AI Policy, Sports Tech & Ransomware: Is Progress Real or Just Optics? | TSG Ep. 888

Hey everyone. The White House wants us to enter a golden age of ai. I feel like we're, it's dying before it's born.

You're watching Text on Gang. Hello everyone. Welcome.

Happy Friday, Friday. I, I feel like I was just on here saying Monday. Welcome back from the weekend.

But we're here on Friday. We've got a, a Great Friday gang line up with some interesting topics to discuss. Let me introduce you to these interesting people.

Uh, we've got, if you've watched the gang, they're regulars here. We've got the one and only Ira Winkler. We've got Fred Wilmont, Mr.

Cecil, well actually he's multi seat time cso, but now founder of his own company, Fred. Well, we'll come back to you. We'll give you a chance to plug that.

And our marketing person extraordinarily Lisa Martin, as well as the dean, still licking his wounds over another Yankee, yet another Yankee loss. Mike Ard gang. Welcome.

Um, so Fred, before we go further, you know, we got Black hat coming up, IRA, I, I, I thought you said you may not be making it to Black hat this year, right? Or airplanes changed? Um, not, not sure.

It's like 50 50 I think at the moment. All right, we're gonna, we're gonna wait. We'll give you more time.

But Fred, you are going to be there and your company is The tech team. Yeah. So what basically we, uh, what we're gonna be doing there is really focused hard on some of the things we're gonna talk about a little bit today.

What we do is we take and transform the static sort of expert driven behaviors of trying to write detections over a long period of time at large companies and, uh, and small companies, and democratize that and automate that and, and bring some of the continuous, uh, automation behind a development lifecycle to detection engineering. So, what used to take, you know, three or four weeks to figure out how to write stuff for this brand new ransomware kind of example, we can generate data that tests whether or not your infrastructure's prepared for that today, and then generate detections and push 'em for you, you know, in 20 minutes. So the intent there is really buying down the risk.

Cool. Hey, I, I like to let people know, you know, I mean, they could go look you up online, but what the heck? Anyway, thank you for that, Mike.

Another announcement from the Talking Heads at 1600 Pennsylvania Avenue. Wow. They wanna usher in a golden age.

On, On the face of it, you might find that there's a lot to like here. On one hand, they are saying that they're gonna get rid of some of the, uh, regulatory hurdles that prevent us from building the data centers that we need for ai. They are talking about making, uh, investments with strategic AI partners.

So, you know, we're all gonna kinda benefit from that. Maybe there'll be more choices for GPUs and AI accelerators on the face of it, at least. There's a lot of things in here that sound like things that the IT community wants.

I mean, you know, you get this whole, as you read it, you get this whole, you know, U-S-A-U-S-A chan going with it, you know, I got my little flag here, the whole nine yards. Nice. But, but, um, they, They pulled out a prop in the business.

But go ahead. But there are thing, uh, concerning things in here. It does seem to be very much, uh, America first and a little light on security and almost no concern for environmental impact.

But Alan, what's your take on what's going on here and maybe what is the role of the government in all this AI stuff? I could sum it up. What, what is it, what's the song about fools Russian, where Wise Men tread fair to tread?

It's not a song, but it's a saying. Wise men fear to tread Where fools rush in. Who's the Fools?

And I Think that that might be an old Ben Franklin thing, I think. Okay, we'll go with Ben Franklin. He was a wise man, but clearly, look, there's a lot to like, as a lot not to, like, are we gonna build AI data centers at the expense of our, of clean water, clean air, faulty, you know, are we going back to love Canal?

Damn, the torpedoes. Full speed ahead. We, we've gotta leave our children a world, I hope, number one.

Number two, you know what, frankly, I'm so Jaded and, and callous to, to these announcements where everyone's coming up and, and bending me and, and opening a, supposedly opening a checkbook and telling us about how much they're gonna spend on these AI factories. And then the third thing is, you know, the more, the more we play with ai, the more we hear and see things going on, the more convinced I of, uh, than ever I am, and I agree with Ira on this, we gotta build security in here, man. We, we can't afford to do the usual.

