Latest / The Application Security Podcast / Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec

Transcript

Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec · The Application Security Podcast

• 0:00
  Chris Romeo: Meghan Jacquot is a security engineer with Inspective, and focuses on vulnerabilities and attack surface management.
• 0:07
  Chris Romeo: She's particularly interested in cloud security, threat intelligence, investigating vulnerabilities, and the ethical use of data.
• 0:15
  Chris Romeo: Meghan shares her research via conferences and publications, and she helps various organizations and folks throughout the year, including DEFCON as a SOC, GOON, Diana Initiative, OWASP, SANS, and WeCyS.
• 0:26
  Chris Romeo: She also visits national parks and gardens and hangs with her chinchilla to relax.
• 0:31
  Chris Romeo: Meghan joins us to explain the concept of Assumed Breach Red Team Engagements, and how these apply to AppSec.
• 0:38
  Chris Romeo: I hadn't heard this term before, so I wanted to understand it more deeply.
• 0:42
  Chris Romeo: Meghan takes us into various scenarios of assumed breach, and we understand how it all fits together.
• 0:48
  Chris Romeo: We hope you enjoy this conversation with Meghan Jacquot.
• 1:29
  Chris Romeo: Hey folks! Welcome to another episode of the Application Security Podcast.
• 1:33
  Chris Romeo: This is Chris Romeo.
• 1:34
  Chris Romeo: I am the CEO of Devici and also co host of said podcast with my good friend Robert.
• 1:41
  Chris Romeo: Hey Robert, what's happening?
• 1:43
  Robert Hurlbut: Hey Chris, doing well.
• 1:45
  Robert Hurlbut: This is Robert Hurlbut.
• 1:46
  Robert Hurlbut: I'm a Principal Application Security Architect and Threat Modeling Lead at Aquia and excited to be here for another episode of the podcast.
• 1:54
  Chris Romeo: With a certain amount of madcap fun.
• 1:57
  Chris Romeo: Always guaranteed with an asterisk attached to it for whatever reason the lawyers say we have to put an asterisk after it.
• 2:03
  Chris Romeo: I don't know.
• 2:03
  Chris Romeo: I don't know why that would be.
• 2:04
  Chris Romeo: But super excited to be joined by Meghan Jacquot.
• 2:08
  Chris Romeo: Did I get it right?
• 2:09
  Meghan Jacquot: You did.
• 2:10
  Chris Romeo: it there.
• 2:10
  Chris Romeo: I tried.
• 2:10
  Chris Romeo: I went all in.
• 2:11
  Chris Romeo: That was my full theater, kind of embracing my inner theater performance there, which I have only experienced as a very young child.
• 2:19
  Chris Romeo: Uh, but let's, uh, jump in, Meghan.
• 2:20
  Chris Romeo: We always like to hear people's security origin stories.
• 2:22
  Chris Romeo: Like how'd you get into this world of security?
• 2:26
  Chris Romeo: You can go back as far as you want.
• 2:28
  Chris Romeo: Um, and we just, we love to hear people's stories.
• 2:30
  Chris Romeo: So please share.
• 2:33
  Meghan Jacquot: Absolutely.
• 2:33
  Meghan Jacquot: I think it's a fascinating thing to think about your origin story and, um, how you got to where you are and then maybe forecast to where you might be going next.
• 2:42
  Meghan Jacquot: Um, for me, mine begins very young.
• 2:45
  Meghan Jacquot: Um, so I knew that intelligence was a field because my grandfather was career military intelligence and had actually been in the OSS, which later on becomes the CIA.
• 2:57
  Meghan Jacquot: And so I was just intrigued that.
• 2:59
  Meghan Jacquot: Intel existed.
• 3:01
  Meghan Jacquot: Um, and he couldn't tell us anything, right?
• 3:03
  Meghan Jacquot: Like even nowadays, um, he's passed, but some of the missions that he was on are still classified.
• 3:09
  Meghan Jacquot: Um, some of the things are not.
• 3:10
  Meghan Jacquot: So I've been able to read up on some of the things, but it was just fascinating that that existed.
• 3:14
  Meghan Jacquot: And so I was like, Hmm.
• 3:16
  Meghan Jacquot: Store that away.
• 3:17
  Meghan Jacquot: Interesting.
• 3:18
  Meghan Jacquot: Um, and then both my parents were in STEM.
• 3:21
  Meghan Jacquot: So my mom was a nurse practitioner.
• 3:22
  Meghan Jacquot: My father was a database analyst using Tableau.
• 3:26
  Meghan Jacquot: Um, and so I kind of had that tech side of things always around me where it would be, you know, like, oh, learn a new technology, teach it to yourself, teach it to another.
• 3:35
  Meghan Jacquot: So had always loved tech, always was kind of the person in the family that would fix something if it was broken.
• 3:40
  Meghan Jacquot: Sometimes I would take apart that thing to figure out how it worked, um, so kind of like the breaker side of things.
• 3:47
  Meghan Jacquot: Um, but I didn't actually start in security, so I had like all this stored in my head.
• 3:53
  Meghan Jacquot: And I really liked helping others, really enjoyed learning and teaching.
• 3:57
  Meghan Jacquot: And so I actually went into education.
• 4:00
  Meghan Jacquot: And so I was a teacher, um, teaching engineering and computer science to 11th and 12th graders.
• 4:06
  Meghan Jacquot: Um, and then because I had that technology side and I was working at smaller schools, if you've ever been to a smaller school, they always have many, many needs.
• 4:14
  Meghan Jacquot: I was also the kind of like sysadmin, network admin, just because they didn't have that staff.
• 4:18
  Meghan Jacquot: So I was just doing like part time teaching and part time IT, essentially.
• 4:24
  Meghan Jacquot: And I kept leaning into the IT side of it and was like, Hmm, I, I think, I think I want to switch more into this.
• 4:32
  Meghan Jacquot: What, what would I do?
• 4:32
  Meghan Jacquot: How would I do that?
• 4:34
  Meghan Jacquot: So pre pandemic, I decided to go back to school and I got another degree.
• 4:39
  Meghan Jacquot: Um, so some people, you know, are more of the, like, I want to learn and just like break everything.
• 4:45
  Meghan Jacquot: Yeah.
• 4:45
  Meghan Jacquot: I think because of my background with education, I really like the formal learning style, as well as doing on your own.
• 4:51
  Meghan Jacquot: And there's no, there's no right way.
• 4:53
  Meghan Jacquot: There's no like, you know, this is the path to get into security.
• 4:57
  Meghan Jacquot: But for me, I enjoyed the formal pieces to it.
