Latest / You've Been Heard / 350- Practical Security Layering Techniques, Done Right by Noah Mechnig-Giordano

Transcript

350- Practical Security Layering Techniques, Done Right by Noah Mechnig-Giordano · You've Been Heard

• 0:00
  Speaker A: We followed the Mitre, ATT and CK chain, I believe it's called, or the Kill chain, very closely. And then we also really structured it around building out from mission critical assets, as that was one of the primary focuses for at least our company and organization was making sure that those mission critical assets are protected so that production and the entire business can keep running.
• 0:24
  Speaker B: Everyone out there listening to dissecting popular IT nerds. This is Phil Howard, your host, and we're speaking with Noah. I do not want to butcher your last name. I'm going to try. Metchnik Giorgiordano.
• 0:36
  Speaker A: That is very close. Yeah, Meshnik Giordano. Very solid.
• 0:40
  Speaker B: Okay, that could have been really bad for me there. So first of all, man, talk to me, because chances are you didn't grow up in it using floppy disk. It's just a. It's just a hunch, man. How'd you get started in it?
• 0:54
  Speaker A: Yeah, So I. Being 26 years old, that is a very accurate statement. I did not grow up with floppy disks. I got.
• 1:03
  Speaker B: Man, I'm telling you, you missed out. But anyways, go ahead.
• 1:06
  Speaker A: I got started with, honestly, a love for video games and then a severely lacking skill in math. And then as I went to college, I decided that, you know, that's something I should explore, something I'm weak in instead of something that comes more naturally to me. And then from there, that's really just where I fell in love with it. And I think I got in at the right time because now everything just seems to be revolving around it.
• 1:31
  Speaker B: Mm. Well, so you're one of those people try to fix a weakness. I'm one of those, too. I was terrible. Terrible at writing in English and all that stuff. I was a creative writing major. Ended up in it, kind of. Okay, so this'll be fun then. What was your very first video game? Recollection of any video game that you ever remember playing? What was the very first? We're going to compare.
• 1:55
  Speaker A: All right. That's a great one. I would say a game called Halo 3. That was kind of a transcendent experience for me at the time.
• 2:06
  Speaker B: Yes. Yes, it was. I don't know, what would the word be for me, more like not transcendent. It would be like, let's just put it this way, the very first video game that I remember playing off the top of my head right now, Pong.
• 2:19
  Speaker A: Okay. Yep.
• 2:22
  Speaker B: Two sticks. Two white sticks and a white ball. That was really a square. I mean, the difference. Just think Halo 3, that was probably. Was even already already a father at that Time and beyond my video game playing days, even though we have a PlayStation 5 now and I've kind of tried to get back into it, soccer and hockey and let's see, I don't know, whatever, Gran Turismo. But that lasted for a little bit of time and then I realized I have no time, so.
• 2:53
  Speaker A: Absolutely. Yep.
• 2:55
  Speaker B: Okay, so trending topics, things that I would really love to get your thoughts on and one of them would be how do you ensure upper management is not fearful of. How do you convince upper management in the importance of security without using fear as a tactic?
• 3:19
  Speaker A: Yeah, no, I think that's a great question. I'd say my experience was a little bit unique. I kind of started out in the security realm with a lot of upper management buy in. So there was really not a lot of resistance that I faced there. But I would say really just having the facts, having the data to support what that's really going to do for the company and how important that really has become. And that's something you really can't compromise on these days even in a mid sized company. Even in a company where you may feel, you know, we might not be a subject for attck or a target specifically. It has just become an absolute vital part of the, of I would say every IT stack. So I, I didn't face a lot of resistance but really to push that through and to really expand that, that infrastructure out, it was really just a matter of demonstration and showing that potential.
• 4:07
  Speaker B: And what is, what are your, I don't know, what are you, what are your security layering techniques?
• 4:14
  Speaker A: So there's a lot of different acronyms but we, we followed the, the MITRE, ATT&CK chain I believe it's called, or the KILL chain very closely. And then we also really structured it around, you know, building out from mission critical assets as that was one of the primary focuses for at least our, our company and organization was making sure that those mission, mission critical assets are protected so that production can keep running and the entire business can keep running. So then as that is a core just expanding out to every facet that could potentially translate or reach our mission critical assets, that was the first avenue. And then from there it was really a very consorted and focused effort on the actual users that are going to be interacting with those security layers, making sure that they're knowledgeable and making sure that they have that kind of training themselves.
• 5:01
  Speaker B: Okay, if you were in a room with, I don't know, just the rest of your colleagues or something like that, no one in the outside world was really allowed in. What would you want to ask them.
• 5:11
  Speaker A: In regards to security?
• 5:13
  Speaker B: Yeah, I'm just curious, like, is there something that you would ask or something that you would offer up? I'm just. People want to talk about security layering techniques, so I'm just curious, I mean, or how about this? It'd be better if they were to ask you, you know, how do I better implement security layering techniques? What, what would your advice be to them?
