Cybersecurity Journeys, Trends and RSAC 2023 – Jennifer Leggio, Netography

This is texturing TV. We're here together with a really special guest special friend Mike rothens and I my generalizio Jennifer. How are you doing today?

I'm doing great. I'm really happy to be here. Thanks for having me always fun talking with you and you've been on some events with tech strong number of times really appreciate the all the things fun things that you do with this but that goes way back our history and we'll kind of get into some of that.

We've all known each other since I think are some of our first security startups the dawn of time. I would say yeah, I just networks and there are many drinks and cigars and RSA sees, you know behind us and and some ahead of us too. So introduce yourself for folks that might not know you oh sure.

So Jennifer Leggio Jen to those who know me. Well, I am the chief marketing officer at nitrography which is a security startup. I am a security startup girl at heart been in the industry for about 23 years.

doing a lot of stuff by like some charge worked at sourcefire and worked with them through their acquisition by Cisco worked at coordinate how build them to their IPO or to Flashpoint Clarity had some really fun runs and then just you know, how I know these fine folks much better is working in the security Community around a security bloggers Meetup security bloggers Network and it's early days and those types of things and I think that my one there's one thing to know about me beside my little Buzzy resume that I just find out there that I'm you know, I'm pretty loud about marketing and security and and encouraging those that use fund to quit and maybe go work at Quiznos is quiznosed something to stop creating more risk in our environment. So I'll probably touch on that a little bit more as we chat. It is a theme for sure.

Yeah, well dare say Mike, you know there wouldn't be without Alan and without Jen there wouldn't be a security bloggers Network certainly wouldn't be the meetups. Well, that's yeah, it's certainly wouldn't be what it you know became you know, I mean, I think Rich mobile and I had a little bit to do with it, but I'm giving all the credit again you later, but you know, certainly we were a quartet. So to speak of folks, you know, really driving a lot of the community activity early on and and really and kind of why we got together today is is really a preview.

I certainly my favorite week of the year and it's funny, you know kind of years gone past. I think I've been to you know, the only four out of the last 26 are essays or something like that. So Jen when you say, you know, I've been doing this for 23 years I start doing the math and go.

Yeah, I'm old right, you know, I'd be you like 10 Before you you know, it's like, you know, I start doing the math and it hurts my head a little bit but you know, it kind of perplexes me that you know, folks like all thankfully I'm able to get out of RSA this year and all that and it's just like, why would I not want to go to my high school reunion right? Why would I not want to go see all my friends that I don't get to see, you know, as often as as I would like, you know, we're coming off of three years where we couldn't really see much of anybody and now you have an opportunity to go and touch base with you know, getting a lot of folks that I've known for a long time that I care about that have become really good friends. So I'm really excited for you know, the RC conference in a couple weeks it really what we want to talk about a little bit here before we kind of dive into you know, some other topics is really what we expect right?

I mean, you know if it's a little bit different last year was kind of you know, many many RSA right because they had to move it from April to to June folks for still getting back into the world. That seems to have passed, you know, we expect in a huge crowd. Is it going to be kind of like the Halcyon Days where you know Caesar is eating grapes and everybody's you know celebrating.

You know, how great things are in the security business. So what do you expect that in the next couple weeks? Well from a marketing part of you.

This is like it's almost like getting ready for the Super Bowl, right? So there's even though you know topography were series a startup. We have a deal.

We have a good presence for our size. It's a lot of work going into it. You know, I it's interesting to buzz that I'm hearing.

I did hear that they're expecting 43,000 people which is a little which is a double last year. I did walk away with covid last year from our say I think it was one of the yeah. Yeah.

That's right. That's right as well. Not sure who's first covered together.

Yeah, exactly. mix I have mixed feelings about it like it's It's a to your point Mike. It's exciting to go back.

There's a lot of people that I only get to see it or you know are saying black and I'm exciting to see those folks. There's a work side of it that is feeling all these pressure about like pipeline leads all the things that I need to to get out of it, but there is a part of me that's like I'm too old for this. I'm not going to any parties.

I'm going to bed at eight you're gonna watch TV, you know, so it's kind of weird how how it's changed for me. At least. I don't know how you guys feel about it versus I think of the my old days of staying up till 3 am at the W.

That is definitely not my future this year. Yeah, not mine either. I mean, I'll hit a couple of parties pretty early catch up with some friends over cocktail or eight but you know kind of none of the Raging that I did, you know kind of waking up in the morning.

Where's my wallet, right, you know, okay Bones still here and none of that stuff anymore, you know, my liver hurts too much and I got too much to do the next day the food at those parties. I think I'm more apt to order room service about eight o'clock. Yes in my room just eat something more and go to bed that's reasonably food, you know supposed to absence day.