• 4:59
  Meghan Jacquot: So I went to, you'll see an Illinois behind me.
• 5:02
  Meghan Jacquot: Um, I'm originally from the Midwest, but I'm on the East coast now.
• 5:05
  Meghan Jacquot: So I went to University of Maryland, um, and got another degree in comp sci with a focus in, um, network and system securities.
• 5:13
  Meghan Jacquot: Um, so finished with that and was like, okay.
• 5:16
  Meghan Jacquot: I have some knowledge.
• 5:18
  Meghan Jacquot: I've, you know, already been doing the breaking side of things.
• 5:22
  Meghan Jacquot: What's next?
• 5:23
  Meghan Jacquot: Well, I knew that Intel was a thing.
• 5:25
  Meghan Jacquot: Um, what if I go into threat intelligence, right?
• 5:29
  Meghan Jacquot: That's just layering on technology with Intel.
• 5:32
  Meghan Jacquot: Um, and so I started doing a lot of research, um, started meeting people, networking, um, joining a bunch of different organizations.
• 5:41
  Meghan Jacquot: And then landed upon my first security job, which was at Recorded Future.
• 5:46
  Meghan Jacquot: And so I was part of the Insikt Group there, and I was doing threat intelligence for a variety of different organizations.
• 5:52
  Meghan Jacquot: Um, really interesting work, um, a lot of research involved.
• 5:56
  Meghan Jacquot: It wasn't quite as hands on technical as I wanted it to be.
• 6:00
  Meghan Jacquot: And so then I started looking for, well, what's the next thing?
• 6:03
  Meghan Jacquot: Um, and I ended up at this, you know, kind of fun startup, um, called Inspectiv and we do, um, AppSec work.
• 6:09
  Meghan Jacquot: It is very technical.
• 6:11
  Meghan Jacquot: Um, and we do, um, penetration tests as a service and bug bounty as a service for all sorts of, um, websites, AppSec, um, anything that you name it, we even do network stuff, but, um, it's really been enjoyable and I've been there for several years now, um, and yeah, it's been kind of a fun little journey of like twists and turns of like, you know, from my, From my, um, early ages, I knew that this was a thing, and then you store that away, and you store that away, and you're like, Okay, well, what do I want to be next?
• 6:40
  Meghan Jacquot: What do I want to do?
• 6:41
  Meghan Jacquot: Kind of the question that I think you can eternally keep asking yourself is what do I want to be when I grow up?
• 6:47
  Meghan Jacquot: You know, it's not that you have to be one thing,
• 6:49
  Chris Romeo: I'm just laughing because I, I asked, you know, college aged young people these days.
• 6:55
  Chris Romeo: And then I always caveat it with, I have no idea what I'm going to do when I grow up.
• 6:59
  Chris Romeo: So don't feel like you have to, you have to figure it out at this point.
• 7:03
  Chris Romeo: Like it is, I'm with you.
• 7:03
  Chris Romeo: It's a, it's a constantly reevaluating type of thing.
• 7:07
  Chris Romeo: You can.
• 7:08
  Chris Romeo: Life is, has so many opportunities that you can change your scope and change your perspective so often.
• 7:14
  Chris Romeo: So, I am curious though, coming from the classroom, is that something that you think you'd, you'll return to in the future?
• 7:23
  Chris Romeo: As far as like investing directly in the next generation?
• 7:26
  Chris Romeo: Or is that something you feel like is kind of a chapter, like you did it for a period of time and now you're on to kind of other things?
• 7:33
  Meghan Jacquot: Yeah, I actually still mentor, um, former students.
• 7:36
  Meghan Jacquot: So I have some students who are now in college, um, almost done with it.
• 7:40
  Meghan Jacquot: And, um, they are, I, a couple of them are going into cybersecurity.
• 7:44
  Meghan Jacquot: Um, so I, I've been still doing mentorship of that next generation.
• 7:48
  Meghan Jacquot: Um, and then I, every year participate as part of the, um, WeCyS mentorship program.
• 7:53
  Meghan Jacquot: So I'm a mentor for that.
• 7:55
  Meghan Jacquot: and most of the people who are my mentees are college students.
• 7:58
  Meghan Jacquot: As far as going back to the high school, I still do guest speakership at high schools, um, so I've continued to kind of give back to that, um, group, um, and, um, I know there's CyberPatriot as well, so I had set up one at my school.
• 8:14
  Meghan Jacquot: The current teacher who took some of the classes that I was teaching did not continue that, but if they did, I said, you know, if you ever need any ideas or mentorship for that type of program, I'd be happy to do so.
• 8:26
  Meghan Jacquot: Um, so I, I have continued it, just not as formally.
• 8:29
  Meghan Jacquot: Um, I could see further on down the line, um, it doing something that is a little bit more Intensive or intentional in the sense of maybe teaching like some college students or, um, helping out more with the high school type thing.
• 8:47
  Meghan Jacquot: So I think that there's always room.
• 8:49
  Meghan Jacquot: If you have the cycles, there's always room and need, um, for the next generation to.
• 8:57
  Meghan Jacquot: understand and learn better from people who are actually doing this work.
• 9:01
  Meghan Jacquot: Um, I mean, they, just the questions they ask, I, I find them to be really fascinating.
• 9:06
  Meghan Jacquot: And, you know, like people are like wondering, well, how do I do this?
• 9:09
  Meghan Jacquot: Or how does that work?
• 9:10
  Meghan Jacquot: Or is, is this really tracking me?
• 9:12
  Meghan Jacquot: Um, et cetera, you know, like.
• 9:14
  Meghan Jacquot: Yeah, just kind of going through different questions people have is a lot of fun.
• 9:18
  Chris Romeo: And, and you mentioned WeCyS, I'm familiar with it, but I'd love for you to just introduce for those in our audience who might not know, um, what WeCyS is.
• 9:26
  Meghan Jacquot: Yeah, so it stands for Women in Cybersecurity.
• 9:28
  Meghan Jacquot: Um, and so then kind of like the shortened form is like We Sisters.
• 9:32
  Meghan Jacquot: And so you might hear that and you might think like, oh, maybe that excludes me.
• 9:35
  Meghan Jacquot: It actually doesn't.
• 9:36
  Meghan Jacquot: So anyone is welcome to join.
• 9:38
  Meghan Jacquot: It's an international nonprofit organization and it's really for just increasing Anyone who is, um, less represented, um, in cybersecurity and bringing them further in.
• 9:50
  Meghan Jacquot: So either getting them to break in, helping them level up, helping them increase executive leadership skills, wherever you are in your career path.
