[00:00.000 --> 00:00.640]  I'm amazed.
[00:00.780 --> 00:05.660]  There's people in the front row that I promised I wouldn't joke about, but there's actually people in the front row, so this might work out.
[00:06.040 --> 00:07.140]  My name is Mercurial.
[00:07.340 --> 00:11.020]  I obviously have other names that I may or may not work under.
[00:11.780 --> 00:12.700]  Business credentials.
[00:13.080 --> 00:18.920]  I am the Chief Information Security Officer for a mid-market, publicly traded financial company that shall remain nameless.
[00:19.440 --> 00:20.600]  My nerd credentials.
[00:20.940 --> 00:23.500]  I started hacking on CPM in 1981.
[00:23.920 --> 00:25.940]  I had a Volksmodem 300.
[00:26.660 --> 00:28.420]  Things got weird from there.
[00:29.100 --> 00:31.960]  No police visits so far.
[00:33.380 --> 00:39.760]  But I did sort of borrow access from a neighbouring university professor and got onto ARPANET when I was about 13 or 14.
[00:40.660 --> 00:44.100]  I'm here as a private person, first and foremost.
[00:44.640 --> 00:46.760]  I'm not representing anyone but myself.
[00:47.000 --> 00:48.860]  I'm not speaking for anyone but myself.
[00:50.560 --> 00:52.100]  Should my employer be watching?
[00:52.400 --> 00:53.280]  Just in case.
[00:53.940 --> 00:54.740]  I'm a suit.
[00:55.340 --> 00:58.140]  It's the sad and honestly horrible truth.
[00:58.960 --> 01:00.800]  You know... Go ahead.
[01:01.020 --> 01:01.400]  Giggle.
[01:02.520 --> 01:03.280]  Okay, good.
[01:03.460 --> 01:03.540]  Good.
[01:03.660 --> 01:04.160]  Giggling works.
[01:05.280 --> 01:07.960]  I didn't really try to end up this way.
[01:09.840 --> 01:13.820]  Believe it or not, my only educational credentials are...
[01:13.820 --> 01:18.820]  I have a diploma in media arts, which qualifies me to make TV commercials and slideshows.
[01:20.680 --> 01:21.840]  I used to have dreams.
[01:22.440 --> 01:23.620]  I've foregone those.
[01:25.060 --> 01:26.640]  It's not happening in the corpsec world.
[01:26.660 --> 01:27.600]  You have to give those up.
[01:28.340 --> 01:30.340]  I was counterculture at one point.
[01:31.380 --> 01:37.060]  I'm going to tell you the story later on of how you can end up losing that a little bit if you're not too careful.
[01:37.060 --> 01:39.040]  And now I commute.
[01:41.740 --> 01:43.720]  Even more sad.
[01:44.560 --> 01:46.000]  It gets worse.
[01:47.060 --> 01:49.080]  And you know you want it.
[01:52.570 --> 01:53.470]  All right.
[01:53.670 --> 01:54.070]  Seriously.
[01:54.430 --> 01:57.130]  You would be really surprised.
[01:57.630 --> 02:03.810]  You kind of forget the good parts of being on one side and being on the other side.
[02:03.810 --> 02:08.630]  I will now insert all references to Mr. Anderson and the plague.
[02:10.130 --> 02:10.870]  Thank you.
[02:13.090 --> 02:17.030]  It's really easy to keep yourself out of an executive position.
[02:17.530 --> 02:18.590]  I'll give you a hint.
[02:18.930 --> 02:26.810]  Dressing the way most of us dress and wearing our hair the way most of us do, you're never going to get the seat at the big table.
[02:27.370 --> 02:27.930]  Sorry.
[02:30.030 --> 02:32.590]  It's actually really easy to get into the club.
[02:34.250 --> 02:35.310]  Especially this one.
[02:36.150 --> 02:37.730]  Now, here's the funny story.
[02:38.490 --> 02:38.930]  CISO.
[02:39.010 --> 02:42.350]  This is the job where your intention is to put yourself out of a job.
[02:43.210 --> 02:44.210]  Does everybody know this?
[02:44.470 --> 02:48.990]  In the real world, we shouldn't have information security separate from just information management.
[02:49.390 --> 02:52.830]  But there's no CIOs that are actually doing their job out there in the real world.
[02:52.830 --> 02:54.150]  So we've had to step in and do it.
[02:55.010 --> 02:59.130]  This is a lot about the hacking and a lot about the what you do about the hacking.
[02:59.130 --> 03:03.030]  It's a lot more about how you do the right things with information.
[03:04.790 --> 03:05.770]  What do you want?
[03:06.130 --> 03:07.110]  I mean, really.
[03:07.630 --> 03:10.530]  If you're like me, you want leisure time.
[03:11.930 --> 03:13.730]  You want to have a good job.
[03:13.950 --> 03:15.750]  You want stable work.
[03:18.990 --> 03:20.790]  There's also some downsides.
[03:21.310 --> 03:24.790]  You really don't want to be on call anymore.
[03:26.850 --> 03:33.590]  Do you want to be really looking at the downside of where the buck stops?
[03:33.930 --> 03:36.950]  Especially after it's on the front page of the newspaper?
[03:39.110 --> 03:42.230]  You know how other people do things that affect your livelihood?
[03:44.190 --> 03:48.050]  Do you know what happens to CISOs of companies who end up on the front page of the paper?
[03:49.770 --> 03:51.130]  We call them waiters.
[03:52.110 --> 03:52.550]  Yeah.
[03:54.630 --> 04:01.830]  How you answer this is really whether or not you're going to be able to get or keep a job in corporate information security.
[04:02.490 --> 04:04.770]  Do we need to define corporate information security?
[04:06.050 --> 04:08.630]  That's the person who follows the sans rules and says no.
[04:10.210 --> 04:11.050]  Nodding and smiling.
[04:11.210 --> 04:12.910]  You guys actually work in real companies, don't you?
[04:13.690 --> 04:14.170]  Cool.
[04:17.130 --> 04:19.230]  It's really a lot of fun.
[04:20.230 --> 04:21.070]  I swear.
[04:23.930 --> 04:24.890]  One time...
[04:24.890 --> 04:25.750]  I kid you not.
[04:25.830 --> 04:27.930]  There's actually somebody in the room who knows this is true.
[04:27.930 --> 04:30.430]  I spent a week refreshing Slashdot.
[04:31.570 --> 04:32.430]  Five days.
[04:32.950 --> 04:34.350]  Seven and a half hours a day.
[04:34.510 --> 04:36.470]  Because my boss managed by butts in seats.
[04:36.790 --> 04:39.510]  I hit F5 on Slashdot for a week.
[04:40.850 --> 04:46.050]  Of course, there's other times where I've been told to go home after I've finished working 100 hours.
[04:47.130 --> 04:48.470]  Monday to Friday.
[04:50.310 --> 04:52.750]  So, it's really between two worlds.
[04:52.750 --> 04:57.510]  I'd like to point this out as being sort of really key and really important.
[04:58.230 --> 05:00.530]  You're going to be updating documentation.
[05:03.290 --> 05:03.950]  Love that.
[05:04.030 --> 05:04.910]  You can hear the pin drop.
[05:07.450 --> 05:09.610]  You're going to be hunting for lost tapes.
[05:09.910 --> 05:11.510]  Because you know what lost tapes turn into?
[05:12.030 --> 05:12.890]  Front page news.
[05:12.890 --> 05:13.890]  Front page news.
[05:14.150 --> 05:14.370]  Right.
[05:14.870 --> 05:16.650]  You're going to be cleaning up after other people.
[05:17.590 --> 05:20.390]  Most people in most companies are very well intentioned.
[05:20.390 --> 05:23.790]  They're trying to do the right thing for everyone.
[05:25.350 --> 05:28.310]  And they're often completely freaking wrong.
[05:28.730 --> 05:31.610]  And you're going to have to clean up the mess that they leave behind.
[05:31.790 --> 05:32.750]  I'd like to introduce you to Edna.
[05:32.890 --> 05:34.250]  She's had every job in the company.
[05:34.370 --> 05:35.130]  She knows everything.
[05:35.670 --> 05:42.850]  Edna just landed us on the front page of the newspaper because she thought she was being nice when she offered the customer list to a former employee.
[05:44.370 --> 05:45.130]  There you go.
[05:45.990 --> 05:47.550]  And nobody's going to care about you.
[05:49.230 --> 05:50.570]  Do you have what it takes?
[05:51.010 --> 05:53.550]  You know, are you prepared to go all the way to the top?
[05:53.750 --> 05:58.330]  This is one of those job trajectories that's more ballistic than guided.
[05:59.170 --> 06:02.410]  Once you launch on this path, you have to be prepared to actually end up there.
[06:02.670 --> 06:09.910]  You know, when I started doing firewall work back in the olden days, in the 90s, you guys remember the 90s, right?
[06:11.130 --> 06:13.590]  Firewalls were new, shiny, blinky lights.
[06:13.590 --> 06:14.150]  It was great.
[06:15.050 --> 06:20.870]  I did not expect that I was going to end up as CISO if I publicly traded company.
[06:21.210 --> 06:22.830]  That was not actually my intention.
[06:23.150 --> 06:27.150]  I just wanted a nice job where I could sit in a corner and play with blinky lights and shiny things.
[06:27.490 --> 06:28.950]  And they don't let me do that anymore.
[06:31.890 --> 06:33.770]  Most importantly, the E-word.
[06:34.730 --> 06:35.770]  Everybody knows the E-word.
[06:36.510 --> 06:38.230]  Everybody has their own version of the E-word.
[06:38.230 --> 06:42.050]  I have a very, very small batch process that runs nightly.
