August 1, 2023 • 55 mins
Imagine you're given the secret playbook of the cybersecurity industry, filled with advice from seasoned experts on how to break into this fascinating field. This episode's got you covered, as we chat with industry veteran Israel Brisky, who uncovers how to step foot into this industry, the significance of networking, and the crucial conferences you should make a point to attend. His indispensable insights provide a solid foundation to anyone trying to navigate this complex industry.
Data security and cyber insurance have been buzzwords lately. But do you truly understand their interplay? Our talk takes a deeper look at the intricate relationships between cyber insurers, brokers, risk management firms, vendors, and breach coaches. We also shed light on how the due diligence process for insurance has tightened over the years. Another highlight is our chat with Rick Adams of Hunters, a trailblazing data security company. Rick gives us a low-down on how Hunters is revolutionizing the way we understand and tackle cybersecurity.
Ending this episode on a high note, we have Taylor Lee, the trailblazing CISO and CFO of Leswee LLC sharing her inspiring journey in cybersecurity. Taylor talks about the significance of representation in this field, the need for companies to walk their talk on representation, and the leadership lessons she's learned along the way. Her story is a testament to the power of perseverance and the importance of paving the way for others. So, gear up for another riveting conversation next week. Until then, stay cyber safe!
Merch: https://cyberwarriorstudios.com/store
Youtube: https://youtube.cyberwarriorstudios.com
Twitch: https://twitch.tv/CyberWarriorStudios
Twitter: @CyberWarriorSt1
Discord: https://discord.gg/eCSRzM6mJf
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:00):
Hello and welcome back to security happy hour.
This is the cyber warrior andthis is cyber warrior studios.
Well, actually, as you can hearby all the noise, we're on site
at New Jersey cyber firesides,so it's going to be a very, very
interesting show.
We've got a lot of thingsplanned and you can see all the
(00:21):
people behind me.
So look, yes, this is securityhappy hour.
It's a little hectic.
We're at a new day, strictlyfor New Jersey cyber fireside,
so it's gonna be an amazingepisode.
So, as we're about to getstarted, you know what I love
you.
Well, oh, we'll be right backhere in just a second.
(00:44):
You know how I do.
I love you, I will be right,but anyways, okay, this is cyber
security, this security happyhour.
I am the cyber warrior, thiscyber warrior studios.
(01:04):
We got a lot of people here, sowe've got I don't know what 75
people here.
So this is what I want fortoday.
We are gonna do.
We've got Hunters andDatabricks All right, apologies,
(01:29):
it's data bricks hunters anddata bricks.
All our sponsors.
This evening.
They're sponsoring not only myshow but New Jersey cyber
fireside, so they are gonna bethe first two to talk and then
we're gonna get into more andmore with Questions from the
audience, for everybody else ishere and we are talking all
facets of cyber security.
(01:51):
So you name it, ask yourquestions and we will get them
answered, because that is theintent of today.
You get answers from theprofessionals that have been
doing his job for years.
So it doesn't matter what fieldwhether it's auditing or Red
team or blue team or you name itsales, we got them all.
(02:14):
And if you want to hear from afew CISOs, we got them too.
I don't know why, but we do,apparently, one of our sponsors
in a system, apparently.
Well, look, start asking yourquestions in the chat.
We're gonna get them answeredFirst.
Let's hear from who do you wantto hear from first?
(02:38):
Don't jump in for just movecamera so brisky, if you just
want to let them know whereyou're from and kind of give an
instruction about yourself andwe'll go from there.
Speaker 3 (02:48):
Sure names Israel brisky CISO Good CISO at my old
partners, sec registeredinvestment advisor in New York
City.
Been there for about five yearsrunning their security program.
Speaker 1 (03:00):
That's awesome.
So so, brisky, if you were totalk to a junior in the industry
, right?
What would be Something youwould tell them to help them
break in Events like this?
Speaker 3 (03:11):
I got my start volunteering at networking
events in New York City.
So at the time it was New YorkISSA the local chapter, the OASP
New York City chapter, cloudCloud Security Alliance local
chapter.
So how do you get that Localchapter?
So find your local chaptersthat have security.
They're delivering securitycontent monthly.
(03:31):
Meet as many people as you canand you'll learn.
So you'll learn.
You'll also network, but don'tjust attend them.
Participate as a.
You'll take a lead role.
Run the program committee onthe cough for papers, run the
logistics, anything that you canTo With this amazing
(03:58):
connections and you'll find jobsWith that network over time.
Speaker 1 (04:09):
So we got a really good question here for brisky
From our friend Misha.
She wants to know are therespecific events that are good
for beginners?
Speaker 3 (04:20):
I Mean you go really to any.
Any security conference, anyconference today, large or small
though, will usually havebeginner tracks, the large ones
for sure.
So if you want to go to, wantto go to RSA it's very large,
it's kind of a zoo, you get lost, but they have beginner tracks.
You want to go to more targetedconferences like OSP, app set
(04:42):
conference, learn aboutapplication security They'll
have beginner tracks.
It's been a long time sinceI've been going.
It's been a while since theconferences I went to growing up
I can't remember start with thelocal chapters, start with
those local meetings and thenwork your way up from there.
You'll meet more people, you'lltalk them, you get advice from
(05:03):
them.
But I would stick to the largerconferences because they're
mostly you're gonna have abeginner tracks.
Speaker 1 (05:15):
Yeah, that's awesome and that's and that's one of the
big things that I talk about.
A lot is setting up.
You know different conferences,networking especially on social
media and B sides, and you knoweven something like this, which
is something that not a lot ofpeople know about, is New Jersey
Cyberfire site.
So you know, I do you know and,talking to Alex, know that it's
(05:35):
gonna go a little bit furtherand he's trying to expand out.
So with that, would you suggestlooking into other conferences
beyond the norm?
Right, so you've got black hat,defcon and B sides.
What other big conferenceswould you suggest that that
people look into beyond those?
You know big ones.
Speaker 3 (05:54):
So if you're in financial services, I tell you
to go to an FS I sec annualsummit.
So it's kind of it's not easyto get into because those you
have to be Working at afinancial services firm that's a
member of FS I sec.
That's criteria.
But if you're working at a bankor any financial services
that's that is a member of theFS I sec, I would urge you to go
to those.
Or there are very targeted tofinancial services.
(06:15):
You get to meet all the otherdoesn't screen that other banks
and they're beyond banks now.
They're credit unions, thehedge funds, their alternative
investor firms and it's it'sreally seeing on this industry.
It's a very financial serviceshave complex technology, complex
infrastructure.
You learn a lot in any of thosefirms.
(06:37):
I would say go check that,check that conference out.
Speaker 1 (06:41):
Yeah, definitely, that's very important, and I
think those are things thatpeople neglect, even us in our
industry.
Neglect is this If you considerit, I'm going to conferences
outside of just cybersecurity.
If you go to things like youknow, your healthcare
conferences, your your financialconferences and things of that
nature, then I think that itwould lend to being able to
(07:04):
speak more to the people thatare on the ground floor doing
the work, versus just alwaystalking to the executives that
are just looking to spend money.
Now you're talking to thepeople that will actually matter
.
So what would you say tosomeone who wanted to go to say,
I Don't know, maybe inhealthcare conference in it had
(07:24):
no CISO, no cyber security, no,no, nothing was involved.
But, as a cyber security personwanted to go there and hear
what they had to say.
Speaker 3 (07:33):
I think that's important.
You'll learn.
You'll learn new things there.
You'll learn if you're ready incybersecurity and you know the
principles of how to protectdata.
Mayfin interesting.
I mean find your secure job outhelp and anything that's
(07:56):
heavily regulated.
There's plenty of opportunity,plenty of jobs in security.
Speaker 1 (08:03):
Yeah, definitely I can't disagree with you there.
What I would like, though, isyou know, I love hearing from
you, but we've got a lot ofpeople here, let's see if
anybody else has any otherperspectives to give.
Who's next?
He was number one.
No, number two is whoeverstands up.
Speaker 5 (08:24):
Oh we got Tom.
Speaker 3 (08:26):
Oh.
Speaker 5 (08:32):
What's that make me first loser?
Speaker 1 (08:35):
So, tom, the question is you know, from your
perspective, what are the goodand bad of cyber security right
now, and what advice can yougive to newcomers in the
industry?
So good and bad of cyber.
Speaker 5 (08:45):
Interesting, I would say.
One of the bad things is peoplehave started to move to a new
paradigm, to what is more likewhat's good enough.
It would be the first thing I'dsay.
That's become a new habit.
It's like it's like the cop.
If it's free, it's for me andthat would be one of the
problems I see in the old daysto be like okay, what's the best
(09:07):
tools out there?
How can I secure myself?
The other downfall is theydon't pay for a training as much
anymore.
So part of the skills gap isbased on the training.
You know, I always look at itas it's like technology without
limits.
I mean this job is like.
The good part is it's like alife of endless learning, so
(09:29):
you're always learning, keepingyour brain fresh.
So that's my perspective onthis.
Speaker 1 (09:37):
Yeah, definitely, that's a good perspective to
have because, if you look at it,this is a field that you are
you, you are constantly learning, you're constantly growing and
you should always be doing moreto learn every day.
And I see that missing a lot ofpeople when they chase money
versus when they actually chaseeducation or opportunity or have
a passion for the field itself.
So, from your perspective, wehave a question here from
(10:01):
Michelle which actually is very,very valid on on the point here
.
You know, what Is the onemistake you see people who are
changing careers tocybersecurity make?
Speaker 5 (10:14):
waste in our money on college.
Speaker 1 (10:17):
So so you think well, what do you think truly college
is?
Is a waste, or do you thinkit's the way it is, just a price
?
Speaker 5 (10:26):
No.
So a couple of us are onadvisory boards for a bunch of
universities and I could tellyou from our experience
everything they're teaching atuniversities is five to ten
years too old, even thefoundations.
They're not even teaching thatcorrectly.
It's like my buddy over there,tom Brennan.
We were on a call one day and Ilike, oh, we just came out with
(10:48):
our networking class and I like, okay, do you teach cloud?
No, but we teach networking.
I'm like, okay, I have fun withthat.
Tell me how quick students andhired.
I think students need to bemeasured on how quick they get
hired, how quick they learn.
You know, not on every otherscenario.
There's so much I mean ElonMusk even said it passed I mean
(11:12):
there's so much free educationout there right now you can go
to you, to me, you can go toYouTube and how much you willing
to learn on your own before youactually blow 200,000 on a
degree.
Me personally, if you are gonnago for a degree, it should be
like a business degree and haveyour job pay for it, meaning,
okay, I'm moving into leadership, maybe I should go for business
(11:33):
management.
That's how I see May.
I've been doing this for Redteam side 24 years.
Speaker 1 (11:47):
You see, I don't have mixed opinions on that, because
I think some colleges areteaching the foundations
correctly, but I think othersare not.
So I think, depending on whereyou're at and what they're
teaching, you could have goodand bad things about it.
But at the same time, I seewhere you're coming from,
(12:12):
because they are just like themilitary, that the big thing is.
The military is always behindand the education and all that
they're teaching is thefoundations of IT and the
(12:33):
foundations of science.
So I think we can still hearyou on that.
Everybody else could hear me,but the people here on stream
could not.
I think Alex did that onpurpose.
They heard it from the other.
Mike, this is going to be a funstream.
(12:53):
Just say oh no, I love you all,but no, so I do.
I think it's one of thosethings that some colleges get
right, some do not.
Speaker 5 (13:04):
The problem is, everybody doesn't get to go to
those colleges you go to, likeCarnegie Mellon or MIT or any of
those Stanford.
The average person in theindustry doesn't get to go to
those.
Speaker 1 (13:18):
And I don't disagree.
I think Carnegie Mellon hasalways been huge about teaching
foundations, but they'reexpensive, extremely expensive,
so I don't disagree with that.
No, degrees don't need to becybersecurity degrees.
Degrees are MBA.
Get a degree and you can get ajob.
(13:38):
It's just like the militaryYou'll be an officer, right.