We'll worry about security later. 'cause this is going to it, it's gonna wind up not good. And then the other thing is, you can't make wine before it's time.

I, I think the promise of AI is phenomenal, phenomenal. But it, it's going to take time to develop, to evolve, to be used to, to be refined and get to where we want it to be. Rushing headlong in here, like bulls in a China shop.

I, I just don't think I, I'm not sure it's the right thing. I don't think you could have a golden age till it has an each. Well, Al could I, oh, sorry.

Go ahead. I, so here's the problem. So there were a few things I saw in the bill, like, oh, we're gonna rush out data centers in the first place.

There's just so many places you can put data centers. And then you have the not in my Backyard thing where everybody says we don't want regulation. And okay, so we're gonna take away some of the regulation to put it.

'cause really what these are, are football, you know, it's like the old days of the NSA has football fields worth of supercomputers or something in the, they're Not football fields. They wanna build them the size of Manhattan. Oh no, I, I understand.

But then you have to figure out where can they actually put them. And when you figure where they can put them, you know, frankly, you're talking about places like the middle of nowhere, like in Yeah, fly over stand, fly over stand. And that comes up to issue number one.

Then the people are gonna be like, okay, not in my backyard. 'cause you know, in some places, I'm not gonna argue whether windmills are good or bad, but some people don't want windmills. Some people love them 'cause it makes great use of their, increases their property values in flyover stand.

But then the next thing that's kind of concerning is this rhetoric of, oh, we're not gonna have woke. Ai, you know, I mean, that's AI again, is mathematics and people lose track of that. And how the AI handles facts.

Sometimes people don't like the facts like, rock was too woke. So they make rock a Nazi. And you know, you have to start to look at, okay, I think that's a lot of rhetoric where people are just gonna develop the math that they do.

And then at the same time, the one thing that keeps coming back to me is we're building these data centers and we we're missing a buzzword. I hate buzzwords, but we have AI as a buzzword. The one buzzword that we're failing to look at is quantum computing.

And the reason I say this is gonna be an issue is, yes, you need lots of computing power to process all the data going into AI algorithms, but once we get quantum computing, which give or take is five, six years away, we're not going to need central parks worth of computing power. We're gonna have much more computing power and a little bit of things. So we're gonna start to develop these data centers that are gonna be obsolete in a few years, should quantum computing hit its prime.

And so I'll, I don't Disagree. Put that. So, IRA, let me just paraphrase one of the points you made, which is, and it goes to Mike's America first thing in one hand, they're saying you could have all these things, but with it comes handcuffs, with it comes conditions that it's gotta be America first, that it's gotta be us.

That it's gotta be under the subject. You're gonna be subject to whether someone wakes up with a feather up their butt and decides you're not allowed to do business with someone because they're prosecuting a former dictator or something. That's not, we, we don't need those kinds of strings.

We don't need, this is America, right? We need a, a private public partnership, but we don't need government controlled ai. I'm, I'm not really sure about the quantum argument because we are building a massive data center in Poughkeepsie with IBM for quantum computing.

It'll take a few years to build, but it's, it's big. It's not just a smaller thing. Maybe it's smaller than, you know, the size of Manhattan, but still gonna need a lot of data centers for both.

Lisa, though, I wanted to get your opinion here because a lot of this is Alan pointed out traces back to this valley vibe, which says, go fast and break things. And in the case of ai, it seems like the risk of breaking things is really high. And you know, it's not about the fact that I just broke an application and it was unavailable for an hour.

So I look at this from a marketing message perspective, and I tried to look at it neutrally without some of the obvious concerns. I was just watching the news a half an hour ago about all the, all the woke ai and doesn't like the term artificial. And I just thought, that's just nonsense.