[06:42.330 --> 06:43.690]  Takes care of this for me.
[06:47.890 --> 06:50.310]  Let's talk about getting the first job.
[06:52.110 --> 06:56.170]  Yes, I'm reading off of two screens and paper at the same time.
[06:56.790 --> 07:07.490]  This is not the job where you do security stuff for 25% of your time, sysadmin work for 25% of your time, and run cable and fix printers for the other 50% of your time.
[07:07.690 --> 07:11.250]  This is the first job where it's a full-time gig.
[07:11.450 --> 07:14.450]  And it's hard to get that first full-time gig.
[07:14.710 --> 07:15.810]  Because what are you missing?
[07:16.290 --> 07:16.810]  Experience.
[07:17.090 --> 07:17.990]  Right, experience.
[07:18.710 --> 07:31.250]  And, you know, I'm sitting there reviewing your resume and it says, well, I work in the change management group at the IT department of XYZ Company, and I want to be an Infosec guy or girl.
[07:31.430 --> 07:32.770]  We'd love to have more girls.
[07:35.130 --> 07:36.410]  There's no girls.
[07:36.870 --> 07:37.350]  Sorry.
[07:38.050 --> 07:38.670]  Please, girls.
[07:39.210 --> 07:41.070]  This is a career arc you can be on.
[07:42.950 --> 07:44.550]  You've got to get your cred together.
[07:44.770 --> 07:45.750]  You know, you've got to have the resume.
[07:46.850 --> 07:50.970]  You're probably blogging or Twittering or Web 2.0-ing.
[07:51.070 --> 07:52.930]  You're on the face space, right?
[07:52.930 --> 07:58.790]  And you've got Google results or, as we heard two talks ago, evil Google.
[07:58.970 --> 08:00.070]  You have Yahoo results.
[08:01.010 --> 08:02.270]  Quasi-evil Yahoo.
[08:03.150 --> 08:04.910]  But you've also got to have actual skill.
[08:05.110 --> 08:14.350]  Because when you're sitting in that first interview and you get past the HR people, it's all about the keyword management.
[08:16.530 --> 08:17.890]  And the not lying.
[08:19.770 --> 08:21.510]  Yes, the lying counts.
[08:21.510 --> 08:24.930]  We catch that in the second interview where we check on your skills.
[08:25.890 --> 08:28.070]  In order to get there, you're going to have to pay a lot of dues.
[08:28.230 --> 08:35.730]  You're going to have to work those part security jobs, you know, where you're slowly ratcheting it up from 25 to 26 to 27%.
[08:36.890 --> 08:38.270]  You're going to have to put in the time.
[08:38.650 --> 08:43.550]  And a lot of that time is going to show up in the time that you spend outside of work.
[08:46.090 --> 08:47.630]  Yeah, and it's going to be boring.
[08:48.070 --> 08:54.870]  During your time doing that first sort of job, expect that you will be doing mostly things like review and metrics.
[08:55.570 --> 08:59.550]  And review and metrics is really boring stuff, but it's what I need to make decisions.
[08:59.770 --> 09:02.970]  So if you do a crappy job, I make crappy decisions, and we all get fired.
[09:04.530 --> 09:05.330]  It counts.
[09:05.590 --> 09:07.510]  And you're going to have to do it the Sands way.
[09:08.390 --> 09:16.710]  If you're not reading the Internet Storm Center, and you don't have ISC in bedazzled on the back of your leather jacket last year.
[09:18.190 --> 09:21.250]  But mostly, you're surviving, right?
[09:21.410 --> 09:25.630]  You're building the resume material.
[09:26.350 --> 09:28.590]  And mostly, you're getting involved.
[09:29.850 --> 09:36.070]  Getting involved sounds like one of those sort of trite, easy to say things for a guy up at the front wearing the darky shirt.
[09:37.430 --> 09:38.910]  Get invited to meetings.
[09:39.610 --> 09:42.350]  This is tips and tricks, step one.
[09:42.910 --> 09:44.090]  Get invited to meetings.
[09:44.890 --> 09:47.430]  Offer yourself up to go to things like change advisory boards.
[09:47.550 --> 09:49.570]  Learn everything you can about the infrastructure.
[09:49.710 --> 09:55.110]  Because you probably come from a background where you played with this much of what's really used in the real world.
[09:56.070 --> 10:02.390]  At home, you don't have a whole lot of experience to fibre channel sands, unless you have electricity included with your rent.
[10:05.010 --> 10:06.990]  You're going to want to get on project teams.
[10:07.030 --> 10:08.810]  You're going to want to ask a lot of questions.
[10:09.490 --> 10:15.450]  You're going to be working your way towards being the generalist.
[10:16.270 --> 10:22.690]  The sad part of corporate security is that you have to have a fully functional bullshit meter for every person you work with.
[10:22.690 --> 10:36.330]  I have to know as much about Windows security, UNIX security, AS/400 security, mainframe security, network security, firewall security, fancy new blinky lights device that they just created a market vertical for.
[10:36.830 --> 10:38.630]  Oh, I'm sorry, DLP security.
[10:38.630 --> 10:39.090]  You have to be.
[10:40.010 --> 10:44.010]  You have to be that generalist because everybody is going to be trying to snow you.
[10:44.230 --> 10:45.710]  And you've got to know this stuff.
[10:47.210 --> 10:49.950]  And you're going to not end up staying anywhere for very long.
[10:50.590 --> 10:52.650]  That's also the sad but horrible truth.
[10:53.510 --> 10:54.890]  You've got to stay at least a year though.
[10:55.210 --> 10:58.570]  If you start seeing short periods, I spent seven days working there.
[10:59.950 --> 11:00.950]  That's not good.
[11:02.310 --> 11:06.890]  I got my first paycheck after my first day, which was also my last day, is not good.
[11:07.670 --> 11:12.430]  Anything less than a year sticks out on a resume probably won't get you past the HR filters.
[11:13.090 --> 11:19.690]  But you're going to be trying on different kinds of organizations to see how they fit and how they feel and where you're going to land.
[11:20.570 --> 11:22.310]  You've got to work for really big companies.
[11:22.510 --> 11:27.470]  Think 30,000, 50,000 employees or more where you are literally just a number.
[11:28.130 --> 11:33.590]  You've got to work for small companies, like five or six people, where you're just a number and also the janitor.
[11:35.630 --> 11:41.330]  And it would be really good to spend some time out there working in the public sector.
[11:42.350 --> 11:44.070]  There's things that can be learned from them.
[11:44.990 --> 11:47.310]  There's only two or three things that can be learned from them.
[11:47.390 --> 11:48.970]  But there are things that can be learned from them.
[11:49.910 --> 11:54.090]  You need most of all the ability to say, yeah, I've been there and I've done that.
[11:54.950 --> 11:59.430]  And you're not going to get that any other way than having been there and doing that.
[12:00.710 --> 12:02.810]  Sorry, was this not the obvious part?
[12:03.410 --> 12:03.890]  No?
[12:04.190 --> 12:04.790]  Pin drop?
[12:05.690 --> 12:08.430]  You need to work on your non-technical skills.
[12:09.870 --> 12:16.110]  This is what we used to refer to in the olden days as social engineering on a wide scale.
[12:17.170 --> 12:20.570]  I cannot emphasize enough the likability aspect.
[12:21.390 --> 12:23.590]  You are going to have to get along with others.
[12:24.610 --> 12:29.250]  This is when you get to start building those soft skills that you ignored for your entire life.
[12:32.170 --> 12:33.990]  So you're moving up the chain.
[12:34.530 --> 12:36.030]  You're a team leader now.
[12:36.970 --> 12:41.970]  This means that you have fuzzy little heads that look to you for guidance.
[12:43.110 --> 12:47.650]  They want to be your friend and they want to survive their trip through step one.
[12:48.150 --> 12:50.770]  Now, since you've been there, you need to help them.
[12:50.910 --> 12:55.730]  You need to protect them from the company that you are all working for to allow them to build.
[12:56.190 --> 13:03.130]  At the same time, you need to not lose your skills and cred because you're not done your meteoric rise to kingdom yet.
[13:04.510 --> 13:04.950]  Queendom.
[13:04.950 --> 13:05.870]  Girls, please.
[13:06.150 --> 13:06.530]  Corpsec.
[13:06.630 --> 13:07.230]  You need to be there.
[13:08.410 --> 13:10.810]  I know it sounds like it's a joke, but it's not.
[13:11.130 --> 13:19.350]  Because, you know, in 15 years of this, I can count on less than one hand the number of girls that I've worked with in corporate security.
[13:20.210 --> 13:23.410]  And the number of idiots I've worked with, I don't have enough hands.
[13:24.430 --> 13:26.190]  Where idiots equals mostly boys.
[13:29.970 --> 13:41.070]  Remember, the hardest part of this is going to be the tech and doing all of those nice personnel things like holidays, sick days, performance reviews, 360 reviews.
[13:41.770 --> 13:45.390]  This is all sounding familiar to people who've worked in a corporation that has more than seven employees.
[13:46.650 --> 13:48.110]  You're keeping up with the crap.
[13:49.670 --> 13:57.170]  This is the part where you begin to learn the real truth, which is that InfoSec has very little to do with technology and everything to do with people.
[13:58.010 --> 13:59.330]  It's not blanky lights.
[13:59.350 --> 14:00.710]  It's not shiny things.
[14:00.930 --> 14:02.430]  It's not product verticals.
[14:02.610 --> 14:05.070]  It's not whatever that sales guy is trying to sell you.
[14:06.490 --> 14:08.230]  But are you really ready for that?
[14:09.770 --> 14:12.870]  It was a crisis of faith for me to give up playing with computers.
[14:14.550 --> 14:15.410]  But you know what?
