Well, speaking of podcasts, if you had a podcast, who would you interview and why?
I know we were discussing before we turned it on. I don't have an answer right now,
so somebody else has to go.
John, I think you want to go?
Yeah, I'll go first.
I think you have a fun one.
Yeah, so I would definitely want to bring on my podcast Kevin Mitnick, because he has a lot of
fun stories. He has gone to jail before and now is like a security consultant, which different
companies are doing business with him, bringing him on different shows to talk about how to
get themselves secured and how to secure the organization, things like that.
So I just want to know how he started being a hacker and how he ended up in jail and something like
that. That's awesome. Yeah, Kevin Mitnick, he writes a lot of books and John, the book that I
was trying to find earlier is Ghost in the Wire. So that's one that I actually do own. I just
can't find it at the moment. But I would love to interview some type of spy that's done the
clandestine work, although I know that they can't share anything. So it would be probably a really
boring podcast. So there is a podcast that I listened to called Layer 8 Security, or I think
that's right, Layer 8, sorry, Eight Layer Insights, and it's all about kind of spies and that kind
of stuff. So I really enjoy that one. I would love to do that. Otherwise, probably just some of my
friends, right? That friends that are in the industry doing their security work and just being
able to bounce ideas off of each other. So I've got a buddy that I was literally just texting this
morning saying, hey, by the way, here's some Azure security stuff that you should be aware of.
So I know he listens to this. So maybe we'll invite him on next time. So.
Nate's like, shout out, you should definitely get on the podcast. Yeah. Or just come work for us.
I'd rather have you work for us than just join a podcast. How about both? Yeah, both. Yeah.
He can be on all the podcasts he wants. Exactly. You're like, you can just be one of the
regulars now. 100%. Come work for CIT. You can be a regular on the podcast.
CIT slash careers. Yeah. So I sorry to, I didn't remember to include this, that Kevin
Mithnick also influenced my book. When I read his book, The Art of Invisibility. So then that
influenced the book I wrote that is on Amazon. So I just started like gathering some ideas,
like, okay, let me write something to help the people. It was during pandemic that I wrote
my book and a lot of people were falling victim of cyber attack and all that.
Yeah. So I guess maybe I could summarize both John and Isis, interview those that have inspired
you. So if you're saying Kevin's inspired you, my friend was actually an old boss and everything
like that who inspired me. Right. So, but again, continue just learning from those that inspire
and helped you grow. 100%. Kelsey, did you have anyone? Did I have anyone? Well, I felt like it
was such a wide range of like, I'd like to talk to this person, this person, I'm like, I don't even
know if I'd be comfortable enough talking to these people or what I would ask them. But I think if
I kept it broad, A, I want to call it a little bit of chaos. I'm just saying I already have a name
for it. I don't know what we're talking about, but I got a name for it. But I think I'd really
like to just talk to different creatives regardless of the field. I think that that would be so
interesting to just talk to somebody completely different every single day. Because those are
the type of podcasts I like to listen to as I was like, this doesn't have to do with my day to day
necessarily. But it does cause me to look at things differently and go, oh, hey, there's no
reason why I have to be doing it that way. Or, you know, you get those really interesting life
stories of them going, this is the moment when I decided this is what was important to me. So
that's my kind of North Star. I was like, oh, interesting. I'm like, you have such a life
purpose that I don't always feel like I have. So I'm like, that would be essentially the like
chaos of it all of being like, hey, this is our excuse to talk about anything within the realm
of do you feel like you're creative because everybody is. So. Interesting. That's so interesting
because I kind of went the same route. It's just so funny. I thought the first thing I thought of,
I have an old professor who just started a podcast that is kind of that where she's like
talking to creatives and talking to like her students or her coworkers. And I'm like,
I would love to just sit down and talk to her again, you know, just an excuse to go back to
those people who influenced me and just kind of see where they're at now and how they've grown and
how they've changed. So yeah, very similar to Kelsey, just those creatives in the world.
So interesting. We'll be co hosts. This is fine. Who's gonna be? Yes. Oh my gosh, we've got a whole
new podcast. Awesome. I love it. Well, today on our tech for business podcast, we're talking Kelsey
and I are joined by Nate, our director of cybersecurity and John, our sock technician.
