This podcast episode elucidates the critical importance of effective communication and leadership within the realm of cybersecurity. We engage in a profound discussion with JC Vega, who shares his extensive background in both operational security and cybersecurity, emphasizing the necessity of translating complex technical concepts into relatable business language. We explore the pivotal role of leaders in fostering a secure organizational environment, underscoring that cybersecurity is not merely an IT concern, but an enterprise-wide imperative that encompasses every facet of an organization's operations. The conversation further delves into strategies for empowering champions within organizations to advocate for security practices, thus ensuring that everyone understands the significance of their roles in safeguarding the enterprise. Ultimately, we aspire to convey that a collaborative, informed approach is essential in navigating the complexities of today's security landscape, thereby enhancing both individual and organizational resilience.

In this episode, cybersecurity expert JC Vega shares insights on effective communication, leadership, and risk management in cybersecurity. He emphasizes the importance of translating technical concepts for business leaders, building trust, and fostering community to enhance organizational resilience.

keywords

cybersecurity, leadership, risk management, communication, trust, community, organizational resilience, cybersecurity education

keytopics

• Translating cybersecurity for non-technical audiences
• Building champions within organizations
• The importance of trust and verification in security
• Cybersecurity as an enterprise survival issue
• Leveraging AI and technology responsibly

sound bites

"Validate and verify, don't just trust."

"Train like it's a Super Bowl."

"Leave a link, build a community."

Chapters

00:00 Introduction to Cybersecurity Leadership

02:34 Translating Cybersecurity for Non-Technical Audiences

05:13 Building a Team of Champions

08:02 Understanding Business Impact and Risk

10:39 The Role of AI in Cybersecurity

12:58 Cybersecurity as an Enterprise Survival Problem

15:21 The Importance of Ecosystem Relationships

18:00 Trust and Zero Trust in Cybersecurity

20:28 Continuous Learning and Community Engagement

resources

Cyber Cannon Project - https://cybercannonproject.org/

B-Sides Conferences - https://www.bsidescon.org/

LinkedIn Profile of JC Vega - https://www.linkedin.com/in/jcvega/

Takeaways:

• The podcast emphasizes the necessity of translating complex cybersecurity concepts into practical business language for effective communication.
• I believe that strong relationships with champions within organizations are crucial for cybersecurity success and operational resilience.
• Our discussion highlights the importance of understanding the operational goals of various stakeholders to better address their cybersecurity needs.
• We advocate for the continuous evolution of skills and knowledge within the cybersecurity field through collaboration and community engagement.

Hello, everyone.

Welcome back to another episode of the Security By Default podcast.

I'm the host of the show, Joe Carson, and it's great to be back here with you all again.

Favorite time of the week?

Favorite time is to get to talk to so many amazing people and people that I really admire and look up to in order to help me become knowledgeable, to give me lessons, and to really kind of help make the world a safer place, which is my passion.

We live in a bit of a world of chaos, and this podcast is all about bringing clarity and visibility and making sense out of the chaos that's there.

So welcome to the podcast.

JC Vega, do you want to give the audience a bit of a background about yourself, your origin story, how you got into the industry, and some fun things about yourself?

Sure.

Well, thanks for having me, Joe.

You're one of my favorite people I like to interact with.

Every time I'm out and about, I always look for where is Joe Carson so that I could connect with him.

And you should, too.

So.

So with my background, it's an interesting background.

Like everybody who's been in cybersecurity for more than 20 or 30 years, you did not start in cybersecurity.

I started somewhere else.

I started in operations and security, both in law enforcement as well as in the Army.

And a lot of the times when I was doing the operational side of security, I was also geeking on the side.

And so at one point, the military said, we need people who are technically smart but.

But also understand operations.

So cybersecurity picked me and said, we need to teach you everything about cybersecurity.

So after many, many years of study and practice, here's where I am now.

Advising and putting to practice 30 years of experience to enable organizations and individuals to live a more secure, have a more secure operation and live a more secure life.