But anyways, before you go,because we want to bring someone
else on, if you give any bit ofadvice to anybody trying to
break it in, what would you say?
Speaker 5 (13:55):
Come be an intern for Alex.
Come to fireside chats.
I'll honestly find out.
Any of the local groups, isc,squared, elwas, whatever.
Go out and network and learnfrom people, because when we
first started in this industry Istarted in 99.
(14:18):
It was literally me going outlearning from other people.
Speaker 1 (14:24):
Yeah, that'll be.
The biggest thing is justlearning from others.
That's the best way for us tolearn.
Speaker 5 (14:29):
Yes, Alex is here to recruit interns.
Speaker 1 (14:35):
So we are going, we got someone new, alex,
everything else.
Speaker 5 (14:40):
Go ahead.
Speaker 1 (14:40):
Hold, go ahead and choose yourself.
Speaker 2 (14:44):
My name is Sean Malito and there's a delay and
it's really annoying, so I'mmanaging direct and I don't do
this usually, as you can tell.
Managing director for Cypher,we're a company that does
ransomware negotiations andsettlements and recovery and
remediation.
That's awesome.
Speaker 1 (15:07):
So I got a question here from one of my good friends
, an Army veteran.
If you were asked to hiresomeone, what green flags green
flags, not red flags what greenflags would you look for in an
entry level resume?
And what are some green flagsyou would look for in an
interview with an entry levelapplicant?
Speaker 2 (15:27):
On the data security side of things, forensics
recovery and remediation?
Yep, You're asking the wrongguy.
I'll be totally honest with you.
I do the relationships betweencyber insurance companies breach
coaches.
That said, I got to think thatmy team would love people who
are willing to learn, that aredisciplined.
Speaker 1 (15:50):
So what about from your perspective, in sales or
the partnership building thatyou do?
So?
Speaker 2 (15:56):
yeah, it's a huge industry now, cyber insurance.
You've got the cyber insurersthemselves.
You've got the cyber brokerswho place the business with the
end clients.
You've got the risk managementfirms.
You've got the vendors, likepeople who do what I do, and
then you've got the breachcoaches, who are the privacy
lawyers that handle the claimsas they come in.
(16:19):
It's kind of it's this massiveecosystem and my job is to know
who everybody is and puteverybody together when
somebody's had a ransomwareattack and they need help.
Speaker 1 (16:32):
So, from your perspective, especially in
ransomware, are you seeingcompanies, are you seeing
insurance companies, ratherespecially in that industry,
doing more due diligence toseeing whether or not
corporations and companies areimplementing the right policies,
procedures, regulations,frameworks and things like that,
(16:53):
or is it still a lot of?
Yeah, I checked the box, so younow get insured and you get
everything along those lines.
Speaker 2 (17:01):
Yeah, no, the due diligence is a lot more in depth
than it was three or four yearsago.
There's a large cyber insurercalled CFC, which they don't
even say what they.
It used to be called click forcover and you could just
basically click a couple ofboxes and you get yourself some
cyber insurance.
They don't do that anymore.
(17:22):
There's very, very in depthquestionnaires, pages of
questions all the way down to isit MFA?
Where is it enabled?
What systems all of that and ifyou lie on any of that, there's
a good chance you're going tohave your claim denied.
So people are taking it a lotmore seriously now than they did
(17:44):
years ago.
Speaker 1 (17:45):
Yeah, definitely.
So last question before we moveon, because we do have a lot of
people here that we want to tryto get on If you have any
advice for anybody trying tobreak into cybersecurity or even
in the field you're in withdeveloping these partnerships
and kind of building theserelationships what would you
give them?
Speaker 2 (18:04):
It's a great time to get in.
I know that there's been a lotof layoffs, but we're not seeing
it on the cyber insurance sideof things.
So if you want to get on thepre-breach side where you work
doing pen tests, vulnerabilityassessments I know a lot of
companies are hiring on theinsurance side or on the data
security side there, and thenanybody for any of the vendors
(18:27):
where I work and where peoplelike Sentinel-1 and people on
the back end work as well.
Speaker 1 (18:32):
Yeah, definitely, and I want to thank you for coming
on.
It's been awesome having youhere.
So what we're going to do nowis we're going to see who wants
to come up next.
Speaker 4 (18:42):
Where's number four?
Speaker 1 (18:43):
Hit the hot mic.
Take a good job, man Nice work.
Speaker 6 (18:51):
How are we doing today?
Frank Angioleli, I am theManaging Director of MSOC.
We are a managed securityoperations center and our goal
is to accurately detect attacksbefore they cause damage and
either prevent them or respondquickly before it gets worse.
Speaker 1 (19:10):
So, as the Managing Director of MSOC, attacks always
happen and you can't guaranteeever 100% security.
So what would you say is thebest way to really lock down
(19:30):
something like a ransomwareattack or something that hits
immediately?
Speaker 6 (19:34):
No complex question, but there's two aspects to SOC,
to understand it well.
The first one is our adversaryis sentient, so we're fighting
against human beings, and thesecond one is they always have
the initiative, meaning they canattack anywhere, anytime, from
any place.
It's almost like defendingEngland against a Viking
(19:54):
invasion, and so at that pointin time, one of the strategies
that really works very well ismilitary type strategies like
Cuswitzy.
And strategy which are tryingto do is you're trying to defend
at your strong point and attackthem at their weak point.
You're trying to interdicttheir operations where they're
(20:15):
weak.
And believe me when I tell youred teams adversaries, they have
weak points.
Speaker 1 (20:23):
You know I laugh about that and I was saying
something because Natalie Baker,who is in the chat right now,
she calls herself the SOC queenon occasion, depending on what
you're looking at, what platform.
But she actually loves SOC andwhat you're talking about, and
so you know, one of the biggestthings for her has always been
(20:44):
you know, you have to bereactive but also proactive at
the same time.
Right, so you're trying to stopattacks, at the same time, you
have to be able to react.
So, in that same vein, howwould the MSOC not only help
prevent, but what is thereactionary measure like?
(21:05):
Where do you really put more ofyour focus when you're doing
things?
Speaker 6 (21:09):
It's an excellent question, and so to describe
that, I'll put it to you thisway Most people will spell a
word the wrong way, but they'llspell it that same wrong way
every time.
When I do this, I spell aparticular word, when I type it
out the wrong way, but I do itthe same way every time.
(21:29):
Adversaries and attackers havethe same issues, they will do
repeatable patterns, they'llstick with what they know,
they'll go for the path of leastresistance, and so what you can
do in that scenario is, as theycome in an attack pattern,
they're going to replicatecertain things and you can, you
(21:49):
know, almost like pulling thepin out of a machine.
That makes the whole machinefall apart.
That's the goal.
The goal isn't to solve thisvolumetrically, because it can
attack anywhere, anytime, and sothere's commonalities in their
attacks, there's commonalitiesin the laboratories, and if you
can find them, you can drop themin very key points.
(22:11):
Think about from a fundingperspective.
In SOC, people will always say,oh, we need more people.
Why?
We need more people?
Because they can attack fromeverywhere, why?
And so today, the solution tothat isn't in funding more and
more and more with huge, hugeamounts of money.
It's about using those patternsto find out how you can
interdict that adversary withoutan overwhelming amount of
(22:34):
funding and cost and source,because SOC is expensive and we
need to keep it manageable tomanage the risk level.
Speaker 1 (22:43):
Yeah, definitely.
Now, before we go and before wemove on to someone else that we
want to keep going with moreand more, I want to ask if you
had any advice to give someonebreaking into cybersecurity
right now.
So you're talking to yourjuniors, your college students.
Whatever the case may be, whatadvice would you give them?
Speaker 6 (23:01):
Yeah, so I would give you three points In order to be
successful.
Look for things that you like,that you're good at and that
people will pay you for.
If you can make those three,you will make a career.
Speaker 1 (23:16):
I love that and and honestly thank you for being on
and thank you for being here.
And you know what, here at NewJersey Cyberfire Sides, we have
a lot of people back there.
Holy Jesus, we're going to keepit going, but with that, let's
let's get someone new here onthe stage and let's hear what
they have to say.
Alright, so, andy, why don'tyou give a little bit of an
(23:46):
introduction who you're herewith and what you're all about?
Speaker 7 (23:50):
Andy Hutchinson.
I am a solution architect atDatabricks and I support the
financial services vertical aswell as the cyber asset me.
Speaker 1 (23:59):
That is.
That's awesome, so beinginvolved with with that side of
things.
So is it right for me to sayyou're more involved with the
sales side of how things go?
Speaker 7 (24:12):
Yes, but at the same time I have to share.
Sales reps guide the customerin the right technical direction
and they're not promisingthings that we can't deliver on
the technical side.
So while day to day I spend alot of time with sales folk,
when I'm working with directlywith customers, it's mostly
technical engineers, you know,directors, things like that, and
then in the cyberspace it'sdirectors up all the way to the
(24:36):
CISO.
Speaker 1 (24:38):
So so, from a Databricks side, give me a, give
me a little insight.
You know, being from Databricksis something I haven't heard of
before.
It's a new company to me.
Speaker 7 (24:48):
Give me a little insight on on how they are
innovating and doing thingsdifferent, yeah, so those who
are familiar with Databricks, weare the pioneers in the
Lakehouse platform, which isbringing together the
centralization of data, browsingand data lakes under one roof.
But we also have a kind ofadvanced cyber SME group.
We have a lot of ex government,ex Splunk who have started
(25:12):
building things into theplatform that make data
ingestion as scale easier, aswell as detections and
automations into the platformbased off those data's that you
know.
We're talking about petabytesworth of data and not just small
terabytes.
Speaker 1 (25:28):
And that's huge because you know, when I look at
sim, when I look at data lakes,when I look at all these things
that ingest data, being able toparse it, being able to really
ingest it and do all thisdifferent things with it, having
that capability is huge.
So, in that space and what youdo, you know as a solutions
architect and being what you'reable to deliver through
(25:51):
Databricks and things of thatnature, what would you say is
the key factor to being able toget to where you're at and have
the knowledge in this space ofDatabricks kind of what they do.
Speaker 7 (26:04):
Honestly, when I first started Databricks, I
didn't know anything about Spark.
I didn't know anything aboutcyber security, and the best way
I learned was by doing.
You know, I built my cybersecurity background by helping
one of the largest media andentertainment companies build
out their cyber security stackand, you know, learning with
them and educating them on allthe things Databricks can do.
Speaker 1 (26:28):
That's huge because I think, when you look at it back
to being able to learn from thefront, being able to you know
no matter where you come from,you can really pick up on the
field.
So, as you were learning, asyou were growing in the industry
over the past two years, whatwould you say was the biggest
asset to you in being able tolearn?
Speaker 7 (26:48):
that All the people around me and the fact that when
you're able to ask questions,they'll give you, you know, very
straightforward answers, and ifyou don't ask questions, you're
never going to learn frompeople who know what they're
talking about and the experts inthe field.
Speaker 1 (27:02):
And that's awesome and I got.
I got one more question here.
I don't know if you're going tobe able to answer it, but we're
going to figure it out.
How can you get an entry-levelinternship for Databricks?
Speaker 7 (27:12):
We actually have a pretty robust internship program
, usually both from aengineering perspective, and we
may even branch out into thecandidate headquarters as well.
Speaker 1 (27:32):
That's fantastic.
I love internships.
I think the more internshipsthat are out there, the better.
Final question and this one isfor me personally, because I
always throw it out there whatadvice would you give to any
newcomer breaking into the cybersecurity space?
Speaker 7 (27:47):
Don't be afraid to ask questions.
Google is your friend for youto get started.
But you know, surround yourselfwith people who know what
they're talking about andexperts in the field and lean on
them for your early educationand then you know, grow from
that, that's awesome, so.
Speaker 1 (28:04):
So this is what I'm going to do, guys.
I'm going to give everybodyhere we're about 30 minutes in
I'm going to give them all a twominute break and we are going
to roll with it here in a minute.
The mic was muted, so let's trythat again.
Howard, go ahead andreintroduce me.
(28:25):
Can you hear me now, there wego All right.
