Podcasts about FireEye

Karen is a genuine global leader in the cyber-legal space. She manages the relationship between Google Mandiant and its law firm and insurance partners. She has had a remarkable cyber career…think FireEye, Safeguard Cyber, Mandiant and now Google Mandiant! Karen and I caught up at the IAPP Global Conference in Washington D.C. and then again at the RSAC Conference in San Francisco. We recorded this session as some 50,000 cyber experts took over downtown San Francisco. If you want to know more about the interaction between law firms and cyber forensic firms, this podcast is for you. Karen shares her views on the current threat landscape, the role of the cyber-forensic expert, the remarkable rise of the Google Mandiant cyber team and successful engagement with law firms / legal teams. A proud Buffalonian and fierce advocate for women in cyber. This is cross-examining Karen Kukoda. Here we go…

ABOUT ANUSH ELANGOVANAnush Elangovan leads the Artificial Intelligence Group (AIG) as Corporate Vice President of AI software and solutions.Anush has 23 years of industry experience in AI, computer science, compilers, network security, operating systems, math, and its materialization on complex hardware systems. This co-founder and Chief Executive Officer of Nod.ai oversaw product strategy and the overall business until AMD acquired Nod.ai (see related article here) today.Anush will lead the acceleration of deploying AI solutions optimized for AMD products while aligning with AMD's AI growth strategy centered on an open software ecosystem. In the near term, he and his team will introduce the code generation (CodeGen) capabilities from the Nod.ai flagship software, Shark, to unlock customer engagements via the ROCm™ and Vitis™ AI platforms. Over time, Anush will lead the contributions of the Nod.ai team to the AMD Unified AI Stack.Before starting Nod.ai, Anush was instrumental in the graphics stack on the first ARM Chromebook. He led the movement of the Chrome operating system from Debian to Gentoo Linux to enable Google to gain full control of the shipping software. Previously, he was Principal Engineer for Agnilux, which Google acquired. The Agnilux team became crucial to the Chrome OS team, building a fusion of Android and Chrome OS.Previously, Anush was a technical lead at Cisco Systems in its Datacenter Group, creating the first distributed virtual switching platform. He has also been an early member of FireEye, where he led in-memory taint-check analysis for networking and security in virtualized environments. He started his career in an earlier stint at Cisco, contributing to metro Ethernet initiatives.Anush holds a Master of Science in computer science from Arizona State University and a Bachelor of Engineering in computer science from the Mepco Schlenk Engineering College at Madurai Kamaraj University in India. He has earned 10 patents. In his spare time, he enjoys skiing, mountaineering, and trail running. Anush lives with his family, including three children and two dogs, in the East Bay of the San Francisco Bay Area.This episode is brought to you by Side – delivering award-winning QA, localization, player support, and tech services for the world's leading games and technology brands.For over 30 years, Side has helped create unforgettable user experiences—from indies to AAA blockbusters like Silent Hill 2 and Baldur's Gate 3.Learn more about Side's global solutions at side.inc. SHOW NOTES:AMD's AI hardware + software strategy, explained (2:24)From startup founder to leading AI software at AMD (3:50)How AMD is unifying hardware through a shared AI stack (6:01)What the VP of AI Software @ AMD owns across software & customer enablement (7:17)AMD's daily standup and real-time prioritization rituals (10:32)Strategies for building a unified AI ecosystem from first principles (13:06)How to approach building for complex technical workflows (15:38)Navigating hardware ecosystem requirements & aligning AI software (17:48)Challenging legacy software assumptions & why AI requires a new mindset for software development (19:38)AMD's integration of community contributors into product cycles (21:21)AMD's approach to cultivating an open-source ecosystem & community experience (22:48)Open-source & AMD's ecosystem strategy: Building trust by building in public (26:57)How AMD collects and acts on user feedback fast within a community ecosystem (29:24)AI's impact on everyday human experiences (32:15)Rapid fire questions (34:50) This episode wouldn't have been possible without the help of our incredible production team:Patrick Gallagher - Producer & Co-HostJerry Li - Co-HostNoah Olberding - Associate Producer, Audio & Video Editor https://www.linkedin.com/in/noah-olberding/Dan Overheim - Audio Engineer, Dan's also an avid 3D printer - https://www.bnd3d.com/Ellie Coggins Angus - Copywriter, Check out her other work at https://elliecoggins.com/about/

SEASON: 5 EPISODE: 10Episode Overview:Welcome to another episode of Becoming Preferred, where we explore the latest strategies and tactics to help you level up your knowledge and improve your skills. Our guest is Scott McCrady, the CEO of SolCyber. With over 25 years of experience, Scott has been at the forefront of protecting people and businesses around the globe. In this episode, we'll delve into the misconceptions that small businesses, entrepreneurs, and business professionals have about cybersecurity, and discuss the impact of human behavior on cybersecurity breaches. Scott will also provide actionable advice on tackling ransomware threats and securing remote work environments. So, whether you are an entrepreneur, a business professional, or simply interested in learning more about cybersecurity and how to protect yourself, this episode is packed with valuable insights. Please join me for my conversation with Scott McCrady.Guest Bio: With 25 years of experience working in the networking, telecommunications, and information security space, Scott McCrady is currently serving as the CEO of SolCyber Managed Security Services. Scott has worked with large companies and start-ups, among them IBM and EDS, where he held Security Engineer and Team Leader positions (US and London).Previous to SolCyber, Scott built the Asia-Pacific-Japan business at Symantec; he ran the global Managed Security Service, and the Symantec and Accenture Joint Venture. Scott then transitioned to FireEye pre-IPO to create their global MSS and System Integrator, and traveled to Singapore to help build their APJ business. After a successful run with FireEye, Scott helped spin out SonicWall from Dell to private equity and reconstitute the business into a profitable, cash flow-positive entity.This experienced guest wants to tell start-up founders, IT Security Managers, CISOs, and other cyber risk management enthusiasts how cybersecurity is improving technology services. He simply wants to make our listeners' life easier, more successful, and safer!Resource Links:Website: https://solcyber.com/ Product Link: https://solcyber.com/security-journey/Insight Gold Timestamps:04:03 Cybersecurity has become a big business05:20 Over 50% of small businesses that get breached go out of business within 2 years after a breach05:54 What's the biggest mistake that they make when it comes to cybersecurity?07:21 What happens in cyber is everyone just sort of forgets about these layers of defense10:01 Two casinos, big casinos, in Vegas were breached13:21 T he technologies around cyber are really good13:27 The attackers generally tend to login, not break in15:43 W e used to call it the crunchy exterior with the soft gooey middle17:18 I s AI good for cybersecurity?19:54 Cyber insurance is a great thing to have, especially for small, medium businesses23:32 You can also go to third parties that have what we call vCISO, Virtual Chief Information Security Officers26:36 You can do it...Is it worth your time?30:21 The biggest problem we have right now...32:22 F or most organizations, it's probably a very good idea to use the Cloud36:53 W hat I tell everybody is, you've got to think about the vertical37:10 The thing that most companies should really think about is, what's your core vertical?39:06 Figure out what the basics are, or have somebody...

Podcast: PrOTect It All (LS 25 · TOP 10% what is this?)Episode: The Intersection of IT and OT: Highlights from S4 Conference with Jori VanAntwerpPub date: 2025-03-17Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationIn this episode, Aaron is joined by Jori VanAntwerp live from the s4 conference. Together, they unpack the intricacies of networking at industry events, the challenges and opportunities in OT cybersecurity, and the evolving technologies and strategies that are reshaping the field.  From the significance of understanding asset owner needs to the promising future of AI and blockchain in cybersecurity, Aaron and Jori cover it all. Whether you're a seasoned professional or new to the field, this episode is packed with insights that will keep you informed and ahead in the ever-evolving cybersecurity landscape.  So, tune in and get ready to explore the essential strategies for protecting it all. Key moments:  04:38 Asset Owner's Conference Dilemma 08:14 "Business at Speed of Trust" 10:45 Career Transition Acceptance 16:09 Limited Solution Compatibility Issues 18:41 Exploring Blockchain for Data Integration 20:47 Adapting to Imperfection with Technology 25:12 Dynamic Detection in Modern Substations 28:28 Rethinking Staffing for Power Utilities 31:45 Retiree Saves Power Plant Upgrade 35:37 Ford F-150 Taillights Theft Spike 39:08 Modular Redundancy in OT Security 42:20 "Advocating for Chipset Optimization" 45:32 "Call for Advanced PLC Monitoring Chip" 48:12 Complicated Security Measures Challenge Efficiency 49:28 Balancing Security and Operational Needs 52:57 IT Policy Disrupts Control Room Ops 56:43 Bridging OT and IT Teams About the guest :  For nearly two decades, Jori has enabled industrial and IT organizations to be successful in reducing risk, increasing compliance, and their overall security efforts. Jori has the ability to quickly evaluate situations and determine innovative solutions and possible pitfalls due to his diverse background in security, technology, partnering and client-facing experience. Approaching situations with intuitive insight and methodology, leveraging his deep understanding of business and technology, ranging from silicon to the cloud. He had the pleasure of working with such great companies as Gravwell, Dragos, CrowdStrike, FireEye, McAfee, and is now Founder and Chief Executive Officer at EmberOT, a cybersecurity startup focused on making security a reality. How to connect Jori :  Website : https://emberot.com/ Linkedin : https://www.linkedin.com/in/jvanantwerp/ Connect With Aaron Crow: Website: www.corvosec.com  LinkedIn: https://www.linkedin.com/in/aaronccrow   Learn more about PrOTect IT All: Email: info@protectitall.co  Website: https://protectitall.co/  X: https://twitter.com/protectitall  YouTube: https://www.youtube.com/@PrOTectITAll  FaceBook:  https://facebook.com/protectitallpodcast  To be a guest or suggest a guest/episode, please email us at info@protectitall.coThe podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

In this episode of The Gate 15 Interview, Andy Jabbour speaks with Allan Liska. Allan Liska, threat intelligence analyst at Recorded Future, has more than 20 years of experience in information security and has worked as both a security practitioner and an ethical hacker. Through his work at Symantec, iSIGHT Partners, FireEye, and Recorded Future, Allan has helped countless organisations improve their security posture using more effective intelligence. He is the author of “The Practice of Network Security, Building an Intelligence-Led Security Program”, “Securing NTP: A Quickstart Guide” and the co-author of “DNS Security: Defending the Domain Name System and Ransomware: Defending Against Digital Extortion.“, and “Ransomware: Understand. Prevent. Recover.” Learn more about Allan on LinkedIn.In the discussion Allan and Andy discuss: Allan's Background. Evolving Threats, mission creep and STDs (wait, what?) The ever-evolving threat of Ransomware and the value of collaboration Resilience: mental health, taking care of your people Roy Rogers, comic books and that's before we play Three Questions! The enduring and expensive threat of scams (#Take9!) Lots more!“Your data isn't going to be deleted.”Selected links: Recorded Future Green Archer

On this episode of The Cybersecurity Defenders Podcast, we explore MSSP partnerships and technology providers with Raffaele Mautone, CEO of Judy Security.Raffaele brings a strong background in IT, sales, and operations, with extensive experience in cybersecurity and IT shaping the foundation of Judy Security. He has a proven track record of leading teams through successful acquisitions, strategic planning, and large-scale program deployments.Throughout his career, he has worked with major companies like Duo, FireEye, McAfee, and Dell, focusing on marketing and sales strategies, business process improvements, and go-to-market programs.Judy Security delivers enterprise-grade cybersecurity tailored for SMBs and MSPs. Their AI-powered platform is affordable, intuitive, and designed to seamlessly integrate with MSP business models while addressing the unique security challenges of SMBs. With Judy Security, businesses can stay protected with advanced, easy-to-use cybersecurity solutions—because safeguarding data shouldn't be complicated.

Silent Push is revolutionizing threat intelligence by tracking threat actors' infrastructure setup before attacks occur. After selling his first cybersecurity company to FireEye and serving as VP of Products there, Ken Bagnall launched Silent Push to address fundamental gaps in how organizations detect and prevent cyber threats. The company has achieved remarkable traction, securing 50% of global Fortune 50 companies as customers within 18 months of launch. Topics Discussed: Evolution from traditional threat intelligence to proactive infrastructure monitoring Building a complex data collection and behavioral analytics platform Strategic focus on enterprise customers versus SMB market Leveraging research and expertise to drive brand awareness Balancing free community tools with enterprise sales motion Geographic expansion challenges and opportunities   GTM Lessons For B2B Founders:  Focus on markets that appreciate technical depth: Ken's first company struggled selling sophisticated email security through MSPs to SMBs who couldn't appreciate the technical value. After being acquired by FireEye, they discovered enterprise customers who deeply understood and valued their capabilities. This taught them to focus Silent Push exclusively on enterprise customers who can recognize and properly value technical innovation. "Shout loudly in a small room": Silent Push's early GTM strategy focused on penetrating tight-knit threat intelligence communities within industry verticals. By establishing themselves as experts in these concentrated groups and consistently sharing valuable insights, they built strong brand awareness among their exact target customers. The strategy proved highly effective, helping them land major enterprise accounts quickly. Build the right kind of community product: While many security companies struggle with free products, Silent Push succeeded by requiring user authentication, monitoring usage patterns to identify sophisticated users, and actively nurturing promising accounts. Ken emphasized that it's not purely product-led growth, but a "weird hybrid" approach tailored to their market position. Leverage research strategically: Rather than joining the "echo chamber" of threat research, Silent Push focuses on uncovering and publishing novel findings that demonstrate their unique capabilities. This approach not only builds credibility but creates content that can be monetized across multiple customer segments affected by the same threats. Take the right path to the CISO: Instead of pitching CISOs directly, Silent Push targets threat intelligence teams who can validate their technology hands-on and become strong internal champions. This circumvents initial skepticism about threat intelligence products at the CISO level by letting the technology prove itself first.

A three-tier showstopper cake may have beautiful pipework and neatly done icing, but if it's overbaked and dry on the inside, it's not a good cake.The same is true for marketing. If it has no message but it's beautiful, it's not good marketing. Focusing on substance over style is one of the many lessons we're taking from The Great British Baking Show in this episode.Together with the help of our special guest, VP of Corporate Marketing at Trellix, Sara Aiello, we talk about being brand classy, going for substance over style, and trusting your gut.About our guest, Sara AielloSara drives impactful brand and communication initiatives that inspire, inform, and elevate global businesses. At Trellix, she led the brand launch of Trellix from FireEye and McAfee Enterprise. Previously, as Head of Growth & Engagement for Amazon's large item business, she accelerated business growth and customer engagement. At BlackBerry, as Vice President of Field Marketing, Sara led global marketing and sales enablement teams, enhancing the company's technology recognition. During her tenure at Cisco, she spearheaded the security customer experience practice, significantly advancing customer adoption. She also led the successful marketing strategy for a billion-dollar service rebrand. As Director of the Executive Briefing Center for Cybersecurity at The Boeing Company, Sara's expertise in customer experience played a pivotal role in securing critical contracts.Sara holds a Master of International Business from Seattle University and a Bachelor of Science from Clarkson University.What B2B Companies Can Learn From The Great British Baking Show:Be brand classy. Create content that has integrity and stands proudly for your brand. Think about making something that's evergreen instead of trendy or reactive. Sara says, “You can never go wrong with being brand classy. Something that lives on, endures. Sometimes you'll want to take a quick hit at a competitor or something like that, but that's not going to age well. And so always be kind of brand classy in what you do.”Go for substance over style. Every so often in The Great British Baking Show, a contestant will create a beautiful confection that doesn't taste as good as it looks. That's when Paul Hollywood says, “Style over substance.” In content, you want to make something that has meaning while also being visually attractive. So always think about your message first before focusing on the beauty of it. Sara says, “You have to actually know what you want to say first before you start thinking about how beautiful or whimsical you want it to look.”Trust your gut. Tune in to what feels right and rings true to your brand. In The Great British Baking Show, contestants have to navigate the technical challenge often based on their gut alone, having to make a cake based on directions like, “Make a genoise sponge.” You may not always have all the information in marketing either, but Sara says, “Be comfortable with not having all your information.” Trust that your gut will lead you in the right direction.Quotes*”One thing we haven't hit on is the storytelling aspect. You really identify and make memories with the bakers and the way that the show tells their backstory. And so you feel really connected. And I think that marketers should remember the power of storytelling. A lot of times, we want to go into stats and figures, but that's really not going to engage our emotional side of our brain, which is what we need to be persuaded.”*”ROI, marketers love to talk about this. I think it really comes down to setting clear goals. A lot of times, especially when it comes on the brand side as opposed to the demand side of marketing, it isn't super easy to see and have metrics, so it's really important to set clear goals from the start. So then you can see if you're succeeding or not.”Time Stamps[0:55] Meet Sara Aiello, VP of Corporate Marketing at Trellix[1:00] B2B Marketing Lessons from The Great British Baking Show[5:10] Behind the Scenes of The Great British Baking Show[11:11] Relating The Great British Baking Show to Marketing[17:52] The Importance of Visuals and Positivity in Marketing[23:24] The Human Element in B2B Marketing[25:46] The Power of Storytelling in Marketing[34:25] Building the Trellix Brand[38:04] Engaging Content Strategies[46:35] Final Thoughts and Advice for Marketing LeadersLinksConnect with Sara on LinkedInLearn more about TrellixAbout Remarkable!Remarkable! is created by the team at Caspian Studios, the premier B2B Podcast-as-a-Service company. Caspian creates both nonfiction and fiction series for B2B companies. If you want a fiction series check out our new offering - The Business Thriller - Hollywood style storytelling for B2B. Learn more at CaspianStudios.com. In today's episode, you heard from Ian Faison (CEO of Caspian Studios) and Meredith Gooderham (Senior Producer). Remarkable was produced this week by Meredith Gooderham, mixed by Scott Goodrich, and our theme song is “Solomon” by FALAK. Create something remarkable. Rise above the noise.