Fantastic.

And that's what this, this episode's all about is, is really that leadership side of things is.

And, you know, how to communicate, how to advise what's.

What's the make, motivate people to take action.

And so for me, you know, that's one of the great things and sometimes that we've been missing in this industry for so long, we always used to take it from a very technical aspect of things.

We used to try and try to explain technical complexity to those who were basically driving the car or those who were steering the business and making critical decisions financially, and that sometimes it didn't work very well.

And we did need to bring in those with.

With knowledge that can really translate those properly into what does it mean for the business, what does it mean for the employees or the actually industry?

So it's great that the industry looked at people who could actually do that proper translation to really make sense of, you know, all of these technical complexities.

Do you want to give kind of.

So what's, what's some of the best ways, what's some of your best practices or tips that you use in order to translate?

How do you approach it?

If you're speaking to somebody who knows nothing, let's say, about cybersecurity, what, what's the, what's the pro approach that you take?

You know that that's a, a great.

Question because that is one of the roles of a cyber security professional.

It's to meet your customer, your public, your audience, where they are, not bring them to your side of it.

And so with that, when I'm speaking with different audiences, depending if it's a board or, you know, an elder who is a victim of fraud, I don't talk cybersecurity, I talk risk.

I talk operational goals.

The goals of the company, how to protect yourself from this particular type of threat that uses the Internet, that uses your own tools against you.

And I help them to navigate that.

But it all translates back to what is it that you're trying to accomplish for them, what is it that they want?

And using my skillset and my background and my expertise, how do I leverage that to achieve their goals?

And it's never just cybersecurity.

There's multiple aspects.

There's physical security, there's behavior, there's best.

Business practices and such.

So again, I, I try to stay.

Away from the word cyber.

I try to stay away from any technical experience because if they learn the technical aspect of cybersecurity, it is not.

Going to make them any soon.

Absolutely.

I think it's really coming down to is really understanding about what's their motivation, how do they get measured successfully?

Because I don't, I don't think we're going to make everyone in the world a cybersecurity professional.

I don't think that's what our goal or aim to do is, is to make bring everyone up to that level.

It's really to understand about what things do they do, how do they perform their job, what's the risky parts of that job.

And then how do we put, you know, embed cybersecurity into behind the scenes so it doesn't have to be so complex.

In the foregr, there was a lot.

Covered in that last question you have there.

So let me break it down in a couple of pieces.

First of all, who cares?

Who are your champions?

Who are the people that the message is going to resonate with?

That's what I call your champions.

Within your organization or within your ecosystem, those are the people that you want to enable, you want to empower, because they're going to be the messengers of whatever it is you're trying to do.

Now, what I'm telling you is not something that's unique to CyberSecurity.

It's Leadership 101.

You find those that the message resonates with and empower them to bring the rest of the team along.

Because you can't do it all as a leader.

So that's.

That's part of it, is find who your champions are within your organization, both above and below you.

If the chairman of the board is not a champion, it's going to be a lot harder to convince that board to take action.

If the CEO is not a champion, it's going to be a lot harder.

But if they are, it's going to be a priority for the organization.

But that goes down to every part of the organization.

Another thing I look at is who in that ecosystem can help you.

And they're not just IT people.

They're people who are involved with the general goal of keeping the business running.

It could be the cfo, it could be the operations officer.

So don't think of this as an IT and cybersecurity problem that the IT people have to solve.

So that's a part about building that team champions, that team of leaders within the organization.

Another part is the tone and the language you use.

Again, I talk cybersecurity.

I talk.

What is it that I'm protecting?

I'm protecting the business, protecting the operation.

I'm protecting your assets.

I'm protecting your lifestyle.

I am not doing any of this so that I can secure the computer.

None of it is to secure the computer.

Securing the computer is an important part of that.

But my end state is not to have a secure computer.

It's to have a secure operation that is less vulnerable and more resilient in case an attack does manifest.