[14:15.770 --> 14:17.630]  Hacking people is way more fun.
[14:18.710 --> 14:19.550]  Think about it.
[14:19.830 --> 14:23.910]  I get a whole corporation to play with, to steer, adjust.
[14:24.450 --> 14:25.670]  It's very nice.
[14:26.650 --> 14:29.050]  Of course, you have to do it following some of their rules.
[14:32.190 --> 14:34.150]  And with mostly their people.
[14:34.950 --> 14:36.510]  There are no HR people in the room, right?
[14:37.750 --> 14:39.690]  No, they wouldn't come to this kind of event.
[14:41.470 --> 14:43.730]  You're also going to have to know finance.
[14:44.030 --> 14:54.990]  If you don't know finance, if you have a credit card balance that is more than your annual income, now is a good time to start sorting out what finance means.
[14:55.530 --> 14:57.090]  And you're going to have to get along.
[15:07.890 --> 15:10.050]  This is the part where you're building that reputation.
[15:10.950 --> 15:24.770]  Because, you know, in so much as people like Charles Strauss and Cory Doctoral like to talk about the reputation economy, and how this is the greatest new thing, this is what Web 7.0 is going to look like, the reality is, we're already there.
[15:28.290 --> 15:31.410]  People know who you know and what you know.
[15:31.950 --> 15:33.030]  And word spreads.
[15:33.610 --> 15:38.810]  Whenever you screw up, you can bet that 25 people are going to know about it before the end of the day.
[15:39.330 --> 15:44.590]  And when you do something really good, you're going to have a hard time finding one person who hears about it.
[15:45.950 --> 15:51.130]  So, to a greater or lesser extent, you're going to have to take care of it on your own.
[15:51.970 --> 15:56.530]  This is where, in life-building seminars, you hear the word networking.
[15:58.870 --> 16:00.030]  Again, with the pin drop.
[16:01.970 --> 16:03.410]  But you're doing good, right?
[16:03.530 --> 16:05.310]  You've done the team leader thing for a while.
[16:05.450 --> 16:07.730]  You've maybe even stirred around from a couple of organizations.
[16:08.590 --> 16:10.790]  This stuff is starting to make a whole lot of sense to you.
[16:11.590 --> 16:13.950]  And now, all of a sudden, you have to talk to people.
[16:17.990 --> 16:19.650]  Let's talk about perimeter defense.
[16:20.010 --> 16:23.130]  Let's not use any IT language at all.
[16:23.490 --> 16:25.730]  The word firewall becomes a swear word.
[16:35.880 --> 16:37.560]  Sorry, I'm just reviewing my notes here.
[16:40.940 --> 16:43.200]  How do you speak the language of the executives?
[16:43.680 --> 16:47.240]  Well, you need to articulate risk.
[16:47.240 --> 16:51.160]  These are people who are very good at managing risks within their own domains.
[16:51.480 --> 16:55.940]  They have no idea what your domain is, even though it's the key component of their business.
[16:58.020 --> 17:00.220]  How does SANS teach you to articulate risks?
[17:00.540 --> 17:01.880]  Anybody want to pipe up with that one?
[17:02.740 --> 17:03.220]  Sock...
[17:08.220 --> 17:10.500]  I was supposed to make you guys laugh.
[17:10.500 --> 17:11.280]  What is this?
[17:12.680 --> 17:13.500]  All right.
[17:13.980 --> 17:14.820]  Legal risk.
[17:15.360 --> 17:16.400]  Regulatory risk.
[17:16.720 --> 17:17.720]  Reputational risk.
[17:18.160 --> 17:21.020]  These are also known as orange jumpsuit.
[17:21.180 --> 17:22.020]  Lose your house.
[17:22.340 --> 17:22.840]  Look stupid.
[17:24.480 --> 17:25.980]  Help them understand that.
[17:26.180 --> 17:32.120]  If you go and tell them about legal risk, regulatory risk, and reputational risk, they have fallen asleep before you got to reputational.
[17:32.440 --> 17:36.700]  Talk to them about orange jumpsuits losing their houses and looking stupid.
[17:37.420 --> 17:39.580]  They'll start to resonate really, really easily.
[17:41.680 --> 17:44.640]  Of course, you're going to hear from them, none of the above.
[17:47.000 --> 17:51.160]  And you're going to have to listen to what they mean when they say, none of the above.
[17:51.480 --> 17:55.700]  Because the reality is, they do things that make themselves look stupid every single day.
[17:56.440 --> 17:57.240]  Play golf.
[18:00.500 --> 18:03.260]  You need to bridge your experience to their experience.
[18:03.260 --> 18:07.620]  So, you have valuable experiences from having climbed up from the bottom.
[18:08.020 --> 18:12.040]  They have valuable experiences from having been born with a spoon in their mouth.
[18:13.140 --> 18:17.480]  Bridge those two experiences together into a cohesive whole.
[18:18.080 --> 18:26.500]  Mostly, help them understand that you're there to talk to them about the risks that you experience based on their behavior.
[18:27.320 --> 18:28.620]  Damn, that thing's right there.
[18:29.100 --> 18:30.340]  Based on their behavior.
[18:30.520 --> 18:31.080]  Less hand-waving.
[18:31.980 --> 18:33.000]  That's your job.
[18:33.720 --> 18:36.280]  And they're going to really thank you for it at some point.
[18:38.520 --> 18:41.680]  The downside, you've read some books about finance.
[18:42.400 --> 18:45.360]  Now it's time to start taking some B-School courses.
[18:45.640 --> 18:53.240]  We know that on your way through school, you took the kind of sideways road that I took, which included media arts, which, let me tell you, doesn't pay well.
[18:54.560 --> 18:56.300]  You don't have a B-School background.
[18:56.460 --> 18:57.960]  It's time to generate one.
[18:58.280 --> 18:59.220]  Start taking courses.
[18:59.720 --> 19:01.040]  Go to community schools.
[19:01.620 --> 19:03.100]  Do all the right things.
[19:04.940 --> 19:06.220]  Please don't play golf.
[19:08.240 --> 19:09.760]  It's the sad truth.
[19:10.800 --> 19:12.800]  But don't tell me what I don't want to hear.
[19:14.520 --> 19:16.960]  You can wear the shirt on the inside, though.
[19:17.600 --> 19:20.820]  Often the day is where I've got one under the suit.
[19:20.820 --> 19:21.860]  It's important.
[19:23.320 --> 19:25.000]  This is the classic.
[19:25.280 --> 19:28.680]  You've heard this from your career counselors as far back, probably as early high school.
[19:28.880 --> 19:31.860]  Dress for the job you want, not the job you have.
[19:32.940 --> 19:33.380]  You're a hero.
[19:36.600 --> 19:37.200]  All right.
[19:37.500 --> 19:39.600]  Underwear fetish talk in the fourth room.
[19:41.820 --> 19:43.160]  Just put on the damn suit.
[19:44.000 --> 19:44.480]  Really.
[19:45.480 --> 19:48.280]  Keep the jacket in the closet at work so you don't have to wear it all the time.
[19:48.440 --> 19:52.340]  Because probably you don't have a 100% wool suit at this point.
[20:00.660 --> 20:02.120]  It's terrifying, but true.
[20:02.880 --> 20:08.480]  This is another one of those times where, just looking at the demographic of the room, girls could really help out.
[20:09.060 --> 20:11.300]  They do know how to dress you well.
[20:11.640 --> 20:12.640]  Ask for help.
[20:12.860 --> 20:13.900]  I'm sure you all know a girl.
[20:14.100 --> 20:15.160]  Or have heard of one.
[20:18.900 --> 20:19.340]  Mom!
[20:25.450 --> 20:26.590]  Note that you're undercover.
[20:27.450 --> 20:29.970]  Because you're still a geek and you're still a hacker.
[20:31.530 --> 20:33.650]  And they don't need to know that.
[20:33.930 --> 20:34.570]  At all.
[20:35.930 --> 20:36.770]  It's a secret.
[20:43.250 --> 20:44.810]  I should give some cred.
[20:45.090 --> 20:46.710]  I may or may not have seen Johnny Long.
[20:47.750 --> 20:49.310]  That's how he does his presentations.
[20:50.670 --> 20:52.050]  Go see Johnny Long Sunday.
[20:54.470 --> 20:55.290]  Maintain your soul.
[20:55.790 --> 20:58.170]  This is going to be the hard part because you're in Corpsec now.
[20:58.370 --> 21:00.510]  I mean, you work in a glass building.
[21:00.510 --> 21:07.090]  You probably commute, you probably read the newspaper on purpose, not in the bathroom.
[21:09.470 --> 21:10.810]  Feed that inner hacker.
[21:11.610 --> 21:18.950]  And realize that when you actually start making the money, getting to play with these things becomes not only fun but cheap.
[21:20.150 --> 21:25.950]  Highly recommended that you go to conferences, especially if somebody else is paying for them.
[21:28.530 --> 21:30.210]  And do the fun stuff.
[21:30.770 --> 21:32.190]  You've earned it at this point.
[21:34.210 --> 21:34.730]  Accept.
[21:38.290 --> 21:39.530]  Nothing on the accept.
[21:40.410 --> 21:41.590]  Okay, we'll go back to this part.
[21:44.640 --> 21:46.560]  You guys know about passive-aggressive behavior?
[21:47.980 --> 21:48.500]  Yes?
[21:49.700 --> 21:50.220]  Mom!
[21:53.820 --> 21:56.380]  This is going approximately twice as fast as I'd wanted to.
[21:56.380 --> 21:58.000]  Have I been talking really, really fast?
[21:58.700 --> 21:59.180]  No.
[21:59.400 --> 21:59.700]  No?
