Proving the value of security operations with Christopher Crowley (Episode 344) (Document)

--- Page 1 --- These tools are going to find the most immediate and efficient path, and they're going to produce a PowerShell script that does the bare minimum of what you want. Now you need to be the adult in the room. My guest today is Christopher Crowley. Christopher is a cybersecurity practitioner and educator focused on security operations, incident response, threat hunting, and building and maturing security operation centers. He is the author of the annual SANS SOC survey, a security operations class called SOC Class, a new book entitled The Value of Cybersecurity Operations, a senior instructor with the SANS Institute, a faculty member at IANS, and a consultant through Montes. His background also includes network operations, software development, mobile security assessment, and security policy. Today we will talk about security operations, what makes an effective SOC, and how the role of the security analyst is changing. Thanks so much for being here. Thank you for being on the show with us today, Christopher. It's great to have you here. Thank you very much for having me. I appreciate it. I always like to get started with how people got into technology and how they found a career in cybersecurity. It seems like nobody has the same path. How did that all come about for you? My path is pretty strange. So I grew up in Massachusetts, suburbs of Boston. And so that area, actually, Mainwood, Massachusetts, when I was a kid was the headquarters of a company called Digital Equipment. And I grew up in a company called Digital Equipment. And I grew up in a company called Digital Equipment Corporation. My dad worked there. So there were lots of computers in the house and lots of stuff going on. So I started playing around with computers when I was really young. And I had like an Apple 2GS that I was doing mail merge, you know, like, I don't know, 10 cents or 2 cents, a letter that I put the stamp on for like marketing stuff. You know, and then I got a job when I was 15 years old doing Alteryx and VMS systems administration. So probably not the traditional path of like, how you start. And computers, you know, I was getting dropped off after school to go do like, you know, just basic sysadmin stuff. And, you know, I was there because they needed somebody to change the tapes and the tape drive and the system, you know, the professionals didn't want to stay after 5pm after the developers were finished, and you needed to run backup daily. So that was, that was my first job in computer. That's, that's a really interesting path. Literally. Watched us develop from tape drives to cloud and now AI, right? Yeah, and it's been weird and winding since too. Yeah. Was there any specific experiences that shaped how you think about security on that journey? How did that sort of become centered to your, your focus? Yeah, for sure. So like, I was, I continued doing kind of the IT stuff, --- Page 2 --- and I was managing Solaris systems and AIX and HPUX at Tulane University. And, you know, this is a thing that you read about in textbooks, but literally the weekend that Blast or Nachi broke out, broke out was the, the freshman orientation at Tulane. We were dealing with that live. You know, so it was kind of like, you know, it was kind of like that. What, what, what shaped my experience with cybersecurity of like, what the hell is going on? What is going on? You know, and then trying to figure out how to understand that without having the background. You know, to think about it and then have to really, really quickly ramp up and do that and like deploying anti-spam because we didn't have it and doing that on like a university budget, you know, that, that kind of stuff. And then, and this is the thing that isn't exactly cyber, but it actually has shaped my concept of a lot of things is in 2005, Hurricane Katrina hit New Orleans and I went through a major disaster recovery experience. So that, that's another thing that, has influenced my career pretty dramatically in two ways. One is having the DR experience, but then it sort of like bounced me out of New Orleans and I ended up in Washington DC and then switched over working for a whole bunch of like US government stuff. So then I started going down the path of like big data stuff. I was at Center for Bioinformatics at National Cancer Institute. And then I was at Department of Energy and then went into Department of Defense for a while. So lots of like, that's a big government stuff. And then I started going down the path of like government stuff too. Like that was kind of the path that I took. So it was like this small niche and then it like ejected me and I ended up like in a totally different world, but really nice for me because at Tulane, I had this tremendous spectrum of, of things that needed to be done. And then I was able to like continue to develop that. And it was like, I was implementing a web application scanning program for the bioinformatics, you know, because the web apps didn't have that before. So it was a lot of that sort of stuff early in my career that nobody else was doing it. And I was picking it up and, you know, candidly figuring it out as I, as I did that. But, but now people in cybersecurity, they walk in the programs largely established. So it's really hard for people to have that context of doing all the things. So that's kind of, I think that that's kind of a unique thing that I bring to the, to the mix is, you know, I've been through a lot and had to do it myself and figure it out from scratch and, you know, Google searches and whatever. --- Page 3 --- Yeah. It must've been so interesting