We're talking about learning, we're talking about growing, we're talking about specifically
staying up to date in cybersecurity. And I want to start with me just really broad as to,
it seems like an obvious answer, but why this topic is important and why it's so important,
especially in cybersecurity to stay up to date. Yeah. So with cybersecurity, one of the main
things there is it is rapidly changing, right? You know, the tech that was here last year
is already different, right? The vulnerabilities that were there yesterday, there's already new
ones, right? And there's items such as zero day vulnerabilities, right? These are ones that are
actively being exploited by a threat actor, and there's no patch available for it. So how do you
start protecting networks, right? There's the market, especially in cybersecurity is shifting
so rapidly, right? We see a vendor that's here today and they get acquired and absorbed into the
next vendor tomorrow. And we see this all the time, even with solutions that we use today.
So it's just rapidly changing. And so that's one of the reasons why I love it is it is not a
stale or stagnant environment. There's always something to learn. And then again,
what was here yesterday, it's already old news, got to learn the next thing. Or, you know,
reading items at predictions for the next year that you find out or either completely
wrong because the entire industry has shifted or again, just thought provoking items to start
getting us into the right mindset. I'd say that's the biggest reasons why. Now, how do you do it?
That's a whole different topic that we're going to get into. I'll just say it's not something you
can do alone. So I rely heavily on my teams as well here. John, maybe you want to start just
some of the basic things that you're doing today to try and keep yourself up to date? And I can
talk a little bit about what I'm doing. And I think what we'll find out is everyone has a
slightly different approach that works for them. Yeah, definitely. But I would just like to
circle back a bit to the introduction you gave about why it is important to stay up to date.
It is very, very crucial to stay up to date because just like you mentioned, the cybersecurity
landscape changes all the time. And that is why what I tell my friends that want to come into
cybersecurity, I always tell them, hey, if you are lazy, you can't get into cybersecurity because
everything changes all the time. So you need to do a lot of reading, you need to attend seminar
podcasts, belong to different organizations. Like here in Kansas City, actually belong to
an organization, information system security association. So I listen to, they bring
different speakers every month. So I joined the virtual conference, I joined the web
manner and things like that. So it is very, very crucial to stay up to date because the
goal of cybersecurity in the first instance is to have confidentiality, integrity and availability
of data. And it is not possible if you are not trying to stay up to date, there's no way you
can comply with the goal of cybersecurity. So talking about how do I stay up to date?
So part of the way I stay up to date is training. Training, security, awareness, here in CIT,
we are meant to do no before training. No before training, we actually expose you to staying up
to date, consigning how people can come up with different fishing attack. So no before
is like a simulation of these type of attack. You see it in your email all the time. So that is
an aspect of how we stay up to date. And apart from that, we also have like video training
from no before on how to protect password authentication and stuff like that. Then apart
from that, apart from the fact that it mimics the real security fishing scenario, it also
makes you understand a lot of things that is going on within the organization.
So an instance of that is I was reading something yesterday how somebody tricked
a company into clicking a link by changing the top level domain. The domain of that organization
is actually.org. And this person cooked up an account and the account says.net and they sent
an email to this person working for an organization to send an invoice and the person fell for it.
So if this person has already witnessed some kind of no before training, I think something like that
shouldn't have happened. Yeah, I guess you helped think of a two different idea or bring up two
different ideas for me is security training is incredibly important for any organization.
So if you take a look at the global metrics or United States or so, I should say, is on average
an organization, depending on the industry, for example, technologies tends to be a little bit
lower, manufacturing tends to be a little bit higher on the percentage of people that fall for
fishing emails. And we see this across all of our different customers. We have different industries
metrics, all that fun stuff. But typically it's between, I'm going to say just 15 to 35 percent,
percent of people that fail when you first start a security training initiative. And then after about
a year, we tend to see that drop below 10 percent down into the threes, the fives. So the regular
testing is incredibly important. Here at CIT, we test employees all the time. They probably get
annoyed at it. But rather than doing the compliance checkbox saying, did you do this annually, here
at CIT, we do it at a minimum of weekly. And we do see the fruit that comes from those initiatives.
Our scores are dramatically low, which is phenomenal here. We put a lot of trading in,
and it does pay off. And then the other thing that John was talking about as well, and specifically
just coming from a little bit of my incident response background is experience, right? As
John was talking about someone spinning up a domain similar to it and falling for it, we see it all
the time, especially with things like fraudulent wire transfers, right? Someone impersonates you.