• 9:59
  Meghan Jacquot: And so, um, you know, like, You might see, like, you can hear this and be like, okay, Meghan's a woman.
• 10:05
  Meghan Jacquot: Of course, she might be in that organization, but anyone could join and become someone who is doing mentorship or maybe is even like, um, going to the conference and doing resume reviews or is, um, You know, getting their resume reviewed, right?
• 10:19
  Meghan Jacquot: So it's not that it has to be a, you just give, give, give.
• 10:23
  Meghan Jacquot: You can also receive some of the services as well, too.
• 10:25
  Meghan Jacquot: And they do an annual conference, um, they were started in the United States.
• 10:30
  Meghan Jacquot: Um, so the conference so far has always been in the United States.
• 10:32
  Meghan Jacquot: They're having their 10th one.
• 10:34
  Meghan Jacquot: Um, in March of this year of 2024.
• 10:39
  Chris Romeo: Very cool.
• 10:42
  Robert Hurlbut: Well, Meghan, one of the things that, uh, you shared with us, uh, before we met today was, uh, talking about some of the things that you've done in terms of helping clients find things that they had no idea were being exposed.
• 10:55
  Robert Hurlbut: But one particular was, uh, an issue where credentials and clear texts in a public facing GitHub repo was found.
• 11:02
  Robert Hurlbut: Can you talk, talk to us about that?
• 11:04
  Meghan Jacquot: Yeah, absolutely.
• 11:05
  Meghan Jacquot: So I think one of the skill sets that I really have is, is ability to do research and, and just think through, um, what the attack surface might be.
• 11:15
  Meghan Jacquot: And so that comes from both.
• 11:17
  Meghan Jacquot: background in education, but also the training that I had in Intel.
• 11:21
  Meghan Jacquot: And I've really applied that to the AppSec world and thinking through, like, where someone might hide something or where someone might inadvertently put something, right?
• 11:30
  Meghan Jacquot: And so you could potentially have a circumstance where one of your dev team sets up a GitHub repo.
• 11:38
  Meghan Jacquot: They connect things that maybe should not be connected public facing, right?
• 11:41
  Meghan Jacquot: And, and, like, I have a GitHub repo.
• 11:44
  Meghan Jacquot: I have things that I put on there just to open source.
• 11:47
  Meghan Jacquot: Um, but I don't have anything that is Company facing public.
• 11:53
  Meghan Jacquot: Um, and I kind of keep those two worlds separate, but not everyone does that, right?
• 11:56
  Meghan Jacquot: You might just have the one single GitHub account and then you've just set up everything through that and then you inadvertently set something to public.
• 12:05
  Meghan Jacquot: Um, and so what we did was we.
• 12:08
  Meghan Jacquot: actually combed through to see, like, who are some of the employees of this company, right?
• 12:12
  Meghan Jacquot: So this is just general OSINT, so just general open source intelligence gathering.
• 12:16
  Meghan Jacquot: Um, you can do this through looking at places like LinkedIn.
• 12:20
  Meghan Jacquot: Um, you can also use a variety of different, um, people finders.
• 12:23
  Meghan Jacquot: The, um, OSINT tool set is really good for looking through those.
• 12:28
  Meghan Jacquot: Um, and then, um, You know, cross referencing that to GitHub repos that align with both company and name match.
• 12:35
  Meghan Jacquot: Um, so just simple searching you can do.
• 12:37
  Meghan Jacquot: You can set up a crawler to do this, so you can do it manually.
• 12:40
  Meghan Jacquot: Um, and for this particular client, we actually found that one of their lead devs, um, had a public facing GitHub.
• 12:48
  Meghan Jacquot: Um, and as you were combing through, what was actually in there was the content of that.
• 12:52
  Meghan Jacquot: Um, it actually had clear credentials that were, um, we were able to authenticate with.
• 12:58
  Meghan Jacquot: Um, so it was one of those finds that, um, we deemed critical, of course, um, and let the client know immediately, even though we're still working on the penetration test.
• 13:08
  Meghan Jacquot: Um, and also one of those finds that you're like, yes, I'm so glad I found this.
• 13:12
  Meghan Jacquot: Here, here, client, here you go.
• 13:14
  Meghan Jacquot: Um, please fix this immediately.
• 13:16
  Meghan Jacquot: Please rotate those credentials, check to see if anything was compromised, because if we found it, We didn't know how long it had been, I mean, you can see when it was, like, you know, most recently, um, had a, like, pull or, or a push request, but we didn't necessarily know, like, how long it's been on there, right?
• 13:31
  Meghan Jacquot: Who's viewed it?
• 13:31
  Meghan Jacquot: Like, you don't get any, um, necessarily data around, like, oh, who's looked at this?
• 13:38
  Meghan Jacquot: It's just out there.
• 13:39
  Meghan Jacquot: Um, who scraped this?
• 13:41
  Meghan Jacquot: It's just out there.
• 13:41
  Meghan Jacquot: And so, um, it was a great find, um, and also something that we wanted them to, to change immediately.
• 13:47
  Meghan Jacquot: And they, they took swift action with it too.
• 13:50
  Chris Romeo: And it's something that happens more often than we would like to report, right?
• 13:56
  Chris Romeo: Like, it seems like it's an issue where we've had lots of, lots of visibility into it over the last number of years.
• 14:02
  Chris Romeo: There are even some tools that'll help you, open source tools that'll help you scan and find secrets that are in any repo, right?
• 14:10
  Chris Romeo: But it's, it just, it still happens.
• 14:13
  Chris Romeo: It's still, it's still.
• 14:15
  Chris Romeo: People are still accidentally making that mistake.
• 14:18
  Chris Romeo: And so it's, it's something that I'm glad you found it.
• 14:20
  Chris Romeo: I'm glad you found it before somebody else, uh, could find it and use those credentials to, uh, their own advantage, um, as a, as an attacker.
• 14:30
  Chris Romeo: So the primary topic that we were going to, we're going to discuss here is something I'm not even really sure what this means.
• 14:37
  Chris Romeo: And so I'm really, I'm really excited for you to explain it to me because I know what the words separately mean.
• 14:44
  Chris Romeo: I don't know what they, when we put them all together.
• 14:46
  Chris Romeo: And so this is the concept of assumed breach of red team engagement.
• 14:50
  Chris Romeo: And so I'd love Meghan, if you can just, just give me a high level picture as far as I know what red team engagements are.
• 14:57
  Chris Romeo: But when we add the extra assumed breach qualifier on the end, I'm not really familiar with that concept.
• 15:02
  Chris Romeo: So I'd love it if you could explain that as a way to start.