to be like internet capable in those early days of the internet because nothing was locked down at all. I have some friends who used to be on those BB edit boards or whatever, and they would tell me about the shenanigans and stuff. I don't know if I want to admit some of the stuff I did on a recording. I'm not kidding. Yeah. But it wasn't malicious, right? It was sort of this, like, that's where that's going and stuff, you know, but I was also just a 15 year old kid and I had root access to everything and the, and the company that I work. No, I mean, it was like, you know, looking back on it, it's insane. They gave a 15 year old kid the root password on everything so that I could do the backups. Yeah. Yeah. Wild times for sure. I often joke about this too early in my career. I would get offended if I didn't have root access on something. And now that I've like, well-established in my career, it's like, do I need that? Cause I don't want it. Please don't give that to me. Please don't give that to me. Yeah. You know, I've been to, you know, now that I work with customers, I'm like, just don't tell me any of that stuff. I really don't need to know that. So I'm not interested in having that information. Yeah. So I, one of the things I wanted to bring up while we were talking was you did just write this book, the value of cybersecurity operations. I'm curious about, you know, what inspired that book and what people can take away from reading it. Yeah. Yeah. The inspiration is I'm tired of repeating myself. You know what I mean? Just like, come on. No, no. Actually the inspiration is I, I genuinely am trying to equip people in cybersecurity to have a conversation that I don't think that they're really ready to have, which is the expression to the organization of like what we do in a way that the organization can use to compare to the other choices that it can potentially make. And, and I think that again, like I've had to kind of make up a couple of things in my career to explain something. Cause I was trying to articulate it. And one of the things that I used sort of like very early on was this metric of like avoidability. And it was like, okay, here's, here's the thing. It's like a, it's like a categorical expression. It was avoidable it, you know, because we just didn't do the patch and there was no reason, or it was like avoidable because we didn't do the patch, but we chose not to do the patch or it's like zero day type stuff. And so this, this sort of thing, like when I started expressing incidents, when I was an incident manager, like literally a large network incident manager, --- Page 4 --- um, I was trying to explain to my management, like, look, this is the situation, right. And, and I'm, I'm trying to make it as simple and as clear as possible. And so I have done this initially for me. As I was working with different groups, uh, and then, um, on behalf of my customers with my consulting stuff. And, you know, as I try to train organizations, I do workshops to like get them to bootstrap and build the sock or help them with the maturity assessment. I really do find myself trying to explain this over and over again. It's like, this is how we need to say this to the business because we have to be really careful about not misrepresent, misrepresenting the things that we're doing and saying, we're providing value to you. But the value that we provide is by helping to assure that a thing didn't happen. So how do I count that? Like, how do I, how do I add that up of like, nothing happened? Because if nothing happens, everybody thinks like, oh, well, we don't need security. But if nothing happens because the security is helping to prevent the impact, then we're doing a great job. And nobody sees that. So it's a real catch 22, right? Yeah. And so it's a, it's a problematic thing because what then happens is people just start making stuff up and I'm like, well, let's negotiate what we're allowed to make up and put this in a, in a, in agreeable scale. And it kind of tracks to money, but it's also all hand-waving around the money. But this is, this is what I'm trying to help people to do with the book because it, it's something that I've a pretty cohesive expression. And I just feel like it's, it's one of those things that if the cybersecurity practitioner spent 10 years in their career, they still wouldn't come up with that. And the only reason why I happened to come up with it is because I've had to do this for lots of different organizations and very quickly arrive at the, this is the method that I'd like to use. And then we'll negotiate and tune the details of it. So I'm now sort of like sharing that approach. Do you find that like cybersecurity teams sometimes focus too heavily on technical metrics that executives don't find meaningful? Is that, I mean, There were 7,463,358 firewall blocks. Yeah. Yeah. Great. You know, but it's like, even that, like I, I want to quantify everything, but you know, I tell people like, great. Okay. So you're going to do, you're going to do a quantification. Are you also showing a moving average, related to the details of the quantity of the things that you're telling them? People are just like, what? Like improvement over time is what you're talking about, right? Well, but also like actually, so improvement over time sometimes, but like firewall blocks, --- Page 5 --- there's no improvement. We're blocking the internet from intruding into our environment. It's probably going the wrong way, if anything. Well, so it's like, here's, here's what I say about that. All that I need to show them there is moving average with some sort of like a, you know, a two or a three standard deviation away from that to be able to