives you access to the items in which you're supposed to be accessing at that time. So Zero Trust model is definitely the model to be moving to if you're not already there. It is definitely a model that I use and employ and don't trust anything else at the moment, but. Yeah, I'm glad you brought that up. It's. You know, we keep. We hear. We hear buzzwords, right? And we hear zero trust as a buzzword. But the, the reason behind zero trust is because we are operating in this moment, which we cannot trust people internal to the network anymore. We can't trust people, obviously can't trust people external to the network. Um, everybody's operating out of everywhere. They're all over the place. You know, they're no longer in the place where they used to be. Used to be. Everyone went into an office and worked from there and then they left and went home. Right. And that's not the case anymore. Everybody is 247 working in different locations, different countries, different locales. And it's hard to detect whether or not they are supposed to be working from that spot or they're not. So Zero Trust model is basically taking advantage of the fact that we don't know that. So we need to continuously verify this person is the right person, this device is the right device, and this location is the right spot that they're supposed to be in and they're supposed to be accessing this certain thing. They break down Zero trust pretty well for you.
• 14:23
  Speaker A: You did break down Zero Trust very well. Thank you. I hear a lot of people use a lot of different approaches to zero trust. But I, you know, it's one of the things where like you go into an organization and it happens more times than not where you, you're going into an organization and they're like, you know, we want to go to zero trust or we want to do NIST or, you know, whatever, and I'm going to talk more about zero trust right now. But it's one of the things where people get into it and they're like, their approach is more of a trust but verify an older school mentality toward it. And it's like, well, when you start taking people down the road of an actual zero Trust, they're like, wait a second, wait a second. That seems intrusive. It's like, no, it's not. We're protecting ourselves at this point.
• 15:07
  Speaker B: It's very, very true, very true. What is, what is your take on Zero Trust and, and how is it kind of affected your, your team?
• 15:21
  Speaker A: So for me, zero trust it's not, you know, you have to break it down into the different segments. Right. So you have the Zero Trust network, right. And then you have the Zero Trust access, which is more, or can be more along the lines of identity or, or just an access management. And that is where you know, you have the zero trust on that aspect of it. So you have like a privileged management system to say, okay, you can, you're going to get access because you verified who you are and you're going to get access for 45 minutes or an hour or whatever it is. And then you have your Zero Trust network which goes to the device verification every minute. Right. Because we're on a minute by minute almost in most of the zero trust stuff that you're talking about. And so you have to kind of combine those because you're combining zero trust of identity and zero trust of device. And if you leave out one, that's where you're going to have a problem. And so it's a constant review of the data and the auditing capabilities to make sure that the zero trust on the identity and the zero trust on the network or systems are in line.
• 16:35
  Speaker B: Yeah. And what advice would you give to our audience listening that maybe they have not yet moved to zero trust or they're looking to move to zero trust. What, what advice would you give them?
• 16:50
  Speaker A: So one of the things that, that I would probably look at the most when it comes to the zero trust is don't, don't think that you're going to get it all done in one day or, you know, even possibly one fiscal year. But start with something. Start somewhere. You've got to start down the road of like, so, okay, if your firewalls are coming up or a refresh, start looking down the road of a SASE model that has the zero trust built in, you know, where you can do reverse proxy, you can do some of these functionalities, or if you're going and moving more toward cloud with your identity and things like that, you know, make sure that you're, you're implementing a, either a PIM or a PAM to help offset that and go down the road for identity. Zero trust it. So it's not just one or the other. It's like you kind of have to start building somewhere.
• 17:41
  Speaker B: So let's talk, let's talk about sase. Right? These are all good, all good information. Let's talk about SASE a bit. Explain to the audience the capabilities of sase because it's such an amazing tool.
• 17:55
  Speaker A: Well, it seems like it's really tool.
• 17:58
  Speaker B: To really say service, but.
• 17:59
  Speaker A: Yeah, yeah, but it seems like it's con. It's still evolving. Right. You know, the idea of SASE really kind of started striking right around the pandemic, maybe just a little bit before. And at first it was, okay, well, we're going to put our VPN out in a virtual firewall, sitting in a pop somewhere and have that VPN back to our head end our central location. Well, that was great. And we started moving down that road and then they started putting, okay, well if we're going to have the firewall there, we're going to have next generation services there. So we're going to be able to do a detection of any malicious traffic. Okay, that's all going well. Then they're like, well, we want to push that to the device and we're going to make sure that the device to that remote firewall is secure. So then they start securing. Okay, well, if you use just a straight VPN client, you're not going to be able to have that level of security. But if you start doing a client that's capable of your edr, XDR and your host identification, you start tracking that, and then it starts putting your device into a hash and saying, okay, if this hash has changed in the last minute, kick it out. If it hasn't, it's still allowed. Right. And that's, that's a really neat way of approaching it because at that point, you're not trying to have your remote service try to identify whether it's anything changed on that computer. It's. Has that hash changed or has that token changed? Yeah, it's a really good way to look at it. And I don't know if that's a really, you know, if that's kind of explaining or answering your question.