• 5:30
  Speaker A: Yeah, I would say there's a lot of simple pieces that are still, I'm seeing, being overlooked. One of the most basic of those is just being passwords, right? Just making sure not to reuse your passwords, making sure to have different passwords for different functions. I've seen that time and time again where, you know, people really easily fall into that cadence of just having one password that they use for everything. And I find that to just be a very easy starting point. And then outside of that, it's really just a mindset as to how you interact with the Internet as well as how you interact with any of the systems you may have at your company. So not going to malicious websites and just practicing kind of common sense knowledge as to how to interact with potentially threatening or potentially malicious environments. And I think a lot of it really does come down to just common sense and having a few basic tools at your disposal to recognize and to check a few things that may flag some suspicion.
• 6:25
  Speaker B: Favorite tools, what are they?
• 6:27
  Speaker A: I'm a big fan of, I forget the name top of my head. But one of the great tools is just being able to input, for example, an email address you may feel suspicious of, and then just being able to trace through and see the origins and the creation of that email address that's proven to be exceptionally useful just on that side alone. And then also having some tools in place to just analyze your passwords and their strengths, as that's always going to be an ever evolving landscape and as computer computing power increases, you know, what you may have previously thought to be an ironclad, bulletproof password may no longer be as secure as you once thought.
• 7:04
  Speaker B: If you had a security one liner, a security one liner, truth, what would your security one liner truth be?
• 7:11
  Speaker A: Ooh, that's a good question. I would say it's to always be vigilant and aware and cautious. I think really with those three principles there, you're able to really overcome a tremendous amount of risk out there just from a user potential.
• 7:25
  Speaker B: Okay. And if you were to tell your, your users this security one liner truth. What would it be? Be paranoid. You know what I mean? What would you like, what would your one liner be like if they were like he's always saying this about security. What is that one liner Security truth.
• 7:42
  Speaker A: I, I do like, I do like being paranoid. That's a good one to an extent. I think that that is a very valuable mindset to have, especially in this landscape as it is just always gonna be changing. It's something that's very hard to pin down and have a very secure understanding at a stagnant position. And then you have to always be learning and adapting what that looks like. So I think be paranoid may encapsulate.
• 8:05
  Speaker C: That pretty well at dissecting popular IT nerds We expect to win and we expect our IT directors to win. And one of those areas where we know that we can help you win is Internet Service providers. As an IT director tasked with managing Internet connectivity, few vendor relationships can prove more painfully frustrating than the one with your Internet service provider. The array of challenges seems never ending. From unreliable uptime and insufficient bandwidth to poor customer service and hidden fees. It's like getting stuck in rush hour traffic. Dealing with ISPs can try one's patience even on the best of days. So whether you are managing one location or a hundred locations, our back office, support team and vendor partners are the best in the industry. And the best part about this is none of this will ever cost you a dime.
• 8:59
  Speaker B: Are, are you one of the, one of the few that is blessed with. It doesn't happen that often. Doesn't happen that often. But are you one of the few that gets blessed with every now and then, someone trying to feed you a heavy dose of A.I. anything?
• 9:14
  Speaker A: Oh, absolutely. As it's, it's very rare. Absolutely. Very rare. But no, I, I do feel that almost everybody has an AI something AI solution that they're looking to sell or looking to implement 100%.
• 9:28
  Speaker B: So there's a lot of questions that can revolve around, around the AI thing and I guess one of them would be have you run into any very practical AI use cases that are real and are that you've actually implemented versus the some, some other layer of AI hype that we all find ourselves in?
• 9:51
  Speaker A: Yeah, that's a great question. I would say that there's certainly a few that I found a lot of value and benefit in. However, I will say that those are solutions that, that I created myself and they're things that I use myself because I think that a lot of it really comes down to how Those solutions are being implemented and where that responsibility of usage is placed. And I think too often that is not really placed in the control of the users or they don't have that understanding to interact with these tools effectively in a way that's actually going to be beneficial in that use case, especially when looking at the long run. So a good example is I've developed kind of an offline AI model to write emails, or I would say more so to edit emails, because I think that that's a very easy trap to fall into if you just type an AI prompt, hey, write this email for me, etc. And then it just spits it out. I think a lot is lost there, but I think that it is very valuable as a launching point and jumping point to facilitate creativity and critical thinking when used correctly. But I think that a lot of the solutions out there, they perhaps try to take too much out of the hands of the user and then you lose a little bit of that creative spark and critical thinking.
• 11:07
  Speaker B: Yes. Which kind of leads to. How can. Well, let me ask it this way. Does your leadership ever come to you and ask you about what should we be doing with AI? Or what should we be doing here? Or do they ever come to you and say, hey, what do you think of this? Or let's implement this? Or I saw this.
• 11:27
  Speaker A: Absolutely, yeah, that's definitely been a common trend where there's been a few solutions out there that leadership has felt and other team members have felt that would be beneficial to implement. My response to date has typically always been no, for those that that wouldn't be a recommendation. So we actually have not leveraged or implemented any external or third party AI solutions. We've kept that completely in house on all that development internal. And the primary reason behind that being security as well as the actual usage of those solutions.
