Security in 2023 – Kelly Albrink, Bishop Fox

This is texturing TV. Hey everyone, welcome back to techstruck TV. I am really happy to have well, she's been on Tech strong before but she's the first time I've had a chance to meet her here on Deck strong.

I want to introduce you to Kelly. Albrink. Kelly is with Bishop Fox where she runs the app security.

Programs and Kelly welcome to Tech strong TV. How are you? Happy New Year.

Very good. Thanks for having me Allen. It's a pleasure to have you on so Kelly before we jump in we're gonna talk about several things.

But let's talk a little bit about Kelly give people a chance to kind of understand who you are. Sure. So I head up our application security practice at Bishop Fox and if you don't know Bishop Fox, we are an offensive security consulting firm.

So we do all kinds of pen testing all day. That's our bread and butter. Don't do a whole lot of else just offensive and here at Bishop Fox.

I do our absec practice so that our you know web apps mobile apps. It includes some of our threat modeling and architecture security assessments source code review and Hardware, which is actually where my background is. So doing embedded security and I love anything Wireless or radio related.

That's my jam. I get it. I love it.

So I think it's almost easy to say what abstick isn't in an offensive security. Company rather than what it is. So what would not be under your kind of domain there?

So we have specialized practices for network security as well. Okay, internal external networks as well as loud practice and then we have a really cool special practice for red teaming. So adversarial offensive security operations, very cool.

Anything's goes cutting-edge kind of stuff. Excellent. Love it.

com So we should give a shout out to our good friend Kevin Koch who I know for. more years than he probably wants to admit is now at Bishop Fox as well and You know, we wish him. Well there so Kelly it's a new year and and more than ever, you know, if after 25 years insecurity.

More than ever before I look at this year and say you know what? This really is. The year security is number one security is people are going to really get on their horse and ride here.

We're gonna we're gonna make a difference we're gonna Correct, a lot of past wrongs and and set things straight. It's not gonna be perfect. We're still gonna have breaches.

We're still gonna have bad things happen, but God darn it. This is the year. We get start getting it, right.

Maybe I'm right. Maybe I'm wrong, but I'm interested in your take you have some. Kind of New Year sort of resolutions.

Yeah. I mean, I appreciate your optimism security is hard. No, I'm an active.

I'm a half have a glass half full kind of guy but good. I mean I think Security it's just one of those things where you always have to be learning. So New Year's resolutions are a great way to kind of give yourself a plan give yourself some goals for how you're going to grow this year and make sure that you're still skills.

Don't get stale and kind of fall behind. So yeah, lots of different approaches to resolutions. And I mean, I think we all are trying to do things like be healthier and get outside more but when we're talking about our career and our technical skills our soft skills, there's lots of different resolutions that we can put into practice and I always give people kind of the advice of you know, look at it from where you are in your career.

So somebody who's kind of just trying to break into the industry is gonna have a very different resolution and goal from somebody that's maybe mid-career or later career or trying to get into leadership. There's lots of cool things that you can kind of learn and grow into in 2023. Absolutely.

So let's jump into some specifics if you don't mind. Yeah, I would say for me some of the like hot topics that we see people talk about like Cloud security is huge. If you're not already getting into Cloud security you're kind of behind right?

I think most apps have moved into Cloud environments. So if you're already familiar with the cloud then maybe exposing yourself to a new platform. So if you're really comfy with AWS, maybe it's time to get into Azure or Google Cloud.

If you're feeling good about the platforms themselves, then maybe it's really driving a little bit deeper into specific elements or Technologies. So serverless functions or orchestration and kubernetes, right? I think there's a lot of really cool things that synergize with the skills.

We already have if you're involved in application security. You should already be pretty familiar with Cloud if you're Often iot and embedded security the client tie into Cloud there is amazing. So I always say whatever skills.

You currently have your goal should kind of synergize and build on what you already know. I'm sorry, I'd say my take on that one. It's funny.

We have this predict. virtual event on January 12th coming up and in the digital trans this four track cyber devops digital transformation and Cloud native in the digital transformation track. you know, we talk a lot about cloud and Cloud security and you know, I think we've reached the not that the cloud is totally mature, but there's definitely been a maturation of cloud.

Right where he was you said if you're not already dealing with Cloud security. I got to ask are you in some kind of specialized vertical that is shunned the cloud or something because it's everywhere and and when we look at the big three clap public Cloud providers right AWS Microsoft, Google while they each do certain things specialized there's a tremendous amount of equality if you will between them and It's right. There was a time where you could just say look AWS is the 800 pound.

Gorilla. That's all I care about. That's what I'm gonna be a specialist not I don't know from a cloud security perspective if that's still If you want to limit yourself that way and just say I'm only AWS.

Well, we're seeing organizations using multiple platforms now, right? Nobody's putting all of their eggs in one. Basket smart thing to do.