• 19:44
  Speaker B: There's a lot to explain. There's a lot to explain with sase, right? I mean, there's a lot of capabilities of it.
• 19:49
  Speaker A: Yeah. I mean, because they keep adding on to it, you know, so now DLP has gotten built into it. You know, your DNS filtering has gotten built into it. So there's so many things and they keep adding more to it. And that's. It makes me really excited for the security of tomorrow because that's going to continue to evolve.
• 20:08
  Speaker B: Yeah, that's. No, I like how you explained it, especially how you talked about, you know, you know, where we're connecting back to a location. Right. Back to a, you know, like a firewall or something at a, At a location, you know, and with sase, that's not necessarily the case. Right. I mean, you. And not at all. Right. You're. You're actually not. You don't have to do that anymore. So you're not dependent on that location, which is a great option. A great option for. To have.
• 20:40
  Speaker A: For.
• 20:40
  Speaker B: As a business. Right.
• 20:41
  Speaker A: And you look at how SASE has been evolving and the fact that they're picking up all of these different SaaS providers now. Right. So they're taking their, you know, the, the firewall or the, the SASE security that you're beginning to know and love, and you're taking it and going, okay, we want to extend that security stack all the way to the, our SaaS products. So, you know, your Microsoft 365, your Google Cloud, where whatever it is they're going to make or they're, they're trying to get to the point of extending the reach all the way to those pieces. So your security is truly end to end.
• 21:19
  Speaker B: Yeah, no, I love that. It's a great, it's a great way to, to explain it. I deal with this a lot, so I think you're explaining it pretty well. You know, the cyber security is definitely a love of yours. You can tell on there. It was funny because, you know, everyone knows I, I interview people kind of before this as well to try to dig up some information to chat about here and make it interesting. And one of the things I wanted to segue away from cyber security for a minute, but I will segue back, I promise, is that you have a love. And it's a love, guys. A love of budgets, right? Yes.
• 22:07
  Speaker A: No, you nailed it.
• 22:08
  Speaker B: Explain to me the love of budgets. I share. I have a fondness. I don't have a love, but please.
• 22:16
  Speaker A: Tell me the reason why. The love of budgets is it always gets the short end of the stick and cybersecurity even gets the shorter end of that. So the thing of it is, part of it is when you're building your budgets and you're having the conversations, it's about meeting the financial officers where they are, they want to save money. You know, it's not always about just explaining to them. It's like, look, you're going to, this is going to cost you money, but you may save money someday down the road.
• 22:47
  Speaker B: Right?
• 22:47
  Speaker A: It's about putting it in terms of risk for them. And so, okay, because CFOs, they love risk. They love understanding risk, or at least they think they do. And so we talk about that. And so when we start talking about budgets, we're talking about what, what type of risk tolerance do they have? What type of risk will they accept? And when you start talking about that, they start moving a little more away from the technology. Oh, my God. We got, we got to stop people from buying things and start moving toward, okay, we're trying to mitigate risk. Okay, we can get behind mitigation of risk. And so that's why I start loving budgets. Because, look, I'm not having a fight about technology as much. I'm having a conversation with the powers of B that says, this is what we're trying to accomplish. This is the risk we're trying to mitigate. This is the risk we're trying to, you know, in case of insurance transfer and have those conversations. And that's why I love doing it because in the end we get to have a conversation about ultimately it's my love, which is, you know, risk and cybersecurity. But they understand it because it is a risk level.