• 15:04
  Meghan Jacquot: Yep.
• 15:13
  Meghan Jacquot: And we might be using the same terms to mean the same thing.
• 15:14
  Meghan Jacquot: And so, I always find it useful to define what we mean, right?
• 15:14
  Meghan Jacquot: We could be speaking the same thing, talking about the exact same thing, but meaning different things, or we could be meaning the same thing, so, um, the way that we use assume breach, um, it means that, um, you as a way.
• 15:27
  Meghan Jacquot: You know, good guy.
• 15:29
  Meghan Jacquot: Um, you is the person going into the system with permission with the rules of engagement with the contract.
• 15:35
  Meghan Jacquot: Um, you have access.
• 15:38
  Meghan Jacquot: Um, and so just like how a threat actor could gain access and they've done a breach, um, if you're doing an assumed breach activity, you are given access.
• 15:49
  Meghan Jacquot: Or you're kind of shown a little bit of a pathway in, and then you're going to try to see how you can pivot further.
• 15:56
  Meghan Jacquot: Um, and so it really depends on a client and how much access they want to give from the get go.
• 16:02
  Meghan Jacquot: Do they want to give you, um, a low level access?
• 16:06
  Meghan Jacquot: of a fake actual employee.
• 16:09
  Meghan Jacquot: Um, I've seen many different designs.
• 16:11
  Meghan Jacquot: And so the design part of this is actually quite a lot of fun because you can be very creative in how you design it.
• 16:17
  Meghan Jacquot: For example, um, we had one recent one, um, I think it was last year where they determined to create a new employee, but they were going to use employee credentials, um, as far as like email and everything that they were setting up, user ID, that were very, very close to an existing employee.
• 16:38
  Meghan Jacquot: So if someone did not look closely, they might see this and see someone in the system, their, their regular sysadmin might see that person and think, okay, yeah, that's, that's just Mo doing her thing.
• 16:49
  Meghan Jacquot: Right.
• 16:50
  Meghan Jacquot: Um, but it was actually the pentesters in there.
• 16:54
  Meghan Jacquot: And so, um, They were given that access, um, and then they're going to try to take it as far as they can.
• 17:01
  Meghan Jacquot: So there might actually be a goal, um, for these.
• 17:04
  Meghan Jacquot: So there might be a particular server that you want to try to get to that has IP on it, that has maybe, um, PII of customers or internal employees.
• 17:16
  Meghan Jacquot: Uh, so it really just depends on what the client is looking for, but essentially You have some sort of foothold that you start with, and once you have that foothold, you're navigating in, um, and so they're typically not, um, a black box type test, um, it's more of a, um, you, you're given something first, because the idea is that credentials exist out there, or people get phished, right?
• 17:43
  Meghan Jacquot: So if Access isn't the issue, right?
• 17:47
  Meghan Jacquot: You know, if, if a certain group really wants to target your organization, they can get that access one way or another.
• 17:55
  Meghan Jacquot: It could be like an insider threat, right?
• 17:57
  Meghan Jacquot: We've seen that before.
• 17:58
  Meghan Jacquot: It could be phishing.
• 17:59
  Meghan Jacquot: I mean, we saw that with the MGM, with the call center techs.
• 18:02
  Meghan Jacquot: Um, and it could be maybe just a compromise.
• 18:06
  Meghan Jacquot: Maybe there's password reuse happening.
• 18:08
  Meghan Jacquot: So there's many different ways to gain that initial access.
• 18:11
  Meghan Jacquot: So set initial access aside.
• 18:13
  Meghan Jacquot: Let's see what can happen once you already have a foothold, um, and where can you go.
• 18:19
  Meghan Jacquot: And then the way that I view this is different than a penetration test and more of a red team engagement is it's not that you're going through some sort of list and trying to see, like, oh, are there issues with the OWASP top 10?
• 18:32
  Meghan Jacquot: Are there certain CWEs?
• 18:34
  Meghan Jacquot: You're actually trying to achieve and action like a threat actor would do.
• 18:40
  Meghan Jacquot: And so that's where I was referencing earlier.
• 18:42
  Meghan Jacquot: Maybe you're trying to get to a certain like server database or something.
• 18:46
  Meghan Jacquot: Maybe there is a specific keys to the kingdom.
• 18:48
  Meghan Jacquot: Maybe you're trying to do a pure privilege escalation elevation.
• 18:53
  Meghan Jacquot: Maybe you're trying, maybe you actually do some fishing, like fishing is part of the rules of engagement for this, and you can do targeted whale fishing, and you're trying to get to some of the highest C suite level, or maybe the board.
• 19:04
  Meghan Jacquot: Um, and so there's different like angles you can take with it.
• 19:07
  Meghan Jacquot: Um, but the idea is you're, you're setting aside, um, the hack this piece.
• 19:14
  Chris Romeo: So a couple of couple of clarifying questions Do you think that this style of test is Used more because our external defenses are becoming?
• 19:29
  Chris Romeo: more battle hardened and more difficult for attackers to come through like a, uh, buffer overflow in a Unix service or something.
• 19:39
  Chris Romeo: You know, I know I'm going way back into the days of old when that was the easiest way into any given system was to just find a vulnerability in a Unix daemon and use a remote code execution to Get into a shell inside of that and then use that as your way in.
• 19:54
  Chris Romeo: But do you think, are we just, are we getting better at security from a kind of infrastructure perspective?
• 19:59
  Chris Romeo: And does that also lead you to wanting to do this type of test or, or customers wanting to do this type of test?
• 20:05
  Meghan Jacquot: That's a really good question.
• 20:06
  Meghan Jacquot: So, I think, It's the type of test that is really great for a mature organization.
• 20:13
  Meghan Jacquot: So they are going to be better with their infrastructure.
• 20:17
  Meghan Jacquot: They are going to be better with just detecting.
• 20:19
  Meghan Jacquot: They're going to have a dedicated blue team.
• 20:22
  Meghan Jacquot: They're not going to just be a security team of one or zero, right?
• 20:25
  Meghan Jacquot: Some of these smaller orgs, you have A security team that's zero people, one people, two people.
• 20:31
  Meghan Jacquot: So these are going to be the larger orgs.
• 20:33
  Meghan Jacquot: Um, and it's going to be an activity that then can be switched over into a purple team activity, essentially, because you can take the findings from this and see, well, what were we able to detect?
• 20:47
  Meghan Jacquot: How did we respond?
• 20:49
  Meghan Jacquot: Um, you know, okay, when the type of report you get for this is really different too.
• 20:53
  Meghan Jacquot: It's a narrative style report.
