Proving the value of security operations with Christopher Crowley (Episode 344) (Video)

--- Page 1 --- These tools are going to find the most immediate and efficient path, and they're going to produce a PowerShell script that does the bare minimum of what you want. Now you need to be the adult in the room. My guest today is Christopher Crowley. Christopher is a cybersecurity practitioner and educator focused on security operations, incident response, threat hunting, and building and maturing security operation centers. He is the author of the annual SANS SOC survey, a security operations class called SOC Class, a new book entitled The Value of Cybersecurity Operations, a senior instructor with the SANS Institute, a faculty member at IANS, and a consultant through Montes. His background also includes network operations, software development, mobile security assessment, and security policy. Today we will talk about security operations, what makes an effective SOC, and how the role of the security analyst is changing. Thanks so much for being here. Thank you for being on the show with us today, Christopher. It's great to have you here. Thank you very much for having me. I appreciate it. I always like to get started with how people got into technology and how they found a career in cybersecurity. It seems like nobody has the same path. How did that all come about for you? My path is pretty strange. So I grew up in Massachusetts, suburbs of Boston. And so that area, actually, Mainwood, Massachusetts, when I was a kid was the headquarters of a company called Digital Equipment. And I grew up in a company called Digital Equipment. And I grew up in a company called Digital Equipment Corporation. My dad worked there. So there were lots of computers in the house and lots of stuff going on. So I started playing around with computers when I was really young. And I had like an Apple 2GS that I was doing mail merge, you know, like, I don't know, 10 cents or 2 cents, a letter that I put the stamp on for like marketing stuff. You know, and then I got a job when I was 15 years old doing Alteryx and VMS systems administration. So probably not the traditional path of like, how you start. And computers, you know, I was getting dropped off after school to go do like, you know, just basic sysadmin stuff. And, you know, I was there because they needed somebody to change the tapes and the tape drive and the system, you know, the professionals didn't want to stay after 5pm after the developers were finished, and you needed to run backup daily. So that was, that was my first job in computer. That's, that's a really interesting path. Literally. Watched us develop from tape drives to cloud and now AI, right? Yeah, and it's been weird and winding since too. Yeah. Was there any specific experiences that shaped how you think about security on that journey? How did that sort of become centered to your, your focus? Yeah, for sure. So like, I was, I continued doing kind of the IT stuff, --- Page 2 --- and I was managing Solaris systems and AIX and HPUX at Tulane University. And, you know, this is a thing that you read about in textbooks, but literally the weekend that Blast or Nachi broke out, broke out was the, the freshman orientation at Tulane. We were dealing with that live. You know, so it was kind of like, you know, it was kind of like that. What, what, what shaped my experience with cybersecurity of like, what the hell is going on? What is going on? You know, and then trying to figure out how to understand that without having the background. You know, to think about it and then have to really, really quickly ramp up and do that and like deploying anti-spam because we didn't have it and doing that on like a university budget, you know, that, that kind of stuff. And then, and this is the thing that isn't exactly cyber, but it actually has shaped my concept of a lot of things is in 2005, Hurricane Katrina hit New Orleans and I went through a major disaster recovery experience. So that, that's another thing that, has influenced my career pretty dramatically in two ways. One is having the DR experience, but then it sort of like bounced me out of New Orleans and I ended up in Washington DC and then switched over working for a whole bunch of like US government stuff. So then I started going down the path of like big data stuff. I was at Center for Bioinformatics at National Cancer Institute. And then I was at Department of Energy and then went into Department of Defense for a while. So lots of like, that's a big government stuff. And then I started going down the path of like government stuff too. Like that was kind of the path that I took. So it was like this small niche and then it like ejected me and I ended up like in a totally different world, but really nice for me because at Tulane, I had this tremendous spectrum of, of things that needed to be done. And then I was able to like continue to develop that. And it was like, I was implementing a web application scanning program for the bioinformatics, you know, because the web apps didn't have that before. So it was a lot of that sort of stuff early in my career that nobody else was doing it. And I was picking it up and, you know, candidly figuring it out as I, as I did that. But, but now people in cybersecurity, they walk in the programs largely established. So it's really hard for people to have that context of doing all the things. So that's kind of, I think that that's kind of a unique thing that I bring to the, to the mix is, you know, I've been through a lot and had to do it myself and figure it out from scratch and, you know, Google searches and whatever. --- Page 3 --- Yeah. It must've been so interesting to be like internet capable