• 12:02
  Speaker B: Okay, great. So, okay, so here's the big one. How can IT leaders convince executives that AI is an enabler and not a replacement for workforce or other tasks? Might be a task, might be a replacement for a task name, but how is it an enabler, not a replacement? And do you think that that is a fear? Do you think there's a lot of IT leaders out there or people that are fearful of their jobs or worried about how executive management or people may think that AI is taking over and going to replace things?
• 12:36
  Speaker A: Absolutely. I think there's definitely a certain level of fear, but I think that that fear is quickly dissuaded once you really start interacting with these models and looking at them. I think you can very quickly see that we're not that close perhaps to a point where it can start really replacing that top level creative decision making. And I think to your point, it is effective in automating and reducing manual tasks. However, the way I see that is just an opportunity. I think that then, then just allows those people in those positions who may have a portion of their job automated, it allows them to start thinking about that next level and taking their work to, you know, an entirely new place as they're not having to spend that time worrying about these more mundane tasks that really can be very easily and effectively automated. And I would say to answer your first question about, you know, how to, to tackle some of those fear factors into, kind of explain, explain that to leadership, I think the most effective way is really just demonstrating results and showing how it can be effective and demonstrating how that hesitancy is not always as deeply founded as potentially it may initially seem to be. As a lot of these things, once you really start interacting with them, and especially as once you start pulling back the curtain and not treating AI as kind of this black box that you can't look into, I think then that's when a lot of this fear potentially or should dissipate.
• 14:02
  Speaker B: Explain the black box analogy a little bit.
• 14:05
  Speaker A: Yeah, no, I think that a lot of times an AI model is just seen as this magic little box and you put a prompt into and then you get a result out of, and then you're not actually able to see anything deeper into the process behind it or interact with how that model is arriving at the result. And I think once you start analyzing that, you can really see the actual potential and also the immediate limitations that exist currently.
• 14:29
  Speaker B: Okay, so let's go a little bit deeper. Are you saying they're not prompting correctly, so you may not get a deep enough answer? And if you understand where it's pulling that data from, then you know that it might be lacking.
• 14:42
  Speaker A: Right. And once you really understand what the model is actually doing and where it's sourcing the data, how it's being trained, that's when you can, I think, have that deeper understanding of, you know, analyzing and looking at what those results are and then understanding them on a deeper level and seeing, you know, maybe it goes into the wrong direction, but then you can understand why it did so. And even if it goes in the right direction, I think it's also important to understand how it arrived there.
• 15:07
  Speaker B: Okay, enlighten us. Where is it, where, where is the model pulling this stuff from? Enlighten us. Tell us how it, how it works. How do ones and zeros translate into pictures on the screen and do all of that? That's, that's really mind blowing to begin with. But. No, how is AI? How is AI working?
• 15:23
  Speaker A: Well, I would say I'm far from a subject expert, but for my limited understanding.
• 15:28
  Speaker B: But it's better. It's good that it's limited. It's good that it's somewhere in between. Because you're translating for executive management, right, that thinks. Might think it's like this. They might think it's like Terminator 2. They might. You know what I mean? No, for real, for real. You know what I mean? That's kind of like where executives are. They could do everything. It's the, you know, it's like, you know, it's the changing of the guard. It's something like this, you know what I mean? But then it's, it's really not that. It's really somewhere in between.
• 15:52
  Speaker A: Right. I think the simplest way perhaps to think about it is it's pulling everything essentially from the Internet. So I think that that's a good starting point is to look at and think about how you as a person, personally, in your life, or even professionally interact with the Internet and then how you naturally have these processes built in where you question, you double check. If you find a source, you dig a little bit deeper to verify and validate that that is actually what you're looking to inquire deeper about. And I think if you apply those same concepts, then you can quickly understand a little bit better about how AI may go into one direction or another, have certain biases, as these biases and different directions are clearly visible just by interacting with the Internet on a daily basis.
• 16:36
  Speaker B: What do you see since you have the, the luxury of being young, younger, what, what leadership challenges have you faced? Where do you see the biggest leadership challenges from an IT leadership being these days?
• 16:54
  Speaker A: Yeah, I think one of the biggest challenges is definitely going to be adapting to a very, very evolving and fast paced landscape in the IT world. I think it's exponentially increasing in pace in terms of what's changing, what's new, what's coming to light and what can be used. And I don't have the experience going back much further, but I would say that we're really in a stage where that exponential increase is a lot faster than perhaps we've ever seen before. So it can be potentially daunting and challenging to, to have an understanding and keep a, you know, keep that understanding as to what's really out there and what it can do for you. I think that if you gain that understanding at any certain point, then six months down the road, that can already potentially be out of date.
• 17:40
  Speaker B: Yes, the. What we thought even, I would say a year ago, if you look at how much the, even just the AI models have changed in a year, what we thought was going to be possible at least. I had a colleague the other day say, you know, I kind of thought that this AI model would be able to help us do this. And a year later, it's a completely different world and it's not even, not even a thing anymore. That was just the AI example. And we were thinking about different prompts for, I don't know, just different research purposes and it's. I don't know, it's just whatever evolved. It's like just. That's not even a thing anymore. I don't even know how to describe that. As far as being an IT leader, do you have a team underneath you?