So that's another aspect.

Explain the why is this is what I'm doing so you can do this.

Not the how necessarily by locking down your computer.

What is that?

What's the what's the outcome of that?

What.

What is the.

Yes.

What's.

What's.

If.

If that computer wasn't running, what's the impact of the business because of that.

That's exactly right.

And then it becomes.

What's.

What's the priority of that?

And how do you.

So now, now we're talking at the very high level, at the operational level.

If that computer is down for a day, the cfo, the chief financial officer, will probably tell you exactly how much it's going to cost.

Not if the computer's down, but.

But if the operation is down for a day, it doesn't matter if it's the computer.

It doesn't matter if it's a piece of equipment failed.

Understand that.

And they understand how to fix that.

If you tell them what you What.

What the possibilities are and what the outcome may be and what the alternative is if you don't fix it.

The fear, uncertainty and doubt, the fud.

It didn't work when we were learning how to drive.

It doesn't work today.

Many people around us still speed.

Many people around us still break the law when they're driving.

It doesn't work.

But you had an excellent point.

But when it happens to you, when you get that ticket, or if you're paying insurance for a family and somebody in that family gets that ticket, boy, it's really going to matter then.

And those are individuals who are going to get it.

But you have to reinforce the behaviors.

This behavior will have this outcome.

This behavior may have a negative outcome.

The idea is what is the desired behavior that you're looking for?

And so what's important for that is that.

Notice I didn't say protecting your computer is the goal.

That is not the goal.

The goal is to protect your business, to protect your assets, to protect your lifestyle, to give you the ability to.

We call it freedom of maneuver.

To do what you need to do as a business without having your IT infrastructure, your unsecure infrastructure holding back your operation.

But there's a couple key terms you want to use at certain levels.

So at the board, you want to use a term fiduciary duty.

That means it's your.

It's your specific responsibility.

And you could be held liable if you don't take the prudent measures to do something, to prevent.

To know it, where you know something is, has a high likelihood of happening and has a high impact and you choose to ignore it, you can be held accountable for that.

And there's a.

A lot of talk recently on bringing that type of expertise at a very senior level of organizations, but I'm sure we'll get into that.

Absolutely.

Yeah.

It kind of resonates a lot with me because some of my most biggest champions in a lot of executives was the CFO because they understood the financial quantifiable risk approach.

And they were actually some of the best people to help me translate technical IT issues into quantify quantifiable risk because they're able to do the maths.

And I think that's what's crucial as well.

The other one that was a big champion was operations.

You know, when you're talking about new downtime because they are measured by basically the uptime of the services that they're providing.

And any type of downtime had a financial impact to their business.

So, so for me, looking at those, it was the two biggest champions to be able to help translate into what you're doing into that business outcomes.

And that's crucial that, that's because that's ultimately it's, it's.

You're absolutely right.

And I remember years ago talking to the Estonian government, we were selling them, you know, next generation, you know, firewalls and EDR and stuff.

And they said, well, you'd like, you know, you know, we were talking about software defined networks.

That was the big topic at the time.

And they said, no, we do services, we look at everything from a service and they do that whole supply chain, you know, what is that total service end to end and what's all the critical components of that service.

And that was the big thing was that, you know, it's not just about this individual piece of software or piece of hardware, hardware application.

It's how do all of those interact to deliver a service to the citizen.

And that was the big thing.

It was, for me, it was a big realization about that.

I'm not in the world of protecting IT systems anymore.

It's in the world of protecting businesses and society.

And that's how we should be actually, you know, measuring.

And I really kind of.

You're absolutely.

On how you communicate is so vital.

And I think absolutely when it gets to responsibility, executives do really need to think about, you know, and it's important to get sign off as well.

They need to be involved.

They can't just delegate security decisions to a ciso.

Otherwise the CISO becomes accountable.

They need to delegate it and be responsible at the executive level as well.

No, that's absolutely right.

