Navroop Mitter:

[00.00.00.03–00.00.00.29]

Hello, this is Navroop Mitter, founder of ArmorText. I’m delighted to welcome you to this episode of The Lock & Key Lounge, where we bring you the smartest minds from legal, government, tech, and critical infrastructure to talk about groundbreaking ideas that you can apply now to strengthen your cybersecurity program and collectively keep us all safer. You can find all of our podcasts on our site, armortext.com, and listen to them on your favorite streaming channels.

Navroop:

[00.00.00.29–00.00.00.31]

Be sure to give us feedback.

Matt Calligan:

[00.00.00.31–00.00.00.55]

Welcome back to The Lock & Key Lounge podcast. I am your host, Matt Calligan, and here’s something that I’m running into this week. If you ask almost any security leader whether threat intelligence matters, you’re going to get a yes. But if you ask them to fund this, if you ask them what money they’re putting towards it, the room can get a little quiet on that one.

Matt:

[00.00.00.55–00.00.01.27]

And SANS has actually put some numbers on this. About 91% of CISOs at this point say that their cyber threat intelligence program is valuable. Having CTI is a valuable part of the security program. But when you dig into that, only about a quarter say it shapes decisions. And for about three years running now, funding it has been one of the top, if not the top, reason why CTI teams can’t move forward, why programs can’t move forward.

Matt:

[00.00.01.27–00.00.01.57]

So today’s question is simple: if everyone says it matters, then what’s holding back people from actually paying for it, actually driving it forward, making it a formal program? And how do you build that argument that actually unlocks that budget if that’s the case? My guest, Tom, is a Threat Hunt Analyst at Intel 471, which is a cyber threat intelligence company focused on the cybercriminal underground and providing intelligence as a service for that research.

Matt:

[00.00.01.57–00.00.02.36]

Before that, he spent a decade building and developing a security operations center at FirstEnergy, one of the United States’ largest electric utilities, serving as security analyst, security engineer, and then ultimately the SOC manager leading the operation for over five years. There, he led the people and processes responsible for detecting and responding to threats against critical infrastructure. The career arc is what makes him actually the right person for today, because Tom has been the practitioner trying to convince leadership to invest in intelligence, and now he is on the side that produces that as a service.

Matt:

[00.00.02.36–00.00.02.42]

So he knows what the business case sounds like from inside the budget meeting and what buyers get wrong once that check is signed.

Tom Kostura:

[00.00.02.42–00.00.02.46]

Thanks for having me, Matt. Looking forward to this conversation, man. Yeah, yeah, yeah.

Matt:

[00.00.02.46–00.00.03.11]

So threat intelligence has mostly won the argument, you know, whether it matters or not. Nobody in leadership today is going to say out loud at least that they see no value in it. But saying it’s valuable and funding it, you know, the old putting your money where your mouth is, they are two different things. And that gap is where a lot of CTI programs die on the vine, or at least die in the theory part.

Matt:

[00.00.03.11–00.00.03.33]

And I have some theories on why that gap exists. And I want to see if Tom thinks I’m right on this. So with that, let’s get right into it. Tom, you spent about ten years working at FirstEnergy in their SOC, ultimately running it. And now you are hunting threats at this intelligence company, Intel 471.

Matt:

[00.00.03.33–00.00.03.39]

It seems like a pretty clean trip from one side to the other here. What made you make the jump?

Tom:

[00.00.03.39–00.00.04.01]

Yeah. Ultimately, at the core of kind of how I think, I love this field, and I really think and kind of live by all the pieces kind of entangled together. Working for FirstEnergy and kind of going through the, you know, that whole scope of trying to protect, you know, critical infrastructure. There’s a lot of pieces, a lot of things happening, a lot of stuff a lot of folks don’t know about.

Tom:

[00.00.04.01–00.00.04.17]

And, you know, you hit a point where it was kind of time for a change. I wanted to have impact in a different way. I wanted to kind of broaden what I could get into and enhance my experience where I’m at now. I’m getting to see it from the other side of the table, which you mentioned, which I think has been awesome.

Tom:

[00.00.04.17–00.00.04.23]

So yeah, hopefully some of my experiences will lend well to the rest of the conversation. Yeah, absolutely.

Matt:

[00.00.04.23–00.00.04.49]

Well, and to that, you know, I guess just kind of pull right on that thread. So that SANS report, they asked CISOs about CTI. Obviously, the vast majority of them say yes, it is valuable. But then only about 26%, you know, say that it’s something that influences their decision-making and ultimately flows through into, you know, where money goes.

Matt:

[00.00.04.49–00.00.05.15]

And my read on that is talk is a little cheap, right? Leaders have cyber requirements. They are publicly held accountable for things. It’s a lot to deal with. And so my guess is they know enough to say the right things, right? You’re never going to be like, “No, that’s not important.” So the budget there is where, you know, the rubber meets the road as far as, you know, who’s willing to invest in that.

Matt:

[00.00.05.15–00.00.05.28]

And maybe that’s the cynic side of me, because I’ve seen so many of these programs, you know, die without the right backing. Am I being cynical? Is that too much?

Tom:

[00.00.05.28–00.00.05.41]

I don’t think so. I do think there’s some depth there, right? So those numbers are high, which is what I’d expect. Honestly, the fact that it was only 91% that said yes makes me very curious about the 9%.

Matt:

[00.00.05.41–00.00.05.43]

Yeah, exactly.

Tom:

[00.00.05.43–00.00.05.44]

Because it seems…

Matt:

[00.00.05.44–00.00.05.45]

…pretty important.

Tom:

[00.00.05.45–00.00.06.07]

Right? Right. I’m just curious about the thinking, really. Not to shame anyone, but I’m just generally curious why you said no to that question. It seems like it’s pretty universal that threat intelligence is kind of a foundational pillar to a security operations environment. You need to know what’s going on. You need to understand what’s happening, how it happened, so you can better protect your environment.

Tom:

[00.00.06.07–00.00.06.24]

I think the part where you kind of lean to the cynical side, I think it’s super valid. The gray area, though, is the part where we know it’s worth it, it’s valuable. But how do you convince the people that need to sign off on the check to, you know, sign off on it and put their money where their mouth is?

Tom:

[00.00.06.24–00.00.06.37]

Like you said, right? That’s where, I think, all the variables happen. And quite honestly, that gap doesn’t surprise me because I’ve had to experience a lot of those variables. And they can get finicky. Yeah.

Matt:

[00.00.06.37–00.00.07.06]

When you were in that chair and making those arguments, what did “we value this” sound like? Like, how did that conversation go? And did you find yourself having to navigate that? “Yeah, yeah, yeah, it’s totally important,” but then there’s no money, you know. When did you ever face a scenario where you got, you know, the sort of buy-in from a talking standpoint, but the financial answer was no?

Matt:

[00.00.07.06–00.00.07.12]

Or not. Walk me through those kind of contrasts that you had.