• 20:55
  Meghan Jacquot: And so as you're looking through that reporting and you're seeing the different things that the red team went through, are you able to align those with detection?
• 21:05
  Meghan Jacquot: Where is it in the logs?
• 21:07
  Meghan Jacquot: But you have to have all those systems set up in place in order to do that.
• 21:10
  Meghan Jacquot: And so if you don't have any of those detection systems set up in place, if you don't have a hardened infrastructure, you know, it doesn't make any sense to do this type of activity yet.
• 21:19
  Meghan Jacquot: So you kind of need to grow and mature to it.
• 21:22
  Meghan Jacquot: Um, and so I would say it really depends on where the organization is in their security journey.
• 21:28
  Meghan Jacquot: Um, you know, you, you start as a new org, maybe you're doing, um, maybe everything on prem and you're doing like shifting to the cloud or something like that.
• 21:38
  Meghan Jacquot: And then you're continuing on your security journey or you're doing various things throughout.
• 21:44
  Meghan Jacquot: Um, you know, we, we always have a risk register, right?
• 21:47
  Meghan Jacquot: It's never that there's zero risk.
• 21:48
  Meghan Jacquot: Yeah.
• 21:49
  Meghan Jacquot: It's just risk you've accepted.
• 21:51
  Meghan Jacquot: Um,
• 21:51
  Chris Romeo: a job if the risk register was empty,
• 21:54
  Meghan Jacquot: exactly, exactly, right?
• 21:56
  Chris Romeo: all know that's not going to happen.
• 21:57
  Meghan Jacquot: No, it's, it's, it's never going to happen.
• 21:59
  Meghan Jacquot: And so, so there's always something more you could do.
• 22:02
  Meghan Jacquot: There's always something different you could do, but it's making those choices, right?
• 22:05
  Meghan Jacquot: It's like, what's the business trade off?
• 22:07
  Meghan Jacquot: Um, and so as organizations get larger, they're going to need to make that continued investment into security, into making those choices for how they want to reduce their risk.
• 22:19
  Chris Romeo: So I have another scenario then, that I'm just, I don't know if this is even possible, so tell me if this is even, if this is even a viable, assumed breach of red team style engagement.
• 22:30
  Chris Romeo: But have you ever had or seen an example where, There was a SQL injection that was provided, and all you had access to was the knowledge of a SQL injection.
• 22:40
  Chris Romeo: So not as much of a credential where you're into VPN in, or you're into systems, but you're starting with a known vulnerability to see how you can, you know, experience that lateral movement once you're inside the fence.
• 22:53
  Chris Romeo: Is that, is that a assumed breach of red team as well, or is this, is that a more specific pen test?
• 22:58
  Chris Romeo: Yeah,
• 22:59
  Meghan Jacquot: That's an interesting one.
• 23:00
  Meghan Jacquot: So with the SQL injection, are you able to then gain access?
• 23:04
  Meghan Jacquot: So like, is it like you have essentially like a POC with that?
• 23:07
  Meghan Jacquot: Like, like you, this is a known avenue into the systems.
• 23:12
  Chris Romeo: yeah, I'm just, I'm literally just making this
• 23:15
  Meghan Jacquot: Yeah.
• 23:15
  Meghan Jacquot: And I know it's a hypothetical scenario.
• 23:17
  Chris Romeo: I'm just curious if that's a vector that, that could also fit into this style of test, or is that maybe just something that's different because you don't have, because it's not credential based, it's not access based.
• 23:30
  Meghan Jacquot: No, I think it can be different avenues of access.
• 23:33
  Meghan Jacquot: I don't think it needs to be that they actually created an account for you.
• 23:38
  Meghan Jacquot: or they turned over an employee that's no longer there and they reactivated the account or something like that, right?
• 23:44
  Meghan Jacquot: I don't think it needs to be one style of initial access.
• 23:49
  Meghan Jacquot: Um, it's more about what is, what is the goal once you have that initial access?
• 23:53
  Meghan Jacquot: Like, is it goal based or is it more, um, like you're looking at the ASVS and you're trying to correlate different weaknesses, something like that?
• 24:01
  Meghan Jacquot: So, um, I think it's, you know, You know, any way you can set aside initial access.
• 24:08
  Meghan Jacquot: I haven't seen someone do that though, that is a really interesting idea.
• 24:14
  Robert Hurlbut: I wonder about situations where you already have customers who can sign up for a service and then they log in and they get certain privileges to be able to do work.
• 24:30
  Robert Hurlbut: We sometimes will test for Uh, authentication issues, just being able to get in, um, but when they don't have an account, but if you allow them to have an account, already have an account, is that part of also assumed breach, where they're already have certain level, uh, that they're in, or is it potentially beyond that?
• 24:46
  Robert Hurlbut: Is that maybe another scenario?
• 24:49
  Meghan Jacquot: Yeah, so I, you can test in a variety of different ways, right?
• 24:52
  Meghan Jacquot: So you could say, we also want you to test authentication, um, and the workflows for that.
• 24:59
  Meghan Jacquot: And we want you to test if you have no login, we want you to test if you have a lower level login, we want you to test if you have super admin, and so you could set up a variety of different scenarios.
• 25:13
  Meghan Jacquot: If you start getting into the testing the authentication workflow with no initial access, you You aren't doing as much of an assumed breach, right?
• 25:24
  Meghan Jacquot: Like, I mean, that, like, we, we, we do standard pen tests as well.
• 25:27
  Meghan Jacquot: And so to me, that would start veering into like the standard pen test.
• 25:31
  Meghan Jacquot: And I mean, you're kind of slicing and dicing definitions here, right?
• 25:34
  Meghan Jacquot: Um, but it could be that someone has a standard pen test they're doing, and then there's some things that you're also provided access, but same thing.
• 25:46
  Meghan Jacquot: The goal is not necessarily.
• 25:50
  Meghan Jacquot: To move laterally throughout, right?
• 25:51
  Meghan Jacquot: The goal is to find application security issues.
• 25:55
  Meghan Jacquot: And so it's like, what is, what is the goal behind what you're doing?
• 26:01
  Chris Romeo: Okay, I want to change, uh, topics a bit because I know we had, uh, talked about kind of CFP reviewing and, and whatnot.
• 26:10
  Chris Romeo: And I'm, I'm curious, uh, what your experience has been there.
• 26:15
  Chris Romeo: Um, you know, why, why would you recommend somebody be a CFP reviewer?
• 26:19
  Chris Romeo: Like, what did you personally get out of that experience?
• 26:22
  Meghan Jacquot: Yeah.