say like last month was really busy because there was a lot of volatility in the state of what we were dealing with. And we attribute that to this other thing. There was a, you know, a zero day that came out and there was tons of scanning and tons of things that were happening. And like that sort of expression of the very technical metrics, I think we also need to do. And again, I don't think that cyber folks are particularly tuned into those sorts of details of why does it matter? And they don't have the tools in their, you know, toolbox to be able to make those sorts of expressions in the metrics. And so I'm really trying to come up with the like, yeah, counter MTTR or whatever. Like that's, that's great. That's, that's a good thing. But meantime to resolution is good. If you can also say like, we're very stable and we have, we have within this range, you know, over the last 10 months, we don't break out of the range very much. That means you're doing a good job. You have maturity, you have that capacity. So I think that all these metrics have value, but we just need to use them appropriately. And sorry, just one other thing on the metrics. I talk about metrics in three different bins of some sort of service level objective. So if I have a metric, I might potentially have an objective associated with that metric. And then service level objectives are presumed to be reported, but sometimes we report other metrics that don't have objectives. And then the third bin, the concept there is we don't report it at all. It's all just internal to us. And I would say it's probably like 5%, 10%, 85% in the breakdown of what those things should look like of like 5% of your metrics or service level objectives, you know, another 10% are reported metrics. And then the rest of it is just like, you have it, you can kind of make sense of it. And if someone asks you a question, you can open that up and show it. For somebody leading an organization, is there anything they can think about when they're trying to determine whether they're spending too little enough or potentially too much on cybersecurity operations? Yeah. And this is, this is what I'm trying to say in the book is like the, the loss prevention and the quantification that comes along with that helps you to do that. So I have sort of like this approach where I talk about some speculations and this is impact --- Page 6 --- quantification and loss prevention. And then I talk about just the, um, sort of the, the costs associated with our technologies and just sort of adding that up. The idea being that it's like, if I can, even if it's speculated, if I can say, here's the value that I'm providing, and then I can say, I'd like to buy this threat intelligence platform. And the threat intelligence platform costs me, I don't know, a hundred thousand dollars to, to buy in. And it's going to cost me 20 to implement it. And it's going to cost me another 10 per year for the next three years. So I'm asking for $150,000 and it's a low estimate, but I'm just making stuff up. Right. Yeah. Yeah. Yeah. That's, that's a cheap product right there. Exactly. So I just, it's easy math. I can do it in my head. So, so, so, so now I'm asking for $150,000 over the course of a few years. To be able to do this for what, what do I think is going to do for me? Well, I can quantify that actually, like that tip is going to save me 0.0000001 dollars for every item of threat intelligence that's in there because that enrichment saves my analyst some time and it provides greater value for the SIM detection by being able to leverage the data and have higher accuracy. So now I can, again, in a speculated way express, here's the real world cost. Here's my projection of what I think that that will, will provide. And I think a lot of people struggle with the, like, how do I ask for it? What, how can I justify that? And there's a lot of kind of just like, this is what we think it will provide. And I'm really trying to ground that back into the, you know, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the real term of the reason why I want the tip is multifold. It saves people time and it gives me data that's useful for detection. And it's maybe not the initial detection, but it's after the initial detection for the validation of that detection to be able to then move it forward. And that reduces false positives. And so I can show the real value to that because that means that I have a, you know, basically a leaner, a cue for my analyst to work for the things that are more important. So that's, that's how I'm trying to, to help people to express that. Am I spending too much or too little? And then maybe even where am I spending too much and where am I spending too little? So obviously we're in the, you know, the burgeoning era of AI, uh, automation has sort of been given an upgrade. Uh, what role should that play in a modern security operations program and in where does it work well and where's --- Page 7 --- in judgment still difficult to replace in your opinion? Yeah, that's, that's, uh, is this what the whole webcast is about? I mean, we can start. I know it's a hot topic. It is. It is. Well, it's also a big one because, um, so, okay, let me, let me think about how to organize it. So I don't like, um, okay. So my thinking on this is that the initial thing that everybody in cybersecurity should be doing with AI is polishing their communication. The easiest win right now is taking the information that you want to communicate and help, uh, helping yourself to this tool that will enhance the expression of that. Okay. So that's like number one, if you're not already doing that in some way, um, you should be doing it. And even for