Tom:

[00.00.07.12–00.00.07.32]

Yeah. So early on, kind of like just pre or right in the beginning of going into that leadership role, where you kind of had to convince higher-ups, “I need this tool for my department. We need this thing. We need this feed.” Talking about why it’s valuable was only one phase of the game.

Tom:

[00.00.07.32–00.00.07.49]

Finding a way to prove it, to actually put the data in front of it, to show the measurable pieces that were going to come from it, show the plan of attack, of how we were going to get return for spending this money. That’s the part that, for me personally, it took me… I had to burn myself a couple times.

Tom:

[00.00.07.49–00.00.08.06]

I had to be told no a few times because I was really passionate. I’m like, “Hey, I know exactly what I can do with this.” But I failed to deliver that message when I asked. I failed to deliver all of the things I needed beyond that passion, beyond, like, “Hey, trust me, I know this will work.

Tom:

[00.00.08.06–00.00.08.27]

I’ll get it in.” You need to convince the folks signing off on the check. The silent trust really isn’t a thing. Yeah, but that’s not hard to do. It’s just a layer I think maybe we as an industry tend to miss. So those conversations, I think a lot of us that have gone across this bridge have had very similar conversations.

Tom:

[00.00.08.27–00.00.08.28]

I imagine.

Matt:

[00.00.08.29–00.00.08.47]

A translation thing? Like, you know, you talk about being excited and energetic and, you know, obviously passionate about it, but that not moving the needle, was it a different language, different priority kind of situation? Where did you land?

Tom:

[00.00.08.47–00.00.09.16]

For me, most of the time it was, I’m sitting in a technical seat or closer to a technical seat. And I have this whole plan, this whole roadmap of what I want to do for implementing this feed or this intelligence. Give it a name, right? And when I would go to my leaders or the people that needed to sign off on the budgetary or the expense, I would translate it in a way that was not in the language that I think that they understood.

Tom:

[00.00.09.16–00.00.09.35]

So in specific situations, you might have leaders that were, you know, I’ll give a rundown of how I’m going to take a given threat intelligence, and I’m going to implement it into maybe an automation format like my SOAR. I’m going to apply it to my operations somehow, maybe have it running within my SIEM structure or my alerting structure.

Tom:

[00.00.09.35–00.00.09.49]

And, you know, I’ll talk in that way and I’ll say, hey, we’re going to do X, Y, and Z. Here’s how we’re going to implement it. But I failed to deliver the thing that they cared about, because these folks aren’t thinking about the boots-on-the-ground, day-to-day operations stuff. That’s what was in my head.

Tom:

[00.00.09.49–00.00.10.14]

What I needed to present more in that situation, why I failed, was: here is what is going to come out of this. Here is what is going to be delivered to you. Here is what we’re going to deliver to the people, to the stakeholders, to the people that needed it. And that’s really the part that like, once I figured that out, those conversations, no matter the tool, they were much easier to have because we created a common language.

Tom:

[00.00.10.14–00.00.10.23]

Or I got to the place where I understood what they were going after or what they needed, and they were able to come to me and sit at the table and understand where I was coming from and why I was passionate about this, if that makes sense.

Matt:

[00.00.10.23–00.00.10.57]

Yeah, yeah, it makes perfect sense. I mean, it’s humans, you know, it’s communication, and what I find at a very broad level is when you can speak to someone in the terms that they understand, it engenders trust. They’re like, “Okay, this guy gets what I’m dealing with.” So your instinct is to put more weight in it and to trust it as a source of information to make a decision about, as opposed to:

Matt:

[00.00.10.57–00.00.11.17]

“This sounds like a foreign language to me. So, yeah, okay, cool, thanks.” You know what? So do you think that’s the primary problem, or do you think there is some ambivalence? Like, even if I do know what it is, I don’t, you know… like, I have to say I care about it, but…

Matt:

[00.00.11.18–00.00.11.20]

Yeah. I mean, do you see that as well?

Tom:

[00.00.11.20–00.00.11.43]

Yeah, I don’t think… and I think that’s where, you know, circling back to that, who are the 9% that said no? I think there is a general understanding that threat intelligence is valuable, right? But threat intelligence is a massive ocean of things and crazy stuff and different tools and different feeds and different ways of delivery and usage.

Tom:

[00.00.11.43–00.00.12.18]

And I think oftentimes there’s probably a lot of stories of we implemented a given thing, we went after and purchased a certain tool, maybe even early on there was excitement and somebody just signed off, and then you didn’t get the return on it. So now you become hesitant to just say okay. You need to better describe what it is you’re trying to accomplish with the thing, because I think we might be getting into a place where there is so many options that you need to be more direct about what you’re going to do with it, because the waste can happen very fast, if that makes sense.

Tom:

[00.00.12.18–00.00.12.26]

So I think that might be where some of the hesitation comes in. And again, I’m speaking strictly from my experience, of course. Of course. Yeah.

Matt:

[00.00.12.26–00.00.12.46]

Is a CTI program, is cyber threat intelligence, have you seen that even be the most effective way to describe it to someone who’s not, like you said, boots on the ground? Should it be considered a part of something else, or is there a way for you…

Matt:

[00.00.12.46–00.00.12.49]

Have you had success in the past by anchoring it to something else?

Tom:

[00.00.12.50–00.00.13.25]

Yeah. So this is a part where I tend to have a hard time getting knocked off this hill. Not that I’m closed-minded, but in my experience, and just kind of the way that I view and kind of see the entire security industry, especially from an operational standpoint, they need to intertwine. So if you’re just trying to stand a CTI program up and you’re just trying to stand up that capability and the thing that you’re going to deliver from it, you know, you might have some CTI analysts, some people going through things using X, Y, or Z tools and then putting together some level of report.

Tom:

[00.00.13.25–00.00.13.44]

Well, the biggest thing is what are you going to do with that? How does that intertwine in your operations? I’m a firm believer that when you want to maximize the space, you get it entangled in operations in every way possible. You have it be one of the key prongs that’s feeding your system, feeding your whole operational universe, right?

Tom:

[00.00.13.44–00.00.14.09]

I think when you go at it as this isolated entity, it also may play into those numbers. You get lost in scope. You get questions, especially when the translation… that table you’re sitting at, talking to people that need to keep signing off on this thing or keep backing you on this when they start losing traction of why this is valuable, it’s going to become an afterthought for them. And for me,

Tom:

[00.00.14.09–00.00.14.30]

I want to entangle anything I have, CTI, into my operations. I want it to help me drive decision-making for how I’m building detections, how I might be hunting for threats, what I might be prioritizing based on my given environment or my given industry, or what my attack surface might be. These are things that can get you. It’s like a dream of mine.

Tom:

[00.00.14.30–00.00.14.51]

And this may sound incredibly naive. I’ve had people tell me I was naive for thinking this before, but as defenders we are always reactive, and I think CTI is one of the key vehicles to get you closer to proactive than having to sit in a reactive space. So if you can apply that and stitch that together, now we’re talking, right?

Tom:

[00.00.14.51–00.00.14.52]

Yeah.

Matt:

[00.00.14.52–00.00.14.58]

Well, why would that be naive? I don’t even understand. I don’t mean to… sorry. Yeah, yeah.