in those early days of the internet because nothing was locked down at all. I have some friends who used to be on those BB edit boards or whatever, and they would tell me about the shenanigans and stuff. I don't know if I want to admit some of the stuff I did on a recording. I'm not kidding. Yeah. But it wasn't malicious, right? It was sort of this, like, that's where that's going and stuff, you know, but I was also just a 15 year old kid and I had root access to everything and the, and the company that I work. No, I mean, it was like, you know, looking back on it, it's insane. They gave a 15 year old kid the root password on everything so that I could do the backups. Yeah. Yeah. Wild times for sure. I often joke about this too early in my career. I would get offended if I didn't have root access on something. And now that I've like, well-established in my career, it's like, do I need that? Cause I don't want it. Please don't give that to me. Please don't give that to me. Yeah. You know, I've been to, you know, now that I work with customers, I'm like, just don't tell me any of that stuff. I really don't need to know that. So I'm not interested in having that information. Yeah. So I, one of the things I wanted to bring up while we were talking was you did just write this book, the value of cybersecurity operations. I'm curious about, you know, what inspired that book and what people can take away from reading it. Yeah. Yeah. The inspiration is I'm tired of repeating myself. You know what I mean? Just like, come on. No, no. Actually the inspiration is I, I genuinely am trying to equip people in cybersecurity to have a conversation that I don't think that they're really ready to have, which is the expression to the organization of like what we do in a way that the organization can use to compare to the other choices that it can potentially make. And, and I think that again, like I've had to kind of make up a couple of things in my career to explain something. Cause I was trying to articulate it. And one of the things that I used sort of like very early on was this metric of like avoidability. And it was like, okay, here's, here's the thing. It's like a, it's like a categorical expression. It was avoidable it, you know, because we just didn't do the patch and there was no reason, or it was like avoidable because we didn't do the patch, but we chose not to do the patch or it's like zero day type stuff. And so this, this sort of thing, like when I started expressing incidents, when I was an incident manager, like literally a large network incident manager, --- Page 4 --- um, I was trying to explain to my management, like, look, this is the situation, right. And, and I'm, I'm trying to make it as simple and as clear as possible. And so I have done this initially for me. As I was working with different groups, uh, and then, um, on behalf of my customers with my consulting stuff. And, you know, as I try to train organizations, I do workshops to like get them to bootstrap and build the sock or help them with the maturity assessment. I really do find myself trying to explain this over and over again. It's like, this is how we need to say this to the business because we have to be really careful about not misrepresent, misrepresenting the things that we're doing and saying, we're providing value to you. But the value that we provide is by helping to assure that a thing didn't happen. So how do I count that? Like, how do I, how do I add that up of like, nothing happened? Because if nothing happens, everybody thinks like, oh, well, we don't need security. But if nothing happens because the security is helping to prevent the impact, then we're doing a great job. And nobody sees that. So it's a real catch 22, right? Yeah. And so it's a, it's a problematic thing because what then happens is people just start making stuff up and I'm like, well, let's negotiate what we're allowed to make up and put this in a, in a, in agreeable scale. And it kind of tracks to money, but it's also all hand-waving around the money. But this is, this is what I'm trying to help people to do with the book because it, it's something that I've a pretty cohesive expression. And I just feel like it's, it's one of those things that if the cybersecurity practitioner spent 10 years in their career, they still wouldn't come up with that. And the only reason why I happened to come up with it is because I've had to do this for lots of different organizations and very quickly arrive at the, this is the method that I'd like to use. And then we'll negotiate and tune the details of it. So I'm now sort of like sharing that approach. Do you find that like cybersecurity teams sometimes focus too heavily on technical metrics that executives don't find meaningful? Is that, I mean, There were 7,463,358 firewall blocks. Yeah. Yeah. Great. You know, but it's like, even that, like I, I want to quantify everything, but you know, I tell people like, great. Okay. So you're going to do, you're going to do a quantification. Are you also showing a moving average, related to the details of the quantity of the things that you're telling them? People are just like, what? Like improvement over time is what you're talking about, right? Well, but also like actually, so improvement over time sometimes, but like firewall blocks, --- Page 5 --- there's no improvement. We're blocking the internet from intruding into our environment. It's probably going the wrong way, if anything. Well, so it's like, here's, here's what I say about that. All that I need to show them there is moving average with some sort of like a, you know, a two or a three standard deviation away from that to be able to say like last month was really busy because