• 23:57
  Speaker B: So I'll take it one step further, right? Because I love the way you approach it with the risk. I would, I would take one step further and what I would do is I would also understand from those, from those sea levels, right, what their pain points are, what their, what their issues are, identify those pain points, tie them back to the solution that you're trying to implement to mitigate the risk. And sometimes you'll find that the solution for the risk mitigation will also alleviate the pain point. So for instance, I mean here's a silly one, right? Just a silly type pain point. Let's talk about CEO that goes to log in every day and has to keep switching up passwords and everything like that, right? So you say, hey, well you know what I want to do is I know you got all these applications that you have out here. I want to take them and I want to single sign on them, you know, back to our identity provider, right? And that'll actually mitigate the risk of, you know, having these out here that don't have, probably don't have MFA and all this stuff. And then we're going to tie it back to our identity provider which has got strong security stuff and able to work. And it's going to make it so you can log in with 1Password and that password secure and it'll reduce the amount of passwords we need to kill when somebody leaves, right? And it'll reduce that whole risk. Now not only have you done exactly what you said to do, which is the risk, but you've also given them a pinpoint to reduce, right?
• 25:37
  Speaker A: Oh, you nailed that. I mean, and it's funny you bring up single sign on because that's like one of the things that whenever I go in and have a conversation not with necessarily the C levels, but just have a conversation with managers, directors, what those level and say, look, if we can remove sign on from, you know, say 60% of what you're doing on a day to day, would that help? And it's like, well God, you know, that's a huge thing. And they're willing, you know, to your point, they're willing to spend a little extra money to remove some of those sign ons.
• 26:09
  Speaker B: Yeah, everybody wants to make their job easier. Right. And it's not even about making their job easier. Right. It's about giving them back the productivity time. Right. And that's the. That's the huge piece of it is we spend so many, so much time here with. Well, actually, I'll say it this way. Security objectives often align with making things easier. It didn't used to be the case. It used to make things a lot harder. But now the security objectives actually align very well with sometimes reduced cost and also, and also the. The ability to make people's lives easier in the organization.
• 26:50
  Speaker A: Well, look at passwordless. You know, the implementation of passwordless is a perfect example of what you're explaining there. Right. Because you're making everybody's life a lot easier and you're increasing their productivity and you're actually enhancing security. Absolutely.
• 27:05
  Speaker B: Absolutely. It's remarkable to see that it's a. It didn't always used to be the case, but it is most definitely the case now. And the alignments of reduced cost and easability and usability and security all coming together. If you follow methodologies like NIST and Zero Trust and you follow the methodologies correctly and you put them on place incorrectly, then you will end up synergizing those three, which will make everybody happy in the organization and you'll feel a lot better because you'll be safer. Yeah. It's a really, really big deal. And I'm glad that you did share your love of budgets with me so that we could have this talk. Let's talk a little bit about. A little about building relationships with co workers. And before we get into the building relationship with co workers, I want to, I want to just double check with you on something because you had mentioned to me something that you were one of the most forgivable people that you will never meet. Right.
• 28:22
  Speaker A: Forgettable.
• 28:23
  Speaker B: Sorry, Forgettable people that I said that wrong. You're one of the most forgettable people that you will never meet. Right? Is that what you said to me?
• 28:29
  Speaker A: That's what I said, yes.
• 28:30
  Speaker B: I think me. And now the audience needs some. Need some actual context on this.
• 28:38
  Speaker A: So early on in my career, I was one of those people in IT that I would. I would be working at a company for a number of years and I would see somebody that I worked with every day for, you know, two, three years. I'd see them out in the world and they'd be like, I have no idea who you are. And I'm like, I literally talk to you every single day. They're like, yeah, I have no Idea. And it was like, okay, well, one time I can understand, but this happened at two, three different companies. And so I got kind of got proud of the fact. It's like, man, I must be really forgettable. So I. I've kind of gone down this road of I'm the most forgettable person you'll never meet because you won't remember meeting me.
• 29:20
  Speaker B: Wait a second. Have we had you on the podcast before?
• 29:23
  Speaker A: I just don't remember. Right. Nope, nope, not at all.
• 29:26
  Speaker B: Well, when I have you on again, I'll make sure not to remember it, so. No, that. That's great. Now let me ask you a question, though. If. If you are one of the most forgettable people, you'll never meet. Right. How do you build relationships so well within the organization?
• 29:42
  Speaker A: See, that's the thing is, like, I've always kind of wondered, like, because when I'm talking to the people that are. That are my co workers, you know, they're. It's. I'm talking to them about things that are important to them. And I think this kind of also kind of plays into why I become forgettable, because I'm talking to them. Like, I have a really good friend that He's a cfo, and he and I have conversations over and over again. Most of the time it's about financial things, because that's what he likes to talk about. Sometimes he'll ask me questions about IT things. And in the end of the day, when he goes and goes, oh, I need to. I need some IT help or I need something done for it, he doesn't even think about calling me. He calls somebody else. And I'm like, but why? And he's like, well, I never thought about you. And so it's like, look, I love having these conversations. He thinks very highly of me. I think very highly of him. But I'm not the first. You know, I'm not the IT Person he thinks about, which is fine. I don't have a problem with that.