• 18:20
  Speaker A: Yes, I do.
• 18:21
  Speaker B: How big is your team currently?
• 18:23
  Speaker A: It's, it's relatively small, just two team members. But that is actually due to a recent. Right. Sizing that we do expect to expand this year to hopefully around 4 or 5.
• 18:34
  Speaker B: Do you find it to ever be it leadership to ever be lonely at the top?
• 18:41
  Speaker A: I think it certainly can be. I think it really depends on the specific company you work for and then that leadership structure above. In my case, it's quite a specific example, but the president at my company was actually the previous director of it so there is a lot more of that understanding where I do have somebody that I'm able to bounce ideas off of and get a little bit more in depth with at the top of the leadership level. However, I am aware that that's quite a unique scenario and would not really exist across many other businesses.
• 19:16
  Speaker B: Okay, so then how could we create that for other people? I guess what would be the unique. And I got. I was speaking with a colleague earlier, Denise, and she said, and she'll. She said, we have to be able to teach leadership how to speak to it, which is kind of interesting.
• 19:35
  Speaker A: Yes.
• 19:36
  Speaker B: But I would assume that your, your leadership already knows how to speak to it because they were the previous it. So what would that. What's special about that?
• 19:45
  Speaker A: Yeah, I would say the, the depth and the understanding that exists and that, that, that communication is very fluid and it allows us to really get into a lot more of a deeper understanding when it comes to new IT solutions, existing problems in the landscape in general. And I, I would say that we could probably see that progression happen organically. I think it does need to be accelerated going forward, but I think that, as you know, in the next 10, 15 years, perhaps that new wave of leaders come into those positions. I think that we'll see a lot more of them have that IT fluency and are able to communicate better with their IT leaders, respectively.
• 20:23
  Speaker B: What would your advice then be to the people that don't have that fluency?
• 20:28
  Speaker A: I would say it's very important to learn to just have some experience, go out there, try to interact, play around with some things, even if it's not initially successful. I think that that's. That's going to be a very valuable understanding. And I think one of the cores of that is. Is having some kind of knowledge of programming and coding. I think that's something that is a little bit too rare in the leadership side. And I think that that does have a lot of translating benefits. When you really get deeper into those conversations and understandings, you don't kind of hit that wall where then you can't explore any deeper once you get into the actual programmatic side of the House.
• 21:05
  Speaker B: So Trump should go take a Python class. No, really? No, but really, like, what would your advice be to the. What would your advice be to. Your advice be to the president when it comes to technology in America? Like, hey, man, like, you need to know a little bit of coding.
• 21:21
  Speaker A: I think that would. I think that that would definitely have some merit and some value, I think, especially as we. We dive deeper.
• 21:28
  Speaker B: Technology advice to President Trump.
• 21:31
  Speaker A: That's a great.
• 21:32
  Speaker B: Just because, you know, what's the unwritten rule? What's the unwritten rule of IT leadership that no one talks about?
• 21:40
  Speaker A: I would say that's a tough question. The unwritten rule.
• 21:43
  Speaker B: I don't know. I'm just asking it. I mean, I'm trying to fire off the hardest questions of all. Now, that one's difficult. I mean, what is the unwritten rule of IT leadership that no one talks about? They're afraid to talk about it. There's something that IT leaders are afraid to talk about. It's the unwritten rule. I'm going to. I mean, I have a couple guesses. I think it has something to do with probably like, vulnerability or something like that. What's the. Maybe something around empathy? I don't know. Or. Or what is it?
• 22:11
  Speaker A: Yeah, I mean, I would say, but.
• 22:13
  Speaker B: I think they like to talk about empathy. I think leaders always love to talk about empathy. Just. I don't know, what is it?
• 22:19
  Speaker A: Yeah, I would say, you know, maybe, maybe I'm just thinking about the AI side still, but I would say the unwritten rule, perhaps there is that, that, that barrier to entry for AI products, AI commercialization has become incredibly, incredibly low. And it's actually very, very easy and simple to spin up a solution. Just, it's essentially just become a matter of API calls and then you're already able to have a commercialized version of ChatGPT or anything of the sort to have any kind of specific use case or functionality. And I think that, that, that, that needs to be potentially explored a little bit in a, in a larger light. That, that's, that's actually really not such a mystical and challenging piece to accomplish, to develop those pieces in house.
• 23:05
  Speaker B: So we should be developing our own apps that are essentially good prompting with a white, with a, with a white label on top of it, inside of square.
• 23:16
  Speaker A: In a sense. Yeah. And I think that that allows you to really, you know, tailor that because I think what a lot of these, these products come down to is really the use case and the interaction with the model as opposed to rather the actual model itself and the, the, you know, in quotes, thinking that's occurring behind the scenes. And so I think having that ability to do that in house allows you to create a lot more tailored and effective solutions and save a lot of money as well, really make that more of an affordable, affordable endeavor.
• 23:44
  Speaker B: If you could bring the head mind of one thing that really knows how to prompt AI very, very well, then you could essentially clone yourself kind of by then putting that tool into the hands of other people that could use it. Is that kind of what you're saying?