[21:59.980 --> 22:00.260]  Okay.
[22:01.220 --> 22:02.960]  136 slides, not enough for you people.
[22:05.940 --> 22:06.680]  Oh, sorry.
[22:06.680 --> 22:08.660]  That was passive-aggression just coming out there.
[22:10.680 --> 22:13.200]  They will treat you like crap.
[22:14.380 --> 22:15.660]  Sort of get used to that.
[22:16.220 --> 22:17.880]  You will be the butt of most of the jokes.
[22:18.640 --> 22:20.740]  And you will be the butt of Matrix Management.
[22:21.200 --> 22:22.620]  Everybody know what Matrix Management is?
[22:23.660 --> 22:25.040]  I have four bosses.
[22:26.340 --> 22:27.700]  I'd love to be kidding you.
[22:27.880 --> 22:29.320]  I have four bosses.
[22:29.600 --> 22:33.020]  Each one of them thinks that they have a hold on 100% of my time.
[22:33.680 --> 22:34.820]  They are all wrong.
[22:39.500 --> 22:42.500]  You really need to be paying attention to this part.
[22:42.580 --> 22:47.120]  If you start wanting to be like them, and that's okay,
[22:55.800 --> 22:57.280]  maintain your contacts.
[22:57.280 --> 23:00.360]  Now, this is the hard part, right?
[23:00.500 --> 23:01.120]  This is the...
[23:01.120 --> 23:11.300]  Once you've been in an organization, and you've spent some time working there, and you've moved up, and moved out, and moved onward, you need to remember that you're going to encounter those people again.
[23:12.440 --> 23:14.180]  Most of you are from cities, I presume.
[23:14.440 --> 23:17.960]  There's not a whole lot of InfoSec going on in Cal country, although there should be.
[23:19.960 --> 23:22.340]  You know how the industries are really small.
[23:22.680 --> 23:25.100]  You know everybody who's doing InfoSec in your city.
[23:25.740 --> 23:29.280]  If you're from the city I am from, you know everybody who's doing InfoSec.
[23:29.280 --> 23:30.760]  It's very incestuous.
[23:32.340 --> 23:34.880]  You're going to keep running into these same people over and over again.
[23:35.660 --> 23:42.080]  That sales guy named Bob from Vendor A, he's going to be at Vendor B next year, and the circle's going to go around.
[23:42.280 --> 23:46.100]  You may end up working for someone who used to work for you.
[23:46.620 --> 23:48.000]  Everyone's on a different trajectory.
[23:48.660 --> 23:50.300]  Theirs may be a little sharper than yours.
[23:53.460 --> 23:54.700]  Mostly, don't be forgettable.
[23:55.360 --> 23:57.300]  Of course, none of you are going to remember me after today.
[23:58.180 --> 23:58.980]  That's all right.
[24:01.240 --> 24:02.120]  Avoid jerk.
[24:02.120 --> 24:06.940]  Which is really hard for pretty much every InfoSec guy I know.
[24:10.260 --> 24:10.600]  Yeah.
[24:14.870 --> 24:17.510]  Everybody know about professional organizations for this kind of stuff?
[24:18.470 --> 24:21.150]  Your SANS groups, your...
[24:22.750 --> 24:24.230]  Not a CISSP groups.
[24:25.710 --> 24:29.190]  Those professional organizations offer you a lot of those networking linkages.
[24:29.530 --> 24:31.910]  A lot of those places where you can loop it back around.
[24:32.870 --> 24:34.650]  Be careful though, sometimes.
[24:36.130 --> 24:38.490]  They will bite you later on.
[24:40.970 --> 24:41.690]  How so?
[24:41.690 --> 24:41.710]  How so?
[24:44.010 --> 24:46.030]  Sometimes they end up being tarred with a brush.
[24:46.730 --> 24:48.810]  That you don't necessarily want to be tarred with.
[24:49.870 --> 24:52.670]  There's a reason why I wear my NADA CISSP badge.
[24:52.670 --> 24:55.150]  Because in the particular vertical that I'm in.
[24:55.310 --> 24:58.230]  In the particular geographic area that I'm in.
[24:58.810 --> 25:03.850]  The government is retraining people who've lost their jobs as CISSP's.
[25:04.670 --> 25:07.390]  The same thing they did with MCSE's about 10 years ago.
[25:07.610 --> 25:08.770]  They're not doing with CISSP's.
[25:10.350 --> 25:14.690]  I don't know exactly why this is okay with ISC2.
[25:14.690 --> 25:15.650]  But it's happening.
[25:16.090 --> 25:19.050]  And we're getting a lot of paper CISSP's through the door.
[25:19.410 --> 25:22.870]  So it's just one particular example from one particular geographic location.
[25:24.450 --> 25:25.870]  But when you get the resume.
[25:26.150 --> 25:29.250]  And the person doesn't have the cred to be able to answer the simple questions.
[25:30.790 --> 25:32.470]  How does a firewall process rules?
[25:34.350 --> 25:35.550]  And you don't get an answer.
[25:36.030 --> 25:38.870]  Then you kind of know you're stuck with somebody who really doesn't know what they're talking about.
[25:39.930 --> 25:46.830]  But that's my, without really dunning anyone too hard, be careful about professional organizations.
[25:47.150 --> 25:47.830]  Some of them are great.
[25:47.990 --> 25:49.570]  Some of them are not so great.
[25:50.770 --> 25:51.470]  Good answer?
[25:51.750 --> 25:53.210]  I can kind of see you nodding.
[25:53.770 --> 25:54.250]  Okay.
[25:55.150 --> 25:57.990]  This is the part where you get into the mentoring role.
[25:58.490 --> 26:00.610]  You should have been there kind of all along.
[26:00.610 --> 26:07.410]  But now you're going to be in charge of a fairly large group of people, hopefully, who are all back at step one.
[26:08.170 --> 26:09.870]  You're going to at least know lots of them.
[26:12.710 --> 26:15.210]  Even though you're busy, take the time to mentor them.
[26:15.530 --> 26:22.470]  There should be a few who you know, who give you sort of hints and clues about what's going on at the bottom.
[26:22.910 --> 26:27.970]  Which are hints and clues you need to understand what's going on because you've finally made it to the top.
[26:30.250 --> 26:31.730]  You're probably ready at this point.
[26:31.930 --> 26:33.290]  You know, you've done the work.
[26:33.410 --> 26:34.570]  You've got the business credentials.
[26:34.850 --> 26:35.550]  You've moved on.
[26:35.550 --> 26:37.450]  It's time to start hanging out with the C-suite.
[26:37.870 --> 26:38.590]  The Chiefs.
[26:41.800 --> 26:42.840]  You've got the reputation.
[26:43.700 --> 26:44.440]  Everybody knows you.
[26:44.720 --> 26:49.680]  Somebody says, hey, I'd really like to get together and do this cool kind of project.
[26:49.680 --> 26:51.480]  I'm going to need some help with this.
[26:51.560 --> 26:53.000]  Who's the right person to help me with this?
[26:53.720 --> 26:54.680]  Your name comes up.
[26:54.760 --> 26:55.300]  You're good to go.
[26:57.880 --> 27:01.900]  At this point, often too, you're writing the job descriptions for the job that you'll have.
[27:03.380 --> 27:05.160]  Which is kind of nice now and then.
[27:06.780 --> 27:09.720]  You also get to say, this is how much money I need to earn.
[27:10.520 --> 27:16.100]  It's not so much about which band you're in or whether or not somebody's interested in giving you money for that.
[27:17.480 --> 27:19.920]  Mostly because they have no idea what you do.
[27:21.900 --> 27:23.180]  But you're there to help them.
[27:23.540 --> 27:24.760]  You're there to fix them.
[27:25.440 --> 27:26.620]  You're there to hack them.
[27:28.380 --> 27:29.600]  And then you get to do it again.
[27:31.600 --> 27:32.720]  With a bigger company.
[27:33.500 --> 27:34.300]  Or a government.
[27:35.920 --> 27:37.180]  Please send me a nice postcard.
[27:39.120 --> 27:40.580]  And with the last 15 minutes.
[27:41.020 --> 27:41.680]  Q&A.
[27:42.420 --> 27:43.740]  You always wanted to talk to a CISO.
[27:43.940 --> 27:44.820]  What do you need to know?
[27:55.110 --> 27:55.550]  Questions?
[27:55.710 --> 27:56.110]  I saw a hand.
[27:57.450 --> 28:06.410]  As far as you start getting into the area where you're talking about moving up into, say, your first manager job.
[28:06.650 --> 28:06.890]  Yes.
[28:06.890 --> 28:07.810]  Q&A.
[28:07.810 --> 28:12.950]  Do you have a recommendation as to what particular type of management job are you talking about?
[28:13.170 --> 28:14.630]  Would anything suffice?
[28:14.750 --> 28:18.650]  Or is it more like a program manager or a group manager or some kind of...
[28:18.650 --> 28:21.330]  What kind of management specifically would be a good starting point?
[28:21.430 --> 28:24.010]  A good starting point is any starting point, frankly.
[28:24.230 --> 28:26.750]  Because you're still at that proving your cred point of view.
[28:27.410 --> 28:29.050]  Do you have what it takes to do...
[28:29.990 --> 28:31.410]  Sorry, I should go back one full step.
[28:31.570 --> 28:33.710]  Most organizations don't have dual track management.
[28:33.710 --> 28:39.910]  Most organizations don't have technical track where you just deal with people on whether or not they're doing their job.
[28:40.830 --> 28:43.250]  And a separate human management track.
[28:43.570 --> 28:46.770]  That's very 22nd century and I hope we'll get there someday.
[28:47.290 --> 28:48.610]  Most organizations are integrated.