• 26:22
  Meghan Jacquot: So it's absolutely something I would recommend wherever you are in your career.
• 26:28
  Meghan Jacquot: Even if you're new, there's some smaller conferences, um, that you might feel like you're qualified to review for.
• 26:35
  Meghan Jacquot: Um, I've reviewed for, um, OWASP as well as SANS, um, and I usually do the Diana Initiative.
• 26:44
  Meghan Jacquot: Um, so there's a few different conference series that I've reviewed for and I continue to review for, uh, and what I find is For me, like I'm, I'm somewhat of a creative person and sometimes that creative energy can kind of like have ups and downs, can wax and wane.
• 27:01
  Meghan Jacquot: And I find that reading what other people are doing, it sparks ideas, right?
• 27:07
  Meghan Jacquot: You can kind of see, like, even if it's not a particular talk that gets accepted, You can just see like, oh, this is how they set this idea up.
• 27:16
  Meghan Jacquot: This is maybe the research that they're doing, particularly with OWASP.
• 27:21
  Meghan Jacquot: You really see some cutting edge, um, ideas that are out there, some ways that attacks are happening, um, some proof of concepts, some ways that people are working on defense as well.
• 27:32
  Meghan Jacquot: And so I think that it's really fascinating to get to read through those, um, and help build a conference too.
• 27:38
  Meghan Jacquot: Like I, I love being part of, um, Our security community and getting to be able to attend a variety of conferences and meet up with folk.
• 27:46
  Meghan Jacquot: And, um, so there's something about helping build that to from the behind the scenes that I really enjoy.
• 27:54
  Meghan Jacquot: And then some of the conferences, like the Diana initiative, actually do mentorship with the CFP.
• 27:59
  Meghan Jacquot: And so you'll have.
• 28:01
  Meghan Jacquot: two rounds.
• 28:02
  Meghan Jacquot: Um, and so the first round, if you weren't accepted as a speaker, you can then say, you know, I wasn't accepted, but I'd like to receive mentorship.
• 28:10
  Meghan Jacquot: And so I've done that as well, where I will mentor someone in order to help them maybe get accepted in the second round.
• 28:17
  Meghan Jacquot: And I found that that's a really great way to give back as well too, um, because you can help, um, newer speakers.
• 28:23
  Meghan Jacquot: So I've, I've been speaking at conferences for, well over a decade now and, um, really, really enjoy that fellowship that you find, right?
• 28:33
  Meghan Jacquot: Where it's like you, you are learning, you're diving deeper into a topic to understand it in order to be able to present it.
• 28:39
  Meghan Jacquot: I kind of think that that's a, um, carry on of education, of teaching, right?
• 28:44
  Meghan Jacquot: Um, you're continuing to share with people things that you learned, things you found fascinating.
• 28:48
  Meghan Jacquot: Um, and, you know, the questions that you get at the ends of the talk too are, quite often, excellent.
• 28:54
  Meghan Jacquot: So it's like you have this piece where You know, it's full circle.
• 28:58
  Meghan Jacquot: So, um, you're helping someone get accepted to a conference, you're maybe mentoring them, and then you yourself are speaking at conferences and helps give you ideas too.
• 29:09
  Meghan Jacquot: So I think it's a great way to continue to be involved in the community.
• 29:13
  Chris Romeo: Yeah, I agree.
• 29:13
  Chris Romeo: I've had a chance to, to be on the, the review committee for some big events and, um.
• 29:21
  Chris Romeo: It definitely challenges my thinking as well, uh, to be able to see the depth and breadth of, of where ideas are coming from.
• 29:27
  Chris Romeo: And, um, let me just give a piece of advice to everybody out there submitting for CFP, ChatGPT is not your friend, okay?
• 29:35
  Chris Romeo: I don't know how many, it's like so many this past year for a big conference that I, that I work with.
• 29:41
  Chris Romeo: Like you look at the thing and you're like, This is ChatGPT.
• 29:44
  Chris Romeo: Like, it's obvious that this is ChatGPT that wrote this.
• 29:46
  Chris Romeo: Like, so, like, one of the, one of the big things I always tell people is, like, as a reviewer, I'm gauging how much of my effort I should put in based on how much effort I think you put in.
• 29:58
  Chris Romeo: So it starts with a snappy title.
• 30:00
  Chris Romeo: If you don't have a snappy title, you're probably not going to catch my attention.
• 30:03
  Chris Romeo: Like, I've got 150 of these to review, and I try to give all of them But if you've got a snappy title, I'm always like, Ooh, that's a cool title.
• 30:12
  Chris Romeo: I'm pulling the thread, right?
• 30:13
  Chris Romeo: I'm into the abstract now, the short abstract.
• 30:15
  Chris Romeo: Like, um, so I think, but, but chat GPT is not the way to get accepted at conferences, and I think we're going to see that, you know, throughout the, all of the industries, like people are relying on it more to try to create content.
• 30:27
  Chris Romeo: to build creative things and human brains are still required to build creative things.
• 30:32
  Chris Romeo: So that was just a free, uh, free bit of advice for those trying to submit to conferences these days.
• 30:37
  Chris Romeo: But,
• 30:38
  Meghan Jacquot: Yeah, even if you use it for idea generation, like, you still have to read through it.
• 30:41
  Meghan Jacquot: Like, it may not have written something that's actually sensical.
• 30:44
  Meghan Jacquot: It may partially align with what you were thinking about, but not.
• 30:48
  Meghan Jacquot: So it's like you have to have a certain baseline level of knowledge to even make sure that what it's sending out makes sense.
• 30:55
  Meghan Jacquot: Um, but yeah, another, another piece of advice that I would say if you're trying to send in for a conference would be really look at the requirements.
• 31:03
  Meghan Jacquot: So if the abstract is asking for 500 words and you wrote 10, You're, you're not going to get accepted.
• 31:11
  Meghan Jacquot: Like, even if those were the most beautiful 10 words ever, like you just literally didn't
• 31:16
  Chris Romeo: the worst of times.
• 31:18
  Chris Romeo: Like you even put that in there.
• 31:19
  Chris Romeo: That's not getting in,
• 31:20
  Meghan Jacquot: No, no.
• 31:21
  Meghan Jacquot: Beautiful prose.
• 31:22
  Meghan Jacquot: You're still not gonna get accepted.
• 31:24
  Meghan Jacquot: So yeah, it's a combination between writing to the right level of detail and not writing like total BS.
• 31:31
  Meghan Jacquot: Like, so yeah.
• 31:33
  Chris Romeo: I'll throw another one in here just cause it's top of mind for me.