there was a lot of volatility in the state of what we were dealing with. And we attribute that to this other thing. There was a, you know, a zero day that came out and there was tons of scanning and tons of things that were happening. And like that sort of expression of the very technical metrics, I think we also need to do. And again, I don't think that cyber folks are particularly tuned into those sorts of details of why does it matter? And they don't have the tools in their, you know, toolbox to be able to make those sorts of expressions in the metrics. And so I'm really trying to come up with the like, yeah, counter MTTR or whatever. Like that's, that's great. That's, that's a good thing. But meantime to resolution is good. If you can also say like, we're very stable and we have, we have within this range, you know, over the last 10 months, we don't break out of the range very much. That means you're doing a good job. You have maturity, you have that capacity. So I think that all these metrics have value, but we just need to use them appropriately. And sorry, just one other thing on the metrics. I talk about metrics in three different bins of some sort of service level objective. So if I have a metric, I might potentially have an objective associated with that metric. And then service level objectives are presumed to be reported, but sometimes we report other metrics that don't have objectives. And then the third bin, the concept there is we don't report it at all. It's all just internal to us. And I would say it's probably like 5%, 10%, 85% in the breakdown of what those things should look like of like 5% of your metrics or service level objectives, you know, another 10% are reported metrics. And then the rest of it is just like, you have it, you can kind of make sense of it. And if someone asks you a question, you can open that up and show it. For somebody leading an organization, is there anything they can think about when they're trying to determine whether they're spending too little enough or potentially too much on cybersecurity operations? Yeah. And this is, this is what I'm trying to say in the book is like the, the loss prevention and the quantification that comes along with that helps you to do that. So I have sort of like this approach where I talk about some speculations and this is impact --- Page 6 --- quantification and loss prevention. And then I talk about just the, um, sort of the, the costs associated with our technologies and just sort of adding that up. The idea being that it's like, if I can, even if it's speculated, if I can say, here's the value that I'm providing, and then I can say, I'd like to buy this threat intelligence platform. And the threat intelligence platform costs me, I don't know, a hundred thousand dollars to, to buy in. And it's going to cost me 20 to implement it. And it's going to cost me another 10 per year for the next three years. So I'm asking for $150,000 and it's a low estimate, but I'm just making stuff up. Right. Yeah. Yeah. Yeah. That's, that's a cheap product right there. Exactly. So I just, it's easy math. I can do it in my head. So, so, so, so now I'm asking for $150,000 over the course of a few years. To be able to do this for what, what do I think is going to do for me? Well, I can quantify that actually, like that tip is going to save me 0.0000001 dollars for every item of threat intelligence that's in there because that enrichment saves my analyst some time and it provides greater value for the SIM detection by being able to leverage the data and have higher accuracy. So now I can, again, in a speculated way express, here's the real world cost. Here's my projection of what I think that that will, will provide. And I think a lot of people struggle with the, like, how do I ask for it? What, how can I justify that? And there's a lot of kind of just like, this is what we think it will provide. And I'm really trying to ground that back into the, you know, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the, the real term of the reason why I want the tip is multifold. It saves people time and it gives me data that's useful for detection. And it's maybe not the initial detection, but it's after the initial detection for the validation of that detection to be able to then move it forward. And that reduces false positives. And so I can show the real value to that because that means that I have a, you know, basically a leaner, a cue for my analyst to work for the things that are more important. So that's, that's how I'm trying to, to help people to express that. Am I spending too much or too little? And then maybe even where am I spending too much and where am I spending too little? So obviously we're in the, you know, the burgeoning era of AI, uh, automation has sort of been given an upgrade. Uh, what role should that play in a modern security operations program and in where does it work well and where's --- Page 7 --- in judgment still difficult to replace in your opinion? Yeah, that's, that's, uh, is this what the whole webcast is about? I mean, we can start. I know it's a hot topic. It is. It is. Well, it's also a big one because, um, so, okay, let me, let me think about how to organize it. So I don't like, um, okay. So my thinking on this is that the initial thing that everybody in cybersecurity should be doing with AI is polishing their communication. The easiest win right now is taking the information that you want to communicate and help, uh, helping yourself to this tool that will enhance the expression of that. Okay. So that's like number one, if you're not already doing that in some way, um, you should be doing it. And even for the people who are like, I can't send it out. It's like, okay, figure