And we see that. So experience obviously is incredibly crucial. The security training
that's being provided by some of these tools are incredibly useful. One of the other things that
John had mentioned was continual training and doing that kind of stuff. There's a lot of great
online resources completely for free as well. So I've used Hack the Box, right? So if you're into
more of a offensive security, which is more of the attacking, not just offensive because it's
mean or anything like that. But Hack the Box is a website that you can go to to practice hacking,
right? And then John, you flagged our security tool on your lab that you're just playing with.
Which one were you just playing with? So I was playing with Blue Team Labs. It has a lot of attack
scenarios that you can come up with. Just do the investigation and being able to write a report
about it. Then there's also Over the Wire game. So that is actually a game that teaches the
leading operating system and the bunch of commands under the leading operating system. So if you get
to a certain level, it will tell you to look for a password, to crack a password, to enter the next
level. So that teaches a lot of hacking skills and how to protect people and organizations.
Yeah. So there you go. There's a red team or offensive or attacking lab. We also have that
Blue Team Defensive Lab that we also mentioned there. So there's two different routes if you're
interested there. Certifications. Here at CIT, we put heavy, heavy emphasis on continual education
and wanting to push employees to get the next certification, training, whatever it is. So
we have people doing the A plus, net plus, security plus, server plus, Certified Ethical
Hacker, CISM, CISP, you name it. There's all these different certifications. Azure, John,
I think you're working on an Azure at the moment as well. But it's all of them.
Thanks, Nate. Yeah. So and thank you, Nate, for the mentorship program you introduced us to.
The CISP mentorship program, the FRCQ. So I'm also on that one. So probably when I finish writing
my Azure certification, then I will jump on to that one. So in CIT, we are encouraged all the
time to take all this certification because we need to stay updated all the time because
if you are out of date, there's no way we can help our customers to help them fix their security
issue. So we need to be up to date. We need to constantly do a lot of training, do a lot of
certification so that we can catch up with the current trend in the world of cyber security.
So I was going to ask, I know you're talking very, very much in the work environment,
like with certifications and stuff. I'm curious as to what you both do outside of the work
environment to stay up to date. I know there's some like blogs and books and things that you'd
kind of mentioned. What are you doing in your free time to continue your education?
I think Kelsey already knows my answer to this. So this is one that I'll preface is I tell my team
all the time, do as I say, not as I do because the next thing I'll say is what free time?
So I try not to have my team work long hours or over the weekends or anything like that.
Do as I say, not as I do because I'm the worst example of that. But for those that are listening,
if you have free time, I, so personally, I don't watch a lot of these labs. I'll join them from
time to time. I consider those going like deep into a particular topic. For me, on the daily
basis, I don't have my phone on me at the moment, but I use a lot of RSS feeds. So if you're not
familiar with RSS feeds, you subscribe to basically a website and then as the website posts new
articles, it gets delivered to whatever you're using. So I use an app called Feedly, you know,
not a sponsor. It's completely free if you want to use it. The free plan is somewhat limited on
what you can do, but for my needs, it's completely sufficient. Within there, I break it into three
different categories. I have an alerts section. So what are some of the critical alerts that are
coming in? So items such as CISA, they are a government entity that puts out new alerts saying
new vulnerable, you know, systems, everything, or the ones that are known to be exploitable,
have a whole section called blogs. And so just as people are writing different blog posts,
you know, less newsy, then I have a whole section to that. I have, I took a picture of it earlier,
but, you know, things like CSO online, dark reading, health IT security, Krebs on security,
Schneier on security, and all of them have security, I guess, the cyber wire, right? And then I have a
whole section regarding news. And so things like bleeping computers, one of them, but I probably
have 40 or 50 different news sources that are all coming in. And, you know, if I have two minutes,
three minutes, whatever, I'll just open up my Feedly app, take a look at the top trending
things, you know, and because I have coverage on so many different websites, oftentimes, if something
is critical or emerging, you'll see that there's, you know, four articles about the similar thing.