the people who are like, I can't send it out. It's like, okay, figure out how to set up, you know, an Alama instance on a, on a server someplace with, you know, a bunch of, uh, a bunch of Ram to the GPU. And I would, I would lean toward max for the Ram richness, you know, because of the unified memory stuff, but it doesn't matter if you want an NVIDIA card with 24 gig of Ram, or you can get something even better than that. I got a pretty beefy GPU on this thing and it works great for home inference stuff. Yeah. Yeah. Yeah. So it's like, okay. So then, then just do it, do it offline. Like you can just do it and it'll take longer, but who cares? It's like, just polish it and, and leverage that to polish it. So that's number one, um, the communications and that's, that's not just the, uh, not just the words, but also the visualizations. Um, the, the second thing that I think everybody should be doing inside of cybersecurity right now, um, is leveraging the tool, the GPT, you know, um, to be able to write the code, to do the little thing that you want done. And this is something that I think that, um, it's so easy to, uh, sort of absorb this as a helper, but here's where the human oversight comes in at the first place is I can say, write this PowerShell script. It's going to write a PowerShell script. These tools are going to find the most immediate and efficient path. And they're going to produce a PowerShell script that does the bare minimum of what you want. And what we need to realize is that this is the tool that we're working with. And so if you want something other than the bare minimum, now you need to be the adult in the room to be able to give it all the, uh, thoughtful instructions and then keep iterating over that and just don't let it go. You know, and it's, it's funny. I find myself sometimes just being like, all right, this will work. --- Page 8 --- I put on caps and I just like yell at it. And I just, I call that yellow mode. Yeah, yeah, yeah, exactly. So, and so, and so now, but the other thing that I found myself doing a lot on that regard, if I'm, if I'm writing code and I'm, I've been doing it manually and I know that you can just get clawed to kind of like do it, but I've been doing it manually and I've been doing it manually. I'm more interested in the observation of it is I give it exactly the code back again. And I say, update this code and then I'll put the code in an XML block below and I'll give it design specifications. And then every four or five prompts, I'll force it to reiterate all of the guidance that I had provided up to that point in terms of the objectives, the specifications, the criteria, the, you know, like reiterate the harness that you have of building the code. Now take that plus the enhancement. Plus the, the current state code and then give it to me again. And that has been really powerful for me. And I think that a lot of teams kind of struggle with the, this as a methodology and it's fairly straightforward. Once you embrace it, you just have to like embrace that. And then it becomes the, like, as a team, you should be sharing these sorts of insights. Yeah. It sounds like you're describing. What I've heard called a self-reflection loop where you're having the AI sort of re-analyze its code based on first assumptions. Over and over and over again. Yeah. Over and over and over again. And I, I do a lot of like AI to generate code with very minimal internal API calls back to different AI, you know, so whether you want to call it agentic or rag it to me, it's like, I know that there's a distinction there. Yeah. I know what the distinction is, but I kind of don't care when I'm like, okay, go over here and get me a thing. And whether you're getting me a thing from a resource where you're getting me a thing that's going to do a thing. Okay. You know, like, cause sometimes it's a, it's a blend of that. So that's a second thing that I think everybody should be doing is using it to write their code and then only selectively inserting the subsequent API calls back to the AI component, but it's primarily deterministic. And then one other thing about that, that I find extremely useful is getting it to log everything that it's doing so that when it does start to go off the rails, you have the intermediary data to be able to be like, okay, let me take an example. This is what you produced at the end of the script. It's not what I want. Here were the intermediary data elements that you stored. --- Page 9 --- This is where we started. This is where we ended up. This is what I don't like about where we ended up. Take these intermediary parts. And then tell me how we should resolve it. So that in this specific case, it's, it's going to do better. Okay. So that's it. Well, well, and it's also like, how, how would I learn what I want to do better on my scripts? I would, I would trace, you know, and I would do data tracing essentially. So I'm forcing the data tracing as part of the development. And ultimately, if, if I get to the point with stuff that I'm developing like this, that I'm going to go fast, all that can be ripped out, but it's really nice for the instrumentation during the development to be able to, to see the details of it. Right. Interesting. There's another thing. Sorry. Okay. One more. Yeah, no, let's keep going. I was going to change the stream. Yeah. I got, I got one more because I think that, I think that there's like the next thing that we do, which is real ML. Like I, you know, like at a certain point. Statistical analysis, ML, not guessing the next word, LM. Deep. Yeah. Yeah. Well, so yeah, not, not, you know, the generative pre-trained stuff, not a, not an, not an auto encoder. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Right. Or not something which those, you can build your own for that, but like the, I'm, I'm sorry. Linear regression. Yeah. So I'm thinking deep learning neural networks to do a very specific thing when you have data. And I said, not, not an auto encoder, but I was actually thinking of an auto encoder, like an auto encoder is a great example. Example of being able to use a, a technique from more traditional machine learning to provide a very sort of like. constrained structure that says, here's the stuff that I know really well. And then I can use that for an anomaly detection. Or, you know, like I did a project recently for a customer where it was like, we got a thing, we're trying to train this up. And I did a little quick prototype. But the thing that I did that I thought was interesting, the prototype didn't work very well. But what I did that was interesting, and I was like, here's all the code to do this, is I turned all of their confluence data into trainable data. And I was like, you know, like, I was doing this for your prototype, but you now have all this other stuff that you could use for other things. And I've now written all this code for you on how you would do that. And I've troubleshot it. And I was like, you know, pulling this in. And it was word based. But still, I'm like, --- Page 10 --- this is a thing that I'm that I'm working with different, you know, engagements that I have, and I'm trying to help people to see where they have a lot of data. And that data is unique to them. And then you can really look at that from the like the ML perspective, like, forget about having something that's a GPT, forget about the, you know, the multi headed self attention, you know, like all of this stuff with the words and the tokens. This is like, potentially a goldmine, and nobody knows how to use it. But it's going to be so niche. But that niche is going to give us detections, you know, so for like, for you all, as an example, you know, like, you, you then need to think about like, what's your pipeline from a hunting to detection engineering perspective? And where are those going to be like, oh, you know, we should do detection engineering for that, because we have this mountain of data. And we can basically just like run this thing for a long time. Yeah. And the thing about that, like, there's a heavy lift at the front, but the cost of running that once it's built, is orders of magnitude cheaper than trying to leverage these LLMs and stuff like that, because it's so tuned to that data. Yeah, that's exactly right. And I think that that's, I think that that's out of reach for most organizations, not because of economy, but because they don't have the imagination and the strategic vision to get there. And, and the other thing is with that lack of imagination, strategic vision, people are like, now going to come up with harebrained ideas that don't work really well, they're not going to do it properly. And then it's going to basically like spoil that effort when it would have worked in another context, because the people who tried to do it first were like, I'm going to use this tool for completely the wrong purpose. And yeah, that's a danger, a real danger. Yeah. And I think if you look at the history of the sort of IT or technology or software development industry, you see that pattern repeat over and over. I remember sort of doing contracting when sort of the app thing became a new thing. And there was a lot of organizations who'd hired somebody to do something and it was delivered poorly. And so they were they were scarred and they didn't want anything to do with it. Yeah, they just burned. And it's, it's unfortunate, you know, it's unfortunate. But then also, it's like, if you do decide to go down this path, and you have one really smart person on your team for a year, who's super into it, and they build it, and then they walk away, nobody else knows how to maintain it. Now, now it's like, okay, now we end up with a new a new wave of kind of --- Page 11 --- a legacy thing that this is different. This is, you know, it's like, there are all these potentials for making it wrong, no matter which direction you go. So find smart people, pay them well, and keep them. That's what you're doing. You're telling me that, you know, it's funny, did you read my book already? Did you? You know, because I literally, I actually, I actually have a section on like people versus technology versus automation versus outsourcing really briefly. But yeah, that's, it's an obvious thing. You know what I mean? It's like, it's really an obvious thing. The machines are self tuning to a degree, but only within the like, the initial scope of the self tuning. And once the thing really gets out of out of its, you know, trajectory, it's going to have some pretty big problems. And getting it back into the into the scale is professional services type of engagement, if you don't have smart people, and those professional services engagements. You know, how long is it going to take even to the contract? Yeah, when things aren't working, right. So what I was gonna try and get to earlier was this, this idea that attackers are also adopting AI, I call it the spawn camping, the CVE list. So you know, we're seeing like days before we're having zero days exploited in the wild. And now it's I think, hours, and I expect we'll eventually get to minutes, you know, does that change how organizations should think about, you know, measuring their defensive effectiveness and deploying AI as like a frontline sort of defensive mechanism? Yeah, I don't think it changes how companies should think about their defenses. I don't think it changes how they