• 31:36
  Chris Romeo: I'm just, I'm going back through all of the things that I'm like, Oh, this abstract was good, but it, they, they, they missed this part.
• 31:44
  Chris Romeo: If you work for a vendor, you can, and Meghan is proof.
• 31:47
  Chris Romeo: I am proof.
• 31:48
  Chris Romeo: Robert is proof.
• 31:49
  Chris Romeo: Like we speak at big events because we don't make it about our company.
• 31:53
  Chris Romeo: Like so many of these, I'm like, Why don't you just put sales pitch in the title just put sales pitch colon and then the name of the talk you're gonna do It's like it's not even like and I guess what I've always done is I've always said, okay, what's a I certainly want to talk about the area that I'm excited about, the area that I'm working in, but what's something I can just give away for free that gives people value in our industry?
• 32:17
  Chris Romeo: And some people will come and buy something from me in the future, sure.
• 32:20
  Chris Romeo: A lot of people won't, but I can say I moved the industry forward because I came up with something, you know, my, my talk from last year, I did zero trust threat modeling, which I had a chance to do at OWASP and a number of other events.
• 32:31
  Chris Romeo: And, and the reason I got into it, I was like, I am passionate about threat modeling.
• 32:35
  Chris Romeo: I wonder what happens if you put a blender.
• 32:37
  Chris Romeo: And you throw zero trust and threat modeling in the same thing.
• 32:40
  Chris Romeo: How would I do it?
• 32:41
  Chris Romeo: And then I built a methodology for how to apply it.
• 32:43
  Chris Romeo: I came up with a list of, of a mnemonic for threats that people could apply.
• 32:48
  Chris Romeo: And then I just threw it out there.
• 32:49
  Chris Romeo: Like
• 32:49
  Meghan Jacquot: You just, you just shared it.
• 32:50
  Meghan Jacquot: Yeah.
• 32:51
  Chris Romeo: it's for the, and I hope people are using it somewhere that I had that, that I hope they'll tell me at some point they got value out of it, but I hope people are using it places I don't even know about.
• 32:59
  Chris Romeo: Right.
• 33:00
  Chris Romeo: Because that was my goal was to, and, and Meghan, like you, I'm a teacher at heart.
• 33:03
  Chris Romeo: I taught my first college class when I was 18 years old.
• 33:07
  Chris Romeo: That's a different story for a different day.
• 33:08
  Chris Romeo: Um, that was, uh, when people didn't know much about computers and, and I grew up in a place where I had lots of computers as a, as a young kid.
• 33:17
  Chris Romeo: And so, but that's, that be, and, and Robert's the same way, like, you know, we're teachers at heart that do other things, but like, we can't, you can't take the teacher out of you once you're, once you've got that mindset, it's all about, and that's how you get into conferences though, is by having that approach and that passion, but also just being willing to give things away.
• 33:35
  Chris Romeo: And people will be like.
• 33:36
  Chris Romeo: You should charge for that.
• 33:37
  Chris Romeo: Yeah, I probably should, but I'm not going to because this is how, this is how we make our industry better.
• 33:42
  Chris Romeo: So that was a bit of a rant about, uh, CFPs and all those other things.
• 33:48
  Chris Romeo: But Meghan, what other communities?
• 33:49
  Chris Romeo: I know we don't have a lot of time to dive deep into these communities, but I love for you, we talked about WeCyS already, talked about Diana Initiative, um, what other communities are you involved in that you want to draw some attention to?
• 34:00
  Meghan Jacquot: Yeah.
• 34:00
  Meghan Jacquot: I'd say the other two that I'm pretty involved in are OWASP and DEF CON.
• 34:04
  Meghan Jacquot: Um, so with OWASP, um, I've been a CFP reviewer for years.
• 34:08
  Meghan Jacquot: Um, I was their volunteer coordinator for the, um, Washington DC conference in the fall of last year.
• 34:15
  Meghan Jacquot: I think, Chris, I ran into you there.
• 34:17
  Meghan Jacquot: Um, And I just, it's, it's a great organization.
• 34:21
  Meghan Jacquot: Um, you know, there's always something new.
• 34:24
  Meghan Jacquot: There's always a new project.
• 34:25
  Meghan Jacquot: There's always a new thing to kinda be paying attention to and, and learning more from.
• 34:30
  Meghan Jacquot: Um, and so I, I find that those are really rewarding experiences.
• 34:34
  Meghan Jacquot: Um, I've, they're, they're working on switching over to the application security verification standard 5.0.
• 34:41
  Meghan Jacquot: Um, so I've helped out a little bit with that, um, working group.
• 34:45
  Meghan Jacquot: Um, so just really enjoyable experiences that I've had with fellow professionals.
• 34:50
  Meghan Jacquot: Um, and then, um, DEF CON, um, Hacker Summer Camp in general is like one of my favorite weeks out of the years.
• 34:55
  Meghan Jacquot: I think it's for many of us.
• 34:57
  Meghan Jacquot: Uh, and so I had the pleasure a few years back to get recruited to be, um, a goon.
• 35:02
  Meghan Jacquot: So first you start out as a noon, so you're a new goon.
• 35:05
  Meghan Jacquot: Um, and then if you make it past year one, then you actually become a goon.
• 35:09
  Meghan Jacquot: Um, and then you become a coin goon later on.
• 35:12
  Meghan Jacquot: Um, and so I'm in the SOC, um, where the people on the floor are yelling and, like, trying to make sure everyone's having a good time and having squeaky chickens and such, so, um, it's, it's a good time, um, very much so, so.
• 35:24
  Chris Romeo: Very cool.
• 35:25
  Robert Hurlbut: Yeah,
• 35:26
  Chris Romeo: Alright, well, it's time, Robert.
• 35:28
  Chris Romeo: Robert is now famous or infamous, I can never remember what word I'm supposed to use, which adjectives describes this section of the podcast, but it is our lightning round, so Robert, take it away.
• 35:39
  Robert Hurlbut: you bet.
• 35:39
  Robert Hurlbut: Well, Meghan, our lightning round, we have three questions.
• 35:43
  Robert Hurlbut: So the first one is controversial, uh, potentially, uh, but what's your most controversial opinion on application security and why do you hold this view?
• 35:52
  Meghan Jacquot: So, I guess it would be, um, build empathy with beg bounty people.
• 35:58
  Meghan Jacquot: So, imagine you get that annoying email and you're like, oh, why is someone even sending this?
• 36:03
  Meghan Jacquot: I'm just going to ignore it.
• 36:05
  Meghan Jacquot: Um, so either figuring out.