[28:48.870 --> 28:59.690]  So not only do you have to manage people doing the work that they're supposed to be doing, but you also have to pat their fuzzy little head and make them feel better and deal with benefits and holidays and sick time and all of that stuff.
[28:59.690 --> 29:05.490]  So that first sort of team lead position is probably going to be more technical than anything.
[29:05.810 --> 29:07.490]  It's going to be less line manager.
[29:07.650 --> 29:15.250]  But the first chance you can get to get line manager, so you can say, you know, in a very lumbered kind of way, you're going to have seven people under you.
[29:16.090 --> 29:17.490]  That's an org chart reference.
[29:17.570 --> 29:20.090]  It's not something that belongs in a talk in the fourth room.
[29:21.090 --> 29:29.670]  Once you get to that point where you're able to say, yes, I've had 10 people working for me or I had a team of 22.
[29:30.130 --> 29:40.450]  You know, once you're at that kind of point, that's what I'm talking about when I say you're sort of at that first real management job where you're in a position where you're not able to do a lot of the work.
[29:40.450 --> 29:45.150]  You know, think about, um, uh, techno-centric kind of work versus business focused kind of work.
[29:45.370 --> 29:48.470]  Techno-centric kind of work, you're doing as well as managing.
[29:49.310 --> 29:51.270]  Business focus, you're managing.
[29:51.550 --> 29:52.470]  Other people are doing.
[29:53.210 --> 30:03.850]  And that's that sort of critical gap where you're losing your cred because you're not touching the equipment anymore, you're not dealing with the policies, you're not actually contributing to the effort, you're orchestrating the effort.
[30:04.170 --> 30:06.430]  You know, the orchestra leader never has an instrument.
[30:07.150 --> 30:15.330]  That's sort of where you need to be in order to move up to the next step because in most organizations, myself included, the CISO has no direct reports.
[30:15.850 --> 30:18.350]  I don't pat the heads of anyone.
[30:18.790 --> 30:25.250]  I have about 400 people who work in an IT department who are indirect reports.
[30:25.470 --> 30:29.190]  They all have to do what I say, but I'm not responsible for them.
[30:31.550 --> 30:32.030]  Others?
[30:32.770 --> 30:33.450]  Front row.
[30:33.450 --> 30:43.750]  How do you deal with the political garbage that goes on in corporate life and trying to get your weight in without having to deal with the politics of that?
[30:43.810 --> 30:45.430]  That's the social engineering part.
[30:46.030 --> 30:51.010]  You have to deal with the politics of it, but you can deal with them on your footing.
[30:52.630 --> 31:02.070]  You can set it up in such a way that essentially this is passive aggression played out as hacking, where you're following their rules and doing it their way.
[31:02.070 --> 31:10.570]  And you keep a special piece of paper beside your desk where you write all the things that you're thinking while you're talking on the phone with the nice lady in HR.
[31:11.430 --> 31:11.910]  Right?
[31:12.130 --> 31:15.330]  And just create that schizophrenic personality.
[31:15.530 --> 31:30.510]  You know, maintain the schizophrenia that allows you to be the hacker dude at the cool conference and also the person who wears a suit and tells people how and how not to manage the information that doesn't really belong to them because it's other people's.
[31:31.650 --> 31:43.570]  But in terms of actually managing the politics, much like you've heard from other speakers, sometimes you have to work within the confines of the system and do what you can to change the system.
[31:44.190 --> 31:46.710]  And to a greater or lesser extent, that's the point where I'm at right now.
[31:46.850 --> 31:48.890]  And this is, you know, more personal challenge than anything.
[31:49.630 --> 31:59.010]  Personal challenge, I need to shift the whole organization over to a real risk management kind of mentality in order for it to grow to the next level.
[31:59.210 --> 31:59.850]  You know, we're sort of stuck.
[31:59.990 --> 32:04.670]  There's a glass ceiling there because we're managing the way that we managed when we were half the size we are now.
[32:05.290 --> 32:08.770]  And in order to get past that, we need to do a major organizational shift.
[32:08.830 --> 32:10.810]  And it's entirely outside of my area.
[32:11.350 --> 32:14.870]  You know, I have a very confined, this is what you do.
[32:15.490 --> 32:17.290]  I need to change something over here.
[32:17.650 --> 32:23.450]  And the only way to do that is to influence that change or to cause them to have that idea.
[32:23.590 --> 32:24.770]  Think like the Socratic method.
[32:25.410 --> 32:28.290]  When you're trying to explain something to somebody and you get it back from them.
[32:28.290 --> 32:29.610]  So it becomes their idea.
[32:30.210 --> 32:31.930]  And it's just, it's playing a game.
[32:32.150 --> 32:37.030]  And at the end of the day, you've got to have a way to purge whatever rage you maintain as part of that game.
[32:38.270 --> 32:40.310]  You know, rage can be power.
[32:41.010 --> 32:43.210]  But you have to channel it, control it.
[32:43.770 --> 32:46.250]  Play racquetball until you wreck your first few racquets.
[32:49.510 --> 32:51.130]  Yeah, you're gonna have to learn how to play golf.
[32:51.330 --> 32:52.570]  I had to learn how to play golf.
[32:52.930 --> 32:53.630]  Oh, you love golf?
[32:53.790 --> 32:54.370]  I love golf.
[32:54.830 --> 32:56.170]  I'm sorry, I can't help you with that.
[32:58.810 --> 33:00.610]  There's another question about midway back.
[33:01.110 --> 33:02.570]  Okay, I got one, two, three.
[33:02.910 --> 33:04.110]  So flip a coin in the middle.
[33:05.710 --> 33:09.070]  I have a job where I do spend 20% of my time fixing printers.
[33:09.650 --> 33:11.890]  And a kind of an embarrassing job title.
[33:12.170 --> 33:12.510]  Yes.
[33:12.650 --> 33:15.230]  But I also get to run four or five servers.
[33:15.610 --> 33:15.790]  Yes.
[33:16.510 --> 33:18.790]  So I'm building up great experience.
[33:19.110 --> 33:19.230]  Yes.
[33:19.230 --> 33:22.030]  But how do I market a job like that to get a first real job?
[33:22.510 --> 33:23.670]  Get them to change your title.
[33:25.190 --> 33:26.550]  Yeah, I work for the city.
[33:27.270 --> 33:28.050]  Oh, yeah.
[33:28.310 --> 33:30.850]  Well, you're getting your credit in the public sector.
[33:31.230 --> 33:33.310]  And that might be enough right there.
[33:34.230 --> 33:39.350]  If it's a possibility, if you spend at least a year there, it's time to shuffle on.
[33:40.130 --> 33:40.570]  Okay.
[33:40.570 --> 33:46.250]  Move to a job where you can get sort of at least 50% not fixing printers.
[33:47.010 --> 33:49.290]  You know, it happens to everybody.
[33:49.570 --> 33:50.570]  Everybody have relatives.
[33:51.090 --> 33:52.670]  Everybody fix their relative's computers.
[33:53.450 --> 33:55.650]  Everybody convert their relatives to not using Windows.
[33:56.250 --> 33:56.330]  Yeah.
[33:58.510 --> 34:00.050]  It's a struggle, but ongoing.
[34:01.290 --> 34:02.930]  That's really what you're facing at that point.
[34:03.070 --> 34:03.850]  It's time...
[34:03.850 --> 34:07.790]  And this is actually a negotiating leverage point that you can use early on.
[34:07.850 --> 34:09.610]  Back when you're still between step one and step two.
[34:09.930 --> 34:11.350]  Leverage for a better title.
[34:12.250 --> 34:14.250]  You know, a title that has less suck.
[34:14.450 --> 34:21.990]  Because, oftentimes, the people who are looking at your resume aren't necessarily going to check what was going on.
[34:22.070 --> 34:24.570]  Like, what the real confines of your job were.
[34:24.850 --> 34:29.010]  But if your title sounds about right, then you're in about the right kind of place.
[34:29.010 --> 34:32.390]  Like, if you can get a title that says something like, manage your IT infrastructure.
[34:34.330 --> 34:37.110]  There's just one person who has no direct reports.
[34:38.170 --> 34:45.670]  But, you know, if you can get that title and that'll fly within the confines of the organization that you're with, that's a reasonable way to get to the end.
[34:46.690 --> 34:47.330]  That'll help.
[34:47.850 --> 34:48.350]  All right?
[34:48.430 --> 34:49.890]  We'll go this way.
[34:50.230 --> 34:50.290]  Yeah?
[34:50.630 --> 34:54.010]  How does a person generally get over the catch-to-and-sail of experience?
[34:55.830 --> 34:56.230]  Legitimately?
[34:56.950 --> 34:57.350]  Legitimately?
[34:57.350 --> 34:58.650]  No, I do stuff on my own.
[34:58.850 --> 34:59.650]  Do you volunteer?
[35:00.390 --> 35:00.670]  Not yet.
[35:00.830 --> 35:01.310]  You should.
[35:01.590 --> 35:01.890]  Okay.
[35:02.550 --> 35:04.970]  There's a couple different ways that you can play that out.
[35:05.670 --> 35:11.070]  One is to find an organization within your community that needs help.
[35:11.230 --> 35:12.050]  Think not-for-profits.
[35:12.270 --> 35:18.170]  There's some even fairly large not-for-profits that really don't have some of the basic infrastructure stuff glued down well.
[35:19.450 --> 35:19.930]  Food Bank.
[35:19.990 --> 35:20.470]  That's...
[35:20.470 --> 35:21.350]  Yeah, exactly.
[35:21.550 --> 35:26.250]  Food Bank is a great option where you're almost even into the manufacturing kind of vertical at that point.