In our seventh episode, Allison discusses sleepless AI with Jari Salomaa, Co-Founder and CEO of Valo, a San Francisco-based tech start-up that builds discovery, observability and remediation for Salesforce customers with its AI service. What if AI could streamline your Salesforce tasks 24/7, allowing you to focus on what truly matters? On today's episode, we join Jari, who explains how Valo is helping Salesforce administrators, architects, and developers take quick action using their AI tools, cutting down on time-consuming, repetitive tasks while bringing them better control over users and app connections. Along the journey today, we also venture into some pretty innovative business networking ideas, product development ploys, combatting common security issues, and embracing wellness tips, such as meeting in saunas, and plunging into the very cold waters of the San Francisco Bay. To learn more about how Valo is transforming Salesforce administration with AI, and the challenges and rewards of being a startup in this space, be sure to tune in! Key Points From This Episode: •    An introduction to Jari Salomaa, and his company Valo. •    How Valo is providing solutions for Salesforce administration using AI. •    Valo's Finnish roots and how it inspired their sauna events. •    The benefits of their week of wellness, physically and socially. •    How Valo supports day-to-day Salesforce administration tasks. •    Valo's approach to solving common Salesforce security issues. •    Leveraging customer feedback and AI to drive and manage product development. •    Jari's time at Salesforce and what inspired him to start Valo. •    What keeps Jari energized and his love of cold-water swimming. •    Our design partner shoutouts and incentives section. •    The type of organizations that Valo is looking to work with.   Jari Salomaa, Founder and CEO of Valo   Guest Biography:   Currently the CEO and Co-Founder of Valo.ai, a company that builds discovery, observability and remediation for Salesforce customers with its automated AI Admin service, Jari Salomaa combines his 20 years of product development experience with his passion for enterprise cloud services, trust and security in his new start-up based in San Francisco with its R&D based in Finland. Jari has led and built several successful products from the idea to general availability, mainly in the enterprise domain, including Nokia E-series mobile devices for business, FireEye threat detection solutions, Salesforce Shield, Salesforce Security Health Check, Event Monitoring, Transaction Security, Field Audit Trail, Big Objects as well as built and launched several ServiceNow platform features and capabilities such as Platform Encryption, Data Classification and Data Privacy, Instance Security Center, Adaptive Authentication and ServiceNow Vault. Tweetables:   “One of the great opportunities with AI is the level of consistency in configuration [and] taking action. Unlike a human who, unfortunately, can often make mistakes, [or be] uninformed, or [might not] know really what to do, AI can be a very powerful supervisor [and] sounding board.” — Jari Salomaa [0:14:01] “We have so many integrations and multiple levels of integrations [in today's supply chains] that it is easy to lose track. It's not about someone not employing good standards. It's the sheer scope and complexity, which is why you want AI in these situations.” — @allisonthought [0:28:57] “Ultimately, what really drives me is my passion for solving customer problems. And if we can find a way to help customers grow their business, save time, give time back, save cost, bring more effectiveness, boost their productivity, I feel that we're on the right track.” — Jari Salomaa [0:36:28]   “Not only do project managers have to build, they have to sell their innovation, as we mentino in my upcoming book. You could be having these customer dialogues and part of your brain is definitely thinking, “Can I build that? Can I work it into the product?” But the other part of your brain has to be thinking, “Will somebody pay for that? Will it really monetize itself? Is it worth the investment?”— @allisonthought [0:32:27]   Links Mentioned in Today's Episode: Jari Salomaa on LinkedIn Jari's company - Valo San Franscisco Sauna - Alchemy Springs Artisan chocolate - Chocolat Moderne AIlison's AI startup - Discerna Book - Power Up Product Management – Order Form Email Listener feedback to info@thoughtmarketing.com Allison J. Taylor on LinkedIn Allison J. Taylor on X  

Podcast: PrOTect It All (LS 24 · TOP 10% what is this?)Episode: Bridging IT and OT in Cybersecurity for Power Plants with Jori VanAntwerpPub date: 2024-10-28Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationIn Episode 29, host Aaron Crow is joined by cybersecurity expert Jori VanAntwerp to delve into Power Grid Security and Redundancy. This episode explores the segmented design of the US power grid, addressing the challenges and necessary upgrades to mitigate cyber vulnerabilities. Jori highlights security monitoring gaps, the impact of hardware updates, and the cost implications of modernizing infrastructure. The discussion also emphasizes the importance of asset inventory and collaborative efforts between IT and OT professionals. Real-world incidents, such as unexplained power plant reboots, illustrate the critical role of operator awareness and system maintenance. The potential of AI in cybersecurity, alongside the need for a collaborative, learning-focused approach, is also discussed. Tune in to gain expert insights on balancing modernization, cost, and operational efficiency to ensure the stability and security of our power infrastructure. Join us for a packed episode to learn how to "Protect It All." Key Moments:    05:30 Restoring power grids involves complex, staged processes. 11:01 Centralizing data improves efficiency, introduces vulnerabilities. 17:47 Network segmentation essential for security, mitigates risks. 26:12 Cybersecurity tools revealed crucial system issues. 32:15 Understanding systems fully prevents unintended negative impacts. 36:31 Understand OT environment before implementing IT solutions. 41:24 Equip must survive extreme heat, unlike typical data centers. 54:28 Strict access control in nuclear power plant. 57:48 Assess likely risks for protecting plant operations. 01:00:59 Rushed training weakens foundational cybersecurity skills.   About the guest :  For nearly two decades, Jori has enabled industrial and IT organizations to be successful in reducing risk, increasing compliance, and their overall security efforts. Jori has the ability to quickly evaluate situations and determine innovative solutions and possible pitfalls due to his diverse background in security, technology, partnering and client-facing experience. Approaching situations with intuitive insight and methodology, leveraging his deep understanding of business and technology, ranging from silicon to the cloud. He had the pleasure of working with such great companies as Gravwell, Dragos, CrowdStrike, FireEye, McAfee, and is now Founder and Chief Executive Officer at EmberOT, a cybersecurity startup focused on making security a reality. How to connect Jori :  Website : https://emberot.com/ Linkedin : https://www.linkedin.com/in/jvanantwerp/   Connect With Aaron Crow: Website: www.corvosec.com  LinkedIn: https://www.linkedin.com/in/aaronccrow   Learn more about PrOTect IT All: Email: info@protectitall.co  Website: https://protectitall.co/  X: https://twitter.com/protectitall  YouTube: https://www.youtube.com/@PrOTectITAll  FaceBook:  https://facebook.com/protectitallpodcast    To be a guest or suggest a guest/episode, please email us at info@protectitall.coThe podcast and artwork embedded on this page are from Aaron Crow, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Dave DeWalt, former CEO of FireEye and McAfee, is the founder and CEO of NightDragon. In this episode, he joins host Paul John Spaulding and Kris Lovejoy, Global Security and Resilience Practice Leader at Kyndryl, to discuss boardroom cybersecurity, including some of the most critical practices that c-suite leaders can't ignore. As the global leader in IT infrastructure services, Kyndryl advances the mission-critical technology systems the world depends on every day. Collaborating with a vast network of partners and thousands of customers worldwide, Kyndryl's team of highly skilled experts develops innovative solutions that empower enterprises to achieve their digital transformation goals. Learn more about our sponsor at https://kyndryl.com.

Cato Networks⁠, a Climb Channel Solutions vendor, is the leading Secure Access Service Edge provider in the world, having pioneered the cloud-native architecture which is improving online speeds and security while moving away from a reliance on data centres. The company recently announced that it had surpassed $200 million in ARR —doubling ARR in under two years.  This means they are the fastest company to reach this milestone since LinkedIn. Cato Networks recently attended a Climb Channel Solutions event in Dublin and I spoke to Mark Draper, EMEA Channel Cato Networks.  Mark talks about his background, SASE, the Cato cloud, Gartner and more. More about Mark Draper: Mark Draper is a seasoned professional with extensive experience in channel management across the EMEA and UK&I regions. Currently serving as Vice President of EMEA Channel at Cato Networks, previous positions include Director of EMEA Channel at Cato Networks, Sr Manager of EMEA Channel at Gigamon, and Sr Manager of UK&I Channel at Juniper Networks. Mark also held the role of Channel Lead for UK&I at FireEye, Inc. and was a Partner Account Manager at Juniper Networks, showcasing a strong background in channel strategy and partnership development.

In this edition of Snake Oilers we hear pitches from three security vendors: Sandfly Security: An agentless Linux security platform that actually sounds very cool Permiso: An identity security platform founded by ex FireEye folks Wiz: The cloud security giant is getting in on code security scanning You can watch this edition of Snake Oilers on YouTube here.

Oz is co-founder and CEO of Opsin, which provides access control capabilities to LLM outputs ensuring users only get appropriate outputs based on their access level. The company was founded earlier this year, but they have already seen strong customer and investor interest given they are aimed at a key roadblock in making gen AI more available within the enterprise. Before Opsin, Oz worked in product management at high profile technology and security companies for most of the last decade, including Fireeye and Abnormal (where he met his co-founder James). In the episode we discuss everything from the origin story to the technical challenges of applying access control to these outputs and how to maintain current records despite a constantly changing access landscape. Website Sponsor: VulnCheck

Send us a Text Message.Alex Lanstein, chief evangelist at StrikeReady (and former long-time FireEye engineer/product), provides insight on the recent CrowdStrike incident and its potential legal implications, as well as the impact of AI on cybersecurity. Alex emphasized the need for a new approach to patch management and the importance of assessing an organization's ability to detect and respond to breaches. He also discussed the prevalence of criminal actors on the dark web and the significance of internal source code in breach incidents.Alex shared his journey in cybersecurity, highlighting the evolution of the industry and changes in attack vectors. He emphasized the increasing liability faced by CISOs and the importance of deriving practical takeaways from major breaches. He also discussed the importance of visibility into edge devices and StrikeReady's role in addressing these challenges.

Welcome to the latest episode of The LoJo Show! On this episode, we have the honor of hosting Dave DeWalt, the CEO of NightDragon, a seasoned leader with an extensive career in tech and cybersecurity. From his beginnings at Pennsylvania to leading companies like McAfee and FireEye, Dave has been a pioneer in cybersecurity innovation. Key Takeaways: Cybersecurity Evolution Career Highlights: Dave built a significant company at McAfee and later became CEO of FireEye and Mandian. Founded NightDragon, named after a famous cyber attack, focusing on generational cybersecurity investments. NightDragon's Mission and Vision Mission: NightDragon's mission is "securing our world for tomorrow," focusing on investment and advisory in the security tech market. Aims to address the biggest risks and threats across five major domains: land, oceans, air, space, and digital. Cybersecurity Landscape Perfect Cyber Storm: The term describes the increasing attack surface, technological vulnerabilities, and the growing number of bad actors. The fusion of cyber with physical domains, AI, supply chain, and industrial sectors is creating a complex security environment. Leadership and Regulation Cyber Leadership: Cyber leaders must adapt to broader responsibilities, including physical and supply chain security. There is a need for more cybersecurity experts on corporate boards to address evolving threats. Regulatory Landscape: The diversity of global regulations presents challenges for uniform compliance. Emphasis on the importance of public-private partnerships in developing effective cybersecurity frameworks. AI and Quantum Technologies Security Concerns: Rapid AI development has outpaced security measures, creating significant risks. The need for visibility and control over AI usage within organizations is crucial to mitigate potential threats. Opportunities: AI and quantum technologies offer powerful tools for faster detection, response, and security automation. Space and Cybersecurity Space Risks: The exponential growth in satellite launches has introduced new vulnerabilities, including electronic warfare and GPS spoofing. The strategic importance of space assets and the need for robust security measures to protect them. Future Directions Innovation Hubs: Beyond the US and Israel, countries like India are emerging as new centers of cybersecurity innovation. Energy and Cybersecurity: The relationship between energy resources and cybersecurity, particularly in the context of AI and data centers, is becoming increasingly critical. About Our Guest: Dave DeWalt is the CEO of NightDragon, a cybersecurity investment and advisory firm. He has led major companies like McAfee and FireEye, and founded NightDragon to address generational cybersecurity challenges. Dave's extensive experience in the tech industry and his vision for a secure future make him a prominent figure in the cybersecurity community. Contact Info: Dave's LinkedIn NightDragon's Website The LoJo Show's Email: officiallojoshow@gmail.com Stay safe and stay secure!

As board directors head into their next round of quarterly meetings, there's one topic that should be on the agenda: cybersecurity. As a member of dozens of boards throughout his career, including multiple public companies, Dave DeWalt, Founder & Managing Director of NightDragon, and former CEO of FireEye and McAfee, offers 5 cybersecurity questions to ask at your next board meeting in a recent Forbes article. In this episode, host Paul John Spaulding is joined by Steve Morgan, Founder of Cybersecurity Ventures and Editor-in-Chief at Cybercrime Magazine, to discuss. The Cybercrime Magazine Update airs weekly and covers the latest news, interviews, podcasts, reports, videos, and special productions from Cybercrime Magazine, published by Cybersecurity Ventures. For more on cybersecurity, visit us at https://cybersecurityventures.com

Dave DeWalt is Founder, CEO, and Managing Director of NightDragon, an investment and advisory firm focused on growth and late-stage cybersecurity, safety, security, and privacy companies. Before NightDragon, Dave helped create more than $20 billion in shareholder value during his 15-plus years as President and CEO of Documentum, McAfee, and FireEye. That includes driving the most successful cybersecurity IPO ever in 2013 and leading the largest all-cash deal in technology history in 2010. Dave has also served on the US National Security Telecommunications Advisory Council for the past four US administrations to advise on national security related to telecommunications systems. This podcast covers: working with National Security Council and Homeland Security, the recent history of cyber attacks on the US, cognitive warfare and disinformation, and much more.    Follow us here for more amazing insights: https://macrohive.com/home-prime/ https://twitter.com/Macro_Hive https://www.linkedin.com/company/macro-hive

As holiday travel ramps up, Southwest Airlines is landed with a $140 million fine for last holiday season's travel meltdown. U.S. Transportation Secretary Pete Buttigieg emphasizes airline obligations to passengers, as well as the infrastructure needed to protect American consumers and travelers. Companies must now disclose cyberattacks in a timely manner, in compliance with new rules from the SEC. Former CEO of FireEye and current Mandiant CEO Kevin Mandia explains the implications of this new rule for shareholders and corporations. Plus, the world's fourth largest steel producer, Japan's Nippon Steel, is buying US Steel for $14.9 billion. CNBC's Courtney Reagan reports on the strength of beauty this holiday season, as the total addressable market for the sector expands in age and gender identity. Courtney Reagan - 6:49Phil Lebeau - 13:10Pete Buttigieg - 20:03Kevin Mandia - 28:36 In this episode:Pete Buttigieg, @SecretaryPeteCourtney Reagan, @courtreaganPhil Lebeau, @LebeaucarnewsJoe Kernen, @JoeSquawkBecky Quick, @BeckyQuickKatie Kramer, @Kramer_Katie

Do you ever wonder what the intersection of biotech and geopolitics looks like? This episode ventures into the realm of genetic testing and the geopolitical implications of a lab gifted by China to Serbia. FireEye, a state-of-the-art lab, stands at the precipice of pushing the boundaries of what we know about viruses and human genomes. As this technology extends its reach across four continents, the consequences could be monumental, ranging from bio weapons, mass surveillance, to harvesting global genetic data. Strap yourselves in for this fascinating discussion on the possible repercussions of this development.As we navigate the profound complexities of biotechnology, we shed light on the ethical dilemmas arising from the analysis of genetic data. The rapid progress in biotechnology, accelerated by the COVID-19 pandemic, has flung open a Pandora's box of potential misuses and global geopolitical impact. We also venture into the realm of a potential hierarchical society where the affluent gain ascendance through genetic modifications. Switching lanes, we steer towards the world of electric vehicles, specifically into the impact of supercharging on EV batteries. We'll tread into the territory of battery degradation, advancements in technology to maximize battery life, and the different types of EV chargers. With the looming presence of giant oil companies like ExxonMobil and their potential push for alternative fuels, we dissect the trials and triumphs waiting in the future of EVs. So tune in, as we discourse on the electrifying journey of the future of mobility.Support the showLet's get into it!Follow us!Email us: TheCatchupCast@Gmail.com