Speaker 8 (28:27):
So my name is Rick Adams.
I'm a senior sales engineer forhunters out of the US East.
I'm based out of Tampa, florida.
Glad to be here in New Jerseyfor the fireside chat.
Glad to meet everybody onlineas well too, that's awesome so.
Speaker 1 (28:40):
So yeah, it was for all those in chat.
Look, the mic was muted becausewe stepped away.
I didn't want you all here andall that.
Don't be all up in arms, butanyway.
So you're here from Hunter.
So, as you're here from huntersand you are one of our sponsors
, yes, give me a little insighton what hunters can do.
Speaker 8 (28:59):
So hunters effectively can.
We're working on what we callabout movie on Sim.
Okay, so we're effectively aSim replacement.
So if you kind of think aboutin terms of like Sims, a lot of
folks today are very, veryunhappy with where their Sim
deployments are from a costingestion perspective.
You kind of think about, thefact is, sims are very costly,
(29:20):
right, data ingest is extremelycostly.
The other thing that we do iswe are really automating the
meantime to identify and respondto incidents.
Okay, so what we're doing iswe're automating the data
onboarding process, vendors outthere and we're effectively
building that into a datapipeline.
Now, our data pipeline is builton top of Databricks as well,
(29:42):
so we actually do Databricks onthe back end to actually align
that, which is really cool.
So we're actually building outa security data lake for our
customers.
So we're building that into acommon schema and then we feed
it into what we call ourdetection pipeline.
Now, the cool thing thathunters does is right out of the
box.
Hunters has a number ofhundreds of detectors that are
built out of the box.
So your analysts are nowcurating and building detectors.
(30:05):
They're not building up,parsing data, onboarding data.
We actually simplify theonboarding of the data process
and then, effectively, whatwe're doing is we then feed it
into what we call ourinvestigation engine.
So we're doing for an analysttier one to tier three is we're
simplifying the time it's goingto take them to onboard detect
signals from the actual sourcesthat we're bringing in, and then
(30:26):
we're doing the crosscorrelation of those data
sources.
So we're tying, for instance,your EDR source to your identity
source, to your cloud source,and we're actually not only
building out what the actualalert was, we're tying it to all
the events in the attack chain.
So that's what we're doing withhunters.
We're really kind ofsimplifying that time for the
tier one to tier three analyststo identify and respond to those
(30:46):
incidents.
So that's essentially what wedo in a 10,000 foot for you.
Speaker 1 (30:51):
That's awesome.
So, as I said, we have oursought queen here, natalie Baker
, and Natalie has asked anamazing question, and actually
two now.
So the first is are you?
Speaker 8 (31:03):
a sore?
No, we are not a sore platform.
So we do have essentiallyeverything but the R in the sore
right so we can do theautomation and orchestration,
but we're not there.
We actually response okay.
So what we're doing is we'renot a remediation engine.
What we're going to do is giveyou the fidelity.
We're going to cross stitch allthe different data sources
(31:23):
together and do the autoinvestigation, but the
remediation typically tied tothird party sore vendors.
So, for example, we partnerwith Tines and Torq to actually
build out playbooks and actuallydo the remediation steps for
our customers, right?
So that's not what we're doing.
We're not focused on theremediation part of the sore, so
we're not a sore platform Allright.
Speaker 1 (31:46):
And so now we got another question.
Sure, Do they?
Do you cross reference to anycompliance standards to make ops
life easier?
Speaker 8 (31:56):
Yeah.
So, for example, if you thinklike compliance, I mean you're
talking about like NIST orsomething like that, or looking
at like different, like our.
So one of the reasons why Iasked the question is because
one of the things that we alignto from a detection perspective
is we're aligned to the MITREattack framework.
So everything we do with our,our platform, is aligned to
MITRE and then, in addition tothat, we have a team of threat
(32:18):
analysts that actually addadditional threat techniques
into the MITRE attack frameworkfor our detection rules that are
built into Hunter.
So we actually show you thecoverage, the gaps and
essentially what are what wecall the what if scenarios on
new, on on new data sources thatwe would onboard.
What about Fed?
So we want FedRAMP certified.
Today we're going through thatprocess, so it's going to be.
(32:40):
It's essentially, it'sobviously it's a lengthy process
, but today we're not, we arenot FedRAMP certified.
Speaker 1 (32:45):
Yes, all right, and so this is going to be the last
question I take from Natalie onthis Dang dang.
She's killing me today.
Do you partner with Swim Laneat all?
Speaker 8 (32:53):
So I don't know at the top of my head if we
actually partner with Swim Lane.
It's like I don't know ifthat's something.
I'd have to double check to seeif we do that specifically, but
I don't know if that's actually.
Jared, who's here, wouldprobably know that better than
me, but I don't know of top ofmy head.
So that's awesome and so youknow.
Speaker 1 (33:09):
I'm trying to get more.
We got a ton of people here soI want to get more and more
through.
So, not to cut you short, butif you can give any advice to
somebody breaking thiscybersecurity, and especially
what you do, what advice wouldyou give them?
So, actually, for me, Iactually have a lot of people
who are in the community.
Speaker 8 (33:23):
So actually for me, I actually got into cyber about
seven years ago.
I'm formerly Cisco.
I actually came over to Huntersabout a year ago.
I got into actually the simspace about a year ago too as
well, and I will tell youhonestly and I've heard a lot of
folks talk about you know,careers and where they're trying
to establish themselves I'vebeen in this business for 35
years.
I'm going to tell you right now,this is clearly the space to be
(33:44):
in, specifically on threatdetection and analysis, and I'll
tell you, this is an area thatI think most folks should really
focus.
It's actually been the mostvaluable for me and actually my
colleagues, and so I feel thatyou know, obviously, the folks
that are like kind of listeningon this podcast, if you're kind
of going through this yes, youtalked about the fact that you
don't have to go for formalizedschooling but definitely I would
(34:06):
definitely focus on, you know,threat analysis and detection,
because this is what we'reactually doing on investigations
and that's typically where Ifind a lot of the growth is
happening in the business.
So that's kind of like where Icome in from my perspective.
It's only an opinion, it's nota fact.
So that's what those werecoming from.
Speaker 1 (34:22):
So that's awesome and thank you for being on.
And look, that's what we'regoing to do.
We're going to keep it rolling.
We're going to keep it moving.
All right, we're going to keepit going.
So let's, get someone else upto the stage.
I think you've got one morecoming up.
There you go.
Hopefully that went.
Okay, I try to get your contactinfo for now.
Speaker 8 (34:41):
Oh, yeah, sure, absolutely yeah.
Speaker 1 (34:47):
You gotta love answering questions while I'm on
camera, not realizing I'm oncamera.
You know it happens, all rightanyway.
So we got someone new coming upto the stage.
You're gonna answer somequestions, but first let's get
into introduction.
Hey, is your mic hot?
Is it red or green?
Speaker 4 (35:05):
Green, all right you're good, all right.
Hey, I'm Josh Berkowitz, theowner of Crestview Public
Adjusters.
We represent policyholders whenthey first party claims against
insurance companies, and nowwe're here just to get more
educated on cyber insurance andhelp people understand what we
do.
Speaker 1 (35:22):
So, knowing that, what I would like to do, though,
so about this, is, you know,tell me a little less about the
organization Now, tell me alittle bit more about you,
because we got a variety ofpeople.
Speaker 4 (35:32):
So I gotta talk, or I gotta talk people.
Speaker 1 (35:35):
So we're gonna get a little bit of everything in here
, sure, so for today, you know,give me a little update on how
you got into cybersecurity andkind of what's going on, can you
?
Speaker 4 (35:43):
hear me you can hear me right.
Okay, so my background isreally representing owners of
real estate commercial owners ofreal estate when they have
property damage, and a couple ofyears ago I met with a
individual who represented bigcompanies when they got breached
against insurance companies torepresent them.
So, being an expert in thefield of representing
(36:03):
policyholders against insurancecompanies with property damage,
I started getting more educatedon the subject about two and a
half years ago and then we gotour first lead in our first
claim.
So after handling that andgetting our feet wet, we started
building up what we call like acyber ops team to help us and
help our clients when they haveclaims against insurance
companies in the cyberspace.
So that's really how we've kindof evolved.
(36:26):
I became an expert in theproperty damage side and, using
those skills, negotiated withinsurance companies on behalf of
policyholders kind of usingthat to our advantage to help
the policyholder out.
Speaker 1 (36:38):
That is absolutely awesome because it just shows
the transition of being able todo one career field and bring
that into the other, and that'sa lot about.
What I talk about is being ableto take what you know, bring
that into to cybersecurity andbe able to establish that.
So that is absolutely awesome.
I love hearing that and so,going from that, what do you
think was the biggest benefit?
(36:59):
You know what, whether it's ahard skill or something, what
was the biggest skill took fromthe other?
Speaker 4 (37:16):
And the policyholder and being an advocate for the
policyholder against insurancecompanies.
We should understand insurancepolicy better than the insurance
company.
So that's one aspect of thisbusiness where we kind of are
above everyone else.
We don't really let them tellus where there's coverage.
We're kind of telling them hey,this is where it says what it
(37:37):
says in the policy and this iswhy you should cover XYZ for
happening.
And that's really importantbecause you want to make sure
you have an advocate on yourside when you have, you know,
any type of insurance claim,especially cyber, insurance
breach or any type of claim.
Speaker 1 (37:52):
So would you say in that aspect, would you say that
cyber insurance?
I'm trying to think of how tophrase this question because I
have a huge issue with the waycyber insurance initially came
in versus where there are now,because I still relegate my
(38:14):
mindset to where they came in atof oh, you did the bare minimum
, so with where you're at now.
So bringing real estate andreal estate has always been a
huge insurance.
They investigate everything thecode, the helpings of bills how
it was designed everything.
Do you think cyber insurance isat that level, or do they still
(38:36):
have a way to go?
Speaker 4 (38:37):
They still have a ways to go.
I mean, I've been doing thisfor six years, I've been in real
estate for 15 years, but theystill have a long ways to go.
There's a tremendous long wayto go, I think.
To be honest with you, what'sscary is what's going to happen
in five years from now, becauseinsurance companies are losing a
ton of money by paying outclaims.
So are they still going to bein a space of insurance?
(38:58):
Cyber insurance?
That's what really could bepotential here.
But hopefully they stay in thespace and they're just going to
make it stricter for people toget insurance and they're going
to increase premiums becausethey when you were talking about
the start of the space, whenthey started getting the space
premiums for anyone to getinsurance and people were
talking about earlier to getinsurance within 30 seconds you
(39:19):
can have cyber insurance.
That's no longer available toanyone at this point.
You have to, they have to havepen test, different steps to
take in order to get insurancenow.
So there's still a long ways togo.
That's all the more so why wecould, why there's more of a
need for someone on the policyother side to help out against
(39:40):
insurance.
Speaker 1 (39:42):
All right, so I got two more questions for you.
First one is do you think thatauditors, especially constant
auditors?
I don't know if I have abackstory on this, by the way,
so I will advise on that.
Speaker 4 (40:02):
To be honest, I'm not .
I don't really know.
I don't want to give them.
I don't have an opinion on that.
Speaker 1 (40:09):
All right.
So the reason, the reason Iasked that question, is because
I have seen auditors who makefriends with the owners of the
companies and the CEOs andthings like that, and so they
get passed every time on theiraudits as if they're doing
everything right.
So when it goes to theinsurance companies, the
insurance companies see oh yeah,they passed on their audits,
they're good to go, they'redoing their due diligence.
(40:29):
But knowing, insight,information that is not always
the case.
Speaker 4 (40:34):
Well, I think it's always better to have a third
party come in and analyzesituation, not even an auditor.
You have an auditor and youhave someone that is looking at
the auditor.
I don't there's such a thing asthat, but I to your point.
I think that's probably, youknow, not the best.
There's probably some unethicalsituation there if they're just
going to keep auditing themover and over again.
Speaker 1 (40:51):
You're absolutely right, and that was the big
thing I was getting to is beingable.
You have to.
I think their needs to comeinto play.