So what are the bus what's gonna be the most you kind of mention a little bit, you know, kind of there's gonna be a good crowd. Hopefully this year. Is there any kind of terms or or Steps that you think are really going to resonate you know, and and kind of take over like zero trust did or or you know, kind of whatever the the buzzword was EDR, you know a couple of years ago.

And what do you think's gonna really resonate this year? I hate to say it, but I feel like The elephant in the room, like everyone's going to be talking about Ai and chat gbt and what that means for security what that means for business and how do we secure it? And what do we do?

And I've lots of opinions around that but I think you know, normally you'd go into an RSA being like you're saying like, oh, is it gonna be zero trust? Is it going to be like, you know Sam now when we back, you know, something like that, right, but now it's something that's really like on the Peripheral of security has a big impact on us, but it's not a security technology. But I feel like that's front and center.

It's going to be interesting. How many what I'm curious about is what kind of questions we get about it at our booth because it kinda has nothing to do with what we do but it kind of has everything to do with what we do at the same time. So not trying to be super philosophical but it's it's one of those things that I think we don't know.

We don't know yet. Yeah, it was it was interesting. I did a panel at our our Tech strong con.

Otherwise Carolyn Wong and Andy Ellis and Adam shows that we're on it and you know who's interesting because there were two aspects to it. I want I think we've been using AI or at least machine learning aspect of AI insecurity circles for you know, close to 10 years at this point right to to refine our detection and and really kind of improve our efficiency and our Effectiveness in terms of finding things. So the generative piece is is you know, obviously what's new At this point and and possibly using it again.

You have a long background in spread intelligence, right? So, how can I use you know, something like generative AI that you know supplement the information that my analysts are getting kind of well within their flow of response using generative AI a lot of aspects that but one of the things that the panel brought up was what happens when the adversary store using AI against you right? So it's it's both sides like you how do we use it as a tool?

But how does it start to be wielded just like we saw the plow leveraged against us when when the adversary started, you know, again attacking small companies and taking over their devices and watching denial of service attacks on that front. So I think it is really largely unknown in terms of what it is. It's it's very exciting.

Everybody's gonna be, you know, kind of busy about it and and you know, there's gonna be you know, somebody sitting there with little cards of stuff that chat GPT pull out, you know generated Here, this is your tragedy BT, you know word of the day or you know, the sentence or what have you for novelty value, but I do think that's going to be one of the clearly overarching themes that we'll see is really just trying to gauge the impact of this Mitch. You know, what do you think? Who I was thinking how many haven't been guilty of this myself.

You have to Mike how many presentations generated with Chachi PT are we're gonna see this brought to you by you know, Etc. I know I did one yesterday actually exactly what I'm wondering if I didn't like a like a luncheon learn about AI for our for our company and I actually use check EBT to build the presentation thrown around the buzzwords. This is great large language models love.

Oh expert there. I'm curious we so what so once you get past the you know, okay. All right talking about buddy.

Yeah, we're kind of run out of what we know about it depending on our knowledge level sort of what's the next security topic? Where's the unit? What's the Innovation or we think there's gonna be a lot in this space obviously with with your company with Marty and team, you know, we expect hope and are looking forward to great things from you.

Of course, what are your thoughts Jenna and where is the center of the universe the gravity for innovation? now in security it's hard to you know, I'm a CMO. So it's really hard for me to not you know, talk from the the cool day drinking outside of this right trying to go into an autography pitch, but I think I'm just having a conversation with a friend about this the other day who's running a co-founder of stealth startup and I think we're at this interesting inflection point where I don't Know that it's necessarily the new technology that needs to be the focus of the conversation.

It's like, okay guys. Where are we gonna start being real with ourselves that the technology that we have EDR other things not to pick on EDR. Just first one that came to my mind.

They have a purpose even like IPS and you know firewall Etc. They still have their purpose critical for compliance in some cases. But there's huge gaps out there and we still out there.

I'm like just kind of like doing the thing that we've always done and I feel like we're at yet another inflection point in the industry where we have to kind of change the ideology of how we approach security. So I it's hard for me to throw out. You know, I could sit here and be like, well, we have something you know, but I'm not going to do that.

And also that's not the it's not a silver bullet. There is no Silver Bullet, but I think that we really have to start being honest with each other around you know, what's working and what? Doesn't do what it used to do, but it still has a place and I've never seen that before it used to be like something came into replace the other and now we're kind of like we still need that but especially because of zero trust.