After nearly a decade, Instacart investors are finally getting their exit. Reddit co-founder and 776 founder Alexis Ohanian was one of Instacart's early investors, and he explains the headwinds and tailwinds facing the business on the day of its long-awaited IPO. In the wake of cyber breaches at Clorox, MGM, and Caesars, cybersecurity CEO Kevin Mandia explains the network of cybercriminals targeting corporations and the cyber defense strategies that will thwart attackers. Mandia led FireEye and is now CEO of Mandiant, a cyber threat intelligence subsidiary of Google. Plus, Elon Musk might start charging users to post on X, and UAW strikers continue their push against US automakers.  Leslie Picker - 13:28Alexis Ohanian - 19:33Kevin Mandia - 31:04 In this episode:Alexis Ohanian, @alexisohanianKevin Mandia, @MandiantLeslie Picker, @LesliePickerAndrew Ross Sorkin, @andrewrsorkinJoe Kernen, @JoeSquawkBecky Quick, @BeckyQuickKatie Kramer, @Kramer_Katie

In this episode of The Cybersecurity Defenders Podcast, we recount some hacker history, and with the help of John Bambenek, tell the story of one of the largest and most complicated supply chain attacks in history: SolarWinds On December 13, 2020, The Washington Post reported that multiple government agencies were breached through SolarWinds's Orion software.Victims of this attack include the cybersecurity firm FireEye, the US Treasury Department, the US Department of Commerce's National Telecommunications and Information Administration, as well as the US Department of Homeland Security.Prominent international SolarWinds customers investigating whether they were impacted include the North Atlantic Treaty Organization (NATO), the European Parliament, UK Government Communications Headquarters, the UK Ministry of Defence, the UK National Health Service (NHS), the UK Home Office, and AstraZeneca. FireEye reported the hackers inserted "malicious code into legitimate software updates for the Orion software that allow an attacker remote access into the victim's environment" and that they have found "indications of compromise dating back to the spring of 2020". FireEye named the malware SUNBURST. Microsoft called it Solorigate.The attack used a backdoor in a SolarWinds library; when an update to SolarWinds occurred, the malicious attack would go unnoticed due to the trusted certificate.The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

In this week's episode we welcome cybersecurity sales leader Robert Freeman as we talk about sales, revenue growth and leadership in a hypergrowth cybersecurity startup. KEY TAKEAWAYS FROM THIS EPISODE Effective leadership involves uniting and motivating individuals towards a shared goal, understanding their motivations, and fostering good communication and positive culture. Leaders in startup environments need to be resourceful, adaptable, and able to wear multiple hats to navigate challenges and accommodate customer requests. Hiring individuals with startup experience is crucial, as they bring valuable skills and independence to thrive in a less structured environment. Identifying gaps and taking initiative to develop ideas or programs are key traits in startup leaders, who must constantly innovate and seize opportunities. The interview process for hiring salespeople is challenging, requiring a balance of assessing qualities like energy, enthusiasm, resilience, and adaptability to succeed in a demanding sales career. Robert Freeman Senior VP of Worldwide Sales at SafeBreach, is a highly experienced and results-oriented IT sales management professional. With over 20 years of expertise in managing high-growth environments, Robert has made significant contributions to renowned global vendors like Cisco, Imperva, and FireEye, as well as startups including Distil Networks and his current role at SafeBreach. Having graduated from the University of Massachusetts, Robert is responsible for scaling SafeBreach globally, leveraging his extensive sales and leadership career. His profound knowledge in cybersecurity and commitment to innovative solutions make him a valuable asset in the industry. YOUR HOST Simon Lader is the host of The Conference Room, Co-Founder of global executive search firm Salisi Human Capital, and podcast growth consultancy Viva Podcasts. Since 1997, Simon has helped cybersecurity vendors to build highly effective teams, and since 2022 he has helped people make money from podcasting. Get to know more about Simon at: Website: https://simonlader.com/ Make Money from Podcasting: https://www.vivapodcasts.com/podcastpowerups Twitter: https://twitter.com/simonlader LinkedIn: https://www.linkedin.com/in/headhuntersimonlader The Conference Room is available on Spotify, Apple Podcasts, Amazon Music, iHeartRadio and everywhere else you listen to podcasts! #RobertFreeman #CybersecuritySalesManagement #SafeBreach #Cybersecurity #ResultsOriented #GlobalExpansion #SalesLeadership #HighGrowthEnvironments #UniversityofMassachusetts #TechnologyExpertise #Startups #EmergingTechnologies #ScalingOperations #InnovativeSolutions #CybersecurityIndustry

Steve Stone, Head of Rubrik Zero Labs, is joined by Sandra Joyce, VP of Mandiant Intelligence at Google Cloud, to discuss leading mission-driven teams through periods of burnout, the gaps private sector cybersecurity teams experience in partnering with the public sector, information sharing on cyberattacks, and more. About Sandra Joyce: Sandra Joyce is a cybersecurity leader and has been head of Mandiant Intelligence since 2017. She oversees threat research activities and operations of the Mandiant Intelligence organization and joined Google in 2022, following Google's acquisition of Mandiant. Joyce is a highly accomplished and respected cybersecurity professional with over 20 years of experience in the field. She has held senior leadership positions at Mandiant, FireEye, and the U.S. Air Force. Joyce is also a member of the Aspen Institute Cybersecurity Working Group, sits on the strategic council of the  Silverado Policy Accelerator, and is a member of the Institute for Security and Technology's Ransomware Task Force Steering Committee. She is regularly featured in international print and broadcast media including CNN, NBC, Bloomberg, BBC World, Today Show, NPR, Wall Street Journal, Deutsche Welle, and others. What you'll learn in this episode: How to lead mission-driven teams through periods of burnout The challenges of partnering between the private and public sectors in cybersecurity The importance of information sharing in the fight against cyberattacks And more! If you're interested in learning more about how to lead a cybersecurity organization through burnout, the gaps between the private and public sectors in cybersecurity, and the importance of information sharing, this episode is a must-listen. Call to action: Subscribe to the podcast to stay up-to-date on the latest cybersecurity trends and insights. Gain more valuable insights on the hard truths of data security here: https://rbrk.co/3zEz3sY Keywords: data security, cybersecurity, ransomware, cyber attack, malware, cybercrime, zero trust, cyber resilience, CISA, cyber threat intelligence, information security, burnout, public-private partnerships

Scott McCrady is the CEO of SolCyber a provider of cybersecurity as a service. Scott talks about the role that a managed security service provider(MSSP) plays in the overall strategy for securing data and infrastructure and explains why SolCyber is primarily focused on serving the start-up and small-medium enterprise (SME) market. He also details the critical ingredients that comprise an effective MSSP offering. Prior to SolCyber, Scott built the Asia-Pacific-Japan (APJ) business at Symantec where he ran the global Managed Security Service, and the Symantec and Accenture Joint Venture. He then transitioned to FireEye pre-IPO to create their global MSS business and led the development of the APJ market. SolCyber https://solcyber.com/ The Secure Talk Cybersecurity Podcast https://securetalkpodcast.com/

Dmitry Korkin, a senior researcher at the security firm FireEye, talks about the dangers of branle, a new form of cyber-espionage pioneered by the Russian government.

With 25 years of experience working in the networking, telecommunications, and information security space, Scott is currently serving as the CEO of SolCyber Managed Security Services. Scott has worked with large companies and start-ups, among them IBM and EDS, where he held Security Engineer and Team Leader positions (US and London). Previous to SolCyber, McCrady built the Asia-Pacific-Japan business at Symantec; he ran the global Managed Security Service, and the Symantec and Accenture Joint Venture. He then transitioned to FireEye pre-IPO to create their global MSS and System Integrator, and traveled to Singapore to help build their APJ business. After a successful run with FireEye, Scott helped spin out SonicWall from Dell to private equity and reconstitute the business into a profitable, cash flow-positive entity. For more information visit https://solcyber.com/. At Tech & Main, we want to be YOUR technology partner. Let our 20+ years of expertise help you achieve the outcomes that are best for your business: cybersecurity, cloud, SD-WAN and data center. We have engineers and project managers available to assist you. Call our office at 678-575-8515, email us at info@techandmain.com or visit us at www.techandmain.com. Thanks for listening! --- Send in a voice message: https://anchor.fm/techandmain/message

Jason Martin is the Co-Founder / Co-CEO at Permiso. Before that, he was the EVP of Product at Fireeye.

#SecurityConfidential #DarkRhinoSecurity Brian is the Vice President of Worldwide Channels and Alliances at DTEX Systems. Brian has extensive experience in MSSP, Channel, Strategic Alliances, and OEM for high-growth security solution providers. Brian has a long history with cybersecurity OEMs starting with CA where I first met him. Brian has been with McAfee, Fireeye, Cylance, Stellar Cyber, and is now with DTEX Systems. 00:00 Introduction 01:18 Technology trends 02:30 Is the industry overcrowded? 05:49 DTEX: who are they and what do they do? 08:45 Compromised Machines 9:26 Endpoint detection 13:48 Where is DTEX Classified? 15:32 Managing Vulnerabilities on the endpoint 18:19 Working with Sectors 20:39 Customer Profile: How small is too small? 24:05 DTEX Cloud 25:23 Trends with Investors 28:00 Remote work: Can you trust your employees? 30:00 Remote work: Fake Linkedin Profiles 33:53 More about Brian ---------------------------------------------------------- Boise States Cyber Dome Program: https://www.boisestate.edu/news/2022/10/12/welcome-to-the-cyberdome/ https://www.boisestate.edu/cybersecurity/ To learn more about Brian visit https://www.linkedin.com/in/brian-stoner-146a56/ To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com ------------------------------------------------------------- SOCIAL MEDIA: Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio! Instagram: @securityconfidential and @OfficialDarkRhinoSecurity Facebook: @Dark-Rhino-Security-Inc Twitter: @darkrhinosec LinkedIn: @dark-rhino-security Youtube: @Dark Rhino Security ​

Shahin Hoda talks with Theo Nasser, Chief Executive Officer at Right-Hand Cybersecurity about how Right-Hand built its customer acquisition channel and managed to land large enterprise customers as a new startup.  Theo is the CEO and Co-Founder of Right-Hand Cybersecurity. Right-Hand provides a modern and interactive security awareness platform to help organisations quantify and reduce their employee cyber risk, build cyber culture and meet compliance standards. Prior to founding Right-Hand, Theo was a Sales Leader at FireEye and SonicWall, helping them expand their businesses across Asia-Pacific into Singapore, Australia, and Japan.   _________________ Download your copy of the State of ABM in APAC Report (2022): https://abm.xgrowth.com.au/report/ Miss out on our latest webinar? Listen here: https://xgrowth.com.au/blogs/programmatic-abm/ Join the Slack channel: https://growthcolony.org/slack Hosted & Produced by Shahin Hoda, Allysa Maywald & Alexander Hipwell from xGrowth We would love to get your questions, ideas and feedback about Growth Colony, email podcast@xgrowth.com.au

In this week's episode Dr. Crane talks to Tim Brown, the CISO of SolarWinds about the Sunburst malware intrusion, how it affected him and his company, the changes he made, and how Tim stayed on as CISO after the intrusion. SolarWinds shot to national prominence due to the Sunburst malware intrusion, first discovered by FireEye in 2020. This incident resulted in the first stand-up of a cyber unified coordination group, with the Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and the Office of the Director of National Intelligence, to coordinate a whole of government response to this incident. The Atlantic council said that Sunburst was a significant moment for cloud computing security and the attack raised concerns about the existing threat model that major cloud service providers use. Now imagine being the cybersecurity leader at the organization identified in this intrusion that affected thousands of customers. That was the situation Tim found himself in, in late 2020. He joins me here today to share his experience and wisdom in dealing with one of the most significant cybersecurity incidents in recent memory. In this episode: 00:00 — Highlight Clip 02:07 — Introductions 02:54 — Sunburst Incident Overview 05:55 — Difficulties Of Handling An Incident During The Holidays 07:05 — How Tim Stayed As CISO 09:06 — Pivoting From Internal To External Facing CISO 11:16 — Organization Reporting Obligations 12:58 — Finding Help For A Large Incident 14:16 — Reaching Out To National Defenders 15:56 — Cooperating With CISA For Messaging 16:47 — Lessons And Improvements Going Forward 18:58 — Validating A Digital Supply Chain 20:55 — Assume Breach Before And After 21:24 — Sign Off Tim Brown: Orange Matter — https://orangematter.solarwinds.com/author/tim-brown/ LinkedIn — https://www.linkedin.com/in/tim-brown-93639a1/ Links in this episode: SolarWinds RSA Presentation — https://www.youtube.com/watch?v=7DHb1gzF5o4 Thanks To Our Sponsors: Heinz College CISO Certificate — https://www.heinz.cmu.edu/programs/executive-education/chief-information-security-officer-certificate CISOWise vCISO — https://www.cisowise.com/ Heinz College: https://www.facebook.com/heinzcollege https://www.linkedin.com/school/carnegie-mellon-university---h.-john-heinz-iii-college/ Carnegie Mellon: https://www.linkedin.com/school/carnegie-mellon-university https://www.facebook.com/carnegiemellonu Follow CISOWise on all podcast apps. Website — https://www.cisowise.com/podcast Show Notes & Transcript — https://www.cisowise.com/podcast/001-tim-brown-on-sunburst

Watch This Interview Live: Click Here Karim has been at the forefront of attacker counterintelligence and infiltration research for the last decade, developing new ways for security teams to clandestinely monitor hackers and anticipate attacks before they happen. Prior to launching Prevailion, Karim was the founder/CEO of Unveillance, an early pioneer in advanced threat intelligence and the first cloud-based data leak intelligence platform. Karim successfully exited Unveillance in 2012 with an acquisition by Mandiant, and he was then appointed as Mandiant's new director of intelligence. While at Mandiant, Karim played an important role in that company's well-known APT1 report released in 2013, which definitively linked the People's Liberation Army of China to widespread cyber espionage activity against US interests. Mandiant was acquired by FireEye soon after. Over the years, Karim has served as a cybersecurity industry source for many prominent news outlets, including CNN, Fox News, Washington Post, The New York Times, Forbes, CyberScoop and many more. Before devoting his work full-time to defense and intelligence product development, Karim served as founder at Demiurge Consulting, a counterintelligence and countermeasure consultancy whose clients and collaborations included Coca-Cola, TSYS, Baker Botts LLP, McKesson, Palantir, MIT, Berkeley and Stanford Universities. Do you or someone you love Not lasting as long as they should in the bedroom?