Tom:

[00.00.14.58–00.00.15.01]

Well, you know, some folks have thoughts, I guess.

Matt:

[00.00.15.01–00.00.15.27]

Everybody has a thought. Yeah. So in this vein of sort of building this argument, you know, as a former SOC manager, now you’re almost, I guess you’d say, on the vendor side of this equation at this point. So helping people build that argument is maybe not your job directly, but is part of, you know, how you advance the company itself and what it does.

Matt:

[00.00.15.27–00.00.15.38]

If someone says to you, like, “I need to make a case for this,” what’s step one? What do you tell them to start doing first?

Tom:

[00.00.15.38–00.00.15.43]

We’re talking, make a case for “I want to make CTI part of my process”?

Matt:

[00.00.15.43–00.00.16.03]

So yeah, my logic is they have to make the argument that CTI is important and worth paying for before they can then say 471 is who I’m going with, right? So if someone asked you, as a SOC manager, “How do I start making that argument? What is the first block that I lay in building an ROI?”

Matt:

[00.00.16.04–00.00.16.07]

What would you tell them first?

Tom:

[00.00.16.07–00.00.16.31]

Or maybe first is not the right word. Identify CTI, we’ll just, I’ll leave it as a generic bucket there for the sake of this. How does it apply immediately to the things I care the most about? Can I gain insight? Can I gain operational effect? That’s going to be its own little sub bucket, right? Like, is the intel that I’m looking to gather, looking to purchase, looking to use…

Tom:

[00.00.16.31–00.00.16.49]

How can I operationalize it as a SOC manager? That should be one of the main thoughts across the board, like how can I get this in my operations? So if you do that, if you ask those questions right off the top, you’re going to have instant ROI out of the gate. I don’t think I’ve ever not seen that be the case.

Matt:

[00.00.16.49–00.00.17.12]

What are some examples? I’m not asking for specifics from a certain, you know, job role you were in. But what are some examples of what opera… operas… let me try this again. Opera… I’m not even going to make that word up. I don’t know, like, what you say, like, operationalize the CTI. Like, what are some examples of that happening?

Tom:

[00.00.17.12–00.00.17.34]

Yeah. So from a SOC perspective, easy. How can I translate this into detections? How can I translate this into hunting? That’s a space I’m living in right now. I’m trying to help move that needle because I really believe in it. Out of the gate, is this feed, you know, take all the pillars, right? You know, timely, accurate,

Tom:

[00.00.17.34–00.00.17.55]

it gives me something to actually operationalize, and it’s relevant to what I care about. You check all those boxes, and then right out of the gate, you can take an intel, identify it’s something you care about. It’s attached to something I care about and want to protect in my environment. It’s telling me behaviors. It’s giving me artifacts.

Tom:

[00.00.17.55–00.00.18.19]

It’s giving me things that are happening that could happen to me. So now I want to take that information and operationalize it by adding it into detections, doing, again, hunting, identifying gaps, right? There’s so many instant pieces of ROI, especially for a SOC manager. Okay, I have this intelligence I care about because it’s pointing at all those key pillars.

Tom:

[00.00.18.20–00.00.18.41]

I see this activity that happened to someone that’s parallel to me. Maybe in industry, we’ll use that because that’s an easy one. And I now see the behaviors this given entity or threat has leveraged. I see some of the artifacts, maybe even the atomic IOCs I might care about. And I want to know if this is happening in my environment, but I also want to know if it’s visible.

Tom:

[00.00.18.41–00.00.19.01]

Can I see it? That’s a big ROI. If you identify gaps in coverage to protect your environment, CTI is going to help you lead that threat hunting, and that kind of pairing, those two, is going to lead to building new detections that are, again, getting to that place where you’re more proactive instead of reactive. Don’t wait for you to get hit to then build detections to prevent it.

Tom:

[00.00.19.01–00.00.19.22]

Again, leverage CTI to get ahead of that. So you’re in place and you’re protected. Find a way to get your house guarded by understanding the, you know, the threats marching down the street. Don’t wait for it to knock on your door. Right, right. So, from that, you can take that information, right? If I’m a SOC manager and I’m reporting upwards, okay:

Tom:

[00.00.19.22–00.00.19.46]

“This given tool or given feed, the CTI bucket that we’re using, it’s given me the ability to… This quarter, I’ve added X amount of detections to our environment. We’ve enhanced our logging coverage to close gaps for critical things that could affect us. And here’s why.” Right? CTI will immediately give you the why. And then your ROI starts just stacking.

Tom:

[00.00.19.46–00.00.20.10]

And you can go beyond that over time if you start applying thought processes with “Where else can I stitch this to, beyond just a threat hunting or threat detection piece? How can I take this whole thing?” If you want to go beyond the SOC and put it together for the rest of the company, right? There’s absolute arguments where you can take CTI and move it beyond just the security environment.

Tom:

[00.00.20.10–00.00.20.29]

It’s a better posture. The folks that are standing these systems up, things to think about, vulnerabilities to consider when deploying a new system. Why it matters what you’re doing on your side, and how you can help them identify potential problems that they might have. Right? It becomes circular, really fast, and you can measure those things very easily.

Matt:

[00.00.20.30–00.00.20.59]

So, that’s interesting. So you’ve had success in tying CTI to non-threat-hunt SOC priorities? You talked about evaluating technologies outside of the SOC based on what you’re seeing inside, you know, the CTI program itself, what it’s outputting and indicating about certain things. Am I reading that right? Is that what you’re suggesting, is you can position this in that way?

Tom:

[00.00.20.59–00.00.21.34]

Yeah. So, let me give you one, I guess, semi-story. So, background: we stood up… we really valued threat intelligence, and we went about it a whole lot of different ways. And I’m speaking from my time at FirstEnergy, but I’m going to leave some of the specifics out. And we were actively, same thought process I’m coming to the table with, and I had a lot of really awesome colleagues and teammates and members of my team that really kind of stayed in that line of thinking, how can we maximize value out of this and stitch it to different things and make our life easier and make us better?

Tom:

[00.00.21.34–00.00.21.54]

That would eventually fall into a place where we actually would distribute some of that information over to our network operations team, like our NOC, like, “Hey, here’s things that we care about, here’s things that we see.” So maybe by putting that in and building a system in that way, our thought process was, okay:

Tom:

[00.00.21.54–00.00.22.14]

The NOC’s doing a specific task. It’s monitoring, keeping the lights on. It’s keeping the stuff going. Security is doing a task, right? There’s a gap there, but they really are working to protect and make sure the same things are going to stay up, right? We’re going to keep the lights on. So if you could create that platform, okay, we’re like, “Hey, here’s things that we care about.

Tom:

[00.00.22.14–00.00.22.30]

Here are things that we wouldn’t specifically monitor in a SOC. But if you see some of this anomalous activity in some of our systems, based on key things we have from our CTI, flag us, let us know,” so we can then prioritize watching this space or making sure that we are checking our boxes there.

