Rick Stewart

Rick Stewart, Chief Software Technologist at DLT Solutions joins Tech Transforms to give insight on Open Source, Platform One, and DORA initiatives. Listen in as Carolyn and Mark learn about the importance of focusing on the right metrics when managing security bottlenecks.Episode Table of Contents[00:48] Old Ways of Doing Things[11:55] Security Metrics That Need Improvement[22:54] Deploying Security Metrics Using Scheduling Techniques[33:19] Continuous Authority to Operate Security MetricsEpisode Links and ResourcesRick Stewart DLT SolutionsBeyond OrderOld Ways of Doing ThingsCarolyn: Today, we get to talk to Rick Stewart, a good friend. Rick Stewart is a Chief Software Technologist at DLT for more than 34 years. Do you really want me to tell people that Rick? That makes you sound super old?Rick: No, it has some relation to the old way of doing things, traditional ways.Carolyn: He knows the old stuff and the new stuff with 34 years of diverse experience in the IT industry. He’s progressing through technical and leadership roles in telecommunications, mobile entertainment, the federal government, and the manufacturing industries. Today, Rick is joining us to talk about DevOps research and assessments, or DORA, a term that is new to me. He’ll also talk about the four key metrics for increasing efficiency and delivering service. He will discuss how Platform One has advanced the cultural transformation to DevOps. Mark: Welcome Rick. By the way, Rick started this when he was six.Carolyn: That's right. I'm going, to be honest. I've been in the industry for a while, and I have never heard the term DORA. DevOps Research and Assessments make sense. I just haven't heard the acronym. They have four key metrics for increasing efficiency in delivering service. Those metrics are deployment frequency, lead time for changes, change failure rate, and time to restore to service. Will you unpack those for us?Rick: It's interesting that you say that because I attend several different events and conferences where we have, especially in the public sector, astute people that have lots of experience.Security Metrics As a First-Class CitizenRick: They're on this journey of DevOps or in the public sector. It's more DevSecOps, bringing security up as a first-class citizen. They were talking about the things that they capture, the journey that they're on, and their improvements. On one of these occasions, DORA was brought up. I think it may be a Q&amp;A panel. It was surprising that a lot of them didn't know what this organization does, especially being so well versed in the cultural transformation, not knowing some of the things to focus on. I thought it was really important to shine a light on.Carolyn: Is it a federal organization?Rick: No, it's more of a community-based organization, an industry-based organization. We've got people like Jez Humble and Gene Kim and others that are involved with this. What they do is, they go out and they do surveys of not just the public sector, but the private sector, all organizations globally. They basically give them surveys and they talk about their experience, where they're at in the spectrum of their journey, and what they have discovered through this analysis. It's a really deep, long analysis.There's a book called Accelerate that was done by Nicole Ferguson. She has a PhD and took lots of painstaking analysis of these organizations and these teams and asked them a series of questions. What it boiled down to is there are a lot of traditional metrics that have been ingrained in the industry that are useful somewhat, becoming less useful over the years, like lines of code when we're talking about mainframe and the complexity and function points, etc. As the industry has changed into more service-oriented or even micro-service-oriented architectures, those types of metrics are less useful.Development Teams and Operations Teams in UnisonRick: So, when you're talking about a cultural transformation of getting development teams and operations teams working in unison and collaborating together, these four metrics were decidedly important to focus on in order to strive more towards that collaborative effort. These indicate the ability to deliver software with high quality and the ability to rectify any changes or security vulnerabilities and rectify them quickly. I'll go through each one of them. Deployment frequency is how often an organization successfully releases a product to production. A product in this case could be a service, could be any kind of workload, or an application. There are differences to that. There's an old saying that says, if something is difficult to do, do it more often and you'll get better at it and it will become less difficult. So this deployment frequency talks to that. You have to measure how many times you're deploying a particular change into production. That way, you can, A, determine your impact, the value you're having on your stakeholders, but also the ability to measure how frequently you can deliver that value. I'll go back and forth between the private and public sectors. The public sector industry days are very interesting to me. It’s not only because that's the space I'm working in, but more importantly, it crystallized the importance of service delivery and frequency and speed. It was a Navy captain that was giving an industry because they wanted to develop a DevOps prototype. One thing that struck me was I can't wait two weeks while I'm in the middle of the Mediterranean, potentially in a firefight, to get a release, a change to an application that's not working properly.Focusing on the Right Security MetricsRick: That manifested for me the importance of focusing on the right things. You have to look at your frequency and where you're deploying these changes. It’s not just through enhancements and value, but to rectify issues, defects, and security vulnerabilities.Carolyn: Are you seeing the government agencies embrace these four metrics?Rick: I think they've embraced a hundred different metrics, but the industry is telling them, just like it's telling them to move towards DevOps or DevSecOps, to focus more on these. Get rid of the 