Right, which you do need? It can't do this stuff anymore. And so I don't know that's that's my view of the world without getting into the tech itself because it's hard for me to do that without pitching what we do.

So I'll stop there. I mean to be fair generally. I I think that visibility is remains a thing, right?

So yeah again, I appreciate you not wanting to you know launch into you know, why I join Marty in the team and why we got the back together at least part of the band, you know, anyway from from the sourcefire days, but you know, you've seen it as we moved it to different areas, whether it's again better visibility the important, you know, and gfw happened better visibility and the you know, kind of network side Cloud happened. We need cspn to get better businessability into those. We've got containers and Cloud native and all these things, you know, the first wave of that is always visibility, right?

So then you kind of go through this cycle where you get a first generation technology and then you get a whole bunch of other, you know stuff that happens. And then folks come back around to the fact that hey that stuff that we were doing five six years ago was Innovative at the time but the world's changed right? I mean, you know, you've got all sorts of stuff that are wrapped up within different, you know, containerized environments, you know, Cloud platforms all these other things that it's not as simple as putting you know, what a sensor on your network and I know what's going on.

Yeah, not so much right, you know God we got sassy stuff all over the place. We got all this other stuff. So again, and let's use it as a metaphor to talk a little bit about the topography right we're taking up your time.

So so why I know you guys have an Innovative, you know approach to you know visibility on on the network. So I need to describe that from maybe, you know again a minute or two just so we get a sense of where you're coming from and where again you think the Innovation is because obviously you're betting with your paycheck that that there's there's Innovation there. Yeah, so the one thing the thing I'll say touching on the visibility piece of it and talking about like old things, you know older things that you know, they may not have relevance but there's also older things that have been forgotten.

There's been all this focus on like sassy and cloud and Cloud native and xcr and all this people kind of forgotten that the network still there. Right so there so that is you and it's changed. Right?

So you've got your network is not and this is something the Marty talks a lot about is like your network is not just your network your network now includes cloud. And you have network security challenges that exists in the cloud. But you can't solve those with appliances.

And you can't solve them with virtual firewalls and things like that and then you've got this whole issue of zero trust. Which is important and it's needed. But you've got your so much is encrypted.

DPI doesn't really see a lot of stuff anymore. You can't inspect your pockets the way that you used to figure out what's going on. So, how do you do that?

Right? What do you do? So you've got to find this is okay.

I'm gonna pitch you for a second Cloud native solution that can deal with network security issues both on Prem and in the cloud. And that's essentially what we do Marty talks about it is the atomization of networks security advice network, but really it's like we take a flow based approach. to see what you can't see through the old traditional models and seeing those gaps where you can't reach some of these other Technologies.

So that's what I'm betting my paycheck on and you run into it. It's interesting issues. You've got like your flow Fanatics like your old school networks carry folks Network folks get it.

Yeah, exactly. Forget it but they might still be skeptical like can flow really do that. So that's that's a point that we need to prove.

I actually got a campaign that went out today. That's like these are all the things that we can detect the flow folks like these types of attacks. Yeah, you know and then you've got folks that are like hardcore Cloud.

They're like wait no no network security has nothing to do with cloud and I'm like Wait a minute. It's part of your network. Right, but it's still a network.

It's still a network right and just software now instead of a bar. Oh, sorry Mitch. Yes.

It's it's a just a software stack instead of a box. And why are you trying to use an NDS to your Cloud? Mmm, they're gonna work right?

So it's it's those types of things that were were looking at and then again, you know, my I can't say too much but my dear friends our dear friends over at command zero Del Iran and deemed a beer and Al hyuger. They're working in some really interesting stuff. They're still in stealth so I can't say too much but dogs got a panel talking about the pain a lot of these things applying to like the pains and investigations and incident response.

What do you do when you can't see what's going on? So I feel like that's becoming visibility. Like you said.

Mike is becoming a theme no matter where no matter what type of Technology you're pushing like you've got to get to that. We've got to get back to those Basics. The thing that I keep being reminded of is that visibility has always been the thing right?

You know, it's it's very rare that you get to the point where the control over, you know takes the visibility and that's only for a short amount of time right and then you tend to have you know, a certain set of control points and then you move on to the next thing and it's always visibility. It's always visibility. So after one in there because I do think we're gonna hear a lot about resilience.

I wrote about this and I did a post on Security Boulevard. It should yesterday. Um, but you know, I think we're gonna hear a lot about that because you know folks are really trying to link up security with business and this idea of continuity and resilience and and Know kind of in the face of both performance issues and complexity and attacks it all kind of can be jumbled together and conflated in a marketing hodgepodge of stuff.