People are good at two things – judgement and relationships. Everything else is largely automatable. When it comes to building software, product managers should really focus on giving people the opportunity to utilize those skills. That's what Matt Peters really believes in and shares in this podcast with us. Through creative customer interviews, experimentation, team empowerment and good UX, Matt has transformed many organizations in 25 years, including FireEye and Expel.  Time Stamped Show NotesGetting into product [01:00]Operational metrics [05:00]Making your team feel safe to experiment [08:04]Hiring for product teams [12:43]Identifying your team's superpowers and super weaknesses [14:55]Supporting your team's career growth [16:54]People enabled by products [22:45]Understanding your customers' workflows [25:39]Investing in good UX [27:03]Unboxing your own product [27:44]Advice for aspiring product leaders [29:30]  Product Chats is brought to you by Canny. Over 1,000 teams trust Canny to help them build better products. Capture, organize, and analyze product feedback in one place to inform your product decisions.Get your free Canny account today. Stay Connected!TwitterFacebookLinkedIn

About AnaïsAnaïs is a Developer Advocate at Aqua Security, where she contributes to Aqua's cloud native open source projects. When she is not advocating DevOps best practices, she runs her own YouTube Channel centered around cloud native technologies. Before joining Aqua, Anais worked as SRE at Civo, a cloud native service provider, where she helped enhance the infrastructure for hundreds of tenant clusters. As CNCF ambassador of the year 2021, her passion lies in making tools and platforms more accessible to developers and community members.Links Referenced: Aqua Security: https://www.aquasec.com/ Aqua Open Source YouTube channel: https://www.youtube.com/c/AquaSecurityOpenSource Personal blog: https://anaisurl.com TranscriptAnnouncer: Hello, and welcome to Screaming in the Cloud with your host, Chief Cloud Economist at The Duckbill Group, Corey Quinn. This weekly show features conversations with people doing interesting work in the world of cloud, thoughtful commentary on the state of the technical world, and ridiculous titles for which Corey refuses to apologize. This is Screaming in the Cloud.Corey: This episode is sponsored in part by our friends at AWS AppConfig. Engineers love to solve, and occasionally create, problems. But not when it's an on-call fire-drill at 4 in the morning. Software problems should drive innovation and collaboration, NOT stress, and sleeplessness, and threats of violence. That's why so many developers are realizing the value of AWS AppConfig Feature Flags. Feature Flags let developers push code to production, but hide that that feature from customers so that the developers can release their feature when it's ready. This practice allows for safe, fast, and convenient software development. You can seamlessly incorporate AppConfig Feature Flags into your AWS or cloud environment and ship your Features with excitement, not trepidation and fear. To get started, go to snark.cloud/appconfig That's snark.cloud/appconfig.Corey: This episode is sponsored in part by Honeycomb. When production is running slow, it's hard to know where problems originate. Is it your application code, users, or the underlying systems? I've got five bucks on DNS, personally. Why scroll through endless dashboards while dealing with alert floods, going from tool to tool to tool that you employ, guessing at which puzzle pieces matter? Context switching and tool sprawl are slowly killing both your team and your business. You should care more about one of those than the other; which one is up to you. Drop the separate pillars and enter a world of getting one unified understanding of the one thing driving your business: production. With Honeycomb, you guess less and know more. Try it for free at honeycomb.io/screaminginthecloud. Observability: it's more than just hipster monitoring.Corey: Welcome to Screaming in the Cloud. I'm Corey Quinn. Every once in a while, when I start trying to find guests to chat with me and basically suffer my various slings and arrows on this show, I encounter something that I've never really had the opportunity to explore further. And today's guest leads me in just such a direction. Anaïs is an open-source developer advocate at Aqua Security, and when I was asking her whether or not she wanted to talk about various topics, one of the first thing she said was, “Don't ask me much about AWS because I've never used it,” which, oh my God. Anaïs, thank you for joining me. You must be so very happy never to have dealt with the morass of AWS.Anaïs: [laugh]. Yes, I'm trying my best to stay away from it. [laugh].Corey: Back when I got into the cloud space, for lack of a better term, AWS was sort of really the only game in town unless you wanted to start really squinting hard at what you define cloud as. I mean yes, I could have gone into Salesforce or something, but I was already sad and angry all the time. These days, you can very much go all in-on cloud. In fact, you were a CNCF ambassador, if I'm not mistaken. So, you absolutely are in the infrastructure cloud space, but you haven't dealt with AWS. That is just an interesting path. Have you found others who have gone down that same road, or are you sort of the first of a new breed?Anaïs: I think to find others who are in a similar position or have a similar experience, as you do, you first have to talk about your experience, and this is the first time, or maybe the second, that I'm openly [laugh] saying it on something that will be posted live, like, to the internet. Before I, like, I tried to stay away from mentioning it at all, do the best that I can because I'm at this point where I'm so far into my cloud-native Kubernetes journey that I feel like I should have had to deal with AWS by now, and I just didn't. And I'm doing my best and I'm very successful in avoiding it. [laugh]. So, that's where I am. Yeah.Corey: We're sort of on opposite sides of a particular fence because I spend entirely too much time being angry at AWS, but I've never really touched Kubernetes and anger. I mean, I see it in a lot of my customer accounts and I get annoyed at its data transfer bills and other things that it causes in an economic sense, but as far as the care and feeding of a production cluster, back in my SRE days, I had very old-school architectures. It's, “Oh, this is an ancient system, just like grandma used to make,” where we had the entire web tier, then a job applic—or application server tier, and then a database at the end, and everyone knew where everything was. And then containers came out of nowhere, and it seemed like okay, this solves a bunch of problems and introduces a whole bunch more. How do I orchestrate them? How do I ensure that they're healthy?And then ah, Kubernetes was the answer. And for a while, it seemed like no matter what the problem was, Kubernetes was going to be the answer because people were evangelizing it pretty hard. And now I see it almost everywhere that I turn. What's your journey been like? How did you get into the weeds of, “You know what I want to do when I grow up? That's right. I want to work on container orchestration systems.” I have a five-year-old. She has never once said that because I don't abuse my children by making them learn how clouds work. How did you wind up doing what you do?Anaïs: It's funny that you mention that. So, I'm actually of the generation of engineers who doesn't know anything else but Kubernetes. So, when you mentioned that you used to use something before, I don't really know what that looks like. I know that you can still deploy systems without Kubernetes, but I have no idea how. My journey into the cloud-native space started out of frustration from the previous industry that I was working at.So, I was working for several years as developer advocate in the open-source blockchain cryptocurrency space and it's highly similar to all of the cliches that you hear online and across the news. And out of this frustration, [laugh] I was looking at alternatives. One of them was either going into game development, into the gaming industry, or the cloud-native space and infrastructure development and deployment. And yeah, that's where I ended up. So, at the end of 2020, I joined a startup in the cloud-native space and started my social media journey.Corey: One of the things that I found that Kubernetes solved for—and to be clear, Kubernetes really came into its own after I was doing a lot more advisory work and a lot more consulting style activity rather than running my own environments, but there's an entire universe of problems that the modern day engineer never has to think about due to, partially cloud and also Kubernetes as well, which is the idea of hardware or node failure. I've had middle of the night driving across Los Angeles in a panic getting to the data center because the disk array on the primary database had degraded because the drive failed. That doesn't happen anymore. And clouds have mostly solved that. It's okay, drives fail, but yeah, that's the problem for some people who live in Virginia or Oregon. I don't have to think about it myself.But you do have to worry about instances failing; what if the primary database instance dies? Well, when everything lives in a container then that container gets moved around in the stateless way between things, well great, you really only have to care instead about okay, what if all of my instances die? Or, what if my code is really crappy? To which my question is generally, what do you mean, ‘if?' All of us write crappy code.That's the nature of the universe. We open-source only the small subset that we are not actively humiliated by, which is, in a lot of ways, what you're focusing on now, over at Aqua Sec, you are an advocate for open-source. One of the most notable projects that come out of that is Trivy, if I'm pronouncing that correctly.Anaïs: Yeah, that's correct. Yeah. So, Trivy is our main open-source project. It's an all-in-one cloud-native security scanner. And it's actually—it's focused on misconfiguration issues, so it can help you to build more robust infrastructure definitions and configurations.So ideally, a lot of the things that you just mentioned won't happen, but it obviously, highly depends on so many different factors in the cloud-native space. But definitely misconfigurations of one of those areas that can easily go wrong. And also, not just that you have data might cease to exist, but the worst thing or, like, as bad might be that it's completely exposed online. And they are databases of different exposures where you can see all the kinds of data of information from just health data to dating apps, just being online available because the IP address is not protected, right? Things like that. [laugh].Corey: We all get those emails that start with, “Your security is very important to us,” and I know just based on that opening to an email, that the rest of that email is going to explain how security was not very important to you folks. And it's the apology, “Oops, we have messed up,” email. Now, the whole world of automated security scanners is… well, it's crowded. There are a number of different services out there that the cloud providers themselves offer a bunch of these, a whole bunch of scareware vendors at the security conferences do as well. Taking a quick glance at Trivy, one of the problems I see with it, from a cloud provider perspective, is that I see nothing that it does that winds up costing extra money on your cloud bill that you then have to pay to the cloud provider, so maybe they'll put a pull request in for that one of these days. But my sarcasm aside, what is it that differentiates Trivy from a bunch of other offerings in various spaces?Anaïs: So, there are multiple factors. If we're looking from an enterprise perspective, you could be using one of the in-house scanners from any of the cloud providers available, depending which you're using. The thing is, they are not generally going to be the ones who have a dedicated research team that provides the updates based on the vulnerabilities they find across the space. So, with an open-source security scanner or from a dedicated company, you will likely have more up-to-date information in your scans. Also, lots of different companies, they're using Trivy under the hood ultimately, or for their own scans.I can link a few where you can also find them in a Trivy repository. But ultimately, a lot of companies rely on Trivy and other open-source security scanners under the hood because they are from dedicated companies. Now, the other part to Trivy and why you might want to consider using Trivy is that in larger teams, you will have different people dealing with different components of your infrastructure, of your deployments, and you could end up having to use multiple different security scanners for all your different components from your container images that you're using, whether or not they are secure, whether or not they're following best practices that you defined to your infrastructure-as-code configurations, to you're running deployments inside of your cluster, for instance. So, each of those different stages across your lifecycle, from development to runtime, will maybe either need different security scanners, or you could use one security scanner that does it all. So, you could have in a team more knowledge sharing, you could have dedicated people who know how to use the tool and who can help out across a team across the lifecycle, and similar. So, that's one of the components that you might want to consider.Another thing is how mature is a tool, right? A lot of cloud providers, what they end up doing is they provide you with a solution, but it's nice to decoupled from anything else that you're using. And especially in the cloud-native space, you're heavily reliant on open-source tools, such as for your observability stack, right? Coming from Site Reliability Engineering also myself, I love using metrics and Grafana. And for me, if anything open-source from Loki to accessing my logs, to Grafana to dashboards, and all their integrations.I love that and I want to use the same tools that I'm using for everything else, also for my security tools. I don't want to have the metrics for my security tools visualized in a different solution to my reliability metrics for my application, right? Because that ultimately makes it more difficult to correlate metrics. So, those are, like, some of the factors that you might want to consider when you're choosing a security scanner.Corey: When you talk about thinking about this, from the perspective of an SRE is—I mean, this is definitely an artifact of where you come from and how you approach this space. Because in my world, when you have ten web servers, five application servers, and two database servers and you wind up with a problem in production, how do you fix this? Oh, it's easy. You log into one of those nodes and poke around and start doing diagnostics in production. In a containerized world, you generally can't do that, or there's a problem on a container, and by the time you're aware of that, that container hasn't existed for 20 minutes.So, how do you wind up figuring out what happens? And instrumenting for telemetry and metrics and observability, particularly at scale becomes way more important than it ever was, for me. I mean, my version of monitoring was always Nagios, which was the original Call of Duty that wakes you up at two in the morning when the hard drive fails. The world has thankfully moved beyond that and a bunch of ways. But it's not first nature for me. It's always, “Oh, yeah, that's right. We have a whole telemetry solution where I can go digging into.” My first attempt is always, oh, how do I get into this thing and poke it with a stick? Sometimes that's helpful, but for modern applications, it really feels like it's not.Anaïs: Totally. When we're moving to an infrastructure to an environment where we can deploy multiple times a day, right, and update our application multiple times a day, multiple times a day, we can introduce new security issues or other things can go wrong, right? So, I want to see—as much as I want to see all of the other failures, I want to see any security-related issues that might be deployed alongside those updates at the same frequency, right?Corey: The problem that I see across all this stuff, though, is there are a bunch of tools out there that people install, but then don't configure because, “Oh, well, I bought the tool. The end.” I mean, I think it was reported almost ten years ago or so on the big Target breach that they wound up installing some tool—I want to say FireEye, but please don't quote me on that—and it wound up firing off a whole bunch of alerts, and they figured was just noise, so they turned it all off. And it turned out no, no, this was an actual breach in progress. But people are so used to all the alarms screaming at them, that they don't dig into this.I mean, one of the original security scanners was Nessus. And I seen a lot of Nessus reports because for a long time, what a lot of crappy consultancies would do is they would white-label the output of whatever it was that Nessus said and deliver that in as the report. So, you'd wind up with 700 pages of quote-unquote, “Security issues.” And you'd have to flip through to figure out that, ah, this supports a somewhat old SSL negotiation protocol, and you're focusing on that instead of the oh, and by the way, the primary database doesn't have a password set. Like, it winds up just obscuring it because there is so much. How does Trivy approach avoiding the information overload problem?Anaïs: That's a great question because everybody's complaining about vulnerability fatigue, of them, for the first time, scanning their container images and workloads and seeing maybe even hundreds of vulnerabilities. And one of the things that can be done to counteract that right from the beginning is investing your time into looking at the different flags and configurations that you can do before actually deploying Trivy to, for example, your cluster. That's one part of it. The other part is I mentioned earlier, you would use a security scan at different parts of your deployment. So, it's really about integrating scanning not just once you—like, in your production environment, once you've deployed everything, but using it already before and empowering engineers to actually use it on their machines.Now, they can either decide to do it or not; it's not part of most people's job to do security scanning, but as you move along, the more you do, the more you can reduce the noise and then ultimately, when you deploy Trivy, for example, inside of your cluster, you can do a lot of configuration such as scanning just for critical vulnerabilities, only scanning for vulnerabilities that already have a fix available, and everything else should be ignored. Those are all factors and flags that you can place into Trivy, for instance, and make it easier. Now, with Trivy, you won't have automated PRs and everything out of the box; you would have to set up the actions or, like, the ways to mitigate those vulnerabilities manually by yourself with tools, as well as integrating Trivy with your existing stack, and similar. But then obviously, if you want to have something more automated, if you want to have something that does more for you in the background, that's when you want to use to an enterprise solution and shift to something like Aqua Security Enterprise Platform that actually provides you with the automated way of mitigating vulnerabilities where you don't have to know much about it and it just gives you the solution and provides you with a PR with the updates that you need in your infrastructure-as-code configurations to mitigate the vulnerability [unintelligible 00:15:52]?Corey: I think that's probably a very fair answer because let's be serious when you're running a bank or someone for whom security matters—and yes, yes, I know, security should matter for everyone, but let's be serious, I care a little bit less about the security impact of, for example, I don't know, my Twitter for Pets nonsense, than I do a dating site where people are not out about their orientation or whatnot. Like, there is a world of difference between the security concerns there. “Oh, no, you might be able to shitpost as me if you compromise my lasttweetinaws.com Twitter client that I put out there for folks to use.” Okay, great. That is not the end of the world compared to other stuff.By the time you're talking about things that are critically important, yeah, you want to spend money on this, and you want to have an actual full-on security team. But open-source tools like this are terrific for folks who are just getting started or they're building something for fun themselves and as it turns out, don't have a full security budget for their weird late-night project. I think that there's a beautiful, I guess, spectrum, as far as what level of investment you can make into security. And it's nice to see the innovation continued happening in the space.Anaïs: And you just mentioned that dedicated security companies, they likely have a research team that's deploying honeypots and seeing what happens to them, right? Like, how are attackers using different vulnerabilities and misconfigurations and what can be done to mitigate them. And that ultimately translates into the configurations of the open-source tool as well. So, if you're using, for instance, a security scanner that doesn't have an enterprise company with a research team behind it, then you might have different input into the data of that security scanner than if you do, right? So, these are, like, additional considerations that you might want to take when choosing a scanner. And also that obviously depends on what scanning you want to do, on the size of your company, and similar, right?Corey: This episode is sponsored in part by our friend EnterpriseDB. EnterpriseDB has been powering enterprise applications with PostgreSQL for 15 years. And now EnterpriseDB has you covered wherever you deploy PostgreSQL on-premises, private cloud, and they just announced a fully-managed service on AWS and Azure called BigAnimal, all one word. Don't leave managing your database to your cloud vendor because they're too busy launching another half-dozen managed databases to focus on any one of them that they didn't build themselves. Instead, work with the experts over at EnterpriseDB. They can save you time and money, they can even help you migrate legacy applications—including Oracle—to the cloud. To learn more, try BigAnimal for free. Go to biganimal.com/snark, and tell them Corey sent you.Corey: Something that I do find fairly interesting is that you started off, as you say, doing DevRel in the open-source blockchain world, then you went to work as an SRE, and then went back to doing DevRel-style work. What got you into SRE and what got you out of SRE, other than the obvious having worked in SRE myself and being unhappy all the time? I kid, but what was it that got you into that space and then out of it?Anaïs: Yeah. Yeah, but no, it's a great question. And it's, I guess, also was shaped my perspective on different tools and, like, the user experience of different tools. But ultimately, I first worked in the cloud-native space for an enterprise tool as developer advocate. And I did not like the experience of working for a paid solution. Doing developer advocacy for it, it felt wrong in a lot of ways. A lot of times you were required to do marketing work in those situations.And that kind of got me out of developer advocacy into SRE work. And now I was working partially or mainly as SRE, and then on the side, I was doing some presentations in developer advocacy. However, that split didn't quite work, either. And I realized that the value that I add to a project is really the way I convey information, which I can't do if I'm busy fixing the infrastructure, right? I can't convey the information of as much of how the infrastructure has been fixed as I can if I'm working with an engineering team and then doing developer advocacy, solely developer advocacy within the engineering team.So, how I ultimately got back into developer advocacy was just simply by being reached out to by my manager at Aqua Security, and Itay telling me, him telling me that he has a role available and if I want to join his team. And it was open-source-focused. Given that I started my career for several years working in the open-source space and working with engineers, contributing to open-source tools, it was kind of what I wanted to go back to, what I really enjoy doing. And yeah, that's how that came about [laugh].Corey: For me, I found that I enjoy aspects of the technology part, but I find I enjoy talking to people way more. And for me, the gratifying moment that keeps me going, believe it or not, is not necessarily helping giant companies spend slightly less money on another giant company. It's watching people suddenly understand something they didn't before, it's watching the light go on in their eyes. And that's been addictive to me for a long time. I've also found that the best way for me to learn something is to teach someone else.I mean, the way I learned Git was that I foolishly wound up proposing a talk, “Terrible Ideas in Git”—we'll teach it by counterexample—four months before the talk. And they accepted it, and crap, I'd better learn enough get to give this talk effectively. I don't recommend this because if you miss the deadline, I checked, they will not move the conference for you. But there really is something to be said for watching someone learn something by way of teaching it to them.Anaïs: It's actually a common strategy for a lot of developer advocates of making up a talk and then waiting whether or not it will get accepted. [laugh] and once it gets accepted, that's when you start learning the tool and trying to figure it out. Now, it's not a good strategy, obviously, to do that because people can easily tell that you just did that for a conference. And—Corey: Sounds to me, like, you need to get better at bluffing. I kid.Anaïs: [laugh].Corey: I kid. Don't bluff your way through conference talks as a general rule. It tends not to go well. [laugh].Anaïs: No. It's a bad idea. It's a really bad idea. And so, I ultimately started learning the technologies or, like, the different tools and projects in the cloud-native space. And there are lots, if you look at the CNCF landscape, right? But just trying to talk myself through them on my YouTube channel. So, my early videos on my channel, it's just very much on the go of me looking for the first time at somebody's documentation and not making any sense out of them.Corey: It's surprising to me how far that gets you. I mean, I guess I'm always reminded of that Tom Hanks movie from my childhood Big where he wakes up—the kid wakes up as an adult one day, goes to work, and bluffs his way into working at a toy company. He's in a management meeting and just they're showing their new toy they're going to put out there and he's, “I don't get it.” Everyone looks at him like how dare you say it? And, “I don't get it. What's fun about this?” Because he's a kid.And he wants to getting promoted to vice president because wow, someone pointed out the obvious thing. And so often, it feels like using a tool or a product, be it open-source or enterprise, it is clearly something different in my experience of it when I try to use this thing than the person who developed it. And very often it's that I don't see the same things or think of the problem space the same way that the developers did, but also very often—and I don't mean to call anyone in particular out here—it's a symptom of a terrible user interface or user experience.Anaïs: What you've just said, a lot of times, it's just about saying the thing that nobody that dares to say or nobody has thought of before, and that gets you obviously, easier, further [laugh] then repeating what other people have already mentioned, right? And a lot of what you see a lot of times in these—also an open-source projects, but I think more even in closed-source enterprise organizations is that people just repeat whatever everybody else is saying in the room, right? You don't have that as much in the open-source world because you have more input or easier input in public than you do otherwise, but it still happens that I mean, people are highly similar to each other. If you're contributing to the same project, you probably have a similar background, similar expertise, similar interests, and that will get you to think in a similar way. So, if there's somebody like, like a high school student maybe, somebody just graduated, somebody from a completely different industry who's looking at those tools for the first time, it's like, “Okay, I know what I'm supposed to do, but I don't understand why I should use this tool for that.” And just pointing that out, gets you a response, most of the time. [laugh].Corey: I use Twitter and use YouTube. And obviously, I bias more for short, pithy comments that are dripping in sarcasm, whereas in a long-form video, you can talk a lot more about what you're seeing. But the problem I have with bad user experience, particularly bad developer experience, is that when it happens to me—and I know at a baseline level, that I am reasonably competent in technical spaces, but when I encounter a bad interface, my immediate instinctive reaction is, “Oh, I'm dumb. And this thing is for smart people.” And that is never, ever true, except maybe with quantum computing. Great, awesome. The Hello World tutorial for that stuff is a PhD from Berkeley. Good luck if you can get into that. But here in the real world where the rest of us play, it's just a bad developer experience, but my instinctive reaction is that there's stuff I don't know, and I'm not good enough to use this thing. And I get very upset about that.Anaïs: That's one of the things that you want to do with any technical documentation is that the first experience that anybody has, no matter the background, with your tool should be a success experience, right? Like people should look at it, use maybe one command, do one thing, one simple thing, and be like, “Yeah, this makes sense,” or, like, this was fun to do, right? Like, this first positive interaction. And it doesn't have to be complex. And that's what many people I think get wrong, that they try to show off how powerful a tool is, of like, oh, “My God, you can do all those things. It's so exciting, right?” But [laugh] ultimately, if nobody can use it or if most of the people, 99% of the people who try it for the first time have a bad experience, it makes them feel uncomfortable or any negative emotion, then it's really you're approaching it from the wrong perspective, right?Corey: That's very apt. I think it's so much of whether people stick with something long enough to learn it and find the sharp edges has to do with what their experience looks like. I mean, back when I was more or less useless when it comes to anything that looked like programming—because I was a sysadmin type—I started contributing to SaltStack. And what was amazing about that was Tom Hatch, the creator of the project had this pattern that he kept up for way too long, where whenever anyone submitted an issue, he said, “Great, well, how about you fix it?” And because we had a patch, like, “Well, I'm not good at programming.” He's like, “That's okay. No one is. Try it and we'll see.”And he accepted every patch and then immediately, you'd see another patch come in ten minutes later that fixed the problems in your patch. But it was the most welcoming and encouraging experience, and I'm not saying that's a good workflow for an open-source maintainer, but he still remains one of the best humans I know, just from that perspective alone.Anaïs: That's amazing. I think it's really about pointing out that there are different ways of doing open-source [laugh] and there is no one way to go about it. So, it's really about—I mean, it's about the community, ultimately. That's what it boils down to, of you are dependent, as an open-source project, on the community, so what is the best experience that you can give them? If that's something that you want to and can invest in, then yeah [laugh] that's probably the best outcome for everybody.Corey: I do have one more question, specifically around things that are more timely. Now, taking a quick look at Trivy and recent features, it seems like you've just now—now-ish—started supporting cloud scanning as well. Previously, it was effectively, “Oh, this scans configuration and containers. Okay, great.” Now, you're targeting actually scanning cloud providers themselves. What does this change and what brought you to this place, as someone who very happily does not deal with AWS?Anaïs: Yeah, totally. So, I just started using AWS, specifically to showcase this feature. So, if you look at the Aqua Open Source YouTube channel, you will find several tutorials that show you how to use that feature, among others.Now, what I mentioned earlier in the podcast already is that Trivy is really versatile, it allows you to scan different aspects of your stack at different stages of your development lifecycle. And that's made possible because Trivy is ultimately using different open-source projects under the hood. For example, if you want to scan your infrastructure-as-code misconfigurations, it's using a tool called tfsec, specifically for Terraform. And then other tools for other scanning, for other security scanning. Now, we have—or had; it's going to be probably deprecated—a tool called CloudSploit in the Aqua open-source project suite.Now, that's going to, kind of like, the functionality that CloudSploit was providing is going to get converted to become part of Trivy, so everything scanning-related is going to become part of Trivy that really, like, once you understand how Trivy works and all of the CLI commands in Trivy have exactly the same structure, it's really easy to scan from container images to infrastructure-as-code, to generating s-bombs to scanning also now, your cloud infrastructure and Trivy can scan any of your AWS services for misconfigurations, and it's using basically the AWS client under the hood to connect with the services of everything you have set up there, and then give you the list of misconfigurations. And once it has done the scan, you can then drill down further into the different aspects of your misconfigurations without performing the entire scan again, since you likely have lots and lots of resources, so you wouldn't want to scan them every time again, right, when you perform the scan. So, once something has been scanned, Trivy will know whether the resource changed or not, it won't scan it again. That's the same way that in-classes scanning works right now. Once a container image has been scanned for vulnerabilities, it won't scan the same container image again because that would just waste time. [laugh]. So yeah, do check it out. It's our most recent feature, and it's going to come out also to the other cloud providers out there. But we're starting with AWS and this kind of forced me to finally [laugh] look at it for the sake of it. But I'm not going to be happy. [laugh].Corey: No, I don't think anyone is. It's every time I see on a resume that someone says, “Oh, I'm an expert in AWS,” it's, “No you're not.” They have 400-some-odd services now. We have crossed the point long ago, where I can very convincingly talk about AWS services that do not exist to Amazonians and not get called out for it because who in the world knows what they run? And half of their services sound like something I made up to be funny, but they're very real. It's wild to me that it is a sprawling as it is and apparently continues to work as a viable business.But no one knows all of it and everyone feels confused, lost, and overwhelmed every time they look at the AWS console. This has been my entire career in life for the last six years, and I still feel that way. So, I'm sure everyone else does, too.Anaïs: And this is how misconfigurations happen, right? You're confused about what you're actually supposed to do and how you're supposed to do it. And that's, for example, with all the access rights in Google Cloud, something that I'm very familiar with, that completely overwhelms you and you get super frustrated by, and you don't even know what you give access to. It's like, if you've ever had to configure Discord user roles, it's a similar disaster. You will not know which user has access to which. They kind of changed it and try to improve it over the past year, but it's a similar issue that you face in cloud providers, just on a much larger-scale, not just on one chat channel. [laugh]. So.Corey: I think that is probably a fair place to leave it. I really want to thank you for spending as much time with me as you have talking about the trials and travails of, well, this industry, for lack of a better term. If people want to learn more, where's the best place to find you?Anaïs: So, I have a weekly DevOps newsletter on my blog, which is anaisurl—like, how you spell U-R-L—and then dot com. anaisurl.com. That's where I have all the links to my different channels, to all of the resources that are published where you can find out more as well. So, that's probably the best place. Yeah.Corey: And we will, of course, put a link to that in the show notes. I really want to thank you for being as generous with your time as you have been. Thank you.Anaïs: Thank you for having me. It was great.Corey: Anaïs, open-source developer advocate at Aqua Security. I'm Cloud Economist Corey Quinn, and this is Screaming in the Cloud. If you've enjoyed this podcast, please leave a five-star review on your podcast platform of choice, whereas if you've hated this podcast, please leave a five-star review on your podcast platform of choice along with an angry, insulting comment that I will never see because it's buried under a whole bunch of minor or false-positive vulnerability reports.Corey: If your AWS bill keeps rising and your blood pressure is doing the same, then you need The Duckbill Group. We help companies fix their AWS bill by making it smaller and less horrifying. The Duckbill Group works for you, not AWS. We tailor recommendations to your business and we get to the point. Visit duckbillgroup.com to get started.Announcer: This has been a HumblePod production. Stay humble.