If you're going to haveauditing and insurance, you need
to have auditors change everyyear, two years, whatever the
case may be.
There needs to be a plan inplace for the insurance
adjusters to be able to say hey,you had the same auditor for
like 10 years, the same exactguy.
(41:11):
There's an issue here, sure,and so I think that's where a
lot of the problem comes intoplay.
Now the final question is andlike I've been doing this entire
night if you could give anyadvice to anybody breaking into
cybersecurity, whether it's ininsurance or whatever you know
about cybersecurity, what advicedo you?
Speaker 4 (41:29):
have to give.
My advice is if you want tohelp out the policy holder and
people you know, large companies, get a public adjuster license
and contact us, because therearen't many people in our space
and there's a big opportunity inthe cyber space to represent
policy holders against insurancecompanies.
Speaker 1 (41:47):
And what is the best way to break into auditing if
you know?
Speaker 4 (41:52):
Just get a license, start getting education,
networking, going to networkingevents and things like that.
I mean going to networkingevents like this is definitely
where you meet people, yeahdefinitely.
Speaker 1 (42:02):
I completely agree with you.
Thank you for joining me thisevening and I will say this for
anybody who's trying to breakinto any industry it is the
smaller events, it is the B-size, it is this New Jersey cyber
fireside and a few others whenyou will find these people.
When you go to things like DefCon and Black Hat and things
like that, it is verycommercialized and you are not
(42:24):
necessarily going to find peopleof all industries Not that they
won't be there just that you'regoing to find your crowd and
kind of blend into them, whereassmaller events like this you
get to meet everybody and youare not blown away and just tied
into a small little crowd.
So get to the smallerorganizations, get to the
(42:45):
smaller events and that is whereyou will find success in being
able to meet everybody from allaspects of cybersecurity.
Okay now, moving on from that, Iam pretty sure we have another
guest coming up and let's figureout who it is.
Who was our next guest?
Who is next on the choppingblock?
People, you are me All right,let's do one more and I will
(43:10):
call tonight.
No, no, jason doesn't want to.
All right, so look, hey, thisis how we're gonna run this
night right now.
Speaker 2 (43:24):
One more one more.
Speaker 1 (43:28):
Bring your drink.
What are you doing in asecurity happy hour?
Bring the drink.
She was about to not bring thedrink.
Speaker 9 (43:40):
I'm green all right, I'm green all right.
Hey guys, I'm green sointroduce yourself please.
Hey, I'm Taylor Lee from was weLLC.
I'm actually the CISO andthat's the CFO.
We are a risk management,compliance and grant acquisition
firm in Montclair, new Jersey,who services the public and
(44:00):
private sector.
Speaker 1 (44:05):
All right, so I ain't gonna lie.
Alex kind of took me away.
He did you know, but I'm okay.
We're good, we're gonna runwith it.
I love you.
Speaker 9 (44:16):
Everyone.
We're here with it.
Speaker 1 (44:17):
We are, that's how we do so, like this one, I want to
ask with what you do?
I heard four letters.
If I'm not mistaken, gotcha,you said CISO am I correct?
Speaker 9 (44:28):
Yes, you did, and you heard CFO, I am both.
Yes, it's a headache, yes, it'shard work.
Speaker 1 (44:35):
So so this woman here is a Is a CISO and a CFO.
So here in chat, if you don'thave questions, I'm gonna smack
you all come on.
I know who you all are.
Bring on the question.
I'm just saying let's go.
Speaker 9 (44:51):
I know you all love me, guys.
Speaker 1 (44:52):
Let's go so bring some good ones, come on.
This is the first question Igot to ask, though.
Where did you get your start incybersecurity?
Speaker 9 (45:01):
So my start in cybersecurity, believe it or not
.
First I'm gonna be upfront withyou guys.
Guess what?
I'm 26 years old, so my startin cybersecurity actually
started completely by myself,learning it on my own self,
teaching.
And then what I did is Istarted gaining mentors and
realize, you know what?
I need to get some moretraining and learn actually the
(45:22):
real ins and outs ofcybersecurity.
So guess what?
Although education, I do notrecommend going to college
specifically for a cybersecuritydegree.
I did.
I graduated last month, guys,cheers to that.
But that's actually how I brokein and I started my company in
2016 with my business partnerOver there, cynthia slaney.
(45:45):
She has an amazing backgroundin environmental and healthcare
and Literally from there, I'mhere in front of you today and
CFO and CISO, loud and proud.
Speaker 1 (45:57):
So I have just been informed that if I do not
mention my good friend and afellow warrior, I'm on a walk to
harbour to you.
She is going to kill me.
So I'm gonna mention her to youand you need to talk to her.
We'll get connected.
Well, we'll.
We'll change details,absolutely.
I got a lot of people thatwould love to work for you.
Just absolutely.
Speaker 9 (46:18):
I like to hear that because, literally, we've
actually launched our summerinternship program and it's
actually been amazing.
So, guys, we will be actuallylaunching another internship
program after the summerinternship programs.
So, for my students, come onout there.
Cyber security internships wehave info set, secure
internships, as well asmarketing and so many others.
(46:39):
So, guys, come on down.
Speaker 1 (46:45):
That is.
That is absolutely awesome.
I've got a lot of people inthis chat, so I don't you know
Me and you were just meetingtoday.
Speaker 9 (46:53):
It's started, I know, that.
Speaker 1 (46:57):
So I'm gonna let you know me and my warriors.
They they looking for jobs,they looking to link up with you
.
Speaker 9 (47:06):
Okay, because opportunity is knocking at your
door and one thing about it hereat was we LLC is we also make
sure that you get educated.
So one thing about it is that'sa huge component of grant
acquisition is making sure thatthe employees at work at was we
LLC Can also make sure that theyget tuition reimbursement from
grants and other grants that waswe LLC applies to In-house, so
(47:29):
that you can actually thrive andnot actually have to deal with
Tuitions and all of those othercrazy.
Speaker 1 (47:36):
I gotta say this because here's the thing a lot
of what I see hey, I've gotNatalie Baker again, the saw
Queen, who wants you as a gueston her podcast.
Yes, I, queen, and we are gonnaget you as a one-on-one on mine
also.
Yes, beyond all this, you'recoming one-on-one, we're gonna
do it all for it.
But I want to say this is youknow, the big talk within our
(48:00):
industry and I have seen it timeand time and time again is
representation.
You being here today is onestep forward in that, and
showing what you've done is aCISO, cfo and everything you've
done for your career.
So, for those who are preachingRepresentation in all this and
all this stuff, what advice doyou have for them?
Speaker 9 (48:22):
So one thing I'm actually gonna say about these
companies that preach that isit's bull crap.
For, you know, companies likemyself, we practice it, we
preach it and we are it.
Representation is critical, itmatters.
And representation also matterswhen you're being a leader of
Influence and being that personthat if it's a student or if
(48:45):
it's someone that's breakinginto cybersecurity or IT, that
they can just come to you andask those questions.
So I really thinkrepresentation it starts with
really being that main point ofcontact and being okay with
Somebody asking you somequestions that yeah, it may have
been a tricky cybersecuritythreat that you dealt with, but
how did you handle it?
So I always say representationit starts with you being honest
(49:08):
and really being forward andbeing open in there for others,
as you know, in Mentorship orjust help, or for partners.
Speaker 1 (49:16):
So one of the questions I have along those
lines is how, how hard did youfind it getting to from where?
Again, I'm 36 years old.
I still I'm not in yourposition.
I've not where you're at.
I don't know what the hellstopped me from getting where
you're at, but you are damn wellahead of me and I ain't even
(49:37):
mad at it.
I want to learn from you,that's right.
So, with where you're at inyour career, with the things
that you've done, what drove youto there?
Was it upbringing?
Was it family?
Was it social there?
Was it upbringing?
Was it family?
Was it support?
What?
What got you to where you're at?
Speaker 9 (49:55):
So one thing I'm actually gonna say is a major
driver for me was I actuallysuffered from an injury in my
12th grade year when I actuallywas bedridden.
My 12th grade year.
I was not in high school, so Ihad to do homeschool.
So during that time I got to dosome research and really so
find out that I Want a lot morefor myself.
(50:15):
So I actually started in thepharmaceutical industry.
Um, so you're like, how does shestart in the pharmaceutical
industry right from an injury?
Yes, because I wanted to knowwhat drugs I was taking, what
was going on.
So it started there, and thenwhat actually happened is I was
like, hey guys, this isn'tenough money, it's too many
hours, it's breaking my back.
Um, so I actually had to moveon and find something else.
(50:37):
So I was just actually Swimmingthrough and, you know, doing my
networking, and really how itbroke through was making sure
that I was building thoseconnections and finding out what
I love most and what I wantedto do and what I was passionate
about Was the key that drove meto say, all right, this is it.
Let me see what cybersecurityis about, let me see what I can
(50:58):
do and let me see how I can doit.
So it was literally that was, Iwould say, my main driver that
just took it off from here tothere.
Speaker 1 (51:07):
So I got one more question for you and then, and
then we're gonna move on.
How.
I have a hard time with thisquestion and me and you can
discuss off air why and thiswoman knows why Me and her are
gonna be fighting for her askingit because I love her.
(51:28):
Um, but when did it go?
All right, how hard was it foryou, being a black woman In
cybersecurity, to get to sysso,and what were some of the
stumbling blocks you ran across?
Speaker 9 (51:42):
So actually I would say there was a lot of
opposition, um, and a lot ofdoubt.
So one for me, being young,there was already you're too
young, you can't get into this,you can't do this.
And then, of course, me beingblack, and normally you would
generally see me with an afro.
So I normally, if you see mylinkedin um, you can find me on
(52:03):
linkedin at taylor lee.
You would see me with an afrogenerally when you see me
walking around.
So Actually, I would say thehardest thing about that and
some challenges that I facedduring that would be a lot of
opposition in doubt.
So that made me say the heckwith that.
You go ahead and doubt mebecause I'm going to prove you
guys wrong um, time after time.
(52:23):
And then another thing I wouldsay is that I guess would be an
opposition was Always makingsure that you're resourceful, um
, invaluable.
That has been a major driverfor me, um, and really making
sure those stereotypical Viewsand different things that you
deal with, especially, um, forpeople who are black, um, that
(52:45):
may face.
So I always bring, say, bringvalue in that room, bring
knowledge in that room, bringsomething new, um, and you can
change the view.
So I would say in the beginningthere's tons of opposition, but
um after you really make thoseUm views change about you, you
usually are respected, just likeeveryone else in the room.
Speaker 1 (53:07):
So I have one last question for you, me personally,
and this is coming from me um,do you feel that and it's
because of our political climate, so I'm going to ask this
question?
I love that bring it.
Do you feel being a black womanhas held you back from where
(53:28):
you want to be in life?
Speaker 9 (53:30):
So I love this question, because I even get
this question from my community.
Um, I'm going to completely saywhat held me back was
completely myself.
I'm not going to say it helpedme me being black.
Um, I go for any opportunitythat I want.
So what that looks like is, ifI want to own my company and I
(53:52):
want it to be the leading riskmanagement, compliance and grant
acquisition firm in new jersey,that is what it's going to be.
I have to work toward it and Ican get it.
Um, what?
Of course, everyone's not goingto love me.
Everyone's not going to lovewhat I bring.
But you have to also look atthe side of things where, um,
you, you don't have.
Those things don't matter toyou.
(54:14):
Your goal and what you want tocome out of it matters.
So I would say that shouldnever and has never really
stopped me personally.
Others maybe, um, but no, don'tlet it stop you.
Let it be a amazing driver, uman influence for you to keep
going.
Speaker 1 (54:32):
I absolutely love that.
Thank you for joining us thisevening.
Speaker 9 (54:35):
We're gonna get.
Speaker 1 (54:38):
One more For guests on this show and I gotta say
I've got to get your informationNatalie Baker on linkedin, and
she's a good friend of mine.
So, queen, she's gonna get yourinformation and I got to hook
you up what.
Mrs Sarver, I've been drinkingso she knows I ain't gonna
pronounce her name, right, I'mgonna hook you up with her.