So really you've got to get cross functional across these different Cloud platforms. I agree and and I'll tell you something this for as much as we talk about cloud and we and when we talk about Cloud we tend to think of the big three public clouds, there's still so much infrastructure and private clouds whether it be on the Oracle or IBM platforms are on private data center private Cloud right in hybrid and all of that. So, I mean there's a lot there's a lot of skills there from a security.

point of view that you you need to you know Master if you're gonna Call yourself a cloud security person Korean. I mean, even if you're working with organizations that are mostly on-prem. Some of those holdouts may be considering moving to the cloud right?

We might have reached critical mass. And so it's time to just be familiar and know what the pros and cons of these different approaches are going to be but cloud is probably something we could have said last year too. Right?

I think that's not that's not new that's not bleeding edge one area in application security that my team and my Consultants are really interested in is blockchain security. So smart contracts security. These are vulnerabilities that have huge multi-million dollar implications.

And so I think that's really exciting and challenging for people. So that's an area. I'm seeing a lot of people want to learn more about in specialize in I don't disagree.

You know. So I gotta tell you I was now I'm not a big crypto person right? I never jumped on that wagon.

I felt in so many ways that that whole crypto thing held back blockchain. from being used To it because there are some real advantages from a security point of view the blockchain bring to us right that if we implemented blockchain on things we'd be better off in certain things but because of the crypto connotation and connection, I think a lot of people really, you know, I'm gonna stay away from that one. Yeah.

Maybe You know, it's a it's interesting because I think a lot of people when they hear blockchain hate immediately think cryptocurrency, but it's really the blockchain technology. That's really interesting. And I think we're just seeing the beginning.

Yeah interesting implementations with smart contracts. So do you think this is a big year for it or it's still two three years out. I mean They're right now, right?

I think we're all. Still reeling from all kinds of crypto scams from nfts and how that has played out. So kind of getting away from that.

like con man kind of association with crypto. I think it's going to be the big challenge for using that technology and making it more widely accepted. Absolutely, I agree.

All right, so blockchain, definitely up there. What else? Huh?

Let's see. Well, I think iot embedded security is huge year over year. We're seeing like just massive growth in that space and so that for me.

Is kind of my expertise in area. So I'm always encouraging people to look more at the the physical security of their devices and I think that ties a lot into what we were talking about with the cloud before but for me, Any kind of Wireless technology is really interesting. We're seeing a ton of devices with NFC technology started to be invented in it.

And that has become hugely more accessible for security researchers with tools like The Flipper zero that came out last year and I don't know if you've seen one of those yet, but it's a very affordable kind of entry-level radio hacking solution that has RFID NFC sub gigahertz infrared. It's a really cool tool that you can use to start to analyze some of the devices in your own home or your office and it allows people to really learn about security that you know, maybe it's not directly connected to the internet. Maybe it's something you need to be in close physical proximity to and that hasn't been a part of many people's threat models before so it's kind of adding a new element to your security posture when you start thinking about well, what can my neighbors see about my home and my devices over the radio?

Yeah, I it's scary, right? Because I being a security person right? I regularly look like what Wi-Fi networks why that says IDs are coming bleeding into my house, right?

And Even just in my you know, my neighborhood which is really I live. You know, it's not that big in neighborhood and it's crazy what you see and you know and people I mean naming conventions that is so Like when you're looking for trouble, you know and you know that most of them have ridiculous passwords as well, but it is true. I I'll tell you.

You know, whether it's it's the I'll give you a great for instance. I set up a new turntable this weekend. Oh.

Because I'm back into vinyl. So I bought a you know, it's a regular turntable that connects RCA plugs in and out, but it also broadcast Bluetooth. Yeah, and all of a sudden my TV starts picking it up.

Oh wow, and it says do you want this device? And I I didn't know I just did you want this device to connect and in real life? It was from the turntable.

I said, yeah, let's see what it is. and all of a sudden my turntable starts playing through the through the TV and I'm thinking of myself if anyone's walking around the Hat my house and they've got some sort of Bluetooth receiver. All they had it because it was just it was wide open.

It was just waiting for someone to hit. Yes. It didn't ask me on the turntable.

It just by default. Was broadcasting. Yeah anytime you replace something in your home.

There's a new tech that's putting it so you know why you dreamers? Yeah. No all of it.

That's what I'm saying and and they didn't make it easy because I was like, I don't want to use Bluetooth on my turntable right now. I just wanted to stop broadcasting. I don't want strangers being able to and they didn't make it easy to shut that off.

Like I kept holding the bud and thinking that would turn it off. It wasn't there was another setting So again, that is something for people to look at. Yeah, I mean the best resolutions are ones that are important to you.

Right? So I have a very young daughter. We have all kinds of new tech and tools that we use to help raise her and a lot of it has security implications.

So, you know, that's something that's really important to me and has been kind of an exciting area of research but you know, it's gonna be different for every person. So when you're thinking about resolutions tailoring it to things that are important to you I think are going to be a key to being successful. Let me bring up another area and get your thoughts on it.

Sure. AIML I knew you were gonna have that we could play like buzzword Bingo. Yeah.