Karim Hijazi has been at the forefront of attacker counterintelligence and infiltration research for the last decade, developing new ways for security teams to clandestinely monitor hackers and anticipate attacks before they happen. Prior to launching Prevailion, Karim was the founder/CEO of Unveillance, an early pioneer in advanced threat intelligence and the first cloud-based data leak intelligence platform. Karim successfully exited Unveillance in 2012 with an acquisition by Mandiant, and he was then appointed as Mandiant's new director of intelligence. While at Mandiant, Karim played an important role in that company's well-known APT1 report released in 2013, which definitively linked the People's Liberation Army of China to widespread cyber espionage activity against US interests. Mandiant was acquired by FireEye soon after. During the hacktivist heydays of the early 2010s, Karim engaged in a well-documented battle with the Anonymous offshoot “LulzSec,” after the group compromised an InfraGard database. Karim's confrontation with the group was featured in Parmy Olson's book, “We Are Anonymous,” as well as national media like CNN and CNET. During the Arab Spring, Karim also served as a key contributor to the Cyber Security Forum Initiative's “Project Cyber Dawn Libya,” which provided the first in-depth look at Libyan cyber warfare capabilities and defenses. CSFI's membership includes military officials, academics and business leaders from the US and around the world. Do you want to get the show on your podcast app or the written versions of the stories? Subscribe to the Business of Tech: https://www.businessof.tech/ Support the show on Patreon:  https://patreon.com/mspradio/ Want our stuff?  Cool Merch?  Wear “Why Do We Care?” - Visit https://mspradio.myspreadshop.com Follow us on: Facebook: https://www.facebook.com/mspradionews/ Twitter: https://twitter.com/mspradionews/ Instagram: https://www.instagram.com/mspradio/ LinkedIn: https://www.linkedin.com/company/28908079/  

We are in for a treat for today's episode. Scott McCrady, CEO of SolCyber Managed Security Services, joins me today to talk about his incredible story about how he went from being an engineer to switching careers and working his way up in the cybersecurity sales space.When he left his engineer job to pursue his passion of working in sales, he started his new career with Symantec. While he was there for an entire decade, he was able to bring businesses from zero to helping them create a solid foundation in their Asia Pacific in Japan and Sydney businesses. Because of his incredible work, he got asked to come back and run the whole business which at the time, was one of the largest MSSP in the world, with 450 to 500 employees, and six security operations centers around the world.Later in his career he decided to go somewhere smaller and helped build out FireEye's MSSP program, both for sales outbound, but also to work with partners and channels.With years of experience in MSSP, Scott is sharing what he feels like his biggest learnings were, what could be different and what he took from it to make SolCyber Managed Security Services the best in the industry. Tune into today's episode where we expand more on Scott's thoughts on how to cut through the noise in a world where everybody can call themselves an MSSP and rise above it by really delivering results and building your reputation.If you are a sales leader at a startup, or you're in the sales team, and you're searching for your repeatable scalable sales process to grow sales faster, then please get in touch with me at andrew@unstoppable.do or you can also go to my site at www.unstoppable.do. Sign up for our newsletter (https://www.salesbluebird.com)We want your questions and topic suggestions for future episodes.  Send them to  andrew@unstoppable.do or send us a voice/video at https://zipmessage.com/unstoppableMake sure to get in touch with Scott on LinkedIn to get connected: https://www.linkedin.com/in/scottmccrady/Support the show

On this episode, we sit down with Theo Nassar, CEO at Right-Hand Cybersecurity, to talk about how Theo made a change in his work life and did something a lot of us wish we could or did do. Theo started out his journey in cyber as an intern with FireEye and then ended up getting an offer to join them as a Sales Development Representative. Now, 8 years later, he has started a business of his own called Right-Hand Cybersecurity. Starting a company is something that Theo had always wanted to do. What it came down to was a conversation between him and his wife about three things…#1 What were they going to do?#2 Who were they going to do it with?#3 Where were they going to do it?Once he felt confident in the network he had accumulated combined with the problem he had identified, it felt like the right time to take the plunge. So what were some of Theo's first hires? Well, it wasn't salespeople. He started off with hiring engineers to help build and establish his product. At first, he explains how when making those first hires, whether it was those early engineers or the early people on his go to market team, you're hiring for a brand that is relatively unknown. Basically, you're hiring on a vision and you're selling the vision of what you want to do, and the potential you want to unlock. His #1 advice he'd give to an entrepreneur looking to hire the first members of their team would be to build in public.As CEO, Theo continues to make cold calls, do outreach for prospects, and has the discipline to take what he learned during his years as an SDR and apply them to his practice and routine today. Tune in to the episode to learn more about Theo's journey from intern in cybersecurity to being founder and CEO of his own business. If you want to get in touch with Theo, the best way is to contact him on LinkedIn or email him at theo@right-hand.ai.com If you are a sales leader at a startup, or you're in the sales team, and you're searching for your repeatable scalable sales process to grow sales faster, then please get in touch with me at andrew@unstoppable.do or you can also go to my site at www.unstoppable.do. Sign up for our newsletter (https://www.salesbluebird.com)We want your questions and topic suggestions for future episodes. Send them to  andrew@unstoppable.do or send us a voice/video at https://zipmessage.com/unstoppableSupport the show (http://www.unstoppable.do)

Enjoy this sample of CSO Perspectives, a CyberWire Pro podcast. Like what you hear? Consider subscribing to CyberWire Pro for $99/year. Learn more. On this episode, host Rick Howard discusses if the first principles theories prevent material impact in the real world, such as the latest SolarWinds attack. Previous episodes referenced: S1E6: 11 MAY: Cybersecurity First Principles S1E7: 18 MAY: Cybersecurity first principles: zero trust S1E8: 26 MAY: Cybersecurity first principles: intrusion kill chains. S1E9: 01 JUN: Cybersecurity first principles - resilience S1E11: 15 JUN: Cybersecurity first principles - risk S2E3: 03 AUG: Incident response: a first principle idea. S2E4: 10 AUG: Incident response: around the Hash Table.  S2E7: 31 AUG: Identity Management: a first principle idea. S2E8: 07 SEP: Identity Management: around the Hash Table. Other resources: “A BRIEF HISTORY OF SUPPLY CHAIN ATTACKS,” by Secarma, 1 September 2018. “Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers,” by 365 Defender Research Team and the Threat Intelligence Center (MSTIC), Microsoft, 18 December 2020. “A Timeline Perspective of the SolarStorm Supply-Chain Attack,” by Unit 42, Palo Alto Networks, 23 December 2020. “Cobalt Strike,” by MALPEDIA. “Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon,” by Kim Zetter, Published by Crown, 3 June 2014. “Cybersecurity Canon,” by Ohio State University. “FireEye shares jump back to pre-hack levels,” Melissa Lee, CNBC, 23 December 2020. "Implementing Intrusion Kill Chain Strategies by Creating Defensive Campaign Adversary Playbooks," by Rick Howard, Ryan Olson, and Deirdre Beard (Editor), The Cyber Defense Review, Fall 2020. “Orion Platform,” by SolarWinds. “Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers,” by Andy Greenberg, Published by Doubleday, 7 May 2019.  “Solarstorm,” by Unit 42, Palo Alto Networks, 23 December 2020. “The Cybersecurity Canon: Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon,” by Rick Howard, The Cybersecurity Canon Project, 28 January 2015. “Using Microsoft 365 Defender to protect against Solorigate,” by the Microsoft 365 Defender Team, 28 December 2020.