• 24:03
  Speaker A: In a sense it can serve a little bit as a proxy? Absolutely. You can kind of spin up these different proxies and have that work very effectively to expand and have that interaction be not so limited to potentially one person or two people. I would say a good example of that is at my company that I work for, there's only, I think, two or three people that have knowledge of programming. And so that's oftentimes something that is, that is needed is to have some kind of programmatic logic, develop some kind of small platform or configurator, et cetera. And I think that instead of having that be bottlenecked at those few people, it's very simple to spin something up that then could deliver that same output and that same product and not necessarily have to go to those people specifically, and especially not for that initial creation phase, ideation phase. You can get really Even without any knowledge, I would say with an effective tool, you can get maybe 70 to 85% of the way there and then just have those specific team members finish that out or take that to a more polished state. I think that's a really effective use case that I've seen.
• 25:10
  Speaker B: But you're asking a lot. This is great. No, for real, you're asking a lot. So you're basically asking, hey, Mr. End User, look, I know you don't even know what coding is, I know you have no clue. But I want you to play around with ChatGPT. I want you to pull up this little thing, I want you to ask it to develop some code and then, and then if you don't know what it looks like, ask it to pull it up. In this other video, it's going to have you go to this website, it's going to have you like take cut all this code, it's going to put you on the website and they're going to see what kind of like the end result kind of looks like. I want you to do all that first and then bring it to me and then I'll finish the job.
• 25:38
  Speaker A: And I've seen that actually at the company I work for very effectively take place. And I think that there are a lot of tools that can really also help guide that journey and to make that not such an isolating, potentially or daunting experience. I think with just the right questions, even that then lead into that prompt or lead into what's being generated, you're really able to make a lot of progress without having to have that internal knowledge. Now, sure, that internal knowledge is very helpful and allows you to operate a lot more independently. However, at this stage, you know, that I would say is most likely an unrealistic ask is to have, you know, the head of HR to have knowledge of Python or programming or something like that. However, I have seen with our head of HR that they've, they've been able to just, with ChatGPT and a few pointers and a few directive questions, able to spin something up that is really quite effective. And then it was just those last polishing steps of, you know, deploying it correctly, making it be able to, you know, function and the UI and UX pieces.
• 26:37
  Speaker B: Okay, all right, so here's the use case we've all been looking for. You're like the technology enabler, so your job shouldn't even be whatever anymore. It's like technology enabler. That's really what the mod is, that what the modern IT person is going to be the person that has more knowledge of networking and all this stuff and then they're going to enable technology within the business and that's what's going to save the IT guy from being fired or something. I don't know. Unless you go to school for becoming a technology enabler in the future, please. I, I'm dying to know what this use case is. Are you allowed to share hr? AI use case? It's, it's not, it's, it's an AI technology leadership. I mean, I, it's, it's actually a pretty big deal. This is actually pretty mind blowing. I don't know how to title this yet, but I want to know what it is.
• 27:25
  Speaker A: Yeah. So I would say this is an interesting example because, you know, at our company we wear a lot of different hats. This was actually kind of a cross functional effort between HR and sales, interestingly enough. And so this was really a sales configuration tool that had some of those project planning and HR factors in place as well. And that was something that this team member was able to spin up very, very effectively. I would say really maybe 85 or 90% of the way. There's just through ChatGPT and a few kind of guiding questions and launching points. But it enabled that team member to really think a lot more freely and not immediately feel limited or hemmed in by technological constraints. They were able to just explore, I would say. And I think that's really something that we need to see more of and that's a really effective relationship between HR, or I should say it, and these other departments.
• 28:20
  Speaker B: Okay, so what was the, I guess the challenge or the problem to begin with?
• 28:24
  Speaker A: Yeah, the challenge to begin with was, was having a very clear understanding and giving our sales team something where they can, excuse me, essentially walk into a sales call and be able to on the fly, configure different proposals, different combinations of items, different configurations of those items. Not having to essentially in those negotiations go back into our system, repopulate an entirely new proposal, but be able to on the fly, adjust, make changes and additions. That was the real problem. Use case. That was the genesis for this.
• 28:57
  Speaker B: And how was HR involved?
• 29:00
  Speaker A: Yeah, that's. I would say HR was involved just because that particular team member was wearing multiple hats. I wouldn't say this was strictly an HR related project. In a sense it was more so just something that they had been working on as they're also leading on the project and strategic development side.
• 29:18
  Speaker B: Okay, and do we have like all said SKUs and items and pricing and all that type of stuff, like loaded into ChatGPT somehow and like, hey, we need to reconfigure this and re. Repopulate this into a PDF or something.
• 29:31
  Speaker A: Yeah, so actually this was, this project was the creation of a web application, more of a UI that would sit on top of, you know, at its most basic level, an Excel file at the beginning, that then it would just pull that information from the Excel file and then allow the user, in this case it would be a sales rep to do that configuration and modularly interact with those different items. And so the AI came into place more so in terms of the actual creation of that code and creation of. It was a Python backend with a JavaScript HTML front end. So the AI was not involved in the actual program after launch. It was a tool that was used to creatively create that, that project.