[35:26.770 --> 35:31.090]  I know it sounds silly to call a Food Bank of Manufacturing, but I mean, it's warehouse and distribution, right?
[35:31.390 --> 35:36.350]  And they may have stuff that sort of half works, stuff that doesn't work, but that's an opportunity to build that.
[35:36.470 --> 35:38.330]  And again, it's almost like the previous question.
[35:38.650 --> 35:42.110]  You're writing the resume credentials yourself at that point.
[35:42.610 --> 35:49.090]  What you do on your own time with your own energy can convert into what the next job looks like.
[35:50.130 --> 35:50.750]  That side.
[35:51.530 --> 35:51.890]  Yeah.
[35:52.010 --> 35:58.290]  One of the biggest problems I've seen with people converting into management is the biggest pitfall we've had is, as technologists, allowing teammates to fail.
[35:58.430 --> 35:58.710]  Yeah.
[35:58.810 --> 36:02.570]  By not allowing them to delegate properly and let them actually fail and screw things up.
[36:02.810 --> 36:02.950]  Yes.
[36:02.990 --> 36:06.010]  What other large pitfalls are you seeing with people trying to convert from one side to the other?
[36:06.970 --> 36:12.810]  In large part, it's because technology people have a predilection for blinky lights and shiny things.
[36:13.410 --> 36:21.050]  And you need to find a way to solve your personal predilection with blinky lights and shiny things while doing other things like audit and accounting.
[36:21.610 --> 36:25.230]  And I know that sounds awful, but audit and accounting counts for a lot more.
[36:25.330 --> 36:28.630]  You know, that kind of mindset that says, you know, I can find the hinky thing.
[36:29.750 --> 36:31.850]  That's got less to do with shiny and blinky.
[36:32.350 --> 36:35.210]  I solve the shiny and blinky thing by spending money on toys.
[36:35.210 --> 36:38.590]  I have an E and it's all hacky and I've been soldering and stuff.
[36:38.850 --> 36:43.590]  And that takes care of that part of my mindset so that I can deal with the...
[36:44.090 --> 36:48.210]  I have to review access permissions for a file server.
[36:49.590 --> 36:52.130]  It's the HR file server, so there's really not...
[36:52.130 --> 36:54.810]  Not really anybody else who can do it within the organization.
[36:55.130 --> 36:56.670]  I've got to review it to make sure it's clean.
[36:56.750 --> 36:57.750]  And that's going to take me a day.
[36:58.090 --> 36:59.230]  And it's going to suck.
[37:00.530 --> 37:02.270]  And I can't delegate it.
[37:02.350 --> 37:04.230]  I'd love to, but I can't.
[37:04.790 --> 37:09.330]  In terms of how you manage that delegation thing, you've got to be prepared to let go.
[37:09.630 --> 37:12.410]  You know, it's almost a Christianist kind of phrase.
[37:13.130 --> 37:14.630]  Let go and just let it happen.
[37:14.630 --> 37:25.970]  And that's really, really hard for technology people, especially control freak monkey type sysadmins who really cannot let go of that root password.
[37:26.510 --> 37:29.430]  At this point, I don't have root password on anything at work.
[37:30.090 --> 37:33.550]  I have root password on my box at home and that's it.
[37:34.630 --> 37:36.330]  And that's really the way that it should be.
[37:36.730 --> 37:40.530]  You know, oftentimes vendors will laugh when they'll say, well, just install this thing on your computer.
[37:40.590 --> 37:41.150]  I'm like, I can't.
[37:41.370 --> 37:42.670]  I'm a normal user at work.
[37:43.370 --> 37:45.070]  You know, I can't install software on my computer.
[37:45.190 --> 37:46.150]  I have to call the help desk for that.
[37:47.130 --> 37:52.510]  Getting to the point where you can let go of that kind of power trip is really hard.
[37:52.510 --> 37:53.010]  And you're right.
[37:53.010 --> 37:54.910]  That's a real place where failure occurs.
[37:55.230 --> 37:55.790]  Absolutely.
[37:56.150 --> 37:56.970]  Behind you.
[37:57.350 --> 38:00.950]  How do you recommend circumventing the HR gatekeepers?
[38:01.430 --> 38:04.290]  How do I recommend circumventing the HR gatekeepers?
[38:05.770 --> 38:07.650]  There's two ways to answer that question.
[38:07.950 --> 38:14.110]  One way will generally land you at the behest of the queen or country, depending on which country you're in.
[38:14.930 --> 38:16.630]  That's not a good way to get around them.
[38:16.910 --> 38:18.190]  The other way...
[38:18.190 --> 38:18.850]  Sorry.
[38:18.850 --> 38:21.270]  First thing that comes to mind when dealing with HR...
[38:24.730 --> 38:34.450]  The real way to get around and not circumvent so much as sidestep the HR issues is literally to work within the confines of their rules.
[38:34.770 --> 38:34.850]  Right?
[38:34.990 --> 38:36.310]  This is yet another hack.
[38:37.210 --> 38:40.610]  HR people are generally power mongers.
[38:41.030 --> 38:45.150]  They're generally people who think they're type A personalities but aren't.
[38:46.150 --> 38:50.350]  And they set up this Byzantine set of rules that theoretically only they understand.
[38:50.710 --> 38:52.030]  And I will tell you this right now.
[38:52.210 --> 38:58.250]  You are a better intuitive processor of rules simply by being a hacker than anything else.
[38:58.670 --> 39:03.110]  Find out what their rule set is and then find the friction-free path through it.
[39:03.370 --> 39:04.870]  There is a friction-free path.
[39:04.990 --> 39:06.390]  They don't want you to know that it's there.
[39:06.850 --> 39:08.610]  They like to keep that information to themselves.
[39:08.690 --> 39:11.310]  But you intuit large systems very well.
[39:11.430 --> 39:14.490]  It's sort of one of the classic definitional hacker things.
[39:14.490 --> 39:19.530]  You can intuit a very large complex system and see how it can be flexed to your need.
[39:19.810 --> 39:23.930]  How would you feel if somebody got around that system and sent resumes to you correctly?
[39:24.470 --> 39:25.930]  I would be okay with that.
[39:26.970 --> 39:29.790]  Unfortunately, I would have to pass them back through that system.
[39:30.150 --> 39:39.930]  And should I have somebody buy me a cup of coffee and explain why they think they're the next hot shot for my team, I'd be a lot more in line with that.
[39:40.010 --> 39:41.910]  And that goes back to the professional organizations thing.
[39:43.230 --> 39:45.090]  Find out who you know or who knows me.
[39:46.230 --> 39:47.590]  Probably not the case in this room.
[39:47.710 --> 39:54.450]  But in some rooms, I'm one or two abstractions apart from almost everybody in the room.
[39:54.450 --> 39:58.350]  So you may well know somebody who knows me who can get that kind of in.
[39:58.650 --> 40:01.050]  And that would be true of wherever you were trying to get that work.
[40:01.610 --> 40:07.390]  So find out who knows who and find out a way to get on that person's agenda even for a 15-minute conversation.
[40:08.210 --> 40:08.610]  Middle.
[40:09.590 --> 40:16.590]  Do you have any advice with your professional associations, like you said, not becoming a CISP?
[40:17.610 --> 40:20.230]  Is there any advice for actually managing that trap?
[40:20.930 --> 40:23.710]  It would be great today and five years from now.
[40:23.870 --> 40:29.150]  Yeah, the best way to manage the trap really is that's a set of politics that you don't need to be involved in.
[40:29.930 --> 40:32.390]  You can be an attendee or a member.
[40:32.390 --> 40:33.750]  You don't want to be in charge.
[40:33.970 --> 40:35.430]  You don't want to be pushed to be in charge.
[40:35.430 --> 40:41.690]  You don't need to be on the board of whatever the local information security professionals group is.
[40:42.570 --> 40:43.630]  You know, just attend.
[40:43.930 --> 40:44.790]  Be a fly on the wall.
[40:44.930 --> 40:45.990]  Pick up what you can pick up.
[40:46.870 --> 40:50.850]  You know, some of those sort of nods and smiles that happen when you're in the room.
[40:50.910 --> 40:51.710]  You're like, oh, hey, I know you.
[40:52.030 --> 40:52.690]  You're here too.
[40:52.830 --> 40:53.270]  Oh, shit.
[40:53.810 --> 40:54.570]  That kind of stuff.
[40:56.870 --> 40:58.790]  That's what I'm talking about in terms of managing that.
[40:58.910 --> 41:08.010]  You don't want to become a board member of one of those groups as much as they'd love you to because that's a whole other set of politics that you've got to work with that really cuts into your leisure time.
[41:08.490 --> 41:11.030]  Spend your leisure time on whatever it is that turns your crank.
[41:11.170 --> 41:12.330]  I mean, I coach t-ball.
[41:13.470 --> 41:14.050]  So, you know.
[41:14.690 --> 41:15.110]  Yeah, I know.
[41:15.250 --> 41:17.510]  Totally non-athletic geek type coaching t-ball.
[41:18.050 --> 41:18.730]  Lots of fun.
[41:19.810 --> 41:21.290]  Spend your time wisely in other ways.
[41:22.270 --> 41:23.310]  How am I doing on time?
[41:23.870 --> 41:24.690]  Lots of time.
[41:24.930 --> 41:25.250]  Questions?
[41:26.030 --> 41:28.090]  Yeah, I got one in front and then one behind.
[41:29.670 --> 41:30.070]  Yeah.
[41:31.130 --> 41:35.950]  In the corporate world, how do you get beyond the negative connotations of being hacker-related?
[41:36.310 --> 41:37.670]  Oh, this is a good one.
[41:37.790 --> 41:41.510]  In the corporate world, how do you get beyond the negative connotations of being hacker-related?