But if I look at it from a marketing message perspective, what what I heard was, okay, there's an action plan in an effort. Because what the White House wants is the US to, to remain a leader in the AI industry, this golden age. And I heard investing in AI r and d building an AI talent pipeline.

We, we've been talking for weeks about the AI talent wars promoting AI adoption across industries. And I thought, what I didn't hear was collaboration. Um, I didn't hear security ire.

You bring up a great point. I didn't hear Quantum, I wasn't listening for it, but you bring up a great point that we didn't hear about that. But I just think, what's the alternative?

But the message is, okay, the future of AI is now you gotta join the golden age of innovation and growth, and we've gotta invest in r and d. We've gotta develop talent and adopt technologies to stay ahead of the curve. What's the alternative?

I didn't hear that, but I also didn't hear collaboration. And that's gonna be absolutely critical, um, for us to be successful in a safe and secure way. I I, I, I agree with you.

I mean, look, I, I, you know, I'm hearing friends leaving CISO who, who, you know, the security aspect of this is, is just getting scarier. Uh, I'm not saying we're gonna have Skynet that decides to destroy all carbon based life forms, right? Outta Star Trek or something.

Ger. But, um, I mean, the damage it can do, I, I, So to to your point though, I mean, I guess this was positioned as, you know, the US has an industrial policy as it applies to ai, but I don't feel like this is a, a, a policy as much as it is just kind of a, an invitation to not have a policy maybe. Yeah.

It, it's like everything else that this administration does, it's a PR kind of front. And when you go, you know, when you go past that first inch, it's kind all murky, TBDs. That's it.

Not a lot of depth. Yeah. No.

Well, they don't call 'em shallow Hal taco for nothing. All right. Um, I, I have anything else to, I was, I was just wondering if maybe they used AI to write the 90 point plan.

What do you think They do? They give you that? Yeah, it'll be like, I'm sure there are a few hallucinations in there, but I mean, I understand all the concern, but I mean, there's just so much rhetoric.

It's just gonna go on for so long to build these data centers anyway, that, you know, I, it's like, you know, the goals in there that sound authoritative or sorry, authoritarian is the word, right? Um, I just don't, I mean, maybe I'm too naive on this, but it's just, I don't expect much ability for them to follow up on some of those other lofty goals. I mean, it sounds good.

They're gonna build lots of data, you know, maybe they'll build the data centers. You still need to come up with billions of dollars for it. The government's not doing it, so private industry's gonna do it.

And, you know, frankly, It sounds like Mexico's building the wall and they didn't Well, Mexico's The wall. That's the point. I still expect Saudi Arabia to put the data centers in their desert, not our desert.

Yeah. And that's what I, and that's what I think would more likely happen when data centers. 'cause the good or bad about AI data centers is you want the results.

You don't care where the results in. Well, theoretically you should care who's making the results. But if the results are coming from Saudi Arabia takes an extra quarter of a second to get here.

Yeah. And so if they're gonna build these large data centers somewhere else, because you can say what you want, but it's expensive to put, you know, building. I know We, we live in, we live in an age of it, sovereignty.

They, they want everything here and every, and as a result of that, other people are saying if that's where it's gonna be, I want my stuff in my place too. I mean, globalism, as we knew it is, is dying. Well, there's globalism, but there's business.

And the one thing frankly is you could say what you want, but these people are gonna like go for like, you know, I mean, how many hundreds of billions of dollars were supposed to flow into the US that were big campaign statements and ended and I'll leave it and never happened. And Agreed. It's, it's the usual BS that comes outta there.

We got, we're over time on this though guys. Let's, let's, let's pull Last thing on this one thing is be wary of real estate scams, right? 'cause a lot of this is gonna wind up being a real estate scam.

Yeah. Wouldn't be the first time. Alright, let's take a break here on the gang.

We're going to come back and talk about fan experience. We imagined that sounds uplifting. You're watching Textron Gang Discover Textron Group, the epicenter of tech innovation.