out how to set up, you know, an Alama instance on a, on a server someplace with, you know, a bunch of, uh, a bunch of Ram to the GPU. And I would, I would lean toward max for the Ram richness, you know, because of the unified memory stuff, but it doesn't matter if you want an NVIDIA card with 24 gig of Ram, or you can get something even better than that. I got a pretty beefy GPU on this thing and it works great for home inference stuff. Yeah. Yeah. Yeah. So it's like, okay. So then, then just do it, do it offline. Like you can just do it and it'll take longer, but who cares? It's like, just polish it and, and leverage that to polish it. So that's number one, um, the communications and that's, that's not just the, uh, not just the words, but also the visualizations. Um, the, the second thing that I think everybody should be doing inside of cybersecurity right now, um, is leveraging the tool, the GPT, you know, um, to be able to write the code, to do the little thing that you want done. And this is something that I think that, um, it's so easy to, uh, sort of absorb this as a helper, but here's where the human oversight comes in at the first place is I can say, write this PowerShell script. It's going to write a PowerShell script. These tools are going to find the most immediate and efficient path. And they're going to produce a PowerShell script that does the bare minimum of what you want. And what we need to realize is that this is the tool that we're working with. And so if you want something other than the bare minimum, now you need to be the adult in the room to be able to give it all the, uh, thoughtful instructions and then keep iterating over that and just don't let it go. You know, and it's, it's funny. I find myself sometimes just being like, all right, this will work. --- Page 8 --- I put on caps and I just like yell at it. And I just, I call that yellow mode. Yeah, yeah, yeah, exactly. So, and so, and so now, but the other thing that I found myself doing a lot on that regard, if I'm, if I'm writing code and I'm, I've been doing it manually and I know that you can just get clawed to kind of like do it, but I've been doing it manually and I've been doing it manually. I'm more interested in the observation of it is I give it exactly the code back again. And I say, update this code and then I'll put the code in an XML block below and I'll give it design specifications. And then every four or five prompts, I'll force it to reiterate all of the guidance that I had provided up to that point in terms of the objectives, the specifications, the criteria, the, you know, like reiterate the harness that you have of building the code. Now take that plus the enhancement. Plus the, the current state code and then give it to me again. And that has been really powerful for me. And I think that a lot of teams kind of struggle with the, this as a methodology and it's fairly straightforward. Once you embrace it, you just have to like embrace that. And then it becomes the, like, as a team, you should be sharing these sorts of insights. Yeah. It sounds like you're describing. What I've heard called a self-reflection loop where you're having the AI sort of re-analyze its code based on first assumptions. Over and over and over again. Yeah. Over and over and over again. And I, I do a lot of like AI to generate code with very minimal internal API calls back to different AI, you know, so whether you want to call it agentic or rag it to me, it's like, I know that there's a distinction there. Yeah. I know what the distinction is, but I kind of don't care when I'm like, okay, go over here and get me a thing. And whether you're getting me a thing from a resource where you're getting me a thing that's going to do a thing. Okay. You know, like, cause sometimes it's a, it's a blend of that. So that's a second thing that I think everybody should be doing is using it to write their code and then only selectively inserting the subsequent API calls back to the AI component, but it's primarily deterministic. And then one other thing about that, that I find extremely useful is getting it to log everything that it's doing so that when it does start to go off the rails, you have the intermediary data to be able to be like, okay, let me take an example. This is what you produced at the end of the script. It's not what I want. Here were the intermediary data elements that you stored. --- Page 9 --- This is where we started. This is where we ended up. This is what I don't like about where we ended up. Take these intermediary parts. And then tell me how we should resolve it. So that in this specific case, it's, it's going to do better. Okay. So that's it. Well, well, and it's also like, how, how would I learn what I want to do better on my scripts? I would, I would trace, you know, and I would do data tracing essentially. So I'm forcing the data tracing as part of the development. And ultimately, if, if I get to the point with stuff that I'm developing like this, that I'm going to go fast, all that can be ripped out, but it's really nice for the instrumentation during the development to be able to, to see the details of it. Right. Interesting. There's another thing. Sorry. Okay. One more. Yeah, no, let's keep going. I was going to change the stream. Yeah. I got, I got one more because I think that, I think that there's like the next thing that we do, which is real ML. Like I, you know, like at a certain point. Statistical analysis, ML, not guessing the next word, LM. Deep. Yeah. Yeah. Well, so yeah, not, not, you know, the generative pre-trained stuff, not a, not an, not an auto encoder. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Not something which those, you can build your own for that. But like the I'm, I'm, I'm sorry, linear regression. Yeah. So I'm thinking deep learning neural networks to do a very specific thing when you have data. And I said not an auto encoder, but I was actually thinking of an auto encoder, like an auto encoder is a great example of being able to use a, um, a technique from more traditional machine learning to provide a very sort of like a very sort of like constrained structure that says, here's the stuff that I know really well. And then I can use that for an anomaly detection or, or, you know, like I did a project recently for, for a customer where it was like, we got a thing, we're trying to train this up. And I did a little quick prototype, but the thing that I did that I thought was interesting, the prototype didn't work very well, but what I did that was interesting. And I was like, here's all the code to do this is I turned all of their confluence data into trainable data. And I was like, you know, like I, I was doing this for your prototype, but you now have all this other stuff that you could use for other things. And I've now written all this code for you on how you would do that. And I've troubleshot it. And I was like, you know, pulling, pulling this, pulling this in. And it was word-based, but still I'm like, this is a thing that I'm, --- Page 10 --- that I'm, that I'm, that I'm, that I'm, that I'm, that I'm, that I'm, that I'm, that I'm, I'm working with different you know engagements that I have and I'm trying to help people to see where they have a lot of data and that data is unique to them and then you can really look at that from the like the ML perspective like forget about having something that's a GPT forget about the you know the the multi-headed self-attention you know like all of this stuff with the the words and the tokens this is like potentially a gold mine and nobody knows how to use it but it's going to be so niche but that niche is going to give us detections you know so for like for you all as an example you know like you you then need to think about like what's your pipeline from a hunting to a detection engineering perspective and where are those going to be like oh you know we should do detection engineering for that because we have this mountain of data and we can basically just like run this thing for a long time. Yeah and the thing about that like there's a heavy lift at the front but the the cost of running that once it's built is orders of magnitude cheaper than trying to leverage these LLMs and stuff like that because it is so tuned to that data yeah. Yeah that's exactly right and I think that that's I think that that's out of reach for most organizations not because of economy but because they don't have that power to do that. Yeah. have the imagination and the strategic vision to get there um and and the other thing is with that lack of imagination strategic vision people are like now gonna come up with harebrained ideas that don't work really well they're not going to do it properly and then it's going to basically like spoil that effort when it would have worked in another context because the people who tried to do it first were like i'm going to use this tool to for completely the wrong purpose and so that's a danger a real danger yeah and i think if you look at the history of the sort of it or technology or software development industry you see that pattern repeat over and over i remember sort of doing contracting when sort of the app thing became a new thing and there was a lot of organizations who'd hired somebody to do something and it was delivered poorly and so they were they were scarred and they didn't want anything to do with it yeah they're just burned and it's it's unfortunate you know it's unfortunate but then also it's like if you do decide to go down this path and you have one really smart person on your team for a year who's super into it and they build it and then they walk away nobody else knows how to --- Page 11 --- maintain it now now it's like okay now we end up with a new a new wave of kind of a legacy thing that this is different problem this is you know so it's like there are all these potentials for making it work and and and and and and and and and and and and and and and and and and and and and making it wrong no matter which direction you go um yeah so find smart people pay them well and keep them that's what you're telling me that you know it's funny did you read my book already did you you know because i literally i actually i actually have a section on like people versus technology versus automation versus outsourcing really briefly but yeah that's it's an obvious thing you know what i mean it's like it's really an obvious thing the machines are self-tuning to a degree but only with the the the the the the the the the the the the the the the the the the the the like the initial scope of the self-tuning and once the thing really gets out of uh out of its you know trajectory it's going to have some pretty big problems and getting it back into the uh into the scale is professional services type engagement if you don't have smart people and those professional services engagements you know how long is it going to take even to contract it you know yeah when things aren't working right so what i was going to try and get to earlier was this this idea that attackers are also adopting ai i call it spawn camping the cbe list uh so you know we're seeing like days before we're having zero days exploited in the wild and now it's i think hours and i expect we'll eventually get to minutes you know does that change how organizations should think about you know measuring their defensive effectiveness and deploying ai as like a frontline sort of