[41:42.310 --> 41:42.510]  Shh.
[41:42.750 --> 41:43.490]  Don't tell them.
[41:45.930 --> 41:46.410]  Like...
[41:46.410 --> 41:47.350]  Well, yeah.
[41:47.490 --> 41:48.230]  They might find out.
[41:51.250 --> 41:57.150]  Really, what you've got to do is present that there's a possibility to learn from these sorts of events.
[41:58.530 --> 42:03.570]  And this, for me, represents serious and significant professional accreditation.
[42:03.930 --> 42:06.870]  And I'll give you an example because it'll help you to wrap your head around it.
[42:06.890 --> 42:10.750]  Like I said, I work in an FI, a financial institution in FI nerd speak.
[42:12.550 --> 42:15.310]  They were talking about doing a rollout of contactless credit cards.
[42:15.730 --> 42:20.170]  And I said, okay, well, we need to look seriously about what the controls we're going to have around these risks are.
[42:20.270 --> 42:21.270]  And they're like, well, what are you talking about?
[42:21.330 --> 42:23.390]  And I said, okay, which contactless credit card?
[42:23.390 --> 42:25.610]  And they named one of the companies and one of the specific technologies.
[42:25.770 --> 42:26.770]  And I'm like, okay, that's great.
[42:27.430 --> 42:29.850]  That's got about seven different ways that it's already been broken.
[42:30.210 --> 42:31.010]  And they said, what?
[42:31.730 --> 42:41.750]  And, of course, the vendor had never told the upright business types, oh, by the way, three or four years ago at the other conference, we showed them hacking this from 75 feet away.
[42:41.970 --> 42:44.910]  You know, they're like, well, it can only be read within four inches of the reader.
[42:45.430 --> 42:51.850]  Well, no, it can only be activated within four inches of the reader, but it can be read from anything that can hear a radio signal from any distance up to...
[42:51.850 --> 42:52.170]  All right.
[42:52.270 --> 42:53.310]  How far away is Voyager now?
[42:54.110 --> 42:54.670]  You know?
[42:57.610 --> 42:58.050]  It's...
[42:58.050 --> 43:01.050]  This is real credential building time, right?
[43:01.150 --> 43:11.710]  Because if you're one of those very staid, I hate to say it, CISSP SANS types, if GIAC is one of your favorite words, you're never going to be in a position to really know and understand that.
[43:11.930 --> 43:17.810]  And then going back about nine threads in the conversation, you're talking about ways to gather that credential experience.
[43:18.290 --> 43:27.230]  A great example, the province that I live in, oops, get away the country, is currently rolling out a contactless fare system for mass transit.
[43:27.710 --> 43:29.550]  They're rolling it out based on the MyFare card.
[43:31.210 --> 43:37.690]  I had a conversation with the guy and he's like, well, it's perfectly secure and gives me all this great, obviously, vendor spiel.
[43:37.750 --> 43:38.970]  I said, have you had a red team look at it?
[43:39.090 --> 43:41.510]  Are you aware of the information that's going to be released in the fall?
[43:41.510 --> 43:42.790]  It was leaked last week.
[43:43.970 --> 43:46.730]  He said, no, I hadn't heard that before, actually.
[43:47.170 --> 44:02.450]  And so that's an opening for a conversation where, yeah, it's easier because I've already got a business card that looks really nice, but that's the opening for a work with your community, help your community, show them that hacker is often a misused term by the media.
[44:02.830 --> 44:08.550]  Hacker really means the same thing that DIY meant in 1954 in Popular Mechanics.
[44:09.450 --> 44:11.090]  And that's just the world that we're out of here.
[44:11.170 --> 44:18.770]  We're the makers, we're the remakers, we're violating warranties and doing crazy things like convincing people to do things that are kind of funny.
[44:19.030 --> 44:23.350]  You know, classic hack, misdirect the output from church to the donut store.
[44:23.850 --> 44:24.570]  You ever done that?
[44:25.250 --> 44:30.970]  Get some of those orange cones, wear a safety vest, use one of the flashlights, people will go where you tell them.
[44:31.190 --> 44:32.610]  It's a hilarious hack.
[44:33.630 --> 44:40.430]  The actual cred for that is to my wife who did that after a football game in high school and it's the best story and how it was proof that I married the right person.
[44:41.630 --> 44:42.950]  There's a question behind you.
[44:54.040 --> 44:56.740]  Okay, let me summarize that question a little more briefly.
[44:56.880 --> 45:00.120]  To what extent are people suited for management or not suited for management?
[45:01.560 --> 45:10.300]  Much like the rules around who gets to be president, if you want to be president, you should be automatically disqualified from the job.
[45:10.300 --> 45:16.260]  If you want to be management, you should be automatically disqualified from being management because nobody wants that.
[45:16.520 --> 45:19.200]  And if they do, there's something horribly, terribly wrong with them.
[45:20.540 --> 45:21.980]  I don't like managing.
[45:22.240 --> 45:34.900]  Like I said, I've got, you know, a few hundred indirect reports who I have to convince to do what I want without ever actually saying, do what I say, because that only works with very, very small children.
[45:37.880 --> 45:42.360]  If you don't want to be in management, you're probably in the right place to do a really good job of it.
[45:42.780 --> 45:44.540]  Do you know about this thing called the imposter syndrome?
[45:46.080 --> 45:46.860]  This is a good one.
[45:46.960 --> 45:48.260]  The imposter syndrome is very important.
[45:48.380 --> 45:58.180]  If you think that you are so totally over your head and they're going to catch you any day now because you do not know what you're doing, you're just playing at this, you're absolutely wrong.
[45:59.120 --> 46:06.060]  I spent the last 45 minutes before I got up here absolutely freaking out that I wouldn't get a single laugh, that it would be pin drop after pin drop.
[46:07.080 --> 46:10.520]  And I got four pin drops, which is a lot less than I counted on.
[46:10.980 --> 46:12.640]  So I did well, right?
[46:12.880 --> 46:13.880]  That's imposter syndrome.
[46:14.100 --> 46:16.740]  I was convinced that I would suck.
[46:17.160 --> 46:26.080]  And instead of being okay with that, I live not okay with that, constantly balancing myself against that imposter syndrome.
[46:26.080 --> 46:31.240]  You're going to encounter people out there who know that they are the cat's ass, right?
[46:31.380 --> 46:32.900]  They are the hottest thing going.
[46:33.100 --> 46:34.980]  They are the best manager in the world.
[46:35.220 --> 46:40.220]  They've got the perfect desk with the perfect wife and the perfect kids and the perfect flower vase.
[46:40.400 --> 46:41.080]  And you know what?
[46:41.400 --> 46:42.220]  They're really not.
[46:42.400 --> 46:43.560]  They're the ones who are faking.
[46:43.740 --> 46:47.340]  And as soon as you push them a little hard, they break down completely.
[46:49.000 --> 46:54.660]  Hackers being the kind of people they are, tend to be able to take a lot more push than normal people can take.
[46:55.380 --> 47:01.460]  You're sort of... you're the 10% that actually does things in this world, as opposed to the 80-some percent that don't.
[47:03.300 --> 47:04.780]  I did not do well in math.
[47:09.380 --> 47:10.760]  Really didn't do well in math.
[47:12.180 --> 47:12.790]  Back there.
[47:18.190 --> 47:20.410]  I don't know, because they didn't exist until three years ago.
[47:22.050 --> 47:23.490]  And you know, that's the honest truth.
[47:23.610 --> 47:25.910]  We're just starting to see graduates from programs like that.
[47:25.910 --> 47:36.190]  What I can tell you about the corporate infosec world is that everyone who I know who's doing well does not have a computer or IT-related degree in their past.
[47:36.570 --> 47:38.210]  They are business degrees.
[47:38.210 --> 47:39.870]  They are accountants.
[47:39.870 --> 47:41.170]  They are auditors.
[47:41.470 --> 47:43.210]  They are liberal arts majors.
[47:43.470 --> 47:44.930]  They are geography majors.
[47:45.490 --> 47:47.330]  They are history majors.
[47:47.610 --> 47:50.050]  And poly-sci majors do really, really well in infosec.
[47:50.570 --> 47:52.450]  They are almost anything but comp-sci.
[47:52.810 --> 48:01.130]  And I haven't seen real tangible results of those first programs, other than the email that keeps showing up in my inbox telling me that I need to go.
[48:03.970 --> 48:04.590]  Up front?
[48:05.090 --> 48:13.890]  Given your educational background, how important do you think it is to, you know, is the education really one of the important things, or is the experience of them pushing more important?
[48:14.350 --> 48:18.530]  I think the most important thing would be to go and get yourself a universal education.
[48:18.950 --> 48:21.330]  Up in Canada, we call them universities rather than colleges.
[48:21.850 --> 48:23.230]  It's to get a universal education.
[48:23.230 --> 48:24.270]  You have to be able to learn.
[48:25.090 --> 48:31.090]  Most people come out of school, especially multiple years of post-secondary, completely unable to learn on their own.
[48:31.230 --> 48:31.890]  They have to be taught.
[48:33.190 --> 48:35.970]  In large part, I'm entirely self-taught.
[48:36.210 --> 48:43.910]  I do have several university-level courses behind me that deal with business stuff and economics and things that are really kind of hard to cogitate on alone.
[48:45.190 --> 48:49.770]  I don't think the education is so much important as your ability to learn and learn quickly.
[48:50.370 --> 48:57.190]  The classic statement is, you know, I tell myself this often, I don't know that particular solution today.
[48:57.470 --> 48:58.410]  Talk to me tomorrow.
[48:59.110 --> 49:01.430]  Because between now and tomorrow, I can learn it.