We are your go-to for reaching IT leaders and practitioners worldwide. Our secret impactful content that sparks awareness, engagement, and top quality leads with us. You'll access editorial websites, streaming videos, virtual events, custom content analyst research, and more.

Join our satisfied clients. Let's revolutionize your tech journey. Contact us today and tell your story to the world in the most powerful way with Textron Group.

All right, to Alan's point, we are going to shift gears to something that's hopefully more uplifting, but I'm not entirely sure we're seeing the fan experiences changing rapidly because of advances in sports tech, everything from analytics to even ai. And, um, it's an interesting time because we're heading into the back half of the baseball season, uh, preseason of football start up next month. And before, you know, we'll be playing hockey and basketball again.

And every time I turn around, Lisa, somebody is throwing a stat at me. And, but I'm not clear that this is for better because most of what I get presented with is really arcane, borderline innate. And that it's like on Tuesdays for the last 10 years after three o'clock, but before five o'clock, the shortstop has gotten ahead for this team.

Who cares? And so I think we're kind of getting a little too data happy in sports tech, but I'm not sure what's your take from the marketer? What do you see here?

You know, from a marketing perspective, I had mixed feelings on this. And then I kind of looked at it from, well, there are six generations alive today, probably attending games. So what these networks are doing is they're trying to go where the fans are.

Certain generations will love this, certain won't, like, you watch a broadcast and then you get hit with a QR code, whether you're watching the pre-game or in-game, and it takes you to a different experience. I think what they're doing is modern marketing. They're trying to meet fans where they are using technologies.

Um, fan engagement helps, uh, teams and sponsors, um, build deeper engagement, deeper connections with fans, with brand partners. I think it's smart modern marketing. Not everyone is gonna want this.

Uh, I know that some networks have been doing this. My San Francisco Giants do it frequently where, where they will take games off of the local networks and put 'em on Roku or streaming services. And my mom hates that because she's silent generation and doesn't necessarily understand technology and just wants to find the game.

But I think what they're trying to do is they're not really re alone in redefining fan experience, but the client trying to go where the fans are. I see beneficiaries, fans, broadcasters, sponsors creating this second screen experience that I think you can either lean into or you can ignore. I like some of this stuffs.

I think it's cool that it kind of brings in technology to the everyday fan consumer kind of thing. So I'm excited to see where this goes. Um, we've also seen this in Formula One.

I'm a big Formula One fan. Really, really data heavy sport when I think it makes even more sense there. Uh, we're seeing the rise of smart stadiums where it's really redefining this entire experience, as Alan said.

And I think it's, I think it's a positive. And like I said, I think you can lean into it or you can ignore it. I had a few thoughts on this one if I could.

So Lisa, I I agree with a lot of what you said. I, I, I put them into different buckets. So there's the second, second screen alternate experience, which to me, the best example is watching the Manning brothers do Monday night football.

It, it's a lot more interesting and funny than the, than the, the usual ESPN commentators who are no dandy Don Frank Gifford and Howard Cosell. But Really, I think when we talk about the fan experience and the real time stats, like Mike, you know, it started with the AWS third and sixth. There's a 68% chance he's gonna throw long on the left side, you know, but now it's gotten, you know, now Google Cloud is in there too.

Yes. If the golfer bangs his putter two times on the ground before he hits the putt, the there's a 60% chance he's gonna miss the putt. And if he only bangs it once, there's a 58%.

If he doesn't bang it at all, who gives a flying cot? Well, I threw some of it. No, but hold, hold on.

I, I, I just want, but you know, what this is really about is about gambling. It's about gambling. Because they're going to get to the point where you watch this on your screen, and when that quarterback walks up under the center, you could say, he's throwing left, he's throwing right.