300-page system security procedures, that's a waste of time because you're not getting value.Carolyn: When you say the industry's telling them, who's industry?Rick: Industry would be the developers that are in the private sector, that are in the Netflixes, the AWSs, the industry leaders, the Googles. Those that can deploy changes and take advantage of disruptive technology and innovative services quickly. They are recognized as thought leaders in terms of what should be a measurement in terms of measuring teams' productivity when they're on this journey to DevSecOps.Mark: Are these standards something that the DORA organization came up with? Like you talk about the industry standards, do you know where they're getting the standards from?Rick: The deployment frequency is standard. It's always been around. You mentioned the 34 years. I've known about deployments ever since I started doing software.Carolyn: But the DORA organization sounds like it has boiled down to these four most important metrics. You're saying from industries like Netflix, like AWS, Amazon.Rick: Google.Carolyn: They've looked at best practices, the metrics that really matter, and DORA said, these are the four that matter most.Collaboration Across Multiple TeamsRick: They can link back to the collaboration across multiple teams, which is the essence of DevOps or DevSecOps. Because these teams have different disciplines, they have different priorities, they have different measurements within their own teams, and if you can measure that you're getting better at deploying more frequently, it indicates that you're collaborating more with these teams. You're getting more rapid in terms of moving that thought from code to application to delivery quicker.Mark: Are there metrics that they've come up with to determine what increasing efficiency means? Or are they kind of like work groups that look at thinking through what an organization might be dealing with?Rick: Well they're looking really at the number, the sheer metric. And they divide it into four different categories of performance. You have your elite performances, I mentioned like the Netflixes, the Googles, etc. They're deploying multiple times a day, which Mark I'm sure you know in the public sector, multiple times a day, it's like a utopia for a public sector entity. They're usually talking once every six months, once every year.They better make it successful or else they have to marshal all those resources again. You're talking about time, money, not being able to provide value, those types of things. When you're looking at the measurement of the metric itself, you're trying to categorize it to allow you to move up this hierarchy, if you're a low performer, you're maybe doing it once a week or once a month or once every six months. That's not optimum. How do you move up? You try to increase your ability to deploy faster. What does that mean?Security Metrics That Need ImprovementRick: Talk to more groups. Get them into a room. What are the bottlenecks, the areas that need improvement? How do you work together even when you're in a different company? In the public sector, you might have different contractors, and different companies doing various different pieces of this. So it's very important to foster that collaboration so that you can deploy more. That should be the goal. How do I deploy more and faster?Mark: One of the things that have me thinking is how can organizations strive to get to the next tier of performance in each of these benchmarks?Rick: Other metrics lead or feed into these four different metrics. For example, your lead time for changes, which is the next metric that they talked about. This is more developer speaking, more technical. When I commit my code saying this has passed all my testing, I've got it through my team. They've looked it over. It's passed all the tests and I've committed that branch or that version of my change onto the main version control. Previously, when you developed a release, a deployment to go to production, everybody, all your developers, would make their changes and be committed to that particular release branch.That has subsequently changed with this movement towards agile and making things more frequent, smaller deployments where each developer would have their own little branch. Once they finished their little piece of the world and passed all the regression testing, they would commit their code to the branch. Using automation, they would move that change from building the application, through test environments and pre-production, to user's test, getting approval user test, and deploying into production.Applying More AutomationRick: Getting that time faster allows you to deploy more frequently. That one feeds into the other. In order to focus on moving up the chain, you need to apply, in my opinion, more automation. These are very repetitive tasks.If you've ever developed code before or you've ever developed software, it’s the combination of artistry and engineering in a beautiful dance. Because you're trying to be an artist, you're trying to be creative. You're trying to figure out what's the most elegant way to put something together but there are certain engineering tasks that have to be done. If you don't do them, it will bite you in the rear end later on down the line.That is, constantly test, constantly scan, and constantly do the mundane tasks that allow your code not only to be elegant but to be maintainable. It’s also correct in terms of requirements and hygienic in terms of not introducing vulnerabilities.Carolyn: But that mundane consistency, you automate all that?Rick: Yes. If DevOps, DevSecOps is the movement or the journey, automation is the key ingredient to allow you to move faster.Carolyn: You feel like these four metrics are sufficient but listening to you talk, there are four big rocks. And then there's a whole bunch of metrics that fall underneath each of them.Rick: Yes. But they should be feeding into increasing your frequency, decreasing your lead time for changes, and making that smaller. Your change fail rate, you want to make that as small as possible. There are ways that you can do this with automation. Then the