She is a good friend of mine,she's one of my warriors, she's
my sister.
We're gonna.
We're gonna get it all hookedup.
(54:58):
All right, cool, let's getawesome.
Let's get one more up here.
We got one more guest.
We got to get up here.
That one's just.
You know that's sent everybodyup, so we're gonna go.
We got one more, let's go.
Who's coming to the stage?
Who's coming to the stage?
Nobody.
All right, look, we got to goto keynote.
(55:20):
This is new jersey cyberfiresides.
We're gonna go keynote.
Get on with the show.
Look, I love you all.
This has been security happyhour.
You know, I'm all here for youand I will talk to you all All
next, actually this Friday.
So y'all take care and enjoyyourselves.
Hello and welcome back to security happy hour.
This is the cyber warrior andthis is cyber warrior studios.
Well, actually, as you can hearby all the noise, we're on site
at New Jersey cyber firesides,so it's going to be a very, very
interesting show.
We've got a lot of thingsplanned and you can see all the
(00:21):
people behind me.
So look, yes, this is securityhappy hour.
It's a little hectic.
We're at a new day, strictlyfor New Jersey cyber fireside,
so it's gonna be an amazingepisode.
So, as we're about to getstarted, you know what I love
you.
Well, oh, we'll be right backhere in just a second.
(00:44):
You know how I do.
I love you, I will be right,but anyways, okay, this is cyber
security, this security happyhour.
I am the cyber warrior, thiscyber warrior studios.
(01:04):
We got a lot of people here, sowe've got I don't know what 75
people here.
So this is what I want fortoday.
We are gonna do.
We've got Hunters andDatabricks All right, apologies,
(01:29):
it's data bricks hunters anddata bricks.
All our sponsors.
This evening.
They're sponsoring not only myshow but New Jersey cyber
fireside, so they are gonna bethe first two to talk and then
we're gonna get into more andmore with Questions from the
audience, for everybody else ishere and we are talking all
facets of cyber security.
(01:51):
So you name it, ask yourquestions and we will get them
answered, because that is theintent of today.
You get answers from theprofessionals that have been
doing his job for years.
So it doesn't matter what fieldwhether it's auditing or Red
team or blue team or you name itsales, we got them all.
(02:14):
And if you want to hear from afew CISOs, we got them too.
I don't know why, but we do,apparently, one of our sponsors
in a system, apparently.
Well, look, start asking yourquestions in the chat.
We're gonna get them answeredFirst.
Let's hear from who do you wantto hear from first?
(02:38):
Don't jump in for just movecamera so brisky, if you just
want to let them know whereyou're from and kind of give an
instruction about yourself andwe'll go from there.
Speaker 3 (02:48):
Sure names Israel brisky CISO Good CISO at my old
partners, sec registeredinvestment advisor in New York
City.
Been there for about five yearsrunning their security program.
Speaker 1 (03:00):
That's awesome.
So so, brisky, if you were totalk to a junior in the industry
, right?
What would be Something youwould tell them to help them
break in Events like this?
Speaker 3 (03:11):
I got my start volunteering at networking
events in New York City.
So at the time it was New YorkISSA the local chapter, the OASP
New York City chapter, cloudCloud Security Alliance local
chapter.
So how do you get that Localchapter?
So find your local chaptersthat have security.
They're delivering securitycontent monthly.
(03:31):
Meet as many people as you canand you'll learn.
So you'll learn.
You'll also network, but don'tjust attend them.
Participate as a.
You'll take a lead role.
Run the program committee onthe cough for papers, run the
logistics, anything that you canTo With this amazing
(03:58):
connections and you'll find jobsWith that network over time.
Speaker 1 (04:09):
So we got a really good question here for brisky
From our friend Misha.
She wants to know are therespecific events that are good
for beginners?
Speaker 3 (04:20):
I Mean you go really to any.
Any security conference, anyconference today, large or small
though, will usually havebeginner tracks, the large ones
for sure.
So if you want to go to, wantto go to RSA it's very large,
it's kind of a zoo, you get lost, but they have beginner tracks.
You want to go to more targetedconferences like OSP, app set
(04:42):
conference, learn aboutapplication security They'll
have beginner tracks.
It's been a long time sinceI've been going.
It's been a while since theconferences I went to growing up
I can't remember start with thelocal chapters, start with
those local meetings and thenwork your way up from there.
You'll meet more people, you'lltalk them, you get advice from
(05:03):
them.
But I would stick to the largerconferences because they're
mostly you're gonna have abeginner tracks.
Speaker 1 (05:15):
Yeah, that's awesome and that's and that's one of the
big things that I talk about.
A lot is setting up.
You know different conferences,networking especially on social
media and B sides, and you knoweven something like this, which
is something that not a lot ofpeople know about, is New Jersey
Cyberfire site.
So you know, I do you know and,talking to Alex, know that it's
(05:35):
gonna go a little bit furtherand he's trying to expand out.
So with that, would you suggestlooking into other conferences
beyond the norm?
Right, so you've got black hat,defcon and B sides.
What other big conferenceswould you suggest that that
people look into beyond those?
You know big ones.
Speaker 3 (05:54):
So if you're in financial services, I tell you
to go to an FS I sec annualsummit.
So it's kind of it's not easyto get into because those you
have to be Working at afinancial services firm that's a
member of FS I sec.
That's criteria.
But if you're working at a bankor any financial services
that's that is a member of theFS I sec, I would urge you to go
to those.
Or there are very targeted tofinancial services.
(06:15):
You get to meet all the otherdoesn't screen that other banks
and they're beyond banks now.
They're credit unions, thehedge funds, their alternative
investor firms and it's it'sreally seeing on this industry.
It's a very financial serviceshave complex technology, complex
infrastructure.
You learn a lot in any of thosefirms.
(06:37):
I would say go check that,check that conference out.
Speaker 1 (06:41):
Yeah, definitely, that's very important, and I
think those are things thatpeople neglect, even us in our
industry.
Neglect is this If you considerit, I'm going to conferences
outside of just cybersecurity.
If you go to things like youknow, your healthcare
conferences, your your financialconferences and things of that
nature, then I think that itwould lend to being able to
(07:04):
speak more to the people thatare on the ground floor doing
the work, versus just alwaystalking to the executives that
are just looking to spend money.
Now you're talking to thepeople that will actually matter
.
So what would you say tosomeone who wanted to go to say,
I Don't know, maybe inhealthcare conference in it had
(07:24):
no CISO, no cyber security, no,no, nothing was involved.
But, as a cyber security personwanted to go there and hear
what they had to say.
Speaker 3 (07:33):
I think that's important.
You'll learn.
You'll learn new things there.
You'll learn if you're ready incybersecurity and you know the
principles of how to protectdata.
Mayfin interesting.
I mean find your secure job outhelp and anything that's
(07:56):
heavily regulated.
There's plenty of opportunity,plenty of jobs in security.
Speaker 1 (08:03):
Yeah, definitely I can't disagree with you there.
What I would like, though, isyou know, I love hearing from
you, but we've got a lot ofpeople here, let's see if
anybody else has any otherperspectives to give.
Who's next?
He was number one.
No, number two is whoeverstands up.
Speaker 5 (08:24):
Oh we got Tom.
Speaker 3 (08:26):
Oh.
Speaker 5 (08:32):
What's that make me first loser?
Speaker 1 (08:35):
So, tom, the question is you know, from your
perspective, what are the goodand bad of cyber security right
now, and what advice can yougive to newcomers in the
industry?
So good and bad of cyber.
Speaker 5 (08:45):
Interesting, I would say.
One of the bad things is peoplehave started to move to a new
paradigm, to what is more likewhat's good enough.
It would be the first thing I'dsay.
That's become a new habit.
It's like it's like the cop.
If it's free, it's for me andthat would be one of the
problems I see in the old daysto be like okay, what's the best
(09:07):
tools out there?
How can I secure myself?
The other downfall is theydon't pay for a training as much
anymore.
So part of the skills gap isbased on the training.
You know, I always look at itas it's like technology without
limits.
I mean this job is like.
The good part is it's like alife of endless learning, so
(09:29):
you're always learning, keepingyour brain fresh.
So that's my perspective onthis.
Speaker 1 (09:37):
Yeah, definitely, that's a good perspective to
have because, if you look at it,this is a field that you are
you, you are constantly learning, you're constantly growing and
you should always be doing moreto learn every day.
And I see that missing a lot ofpeople when they chase money
versus when they actually chaseeducation or opportunity or have
a passion for the field itself.
So, from your perspective, wehave a question here from
(10:01):
Michelle which actually is very,very valid on on the point here
.
You know, what Is the onemistake you see people who are
changing careers tocybersecurity make?
Speaker 5 (10:14):
waste in our money on college.
Speaker 1 (10:17):
So so you think well, what do you think truly college
is?
Is a waste, or do you thinkit's the way it is, just a price
?
Speaker 5 (10:26):
No.
So a couple of us are onadvisory boards for a bunch of
universities and I could tellyou from our experience
everything they're teaching atuniversities is five to ten
years too old, even thefoundations.
They're not even teaching thatcorrectly.
It's like my buddy over there,tom Brennan.
We were on a call one day and Ilike, oh, we just came out with
(10:48):
our networking class and I like, okay, do you teach cloud?
No, but we teach networking.
I'm like, okay, I have fun withthat.
Tell me how quick students andhired.
I think students need to bemeasured on how quick they get
hired, how quick they learn.
You know, not on every otherscenario.
There's so much I mean ElonMusk even said it passed I mean
(11:12):
there's so much free educationout there right now you can go
to you, to me, you can go toYouTube and how much you willing
to learn on your own before youactually blow 200,000 on a
degree.
Me personally, if you are gonnago for a degree, it should be
like a business degree and haveyour job pay for it, meaning,
okay, I'm moving into leadership, maybe I should go for business
(11:33):
management.
That's how I see May.
I've been doing this for Redteam side 24 years.
Speaker 1 (11:47):
You see, I don't have mixed opinions on that, because
I think some colleges areteaching the foundations
correctly, but I think othersare not.
So I think, depending on whereyou're at and what they're
teaching, you could have goodand bad things about it.
But at the same time, I seewhere you're coming from,
(12:12):
because they are just like themilitary, that the big thing is.
The military is always behindand the education and all that
they're teaching is thefoundations of IT and the
(12:33):
foundations of science.
So I think we can still hearyou on that.
Everybody else could hear me,but the people here on stream
could not.
I think Alex did that onpurpose.
They heard it from the other.
Mike, this is going to be a funstream.
(12:53):
Just say oh no, I love you all,but no, so I do.
I think it's one of thosethings that some colleges get
right, some do not.
Speaker 5 (13:04):
The problem is, everybody doesn't get to go to
those colleges you go to, likeCarnegie Mellon or MIT or any of
those Stanford.
The average person in theindustry doesn't get to go to
those.
Speaker 1 (13:18):
And I don't disagree.
I think Carnegie Mellon hasalways been huge about teaching
foundations, but they'reexpensive, extremely expensive,
so I don't disagree with that.
No, degrees don't need to becybersecurity degrees.
Degrees are MBA.
Get a degree and you can get ajob.
(13:38):
It's just like the militaryYou'll be an officer, right.
But anyways, before you go,because we want to bring someone
else on, if you give any bit ofadvice to anybody trying to
break it in, what would you say?
Speaker 5 (13:55):
Come be an intern for Alex.
Come to fireside chats.
I'll honestly find out.
Any of the local groups, isc,squared, elwas, whatever.
Go out and network and learnfrom people, because when we
first started in this industry Istarted in 99.
(14:18):
It was literally me going outlearning from other people.
Speaker 1 (14:24):
Yeah, that'll be.
The biggest thing is justlearning from others.
That's the best way for us tolearn.
Speaker 5 (14:29):
Yes, Alex is here to recruit interns.
Speaker 1 (14:35):
So we are going, we got someone new, alex,
everything else.
Speaker 5 (14:40):
Go ahead.
Speaker 1 (14:40):
Hold, go ahead and choose yourself.