defensive mechanism yeah i don't think it changes how companies should be able to do that i don't think it changes how companies should be able to do that should think about their defenses i don't think it changes how they should think about it i do think it increases the urgency of getting it right you know like it doesn't really change the equation and my other thing about ai is my my concept of operations in the sock is that the sock is in a part of the organization with a responsibility among other things to deal with uncertainty like the sock is the thing that the weird stuff lands in that is part of its responsibility like that's that's if you're if you don't think your sock is that then it's probably not what i think a sock is right um so so that being said um and this is maybe like you know just let me qualify that a little bit if your sock is just --- Page 12 --- the monitoring slice of the overall cybersecurity operations yeah then you're not going to agree with me that that's where it lands because like that monitoring is the more routine i'm talking about the larger like cybersecurity operational concept of security operations sock um so so just in case that doesn't sit well with people i want to clarify that a little bit but if we're supposed to be dealing with uncertainty dealing with you know issues that arise i think that's a really important part of what we should always be doing operationally is ingesting new technology and to me ai number one isn't new technology but the the explosion in the last you know five years is is a big hit for us but we should be ready to just like be onboarding tools for ourselves and for the company and if your sock or your cyber operations at all aren't in a position to do that you're missing an important part of the technology that's going to be in the system and that's going to be an important capability yeah and i think we still we suffer a lot of like skeptical and for lack of a better word i'm going to say curmudgeons in this industry i've talked to some really talented smart teams who just had an experience early with llms and they said nope yeah and you know years later they're still holding that line and i'm like you know i'm in this thing every day and if you can see the leaps and bounds and you understand the curve of technology like this you can't ignore this like whether it upsets your worldview or not it's just something you need to accept yeah and and it's it literally is especially for curmudgeonly people it's just some math like it's it there's there's nothing others than some predictive output based on the input so it's like especially people who have a um an analytical mind if they investigated how it's working i think that they might arrive at like uh you know an embrace to the thing of like you know like you know like you know like you know like you know like you know like okay well this is actually how it works so let me just let me just think about it that way because it you know it really is just the the predictive outputs with some very clever engineering inside yeah it's augmentation not replacement like i still think like humans have a central piece in all of this it just like it's like putting on a mech suit you know it's amazing it's amazing and you know it's like i'm you know i think we were talking about this just a little bit i'm kind of like this solo or whatever you know made up word people use for that i don't have any employees uh you know it's like i i have a backlog of thousands of things that i would like to do so if i'm doing them a --- Page 13 --- lot faster now and well it's like i can i can write code but i never take the time to write the code off the top of my head and all the things that i knew needed to be written in code i just kind of like okay let me write the power shell for that or whatever and now it's just like give me the python that does this and then i'll look at it and i'll be like no you know like okay i that was a bad prompt on my part let's let's go again okay this might this might work let's try that you know but i'm doing stuff where like like my development path is jupyter lab notebooks lots of like you know sort of very rapid development sharing that with people seeing what they they use for it and i just was revisiting a deliverable with a different customer and i went and i had all these notebooks and i'm looking at it i'm like where the hell did this come from and i and i went and i was like this is weird because it's like i'm a very organized person in terms of my workspaces yeah and i'm like i got all and i went back and i was like i like i literally wrote this in like five minutes on gemini and totally forgot about it and basically it was like i was looking i was like this stuff is really good like you know like it was and i looked at the logs of it it was a super short conversation it gave me all the stuff that i wanted i dropped a presentation that i'd written six years ago in i said there are all these like there are all these specs inside of here for the stuff create that database in uh you know in a file and then generate all of these other things simulate all of these things give me this and then produce this and produce these and this and you know i was like man that's really good that's like that's what i would have written if i had three days but unlimited time and yeah yeah you know so now it's a lot of like so long as i can test it and review it it becomes it becomes pretty powerful and so i think this is where we're going i really do i think that this is where we're going in cyber security from a defensive perspective think about it not as like a a new burden or anything think of it as this is going to clear the queue of the backlog of