Tom:

[00.00.22.30–00.00.22.52]

Yeah. And then beyond that, you can put that all together. And we did things where we would share it with, even in a simpler form. We would take stuff we had from our CTI and things we were doing in our SOC. And at the back end of my time there, we were building this thing to push out almost like an internal blog to the whole company.

Tom:

[00.00.22.52–00.00.23.15]

So it’s not necessarily just the people that are doing the boots-on-the-ground work. CTI can be valuable beyond that. Most companies have, like, a phishing training, right? And most of us have all gone through it. What else can you do to keep it front of mind for the people that aren’t doing this stuff or have to think about it all day? Keep it…

Tom:

[00.00.23.15–00.00.23.32]

…keep this thing in the front of their mind. So if we had stuff that was very easy to translate, we could say, “Hey, look out for this.” We would put blogs out there, “Here’s Security Weekly from our SOC,” tied, leveraging this intelligence, leveraging things we’re doing and stitching it all together. So there’s many ways to leverage it.

Tom:

[00.00.23.32–00.00.23.34]

It’s never isolated.

Matt:

[00.00.23.34–00.00.23.57]

Yeah. Yeah, I would imagine a lot of those exercises, security exercises, tabletops, they all get stale. And a lot of times they’re run by folks who aren’t boots on the ground on that threat hunt or detection or defense role. They’ve kind of stepped back from that role. And so, you know, a lot of times, feedback on these things is like, it’s just stale.

Matt:

[00.00.23.57–00.00.24.28]

It’s just a checkbox exercise. We’re all just, you know, doing it just so we can say we did it. But in this case, you could attach fresh, whatever, TTPs, latest ways that this stuff is happening, to make the security program, you know, that’s deployed across an organization, more relevant, more fresh, more engaging, more, you know, accurate, if nothing else, as opposed to kind of just rehashing the same thing over and over.

Tom:

[00.00.24.28–00.00.24.46]

Yeah, 100%. I’ve used them in tabletops before. I used them both with my team and outside, bringing in other entities. And we would do, you know, little war game situations. We’d leverage current intel, and we’d try to emulate it in a given environment safely to try to say, hey, these are the things to see and look for.

Tom:

[00.00.24.46–00.00.24.53]

So we could even, in a roundabout way, train the non-security folks to have some level of security thinking. Yeah.

Matt:

[00.00.24.53–00.00.25.14]

Yeah, yeah. We’re talking value, we’re talking ROI, but we’re still talking in terms of security. What if a CFO walks in the room? How does that change your argument? Like, do you actually have, like, “Here’s the money side of it”? Have you ever had to make that argument?

Tom:

[00.00.25.14–00.00.25.35]

I’ve thought about it for quite some time, but I’ve never specifically had to make that argument. It’s hard sometimes when you have those conversations on the security side, right? Because for the most part, you generally see security expenditure. The expense of a security anything is generally hard to show the financial side.

Matt:

[00.00.25.35–00.00.25.37]

Because it’s working, because nothing’s happening. Right.

Tom:

[00.00.25.37–00.00.25.55]

So when there’s opportunity to do that, you know, if you could have some golden nuggets like, “Hey, because we implemented this, our outages were reduced by X,” which, you know, you could translate into dollars, right? If you could find ways to do that, I would say, you know, especially like say I’m speaking to a SOC manager.

Tom:

[00.00.25.55–00.00.26.12]

Somebody’s getting involved in this space trying to implement it, keep it in mind. But at the end of the day, the goal is to protect the environment. But I’m sure those conversations have to be had. Sadly or luckily, I haven’t really had to fight that war. In my experience.

Matt:

[00.00.26.12–00.00.26.24]

If you had to do it, I mean, and again, I’m not talking like actual dollars, but like where are the easy areas to start looking if you’ve got to go build that from a money standpoint?

Tom:

[00.00.26.25–00.00.26.26]

Help me understand what you’re asking.

Matt:

[00.00.26.26–00.00.26.51]

So if you’re going back to the analogy, you know, the CFO is sitting in a meeting and is like, “That’s all cool. But, like, what does that mean as far as savings, cost?” You know, in energy, you’re never talking about profit and revenue. But, you know, generally speaking, that’s what kind of drives most private sector: has it made us more money or has it saved us money?

Matt:

[00.00.26.51–00.00.27.15]

And, you know, security, you’re rarely going to actually make money in security. It’s more about savings, right? And so, like, is it a human efficiency argument? Is it like, we spent less hours doing this thing? Like, what are some areas that you might go focus on first? Like, “I bet if we go look at these three things, we could find a reduction or more efficiency because this got implemented.”

Tom:

[00.00.27.15–00.00.27.41]

100%. So that’s kind of the next, I think, play when you start talking about the ROI factor. So sorry for missing that. But no, the time savings you can implement from leveraging good threat intelligence is in my opinion, it’s immeasurable and it’s almost a requirement. You need to be able to… your security posture. You’re protecting an environment, critical infrastructure, any environment.

Tom:

[00.00.27.41–00.00.28.09]

It can be a mom-and-pop shop. Your job is to protect that environment. You need to know what you’re facing. This brings you to the forefront a lot faster, so I’m able to put things in position to stop us from being hit so I can get ahead of having to do things. And we’ve already explained that. But the other side of that is if the threat intelligence is super solid, if we’re getting a lot of that information from those key pillars of what makes threat intelligence good, we’re able to build faster.

Tom:

[00.00.28.09–00.00.28.43]

We’re able to react faster, we’re able to position faster. Every piece of that is measurable. Yeah, in a lot of cases, even in the inverse, maybe you’re not just taking that path. Maybe the other path is, you know, a SOC analyst catches some random alert that they haven’t seen, they’re unsure what it is at 2:00 in the morning, having avenues, which is part of like how you implement it into operations, but having avenues to circle it back to CTI to help you better understand what you’re looking at, or at least give you avenues to help mitigate it, help react, you know, that mean time to detection,

Tom:

[00.00.28.43–00.00.28.56]

the mean time to resolution, those numbers speak volumes in how you can stitch CTI to enhancing and creating faster processes, able to accomplish more with less time.

Matt:

[00.00.28.56–00.00.29.19]

Yeah, yeah. What if you had to simplify it even further? Again, I’ve been in these things where certain C-level are so far removed that even, like, MTTR means nothing, you know, like it’s the acronyms and stuff that contain value in the space can be seen as just a different language.

Matt:

[00.00.29.19–00.00.29.43]

So if you’re even talking in terms more abstract, from “We have reduced our reaction time, our recovery time,” what does that mean? Even higher level. Like, what’s the higher abstract version of that? If you’ve got to go talk to the CFO to get them to carve out something for it, what does that look like or sound like?

Tom:

[00.00.29.43–00.00.29.44]

Let me see if I hit the right note.

Matt:

[00.00.29.44–00.00.29.45]

You’re fine. Yeah, right.