What the odds are, right? 'cause we're gonna need to know what those stats are to make odds. And, and you got people who will bet on cockroaches climbing up a wall and they're gonna wanna bet on, did he throw 15 yards to the left or 30 yards to the right or over the middle for two and bang my my and at, at that action, that adrenaline junkie rush, because there are degenerate gamblers out there who love, who love that stuff.

And I think that's who this stuff is aimed at. That's a great point. Yeah, that's a great point.

I, I mean, I tend to think that this has always been a niche. Most people just want to go to a game and enjoy the game, get excited about and things like that. They're talking.

They're talking. Yeah. And most, but then there's talking about feeding the data to you in real time and everything like that of what the stats are.

And we've had that as you're saying, like, when you watch this, there's like a 58% blah, blah, blah and all that sort of stuff. And it started to seep in. The thing is, like you're saying, some people are going to like it, some people are gonna be indifferent and some people are gonna love it and figure out how to monetize it.

Yeah. And it's like everything else because, you know, we're getting data into just about everything. And when people are there, you know, you're talking about a, what is it?

They've, the fantasy football leagues and stuff like that. These people are gonna love that. You know, we're talking Moneyball, like, you know, that movie.

Yep. And, and some pe you know, I think this is just gonna be a business aspect of where sports are going because there's a, just a, you, when you hit a wall to what else you can do, you know, it behooves these leagues to start figuring out how can I go through the wall and do something different and make it more exciting? Now, how many people are gonna make use of it?

That's up to them. But I don't know, I just think the people who want it, everybody else is gonna get sick of it if it gets too intrusive. Right?

That's a great point. Alright, I to balance, I just wanna dial a dial that says I can turn this up or down. I don't want to have to go, well, You know, the, the BA has something like that.

The NBA on ES, ESP N has like, not on the main ESPN, but if you go to like e espn two or ESPN three, I figure out which one it is. You could just watch the game. There's no, there's no commentators, there's no nothing.

It's, it's a little quiet. All you hear is the crowd. But you could just watch the game.

And, you know, during the Knicks playoff run last year, I, I actually started watching that. It was easy, right? I just, you could watch the game.

I know enough about basketball if it goes in the basket, you know, I know it scores points, what do I need? All the other nonsense. But anyway, hey, it's gonna be interesting.

And as I said, for those gamblers out there, this is all about you. You're watching Text on Gang. Let's come back.

We, I want you to save a little time for this next one talking about ransomware. Is it dying? Is it morphing?

You know, malware never goes away. com is the leading resource for news analysis and education on challenges facing the cybersecurity industry. com covers all aspects of cybersecurity, including data security, DevSecOps, cloud security, application security, network security, security threats, and more.

com has the largest selection of security content featuring breaking news, blog posts, podcasts, and more. com to learn more. com.

Home of Security Bloggers Network. Hey folks, we're, and yes, we're talking about ransomware and there's multiple reports, one in which Alan covered on Security Boulevard talking about, well, ransomware may be dying. There's fewer instances of it, and yet there's also all Insecurity Boulevard, at least two articles identifying new flavors of ransomware that have emerged.

And so it seems like the bad guys keep building this stuff, but maybe they're being less effective with it. Who knows? But Alan, you've been looking at this space for a long time.

What's your take here? So I, you know, we used to, when we said ransomware, we used to sit, think about somehow using phishing or whatever, they would get access to your system. They'd encrypt your system and hold your data hostage unless you paid, and then they unencrypted it.

I think that, let's call that pure old ransomware or ransomware, I think that pure old ransomware as the stats in the article I cited, that is down. And it's down because people are wiser to it. They have off-prem copies, they, you know, the insurance, the cyber insurance companies got involved.

I think we do a little better with it, but ransomware itself is morphed. There's DDoS ransomware. It's like, it's basically, look, I'm gonna do any of these laundry list of bad things that are gonna prevent you from doing business unless you pay me.

And so there are new variants, new attack vectors, new, you know, it's the story of security. The cat and mouse came, they're always coming up. Fred Ira, you, you've seen this a lot of times.