• 30:17
  Speaker B: I have an, I have a 75% idea of, of what you're talking about, an idea around it, and it's pretty cool.
• 30:24
  Speaker A: I was very impressed. I was very pleased with the results.
• 30:27
  Speaker B: Yeah, this is, this is. You have a very unique situation going on. I want to applaud you. So the fact, since, I mean, anytime that you can get Sales to, to, to want to be impressed by it. Is that right? Am I getting this right? You mean anytime sales is saying, I really just, I really want it to just be impressed with me, that's like a, a super win. That's like, I mean, really high up in my book. Because last time I checked, sales was throwing, you know, laptops out their car when they're in a, in a fit of rage and, and calling the help desk and saying, hey, I need, I need a new laptop. This one's broken. These are real stories. If we go the real stories. No, for real. Like, I don't how often and you're too young. I mean, I guess maybe not, but I, and I can guarantee you there's a bunch of people on this, on this call that or on this call listening to this show that sales doesn't know the name of the IT people in the IT department. Wow, you're surprised by that? I mean, they don't even know their name. I'm serious. We've got people that are like the, I mean, there's people out there that relate with this, the CEO or C levels walk by, walk by, you know, IT office. They don't even know their name. That's a problem. So you're in a very, I mean, I want to congratulate you. Like, seriously. I don't I don't know what you're doing. I don't know what the tr. I don't know what it is. Maybe it's just the fact that we're coming to the age where everyone knows that nothing gets done without it touching every aspect of the business.
• 32:13
  Speaker A: Absolutely. And I think that's an understanding that has existed and perhaps even predated my position at the company I work for. Is that real deep understanding that it is now absolutely critical to a lot of these projects, almost all of these projects. And a lot of times that may be more of a precursor capacity, but that is, that is just as critical and just as crucial to the success of any of these projects. Absolutely.
• 32:41
  Speaker B: What would you think is the one skill IT leaders need to stay relevant in the next five years?
• 32:45
  Speaker A: I would say it's adaptability. I would say it's not getting too entrenched in a certain mindset or a certain way of doing or thinking. I think always being open to that new direction and always be open minded about what's to come. I think that that's something incredibly crucial. I couldn't necessarily speak to that not existing. I would hope that exists. However, I find that to be incredibly important. It's just that base level of open mindedness and then also that combination of. That it at the end of the day is also a very creative facet of any business and it's not so locked in. While there is a lot of analytical components and a lot of more, you know, writing code and things that aren't necessarily at the face, they don't maybe seem as creative. I find those to be incredibly creative spaces where if you have that creativity and that mindset, I think that that is a lot more effective. And I would say, perhaps even, I would say that an entrepreneurial mindset is also very crucial to IT leaders.
• 33:45
  Speaker B: Have you ever experienced burnout?
• 33:47
  Speaker A: Sure. I would say, yeah, I would say anybody would be lying if they said they hadn't at some stage. Um, but I, you know, what's the.
• 33:54
  Speaker B: Best way to handle it?
• 33:55
  Speaker A: I would say the best way to handle it, that's, that's maybe gonna. My answer may not be the most broadly applicable, but for, for me at least it's really getting into. I, I experience burnout when a project or something I've been working on doesn't seem to make progress or seems to be overloaded without there being an actual end goal. That makes a lot of sense in mind. And so I find taking some time to work on a project that really has a very Definitive outcome, something that does have value and something that you can measure the progress. I think that's very effective to. To combating at least my burnout.
• 34:30
  Speaker B: So the Never Ending Story is. Do you remember that? Did you don't remember that movie? That movie came out before you were born. But have you ever seen the Never Ending Story?
• 34:39
  Speaker A: I have not, no.
• 34:40
  Speaker B: Okay. Have you ever heard of the song that Never Ends? It's the song that never ends. It goes on and on and on, my friend. It's the song that never ends. And it just keeps going on and on, on. It's like the kid. It's like my kids want to sing it in the car when they really want to drive you nuts. So. So what you're saying is the Never Ending Story project is. It's a bad project. We must find an end to the Never Ending Story or the Song that never ends, maybe regroup. So if you're stuck in that then. And there's kind of this minutia, you're stuck in the minutiae of no ending and burnout, then what do you do? Regroup and find a goal and be like, hey guys, what's the. What is the. What is the end in mind here? What is the goal? I mean, what is it? Is it someone else? Is it, hey, give it to the HR sales guy so he can put an AI model to it and forget about it? What is it?
• 35:28
  Speaker A: I would say, yeah, I think that part of that entrepreneurial mindset is that sometimes you have to take knowledge when perhaps a project is no longer fruitful or does not make sense anymore with its initial goals or scope in mind. I think being open and adaptive to pivot away, perhaps even completely from a project, approaching it completely new and from a different perspective. One example I can give is I've spent a lot of time working on an effective AI based forecasting model for our sales side. And that has been probably a six to eight month project that has yielded some results, but has really been kind of that grind that really does quickly in my mind lead to burnout. And so for me, what's been effective is to, I think it's maybe been three or four times, essentially restarting completely, approaching it from a completely different launching point and a different perspective entirely. And I think that can really do a lot to combat that, that burnout and that cyclic feeling, because then it allows you to think creatively again, think freely again. And then oftentimes I've also found that then new developments or new options have even presented themselves in that Timeframe that weren't necessarily previously available.