Tom:

[00.00.29.45–00.00.30.00]

All right. So yeah, I’m walking in the room, sitting down with the CFO. “Hey, I need this thing. I need this money for this thing.” And they’re going to ask me why, or they’re going to ask me, “Why does it matter?” I’m going to say, because right now, we’re not good enough. This is going to make us exponentially better.

Tom:

[00.00.30.00–00.00.30.21]

And here are all the ways it’s going to make us exponentially better. And here are all the ways that it’s going to save us both time, money, and resources. In a lot of ways, it’s going to remove redundancy because a lot of things can happen. I’ve honestly seen this happen, where good CTI, or, you know, a good setup there, will lessen the work and the redundancy.

Tom:

[00.00.30.21–00.00.30.44]

So, yeah, okay. By freeing up this space, by removing the redundancy, by helping us become faster at these things, using this… I’m just taking this avenue, I’m thinking SOC manager. Yeah. I now have freed up all these resources to do X, Y, and Z. I now have other opportunities. Now I can maximize what I can do with the resources I do have, instead of needing to continue to stack resources.

Matt:

[00.00.30.44–00.00.30.47]

To keep analysts on this thing all the time.

Tom:

[00.00.30.47–00.00.31.10]

All the time. Now I can broaden the horizons, we can cover down on a lot more, and we can get a lot better at all of the other avenues of our operations. Right? It’s a very circular thing. Yeah. And those conversations, for me, at least with everybody I’ve talked to at a C-level, and anytime I sat at the table with folks, which was quite a few times, always positive. I never had a real hard kickback.

Matt:

[00.00.31.10–00.00.31.36]

Adversarial. Yeah, yeah, yeah. And what I see a lot is the ambivalence goes up the smaller you get as an organization. And so, you know, I’m always kind of thinking about the big side of, you know… any critical infrastructure industry is sort of a barbell, usually, where you’ve got hundreds of really big ones and then thousands of much smaller ones.

Matt:

[00.00.31.36–00.00.32.05]

And both parts of that scale matter, you know, the scaling of the way cyberattacks happen these days, those thousands of small ones are the widest threat surface. And all day long, the people on the enterprise, the big side of that equation, worry about what a scaled attack of that smaller component is going to look like and how it will, because you can’t guard yourself against the smaller components of your same industry.

Matt:

[00.00.32.05–00.00.32.29]

You’re interconnected, and, you know, that interconnection is the risk. And so as you’re making the ROI argument, you know, the person that makes that argument as you move into the smaller and smaller organizations, that hat is one of many that they’re wearing. Some, you know, in some cases, you don’t even have threat hunting.

Matt:

[00.00.32.29–00.00.32.32]

You just have one cyber person.

Tom:

[00.00.32.32–00.00.32.32]

One.

Matt:

[00.00.32.32–00.00.33.05]

Person, cyber in general, you know. And so, like, how do they… they need to maximize their time. And a CTI program could come across as such a tangential, esoteric, super geeky thing that, you know, “We just can’t put money towards that, man.” Like, you know, that argument that you’re saying now lends itself to what a CFO worries about as far as where money is going: “It looks like I need to hire three people to handle this cyber thing.”

Matt:

[00.00.33.05–00.00.33.25]

But if you position CTI correctly, it’s like, “Actually, no, we’re able to squeeze more efficiency out of the manpower we have,” even at a small organization. So everybody has to eventually make that argument at a more abstract level. The smaller you go, the faster you have to, you know.

Tom:

[00.00.33.25–00.00.33.48]

Yeah. And that’s, I think, the biggest key is you’re going to gain that speed, you’re going to gain that insight. You’re going to understand, I think especially like the biggest gain, even at a small place, even if, say, you really do not have budget for one of the really awesome feeds or tools that are out there, and you have to live on and leverage OSINT, having some level of CTI is paramount, because you need to know what’s common.

Tom:

[00.00.33.48–00.00.33.54]

You need to know what has happened, and you need to leverage it to help you prioritize. And that’s all going to save you time.

Matt:

[00.00.33.54–00.00.34.08]

Yeah. Who do you usually have to have in your corner before you go ask for the budget as far as that political backing or, you know, internal whatever?

Tom:

[00.00.34.08–00.00.34.34]

Yeah. For me, it’s usually the CISO, CISO-level person sitting there. In my experience, I’ve been relatively not too many tiers removed, pretty direct there. That’s been the main thing. So if somebody in that position like they need to back you because if they’re not going to, you’re not going to win, right? I mean, you’re not going to get to the other folks that really don’t know what’s going on that side of the house, it’s going to be hard to sell them if that guy is not in your corner or that person is in your corner, right?

Matt:

[00.00.34.34–00.00.34.53]

Yeah. Do you find there’s any value in peers, you know, referencing peer support, or, you know, like the E-ISAC as an example, using those as, you know, building blocks for your argument? Have you had success with that as well?

Tom:

[00.00.34.53–00.00.35.17]

Yeah, talking with peers is something I think people don’t talk about enough. It was almost… I mean, it was absolutely required in my role at FirstEnergy. Yeah. And I’ve leveraged some of those conversations as well as some of the other groups we were in, like, you know, regional consortiums and stuff or other companies that might not be in industry, you know, what are they doing?

Tom:

[00.00.35.17–00.00.35.37]

What are you folks doing? How are you protecting your environment? And I’ve leveraged those points quite a few times just to have as part of my sell, as part of my “Hey, I want to obtain this. Here’s what I’m trying to accomplish. And, oh, by the way, businesses A, B, and C are doing very similar things, and they’re showing the results that I believe we’re going to have.”

Tom:

[00.00.35.37–00.00.35.43]

So I already have some level of proof and backing. That never hurts. That always helps. Yeah.

Matt:

[00.00.35.44–00.00.36.06]

Yeah, this was not on purpose, but I’m talking to a number of people about the different parts of… you know, you and I are talking about the threat sharing program internally. I’ve got someone from Central Hudson we’re going to talk about, you know, the collective defense component of it and how to make that argument and, you know, the constraints.

Matt:

[00.00.36.06–00.00.36.29]

But it seems like, as I put all this stuff together, they complement each other. So I was assuming that a collective defense angle could actually support internal arguments for certain tooling, certain programs that need, you know, backing. Right? Almost, not a peer pressure, but like, “This is what the peers are doing, and they’re having success at it.”

Tom:

[00.00.36.29–00.00.36.48]

Yeah, I think, if it’s okay if I throw a little note there, just because I know a few people, if they listen, they’ll hit me for not saying this, but it’s important in those situations when you have those kinds of like functions or groups that the right people are involved in the conversation, not necessarily have to lead it, but they need to be involved.

Tom:

[00.00.36.48–00.00.37.10]

So if you get a lot of folks that aren’t involved in the day-to-day operations, making the decisions because their peers said to, you know, you’re kind of missing some of the chains of people that you need to be talking to. Right? Like, there’s been a lot of times where you have, like some of that stuff where, you know, company A is doing X and B and C, they’re doing X, but maybe that doesn’t fit your environment.