time to restore service or the mean time to repair, I've heard mean time to restore, mean time to resolve, mean time to remediate.Catastrophic FailureRick: So MTTR, the R is interchangeable, but it means the same thing. The change failure rate is when the DevOps, DevSecOps teams deploy into production. Was that a catastrophic failure such that you had to roll back or remove that change because you're making it worse than what it was before? Speaking of industry, I was in the telecommunications industry. We were doing a lot of white-labeled systems for the wireless industry, all the big ones, the Verizons, the AT&amp;T, etc.They have very strict procedures on when deployments occur within windows. It's usually between 2:00 AM and 4:00 AM on a Tuesday or a Wednesday, just enough to break up your week and make developers and operations miserable. Between those two times, if there was any failure deploying your new code, no matter how important it was, you back it out. You roll it back and you try again either the next day or the next week or the next window that they had. That gets grueling. What happens if you do have a major catastrophe or a major issue with your system or your new change or your fix? It could take weeks before you can get that out.Meanwhile, you're not producing any value from enhancements to that application because they stay behind the failed deployment. So you need to reduce that change failure rate, hopefully, to zero and the elite performers do this. They do this with many different methods. One most popular is a blue, green deployment. What they do there is, let's say you have version one of an application and it's running in production. Everything's fine.Security Metrics to Test Operational Functional CapabilitiesRick: Now you have version two, and you want to enhance it or fix it. You deploy version two alongside your version one deployment. One blue and one green. You can test offline your new version two to ensure that it meets the requirements. It's working properly and it scales all the different operational functional capabilities that it needs to do. Then when you're happy about that, you can switch it over or you can produce a certain amount of traffic to get real traffic to it. So make sure it behaves properly. When it does, you just stop traffic to the old version and put all the traffic to the new version seamlessly with no downtime.Carolyn: Do developers ever play games in a test environment where they blow it up on purpose so they can see how fast they can restore?Rick: It should be part of the culture and the methodology that DevOps or DevSecOps teams have. When somebody asked me, I said, "I'm a pessimistic optimist." Meaning I want things to occur properly, but I know Murphy's involved with everything. So, let's test it before we go live because if we don't test it there, it will cause havoc. Coming from that environment where you get one or two shots, once, twice a week, you want to make sure that you measure twice, cut once. That measure twice is testing in the test environment, and pre-production environment, so that when it gets to production, you're pretty confident that your change will work. It will be resilient enough to maintain production traffic.A Drift Within the IndustryRick: One other point I think is a good one, I've always advocated that pre-production environments should mirror production environments. There's been a drift within the industry in terms of developers. Well, I can develop in this environment and I can push it to this environment. It looks slightly different but I'll maintain some changes here and I'll make it work. Then when it goes in production, it might be a third different environment. That's really a fool's errand, that's going to result in a bad experience. Luckily, there's some automation that makes that gap between the differences between production and pre-production a whole lot easier and a whole lot more narrow.Mark: Speaking of automation, you've talked about this in blogs. You talked about Platform One and how it leverages new technologies and automation. Can you dig into this a little bit? First, tell our listeners what Platform One is.Rick: Platform One is an innovative Air Force environment that is built on the Kubernetes orchestration and management framework. Now I'll explain that in a second. The second one is that it requires development teams to deliver their services, and even the tools that develop their services, in containers. Containers are, you can think of them as small virtual machines that only have application needs installed in them.Mark: Like a modular approach.Rick: Think of it as a widget. From an operational standpoint, they all look like several different widgets. Each one of those widgets could be a completely different language, dependency, structures, etc. inside. But from an operational capability, it is much more efficient because you can deploy these widgets as independent, generic items.Deploying Security Metrics Using Scheduling TechniquesRick: You can deploy them using scheduling techniques that make sure that an application's needs are deployed on a host within the Kubernetes environment. It has the appropriate resources to serve that application and enough resources that it can scale if it has too many requests coming to it. It can descale or become less in order to take advantage of resources, etc. But the application itself could be myriad languages or constructs from applications. It’s really nice in terms of crystallizing or making concrete some of the notions that came out of the agile movement, which was each task that comes across a developer's desk shouldn't always be a Java application per se or pick a language because that's what the operational team can support.The notion that the best technology should be used for the task at hand really makes a developer's life a lot easier. You can pick maybe a lighter-weight language or an application to create or solve the task. Then deploy it and not worry about the operational risk of not having dependencies or anything that the application needs once it goes further in product pre-production and down into production. We're talking...