technology deficit and if you have even just been tracking that uh then maybe you can get to the point where now you can even square off against your adversaries because yeah or go spend time with your kids and get a good night's sleep no yeah of course no no of course i you know it's like i i have been uh like a road --- Page 14 --- courier for the last 15 years i spend a lot of times on planes you know yeah i'm like you know my my um you know badge of i guess we'll call it honor is that you know i'm like you know basically the highest tier status on two airlines well what one thing i found that me and my business partner actually talked about recently that i think is really interesting is is like i find myself doing more deep thinking whereas in like there was just so much urgency in front of me i think i i had a really hard time slowing down and taking a step back and and i just find that i have more time to to think about more strategically over the longer term instead of just putting out fires in front of me so maybe that's the boon in all of this that we all get to get back to that deep thinking and this this is the point of what i was just about to say is it gives you space to rest because if it doesn't matter ai or not if you're not resting you're gonna you're gonna destroy yourself you just can't work in this space without figuring out what you individually need from an emotional release from a physical release you know for me one of the best things that i did in the last 10 years was i got a desk that shifts between standing and sitting same yeah and you know i have a treadmill under my desk so that i have a elliptical machine like you need movement you can't just sit there for 14 hours a day yeah so this becomes the the thing that people need to find that and if that's good night's sleep in your own bed you know spending time with your kids and like pushing it all the way you have to do that yeah you know you like genuinely have to do it and the thing about the deep thinking i think of the what was his name cal newport deep work guy cal newport mit or whatever um and and you know he has some really nice like thoughts on that and he's like i don't know i don't know i don't know but it's like the different techniques of make a time period where no phones no interruptions snap in and do uh the the other thing i actually do this quite a bit is that sort of like um journalistic thing where i'm just so under time pressure that i just have to produce and it's just like everything that i'm doing when i have a spare 20 30 minutes i'm basically producing something because i'm just like working it in and i'm just like i'm just like i'm just like i'm just like uh that's burnout space you know what i mean so it's like you have to be really careful about using that too much and then the last one that he mentions which i also do he calls it the like --- Page 15 --- monastic where you're just you can you can brew great beer if there's if there's no urgency right well so i get stuck in places sometimes where i'm like between work gigs and i have to go someplace i'll sit in a hotel for a week and i'll just work on a project you know and it's like that that is another thing that i have like given myself is i'm going to be in a cool place and i'm going to do this i just i finished the book when i was just in oaxaca mexico and i had like a vacation you know it's like i was there for a week to just like hang out and i had my coffee in the morning and then i finished writing you know which is a big lift so yeah i think that we all need to figure out what that's like for us so that we can keep doing all these things because the problems aren't going away the problems are accelerating as you've cited and we need to catch up yeah take care of the meat suit and uh go forward strategically okay so this is the last one i have for you it's the one i ask of everybody that comes onto the show it can be as wide or as narrow as you want do you have any predictions for the future of cyber security yeah i absolutely do no there's an article recently on what this is going to look like in security operations and so i'm going to talk about it from the skill set that's required for for people going forward and to me it's like this amalgamated architect programmer data science communicator like that is what people in cyber security are going to need to do and i think that The intention of our work is that. And then one other thing about that is I also see cybersecurity reconverging more into IT. And there's a lot more convergence and alignment with the empowerment of people who are doing IT engineering of the like, you can't skip the cyber or give that to us as our responsibility now. If it's not engineered that way from the beginning and we start having problems, we're just going to kill the project. You just can't have it anymore. It's just not reasonable to do the thing where you're pushing it out knowing that it's flawed. It's just non-tolerable. So I think that that becomes the reconvergence of cyber and IT. And the last two decades of big separation there basically melds that back in. Still having specialists. That's for cyber, but largely it's embedded. At an organizational level, they kind of become one and the same. Yeah, I totally agree with that. Yeah. There'll be less people, but better tuned to the new skills and requirements. Yeah. Yeah, I think so. Awesome, Chris. This was a really fun conversation. Likewise. I appreciate it. Yeah. Before we sign off, where's the best place for people to go get your book? --- Page 16 --- I'll put a link in the show notes, but just for them listening. The Montance shop. So it's just. Shop.montance.com. Okay. Awesome. That would be awesome.