• 30:37
  Speaker B: I just realized, by the way, you would make a great, like, secret agent.
• 30:42
  Speaker A: Yeah. Probably.
• 30:43
  Speaker B: You just. You just walk right in, go to. They'd forget about you. You know, you should be a spy. I mean, that's. That should have been your calling.
• 30:51
  Speaker A: That probably should have been, but, you know, so. And that's why I build these relationships, and these relationships last. I mean, I. I have, you know, my old COO when I was at Aspen, he and I are still good friends, and we still talk. And the c. The CIO that I had at Company in Omaha, you know, she and I still talk. I build these relationships that are long term that we can like have conversations. Like, what are you doing in technology? What are you doing for the, on operation? What are you doing in financial? I like having those conversations because it means a lot, first of all, that we can have the conversations, but the other part of it is, is that they become more than just co workers. They're, they're friends. And that's what becomes important to me is I, yeah, I can go on LinkedIn and I can have my, my, all my connections in LinkedIn, but if I contact any one of those guys, I know that they will help me out with anything I need.
• 31:48
  Speaker B: Yeah, See that's that, that ability to have that dependability and know that they've got your back while you've got theirs. I mean, that's, you can't take that away. That's a great part about being part of a team, right, Is that you're able to have each other's backs and be able to do whatever you need for each other. So that building those partnerships to me is huge within an organization.
• 32:14
  Speaker A: Oh, and building it across different organizations. I mean, it's, you know, you're talking just the organization, but I'm sitting there looking at it and going, you know, people that I worked with 10 years ago, we're still talking, like usually on a weekly or every two week basis, but we still talk. I mean, that means a lot and especially for me in IT when, you know, it is usually the dirty word that no one really wants to talk about. The fact that we have conversations still to this day, after 10, 15 years, it means that I actually made an impact.
• 32:47
  Speaker B: Great. Yeah, no, I think that that's, I think that's awesome. I think that's the way in which, that's the way in which we need to be doing it and personalizing it, in my opinion. You know, it is, you know, I hear stories all the time from friends and stuff like that with, with their IT departments and, and the, and the stories you hear are, you know, I got off the phone, they didn't trust me, they didn't talk to me, they didn't do what I needed and stuff like that. And, and I kind of, you know, every time I hear that, I'm like, oh man, you know, they missed the mark. They missed that mark. Right? They didn't do what you said to do.
• 33:27
  Speaker A: And I, I tell this to my help desk guys all the time. And I actually, I was having a conversation with my manager just before this all. And about this exact thing. It's like have our help. You know, our help desk needs to take that extra time. They need to. To make it personal, you know, a personalized level. And we were, we're trying to fill a position in the help desk. And with that position, it's like, okay, they're, they're an absolute opposite type of personality than the one of the per help desk people that we already have in place. But that's what we need because personalities don't always drive, so you need to have that contrast in personality. So that way if someone doesn't get along with, you know, help desk personality A, they can go to help desk personality B and they, they're treated. Or they feel like they're treated better and it becomes more of a personal approach.
• 34:18
  Speaker B: No, that's a great, great point. I think that in the world that we mentioned that we're living in right now, which is full of things that are not real, right? And things that, you know, that are artificially created, having those types of genuine, I would say genuine moments, right, with people, regardless of if they're a team member or they're a partner that you have or they're a, you know, they're somebody that you meet on the street. Right. The having these meaningful moments matters. And I think it's the thing that's going to remind us that there are some things that are still real, very real in life. I'm going to segue off to our final segment. It's the IT Crystal Ball. And this is where we discuss the future of it. Right? So we've been sitting here talking about the current situation. And it's so funny because I've done a bunch of these and. And it was AI, AI, AI, AI. And. And it's been the, the constant theme, Right? Right. But AI is no longer the future, right. I mean, there are articles now stating that we're about a year away from agentic AI, right? So we're. We're moving away from generative and moving on to the next step, literally, probably, you know, either this year or next year, which is an interesting theory. So, so, you know, that's where we are right now. We're currently at generative AI and that's no longer. No longer a thing that is. Is in the future. We're going to be talking about the future five years out from now. Right. Which is so hard now to predict. Right. Because of all the changes that are happening 20, 25. And some science fiction books promise things like, you know, flying cars and stuff like that. But AI was also, also in those books, you know, and we have reached it, right? We, we are in 2025. We're full of AI and it is permeating everything that we have. So when we talk about the future, we have to kind of think past that, right? We can incorporate it, but we have to think kind of past that. And so let's talk about the future. And since we had such an elaborate discussion on cybersecurity, right, let's talk about what the future of cybersecurity is going to be five years from now. What do you think, Trent? What will be the world of cybersecurity when we look into the future using our IT crystal ball?