About AshleighAshleigh Early is a passionate advocate for sales people and through her consulting, coaching, and The Other Side of Sales, she is devoted to making B2B sales culture more inclusive so anyone can thrive. Over the past ten years Ashleigh has led, built, re-built, and consulted for 2 unicorns, 3 acquisitions, 1 abject failure and every step in between.  She is also the Head of Sales at the Duckbill Group! You can find Ashleigh on Twitter @AshleighatWork and more about the Other Side of Sales at Othersideofsales.comLinks: Twitter: https://twitter.com/ashleighatwork LinkedIn: https://www.linkedin.com/in/ashleighearly TranscriptAnnouncer: Hello, and welcome to Screaming in the Cloud with your host, Chief Cloud Economist at The Duckbill Group, Corey Quinn. This weekly show features conversations with people doing interesting work in the world of cloud, thoughtful commentary on the state of the technical world, and ridiculous titles for which Corey refuses to apologize. This is Screaming in the Cloud.Corey: Couchbase Capella Database-as-a-Service is flexible, full-featured and fully managed with built in access via key-value, SQL, and full-text search. Flexible JSON documents aligned to your applications and workloads. Build faster with blazing fast in-memory performance and automated replication and scaling while reducing cost. Capella has the best price performance of any fully managed document database. Visit couchbase.com/screaminginthecloud to try Capella today for free and be up and running in three minutes with no credit card required. Couchbase Capella: make your data sing.Corey: Today's episode is brought to you in part by our friends at MinIO the high-performance Kubernetes native object store that's built for the multi-cloud, creating a consistent data storage layer for your public cloud instances, your private cloud instances, and even your edge instances, depending upon what the heck you're defining those as, which depends probably on where you work. It's getting that unified is one of the greatest challenges facing developers and architects today. It requires S3 compatibility, enterprise-grade security and resiliency, the speed to run any workload, and the footprint to run anywhere, and that's exactly what MinIO offers. With superb read speeds in excess of 360 gigs and 100 megabyte binary that doesn't eat all the data you've gotten on the system, it's exactly what you've been looking for. Check it out today at min.io/download, and see for yourself. That's min.io/download, and be sure to tell them that I sent you.Corey: Welcome to Screaming in the Cloud. I'm Corey Quinn. My guest today does something that I, sort of, dabbled around the fringes of once upon a time, but then realized I wasn't particularly good at it and got the hell out of it and went screaming into clouds instead. Ashleigh Early is the Head of Sales here at The Duckbill Group. Ashleigh, thank you for joining me.Ashleigh: Thanks for coming on and running, screaming from my chosen profession [laugh]. You're definitely not the only one.Corey: Well, let's be clear here; there are two ways that can go because sure, I used to dabble around in sales when I was, basically, trying to figure how to not starve to death. But I also used to run things; it's basically a smart team. I was managing people and realized I was bad at that, too. So, really, that's, sort of, an open-ended direction. We can go either side and…But, let's go with sales. That seems like a more interesting way for this to play out. So, you've been here for—what is it now—it feels like ages, but my awareness for the passing of time in the middle of a global panini is relatively not great.Ashleigh: Yeah. I think we're at day—what is it—1,053 of March 2020? So, time is irrelevant; it's a construct; I don't know. But, technically, by the Gregorian Calendar, I think I'm at six months.Corey: It's very odd to me, at least the way that I contextualized doing this. Back when I started what became The Duckbill Group, I was an independent consultant. It was, more or less, working people I knew through my network who had a very specific, very expensive problem: The AWS bill is too high. And I figured, this is genius. It is the easiest possible sale in the world and one of the only scenarios where I can provably demonstrate ROI to a point where, “Bring me in; you will inherently save money.”And all of that is true, but one of things I learned very quickly was that, even with the easiest sale of, “Hi. I'd like to sell you this bag of money,” there is no such thing as an easy enterprise sale. There is nuance to it. There is a lot of difficulty to it. And I was left with the, I guess, driving question—after my first few months of playing this game—of, “How on earth does anyone make money in this space?”The reason I persisted was, basically, a bunch of people did favors for me, but they didn't owe me at all. It was, “Oh, great. I'll give them the price quote.” And they're, like, “Oh, yeah.” So cool, they turned around and quoted that to their boss at triple the rate because, “Don't slit your own throat on this.” They were right. And not for nothing, it turns out when you're selling advice, charging more for it makes it likelier to succeed as a project.But, I had no idea what I was doing. And, like most engineers on Twitter, I look at something I don't understand deeply myself, and figure, “Oh. Well, it's not engineering, therefore, it's easy.” Yeah, it turns out that running a business is humbling across a whole bunch of different axes.Ashleigh: I wouldn't even say, it's not running a business; it's working with humans. Working with humans is humbling. If you're working with a machine or even something as simple as, like, you know, you're making a product. It's follow a recipe; it's okay. Follow the instructions. I do A, then B, then C, then D, unless you don't enjoy using the instructions because you don't enjoy using instructions. But you still follow a set general process; you build a thing that comes out correctly.The moment that process is, talk to this person, and then Person A, then Person B, then Person C, then Person D, then Back to Person A, then Person D, and then finally to Person E, everything goes to heck in a handbasket. That's what really makes it interesting. And for those of us who are of a certain disposition, we find that fascinating and enthralling. If you're of another disposition, that's hell on earth [laugh]. So, it's a very—yeah, it's a very interesting thing.Corey: Back when I was independent, and people tried to sell me things—and yeah, sometimes it worked. It was always interesting going through various intake funnels and the rest. And, like, “Well, what role do you hold in the organization? Do you influence the decision? Do you make the decision? How many people need to be involved in the rest?”And I was looking around going, “How many people do you think fit in my home office here? Let's be serious.” I mean, there are times I escalated to the Chihuahua because she's unpleasant and annoying and basically, sometimes so are people. But that's a separate topic for later. But it became a very different story back as the organizational distance between the people that needed to sign off on a sale increased.Ashleigh: Mm-hm. Absolutely. And you might have felt me squirm when you described those questions because one of my biggest pet peeves is when people take sales terminology and directly use that with clients. Just like if you're an engineer and you're describing what you do, you're not going to go home and explain to your dad in technical jargon what exactly; you're going to tell him broad strokes. And if they're interested, go deeper and deeper; technical, more technical.I hate when salespeople use sales jargon, like, “What's your role in the organization? Are you the decision-maker?” Don't—mmm. There are better ways to deal with that. So, that's just a sign of poor training. It's not the sales rep's fault; it's his company's fault—their company's fault. But that's a different thing.It's fascinating to me, kind of, watching this—what you said spoke of two things there. One is poor training, and two, of a lack of awareness of the situation and a lack of just doing a little bit of pre-work. Like, you do five seconds of research on Corey Quinn, you can realize that the company is ten to 15 people tops. So, it makes sense to ask a question around, “Hey, do you need anyone else to sign off before we can move forward with this project?”That tells me if I need to get someone for technical, for budget, for whatever, but asking if you're a decision-maker, or if you're influencing, or if you're doing initial research, like, that's using sales terminology, not actually getting to the root of the problem and immediately making it very clear, you didn't do any actual research in advance, which is not—in modern selling—not okay.Corey: My business partner, Mike, has a CEO job title, and he'll get a whole bunch of cold outreach constantly all day, every day. I conducted a two-week experiment where in front of my Chief Cloud Economist job title, I put ‘CTO/' just to see what would happen, and sure enough, I started getting outreach left, right, up, down, and sideways. Not just for things that a CTO figure might theoretically wind up needing to buy, but also, job opportunities for a skill set that I haven't dusted off in a decade.So, okay. Once people can have something that hits their filters when you're searching for very specific titles, then you wind up getting a lot more outreach. But if you create a job title that no one sensible would ever pick for themselves, suddenly a lot of that tends to go by the wayside. It shined a light on how frustratingly dreary a lot of the sales prospecting work really can be from—Ashleigh: Oh, yeah.Corey: —just from the side of someone who gets it. Now, I'm not exaggerating when I say that I did work in sales once upon a time. Not great at it, but one of the first white-collar-style jobs that I had was telemarketing, of all things. And I was spectacular at it because I was fortunate enough to be working on a co-branded affinity credit card that was great, and I had the opportunity to position it as a benefit of an existing membership or something else people already had. I was consistently top-ten out of 400 people on a shift, and it was great.But it was also something that was very time-limited, and if you're having an off day, everything winds up crumbling. And, eventually, I drifted off and started doing different things. But I've never forgotten those days. And that's why it just grinds my gears both to see crappy sales stuff happening, and two, watching people on Twitter—particularly—taking various sales-prospect outreach for a drag. And it's—Ashleigh: Oh, God. Yeah.Corey: —you know, not everyone is swimming in the ocean of privilege that some of the rest of us are. And understand that you're just making yourself look like a jerk when you're talking to someone who is relatively early-career and didn't happen to google you deeply enough before sending you an email that you find insulting. That bugs me a fair bit.Ashleigh: And I think part of that is just a lack of humanity and understanding. Like, there's—I mean, I get it; I'm the first person to be jumping on Twitter and [unintelligible 00:08:41] when something goes down, or something's not working, and saying, you know—I'm the first one to get angry and start complaining. Don't get me wrong. However, what I think a lot of people—it's really easy to dehumanize something you don't see very often, or you're not involved in directly. And I find it real interesting you mentioned you worked in, you know, doing telemarketing.I lasted literally two weeks in telemarketing. I full-on rage-quit. It was a college job. I worked in my college donations center. I lasted two weeks, and I fully walked out on a shift. I was, like, “Screw this; I'm never doing anything like that ever again. I hate this.”But what I hated about it was I hated the lack of connection. I was, like, I'm not just going to read some scripts and get yelled at for having too much banter. Like, I'm getting money; what do you care? I'm getting more money than other people. Maybe they're not making as many calls, but I'm getting just as much, so why do you care how I do this?But what really gets me is you have to remember—and I think a lot of people don't understand how, kind of, most large, modern sales organizations work. And just really quickly giving you a very, very generic explanation, the way a lot of organizations work is they employ something called SDRs or Sales Development Reps. That title can be permeated in a million different ways. There's ADRs, MDRs, BDRs, whatever. But basically, it's their job to do nothing but scour the internet using, sometimes, actual, like, scripts.Sometimes they use LinkedIn; sometimes they have—they purchase databases. So, for example, like, you might change your title on LinkedIn, but it's not changing in the database. Just trust me Corey, they have you flagged as a CTO. Sorry. What [crosstalk 00:10:16].Corey: My personal favorite is when I get cold outreach asking me on the phone call about whether we have any needs for whatever it is they happen to be selling at—and then they name a company that I left in 2012. I don't know how often that database has been sold and resold and sold onwards, yet again. And it's just, I work in tech. What do you think the odds are that I'm still in the same job I was ten years ago? And I get that it happens, but at some point, it just becomes almost laughable.Ashleigh: Yeah. If you work in a company—that when in doubt—I tell every sales, kind of, every company team that I work with—do not use those vendors. Ninety percent of them are not very good; they're using old databases; they don't update. You're better off paying for a database that is subscription-based because then, literally, you've got an SLA on data quality, and you can flag and get things fixed. The number one sales-data provider, I happen to know for a fact, I actually earned, I think, almost $10,000 in donations to a charity in—what was this—this was 2015 because I went through and did a scrub of are RCRM versus I think, LinkedIn or something else, and I flagged everything that wasn't accurate and sent it back to them.And they happened to have a promotion where for every—where you could do a flag that wasn't accurate because they were no longer at the company. They would donate a buck to charity, and I think I sent them, like, 10,000 or something. [unintelligible 00:11:36] I was like, “None of these are accurate.” And they're, like, you know? And they sent me this great email, like, “Thank you for telling us; we really appreciate it.”I didn't even know they were doing this promotion. They thought I'd be saving up for it. And I was, like, “No, I just happened to run this analysis and thought you'd want to know.” So, subscriptions—Corey: You know, it turns out computers are really fast at things.Ashleigh: Yeah, and I was very proud I figured out how to run a script. I was, like, “Yay. Look at me; I wrote a macro.” This was very exciting for—the first—God, the first five or so years of my sales career, I've consistently called myself a dumb salesperson because I was working in really super-technical products. I worked for Arista Networks, FireEye, Bromium, you know, PernixData. I was working in some pretty reasonably hard tech, and I'd always, kind of, introduced myself, I definitely talked about my technical aptitude because I have a degree in political science and opera. These are not technical fields, and yet here I am every day, talking about, you know, tech [crosstalk 00:12:25].Corey: Well, if the election doesn't pan out the way you want, why don't you sing about it? Why not? You can tie all these things together.Ashleigh: You can. And, honestly, there have several points—I've done a whole other shows on, like, how those two, seemingly, completely disparate things have actually been some of the greatest gifts to my career. And most notably, I think, is the fact that I have my degree in political science as a Bachelor of Science, which means I have a BS in BS, which is incredibly relevant to my career in a lot of different ways.Corey: This episode is sponsored by our friends at Oracle Cloud. Counting the pennies, but still dreaming of deploying apps instead of “Hello, World” demos? Allow me to introduce you to Oracle's Always Free tier. It provides over 20 free services and infrastructure, networking, databases, observability, management, and security. And—let me be clear here—it's actually free. There's no surprise billing until you intentionally and proactively upgrade your account. This means you can provision a virtual machine instance or spin up an autonomous database that manages itself, all while gaining the networking, load balancing, and storage resources that somehow never quite make it into most free tiers needed to support the application that you want to build. With Always Free, you can do things like run small-scale applications or do proof-of-concept testing without spending a dime. You know that I always like to put asterisks next to the word free? This is actually free, no asterisk. Start now. Visit snark.cloud/oci-free that's snark.cloud/oci-free.Ashleigh: Yeah, so wrapping up, kind of, how modern-skills organizations work, most companies' employees can be called BDRs, and they're typically people who have less than five years of sales experience. They, rightly or wrongly, tend to be people in their early-20s who have very little training. Most people get SDRs on phones within a week, which means—Corey: These are the people that are doing the cold outreach?Ashleigh: —they've gotten maybe five or six hours of product training. Hmm? Sorry.Corey: These are the people who are doing the cold outreach?Ashleigh: These are the people who are doing the cold outreach. So, their whole job is just to get appointments for account execs. Account execs make it—again; tons of different names, but these are the closers. They'll run you through the sales cycle. They typically have between five and thirty years of experience.But they're the ones depending on how big your company is. [unintelligible 00:13:35] the bigger your company, typically the more experience your sales rep's going to have in terms of managing most separate deal cycles. But what ends up happening is you end up with this SDR organization—this is where I've spent most of my career is helping people build healthy sales-development organizations. In terms of this churn-and-burn culture where you've got people coming in and basically flaming out because they go on Twitter or—heaven forbid—Reddit and get sales advice from these loud-mouthed, terrible people, who are telling them to do things that didn't work ten years ago, but they then go try it; they send it out, and then their prospects suddenly blasting them on Twitter.It's not that rep's fault that they got no training in the first place, they got no support, they just had to figure it out because that's the culture. It's the company's fault. And a lot of times, people don't—there was a big push against this last year, I think, within the sales community against other sales leaders doing it, but now, it's starting to spread out. Like, I have no problem dragging someone for a really terrible email. Anonymize the company; anonymize the email. And, if you want to give feedback, give it to them directly. And you can also say, “I'm going to post this, but it's not coming back to you.” And tell them, like—Corey: Whenever I get outreach from—Ashleigh: “Get out of that terrible company.”Corey: Yeah. Whenever I get outreach from AWS for a sales motion or for recruiting or whatnot. I always anonymize the heck out of the rep. It's funny to me because it's, “Don't you know who I am?” It is humorous, on some level. And it's clear that is a numbers game, and they're trying to do a bunch of different things, but a cursory google of my name would show it. It's just amusing.I want to be clear that whenever I do that, I don't think the rep has done anything wrong. They're doing exactly what they should. I just find it very funny that, “Wait, me? Work at an AWS? The bookstore?” It seems like it would be a—yeah. Yeah, the juxtaposition is just hilarious to me. They've done nothing wrong, and that's okay. It's a hard racket.I remember—at least they have the benefit over my first enterprise sales job where I was selling tape drives into the AS/400 market, competing against IBM on price. That was in the days of “No one ever gets fired for buying IBMs.” So, yeah. The place you want to save money on is definitely the backup system that's going to save all of your systems. I made one sale in my time there—and apparently set a company record because it wasn't specifically aimed at the AS/400—and I did the math on that and realized, “Huh, I'd have to do two of these a month in order to beat the draw against commission structure that they had.”So, I said, “To hell with this,” and I quit. The CEO was very much a sales pro, and, “Well, you need to figure out whether you're a salesperson or not.” Even back then, I had an attitude problem, but it was, “Yeah, I think that—oh, I know that I am. It's just a question is am I going to be a salesperson here?” And the answer is, “No.” It [laugh]—Ashleigh: Yeah.Corey: It's a two-way street.Ashleigh: It is. And I say this all the time to people who—I work with a lot of salespeople now who are, like, “I don't think sales is for me. I don't know, I need [unintelligible 00:16:24]. The past three companies didn't work.” The answer isn't, “Is sales for you?”The answer is, “Are you selling the right thing at the right place?” And one of the things we've learned from the ‘Great Recession' and the ‘Great Reshuffling' in everything is there's no reason to stay at a terrible company, and there's no reason to stay at a company where you're not really passionate and understand what you're selling. I joked about, you know, I talked down about myself for the first bit of my career. Doesn't mean I didn't—like, I might not understand exactly how heuristics work, but I understand what heuristics are. Just don't ask me to design any of them.You know, like, you have to understand and you have to be really excited about it. And that's what modern sales is. And so, yes, you're going to get a ton of the outreach because that's how people—it still works. That's why we all still get Nigerian prince emails. Somebody, somewhere, still clicks those things, sadly. And that gets me really angry.Corey: It's a pure numbers game.Ashleigh: Exactly. Ninety percent if enterprise B2B sales is not that anymore. Even the companies that are using BDRs—which is most of them—are now moving to what's called ‘account-based selling'. We're using hyper-personalized messaging. You're probably noticing videos are popping up more.I'm a huge fan of video. I think it's a great way to force personalization. It's, like, “Hi. Corey, I see you. I'm talking to you. I've done my research. I know what you're doing at The Duckbill Group and here's how I think we can help. If that's not the case, no worries. Let me know; I'll leave you alone.” That's what selling should be.Corey: I have yet to receive one of those, but I'm sure it'll happen now that I've mentioned that and put that out into the universe.Ashleigh: Probably.Corey: What always drove me nuts—and maybe this is unfair—but when I'm trying to use a product, probably something SaaS-based—and I see this a lot—where, first, if you aren't letting me self-serve and get off with the free tier and just start testing something, well, that's already a ding against you because usually I'm figuring this out at 2 o'clock in the morning when I can't sleep, and I want to work on something. I don't want to wait for a sales cycle, and I have to slow things down. Cool. But at some point, for sophisticated customers, you absolutely need to have a sales conversation. But, okay, great. Usually, I encounter this more with lead magnets or other things designed to get my contact info.But what drives me up a wall, when they start demanding information that is very clearly trying to classify me in their sales funnel, on some level. I'll give you my name, my company, and my work email address—although I would think that from my work email address, you could probably figure out where I work and the rest—but then there are other questions. How big