Speaker 2 (14:44):
My name is Sean Malito and there's a delay and
it's really annoying, so I'mmanaging direct and I don't do
this usually, as you can tell.
Managing director for Cypher,we're a company that does
ransomware negotiations andsettlements and recovery and
remediation.
That's awesome.
Speaker 1 (15:07):
So I got a question here from one of my good friends
, an Army veteran.
If you were asked to hiresomeone, what green flags green
flags, not red flags what greenflags would you look for in an
entry level resume?
And what are some green flagsyou would look for in an
interview with an entry levelapplicant?
Speaker 2 (15:27):
On the data security side of things, forensics
recovery and remediation?
Yep, You're asking the wrongguy.
I'll be totally honest with you.
I do the relationships betweencyber insurance companies breach
coaches.
That said, I got to think thatmy team would love people who
are willing to learn, that aredisciplined.
Speaker 1 (15:50):
So what about from your perspective, in sales or
the partnership building thatyou do?
So?
Speaker 2 (15:56):
yeah, it's a huge industry now, cyber insurance.
You've got the cyber insurersthemselves.
You've got the cyber brokerswho place the business with the
end clients.
You've got the risk managementfirms.
You've got the vendors, likepeople who do what I do, and
then you've got the breachcoaches, who are the privacy
lawyers that handle the claimsas they come in.
(16:19):
It's kind of it's this massiveecosystem and my job is to know
who everybody is and puteverybody together when
somebody's had a ransomwareattack and they need help.
Speaker 1 (16:32):
So, from your perspective, especially in
ransomware, are you seeingcompanies, are you seeing
insurance companies, ratherespecially in that industry,
doing more due diligence toseeing whether or not
corporations and companies areimplementing the right policies,
procedures, regulations,frameworks and things like that,
(16:53):
or is it still a lot of?
Yeah, I checked the box, so younow get insured and you get
everything along those lines.
Speaker 2 (17:01):
Yeah, no, the due diligence is a lot more in depth
than it was three or four yearsago.
There's a large cyber insurercalled CFC, which they don't
even say what they.
It used to be called click forcover and you could just
basically click a couple ofboxes and you get yourself some
cyber insurance.
They don't do that anymore.
(17:22):
There's very, very in depthquestionnaires, pages of
questions all the way down to isit MFA?
Where is it enabled?
What systems all of that and ifyou lie on any of that, there's
a good chance you're going tohave your claim denied.
So people are taking it a lotmore seriously now than they did
(17:44):
years ago.
Speaker 1 (17:45):
Yeah, definitely.
So last question before we moveon, because we do have a lot of
people here that we want to tryto get on If you have any
advice for anybody trying tobreak into cybersecurity or even
in the field you're in withdeveloping these partnerships
and kind of building theserelationships what would you
give them?
Speaker 2 (18:04):
It's a great time to get in.
I know that there's been a lotof layoffs, but we're not seeing
it on the cyber insurance sideof things.
So if you want to get on thepre-breach side where you work
doing pen tests, vulnerabilityassessments I know a lot of
companies are hiring on theinsurance side or on the data
security side there, and thenanybody for any of the vendors
(18:27):
where I work and where peoplelike Sentinel-1 and people on
the back end work as well.
Speaker 1 (18:32):
Yeah, definitely, and I want to thank you for coming
on.
It's been awesome having youhere.
So what we're going to do nowis we're going to see who wants
to come up next.
Speaker 4 (18:42):
Where's number four?
Speaker 1 (18:43):
Hit the hot mic.
Take a good job, man Nice work.
Speaker 6 (18:51):
How are we doing today?
Frank Angioleli, I am theManaging Director of MSOC.
We are a managed securityoperations center and our goal
is to accurately detect attacksbefore they cause damage and
either prevent them or respondquickly before it gets worse.
Speaker 1 (19:10):
So, as the Managing Director of MSOC, attacks always
happen and you can't guaranteeever 100% security.
So what would you say is thebest way to really lock down
(19:30):
something like a ransomwareattack or something that hits
immediately?
Speaker 6 (19:34):
No complex question, but there's two aspects to SOC,
to understand it well.
The first one is our adversaryis sentient, so we're fighting
against human beings, and thesecond one is they always have
the initiative, meaning they canattack anywhere, anytime, from
any place.
It's almost like defendingEngland against a Viking
(19:54):
invasion, and so at that pointin time, one of the strategies
that really works very well ismilitary type strategies like
Cuswitzy.
And strategy which are tryingto do is you're trying to defend
at your strong point and attackthem at their weak point.
You're trying to interdicttheir operations where they're
(20:15):
weak.
And believe me when I tell youred teams adversaries, they have
weak points.
Speaker 1 (20:23):
You know I laugh about that and I was saying
something because Natalie Baker,who is in the chat right now,
she calls herself the SOC queenon occasion, depending on what
you're looking at, what platform.
But she actually loves SOC andwhat you're talking about, and
so you know, one of the biggestthings for her has always been
(20:44):
you know, you have to bereactive but also proactive at
the same time.
Right, so you're trying to stopattacks, at the same time, you
have to be able to react.
So, in that same vein, howwould the MSOC not only help
prevent, but what is thereactionary measure like?
(21:05):
Where do you really put more ofyour focus when you're doing
things?
Speaker 6 (21:09):
It's an excellent question, and so to describe
that, I'll put it to you thisway Most people will spell a
word the wrong way, but they'llspell it that same wrong way
every time.
When I do this, I spell aparticular word, when I type it
out the wrong way, but I do itthe same way every time.
(21:29):
Adversaries and attackers havethe same issues, they will do
repeatable patterns, they'llstick with what they know,
they'll go for the path of leastresistance, and so what you can
do in that scenario is, as theycome in an attack pattern,
they're going to replicatecertain things and you can, you
(21:49):
know, almost like pulling thepin out of a machine.
That makes the whole machinefall apart.
That's the goal.
The goal isn't to solve thisvolumetrically, because it can
attack anywhere, anytime, and sothere's commonalities in their
attacks, there's commonalitiesin the laboratories, and if you
can find them, you can drop themin very key points.
(22:11):
Think about from a fundingperspective.
In SOC, people will always say,oh, we need more people.
Why?
We need more people?
Because they can attack fromeverywhere, why?
And so today, the solution tothat isn't in funding more and
more and more with huge, hugeamounts of money.
It's about using those patternsto find out how you can
interdict that adversary withoutan overwhelming amount of
(22:34):
funding and cost and source,because SOC is expensive and we
need to keep it manageable tomanage the risk level.
Speaker 1 (22:43):
Yeah, definitely.
Now, before we go and before wemove on to someone else that we
want to keep going with moreand more, I want to ask if you
had any advice to give someonebreaking into cybersecurity
right now.
So you're talking to yourjuniors, your college students.
Whatever the case may be, whatadvice would you give them?
Speaker 6 (23:01):
Yeah, so I would give you three points In order to be
successful.
Look for things that you like,that you're good at and that
people will pay you for.
If you can make those three,you will make a career.
Speaker 1 (23:16):
I love that and and honestly thank you for being on
and thank you for being here.
And you know what, here at NewJersey Cyberfire Sides, we have
a lot of people back there.
Holy Jesus, we're going to keepit going, but with that, let's
let's get someone new here onthe stage and let's hear what
they have to say.
Alright, so, andy, why don'tyou give a little bit of an
(23:46):
introduction who you're herewith and what you're all about?
Speaker 7 (23:50):
Andy Hutchinson.
I am a solution architect atDatabricks and I support the
financial services vertical aswell as the cyber asset me.
Speaker 1 (23:59):
That is.
That's awesome, so beinginvolved with with that side of
things.
So is it right for me to sayyou're more involved with the
sales side of how things go?
Speaker 7 (24:12):
Yes, but at the same time I have to share.
Sales reps guide the customerin the right technical direction
and they're not promisingthings that we can't deliver on
the technical side.
So while day to day I spend alot of time with sales folk,
when I'm working with directlywith customers, it's mostly
technical engineers, you know,directors, things like that, and
then in the cyberspace it'sdirectors up all the way to the
(24:36):
CISO.
Speaker 1 (24:38):
So so, from a Databricks side, give me a, give
me a little insight.
You know, being from Databricksis something I haven't heard of
before.
It's a new company to me.
Speaker 7 (24:48):
Give me a little insight on on how they are
innovating and doing thingsdifferent, yeah, so those who
are familiar with Databricks, weare the pioneers in the
Lakehouse platform, which isbringing together the
centralization of data, browsingand data lakes under one roof.
But we also have a kind ofadvanced cyber SME group.
We have a lot of ex government,ex Splunk who have started
(25:12):
building things into theplatform that make data
ingestion as scale easier, aswell as detections and
automations into the platformbased off those data's that you
know.
We're talking about petabytesworth of data and not just small
terabytes.
Speaker 1 (25:28):
And that's huge because you know, when I look at
sim, when I look at data lakes,when I look at all these things
that ingest data, being able toparse it, being able to really
ingest it and do all thisdifferent things with it, having
that capability is huge.
So, in that space and what youdo, you know as a solutions
architect and being what you'reable to deliver through
(25:51):
Databricks and things of thatnature, what would you say is
the key factor to being able toget to where you're at and have
the knowledge in this space ofDatabricks kind of what they do.
Speaker 7 (26:04):
Honestly, when I first started Databricks, I
didn't know anything about Spark.
I didn't know anything aboutcyber security, and the best way
I learned was by doing.
You know, I built my cybersecurity background by helping
one of the largest media andentertainment companies build
out their cyber security stackand, you know, learning with
them and educating them on allthe things Databricks can do.
Speaker 1 (26:28):
That's huge because I think, when you look at it back
to being able to learn from thefront, being able to you know
no matter where you come from,you can really pick up on the
field.
So, as you were learning, asyou were growing in the industry
over the past two years, whatwould you say was the biggest
asset to you in being able tolearn?
Speaker 7 (26:48):
that All the people around me and the fact that when
you're able to ask questions,they'll give you, you know, very
straightforward answers, and ifyou don't ask questions, you're
never going to learn frompeople who know what they're
talking about and the experts inthe field.
Speaker 1 (27:02):
And that's awesome and I got.
I got one more question here.
I don't know if you're going tobe able to answer it, but we're
going to figure it out.
How can you get an entry-levelinternship for Databricks?
Speaker 7 (27:12):
We actually have a pretty robust internship program
, usually both from aengineering perspective, and we
may even branch out into thecandidate headquarters as well.
Speaker 1 (27:32):
That's fantastic.
I love internships.
I think the more internshipsthat are out there, the better.
Final question and this one isfor me personally, because I
always throw it out there whatadvice would you give to any
newcomer breaking into the cybersecurity space?
Speaker 7 (27:47):
Don't be afraid to ask questions.
Google is your friend for youto get started.
But you know, surround yourselfwith people who know what
they're talking about andexperts in the field and lean on
them for your early educationand then you know, grow from
that, that's awesome, so.
Speaker 1 (28:04):
So this is what I'm going to do, guys.
I'm going to give everybodyhere we're about 30 minutes in
I'm going to give them all a twominute break and we are going
to roll with it here in a minute.
The mic was muted, so let's trythat again.
Howard, go ahead andreintroduce me.
(28:25):
Can you hear me now, there wego All right.
Speaker 8 (28:27):
So my name is Rick Adams.
I'm a senior sales engineer forhunters out of the US East.
I'm based out of Tampa, florida.
Glad to be here in New Jerseyfor the fireside chat.
Glad to meet everybody onlineas well too, that's awesome so.
Speaker 1 (28:40):
So yeah, it was for all those in chat.
Look, the mic was muted becausewe stepped away.
I didn't want you all here andall that.
Don't be all up in arms, butanyway.
So you're here from Hunter.
So, as you're here from huntersand you are one of our sponsors
, yes, give me a little insighton what hunters can do.
Speaker 8 (28:59):
So hunters effectively can.
We're working on what we callabout movie on Sim.
Okay, so we're effectively aSim replacement.
So if you kind of think aboutin terms of like Sims, a lot of
folks today are very, veryunhappy with where their Sim
deployments are from a costingestion perspective.