• 36:45
  Speaker B: Blow it up.
• 36:46
  Speaker A: Exactly.
• 36:48
  Speaker B: Okay, the. That was the burnout question. Have you ever dealt with a vendor that has over promised and underdelivered?
• 36:56
  Speaker A: That's a good question. I would say. I would say definitely. Actually, I'd say one. One clear example comes to mind. And this was at the beginning of our kind of creating our security infrastructure. We really didn't have much in place at all when I first started. Passwords and important information was shared via an Excel file that was being emailed around. And so the first step is we thought, okay, let's not maybe necessarily piecemeal this out completely. Let's get a company that can give us that all in one experience that will really just take care of us. And acknowledging that that may cost a little bit more, but it's going to give us that peace of mind and that simplicity. And I found that that was really not. Not the case.
• 37:44
  Speaker B: And there was a lot of security as a service. Like a security as a service? Yep. Kind of like managed service provider approach thing.
• 37:51
  Speaker A: Okay, absolutely.
• 37:53
  Speaker B: And what happened? Dying to know?
• 37:56
  Speaker A: Well, yeah, no. So we, we very quickly offboarded from them because that. We could quickly see that there was not a lot of value that was actually being added. They were more so just aggregating different solutions that existed and then presenting those as a package, which can be appealing, I suppose, if perhaps that's the perfect combination that just so happens to click for your organization. However, I would venture to say that that is going to be more likely not the case than it is the case. And so that gave us some very valuable experience in jumping off points. And then we decided to just put our solutions together individually and building the best security stack that works for our organization without being limited to, you know, one, one grouping or one kind of package deal.
• 38:43
  Speaker B: Top five favorite security vendors. And we're going to make them all pay us money for. For this, for this little, this little piece. Top five security. Top five security products or vendors.
• 38:56
  Speaker A: Yeah, calling out a few, not necessarily ones that we utilize, but I would say CrowdStrike is fantastic. Their offerings are really, really great and they have quite a. Just a breadth and depth to what they offer.
• 39:09
  Speaker B: The CrowdStrike. The CrowdStrike strike.
• 39:12
  Speaker A: I was. And that's why I say not necessarily ones that we use, but outside of that one that I found.
• 39:19
  Speaker B: Well, I'm just wondering why you say them. Because a lot of people are like, oh, they handle. I mean there's reasons why people would say CrowdStrike. They would say CrowdStrike because, hey, they dealt with this. Whatever other people would say, how could they not have, how could they have not pushed that code out properly through the proper, I don't know, operational procedures and roll out a piece of code that was going to shut down the world?
• 39:44
  Speaker A: Right. I would say I'm definitely have one foot in both of those camps, but I would say that their, their resilience and that ability to get through those, those tough times and come out with a good solution in the end. I think that that speaks volumes as to that company as I can understand that there will not necessarily always, but there is a high likelihood, especially when you're at the top of that particular field, that then you will have these stumbling points. You will have these things that don't come out and aren't necessarily fully ready or have these kind of issues and errors within them. However, I find it a little bit difficult to then discredit all of the other value that they do provide and really the incredible solutions that they do have.
• 40:26
  Speaker B: Number two.
• 40:27
  Speaker A: Yeah, number two, I would say is Air Gap. It's a very, very creative network solution, one that I think really solves a problem that I, that I haven't seen others solve in the same way. And just they really deliver a very polished, polished product that is just, I would say almost bar none to the, to the competition in that particular space. It is a little bit more of a niche product, but I think it is incredibly effective.
• 40:54
  Speaker B: What is the problem they solve?
• 40:56
  Speaker A: Yeah, it would be that propagation or propagation kind of horizontally and vertically if we were looking at some kind of diagram, but essentially having all network devices be isolated and encapsulated. So if you, for example, have a ransomware attack, that's a good example, then it wouldn't be able to go to and infect all of the computers in that network. It would be able to be locked in and isolated to one. And then you can very cleanly and effectively manage that damage control.
• 41:30
  Speaker B: It's like the submarine movies where the water's coming in and we're just like closing the doors so the water can't go into the odor. Only one does.
• 41:36
  Speaker A: That's exactly right. Next one, the next one I would say is going to be Titan hq. They have quite a few different products, but we've leveraged a few of them in the past and they have just exceptional customer service. And I think one of the really important factors is going to be that customer service, but then also that integration and onboarding. I think that's a challenge that a Lot of it security related vendors face where that process is just absolutely miserable and grueling and then it really leads to an ineffective implementation potentially of those products, which in my opinion immediately negates a lot of the value that they could potentially provide. So I think having a streamlined process that's tailored towards a broader audience is really just a far more effective approach. And they have just been exceptional under those two fronts. And not to mention the product itself is also fantastic.