Security Metrics: Measure Twice, Cut Once with Rick Stewart

Willie Hicks, CTO of Public Sector at Dynatrace joins Carolyn and Mark to unpack the recent ATARC event: Improving the User Experience in a Zero Trust World. At this federal breakfast summit, sponsored by Dynatrace and Amazon Web Services, we heard from some of the most prominent technology leaders focused on Zero Trust including Nicole Willis, Jamie Holcombe, Mickey Iqbal, and more. Listen in as Mark and Willie give highlights and takeaways from the event. Be sure to follow the link in the show notes to see the full event On-demand!Episode Table of Contents[00:30] Guest Speakers at the ATARC Event: Improving the User Experience in a Zero Trust World[07:55] Zero Trust Should Be a User Experience Enabler[14:41] OMB Is Pushing to Move Too Fast[20:05] How to Ensure Zero Trust Does Not Disrupt the Employee User ExperienceEpisode Links and ResourcesWillie HicksSummit On-demandNicole WillisJamie HolcombeMickey IqbalGrant SchneiderTom SuderGuest Speakers at the ATARC Event: Improving the User Experience in a Zero Trust WorldCarolyn: So today we're reviewing top takeaways from ATARC 's Federal Breakfast Summit, Improving the User Experience in a Zero Trust World. Which those two things, user experience, and zero trust, are kind of a direct conflict for me, but we'll get to that. The conference was sponsored by AWS and Dynatrace, and it's available on-demand for our listeners at ATARC.org. Also, we have Willie Hicks, our Federal Chief Technologist at Dynatrace.Willie, you were a keynote speaker at the event. I'm too biased to say you were my favorite so I won't say that. I mean, everybody was really good. Jamie was super exciting. Let me just review who our speakers were. So our keynote speaker around zero trust was Grant Schneider. He brought a really interesting perspective because he's former white house. So he was the senior director of cybersecurity services. So former federal CISO, and now he's in industry at Venable. Then we had our next keynote around the user experience was the very entertaining Jamie Holcomb. He's the CIO at U.S. Patent and Trademark office. And then my favorite, Willie, Federal Chief Technology Officer here at Dynatrace. Then we had a panel that brought the user experience and zero trust together and how we reconcile those two and how they work together. And on that panel, we had Nicole Willis, Chief Technology Officer, OIG, at the U.S. Department of Health and Human Services.Is User Experience Unrelated to Zero Trust?Carolyn: Jamie came back on the panel. We had Mickey Iqbal, he's the Public Sector Solution Architect and Chief Technologist at Amazon Web Services. Willie on the panel. And then we had our moderator, Tom Suder, who's fantastic. He's been in this business so long that he had a lot of really good insights too. Now that I've given our listeners the overview of who participated, first of all, I was thrilled to see that we had a packed room. We had a standing room only, and that was really, really nice to see. It was lovely to have people in person and to be able to interact with one another personally. So, all right, let's get to the first question. Today, Mark, you're less of a co-host. I want to hear your opinions about what your takeaways were from that day. So around the user experience and zero trust, did you have any aha moments? What were your favorite moments? Tell me your feelings about the day.Mark: Well you know, from my perspective, coming from industry and Dynatrace, I think we think of end-user experience as something different related to zero trust. So we think of it differently.Carolyn: And at odds with each other.Mark: Yes. Well, I get the feeling more and more, it's more how the end-user navigates the security protocols and processes to accomplish the end goal. Which is not their problem of zero trust, which would be the agency's problem. How the End-User Navigates the Security ProtocolsMark: And so the agencies think of end-user experience in that light as opposed to we think of it in a different way as it relates to somewhat the same. But how end users are impacted by their interaction with applications on the internet and things like that. So I guess it's a little bit like that.Carolyn: Did you get the sense that's how our government thought leaders that were speaking at the summit? Is that how they think of it? Or do you think that's more about how industry and we as end-users think of it?Mark: I think that's how we think about it. I think they think about it in the former.Willie: Yes. I definitely agree.Carolyn: The government leadership. So Willie, talk to me more about that.Willie: Yes. So I agree. I think it is interesting because I think our panel, and I got to talk to the panel a little bit afterwards as well. I think that Jamie from PTO standpoint and Nicole, just by kind of how they were, not just the keynote, but how we were interacting on the panel, they actually do get it. For example, I got to have a great conversation with Nicole. It was one of those things where she was kind of talking about the service that she was trying to provide to the citizens. Because a lot of people who use HHS services and so forth, Medicare, Medicaid, those kinds of things, they might be older. They might be having a very difficult process to log into a system, to get access to a system, to get your basic information.We’re Protecting the System, Not