And one thing that when I look at organizations or organizational structure, where the CISO lies in that hierarchy varies by organization.

And we can argue back and forth on where is the right place for that individual and that expertise.

And there's plenty of right ways and wrong ways to do that.

But the most important part of that is that that individual should have a direct line to the senior leadership when it's necessary to use.

Because if it's not established in advance, you're going to have a hard time influencing a decision.

It doesn't mean you always have to have that face to face.

But it should be at a regular cadence.

That is builds enough trust in your assessment and your evaluation where they will take you seriously.

And that's the part that I say you respond at the speed of trust.

In a crisis, you respond at the speed of trust.

If I need you and I don't trust you, I may be hesitant in how react where in our space, time really does matter.

And delaying decisions can have a significant impact.

Which brings us to, you know, the hot term of the day.

AI.

Yep.

AI is a fantastic tool that is accelerating innovation.

And if you're not using it, you are likely falling behind your competitors.

And no matter what you do, if you're secure and non competitive, you're, you're going to, you're going to, you're not going to exist.

That being said, AI is also accelerating the attacker.

So you have to take both into account as the organization is making these decisions to use AI, you have to communicate to them what the risk of that is at the pace that they're doing and they, what they have to account for.

And AI is not a magic box anymore.

There are things, there's a lot of controls you can put in place to protect your organization.

There's a lot of best business practice that have emerged and the idea is that you as a security person have to bring that risk up to the level of the decision makers so that they have the right information and that it, the risk they're accepting matches their risk appetite.

And so those two have to converge.

But you notice when I talked about risk, I talked about fiduciary responsibility.

I'm not talking about cyber, even though in my background it's all cyber.

What I can add to the fight to protect them, to allow them to provide them the COVID to allow them to accelerate the business.

But these conversations are happening in parallel.

I just happen to be the cybersecurity part of that.

But I also have to work with my partners because cybersecurity is not an unlimited budget.

If you have an unlimited budget, I want your job, I want to be in that.

But there are limits to what you can do both in time and money and how it's going to impact the operation.

So the idea Is you have to work with your partners across your organization and they have to see cybersecurity is providing them a competitive advantage.

We mentioned the cfo, we mentioned the operations team.

One that I like to bring in is the CRO, the chief revenue officer and the business development team and the marketing team.

So what distinguishes my product or my service from my competitors?

I'd like to think that my security posture, all things being equal, you're accepting less risk from me than you are from a competitor.

Absolutely.

When you can think about it as well as, you know, for organizations choosing their next, you know, partner regarding technology, they want to make sure that whatever their lifespan is, whether that's a three year or five year or seven year, and even a lot of, you know, in the big industries and things like shipping and others, that could be 15, 20 years that you're going to enter in a partnership and you want to make sure that that organization can sustain and has resiliency built in.

So they will be around for that 5, 7, 15 years.

So I think, you know, showing that they have thought about, you know, security as a resiliency and the ability to maintain operations for a long time, that's something that shows a competitive advantage.

You know, we look at the recent incident with Jaguar Land Rover and the financial impact, and not even to that organization and stopping production, but also to the point where it was even the community, the suppliers, those who were living day to day, you know, providing food for the employees, transportation, parts, and that whole disruption, I think it ends up actually having a massive impact, even a significant impact to the entire UK economy.

So it really shows that when your services are running, there is massive dependencies, supply chain.

And that having a secure, by, by design and by default approach can actually provide you a competitive advantage when it goes to new negotiations.

Contract and being a supplier, you bring.

Up two great points there.

One of them is that security is not an IT problem, it's an enterprise survival problem, meaning you have to look at the enterprise and that includes your ecosystem and that includes your suppliers.

And another part of that is that the systemic cyber risk means that the weakest partner can be your biggest threat.

So you have a vested interest to examine what are all the connections that can impact your operation.

We used to use a term, I'm sure it's still used in operations in the military.

We say you have your area of responsibility.

That is the area on a map or a particular task that you have complete control over.