So I do think we're gonna it may not be the big theme, you know kind of this year. I think we'll see a lot more of it when we get to black hat through the summer but that does feel like it's gonna be a theme that we start to see so, you know, we're gonna see a bunch of stuff. We're gonna see a bunch of all friends.

We're gonna be reminded about the fact that hopefully this is a community we're gonna be doing the security bloggers meet up, which is exciting on Wednesday night. So if you are security blogger, we hope to see you there. We're gonna be doing the disaster recovery breakfast on Thursday morning 8 to 10 at the Pink Elephant.

So that is certainly my favorite event of the week. So come RSA but we don't want to just get all that s*** about security right because we're actually people and you know as you get a little bit more mature, let's say we find we have different interests, right, you know kind of so generally why you know, we do want to let you touch. I know you're starting to Branch out just beyond cyber stuff.

So let me tell us a little bit about what you've been up to, you know, kind of on the person. um Well great way to start with an um there. So I appreciate I appreciate you asking and I do one thing.

I just want to throw out there more around the not to go back to the AI and the Chachi BT. I really think there's a huge privacy and security trust and safety play there that is being hugely overlooked and that's gonna that's gonna catch up. So I think people should keep their ear out about that at RSA but back to the human side of things.

So that is very human for me. It's been an interesting Journey, you know, the the last six or seven months I you know, I have some trepidation going into RSA that I never had before normally this time of year. I would be like, all right.

I'm going to all these parties. I'm gonna do this make my pregame on I'm ready to network. Like I'm social anxiety.

I like social anxiety. You got a little bit of a Gore phobia like so I you know a lot of that like, Social lubrication to you know, drinking to like mingle with others and network. Well that seven and a half months ago.

I decided to get sober and to the point of going into recovery quite frankly, then I've been very open about that. Um because I realized that It went for me. It was either zero or blackout.

Hmm and it didn't matter if it was like a work event or personal event or on my couch. As a matter of fact, I recently I did a comedy thing where it was called on the couch where I bought him down because it was like where I realized that like I needed to stop and then it's also where I started to enter into recovery programs. So for me going into our state this year, I'm kind of like, all right.

What tools do I have in my toolbox? Um, you know what people do I have there like the good news is for me not good one day at a time that I haven't wanted to drink since I stopped because my life is so much more full than it was before but but you know, I feel like you know when we were thinking about doing a vendor party we decided not to put the money into it at our side but you know Stacey Thayer who's on my team and I we're gonna do a mocktail room. Because I feel like it's just like there's so much people like you must go drink in order to fit in you must go drink in order to network.

It's at least that's how I felt growing up in my career. Now that had nothing to do with my issue. They can't blame the security Community for my problems.

But yeah, so it's it's weird. It's it's so weird to talk about so publicly but I also want to take the shame out of it because I know if anytime I talk about it. There's got to be one person.

That's like hmm. Maybe that could help me. Well congratulations and you really I mean that's just fantastic that is congratulations, but we're very proud of you because you know again it's it takes a lot of courage to admit one, you know, you have an issue and to actually take action to address it.

So that really is fantastic. And you know, what what what's interesting is that you know, and and what you can't provide anybody that isn't, you know, that hasn't been doing this for a while is is perspective. Right?

So I I you know, my kids are in college now and I see them doing a lot of the same stuff that I did for better for worse. Sometimes For Worse all that kind of stuff. But what I don't have and what I can't give them is the perspective of you know, 35 years past that where you say, yeah that stuff just isn't that important, right?

You know? Yeah, you know, you're kind of talk about it as it's a badge of honor. Know he ended up in this situation or that situation and and you know again you get to a point in your life where you're like, hey, it's it's about more than that.

And and I really appreciate you know, kind of the social Loop location aspect of that because you know again, I think a lot of people especially is there on the younger side of things, you know, again, they do suffer from this we're coming out of a situation. We didn't have to interact with anybody besides. I'm a little box right over for two and a half years and you're starting to get back and mixing the people and it's anxiety.

Right just cause a lot of angst and the easiest thing to do is just to to get numb and to move it up a little bit. But you know again, I think that that having your voice having a lot of other folks that talk having Alternatives, I think the mocktail party is fantastic, right you people on opportunity to not have to do that and be like, you know to be, you know kind of s***-faced in order to actually enjoying, you know, the company the people around Me right and that's when you start to realize and that's when it's more like, you know, hey, these are my friends as opposed to these are folks that I kind of know in a fog of, you know nonsense. Yeah, I absolutely agree.