Tom:

[00.00.37.10–00.00.37.28]

Maybe that’s not the way to go. So if you only have certain people like you only have a CFO or a CSO sitting at the table at those conversations, then they bring it to the table and they say, okay, well, you need to implement this because it looks really great. And the showing from those other companies was really great, but they’re missing the nuance from the day-to-day.

Tom:

[00.00.37.28–00.00.37.49]

So, like, in those conversations, and I think this is one of the things, not to go… I don’t mean to go off topic at all, but where some of the information sharing stuff has lacked, I think, personally, over time, is you don’t have the right people at the table. Interesting. And you get a lot of kind of mix and match things and you lose time, you lose traction.

Tom:

[00.00.37.49–00.00.38.04]

Sometimes you lose confidence. That’s another thing that, you know, you never like to see, is when you have, like, an initiative to do some level of information sharing if you lose confidence in it. It seems like folks are really quick to not come back to that table. So it’s almost like you really got to nail it, you know what I mean?

Tom:

[00.00.38.04–00.00.38.05]

Interesting. Yeah.

Matt:

[00.00.38.05–00.00.38.30]

Yeah, yeah. So let me reiterate that. You’re saying that if you have only a concentration of certain people in, we’ll call it just collective defense, for a broad kind of umbrella term, in these sort of communities of threat sharing, decision-making can be so abstract that it’s actually irrelevant once you actually start to implement it.

Tom:

[00.00.38.30–00.00.38.49]

Yeah. Yeah. So you get caught in almost, like, maybe not the right comparison, but if you have certain folks that day-to-day do certain tasks, they sit in this thing, this sharing thing, and they’re shown presentations of stuff that look really good or they are really good, right? And they’re like, I have to have that, or we need to do that.

Tom:

[00.00.38.49–00.00.39.12]

And you don’t have the right people there to talk to you about it, like, “That’s awesome, but we do have these hurdles.” And then if you aren’t careful of that, you can kind of have the inverse effect where something’s pushed down on you. And you’re like, this doesn’t work for us. And now you’ve like, wasted so much money and time, you know, and it’s like, just have the right people, have people at the conversation table, that’s all.

Matt:

[00.00.39.12–00.00.39.29]

Just all levels. Yeah, yeah. That makes sense, because, yeah, there is a lot of shiny object chasing, you know, it can get into that. You know, AI being the thing. Everybody’s like, “How are we using it?” Yeah. Like, maybe we haven’t thought about that one.

Tom:

[00.00.39.29–00.00.39.34]

Yeah. Yeah, we could talk about that. That’s fine.

Matt:

[00.00.39.34–00.00.39.55]

So from the flip side of this, I mean, I’m assuming you’re part of these conversations where someone is evaluating the tool at 471. But what are you seeing people get wrong as they’re looking at this and trying to implement it? Where do they go off quickly?

Matt:

[00.00.39.55–00.00.40.00]

What are kind of the wrong ways to get started on building an argument like this?

Tom:

[00.00.40.00–00.00.40.25]

I think one of the things that people get wrong out of the gate is you’re trying to find a solution to the problem instead of a tool to help you create the solution that works for you. What I mean by that is I think a lot of folks they tend to miss because they’ll go into, you know, maybe purchasing a different feed or getting a specific tool or something.

Tom:

[00.00.40.25–00.00.40.42]

And they’re coming at it with, okay, this thing is going to just plug in and solve some of these problems. They’re not thinking about, how do I entangle this into my operational workflows? How does this stitch to my current process? What’s the lift going to be to now take this and stitch it to this?

Tom:

[00.00.40.42–00.00.41.04]

I see that a lot, where people don’t ask that question, and then it becomes a bit cumbersome. You’re trying to meld it, if you will. And you just started off wrong out of the gate. So you weren’t entirely sure what you wanted to do with it out of the gate, which I think from an operational standpoint, I think that’s where the first miss usually hits.

Tom:

[00.00.41.04–00.00.41.25]

The second one is usually, “I think this is just going to solve my problems for me.” Yeah, I have seen that in the past with different groups. I’ve talked to peers and so on where they went down this road or tried to go down this path of what to do. And we’ve just had shop talk conversations at a conference or something.

Tom:

[00.00.41.25–00.00.41.44]

And, you know, you hit this thing where it’s like, hey, this tool is great. It can do a lot of cool things. But you did not consider how you’re going to deploy it. Yeah. So now you have this cumbersome deployment process. You might even land it in a place where not all the people that have to use it don’t fully understand how to integrate it.

Tom:

[00.00.41.44–00.00.41.59]

It becomes a burnout piece, and you can really kind of set yourself back that way. And it’s just a couple simple questions out of the gate. What am I trying to accomplish with this and how does it fit into my workflow? It surprises me how often those questions aren’t asked out of the gate.

Matt:

[00.00.41.59–00.00.42.17]

What should somebody who’s evaluating CTI solutions, what should they look for as indicators of, this is a quality, you know, product, whatever, quality provider, quality vendor, versus what are some red flags of, like, they should not be on the list?

Tom:

[00.00.42.17–00.00.42.34]

I’m going to speak out of turn a little bit here. But this is completely me, not speaking for Intel 471 or FirstEnergy. As soon as I see AI as the first splash, I’m like, “Okay, let me take a minute. Let’s talk about that a little bit.” Yeah. No, it’s the key pillars, you know.

Tom:

[00.00.42.35–00.00.43.08]

Is the intel timely? Is it accurate? Is it relevant? And can I operationalize it at the end of the day? For me personally, because of the way that I think about defending, I need to know if I can operationalize it. I need to know if it’s timely and accurate. And I want intel that’s rich. You know, it still shocks me, I guess, how much is out there where you see intel, open source or otherwise, you know, kind of trying to drop you this, like, intelligence that’s overarching.

Tom:

[00.00.43.08–00.00.43.28]

It gives you the story, the things that happened. But it gives you none of the how or why or what. You just know that this thing happened. You don’t know how it happened. You don’t know even the slightest bit of how you should protect yourself from it happening. And then if I see that, I can’t apply value to that.

Tom:

[00.00.43.28–00.00.43.38]

You know, I don’t know how to take that and stitch that into any part of my operations. I don’t know how that checks an accuracy box because I have very few details. I just have the story, you know what I mean?

Matt:

[00.00.43.38–00.00.43.48]

Yeah. It’s so abstract. It’s not applicable. There’s nothing applicable in it. Yeah. It’s just like, “Cool story. Good. Okay. So now I know that that thing happened.”

Tom:

[00.00.43.48–00.00.44.06]

Right, right. Some details about, you know, the things that were targeted or what was… you know, it’s a big scary story. This thing was attacked. It could affect so many people. But you don’t say how, where, who, nothing. So those turn me away immediately. So, yeah, I hope that answers your question.

Matt:

[00.00.44.06–00.00.44.24]

It did. Well, and it also, I mean, it does highlight, you know, something that you see a lot. I mean, even me, I’m nowhere near, you know, the level of a technical, you know, threat hunter proficiency by any means. But, you know, I’ll read an article and I’m like, “Yeah, but how? Like, what did they actually do?”