Well, I wanted to bring Fred in here for a minute Hold. Yeah, sure. I mean, I, I think maybe on the, uh, the net the overall sort of attack surface of what people are, are, are referring to as ransomware the last four months maybe down, uh, I don't see that at all, actually.

Uh, and, and some of these currents that have been around for a while, like Alan said, I mean, there are just different permutations of things happening here with specific ransomware groups. And one of the things that's intriguing about it is we don't really see a lot of different vectors, right? There are some pretty common things.

And you know, to Shimmy's point earlier, I think is some of these vectors are so common, right? The mutation of the way that ransomware manifests, um, is changing. You're finding groups taking different types of approaches to, you know, stay current.

There's been some crackdown on ransomware, but ultimately you've got, you know, groups that are now providing legal advice to other groups in order to make sure that, you know, they can, you know, subvert DOJ and this location or that. But by and large, you're seeing optimization of things that already exist. So when we talk about whether or not ransomware is dead, absolutely not.

Um, and whether or not the ransomware groups that are prolific today, uh, you, we will talk about, you know, crux and Burt, but, you know, scattered Spider has had a resurgence, like a massive resurgence over the last month, just this last weekend. We also saw a couple of drops of O days for Microsoft remote, you know, code execution of vulnerabilities that have been widely exploited over a very short period of time. And so, you know, the differences is how fast and how, uh, short a period of time can an organization that produces ransomware as a service get their hooks into something and then, you know, they're there.

They may come back later and say, Hey, look, we'll wait until this particular political circumstance goes away or what have you. And so we're also starting to see something, we found this, uh, this nuanced, uh, behavior, this, uh, last week is, uh, you know, models that are capable of performing ransomware and mutating techniques in the middle of it. So Quin three is a model, is doing this, you know, today.

So what what I think we're seeing is instead of a, my, uh, my, my baseball coach in high school would always say, we're not, uh, rebuilding, we're reloading, right? In the sense this is the same philosophy as playing out here, whether it's, you know, it's the QN, you know, or it's the crux skies, the, uh, you know, the black bite guys, all of which have mutations of what they do into new sets of offerings for others to take advantage of. Yeah.

Alan, let me give some historical context. Back in 1996, almost 30 years ago, I was the director of technology for the National Computer Security Association. We had that little logo, NCSA approved that went on all anti, uh, malware.

It was antivirus at the time. That has evolved to the ICSA, which evolved and was acquired ICSA labs, which is now part of Verizon. That little logo is still there 30 years later.

I think the point of the matter is, is that all this malware has been here for 30 years and has found a way to evolve and has found a way to get worse and also is gonna be prolific. I mean, there's a couple of technologies I see, like armed cyber has like little, you know, kind of like embedding in the kernel type of thing. But until we actually find a way to stop it, and then we need to get it across all computers, because yes, some companies might find a way to be better and be more resilient against it.

But you know, these criminals are like Frank, you know, I was a CSO for like a SaaS provider that focused on the, um, sled markets, state local education. These like school districts. Municipalities are prolific at being hit by these ransomware purveyors because they don't have the budgets to do things properly.

And these people are gonna be hit again and again and again. And even though you might see large companies be less hit by it, there's gonna be more than enough people who are gonna be hit by ransomware, which is a generation or two old, because these computers are still out there. So for somebody to say ransomware is gonna go away, that the criminals have too much money involved in this, and there's just so much cyber poverty out there, it's not going anywhere anytime soon.

Yep. I haven't heard cyber poverty that Wendy Nather. Yeah, neither Wendy.

No, no, I I've heard the term, I haven't heard it in a while. Wendy Nather used to talk about it a lot. My friend Wendy.

I'm sure you guys know Wendy. That's Right. That's right.

The, uh, lower, lower the poverty line, right? Yep. Yeah.