is your company? What is your functional role within the company? And where are you geographically?Well, that's an interesting question. Why does that matter in 2022? Well, very often leads get circulated out to people based upon geography. And I get it, but it also frustrates me, just because I don't want to have to deal with classifying and sorting myself out for what is going to be a very brief conversation [laugh] with a salesperson. Because if the product works, great, I'm going to buy. If it doesn't work, I'm going to get frustrated and not want to hear from you forever.Which gets to my big question for you—and please don't take the question as anything other than the joking spirit in which it's intended—but why are so many salespeople profoundly annoying?Ashleigh: I would—uh, hmm.Corey: Sales processes is probably the better way to frame it because—Ashleigh: I was going to say, “Yeah, it's not the people; it's the process.” So—Corey: —it's not the individual's fault, as we've talked about it.Ashleigh: —yeah, I was going to say, I was, like, “Okay, I think it's less the people; more of the processes.” And processes that will make [crosstalk 00:19:37]—Corey: Yeah. It expresses itself as the same person showing up again and again. But that is not—Ashleigh: Totally.Corey: —their fault. That is the process by which they are being measured at as a part of their job. And it's unfair to blame them for that. But the expression is, “This person's annoying the hell out of me, what gives?”Ashleigh: “Oh, my gosh. Why does she keep [unintelligible 00:19:51] my inbox? Leave me alone. Just let me freaking test it.” I said, “I needed two weeks. Just let me have the two weeks to freaking test the thing. I will get back to you.” [unintelligible 00:19:58] yeah, no, I know.And even since moving into leadership several years ago, same thing. I'm like, “Okay, no.” I've gotten to the point where I've had several conversations with salespeople. I'm like, “I know the game. I know what you're trying to do. I respect it. Leave me alone. I promise I will get back to you, just lea”—I have literally said this to people. And the weird thing is most salespeople respect that. We really respect the transparency on that.Now, the trick is what you're talking about with lead capture and stuff like this, again, it comes down to company's design and it comes down to companies who value the buyer experience and customer journey, and companies who don't. And this, I think, is actually more driven by—in my humble opinion—our slightly over-reliance on venture capital, which is all about for a gathering of as much data as possible, figuring out how to monetize it, and move from there. In their mind, personal experience and emotion doesn't really factor into that equation very much, so you end up with these buyer journeys that are less about the buyer and more about getting them from click to purchase as efficiently as possible in terms of company resources, which includes salespeople time. So, as to why you have to fill out all those things, that just to me reeks of a company that maybe doesn't really understand the client experience and probably is going to have a pretty, mmm, support program as well, which means the product had better be really freaking good for me to buy it.Corey: To be clear, at The Duckbill Group, we do not have a two-in-the-morning click here and get you onboarded. Turns out that we have yet to really see the value in building a shopping cart system, where you can buy, “One consulting please,” and call it good. We're not quite at the level of productizing our offering yet and having conversations is a necessary part of what we do. But that also aligns with our customer expectation where there is not a general expectation in this industry that you can buy a full-on bespoke consulting engagement without talking to a human being. That, honestly, if someone trying to sell someone such a thing, I would be terrified.Ashleigh: Yeah, run screaming. Good Lord. No, exactly. And that's one of the reasons I love working with this team and I love this problem is because this isn't a quick, you know, download, install, and save, you know, save ten percent on your AWS bill by installing Duckbill Group. It ain't that simple. If it were that simple, like, AWS wouldn't have the market cap it does.So, that's one of the things I love. I love really meaty problems that don't have clean answers, and specifically have answers that look slightly different for everybody. I love those sort of problems. I've done the highly prioritized stuff: Click here, buy, get it on the free tier, and then it's all about up-sale, cross-sale as needed. Been there, done that; that's fun, and that's a whole different bucket of challenges, but what we're dealing with every single day on the consulting's of The Duckbill Group is far more nuanced and far more exciting because we're also seeing some truly incredible architecture designs. Like, companies who are really on the bleeding edge of what they're doing. And it's just really fun—Corey: Cost and architecture are the same thing in the Cloud.Ashleigh: —[crosstalk 00:22:59] that little—Corey: It's a blast to see it.Ashleigh: It's so much fun. It's, it's, it's… the world's best jigsaw puzzle because it covers, like, every single continent and all these different nuances, and you got to think about a ‘ephemerality,' which is my new favorite word. So…Corey: It's fun because you are building a sales team here, which opens up a few interesting avenues for me. For one, I don't have to manage and yell at individual salespeople in the same way. For example, we talk about it being a process and not a person thing. We're launching some outbound sales work and basically, having the person to talk to about that process—namely you—means that I don't need to be hovering over people's shoulders the way I felt that I once did, as far as what are we sending people? These passive-aggressive drip campaigns of, “Clearly, you don't mind lighting money on fire. If that changes, please let me know.”It's email eight in a sequence. It's no. This stuff has an implicit ‘Love, Mike and Corey' at the bottom of everything that comes out of this company, and it represents us on some respect. And let's be clear, we have a savvy, sophisticated, and more-attractive-than-the-average audience listening to all of these shows. And they'll eat me alive if we start doing stuff like that—Ashleigh: Oh, yeah.Corey: —not to mention that I find it not particularly respectful of their time and who they are. It doesn't work, so we have to be very conscious of that. The fact that I never had to explain that concept in any depth to you made bringing you in one of the easiest decisions we've ever made.Ashleigh: Well, I think it helped—I think in one of my interviews I went off on the ‘alligator email,' which is this infamous email we've all gotten, which is basically, like, you know, “Hi. I haven't heard from you yet, so I want to know which one of these three scenarios has happened to you. One, you're not interested in my product but didn't have the balls to email me and say that you're not interested. Two, you're no longer in this position, in which case, you're not going to read this email anyway. Or three, you're being chased by an alligator, and I should call animal control because you need help.” This email was—Corey: He, he, he, hilarious.Ashleigh: Ugh. And there's variations of it. And I've seen variations of it that are very well done and are on brand and work with the company. I've seen variations that could be legitimately, I think, great humor. And that's great.Humor in emails and humor in sales is fantastic. I have to shout out my friend, Jon Selig up in Canada, who actually, literally, does workshops on how sales teams can integrate humor into their prospecting. It's freaking brilliant. But—Corey: Near and dear to my heart.Ashleigh: —if you're not actually trained in that stuff, don't do it. Don't do the alligator email. But I think I went off on that during one of our interviews just because I was just sick of seeing these things. And what kills me, again, it comes back to the beginning, is people who have no training, no experience coming in—I mean, it really kills me, too, because there's a real concerted effort in the sales community to get more diverse people into sales to, kind of, kill the sales bro just by washing them out, basically. And so, we're recruiting hard with veterans, with black and other racial minority groups, LGBTQ communities, all sorts of things, and indigenous peoples.And so, we're bringing people that also are maybe a little bit more mature, a little bit older, have families they're supporting, and we're throwing them in a role with no support and very little training. And then they wash out, and we wonder why. It's, like, well, maybe because you didn't—it's, like, when I explain this to other people who aren't in sales, like, “Really, imagine coming in to being hired for a coding job, being told you're going to be trained on, you know, Ruby on Rails or C# or whatever it is we're currently using”—my reference is probably super outdated—but then, being given a book, and that's it. And told, “Learn it. And by the way, your first project is due in a month.” That's what we're doing in sales—Corey: For a lot of folks, that's how we learned in the engineering spaces, but let's be clear, the people who do well in that, generally have tailwinds of privilege at their back. They don't have headwinds of, “You suck at this.” It was, you're-born-on-third-you-didn't-hit-a-triple school-of-thought. It's—Ashleigh: Yeah.Corey: —the idea of building an onboarding pipeline, of making this stuff more accessible to people earlier on is incredibly important. One of my, I guess, awakening moments as we were building this company was it turns out that if you manage salespeople as if they were engineers, it doesn't go super well. Whereas, if you manage engineers like they're salespeople, they quit—rage quit—cry, and call you out as being an abusive manager.One of the best descriptions I ever heard from an advisor was that salespeople are sharks. But that's not intended to be unkind. It is simply a facet of their nature. They enjoy the hunt; they enjoy chasing things down, and they like playing games. Whereas, as soon as you start playing games with your engineers on how much money they're going to make this week, that turns out to be a very negative thing. It's a different mindset. It's about motivating people as whatever befits what it is that they want to be doing.Ashleigh: It is. And the other thing is it's a cultural conditioning. So, it's really interesting to say, you know, “People,” you know, “Playing games.” We do enjoy—there's definitely some enjoyment of the competition; there's the thrill of the hunt, absolutely, but at the same time, you want your salespeople to quit? Screw with their money.You screw with their money; we will bail so fast it'll make your head spin. So, it's like, people think, “Oh, we love this.” No, it's really more—think of it as we are gamblers.Corey: Yeah. To be clear when I say, “Playing games with money,” I'm talking about the idea of, “Sell to a company in this profile this quarter, and we'll throw a $5,000 bonus your way,” or something like that. It is if the business wants to see something, great, make it worth the sales team's while to pursue it, or don't be surprised when no one really cares that much about those things—Ashleigh: Exactly.Corey: It's all upside. It is not about, “He, he. And if you don't sell to this weird thing that I can't really describe effectively to you, we're going to cut your bet—” Yeah, that goes over like a lead balloon. As it should. My belief is that compensation should always go up, not down.Ashleigh: Yeah. No, it should. Aside from that, here's a fun stat—I believe this came out of Forrester, it might've been out of [Topel 00:28:54]; I apologize, I don't remember exactly who said this, but a recent study found that less than 68 percent of sales reps make their quota every month. So, imagine that where if you're—we have this thing called OTE, which is On Target Earnings. So, if you have this number you're supposed to take home every month, only 68 percent of sales reps actually do that every month.So, that means we live with this number as our target, but we're living and budgeting anywhere from 30 to 50 percent below that. And then hoping and doing the work that goes in there. That's what we've been conditioned to accept, and that's why you end up with sales reps that use terms like ‘shark' and are aggressive and are in your face and can get—[unintelligible 00:29:30]—Corey: I didn't realize it was pejorative.Ashleigh: I know. No. But here's the thing too, but somebody called it ‘commission breath,' which I love. It's, like, you can smell commission breath coming off us when we're desperate. You totally can. It's because of this antiquated way of building commissions.And this is something that I—this was really obvious to me, and apparently, I was a little bit ahead of the curve. When I started designing comp plans, everyone told me, “You want to design a comp plan? Tie it to what you want them to do very specifically.” So, if you want them to move a pen, design a comp plan that they get a buck when they put the pen from the heel of your hand to the tips of your fingers. Then they get a buck. And then they can do that repeatedly. That's literally how I was taught design comp plans.In my head, that meant that I need to design it in such a way that it's doable for my team because I don't want my team worrying about how they're going to put food on the table while they're talking to a client because they're going get commission breath and it'll piss off the client. That's not a good client experience; that's not going to lead to good performance. Apparently—Corey: Yeah. My concern as a business owner has nothing to do with salespeople making too much money. In fact, I am never happier than I am than paying out commissions. The concern, then, therefore has to become the, “Okay, great. How do I keep the salespeople from being inadvertently incentivized to sell something for $10 that costs me $12 to fulfill?”It's a question of what behaviors do you incentivize that align what they're motivated by with what the company needs. And very often getting that wrong—which happens from time to time—is not viewed as a learning experience that it should be. But instead, “They're just out to screw us.” And I've seen so many company owners get so annoyed whenever their salespeople outperform. But what did you expect? That is the positive outcome. As opposed to what? The underperforming sales rep that can't close a deal? Please.Ashleigh: Well, no. And let's think about this too, especially if it's tied to commission and you're paying out commission. It's, like, okay, commission is always some, sort of, percentage—depending on a lot of things—but some sort of percent of what they're bringing in. If you design a comp plan that has you paying out more in commission than the sales that were earned to bring it in, that's on you; you screwed up. And you need to either be honest and say, “I screwed up; I can't pay this,” and know that you're going to lose some sales reps, but you won't lose as many as if you just refuse to pay it.But, honestly, and I'm not even kidding, I know people. I've worked at a company that I happen to know did this. That literally fired people because they didn't have the money to pay out the commission. And because they fired them before the commission was due to be paid out, then that person no longer had a legal claim to it. That's common. So, the commission goes both ways.Corey: To be clear, we've never done that, but I also would say that if we had, that's a screaming red flag for our consultancy, given the nature of what it is that we do here. It turns out that when we're building out comp plans, we model out various scenarios. Like, what is the worst way that this could wind up unfolding? And, okay, some of our early drafts it's, yeah, it turns out that we would not be able to pay salaries because we wound up giving all of that in commission to people with uncapped upside. Okay, great.But we're also not going to cap people's commissions because that winds up being a freaking problem, so how do we wind up motivating in a way that continues to grow and continues to incentivize the behaviors we want? And it turns out it's super complicated which why we brought you in. It's easier.Ashleigh: Yeah, it's a pain. But the other side of this too, I think, is there is another force at play here, which is finance. A lot of traditional finance modeling is built around that 50 to 70 percent of people hit commission. So, if all of the sudden, you design a comp plan such of a way that a hundred percent of the team is hitting commission, finance loses their shit. So, you have to make sure that when you're designing these things, one of the things I learned, I learned the hard way—this is how I learned that not everyone does it this way—I built my first comp plan; my team's hitting it.My team's overperforming, not a ton, but we're doing really well. All of the sudden, I'm getting called to Finance and getting raked over the coals. And they're like, “What did you do?” I'm like, “What do you mean what did I do? I designed a comp plan; we're hitting goal. Why are you mad?” “Well, we only had this much budgeted for commission.”And I was, like, “That's not my fault.” “Well, that's what historic performance was.” “Okay, well that's not what we're going to do going forward. We're going to do this.” And they're like, “Oh, well, you need to notify us if you're going to change it like that.” And I was, like, “Wait a minute. You modeled so that my team would not hit OTE?” “Yes.” “That's how you've always done this?” “Yes.” “Okay. Well, that's not what we're going to do going forward, and if that's a problem, I'll go find a door.” Because, no.Especially when we're talking about people who are living in extremely expensive areas. I spent most of my career living and working in San Francisco, managing teams of people who made less than six figures. And that's rough when you're paying two grand in rent every month. And 60 percent of your pay is commission. Like, no. You need to know that money's coming.So, I talk about modern sales a lot because that's what I'm trying to use because there's Glengarry Glen Ross, kind of, Wolf of Wall Street school, which is not how anyone behaves anymore, and if you're in an environment that's like that or treats your salespeople like that? Please leave. And then you've got modern sales, which is all about, “Okay, let's figure out how we can set up our salespeople to be the best people they can be to give our clients the best experience they can.” That's where you get top performance out of, and that's where you never run into the terrible emails with the alligators, and the, “Clearly you like lighting piles of money on fire.” That's where you don't get emails to Corey Quinn asking him if he's interested in coming to work for AWS, the book company.It's by incentivizing the people and creating good humans where they can really thrive as salespeople and as people in general. The rest comes with time. But, it's this whole, new way of looking at things. And it's big, and it's scary, and it costs more upfront, but you get more on the back end every single time.Corey: Not that you care about this an awful lot, but you have your own podcast that talks about this, The Other Side of Sales. What inspired you to decide, not just to build sales teams through a different lens, but also to, “You know what? I'm going to go out and talk into microphones through the internet from time to time.” Which, let's be clear, it takes a little bit of a certain warped perspective. I say this myself, having done this far too often.Ashleigh: Yeah. No, it's a fun little origin story. So, I'm a huge Star Trek geek; obsessive. And I was listening to a Star Trek podcast run by a couple of guys who are a little bit embarrassed to run a Star Trek podcast, called The Greatest Generation. Definitely not safe for work, but a really good podcast if you're into Star Trek at all.And they always do, kind of, letters at the end of the shows. And one of the letters at the end of the show one day was, “Hey, I was really inspired by you guys and I started my own podcast on this random thing that I am super excited about.” And I'm literally driving in the car with my husband, and I'm, like, “Huh. I don't know why I'm not listening to sales podcasts. I listen to enough of these other random ones.” Jumped online, pulled up a list of sales podcasts, and I think I went through three or four articles of, like, every sales podcast that was big. And this was, like, January of 2019.Corey: “By Broseph McBrowerson, but Everyone Calls Him ‘Browie.'” Yeah.Ashleigh: Literally, there was, Conversations with Women in Sales with the late, great—with the amazing Lori Richardson, who's now with it, but she took over for a mentor of mine who passed in 2020, sadly. But there was that, and then there was one other that was hosted by a husband-and-wife team. And that was it out of, like, 30 podcasts. And [laugh] so it was this moment of, like, epiphany of, like, “I can start my own podcast,” and, “Oh, I probably need to,” because, literally, no one looks or sounds like someone who I would actually want to hang out with ever, or do business with, in a lot of cases. And that's really changed. I'm so grateful.But really, what it came down to was I didn't feel there was a podcast for me. There wasn't a podcast I could listen to about sales that could help me, that I felt like I identified with. So, I was, like, “All right, fine. I'll start my own.” I called up a friend, and she was, literally, going through the same thing at the same time, so we said, “Screw it. We'll do our own.”We went full Bender from Futurama. We're like, “Just screw it; we'll have our own podcast… with liquor… and heels… and honest conversations that happens to us every day,” and random stuff. It's a lot of fun. And we've gone through a few iterations and it's been a long journey. We're about to hit our hundredth episode, which is really exciting.But yeah, we're—The Other Side of Sales is on a mission to make B2B sales culture truly inclusive so everyone can thrive, so, our conversations are all interviews with amazing sales pros who are trying to do amazing things and who are 90—I think are over 90 percent—are from a minority background, which is really exciting to, kind of, try and shift that conversation from Broseph McBrowerson. Our original tagline was the ‘anti-sales bro' podcast, but we thought that was a little too antagonistic. So…Corey: Yeah, being a little too antagonistic is, generally, my failure mode, so I hear you on that. I really want to thank you for taking so much time out of your day to speak with me. Because—well, not that I should thank you. It's one of those, I should really turn around and say, “Wait a minute. Why aren't you selling things? Why are you still talking to me?” But no—Ashleigh: No, I'm waiting for you to say, “Back to work.”Corey: Do appreciate your—exactly. I think that's a different podcast. Thank you so much for your time. If people want to learn more, where's the best place to find you?Ashleigh: Well, definitely please go check out duckbillgroup.com. We would love to talk to with you about anything to do with your AWS bill. Got a ton of resources on there around how to get that managed and sorted.If you're interested in connecting with me you can always hit me up at—I'm on Twitter @ashleighatwork, which is another deep-cut Star Trek reference, or you can hit me up at LinkedIn. Just search Ashleigh Early. My name is spelled a little weird because I'm a little weird. It's A-S-H-L-E-I-G-H, and then Early, like ‘early in the morning.'Corey: And links to all of that will wind up in the [show notes 00:39:11]. Thanks so much for your time. It's appreciated.Ashleigh: This has been fun; we'll do it again soon.AndIf your AWS bill keeps rising and your blood pressure is doing the same, then you need The Duckbill Group. We help companies fix their AWS bill by making it smaller and less horrifying. The Duckbill Group works for you, not AWS. We tailor recommendations to your business and we get to the point. Visit duckbillgroup.com to get started.Announcer: This has been a HumblePod production. Stay humble.