And it's it's interesting where I you know, I love natography and I'm really I'm really tied to the mission of it. And you know, I'm gonna see this through you know, and as long as as long as it takes Marty would kill me if I didn't anyway, but I but I know I love it and I believe it and it's not just Marty. It's also bear it line and Dan Murphy or other Founders who are fantastic, but I found a purpose through all of this and it's like You know, I know that on the other side of this I don't want to do cyber anymore.

I want to go into recovery. Advocacy. I want to become a counselor.

I want to speak and write I want to use my voice. I want to use my brand and helping and I think that's one thing that I think is really like if we kind of broaden this out and take it away from recovery taking away from RSA. One thing that like, you know, there's a lot of conversation right now as there should be around inclusion and security and cyber careers and things like that.

And I think you've both heard my rant about how I hate being told that I'm not in cyber security because I'm a marketer because I'm not technical I beg to differ but that's a different conversation but actually haven't had a conversation with you yet. So yeah, I feel very strongly about that one, but it's like it brought into like you can make your career what you want it to be you can be in this industry and you can like if you think you don't I've said this recently if you think you don't have a voice you have one. And if you don't believe you have one surround yourself with mentors to of whom might be on this call that help you break out of a mold.

My best advice actually ever got was Mike during a time that he will know. I won't say or he said sometimes you do things to learn what not to do. And and anyway, I I'm kind of going in circles a little bit here.

But my whole point in bringing that up is that I think that there's a way that you can work really hard in cybersecurity and I think everybody that's in this industry has a It has a requirement to be passionate about solving the problem of protecting people, but that doesn't have to be the only thing that you have purpose for and as you build your voice use it to help other people in other ways to because we are humans and I think that's what I've become very passionate about and yeah, I was just gonna say I think we're much more open about you can't separate work from Human we are we're people and we bring work to home we home bring home to work our personal selves to work it I've come to just sort of the the wisdom thing for me that I finally dawned on me was don't looking back isn't just a history. It's a preparation for looking forward It prepares you for that next Journey a prayer prayers you for, you know, if after an autography you take that step and take that direction or wherever that evolves to and you know what you're around long enough. You will go through some challenges.

It just happens to everybody whether it's Know addiction it's you know medical. It's Financial whatever it is. That does shape you and I think it shapes you for that next thing and oftentimes it's to help not just yourself but help others.

So I'm excited about you know, you you doing great things with Marty and team and then to see where you go next because that's fabulous that that's all a positive force for you because it's that's a tough challenge through it everybody else. I mean everybody's got their challenges right speak up about don't be shy. I mean, I want you back in 2014.

I talked about a lot of the you know challenges I had with anger and and one of the things that you know, and how how mindfulness and and yoga and you know other techniques I used in order to you know, kind of diffuse literally right? There was a fuse and it was just a matter of you know, how what would boom you know, and and how I use that to really reshape and and reframe a lot of how I thought so as you get older you All going to go through this stuff. And and the more what I found is the more you can share right the more somebody else in benefit and it doesn't have to be a lot of people right?

It's just that one person had a show that kind of saying I saw that talk it really made an impact on me. That's why you do it right that and that's all you need. Right?

Just that one person and that and for me all of The Angst all of the challenge all of the experimentation that I had to you know, but it was more than one person that you know, kind of made positive comments. But all I need was that one person is you know, what you you help me and Jennifer. I know that you know kind of you talking about, you know, kind of your journey and and you know kind of where you got to and what you did moving forward that's gonna help a lot more than one person because it's a problem for for a lot of folks right?

You just you just numb yourself because it hurts right and you gotta be able to face the pain you gotta be able to process it. You gotta be able to work through it and and yet again, I I think for health perspective for mental perspective. You got to be able to do it without you know, kind of totally going up.

So so congratulations again, I think that's really great. I'm just gonna put plug-in we got to take care of each other, too. right, that's part of the community that we formed so long ago that's held so strongly all these years and So and it's being there for each other too because they're a great things to celebrate and there's some challenges that I couldn't have gotten through without help from my best friend and others so we could go on all day, you know, well friends.

Yeah get on the horn. I mean we literally could of course we can't because the production guys get really pissed off when we you know becomes a six hour show they don't like that but you know, I I think we have a lot to look forward to I can't wait to see in person and that's gonna be fantastic and everybody else that's out there again security blogger meet up on Monday. We're doing devops connect which is our deaf secops show and RSA.

So, so please swing by when you see that we're looking forward to to seeing everybody in California in a couple weeks. So with that Mitch, I guess we're gonna send it back to the studio for our next interview. Yeah.

We'll hand it back. Thanks again Jennifer being nice. Thanks so much you guys.