should think about it. I do. think it increases the urgency of getting it right. You know, like, it doesn't really change the equation. And my other thing about AI is my concept of operations in the SOC is that the SOC is a part of the organization with a responsibility, among other things, to deal with uncertainty. Like the SOC is the thing. That the weird stuff lands in that is part of its responsibility. Like that's, that's if you're if you don't think your SOC is that then it's probably not what I think a SOC is. Right. So, so that being said, and this is maybe like, you know, just let me qualify that a little bit. If your SOC is just the monitoring slice of the overall cybersecurity operations. Yeah, then you're not going to agree with me. That that's where it lands. Because like that monitoring is the more routine. I'm talking about the larger like cybersecurity operational concept of security operations SOC. So, so just in case that doesn't sit well with people, I want to clarify that a little bit. But if we're supposed to be dealing with uncertainty, dealing with, you know, issues that arise, part of what we should --- Page 12 --- always be doing operationally is ingesting new technology. And to me, AI, number one isn't new technology, but the the explosion in the last, you know, five years is, is a big hit for us. But we should be ready to just like, be onboarding tools for ourselves and for the company. And if your SOC or your cyber operations at all, aren't in a position to do that, you're missing an important capability. Yeah. And I think we suffer. We suffer. We suffer a lot of like skeptical, and for lack of a better word, I'm gonna say curmudgeons in this industry. I've talked to some really talented, smart teams who just had an experience early with LLMs. And they said, Nope. And, you know, years later, they're still holding that line. And I'm like, you know, I'm in this thing every day. And if you can see the leaps and bounds, and you understand the curve of technology, like this, you can't ignore this, like whether it upsets your worldview or not, it's just something you need to accept. Yeah. Yeah. And, and it's, it literally is, especially for curmudgeonly people, it's just some math, like it's it there's, there's nothing others than some predictive output based on the inputs. So it's like, especially people who have a, an analytical mind, if they investigated how it's working, I think that they might arrive at like, you know, an embrace to the thing of like, Okay, well, this is actually how it works. So let me just, let me just think about it that way. Because, you know, when you're when you're doing business, you just, you just, you're just using them. Right. it you know it really is just the the predictive outputs with some very clever engineering inside yeah it's augmentation not replacement like i still think of course humans have a central piece in all of this it just like it's like putting on a mech suit you know it's amazing it's amazing and you know it's like i'm you know i think we were talking about this just a little bit i'm kind of like the solopreneur or whatever you know made up word people use for that i don't have any employees you know it's like i i have a backlog of thousands of things that i would like to do so if i'm doing them a lot faster now and well it's like i can i can write code but i never take the time to write the code off the top of my head and all the things that i knew needed to be written in code i just kind of like okay let me write the power shell for that or whatever and now it's just like give me the python that does this and then i'll look at it and i'll be like no you know like okay i that was a bad prompt on my part let's let's go again --- Page 13 --- okay this might this might work let's try that you know but i'm doing stuff where like like my development path is jupiter lab notebooks lots of like you know sort of very rapid development sharing that with people seeing what they they use for it and i just was revisiting a deliverable with a different customer and i went and i had all these notebooks and i'm looking at it i'm like where the hell did this come from and i and i went and i was like this is weird because it's like i'm a very organized person in terms of my workspaces yeah and i oh and i'm like i got all and i went back and i was like i like i literally wrote this in like five minutes on gemini and totally forgot about it and basically it was like i was looking i was like this stuff is really good like you know like it was and i looked at the logs of it it was a super short conversation it gave me all the stuff that i wanted i dropped a presentation that i'd written six years ago in i said there are all these like there are all these specs inside of here for the stuff create that database in uh you know in a file and then generate all of these other things simulate all these things give me this and then produce this and produce these outputs and this and you know i was like man that's really good that's like that's what i would have written if i had three days but unlimited time and yeah yeah you know so now it's a lot of like so long as i can test it and review it it becomes it becomes pretty powerful and so i think this is where we're going i really do i think that this is where we're going in cyber security from a defensive perspective think about it not as like a new burden or anything think of it literally as this is going to clear the queue of the backlog of technology technology deficit and if you have even just been tracking that uh then maybe you can get to the point where now you can even square off against your adversaries because yeah or go spend time