• 37:16
  Speaker A: So to me, you know, obviously we, we're going to have AI built into everything. That's fine. But our approach to security is going to continue to evolve. It is, you know, right now we're, you know, sase, or becoming the big thing with zero trust. But as you get more and more mobile devices, more and more Internet of things devices that are running around, how are we going to secure those? And to me, it's literally going to be about securing them from that, that device level or, or the perimeter where you are mentality. So it, it's no longer going to be a, you know, the old perimeter approach to network security is long dead, right? And so they've extended it out to, you know, with sase, they extended out to your device, you know, your computer, wherever it is, but they've been ignoring Internet of things. So you're going to see Internet of things that are going to come relational to these central computing devices. And that's how the security is going to it. The, the computer devices, I think, are going to become that perimeter for your Internet of things devices that are connected to the network.
• 38:32
  Speaker B: It's such an interesting thought. I mean, the Internet of things is IoT is such a, interesting space anyway, right, because we tend to forget about it because it's like, oh, I have a, you know, I have a, an Alexa or a Google home, right? Oh, I have this, you know, this watch that needs an IP address. I, oh, I have a refrigerator that checks in. I have, you know, but you just, you don't use it and think about it. It just works in the background, right? And so many, so many things now are Iot and it's a, you know, I'm glad you brought this up because what other things will become Iot and, and, and you can imagine if you take some things that are in such Common use. Not only do they become, you know, not only when they become Iot, they become very abundant, but also as technology gets better, they become disposable, which is another problem. Right?
• 39:39
  Speaker A: Yep. Yeah. I mean, you start going down the road of the IoT and I'll use airtags. It's kind of a great kind of Iot, almost a scary cybersecurity thing, right. The idea of the first generation airtags and what they were able to do with them before they started locking them down was scary enough as far as, what, you know, cyber stalking or, you know, stalking people using air tags. But now, you know, they're going to have the second generation AirTags probably this spring, and their accuracy is going to be so much more. But the thing of it is, is it's going to. There's more. Going to be more memory to it. There's going to be more opportunity to take advantage of it from a list, from a malicious standpoint. And those are the things that people don't think about that they just are there.
• 40:25
  Speaker B: Yeah.
• 40:26
  Speaker A: So, yeah, we have to secure them.
• 40:28
  Speaker B: I mean, there's silly things like, you know, if you wanted to throw hacks out there, right. We all know the common easy hack before, which was, you know, someone picks up a. Just, you know, throw out a bunch of USB drives and. And I, I even had. I even had someone on the podcast that even told me about that they did, was one time where they threw out a bunch of USB drives and. Just to see who took them, right? And actually recorded how many people took them and stuff. Not maliciously, just. Just to verify and see who did it. And a staggering amount of people took them and plugged them in. Right? But with IoT, it's even easier, right, because you can throw. Let's. I mean, right now, you know, watches and stuff are expensive, like, you know what I mean? But they won't be in the future. There'll be throwaways. People will be replacing them very quickly and. And there'll be cheaper ones. And so you get, you know, leave a watch out on, you know, out there and somebody picks it up and starts incorporating it and it starts connecting it to their phone and bam, right. You know, all of a sudden you can pull their bank records and you're done. Right? So I mean, there's just small little things like that, Right. You know, it's amazing to me, the ability. So, you know, I think you're onto something with this IOT piece and the next evolution of this stuff. Combine that with Agentic AI and we're going to have some trouble here.
• 42:00
  Speaker A: Oh, yeah, very much so. But you know what? The thing of it is, I'm excited for it because the only way that we get better is for things like that to occur.
• 42:10
  Speaker B: That's very true.
• 42:11
  Speaker A: So I'm excited for it.
• 42:13
  Speaker B: I love it. Trent is excited for the future. Nerds. I'm Michael Moore, hosting this podcast for dissecting popular IT Nerds. I've been here with Trent Heiser, Chief Information Officer at QC Supply. Trent, thank you so much for joining the program for us. I would. I would love to have you on again, if I remember.
• 42:34
  Speaker A: Thank you.