Thrilled to introduce y'all to Lizzetth Bellot, the director of people operations at Light. Lizzetth has worked at companies like Curai, Dropbox, FireEye, and Facebook. She went back to school as a single mom to get her bachelor's and master's degrees and has worked in Silicon Valley since. We talk about the importance of networking, the example she's set for her daughter, and her goal to help women whose path may be different from the norm.Connect with her here: https://www.linkedin.com/in/lizzetthbellot/

Security companies typically start by focusing on one particular problem, but the biggest ones like Palo Alto Networks, FireEye and Symantec have shifted to a horizontal approach typically gaining functionality over time through acquisition.

Rick discusses if the first principles theories prevent material impact in the real world, such as the latest SolarWinds attack. Previous episodes referenced: S1E6: 11 MAY: Cybersecurity First Principles S1E7: 18 MAY: Cybersecurity first principles: zero trust S1E8: 26 MAY: Cybersecurity first principles: intrusion kill chains. S1E9: 01 JUN: Cybersecurity first principles - resilience S1E11: 15 JUN: Cybersecurity first principles - risk S2E3: 03 AUG: Incident response: a first principle idea. S2E4: 10 AUG: Incident response: around the Hash Table.  S2E7: 31 AUG: Identity Management: a first principle idea. S2E8: 07 SEP: Identity Management: around the Hash Table. Other resources: “A BRIEF HISTORY OF SUPPLY CHAIN ATTACKS,” by Secarma, 1 September 2018. “Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers,” by 365 Defender Research Team and the Threat Intelligence Center (MSTIC), Microsoft, 18 December 2020. “A Timeline Perspective of the SolarStorm Supply-Chain Attack,” by Unit 42, Palo Alto Networks, 23 December 2020. “Cobalt Strike,” by MALPEDIA. “Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon,” by Kim Zetter, Published by Crown, 3 June 2014. “Cybersecurity Canon,” by Ohio State University. “FireEye shares jump back to pre-hack levels,” Melissa Lee, CNBC, 23 December 2020. "Implementing Intrusion Kill Chain Strategies by Creating Defensive Campaign Adversary Playbooks," by Rick Howard, Ryan Olson, and Deirdre Beard (Editor), The Cyber Defense Review, Fall 2020. “Orion Platform,” by SolarWinds. “Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers,” by Andy Greenberg, Published by Doubleday, 7 May 2019.  “Solarstorm,” by Unit 42, Palo Alto Networks, 23 December 2020. “The Cybersecurity Canon: Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon,” by Rick Howard, The Cybersecurity Canon Project, 28 January 2015. “Using Microsoft 365 Defender to protect against Solorigate,” by the Microsoft 365 Defender Team, 28 December 2020.

We know that cybersecurity presents a huge risk to us both personally and professionally, but what can we do to stay safe? To answer this question I spoke with cybersecurity expert Raj Samani, who at the time of recording was Chief Scientist at McAfee, and is now at Rapid7 on the Actionable Futurist Podcast®.As an international cybercrime expert, Raj has assisted multiple law enforcement agencies in cybercrime cases, and is a special advisor to the European Cybercrime Centre and is on the advisory councils for Infosecurity Europe and Infosecurity Magazine.Cybersecurity threats now have the potential to completely cripple companies and complete supply chains and my discussion with Raj is accessible to audiences of all types, and contains advice for a board of directors, right down to students considering their career options.In this wide-ranging discussion, we covered topics including:Cybercrime in a pandemic worldHow cybercrime has evolvedHow supply chains are now a targetThe Log4j vulnerability and what it meansAre boards taking cyber threats seriously?Making the board uncomfortable about the risksContextualising why cybersecurity mattersCan AI help fight cybercrime?Actionable advice to keep safeHow much security do you need?The industries most at riskNation-states running social media campaignsWhat the FireEye acquisition means for McAfee Criminals now have R&D departmentsIoT and APIs as the next threat areas?Children's toys are getting hackedPutting security at the heart of designBletchley Park's role in cybersecurityThe hot roles in cybersecurityTop 3 cybersecurity trendsDo companies need a dedicated Chief Security Officer?3 things to do today to stay safeRaj provides us with actionable and practical advice on what to do this week to reduce your exposure.Make 2022 the year you lean forward and take cybersecurity seriously.More on RajLinkedInTwitterMcAfee EnterpriseRaj's BlogsResources mentioned on the showHave I Been Pwned? websiteSpeakers for Schools websiteNoMoreRansom.orgThe Cuckoo's Egg bookApplied Cyber Security and the Smart Grid bookDave Grohl BiographyBletchley ParkYour Host: Actionable Futurist® Andrew GrillFor more on Andrew - what he speaks about and replays of recent talks, please visit ActionableFuturist.comfollow @AndrewGrill on Twitteror @andrew.grill on Instagram.

Tim Sullivan, co-founder and co-CEO of CaveonixTim Sullivan is the co-founder and co-CEO of Caveonix, the first hybrid cloud security platform. Tim has a 20-year track record of building emerging technology companies, specializing in cybersecurity. In 2017, he co-founded Caveonix with Kaus Phaltankar. Previously, as CEO of nPulse Technologies, Tim leveraged his industry knowledge and relationships to lead the company from a focus on providing packet capture technology to a position in cybersecurity as the premier provider of network forensics for the world's fastest networks. nPulse products are used by the U.S Intelligence Community, leading Wall Street banks, and Tier 1 telco providers. In May 2014, FireEye purchased nPulse.Prior to nPulse, he founded and was CEO of Fidelis Security Systems (now Fidelis Cybersecurity), another leading cybersecurity company, where he was a key player in the development of the data leakage prevention (DLP) market. In August 2012, General Dynamics purchased Fidelis.Tim is a former U.S. Marine Corps Infantry Platoon Commander. He holds both a BA and an MBA from Columbia.

FireEye COO explains exactly how the big break up will happen in cyber security (FEYE). A big privacy decision by Google means big profits for Criteo and others (CRTO).  RiteAid struggles to find enough sick people (RAD). KB homes explains why there's a limit to how much housing prices can rise (KBH). The Drill Down with Cory Johnson offers a daily look at the business stories behind stocks on the move. Learn more about your ad choices. Visit megaphone.fm/adchoices

Uber's (UBER) big bet on delivery pays off in the pandemic. But now what? James Cakmak of Clockwise Capital explains. FireEye (FEYE) divides itself in two and shows just how different cybersecurity companies can be. Splunk (SPLK) finds that margins aren't so puffy in the cloud. Ciena Corporation (CIEN) looks to take advantage of a global concern about China and Huawei. The Drill Down with Cory Johnson offers a daily look at the business stories behind stocks on the move. Learn more about your ad choices. Visit megaphone.fm/adchoices

Is Virgin Galactic (SPCE) a zero-gravity zero? James Rasteh of Coast Capital says they should cease operations. Cybersecurity giant FireEye (FEYE) poised to help the White House fight cyber terrorists. Behind the successful turnaround of Contango Oil & Gas (MCF). A troubled blood company Haemonetics Corporation (HAE) fails to reassure investors or customers. The Drill Down with Cory Johnson offers a daily look at the business stories behind stocks on the move. Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode we explore supply-chain security with Manish Gupta. We're going to learn about risks and cyberattacks related to the continuous integration/continuous deployment or CI/CD pipeline, which, given high-profile attacks like SolarWinds, will give us plenty to discuss this week!0:00 - Intro2:21 - Manish's origin story4:58 - Major career stepping stones8:45 - Lessons when ahead of the curve11:21 - Average day as a servant leader CEO14:54 - Concerns with supply chain security21:22 - Federal supply chain action26:20 - What supply chain policy should focus on28:40 - Skills needed for supply chain jobs32:48 - What should be on my resume? 34:03 - Showing supply chain aptitude 36:04 - Future projects38:29 - OutroHave you seen our new, hands-on training series Cyber Work Applied? Tune in every other week as expert Infosec instructors teach you a new cybersecurity skill and show you how that skill applies to real-world scenarios. You'll learn how to carry out different cyberattacks, practice using common cybersecurity tools, follow along with walkthroughs of how major breaches occurred, and more. And it's free!– Learn cybersecurity with our FREE Cyber Work Applied training series: https://www.infosecinstitute.com/learn/– View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcastManish Gupta is the founder and CEO of ShiftLeft, an innovator in automated application security and the leader in application security for developers. He previously served as the chief product and strategy officer at FireEye, where he helped grow the company from approximately $70 million to more than $700 million in revenue, growing the product portfolio from two to more than 20 products. Before that he was vice president of product management for Cisco's $2 billion security portfolio. He also served as a  vice president/general manager at McAfee and iPolicy networks.Manish has an MBA from the Kellogg Graduate School of Management, MS in engineering from the University of Maryland and a BS in engineering from the Delhi College of Engineering.About InfosecInfosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with  skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It's our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

From working the help desk to becoming FireEye's Chief Security Strategist and founding his own company Kolide, Jason Meller has a wealth of experience to share about moving up the cybersecurity ladder. On today's episode, he discusses his security journey, including working one of the best help desk jobs of all time, bluescreening his friends in the Wild West days of the Internet and sharing advice for up-and-coming cybersecurity professionals.0:00​ - Intro 2:22​ - Pixar movie Soul and finding his "spark"6:40​ - The Wild West of cybersecurity7:56​ - Working at the best help desk ever12:13​ - Becoming a cyber threat analyst18:02​ - The importance of soft skills21:23​ - Becoming a chief security strategist at FireEye24:38​ - Working solo vs in a team25:55​ - Adding a new superpower with your talents28:03​ - Should you leave your job?31:10​ - Exploring the psychology of security36:34​ - Security veterans and mentorship40:30​ - What is Kolide?44:30​ - The new work/life balance of security46:40​ - OutroHave you seen our new, hands-on training series called Cyber Work Applied? Tune in as expert Infosec instructors teach you a new cybersecurity skill and show you how that skill applies to real-world scenarios. You'll learn how to carry out different cyberattacks, practice using common cybersecurity tools, follow along with walkthroughs of how major breaches occurred, and more. And it's free! Click the link below to get started.– Learn cybersecurity with our FREE Cyber Work Applied training series: https://www.infosecinstitute.com/learn/ – View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcastJason Meller is the CEO and founder of Kolide. Jason has dedicated his career to building products and tools that enable security experts to successfully defend western interests from sophisticated and organized global cyber threats. He started his security and product career at GE's elite computer incident response team, led by Richard Bejtlich (the father of modern network security monitoring). From there, Jason moved to the legendary Mandiant corporation (acquired by FireEye) quickly working his way up from an entry level analyst position to becoming the Chief Security Strategist. As Chief Security Strategist at FireEye, Jason was responsible for rapidly building products and services with an engineering strike team to facilitate and grow high-profile partnerships and key strategic initiatives.About InfosecInfosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It's our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

In this episode I talk about to former FBI Special Agent and current FireEye senior manager Rob Schuett on the blending of cyber and human intelligence tradecraft by our nation-state foes. Rob and I discuss some big cases he worked on, including the Su Bin case where a Chinese actor was arrested and convicted of stealing some critical defense-related technology and how he did this despite reluctance by his own office management.  If you have questions or comments on this, or any other podcast, email me at darren@thecyburguy.com, or find me on LinkedIn at www.linkedin.com/in/darrenmott