with your kids and get a good night's sleep no no no that's not happening yeah of course no no no of course i you know it's like i i have been uh like a road warrior for the last 15 years i spend a lot of times on planes you know yeah i'm like i'm like i'm like i'm like i'm like i'm like i'm you know my my um you know badge of i guess we'll call it honor is that you know i'm like you know basically the highest tier status on two airlines so what one thing i found that me and my business partner actually talked about recently that i --- Page 14 --- think is really interesting is is like i find myself doing more deep thinking whereas in the past like there was just so much urgency in front of me i think i i had a really hard time slowing taking a step back and and i just find that i have more time to to think about more strategically over the longer term instead of just putting out fires in front of me so maybe that's the boon in all of this that we all get to get back to that deep thinking and this this is the point of what i was just about to say is it gives you space to rest because if it doesn't matter ai or not if you're not resting you're gonna you're gonna destroy yourself you just can't work in this space without you know you're gonna you're gonna you're gonna you're gonna you're gonna figuring out what you individually need from an emotional release from a physical release you know for me one of the best things that i did in the last 10 years was i got a desk that shifts between standing and sitting same yeah and you know i have a treadmill under my desk so that i have a elliptical machine like you need movement you can't just sit there for 14 hours a day yeah so yeah so like this becomes the the thing that people need to do that and if that's good night's sleep in your own bed you know spending time with your kids and like pushing it all the way you have to do that yeah you know you like genuinely have to do it and the thing about the deep thinking i think of the what was his name cal newport deep work guy cal newport mit or whatever um and and you know he has some really nice like thoughts on that but it's like the different techniques of make a time period where no phones no interruptions snap in and do uh the the other thing i actually do this quite a bit is that sort of like um journalistic thing where i'm just so under time pressure that i just have to produce and it's just like everything that i'm doing when i have a spare 20 30 minutes i'm basically producing something because i'm just like working it in uh that's burnout space you know what i mean so it's like you have to be really careful about using that too much and then the last one that he mentions which i also do he calls it the like monastic where you're just you can you can brew great beer if there's if there's no urgency right well so i get stuck in places sometimes where i'm like between work gigs and i have to go someplace i'll sit in a hotel for a week and i'll just work on a project you know and it's like that that is another thing that i have like given --- Page 15 --- myself is i'm going to be in a cool place and i'm going to do this i just i finished the book when i was just in oaxaca mexico and i had like a vacation you know it's like i was there for a week to just like hang out and i had my coffee in the morning and then i finished writing you know which is a big lift so yeah i think that we all need to figure out what that's like for us so that we can keep doing all these things because the problems aren't going away the problems are accelerating as you've cited and we need to catch up yeah take care of the meat suit and uh go forward strategically okay so this is the last one i have for you it's the one i ask of everybody that comes onto the show it can be as wide or as narrow as you want do you have any predictions for the future of cyber security yep i i absolutely do so there's there's an article that i wrote recently on what this is going to look like in in security operations and so i'm going to talk about it from the skill set that's required for for people going forward and to me it's like this amalgamated architect programmer data science communicator like that is what people in cyber security are going to need to do and i think that the the intention of our work is that and then one of the thing about that is i also see cyber security reconverging more into it and there's a lot more a lot more convergence and alignment with the empowerment of people who are doing it engineering of the like you can't skip the cyber or give that to us as our responsibility now if it's not engineered that way from the beginning and we start having problems we're just going to have to do it again and again and again and again and it's going to kill the project you just can't have it anymore it's just not it's not reasonable to do the thing where you're pushing it out knowing that it's flawed yeah just non-tolerable so i think that that becomes the like the reconvergence of cyber and it and like the last you know two decades of you know big separation there basically melds that back in still having specialists for cyber but largely it's embedded at an organizational level they kind of become one in the same yeah i totally agree with that yeah there'll be less people but better tuned to the new skills and and requirements yeah yeah i think awesome chris uh this was a really fun conversation uh before we appreciate it yeah before we sign off where's the best place for people to go get your book i'll put a link in the show notes but uh just for them listening the um the montance shop so it's just shop.montance.com okay awesome that would be awesome --- Page 16 --- you