You kind of think about, thefact is, sims are very costly,
(29:20):
right, data ingest is extremelycostly.
The other thing that we do iswe are really automating the
meantime to identify and respondto incidents.
Okay, so what we're doing iswe're automating the data
onboarding process, vendors outthere and we're effectively
building that into a datapipeline.
Now, our data pipeline is builton top of Databricks as well,
(29:42):
so we actually do Databricks onthe back end to actually align
that, which is really cool.
So we're actually building outa security data lake for our
customers.
So we're building that into acommon schema and then we feed
it into what we call ourdetection pipeline.
Now, the cool thing thathunters does is right out of the
box.
Hunters has a number ofhundreds of detectors that are
built out of the box.
So your analysts are nowcurating and building detectors.
(30:05):
They're not building up,parsing data, onboarding data.
We actually simplify theonboarding of the data process
and then, effectively, whatwe're doing is we then feed it
into what we call ourinvestigation engine.
So we're doing for an analysttier one to tier three is we're
simplifying the time it's goingto take them to onboard detect
signals from the actual sourcesthat we're bringing in, and then
(30:26):
we're doing the crosscorrelation of those data
sources.
So we're tying, for instance,your EDR source to your identity
source, to your cloud source,and we're actually not only
building out what the actualalert was, we're tying it to all
the events in the attack chain.
So that's what we're doing withhunters.
We're really kind ofsimplifying that time for the
tier one to tier three analyststo identify and respond to those
(30:46):
incidents.
So that's essentially what wedo in a 10,000 foot for you.
Speaker 1 (30:51):
That's awesome.
So, as I said, we have oursought queen here, natalie Baker
, and Natalie has asked anamazing question, and actually
two now.
So the first is are you?
Speaker 8 (31:03):
a sore?
No, we are not a sore platform.
So we do have essentiallyeverything but the R in the sore
right so we can do theautomation and orchestration,
but we're not there.
We actually response okay.
So what we're doing is we'renot a remediation engine.
What we're going to do is giveyou the fidelity.
We're going to cross stitch allthe different data sources
(31:23):
together and do the autoinvestigation, but the
remediation typically tied tothird party sore vendors.
So, for example, we partnerwith Tines and Torq to actually
build out playbooks and actuallydo the remediation steps for
our customers, right?
So that's not what we're doing.
We're not focused on theremediation part of the sore, so
we're not a sore platform Allright.
Speaker 1 (31:46):
And so now we got another question.
Sure, Do they?
Do you cross reference to anycompliance standards to make ops
life easier?
Speaker 8 (31:56):
Yeah.
So, for example, if you thinklike compliance, I mean you're
talking about like NIST orsomething like that, or looking
at like different, like our.
So one of the reasons why Iasked the question is because
one of the things that we alignto from a detection perspective
is we're aligned to the MITREattack framework.
So everything we do with our,our platform, is aligned to
MITRE and then, in addition tothat, we have a team of threat
(32:18):
analysts that actually addadditional threat techniques
into the MITRE attack frameworkfor our detection rules that are
built into Hunter.
So we actually show you thecoverage, the gaps and
essentially what are what wecall the what if scenarios on
new, on on new data sources thatwe would onboard.
What about Fed?
So we want FedRAMP certified.
Today we're going through thatprocess, so it's going to be.
(32:40):
It's essentially, it'sobviously it's a lengthy process
, but today we're not, we arenot FedRAMP certified.
Speaker 1 (32:45):
Yes, all right, and so this is going to be the last
question I take from Natalie onthis Dang dang.
She's killing me today.
Do you partner with Swim Laneat all?
Speaker 8 (32:53):
So I don't know at the top of my head if we
actually partner with Swim Lane.
It's like I don't know ifthat's something.
I'd have to double check to seeif we do that specifically, but
I don't know if that's actually.
Jared, who's here, wouldprobably know that better than
me, but I don't know of top ofmy head.
So that's awesome and so youknow.
Speaker 1 (33:09):
I'm trying to get more.
We got a ton of people here soI want to get more and more
through.
So, not to cut you short, butif you can give any advice to
somebody breaking thiscybersecurity, and especially
what you do, what advice wouldyou give them?
So, actually, for me, Iactually have a lot of people
who are in the community.
Speaker 8 (33:23):
So actually for me, I actually got into cyber about
seven years ago.
I'm formerly Cisco.
I actually came over to Huntersabout a year ago.
I got into actually the simspace about a year ago too as
well, and I will tell youhonestly and I've heard a lot of
folks talk about you know,careers and where they're trying
to establish themselves I'vebeen in this business for 35
years.
I'm going to tell you right now,this is clearly the space to be
(33:44):
in, specifically on threatdetection and analysis, and I'll
tell you, this is an area thatI think most folks should really
focus.
It's actually been the mostvaluable for me and actually my
colleagues, and so I feel thatyou know, obviously, the folks
that are like kind of listeningon this podcast, if you're kind
of going through this yes, youtalked about the fact that you
don't have to go for formalizedschooling but definitely I would
(34:06):
definitely focus on, you know,threat analysis and detection,
because this is what we'reactually doing on investigations
and that's typically where Ifind a lot of the growth is
happening in the business.
So that's kind of like where Icome in from my perspective.
It's only an opinion, it's nota fact.
So that's what those werecoming from.
Speaker 1 (34:22):
So that's awesome and thank you for being on.
And look, that's what we'regoing to do.
We're going to keep it rolling.
We're going to keep it moving.
All right, we're going to keepit going.
So let's, get someone else upto the stage.
I think you've got one morecoming up.
There you go.
Hopefully that went.
Okay, I try to get your contactinfo for now.
Speaker 8 (34:41):
Oh, yeah, sure, absolutely yeah.
Speaker 1 (34:47):
You gotta love answering questions while I'm on
camera, not realizing I'm oncamera.
You know it happens, all rightanyway.
So we got someone new coming upto the stage.
You're gonna answer somequestions, but first let's get
into introduction.
Hey, is your mic hot?
Is it red or green?
Speaker 4 (35:05):
Green, all right you're good, all right.
Hey, I'm Josh Berkowitz, theowner of Crestview Public
Adjusters.
We represent policyholders whenthey first party claims against
insurance companies, and nowwe're here just to get more
educated on cyber insurance andhelp people understand what we
do.
Speaker 1 (35:22):
So, knowing that, what I would like to do, though,
so about this, is, you know,tell me a little less about the
organization Now, tell me alittle bit more about you,
because we got a variety ofpeople.
Speaker 4 (35:32):
So I gotta talk, or I gotta talk people.
Speaker 1 (35:35):
So we're gonna get a little bit of everything in here
, sure, so for today, you know,give me a little update on how
you got into cybersecurity andkind of what's going on, can you
?
Speaker 4 (35:43):
hear me you can hear me right.
Okay, so my background isreally representing owners of
real estate commercial owners ofreal estate when they have
property damage, and a couple ofyears ago I met with a
individual who represented bigcompanies when they got breached
against insurance companies torepresent them.
So, being an expert in thefield of representing
(36:03):
policyholders against insurancecompanies with property damage,
I started getting more educatedon the subject about two and a
half years ago and then we gotour first lead in our first
claim.
So after handling that andgetting our feet wet, we started
building up what we call like acyber ops team to help us and
help our clients when they haveclaims against insurance
companies in the cyberspace.
So that's really how we've kindof evolved.
(36:26):
I became an expert in theproperty damage side and, using
those skills, negotiated withinsurance companies on behalf of
policyholders kind of usingthat to our advantage to help
the policyholder out.
Speaker 1 (36:38):
That is absolutely awesome because it just shows
the transition of being able todo one career field and bring
that into the other, and that'sa lot about.
What I talk about is being ableto take what you know, bring
that into to cybersecurity andbe able to establish that.
So that is absolutely awesome.
I love hearing that and so,going from that, what do you
think was the biggest benefit?
(36:59):
You know what, whether it's ahard skill or something, what
was the biggest skill took fromthe other?
Speaker 4 (37:16):
And the policyholder and being an advocate for the
policyholder against insurancecompanies.
We should understand insurancepolicy better than the insurance
company.
So that's one aspect of thisbusiness where we kind of are
above everyone else.
We don't really let them tellus where there's coverage.
We're kind of telling them hey,this is where it says what it
(37:37):
says in the policy and this iswhy you should cover XYZ for
happening.
And that's really importantbecause you want to make sure
you have an advocate on yourside when you have, you know,
any type of insurance claim,especially cyber, insurance
breach or any type of claim.
Speaker 1 (37:52):
So would you say in that aspect, would you say that
cyber insurance?
I'm trying to think of how tophrase this question because I
have a huge issue with the waycyber insurance initially came
in versus where there are now,because I still relegate my
(38:14):
mindset to where they came in atof oh, you did the bare minimum
, so with where you're at now.
So bringing real estate andreal estate has always been a
huge insurance.
They investigate everything thecode, the helpings of bills how
it was designed everything.
Do you think cyber insurance isat that level, or do they still
(38:36):
have a way to go?
Speaker 4 (38:37):
They still have a ways to go.
I mean, I've been doing thisfor six years, I've been in real
estate for 15 years, but theystill have a long ways to go.
There's a tremendous long wayto go, I think.
To be honest with you, what'sscary is what's going to happen
in five years from now, becauseinsurance companies are losing a
ton of money by paying outclaims.
So are they still going to bein a space of insurance?
(38:58):
Cyber insurance?
That's what really could bepotential here.
But hopefully they stay in thespace and they're just going to
make it stricter for people toget insurance and they're going
to increase premiums becausethey when you were talking about
the start of the space, whenthey started getting the space
premiums for anyone to getinsurance and people were
talking about earlier to getinsurance within 30 seconds you
(39:19):
can have cyber insurance.
That's no longer available toanyone at this point.
You have to, they have to havepen test, different steps to
take in order to get insurancenow.
So there's still a long ways togo.
That's all the more so why wecould, why there's more of a
need for someone on the policyother side to help out against
(39:40):
insurance.
Speaker 1 (39:42):
All right, so I got two more questions for you.
First one is do you think thatauditors, especially constant
auditors?
I don't know if I have abackstory on this, by the way,
so I will advise on that.
Speaker 4 (40:02):
To be honest, I'm not .
I don't really know.
I don't want to give them.
I don't have an opinion on that.
Speaker 1 (40:09):
All right.
So the reason, the reason Iasked that question, is because
I have seen auditors who makefriends with the owners of the
companies and the CEOs andthings like that, and so they
get passed every time on theiraudits as if they're doing
everything right.
So when it goes to theinsurance companies, the
insurance companies see oh yeah,they passed on their audits,
they're good to go, they'redoing their due diligence.
(40:29):
But knowing, insight,information that is not always
the case.
Speaker 4 (40:34):
Well, I think it's always better to have a third
party come in and analyzesituation, not even an auditor.
You have an auditor and youhave someone that is looking at
the auditor.
I don't there's such a thing asthat, but I to your point.
I think that's probably, youknow, not the best.
There's probably some unethicalsituation there if they're just
going to keep auditing themover and over again.
Speaker 1 (40:51):
You're absolutely right, and that was the big
thing I was getting to is beingable.
You have to.
I think their needs to comeinto play.
If you're going to haveauditing and insurance, you need
to have auditors change everyyear, two years, whatever the
case may be.
There needs to be a plan inplace for the insurance
adjusters to be able to say hey,you had the same auditor for
like 10 years, the same exactguy.
(41:11):
There's an issue here, sure,and so I think that's where a
lot of the problem comes intoplay.
Now the final question is andlike I've been doing this entire
night if you could give anyadvice to anybody breaking into
cybersecurity, whether it's ininsurance or whatever you know
about cybersecurity, what advicedo you?
Speaker 4 (41:29):
have to give.
My advice is if you want tohelp out the policy holder and
people you know, large companies, get a public adjuster license
and contact us, because therearen't many people in our space
and there's a big opportunity inthe cyber space to represent
policy holders against insurancecompanies.
Speaker 1 (41:47):
And what is the best way to break into auditing if
you know?