You are responsible and accountable for everything that happens in your area of responsibility.

But you also have your area of interest.

Your area of interest is much larger than that.

That's all.

It's everything that can impact your area of responsibility.

So if you think about your supply chain is.

It's not just a physical supply chain.

How it can be interrupted is where is the software that is connecting with my software?

So it's pushing risk across on an automated level also that.

That's the software.

Now the data, how is the data being stored?

How is the data being shared?

Are my suppliers or my partners putting me at risk?

And so there's a lot of things you can do with that also.

But the idea is that you're taking this from a perspective of your organization is already compromised.

Design it as if it is, and now take the necessary measures to mitigate that risk so that you are more resilient, that in the face of an attack, you will survive the attack.

If you focus most of your resources on prevention.

And then the breach happens, the incident occurs, and you spent very little on the resilience and recovery.

That's like you spent all the money up to protect your, your town from the dam and the dam breaks and you have no recourse.

So you have to have the levies built in all along the way as if you are already compromised.

And that leads to the idea of, I don't like this part of our industry.

It's how we've kind of.

It is the right way to do it.

I don't like it though, how we look at trust.

Trust is something you earn.

Trust is something that's built over many handshakes, over many cups of coffee and tea and all those things that you do.

And it takes one incident to break it and then you lose it all.

But we look at trust as zero trust.

As we don't trust anything, we don't trust anyone.

And so very, very secure approach here.

I am telling.

I'm trying to build trust with you, trying to build trust with you.

And we say we don't trust anybody, which is actually the right way to do it.

It's just bad marketing.

I agree.

I hate the term.

You know, I prefer to, you know, think of it as, it's about zero assumptions.

You're assuming that certain security controls have not been satisfied.

So therefore you want to verify that the controls are in place.

I use validate and verify.

Yep, it's validation and verification.

Because you, you, when you take zero trust to the executive team or anyone who's in business, they're like, what they think of it more of a As a per, you know, as a friction, you're going to stop them from being able to do their job.

You know, it's great from a security terminology and what we're actually doing with it, but absolutely a marketing term.

It's horrible.

And that's, that's, that's for us cyber people to talk about.

Yes.

You don't talk about it.

So it's a poor choice of words because it communicates a message where a lot of half those people or most of those people receive their job based on trust.

Yes.

So they had to trust somebody or somebody trusted them.

But that doesn't take away from that idea.

If you got to validate and verify every I say entity, because it's not just every person, it's every process, every exchange, every data transfer.

You have to make sure that the right action is taking place by the right entity in the right environment at the right time.

You have to put all that together and you can't assume if, because if one of those pieces is unsecure, then you just compromise the entire system.

And back to your area of interest and your area of responsibility.

Think beyond your own organization.

What, what can impact your organization and what I challenge people to do whenever I have a, a one on one or, or a meeting or some type of consulting gig.

That's one of the things we, we finish with is who is in your ecosystem, who's in your area of interest.

When is the last time you spoke with them, when is the last time you reached out to them?

That includes your, your suppliers, that includes your vendors, that includes the people who are selling your product, that includes law enforcement, that includes your building manager.

All of these things that may impact your operation.

When is the last time you had a face to face with them?

Do you have, how quickly can you summon them and how fast will they respond?

And like I said earlier, you respond at the speed of trust.

If you don't develop that in advance, you are not going to be their priority.

You are not going to be in their area of interest.

And you want to make sure that you are in their area of interest as well.

Absolutely.

It reminds me of kind of a story from years ago doing a penetration test for a ship management company.

So a company responsible for managing the ship logistics and manifests.

And they had a leasing agreement with a building company who basically so they had offices, they didn't own the offices, but they had leased from the vendor and they were going through, they wanted to be more energy efficient, so they wanted to appear more green.

They went to the, the, the supplier said, we need you to be more of energy efficient.

We want to get these standards, we want to go back and we want to have a message that we are a green company.