[49:02.370 --> 49:02.670]  Yeah?
[49:02.910 --> 49:03.770]  You actually did.
[49:03.990 --> 49:04.630]  You didn't talk to me.
[49:06.370 --> 49:06.810]  Shit!
[49:07.210 --> 49:08.690]  I was hoping nobody would notice.
[49:10.310 --> 49:11.190]  Yeah, exactly.
[49:11.490 --> 49:15.530]  I spend an awful lot of time reviewing other people's work.
[49:15.750 --> 49:17.810]  I spend a lot of time in meetings.
[49:18.130 --> 49:19.570]  I'm about 60% in meetings.
[49:20.090 --> 49:31.490]  When I say other people's work, I should say project teams, decisions that are being made by people where they're saying, you know, we need to make this risk-based decision that says, we're gonna do this terribly risky thing, but we think we've covered it off with enough control,
[49:31.610 --> 49:32.050]  so it's okay.
[49:33.050 --> 49:37.990]  I spend a lot of time managing internal and external audits, helping them understand.
[49:37.990 --> 49:38.930]  I write policy.
[49:39.630 --> 49:42.370]  So it's not infrastructure security or like technical...
[49:42.370 --> 49:44.650]  I haven't done that in years.
[49:45.510 --> 49:47.150]  Most CISOs don't.
[49:47.650 --> 49:52.070]  I should say most people who are actually doing the job of CISOs don't.
[49:52.270 --> 49:59.530]  There's a technical level job in there that's called something like director of IT security, or vice president responsible for IT security.
[49:59.730 --> 50:03.190]  And that's the person who manages technical preventative controls.
[50:03.490 --> 50:07.110]  But I'll tell you, in my experience, technical preventative controls generally don't work.
[50:07.110 --> 50:08.530]  They're incredibly brittle.
[50:09.090 --> 50:12.390]  They break the next time somebody comes out with a new market vertical for you.
[50:13.470 --> 50:15.910]  They're just... they do not play well in the real world.
[50:16.410 --> 50:22.870]  Mostly, I spend a lot of time and effort on detective controls and other sorts of compensating controls that will catch things.
[50:23.510 --> 50:29.730]  This is the classic, you can't build a perfect lock, but you can build an awfully good system to tell you when that lock was violated.
[50:30.210 --> 50:34.170]  So how do you get people to understand security that don't care about security in their personal life?
[50:35.270 --> 50:37.210]  I do not use the word security at all.
[50:37.490 --> 50:39.790]  In my day-to-day life, I do not use the word security at all.
[50:39.850 --> 50:41.070]  I talk about information management.
[50:41.470 --> 50:45.270]  And the way that I help them is by giving them tangible things that they can take home and use.
[50:46.250 --> 50:47.630]  Show them the things that are wrong.
[50:47.810 --> 50:50.710]  You know, the classic, you keep your RSA key fob with your laptop.
[50:51.010 --> 50:55.310]  Do you also put your keys in the front door of your house and just leave them there all the time?
[50:56.010 --> 50:59.610]  You know, are they above the visor in your car?
[50:59.830 --> 51:03.250]  You know, just walk them through the practical implications of it.
[51:03.550 --> 51:05.290]  Teach them, you know, this is what your kid is doing.
[51:05.490 --> 51:08.070]  You don't think your kid is violating your little net nanny program.
[51:08.350 --> 51:09.650]  Tell you what, they are.
[51:09.730 --> 51:10.510]  And here's how.
[51:10.930 --> 51:13.570]  And show them those things in a very real and tangible way.
[51:13.650 --> 51:15.510]  We do a whole session of Lunch and Learns.
[51:15.710 --> 51:25.470]  There's Lunch and Learns for people that have teenagers, Lunch and Learns for pre-teens, where we teach them everything they need to know about social networking and web two point whatever, and help them through that.
[51:25.610 --> 51:26.950]  Say, this is what Facebook is all about.
[51:27.070 --> 51:28.330]  This is what MySpace is all about.
[51:29.130 --> 51:31.710]  The kids today have no expectation of privacy.
[51:31.950 --> 51:34.650]  This is what their version of private means.
[51:34.990 --> 51:36.690]  And walk them through all that stuff.
[51:37.050 --> 51:42.390]  But it's that kind of education that works much, much better than saying no and don't.
[51:42.750 --> 51:44.690]  Because no and don't doesn't resonate with anyone.
[51:44.990 --> 51:48.530]  Most people have only got ten slots in their head for don't and no.
[51:48.530 --> 51:51.650]  And of those ten slots, they violated almost all but one of them.
[51:52.250 --> 51:55.090]  They have special places for people to violate that tenth one.
[51:56.530 --> 51:58.130]  It just, it does not play out well.
[51:58.250 --> 52:00.590]  So you give them tools that are very tangible, very visceral.
[52:01.190 --> 52:02.610]  Use biological terminology.
[52:03.410 --> 52:06.450]  Somebody wants to put their information in your repository.
[52:07.070 --> 52:08.530]  Are you okay with that?
[52:10.450 --> 52:13.230]  Have you considered protecting that transaction?
[52:15.910 --> 52:16.750]  Question over there.
[52:17.810 --> 52:25.470]  I've had the opportunity, being self-employed, to get myself into situations where I've done some tremendous security work.
[52:25.570 --> 52:25.870]  Yes.
[52:26.110 --> 52:27.690]  Very large organizations.
[52:28.630 --> 52:31.830]  And I've attempted to put them into resumes.
[52:32.210 --> 52:32.430]  Yes.
[52:32.770 --> 52:35.170]  I never seem to find the right way to do it.
[52:36.190 --> 52:37.970]  I don't want to do a two-page report.
[52:38.130 --> 52:41.690]  Yeah, you can't because often you can't quote that you worked for whoever it was.
[52:41.690 --> 52:48.850]  I mean, one of my greatest coups was that I helped a major international telecommunications company through a significant breach of their internal systems.
[52:49.070 --> 52:54.570]  There was a loss, a tangible real loss, not a lawyer made up loss, but a tangible real loss of over $14 million.
[52:55.090 --> 52:58.670]  There's three people in jail and will be in jail for another 15 years as a result.
[52:58.830 --> 53:03.050]  It involved international litigation, international cooperation amongst police forces.
[53:03.590 --> 53:06.150]  It never made the newspaper and I can't talk about it.
[53:07.750 --> 53:09.030]  It's great resume material.
[53:09.030 --> 53:09.810]  How do you write that?
[53:10.270 --> 53:11.110]  Just like that.
[53:11.990 --> 53:12.350]  And...
[53:12.350 --> 53:14.010]  Just a follow-up question if I could.
[53:14.130 --> 53:14.450]  Absolutely.
[53:15.170 --> 53:15.530]  I think...
[53:15.530 --> 53:18.390]  I presented with a scenario where I know a site's been hacked.
[53:18.510 --> 53:19.030]  I found it.
[53:19.130 --> 53:20.090]  I know where it came from.
[53:20.270 --> 53:21.070]  I know what they did.
[53:21.310 --> 53:21.570]  Yep.
[53:22.650 --> 53:24.770]  And they don't want to report it to anybody.
[53:25.210 --> 53:25.570]  Yep.
[53:27.130 --> 53:27.730]  Are you in California?
[53:28.310 --> 53:28.550]  No.
[53:29.010 --> 53:29.690]  They don't have to.
[53:32.450 --> 53:35.390]  And do please be careful doing InfoSec research on your own.
[53:36.390 --> 53:37.150]  I hate to say it.
[53:37.270 --> 53:37.830]  It's a chilling effect.
[53:38.470 --> 53:41.530]  Bad things have happened to people who have brought up other people's problems in public.
[53:42.410 --> 53:43.930]  So, kind of be careful with that one.
[53:44.090 --> 53:44.470]  Okay.
[53:45.170 --> 53:47.850]  And the unfortunate, but yes, chilling effect, especially in this country.
[53:48.550 --> 53:52.090]  This country has some rather draconian laws in that regard.
[53:53.890 --> 53:55.270]  Time for one last question.
[53:55.570 --> 53:56.130]  You already got one.
[53:56.390 --> 53:56.770]  Yeah.
[53:57.410 --> 54:00.420]  You started climbing up the ladder.
[54:00.580 --> 54:05.300]  Do you feel there's a cap without having a degree or without having a specific degree at a specific level?
[54:05.500 --> 54:06.220]  I haven't found one.
[54:07.100 --> 54:08.080]  I'm on my way up.
[54:08.180 --> 54:09.100]  I'm not at the top yet.
[54:09.740 --> 54:12.120]  I hope to be at the top within about another two years.
[54:12.420 --> 54:16.680]  Top being defined as global organization, 50,000 plus employees.
[54:17.380 --> 54:19.620]  I expect to be there within another two to three years.
[54:19.620 --> 54:20.760]  I haven't found a cap yet.
[54:21.560 --> 54:24.620]  Lack of business credentials seems to be the cap for most people.
[54:24.800 --> 54:32.900]  So, if you can go back and pick up a CPA preparatory course, there's a great way to start this process on your own for free.
[54:33.000 --> 54:34.340]  There's this thing called Personal MBA.
[54:34.540 --> 54:35.220]  Look it up on the Internet.
[54:35.440 --> 54:36.180]  Personal MBA.
[54:36.460 --> 54:40.500]  And it's essentially all the book learning that's in a standard EMBA course.
[54:41.060 --> 54:44.560]  So, it's like getting an EMBA without the piece of paper and for free.
[54:45.580 --> 54:48.480]  Later on, if you feel it's necessary, you can go back and pick up that EMBA.
[54:49.120 --> 54:50.160]  And that's my time.
[54:50.500 --> 54:51.700]  Thank you all very much.