So Mike, am I reading this correctly though? Essentially this stuff comes in waves and every time there's a a downturn, we think that we're doing something magical and the next thing we turn around and we're getting clobbered again, is that how this continues to go? Well, what happens is, when you look at the delivery mechanisms, like, so a lot, the good part is a lot of more companies are using, I'm not endorsing these, but they're using Gmail.

They're using like, you know, Microsoft 365 and things which are getting better at filtering out attacks. However, as these services get, filter out the attacks, the criminal, it's, it's a, you know, it's an arms race. When can they start getting things through?

Then they can start doing other things to proactively act directly into targets as opposed to just using phishing to get in and so on. So, um, you know, again, mostly it's an arms race, assuming you're not dealing with just a straight out attack against an organization to get a foothold in it. Yeah, there's, there's a couple of pervasive behaviors that, that we see, right?

And you know, phishing obviously is in the top of that right? Now you've got some pretty advanced types of phishing. Phishing, you've got deep fakes, all of those types of things.

But in addition to that, you've also got some of the standards, uh, old and, and tried and true, right? VPN accounts and RDP accounts that aren't properly secured. And these types of things are, you know, the binaries that exist successfully on every system we call law bins, right?

They're, these are living off of land binaries that exist in the windows boxes that are potentially exploitable and adversaries are using the tools that, that they have, right? So some of the challenges are when we look at whether or not somebody is hitting, uh, BC edit xe, right? That's a known thing to back up environments.

And so how do we get there? Well, maybe we, uh, drop the no day on, you know, for to Fortinet, right? Uh, gotta love those guys.

They have the most software vulnerabilities of any software vendor, but they take advantage of those opportunities and then, you know, they get legitimate credentials and they run around and they'll do it over whatever period of time. But the thing that's interesting to me about this is the timeline for how fast it happens now. And you know, there used to be a window of time where that could be three days, you know, to breakout, right?

CrowdStrike put out a report about this, where the breakout window used to be three days, you know, five years ago. Now it's 49 minutes. So in breakout time is defined as the moment you pivot off of a particular exploited box into other places, AKA lateral movement.

And so when we look at that, if 49 minutes is the average behavioral time for that type of, of, of movement within a, an attack, then we know that, you know, the speed of these things has changed dramatically. So the arms race, right? Just like us to get to the moon, just like us, to build our AI infrastructure is this arms race to be able to defend ourselves before known tools that we've used every day, continue to, you know, become a mature development lifecycle for adversaries.

Agreed. I mean, and you know, and, and don't think AI doesn't play a role in there though too, Fred, right? Helping these guys get better.

A hundred percent. Hopefully it will help the defenders get better too. But um, to Fred's point, ira, are we mentally prepared for that level of stress?

Because this game is moving into real time and you know, it seems like we were already freaking out as it was. So now if everything's happening, sounds like it'll only be a matter of time before we're measuring this in seconds. Well, I'm kind of stoic about this.

You shouldn't be in this industry if you are not capable of handling the stress of attacks becoming more prolific and getting quicker. You know, because it's like one of those things, you can't be a police officer and expect everybody to just say hi as you're walking around your beat. You know, you don't know what you're gonna be hit with at any point in time.

Good programs will have automation, unfortunately, programs that are, I'll keep using the word cyber poverty, they're gonna get more difficult. But I ideally, you know, people are gonna get used to this. There's gonna be better tools in use that hopefully help these people out a little bit more.

Um, but yeah, I mean, it's just a fact of life. And if you can't go ahead and deal with like attacks are getting quicker and better, then frankly this isn't the industry for you. I mean, you know, the industry for you involves your technology, your interest, but also the level of mental stress you can put up with.

And maybe a GRC job would be better than a hands-on operator job, as an example. So, 'cause there's a lot of jobs in cybersecurity and you know, it's just a fact of life. I remember when, again, maybe I am dating myself, but in the 1990s, admins were out there with like zero protections that they had and they were getting hit by people just randomly scanning, doing ping scans and everything else, finding vulnerabilities.