So the building supplier or the building, you know, who was doing the lease went and they installed lots of smart meters and smart LEDs and bulbs and you know, so things that would be more energy efficient, that would turn off, shut off, you know, based on motion, based on people in the office, based on different times.

And they created a vulnerability.

So, and ultimately, so it was interesting kind of when you get into that, the dependency that, you know, one is it was their initiative but by not having that relationship about the actions they were taken to become more energy efficient that end up their supplier, their leasing company became a massive risk for their environment because it meant that attackers could simply just jump onto the light bulbs, onto their network and have access.

So it really means that you have to have an understanding about a good relationship.

And I think it's important.

One of the things, you know, I will say that we are, we're only as secure as the social sphere that we have around us.

And with the social sphere, it means that we have to understand those risks that you know, remember even a large organization transportation, they give the employees antivirus software and password managers for their home machines and their family members because they knew that actually security just didn't start from the office and didn't start with their employees laptops, but it started with their family.

And that's that same concept is understand your area of interest, as you say, the social sphere is where security starts and stops.

Now.

That's absolutely right.

So one of the largest contracts for antivirus that I was a part of was for the U.S. army.

And those licenses extended to the household because a lot of the work that people do is they do it at home and they bring it into work.

And at that time, I don't know what it's like today.

You didn't have the luxury of everybody having a computer, a personal computer.

So it was a, it was a bring your own device environment or you stayed at work all day, which we did anyway.

But the idea is that you extended that security and it wasn't for the sake of protecting the family, it was for the sake of protecting the work environment, the operational environment.

And that was an operational cost that was necessary because we know how the behavior is like.

And it was, it's going to be too difficult to change the behavior.

Instead you put those safeguards and the way people are already what they're already doing, just like a university, you know, that puts in the sidewalks all over to connect the campus.

The best execution of that that I've seen is first they see where the trails are being formed by the students, then they put the sidewalks over that.

Absolutely.

Instead of trying to direct the students onto sidewalks, you put the sidewalk where they're already going.

Yes.

You actually put it with a habit.

The habits, as you're trying to embed security into their cultural DNA, which is a lot looking at what the habits of people have.

That's right.

So question, bring it all together.

What, what's some of the.

Where do you get your resources to stay up to date, stay knowledgeable?

Because this is always an evolving industry.

Is there any books that you read or conferences that you go to that are very valuable events?

You also have the Weed weekly meetup, which is our monthly meetup, which is.

The weekly meetup every Wednesday night.

So when I bring executives together, practitioners, executives, influencers, senior people, and they're part of the field on national cybersecurity.

And we talk shop in a non vendor environment.

And the idea is what should we be, what should we all know?

And we do it in a very light format to replicate the meetups that happen at conferences because that's where you really get to exchange information and talk to your peers about what they, what they are seeing out there.

So we took that concept of after a conference, after a great presentation or not, not, you go to the hallway with your friends and peers and you talk about what they really liked and didn't like about that, where they were right, where they were wrong, without being critical of the topic.

The topic was a conversation starter.

And so the idea is we bring that on the.

On our weekly Wednesday from there.

I also am part of a book club, the Cyber Canon Project.

We evaluate books, cybersecurity books, and then we come up with a list of.

These are the top cybersecurity books that everybody should read.

So I do a lot of reading and I do a lot on Audible as well.

So I do it to them because I don't get anything for that.

But the idea is I was just going, I'll go through at least a book a month, sometimes two.

And I'm picking different subjects.

And don't be afraid to pick a book up.

You start reading it and you say I don't like it and put it down and go to another.

That's part of the process.

And what we do with the Cyber Canon is we do that for you and we say this is a must read book if you're in the discipline, or this is a niche book if you're in this part of the discipline.

So there's two sources.

I'm a news junkie.

I have my, my alerts set up key terms on different projects I'm working on and different organizations I'm following so that if they come up in the news, I get a feed for that.

I go to podcasts like yours that I'm able to get value deeper insight than just a cursory discussion on this topic.