Matt:

[00.00.44.24–00.00.44.41]

And clearly there’s some hesitancy, when things are fresh, for the, you know, someone who’s been a victim of something to just kind of, you know, “Here’s how it happened. This is exactly what happened.” You know, like, nobody wants that out in publication a lot of times. And so you have to balance that.

Matt:

[00.00.44.41–00.00.45.03]

And, you know, again, from my seat, it does matter then who you have as sources of intelligence. And are there approved channels that can sort of pass along sensitive intelligence in a secure and responsible way, so that people in your seat can act on it without it just hitting the New York Times or something, you know?

Matt:

[00.00.45.03–00.00.45.04]

And.

Tom:

[00.00.45.04–00.00.45.22]

Right. Yeah. Because you can’t always give away everything. But sometimes, some of those I see, and it’s just my personal… I’m like, “That’s not threat intelligence. That’s just a news article.” Like, that’s no different than something I might get off of, you know, pick your news site, pick whatever your feed

Tom:

[00.00.45.22–00.00.45.26]

is, the channel, whatever. Right. Yeah. No. Yeah.

Matt:

[00.00.45.26–00.00.45.55]

I hear you, man. I’m just going through. I realize we’ve talked about some of these questions out of order, so I’m just like, okay, we’ve already done that. We’ve already done that. All right. So as a threat hunter now, is that one of the better ways to demonstrate intel is worth paying for? Is a hunting program, or hunting activities formally, something that must be in place in order to really grab that and operationalize intelligence?

Matt:

[00.00.45.55–00.00.46.02]

Or can it be applied at a higher level inside organizations that maybe don’t have that specific role in there?

Tom:

[00.00.46.02–00.00.46.28]

Yeah, I think it can be applied at a higher level. I think it can be applied very simply just by having it as a stitch to your SOC. Maybe you’re using an MSP, maybe you have an outside third party handling that piece for you. The threat intelligence is still super valuable because you can collaborate with the folks that are protecting your area to say, here are key things to care about.

Tom:

[00.00.46.28–00.00.46.56]

Watch for, focus on. Yeah. You can show that focus. You can show that prioritization just from that level. However, threat hunting can absolutely empower threat intelligence. Applying that in that way, not just threat hunting because threat hunting can be a bunch of things. I don’t think it’s one foundational term. Personally, I think it’s a lot of stuff, but it’s a really awesome area and it could be done in a whole lot of really cool ways.

Tom:

[00.00.46.56–00.00.47.15]

Here’s where my passion comes out. Just full disclosure, I like learning how the bad guys do what they do and why they do what they do, and I like figuring out ways to catch them. Like, I just think it’s a cool thing. It’s like, cool thing, yeah, being a kid playing around with action figures, you know? Yeah. Threat hunting can empower what CTI brings.

Tom:

[00.00.47.15–00.00.47.42]

It can super-boost your ROI. As far as where the value is coming from, it’s a very easy stitch to operationalizing. It’s almost a required marriage. You’re not going to threat hunt without threat intelligence. Yeah, you’re generally just not. And it’s one of the ways that you can show the absolute most bang for your buck out of the gate, because you’re going to identify all those things I kind of talked about earlier.

Tom:

[00.00.47.42–00.00.47.51]

At the top of the show: your gaps, where you can get better, where you can prioritize focus, what may be coming for you so you can be proactive. All of those things kind of immediately stitch.

Matt:

[00.00.47.51–00.00.48.28]

Yeah. All right. So the last question then is, from an opportunistic standpoint, do you wait for the pain, right? Is that the best time to be like, “Hey, we should probably get this tool”? Or, a lot of what you’ve talked about so far, and it makes sense, seems to indicate that you take your time to figure out the applications, why you have it, where it is best to operationalize, where the ROI is. Is it better to wait for an example of something, where the argument is easier to make at that point, or is it better to, you know, do your homework

Matt:

[00.00.48.28–00.00.48.33]

and build the case in whatever left-of-boom kind of situations?

Tom:

[00.00.48.33–00.00.48.59]

Well, I’ll always be on the side of the house of “go after it first,” I think especially, and it might be either an experience, maturity or just a bias thing, but I’m okay with this bias, I think. Don’t wait. It’s always bothered me that, like us as defenders, we tend not to actually do the thing or innovate or come at it from a different angle or think differently until we’re hit.

Tom:

[00.00.49.00–00.00.49.20]

It drives me crazy, but I think we’ve matured so much, even just in my time in the field, from having to need that to happen to now being able to go to the table and present a well-thought-out, mature plan for why I’m going after this before I get hit, and why we should spend this now. Yeah.

Matt:

[00.00.49.20–00.00.49.34]

Yeah, I get that. There’s a couple kind of wrap-up questions that I like to shift into here, but before I do that, any final thoughts? Closing comments?

Tom:

[00.00.49.34–00.00.49.57]

Oh, you get me talking, I’m going to keep going. So, no, really, anyone that listens, anyone that’s on the defender side, anyone that’s trying to improve the stuff no matter what you’re defending, think away from the same standpoints. You know, I really want to see our sector, the cybersecurity defense side. I really want to see us think more creatively, think more innovatively, stop just doing what the next guy does.

Tom:

[00.00.49.57–00.00.50.25]

Because every environment, in every situation is so unique. I cannot preach that enough. And I have very much done that with young people that I’ve hired that I’ve brought up. Think outside the box, you know, attack the problem. Don’t try to walk a guardrail when you’re talking about how you’re going to leverage CTI, when you talk about how you’re going to defend your environment, what tools you’re going to use, how you’re going to implement and stitch them together, really be creative to what your purpose is.

Tom:

[00.00.50.26–00.00.50.39]

There is no blueprint for this. As much as some folks like to think, there’s a lot of things you can look at, consider, but you really need to think creatively for your own situations, and that’s going to help us get closer to that proactive side. I’m a firm believer in it. Yeah, yeah.

Matt:

[00.00.50.40–00.00.50.47]

Just on a personal level, what are you learning about right now? What’s something that’s got you really excited?

Tom:

[00.00.50.47–00.00.51.10]

Well, it’s funny you asked that question. I’m actually spending time getting more acquainted with AI, going through a couple training things. I’m really trying to understand. I’m taking an approach of learning some of this stuff because I want to understand what’s going on. Yeah, understand kind of how it’s trying to be implemented now. We have to keep our eye on it.

Tom:

[00.00.51.10–00.00.51.34]

It’s an emerging technology that I don’t think any of us can ignore. But the sky isn’t falling for me personally yet. I don’t believe that. And I want to go back to what I had said. I want to be innovative and creative in my thinking of how I’m going to leverage these tools and what that means and how that’s applied specifically from a cybersecurity standpoint, because I’m fearful of the holes that are going to be opened with some of the stuff.

Tom:

[00.00.51.34–00.00.51.45]

So right now, that’s what I’m really digging on. I’m trying to make sure that I know that this is going to be a thing that’s not going away. It’s coming. And how do I defend it? How do I leverage it and everything in between?