And that was what they did. They kept repelling, trying to patch close people out. 30 seconds later, the person was back in and they were back to protecting.

I hate to say it's just the nature of the job, but that's what we need to accept It is it, it is. And you know what, things have gotten a lot more complex. 'cause back then you had the moat in the castle, right?

You just had to worry about the castle door for them to come in. You know, the, the term a backdoor kind of, uh, attack really meant something. Today you're, your attack surface is all over the place.

You, you know, you, you don't even know you're full attack surface most people. So it, it is, it's a cat and mouse game. You are the cat.

The mask is always a little bit ahead. They're well financed, they're well funded and they make a lot of money. And, and, and Ira, you're right.

If you don't have the thick enough skin for that particular role, you shouldn't do it. 'cause you're only gonna get burnt out and depressed. So, so CISOs should put pictures of Harry Truman up in their office saying, you know, if you can't stand the heat, get out of the kitchen.

Is that where We're going? That, but that's always been, but that's been it in security. If you can't, you'd get out.

That's the nature of it. When nothing happens, it's a good day. Yeah.

I mean it's like, I, I gotta admit I'm a little less so I look at stress levels of CISOs, which is serious and yeah, CISOs are under a lot of stress, but I look at the people who work for them. These people are actually doing day-to-day stressful things, but they don't have the money a lot of CISOs have. And to me, somebody worried about making their rent payment and dealing with, you know, can't deal with childcare and something like that while working a job.

24, you know, a 24 hour shift work is a little bit more stressful than the person at the top. And so I appreciate what No, the front lines of security, yeah, We have to appreciate everybody is in there for sh is gonna experience stress and you know, sometimes not all jobs are right for everybody. If you want to be a librarian, go be a librarian if that's what your mentality is meant for.

But if you're in cybersecurity, I hate to say it, depending on the role, your job is essentially being a firefighter where you are going in, you know, and that's all there is to it. I think you're right. My last, my last thing on this is that, uh, a lot of people get deputized in an incident and they're not cybersecurity professionals, right?

Well, It used to be that's how people became security people, right? They were network people or whatever, help desk people. And, and when stuff hit the fan, I go look at the logs.

What are you seeing Fred? Right? Exactly.

That's how it was. So, so the best cybersecurity people are adrenaline junkies, right? They're in it for the fight and they enjoy that.

But the truth of the matter is you can only keep that up for so long and they're gonna burn out. Well, It depends on the processes they put in place, because this is the Ira Winkler philosophy of organization of cybersecurity programs. It's like a ship at sea where it's off course 90% of the time.

You put a process in place that keeps it kind of knowing that there's little things here and there that are gonna push it off and you keep it running. That's what makes good cybersecurity programs, good cybersecurity programs every so often there's a bigger wave, but they know how to deal with it. And if you can't, another thing we haven't spoken about, I mentioned it a little bit, is outsourcing most of your infrastructure.

'cause cloud computing does allow for offloading a significant amount of your work. Like if you can't maintain an internal infrastructure well and secure, you can outsource it to Office 365 or whatever. You can outsource everything, but you can outsource most of the internal SaaS function or use SaaS, secu SaaS applications to deal with a lot.

And those providers are there and do serve a good purpose in offloading a lot of your security, assuming these are good providers. I'll leave it at that. And we're gonna leave it at that right here too, because that about wraps up our show today on the gang.

I hope you've enjoyed it. As usual, we have tech drunk TV following the gang today. A couple hours worth of more programming.

But until Monday, have a great weekend everyone. Ira, Fred, Lisa, and Mike. Thanks for helping me out and joining us here on the gang.

Uh, thank you for watching. We'll see you Monday. Try to stay, stay, try to stay safe and think maybe a cybersecurity career is for you.

We haven't scared you off yet. Until next time, I'm Alan Shimmel. Thanks for joining us.

We're out.