Speaker 4 (41:52):
Just get a license, start getting education,
networking, going to networkingevents and things like that.
I mean going to networkingevents like this is definitely
where you meet people, yeahdefinitely.
Speaker 1 (42:02):
I completely agree with you.
Thank you for joining me thisevening and I will say this for
anybody who's trying to breakinto any industry it is the
smaller events, it is the B-size, it is this New Jersey cyber
fireside and a few others whenyou will find these people.
When you go to things like DefCon and Black Hat and things
like that, it is verycommercialized and you are not
(42:24):
necessarily going to find peopleof all industries Not that they
won't be there just that you'regoing to find your crowd and
kind of blend into them, whereassmaller events like this you
get to meet everybody and youare not blown away and just tied
into a small little crowd.
So get to the smallerorganizations, get to the
(42:45):
smaller events and that is whereyou will find success in being
able to meet everybody from allaspects of cybersecurity.
Okay now, moving on from that, Iam pretty sure we have another
guest coming up and let's figureout who it is.
Who was our next guest?
Who is next on the choppingblock?
People, you are me All right,let's do one more and I will
(43:10):
call tonight.
No, no, jason doesn't want to.
All right, so look, hey, thisis how we're gonna run this
night right now.
Speaker 2 (43:24):
One more one more.
Speaker 1 (43:28):
Bring your drink.
What are you doing in asecurity happy hour?
Bring the drink.
She was about to not bring thedrink.
Speaker 9 (43:40):
I'm green all right, I'm green all right.
Hey guys, I'm green sointroduce yourself please.
Hey, I'm Taylor Lee from was weLLC.
I'm actually the CISO andthat's the CFO.
We are a risk management,compliance and grant acquisition
firm in Montclair, new Jersey,who services the public and
(44:00):
private sector.
Speaker 1 (44:05):
All right, so I ain't gonna lie.
Alex kind of took me away.
He did you know, but I'm okay.
We're good, we're gonna runwith it.
I love you.
Speaker 9 (44:16):
Everyone.
We're here with it.
Speaker 1 (44:17):
We are, that's how we do so, like this one, I want to
ask with what you do?
I heard four letters.
If I'm not mistaken, gotcha,you said CISO am I correct?
Speaker 9 (44:28):
Yes, you did, and you heard CFO, I am both.
Yes, it's a headache, yes, it'shard work.
Speaker 1 (44:35):
So so this woman here is a Is a CISO and a CFO.
So here in chat, if you don'thave questions, I'm gonna smack
you all come on.
I know who you all are.
Bring on the question.
I'm just saying let's go.
Speaker 9 (44:51):
I know you all love me, guys.
Speaker 1 (44:52):
Let's go so bring some good ones, come on.
This is the first question Igot to ask, though.
Where did you get your start incybersecurity?
Speaker 9 (45:01):
So my start in cybersecurity, believe it or not
.
First I'm gonna be upfront withyou guys.
Guess what?
I'm 26 years old, so my startin cybersecurity actually
started completely by myself,learning it on my own self,
teaching.
And then what I did is Istarted gaining mentors and
realize, you know what?
I need to get some moretraining and learn actually the
(45:22):
real ins and outs ofcybersecurity.
So guess what?
Although education, I do notrecommend going to college
specifically for a cybersecuritydegree.
I did.
I graduated last month, guys,cheers to that.
But that's actually how I brokein and I started my company in
2016 with my business partnerOver there, cynthia slaney.
(45:45):
She has an amazing backgroundin environmental and healthcare
and Literally from there, I'mhere in front of you today and
CFO and CISO, loud and proud.
Speaker 1 (45:57):
So I have just been informed that if I do not
mention my good friend and afellow warrior, I'm on a walk to
harbour to you.
She is going to kill me.
So I'm gonna mention her to youand you need to talk to her.
We'll get connected.
Well, we'll.
We'll change details,absolutely.
I got a lot of people thatwould love to work for you.
Just absolutely.
Speaker 9 (46:18):
I like to hear that because, literally, we've
actually launched our summerinternship program and it's
actually been amazing.
So, guys, we will be actuallylaunching another internship
program after the summerinternship programs.
So, for my students, come onout there.
Cyber security internships wehave info set, secure
internships, as well asmarketing and so many others.
(46:39):
So, guys, come on down.
Speaker 1 (46:45):
That is.
That is absolutely awesome.
I've got a lot of people inthis chat, so I don't you know
Me and you were just meetingtoday.
Speaker 9 (46:53):
It's started, I know, that.
Speaker 1 (46:57):
So I'm gonna let you know me and my warriors.
They they looking for jobs,they looking to link up with you
.
Speaker 9 (47:06):
Okay, because opportunity is knocking at your
door and one thing about it hereat was we LLC is we also make
sure that you get educated.
So one thing about it is that'sa huge component of grant
acquisition is making sure thatthe employees at work at was we
LLC Can also make sure that theyget tuition reimbursement from
grants and other grants that waswe LLC applies to In-house, so
(47:29):
that you can actually thrive andnot actually have to deal with
Tuitions and all of those othercrazy.
Speaker 1 (47:36):
I gotta say this because here's the thing a lot
of what I see hey, I've gotNatalie Baker again, the saw
Queen, who wants you as a gueston her podcast.
Yes, I, queen, and we are gonnaget you as a one-on-one on mine
also.
Yes, beyond all this, you'recoming one-on-one, we're gonna
do it all for it.
But I want to say this is youknow, the big talk within our
(48:00):
industry and I have seen it timeand time and time again is
representation.
You being here today is onestep forward in that, and
showing what you've done is aCISO, cfo and everything you've
done for your career.
So, for those who are preachingRepresentation in all this and
all this stuff, what advice doyou have for them?
Speaker 9 (48:22):
So one thing I'm actually gonna say about these
companies that preach that isit's bull crap.
For, you know, companies likemyself, we practice it, we
preach it and we are it.
Representation is critical, itmatters.
And representation also matterswhen you're being a leader of
Influence and being that personthat if it's a student or if
(48:45):
it's someone that's breakinginto cybersecurity or IT, that
they can just come to you andask those questions.
So I really thinkrepresentation it starts with
really being that main point ofcontact and being okay with
Somebody asking you somequestions that yeah, it may have
been a tricky cybersecuritythreat that you dealt with, but
how did you handle it?
So I always say representationit starts with you being honest
(49:08):
and really being forward andbeing open in there for others,
as you know, in Mentorship orjust help, or for partners.
Speaker 1 (49:16):
So one of the questions I have along those
lines is how, how hard did youfind it getting to from where?
Again, I'm 36 years old.
I still I'm not in yourposition.
I've not where you're at.
I don't know what the hellstopped me from getting where
you're at, but you are damn wellahead of me and I ain't even
(49:37):
mad at it.
I want to learn from you,that's right.
So, with where you're at inyour career, with the things
that you've done, what drove youto there?
Was it upbringing?
Was it family?
Was it social there?
Was it upbringing?
Was it family?
Was it support?
What?
What got you to where you're at?
Speaker 9 (49:55):
So one thing I'm actually gonna say is a major
driver for me was I actuallysuffered from an injury in my
12th grade year when I actuallywas bedridden.
My 12th grade year.
I was not in high school, so Ihad to do homeschool.
So during that time I got to dosome research and really so
find out that I Want a lot morefor myself.
(50:15):
So I actually started in thepharmaceutical industry.
Um, so you're like, how does shestart in the pharmaceutical
industry right from an injury?
Yes, because I wanted to knowwhat drugs I was taking, what
was going on.
So it started there, and thenwhat actually happened is I was
like, hey guys, this isn'tenough money, it's too many
hours, it's breaking my back.
Um, so I actually had to moveon and find something else.
(50:37):
So I was just actually Swimmingthrough and, you know, doing my
networking, and really how itbroke through was making sure
that I was building thoseconnections and finding out what
I love most and what I wantedto do and what I was passionate
about Was the key that drove meto say, all right, this is it.
Let me see what cybersecurityis about, let me see what I can
(50:58):
do and let me see how I can doit.
So it was literally that was, Iwould say, my main driver that
just took it off from here tothere.
Speaker 1 (51:07):
So I got one more question for you and then, and
then we're gonna move on.
How.
I have a hard time with thisquestion and me and you can
discuss off air why and thiswoman knows why Me and her are
gonna be fighting for her askingit because I love her.
(51:28):
Um, but when did it go?
All right, how hard was it foryou, being a black woman In
cybersecurity, to get to sysso,and what were some of the
stumbling blocks you ran across?
Speaker 9 (51:42):
So actually I would say there was a lot of
opposition, um, and a lot ofdoubt.
So one for me, being young,there was already you're too
young, you can't get into this,you can't do this.
And then, of course, me beingblack, and normally you would
generally see me with an afro.
So I normally, if you see mylinkedin um, you can find me on
(52:03):
linkedin at taylor lee.
You would see me with an afrogenerally when you see me
walking around.
So Actually, I would say thehardest thing about that and
some challenges that I facedduring that would be a lot of
opposition in doubt.
So that made me say the heckwith that.
You go ahead and doubt mebecause I'm going to prove you
guys wrong um, time after time.
(52:23):
And then another thing I wouldsay is that I guess would be an
opposition was Always makingsure that you're resourceful, um
, invaluable.
That has been a major driverfor me, um, and really making
sure those stereotypical Viewsand different things that you
deal with, especially, um, forpeople who are black, um, that
(52:45):
may face.
So I always bring, say, bringvalue in that room, bring
knowledge in that room, bringsomething new, um, and you can
change the view.
So I would say in the beginningthere's tons of opposition, but
um after you really make thoseUm views change about you, you
usually are respected, just likeeveryone else in the room.
Speaker 1 (53:07):
So I have one last question for you, me personally,
and this is coming from me um,do you feel that and it's
because of our political climate, so I'm going to ask this
question?
I love that bring it.
Do you feel being a black womanhas held you back from where
(53:28):
you want to be in life?
Speaker 9 (53:30):
So I love this question, because I even get
this question from my community.
Um, I'm going to completely saywhat held me back was
completely myself.
I'm not going to say it helpedme me being black.
Um, I go for any opportunitythat I want.
So what that looks like is, ifI want to own my company and I
(53:52):
want it to be the leading riskmanagement, compliance and grant
acquisition firm in new jersey,that is what it's going to be.
I have to work toward it and Ican get it.
Um, what?
Of course, everyone's not goingto love me.
Everyone's not going to lovewhat I bring.
But you have to also look atthe side of things where, um,
you, you don't have.
Those things don't matter toyou.
(54:14):
Your goal and what you want tocome out of it matters.
So I would say that shouldnever and has never really
stopped me personally.
Others maybe, um, but no, don'tlet it stop you.
Let it be a amazing driver, uman influence for you to keep
going.
Speaker 1 (54:32):
I absolutely love that.
Thank you for joining us thisevening.
Speaker 9 (54:35):
We're gonna get.
Speaker 1 (54:38):
One more For guests on this show and I gotta say
I've got to get your informationNatalie Baker on linkedin, and
she's a good friend of mine.
So, queen, she's gonna get yourinformation and I got to hook
you up what.
Mrs Sarver, I've been drinkingso she knows I ain't gonna
pronounce her name, right, I'mgonna hook you up with her.
She is a good friend of mine,she's one of my warriors, she's
my sister.
We're gonna.
We're gonna get it all hookedup.
(54:58):
All right, cool, let's getawesome.
Let's get one more up here.
We got one more guest.
We got to get up here.
That one's just.
You know that's sent everybodyup, so we're gonna go.
We got one more, let's go.
Who's coming to the stage?
Who's coming to the stage?
Nobody.
All right, look, we got to goto keynote.
(55:20):
This is new jersey cyberfiresides.
We're gonna go keynote.
Get on with the show.
Look, I love you all.
This has been security happyhour.
You know, I'm all here for youand I will talk to you all All
next, actually this Friday.
So y'all take care and enjoyyourselves.
Popular Podcasts
Crime Junkie
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by audiochuck Media Company.
24/7 News: The Latest
The latest news in 4 minutes updated every hour, every day.
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.