• 36:07
  Meghan Jacquot: Um, some sort of VDP process that you might want to build or just thinking like, Hey, the person who's sending this, we don't know their circumstances.
• 36:16
  Meghan Jacquot: We don't know their background.
• 36:17
  Meghan Jacquot: Um, and they might be sending it out of duress.
• 36:20
  Meghan Jacquot: Um, and so just trying to build empathy, even if something is really, really annoying.
• 36:28
  Robert Hurlbut: Our second question is what would it say if you could display a single message on a billboard at the RSA or Black Hat conference?
• 36:38
  Meghan Jacquot: So I'll, I'll be at RSA.
• 36:40
  Meghan Jacquot: Um, and.
• 36:42
  Meghan Jacquot: I, their theme this year is I'm possible.
• 36:44
  Meghan Jacquot: Um, so I think as a woman who didn't start in tech and is in cybersecurity and on the more technical side of things, assign this as I'm possible.
• 36:57
  Robert Hurlbut: And number three, uh, what's your top book recommendation and why do you find it valuable?
• 37:03
  Meghan Jacquot: So it's a book that's not a security book, but it's, um, looking to see if I have it on the shelf over there.
• 37:12
  Meghan Jacquot: I, I don't see it.
• 37:16
  Meghan Jacquot: Um, but it is a book called How to Have Difficult Conversations.
• 37:20
  Meghan Jacquot: Um, and it's an allegorical style, so kind of like, um, Phoenix Project, um, and I, I just find the writing to be really compelling because you never know when in your career you might need to have a tough conversation and it could be with direct reports, it could be with someone above you, it could be with a colleague, whatever level.
• 37:40
  Meghan Jacquot: And it, and it doesn't just apply to professional life.
• 37:43
  Meghan Jacquot: Um, it, you know, it can apply to personal life.
• 37:45
  Meghan Jacquot: And so I think it's a book that everyone should read.
• 37:48
  Meghan Jacquot: Um, I actually, when I read it, um, I actually bought a copy for everyone in my family, my immediate family.
• 37:54
  Meghan Jacquot: And not to say like, oh my gosh, like we're so like conflict filled, but I just think it's a really useful.
• 38:01
  Meghan Jacquot: tool to have in one's tool belt for having those conversations, um, that maybe you might ignore, but maybe you should have.
• 38:09
  Chris Romeo: that's really neat.
• 38:11
  Chris Romeo: And then we can't forget your other book recommendation.
• 38:13
  Chris Romeo: Which I've already, which has nothing to do really with the podcast other than we were talking about, uh, Henry Winkler before, before we hit record.
• 38:22
  Chris Romeo: And Meghan pointed me to Being Henry, The Fonz...
• 38:25
  Chris Romeo: and Beyond, narrated, or that's by Henry Winkler.
• 38:28
  Chris Romeo: This is his, uh, I guess autobiography, right?
• 38:30
  Chris Romeo: That's sort of
• 38:31
  Meghan Jacquot: Yeah, yeah, it's an autobiography about the Fonz, but also his life beyond that, that he just recently wrote, so, which is impressive itself.
• 38:37
  Chris Romeo: I, I read a lot of autobiographies.
• 38:40
  Chris Romeo: I don't know.
• 38:41
  Chris Romeo: I just, I'm fascinated by, you know, What, how people, people's stories, ultimately, it's why we ask the origin story is the start here.
• 38:48
  Chris Romeo: Like it's, people's stories are just fascinating, like what they've been through and things they've overcome that you would never know just by, you'd look at them and say, that person's life is easy.
• 38:57
  Chris Romeo: And then you look at their, you know, Their story is like, no, it wasn't like they had to fight for their life at a certain age, you know, to be successful.
• 39:04
  Chris Romeo: So, all right.
• 39:05
  Chris Romeo: So Meghan, what about a key takeaway?
• 39:08
  Chris Romeo: Something you want to leave our audience with here?
• 39:10
  Chris Romeo: Uh, that's potentially they can, you can give them homework if you want.
• 39:14
  Chris Romeo: That's allowed.
• 39:14
  Chris Romeo: I mean, you're a teacher, so I mean, you're, you're going to be all in on giving people some homework and having them send it in and checking it and grading it or whatever, but what are you,
• 39:21
  Meghan Jacquot: I don't actually use, I didn't actually use red pens.
• 39:25
  Meghan Jacquot: So I would actually use, usually use green pens when I was doing grading.
• 39:28
  Meghan Jacquot: Um, but yes, um, I, I will grade your homework.
• 39:32
  Meghan Jacquot: Um, so I would say that wherever you are in your career, you know, you might be, you might be new, you might be, um, C suite to executive level.
• 39:41
  Meghan Jacquot: You have something to share and give back to others.
• 39:44
  Meghan Jacquot: Um, and so you might think to yourself.
• 39:46
  Meghan Jacquot: No, I don't know anything yet.
• 39:48
  Meghan Jacquot: You know, you might have a bit of imposter syndrome, what have you.
• 39:50
  Meghan Jacquot: Um, but you do, you're, you're further along than someone else's.
• 39:55
  Meghan Jacquot: Um, you got to where you are through, you know, your unique origin story and you can share and give back to others.
• 40:02
  Meghan Jacquot: Um, and so I think that would be my key takeaway is that you always have something you can do to share and help others from what you've learned.
• 40:10
  Meghan Jacquot: Um, and I would encourage people to do that.
• 40:13
  Chris Romeo: Very cool.
• 40:14
  Chris Romeo: What a great, great key takeaway.
• 40:16
  Chris Romeo: What a great way to end our conversation.
• 40:18
  Chris Romeo: So Meghan, it's been, uh, it's been excellent to have you on the podcast and, uh, we'll definitely do this again at some point in the future and, uh, hope to bump into you at RSA, even though there's 50, 000 other people, but it's funny how you bump into
• 40:32
  Meghan Jacquot: You do, you tend to.
• 40:33
  Chris Romeo: statistically we should never have actually been in the same physical vicinity, but we end up, you end up bumping into people in the hallway and like, Hey, how's it going?
• 40:42
  Chris Romeo: So it's a
• 40:42
  Meghan Jacquot: My friend calls it the vortex.
• 40:44
  Meghan Jacquot: It's like you're, you're being brought together in a way that was meant to happen.
• 40:49
  Chris Romeo: I like that.
• 40:49
  Chris Romeo: That's really cool.
• 40:50
  Chris Romeo: So, all right.
• 40:51
  Chris Romeo: Well, thanks Meghan.
• 40:52
  Chris Romeo: Thanks for being a part of the podcast.
• 40:53
  Meghan Jacquot: Thank you both.