I think it was just buzzwords. I I got to tell you though, and maybe it's because I'm in the media World here and we're hearing so much. About this AI writing articles writing code, you know, all my security friends have been buzzing about it.

It's got it it's gonna it's going to have an effect. There's this. Yeah, I mean chat GPT is something we've been playing with a lot at work, you know saying write me a nuclei template to find this particular vulnerability and we found stop putting any of us out of a job yet.

Right? Let's not get any any sky falling. Yeah.

That's you know, that's That's the flip side of this. That's what we always hear when these new tech. That's it.

All of you are going to be out of work all the security people done all the testing people no more testing in devops, right? That never happens, but nevertheless it's going to have an effect. Absolutely, and I think for people in Tech and security, it's you know, it's a great.

Like launching off point if you need a project where you're just in the brainstorming phase like put something into an AI see what it comes up with and it's probably not going to be super accurate. It's like pulling the wisdom of the masses, right? It's not always gonna give you the right answer but it might get you pointed in the right direction or give you some new ideas of a totally different direction to take so worth keeping an eye on but for me early days still in kind of the AI and security integration.

I agree. All right. What else do you have on your list?

Oh. I know I think for me personally and where I'm at in my career, you know, I'm I'm in a leadership position. I'm not as Hands-On keyboard anymore.

So I try to keep a resolution. That's Gonna Keep Me Technical and excited about kind of thing hands on keyboard keeping my technical skills sharp, but I also want to have A different resolution that's going to kind of push me ahead on the leadership side of my career. So for me that is gonna be you know, getting more involved with other business units.

So I find really used to being you know, super technical sitting on the Consulting side of the house. Maybe it's time to get a little bit more familiar with our sales organization or project management and just kind of building some more of those Human Relationships that need to get lost a little bit during covid. Absolutely.

Let me add to that. If you don't mind Kelly, you know for a lot of our listeners Watchers. audience out here They haven't been.

In a down cycle of the economy, right? We Tech was relatively. Left out of the terrible recession of oh 809.

com bust was the last time we really started and I look I permanently pray and hope that this is not a bad year for our economy. But for those of us for those of you who have not been through it down cycle, you can't count on the Head Hunter or the executive Search person getting you your next job. You can't count.

You you need to make human relationships with your peers and your community. There was a time where people would go to conferences like an RSA or a black hat or what? Have you not just for the learning.

But for the networking for the chance to build your network just to understand what your peers are doing. Who your people are what you know, how do you fit in here? How do you build your career?

from your network, and I'm not talking about your You know your network security network. I mean you're human Network and whether it was local meetup groups or Issa meetings or infra God or you know, whatever it was. It was how you met your community and how you interacted and believe it or not.

That's how people used to get jobs. Absolutely and I think a lot of those communities are coming back right? I hope seeing, you know, Defcon groups start research starting after being gone for a very long time.

We're seeing 20. Yes 100 groups. We're seeing completely new groups.

I think there will be new ones and people should embrace it. Yeah, embrace it. I definitely think especially for a lot of us who Moved during covid, right?

We had the Great Tech diaspora of people with remote work. A lot of us are in new physical locations and maybe haven't had chance to kind of get connected with the community. So I think that's a great thing to focus on for this.

Absolutely. Yeah. I was I was in Sanford and I mentioned to before we started recording I was in San Francisco last week and it was amazing.

Amazing to me how empty the streets were. Yeah. Those people are still working somewhere.

I don't care whether you want Tanner. I I used to are you princess go and I I move back East during coconut. So it's very different when I go back.

It is San Francisco's a different town. I I you know, I think it's gonna be a problem for many cities as we Face who wants to live in the urban centers, but that's a whole another interview we can do Kelly but the bottom line is those that no matter where you moved. seek out your peers locally and and because this strength in numbers and that's how you you know, you really grow and you'd be surprised to you find there.

Right. You never know who you're gonna run into and and when I say that I don't mean just your cybersecurity folks. Find out what tech folk or in in your community, right?

It may be the sales guy for a cyber vendor, but he's a sales guy and normally it's I don't talk by the sales guy, but you know what, you're in new surroundings count your friends build your network. Yeah, that's right. Yeah, you know, I can't tell you how many times I have someone kind of come out of the woodworking but we met two or three years ago at an event and you get my age.

years ago Okay, everyone had for breakfast yesterday. But anyway, yeah, I hear you. I mean that is look so to me building your network.

You're human network is is it's got to be a big big part of your your function and it's hard to Kelly because look you have you in your case. You have a young family. You're full-time.

Mom full-time work or full-time. How many full-time full-time can you be right? Absolutely.

Yeah, but you need to make time. To to build that Network. It's important.

Anyway, hey, we're about out of time speaking at time. I want to thank you for coming on. You know what let's make a resolution 2023 we get Bishop Fox on here more regularly.

Keep us posted about what's happening. Alrighty, awesome. Thank you so much Alan.

Alright Bishop Fox Kelly Albrecht here on textrung TV. We're gonna take a break and we'll be right back.