• 42:31
  Speaker B: Man, I should just be the guy that just does like testimonials for other companies. All right. I should be like, what are the worst ones? Okay, give me two more. You got two more?
• 42:40
  Speaker A: Yeah, I would say another one is going to be. No, before. They're more on the phishing and user training side.
• 42:49
  Speaker B: I would say most popular. I would say they're the most popular of the, of the email phishing and security training and don't click on that guys.
• 42:58
  Speaker A: Right. And I think that that's a well deserved position. And I would say after looking at and exploring some of these other alternatives on the market, you know, I think one of the biggest challenges when it comes to training is kind of making that interesting. Making it something that people actually will watch and sit through.
• 43:15
  Speaker B: Gotta fill it with memes. You can' have it be like a stick figure boring.
• 43:19
  Speaker A: Right.
• 43:19
  Speaker B: You just can't do that. You gotta be fun.
• 43:22
  Speaker A: Exactly.
• 43:22
  Speaker B: They gotta have it be crazy. You got. Gotta throw in like the Jurassic park guy here and there. You gotta throw in some stuff. Another movie before and they have. That's fascinating. You weren't even around for Jurassic park one. I know, but it's the greatest IT meme. It's the my. It's my favorite IT meme of all time expired, no expenses. Hire you an IT guy. You know what I mean? Like spare ex, you know? Is that right? Spared. Is my English working today? It's been a long day. Spared no expense. Hires one ID and that's why the dinosaurs escaped. Okay, okay. No, before. Last one.
• 44:01
  Speaker A: Yeah. Last one I would say would be this is a PAM solution called secret server. That's one I think is just very effective. It's well designed. They've gone through a few acquisitions and improvements along the time the lifecycle that we've had them. However, all of those have actually proven to be effective and beneficial to the end user, which is oftentimes something that doesn't necessarily happen is that those acquisitions might be better for the company but they may have a negative impact on those bottom line user base. But they've Had a really effective transition and their product is just. Just very good to use. I think there's not a lot more to say except for just a very well executed product.
• 44:46
  Speaker B: Okay, so what company did you see take over another company where the end users suffered? I can think of a big one right now, but can you think of any?
• 44:55
  Speaker A: Oh, boy. I don't think I've experienced any personally, at least not in the IT space.
• 45:03
  Speaker B: I can think of one. I can think of one that begins with B. And I know a lot of people know what I'm talking about. Begins with B and it ends with A common. But hopefully I don't. And I'm talking about Burger Comm. It's been a pleasure, actually. Very, very enlightening. It's been a pleasure having you on the show. Words of advice or anything. How, how do you, how do you scale up so fast? How do you get to. I mean, what is it? How do you go from video games to this?
• 45:32
  Speaker A: I would say it's really, you know, finding. Finding a good company and not being afraid to kind of, you know, maybe shop around a little bit and breaking away.
• 45:43
  Speaker B: You're a smart person. Yeah.
• 45:44
  Speaker A: And I think breaking away from that approach, I think that was ingrained, at least one that I was ingrained with a little bit in college, which is that, you know, in an IT professional world, you should be jumping ships every one to two years or something like that. I think that that is something that is not really necessarily going to be as effective. I think it's. It absolutely has to happen sometimes and there are always going to be times where that is the best move. But I think it's. It's really finding a good company that is going to have that longevity and is going to not necessarily, you know, hold you back in that development and allow you to really expand your knowledge base, get exposure to a lot of different areas. I think that is just one of the most important catalysts to really expanding and progressing in your career.
• 46:29
  Speaker B: That is probably one of the best pieces of advice. And I only say that because I know it personally. You have to pick. You can't just. You. You need to pick where you want to work and where you fit in. Or you're going to be miserable.
• 46:42
  Speaker A: Yep.
• 46:42
  Speaker B: Or you're just going to be. You're going to pick a loser and it's going to be you. You might be miserable, you might be broke, they might be. You might just not be successful there. The, the choices that you make of where you work are very, very important. So that's actually an outstanding piece of advice looking at your past though. I mean you're also. It probably helps to be a philosophy minor I guess when it comes to these things. And you have a BS in Computer science. How much did computer science actually help you in your role? Because I ask a lot of people this and it's God so much like, you know, it's like philosophy but you know, which is kind of like interesting that you were a minor in philosophy. So computer science and actual real life work help or not?
• 47:25
  Speaker A: For me it did. I think that you can definitely get there without that formalized degree. I think there's just so many fantastic resources that exist out there to get that that knowledge base and that kind of those basic tools. And that's how I would essentially describe that is it gave me that launching point to understand more essentially what I don't understand and then allow me to go after those in more depth. And then just for myself personally, I had no exposure experience with programming whatsoever prior to my time at the university. So having that baseline knowledge is something I use on a very regular basis. And I have to admit that maybe something I I kind of forced to use and make sure is being used because I think that's an important skill to, to not get rusty.
• 48:11
  Speaker B: Noah, thank you so much for being on Dissecting Popular IT Nerds. It has been a pleasure my friend.
• 48:17
  Speaker A: Thank you so much. I appreciate your.