So it quickly bubbles up to the top. So I can do that. And then after I start getting through all the,
you know, most critical or kind of a trending stuff, then I can flip over to all and look at
all the posts that have come through. That's probably the best way that I know of. And then as I'm just,
you know, mowing the lawn or whatever it is, shoveling, because it seems like we just continually
get snow here in Minnesota. I listen to a lot of podcasts as well. So a couple of the big ones
that I listened to, I already talked about the eighth layer insights, more on the spy kind of
side. But there's a CSO podcast. There's Dark Net Diaries, which is more of a storytelling,
phenomenal podcast, if you haven't listened to it. Cyber Wire Daily, that's a podcast that's just
dedicated to yesterday's cybersecurity news, right? So if you're hopping in the shower, brushing your
teeth, whatever it is, throw on that podcast, listen to that yesterday's news. If you miss
something, they'll cover it. I touch on a lot of stuff there, but that's my regiment is,
you know, mornings or when I'm busy doing something driving, I listen to a podcast. If I have a couple
minutes to look at my phone, then I'll do the more of the RSS feeds.
John, do you have free time? Oh, yes, I do.
Yeah. So part of my free time, I also use it to listen to like some podcasts. And
apart from that, I subscribe to different, you know, YouTube channel. So I'm always on
CK Award security weekly. The Hacker News and just like Nate also mentioned,
also do Blueprint, Cyber Wire Daily, Dark Net Diaries. So then apart from those, I also like
listening to this guy, I subscribe to his YouTube channel. I don't know if Nate knows him, Network
Chuck. His name is Nick. His name is Nick. Yeah, I will send you. We're learning together here.
Yeah, I will send you his link. I mean, he's really good. He talks about the new trend
in the world of cybersecurity and, you know, like he knows a lot about networking. So because I
want to be learning more about networking as well. So I like following him, you know, so that
that when I have my free time, that is where I go to learn stuff. Yeah. So yeah, one thing that I
was going to touch on earlier that I did was utilizing our own teams and staff here at CIT,
right? So we've got a lot of really, really smart security people here. And even just smart
texts in general that, you know, I happen to read the news while I'm eating lunch and
send me an article or something, right, to help continue educating me. I know that I don't know
everything and I know that I'm not going to be able to read everything at any given point.
So if there is something really important, like again, John mentioning some of his favorite YouTube
channels is sharing it, right? You know, he just mentioned one that I've never heard of before. So
one that I'm sure a lot of people have heard of, at least if you're in the security industry,
again, continuing the YouTube topic is John Hammond. I try and watch a lot of John Hammond.
He is one of the smartest offensive security guys that is public that I know of. You know,
he's always posting new things. I think I literally just had one pulled up right before this as I was
getting ready to eat lunch. It was all about how to test your EDR solutions with third party
testing essentially, right? How do you ensure that the investments that you put in place
are successful? And so that's something that, you know, CIT has done, but it's also something
that he's trying to educate others on as well. So and then I guess one other one YouTube channel
while I'm on the topic is 13 cubed. So it's a far less known YouTube channel, but it's heavy,
heavy, heavy on forensics. So, you know, what are the inner workings of Windows file system and
how it keeps track of time and updates, you know, the updated, right, or date modified or date
created fields, because there's nuances between all that. That YouTube channel digs into that.
So if anyone's looking for some good nighttime listening, put you to sleep. That's probably
one of them for you. New bedtime stories, which I really quickly want to go. You just a, we got a
huge laundry list of going, all this is great. So for anybody listening, we will get the links
from these two and put them into the podcast. So if you were trying to go, Hey, wait, go back,
pause it. We'll get there 100% because that's what my brain just said. Because I was like,
I'm never going to remember all of these, but they all sound fabulous. But also, right, if part of
our audience is not technical, not just doing cybersecurity day in and day out, I know from
a personal standpoint, right, that I'm lucky enough that when something happens with, say,
one of our web plugin tools, I get a message from Nate going in the morning going, Hey,
there's something going on. Do we have this? And then I can go check it. And I'm like,
Oh, I got my whole back covered by an entire team that's looking out for these things and
double checking my work, which is fabulous. But I can only imagine for somebody running a business,
if cybersecurity is only one of the hats that you wear. And we just listed out things that,
as Nate pointed out, may take up all of your free time just to stay up to date with all of this.
How would you ingrant it? It sounds like I'm totally leading into a sales pitch of going,
work with CIT, which spoilers is one of the answers. But is that kind of the best way if
you're running a small to medium business is to find a cybersecurity partner?
Yeah, like you said, that is the correct answer, at least the selfish plug in there. But
yeah, so if, for example, if there's something that you're working with CIT on,
again, our teams are staying up to date on this. So I'll use one of the latest ones was
Outlook. Outlook had a major, major vulnerability that someone could send you an email. You never
had to interact with it, but your computer could send your kind of password encrypted
password out to the threat actor, they could then use that to try and get into your network.