That's, that's a two minute read it.

You get deeper insight on a podcast than you would on just reading an article.

And then with the book, like I said, it's even greater.

And then the one on one interaction or the face to face interaction on the weed RAM is another.

And I also take formal courses.

If there's something that, for instance, I've taught databases, I ran databases, I've worked with large data sets.

And sometimes what you learned 20 years ago, 10 years ago, starts to drift into new knowledge.

And so now it's, you know, data analysis, data science.

I don't say I'm a data analysis, a data analyst or data scientist, but I do work in that field.

So I'll take a course on that to sharpen my terminology so I understand it better.

And so in this field you have to be a lifelong learner.

In fact, if you have any kind of certification, it's an absolute requirement for you to do it.

And no one's going to tell you what to do.

But I just gave you about five.

Examples that are part of my weekly ingest of information and also give it back.

That's the big thing is with some of these forums I do a lot of speaking to a lot of groups and I give them back the knowledge so that they, not everyone has the time to keep up with everything.

So you have to rely on trusted individuals, back to that word, trusted individuals who are going to sift through the noise to get you the signal, the right information that's relevant to your organization now.

And you have to maintain a trusted network because if you see something and you hear something and you need to say something, sometimes you want to validate that.

And I have lots of people on speed dial that I'll call and say, have you seen this?

What about this?

How are you seeing this?

And that network also is a trusted network and you're a part of my network.

It's something that we go, you mentioned conferences, I the top conferences out there as far as quality and number of people is one that happens in San Francisco in the spring and one that happens to.

That happen in Las Vegas in the summer.

And there's a lot of other niche audiences.

One of my favorite ones is event called Corncon of all places, Davenport, Iowa.

But it brings a lot of the top people to a very niche conference where I'm not competing with 20,000 people for the attention of these security professionals.

Those are located everywhere.

If you're.

And if you don't have a conference near you start it.

We started a B sides conference here in southwest Florida, where I'm at, because for 100 miles away there was no security conference around us.

So everywhere had.

We had to drive three hours, two hours to get to a conference.

So we brought it, we created our own.

So B sides is another thing that I'll champion for that.

And those are global, Worldwide.

Yes.

So you got your conference, you got your reading, you got your study, you have your news feeds, you have your networks.

And then create that trusted network, bring it together so that you could exchange knowledge.

I look at it this way.

When you need that team, you want to train like it's a Super Bowl.

Think of incident response.

You want to train like it's a Super bowl where it took a 2, 3, 4 year cycle of preparedness to get your organization ready to be the champion of your sport.

You want your incident response team to be that prepared.

And if you're not looking at it that way, the alternative, it's a pickup game that you had on the playground when you were a kid where whoever was on the field at that time, that's the team that you're going to play with.

And the best play you have is take 10 steps, turn around, I'm going to throw the ball at you.

It is not synchronized, it's not coordinated, is not rehearsed.

And you didn't take into account all the planning that could have taken place and identify where the weaknesses in your organization are and address those throughout the year.

Absolutely.

So train like you fight.

Fight like you train and you will have a better outcome.

That advice is the top advice I've, I've heard.

It's.

You're absolutely spot on.

It is all about community.

It's all about investing yourself, learning, continuous learning.

This industry evolves and changes, the world changes and we have to stay on top of it.

And I think one of, one of the things I just re emphasized, one of the things you mentioned is there's also give back.

One of the things I always find is that I go to lots of trainings and receive and try to stay on top.

I do a lot of capture the flag events, gamification, but I also give training and when I'm giving training, it really forces me to go so deep and so, you know, into the details to make sure I have enough information to pass on the knowledge to others and even to the point where I do in the capture the fly gamification side, I also do these periodic walkthroughs of my own experiences and what I find when I was doing those.

And I think giving back is such a critical thing in this industry because it means that we can't do this alone.

We have to do it as a team.

This is one industry where it is a team sport and we all have to come together.