Matt:

[00.00.51.45–00.00.51.52]

Yeah. What’s something that you’ve changed your mind on lately, that suddenly you’re like, yeah, not so much?

Tom:

[00.00.51.52–00.00.51.54]

Oh. That’s a good question.

Matt:

[00.00.51.54–00.00.52.00]

Or maybe you’re still debating. Maybe you’re on the cusp of changing your mind.

Tom:

[00.00.52.00–00.00.52.01]

So I…

Matt:

[00.00.52.01–00.00.52.01]

I.

Tom:

[00.00.52.01–00.00.52.26]

…keep going back and forth. So I want to say this from, like… there was a point early on in my career where automation, I understood, but I also thought, at the given time, the given situation, it was probably being over-invested in. I very quickly realized that wasn’t the case once I understood how to leverage that kind of thing, and I am currently doing the same thing going back and forth.

Tom:

[00.00.52.26–00.00.52.47]

Actually, I haven’t fully changed my mind. I think I just haven’t settled in on the things that the current tooling, talking about AI again, can replace, the actions it can take, the things it can do. Yeah, I haven’t landed on. There was a point where I was 100% sure that, like, okay, us as cyber defenders, it’s not going to take our jobs.

Tom:

[00.00.52.47–00.00.53.03]

I still really believe that that’s not the case. But I do see that there’s going to be an evolution. And I’m starting to change my mind on the jobs are going to get different. And that creative and innovative thinking of how to leverage the tool needs to change. So I think that’s the best answer I have.

Matt:

[00.00.53.03–00.00.53.22]

Yeah, I heard someone else unrelated to cyber put it similarly in that she is a journalist and she’s been, you know, through “the internet’s going to kill journalism,” and now it’s “AI that’s going to kill journalism.” And she goes, you know, I still do the same thing. I still use the same skill sets. I just repackage it differently.

Matt:

[00.00.53.22–00.00.53.41]

I just reinvent what it’s called, you know, every ten years. But I’m still doing the same thing. And I was like, I think that’s a healthy way to approach it, right? To think about what you’re good at and the skill sets you have, not what the job title is, you know.

Tom:

[00.00.53.41–00.00.54.08]

Exactly. Yeah. I think, to get existential just a little bit, I think as humans, we forget that we’re creative creatures by nature. You know, maybe not with everything or every aspect, but in the things we care about or like or enjoy. We’re creative naturally. So maybe being the optimist, maybe the way that tools advance and they kind of come to us can unlock more of that creativity.

Matt:

[00.00.54.08–00.00.54.27]

Yeah, yeah. Push us into those areas where we learn how to apply this, apply our skill sets differently, or call them by different names, but still keep going. Yeah. All right. So last question here in The Lock & Key Lounge theme. You are at a bar. Sometimes people like to think of it as their favorite bar.

Matt:

[00.00.54.28–00.00.54.46]

Sometimes it’s like that really cool bar that, you know, you go to at RSA, but it’s a nice one, right? It’s that one where you don’t have to scream over other people to have a conversation, and you’re at one end and at the other end is actually somebody you have been dying to talk to in security.

Matt:

[00.00.54.46–00.00.54.54]

What’s the cocktail that you order? If cocktails are your poison. And who’s at the other end of that bar?

Tom:

[00.00.54.54–00.00.55.18]

Okay. I’m going with either a straight bourbon, I’m an Eagle Rare guy, or an Old Fashioned. That’s if I’m going cocktail, it’s Old Fashioned. Yeah. Other end of the bar. Honestly, I think I’d say Anton. I am fascinated by him. I followed him for quite some time. I like the way he thinks and the way he attacks problems.

Tom:

[00.00.55.18–00.00.55.30]

I find it very interesting, his background and kind of his path into cybersecurity, you know, training to be a physicist and everything. So sitting down and having a drink and, you know, talk shop with him for a little while would be a fantastic memory.

Matt:

[00.00.55.30–00.00.55.53]

Yeah, yeah. Good answers. I find most guys skew towards Old Fashioned, most women skew towards, like, a red wine or maybe sometimes a martini, or some guys have a beer. But yeah, Old Fashioned is a solid choice. Do you do Eagle Rare in the Old Fashioned, or…

Tom:

[00.00.55.53–00.00.56.07]

No. I’ve tried it before in my Old Fashioned. I think I prefer Basil Hayden’s. Yeah, I like Basil’s in my Old Fashioned. I think that’s usually it, and then some versions of Old Forester. Yeah, yeah.

Matt:

[00.00.56.07–00.00.56.10]

Basil, have you done their cherry cask?

Tom:

[00.00.56.10–00.00.56.11]

No, I don’t think I have.

Matt:

[00.00.56.12–00.00.56.12]

That one.

Tom:

[00.00.56.12–00.00.56.12]

No.

Matt:

[00.00.56.13–00.00.56.30]

That is like, if you’ve ever had a Manhattan, you know, a Manhattan has the rye and the vermouth. Basil has a vermouth-y kind of undertone to it. So it’s really great in a Manhattan because it’s sort of got that angle to it. It’s interesting.

Tom:

[00.00.56.30–00.00.56.31]

That’s interesting.

Matt:

[00.00.56.31–00.00.56.37]

Yeah. Yeah. It’s a different enough taste that it’s worth going after, just to kind of learn how to use it.

Tom:

[00.00.56.37–00.00.56.40]

Well, when we cross paths, man, I’ll try to remember that.

Matt:

[00.00.56.40–00.00.56.50]

You know, I feel like it’s going to happen. So yeah, we’ll make sure that happens one way or the other. Tom, I do appreciate your time today. Really good conversation. Thanks for taking the time.

Tom:

[00.00.56.50–00.00.56.51]

I appreciate you having me on.

Matt:

[00.00.56.51–00.00.57.13]

Absolutely. And for the listeners, again, thank you for giving us your time. I came in with that, you know, sort of punchy, cynical theory about leadership support for these programs. Tom has obviously shed a lot of perspective on this and certainly added some nuance that matters. And I hope for those listening that you had the same experience.

Matt:

[00.00.57.13–00.00.57.43]

Whichever side you land on, it does look like the fix is the same. You know, stop asking leadership to value your intelligence and your problems and what you see, and start showing them how decisions can be implemented, how value can be conveyed in terms that matter to them. And you start with those questions, you know, the business is already asking, and measure what’s moved and get those people in your corner that you need in order to make that argument.

Matt:

[00.00.57.43–00.00.57.53]

So I hope this was helpful for you all. Thanks for spending the time with us. And until next time, be well. Stay curious. Do good work.

Matt:

[00.00.57.53–00.00.58.26]

We really hope you enjoyed this episode of The Lock & Key Lounge. If you’re a cybersecurity expert or you have a unique insight or point of view on the topic, and we know you do, we’d love to hear from you. Please email us at lounge@armortext.com or our website: armortext.com/podcast. I’m Matt Calligan, Director of Revenue Operations here at ArmorText, inviting you back here next time, where you’ll get live, unenciphered, unfiltered, stirred, never shaken insights into the latest cybersecurity concepts.