Zero interaction, it was extremely critical, right? That's something that CIT,
we saw, we put in custom scripts to remediate it on our customers' be halves. We notified the
customer saying we are going to do this. And then we pushed that out to the thousands of endpoints
that we have to make sure that those were mitigated as fast as possible, right? So that is the value
that you're going to get out of some type of partnership. If you're just looking for staying
up to date, like I said, those RSS feeds, the YouTube channels, whatever your flavor of learning
is, watching, reading, whatever it is, there's so many great resources out there. Yes. Then
apart from that, monitoring environment, testing, and regular L check of some of the
security tools, those also matter. Yeah, one of the things I think you'll find
for anyone that is interested is the security community is very, very interested in sharing
knowledge with the wider community because we all know that it takes a village to actually
protect all these organizations, right? There's a, on our last podcast or so, we did the whole thing
about a shortage of cybersecurity labor, right? There's already a labor, so there's already a
deficiency of people that can actually patch these things. So rather than trying to keep all that in
our own heads, let's share. So you'll find a lot of security people are doing online writings.
John mentioned that he wrote a book about it. We've got YouTube channels. We're sitting on this
podcast right now if you're still listening, but I hope you're still listening. Yeah. Yeah.
Yeah, exactly. So basically, staying up to date has to do with protecting your business,
which is synonymous with protecting your customers. And that is what is always fueling
my own passion about anything I want to do. Like the book I wrote, just to help people.
I believe I am in the cybersecurity profession because I don't want to see anybody cry.
I'm always trying my best to assist, delete where I can. And some of our customers,
as in CIT, they can also testify to that. Because if anybody reaches out to me and say,
oh, this thing is going on with me, can you help me look at it? Even if I'm doing something that
is not too important at that moment, I will quickly jump on the call just to help them look at what
is going on. And as we kind of wrap up here, if there's any kind of closing thoughts, anything
you want to share, anything, if somebody is listening to this podcast and they're feeling
overwhelmed or they're feeling like, I am so behind. Any practical do this today advice that
you could maybe give them. Okay. I will say this. Staying up to date is not something that is
negotiable. Especially if you think about the zero trust and the Joe Biden's executive order
in improving the nation's cybersecurity. So you are less vulnerable if you are on the latest
software and application. So try as much as possible to stay up to date by using
the authentication app. Check your information if they are not on the dark net or dark web or deep
web. Always try to attend conferences, webmina and all of those things and try to monitor them.
Just like I said before, monitor the environment and then do regular check of your security
information and event management to and things like that. Then attend podcasts. Just to
generalize everything like we've been saying just in conclusion.
That's some great stuff, John. I love that you took it completely to the super practical level.
Not even anything really about sharing, just saying, by the way, you should start focusing on
this. I am going to bring it a little bit back to some of the new sources since John covered that
one so well. Try to find websites or blog posts or anything that's relatable to your industry.
So if you're in healthcare, I'm going to call this one out again, health IT security. There's a whole
website dedicated to that and what is coming down for the latest regulations, the revisions that
are happening. Also, there's just other components. For example, if you're more of an executive,
probably websites like this CSO online, it's intended for extremely high level
reading. I'm not going to say comprehension, but it's intended for executives.
Now, if you're a technical person, maybe you're trying to break into cybersecurity,
maybe more of the technical ones are going to be of interest to you. I recommend John Hammond,
but I don't because he is up here. I try and follow along there, but a lot of great articles
out there to really fit what you're looking for. So again, we can provide all these in the notes
and everything, but start taking a look at them. Just even one of them, just to say,
this applies to my industry and I should be aware of it. Maybe you bookmark it and look at it at
lunch or something, right? But if you want to get completely flooded with articles, then I would say
take a look at something like the RSS feeds or some other way to gather data from a lot of
different sources. Then at that point, you'll start really seeing a comprehensive coverage of the
entire industry, not just specific to you. And then work with CIT. Yeah, first. Yeah, I was going to
say, if you need anything, feel free to reach out to us. We can get in contact with both of these
people or anyone else that you're interested in speaking to and just getting some information.
We're always here to help. So thank you, Nate. Thank you, John, for joining us today.
And if you are curious about cybersecurity in general or how CIT can help you and support you,
reach out to us at info at cIT-net.com or head out to our website at cIT-net.com
slash podcast. And we'll be back next week with an all new episode.