We all have our unique skills and expertise and knowledge and we all bring it together.

And hopefully collectively as the community, we make the world a safer place, starting with the companies and the people around us in that social sphere and then bringing it global.

To your point, you know about not having the B sides event locally so you create one.

I think that's, that's definitely the kind of the message we want to get to the, to the world out there is that if you can't get to it, start it.

Absolutely.

Where there's, where there's a gap, fill it.

And there's resources out there.

And if you want to start a conference where you're at and you need help, feel free to reach out to me.

I will help you get the right speakers here.

I will help you, I will give you.

We, we probably have lots of notes on that and there's probably someone close to you who can really be influential and do that.

Because what's unique about our discipline, one of them, it's not an IT problem, it's an ecosystem problem.

So there's more to it than just it.

It's very much human in the loop.

And the giants of our discipline are still walking amongst us.

In philosophy, they died hundreds, if not thousands of years ago in our field.

They're still alive, they're still walking the earth and they're available for and typically.

Always willing to be available and to help in the system where possible.

Right.

If you have the right mentality and you're doing it for the right reasons, they will do everything they can to support you.

And I'll tell you that I did not get here alone.

I was standing on somebody else's shoulders.

And I always say when you reach up on that ladder.

When you're climbing that ladder of success, every time I reached up, there was somebody there to grab my hand.

But never forget to reach down and pull somebody up with you.

Leave awake.

And as you move forward, that's such.

A great, great philosophy and metaphor.

Absolutely.

So if the audience do have questions, let's say they do want to start an event or they do want to learn more about, you know, how to communicate better, what's the best way for them to contact you?

How can they reach out on LinkedIn.

Or [email protected] you can reach me there.

I'm sure you'll put it on your show.

I'll put on the show notes as well.

Absolutely.

But connect me on LinkedIn, reference this podcast and we'll connect from there.

Because otherwise, one thing I'll tell you for the vendors, quit cold calling us for stuff if you don't have a relationship with us.

I'm going to go first to people who I trust.

And if you're cold, calling me means you didn't do your homework to get into my circle of trust.

Absolutely.

It's about, you know, earning the trust.

As you say, trust isn't just established and it's, and it's earned.

Right.

And it doesn't mean we, we have to be friends, best friends or anything like that.

It's just that you did the homework enough to understand what my problems are.

You understand how your solutions can address my issues and why you're a good choice.

If you didn't do that and you start out with, I got this solution, do you have this problem?

It doesn't work that way.

And plus my phone blows up, so.

It's not the way to contact.

We have to prioritize and focus.

JC it's been awesome having you on.

I always, it's, it's always an honor and pleasure speaking with you and absolutely.

Every time we're same events, we have to, we have to put time aside and meet up and have a good catch up, as always.

So thank you for spending the time today.

I'm glad to be here.

The feeling is mutual.

I look at you as a, as peer, I look at you as a coach, I look at you as a mentor.

Most importantly, I see you as a friend.

Thanks.

And it's mutual.

I think it's going back a long time with our good friend Dave.

David Lewis put us together in one table for dinner, which was, which was a fantastic opportunity and absolutely, you're definitely a close and a great friend and I look forward to keeping meeting up in the future and even doing more of the podcast episodes together.

Absolutely.

We got a lot of topics we can talk about.

I enjoy being with your audience here.

Feel free for the audience members to reach out if you want something.

If I can do it, I will.

If I can't, I may know someone who can.

Absolutely.

It's about the community.

So many thanks for being on the show.

For everyone, this is the security by default podcast.

Really bringing important knowledge, lessons learned, best practices and really to help you shape your career, whether you're starting, whether you're looking for your next path and journey and adventure.

Hopefully this will give you some insights and some best practices to really make your world a safer place and the world that we live in safer as well.

So for everyone, every two weeks, new episodes, new guests, stay safe, subscribe, share with your friends, make sure that we get the message out there.

Thank you and all the best and take care.