the User ExperienceWillie: She seemed very sensitive to that, in understanding that we have to have a better user experience. And I think I got that from Jamie but at the same time, we talked about agencies as a whole and the government as a whole. There is an issue, not just zero trust. But even before this real big push for like Shields Up with CISA and all of the zero trust. We build these systems, we put up our authentication and all the things that we're going to do to protect the system, not really factoring in the customer, not really even thinking about it. It's about protecting the system. The idea is about the system, not really about the customer, don't really care. We just want to make sure we protect the system.At the end of it, we might be making the system so difficult that no one can even access it. Nobody wants to take the time, the 45 minutes it takes to set up an ID and jump through all the hurdles to get to an ID. So I think that from a larger standpoint, and just talking on the panel, they admitted that there are a lot of systems out there. A lot of public-facing, citizen-facing systems, and backend systems that need a lot more focus around the customer experience. And again, not just around zero trust, this is just in general about just the basic usability of the system, if that makes sense.Zero Trust Should Be a User Experience EnablerMark: It does, you know, I can't remember if this was in a sidebar conversation after the event or if it was during the event, But they talked about multifactor authentication and how they were almost just forced to take the plunge. And somebody said, "We're just going to do it." At the end of the day, they're like, "Oh, wow. Okay, this word works. It's not that difficult. It's not that tough for end-users."Carolyn: Well, and do you know what’s funny, is when I hear security, so zero trust is all about security to me as an end-user. And whenever I hear security, that makes me feel a little puke-y. Because I think that means that my experience is going to be really awful as an end-user, to your point, Willie. However, Willie, you make the argument at the event that zero trust can and should make the end-user, my user experience, better and make the practitioner's experience better. So there's more than one end user. There's the end-user of the systems, then there's me trying to get into the systems, and can you talk a little bit more about that? And did you get the sense that our government speakers feel the same way? That zero trust really should be a user experience enabler?Willie: Right. So, that's an excellent point. I do agree with that. And I think the panel as a whole agrees with that too. Again, if you look at the principles, the mindset around zero trust, the mindset around architecture, architecting zero trust framework, it's an all encompassing type of scenario. Understanding Your Customer’s User ExperienceWillie: It's not just like we're buying MFA or you get single sign-on and this, this and this, and you've got zero trust. It's really a whole mindset. I think Nicole actually mentioned this. With everything they do, especially with zero trust, they're thinking about user experience at the beginning of the process. So things like multifactor authentication as Mark already pointed out. When you have a robust multifactor setup, that is going to actually enable you to make your end user's life easier. Because once they log in, once they validate, whatever those multiple factors that they use to validate that user, once that I can trust you or you, and the device that you are on is a valid device, then now you can have access to this cloud application. Or you can have access to this internal system or that authentication token can be passed around.There might still be a validation process, but it should be external. You shouldn't see it as the customer. It should all be kind of going on in the background. It's constantly validating you. So I think that idea was there, but also I did counter though, the point that, yes, it should be better. But how do you know it's better if you're not measuring it? If you don't understand today your customer's user experience, how do you know it's gotten better when we implement these new systems? How do you know it hasn't gotten worse? How do you know that there really isn't a problem? I gave an example as part of my keynote. Monitoring User ExperienceWillie: I didn't mention the agency name, but several months ago I tried to set up a multifactor authentication for a system with some of my personal information on it. This was a government system. And after about 45 minutes of filling out a form, putting in my government ID, waiting for an identifying number to come back on my phone, which never showed up. Trying to go back and reestablish and start it over again. Literally after 45 minutes and then the system telling me to call this number to try to do this manually. I was like, "I'll just go in and do what I need to do." So again, do I think either this agency that I was working with just didn't know how bad the customer experience was, or they just didn't care. And my hope is that it's just they didn't know.Mark: I think that's probably it.Carolyn: I think it might be a little bit of both. Because they have to have the security in place. They have to use those systems too.Mark: Yes but they're typically technical people..Carolyn: Yes. So is Willie.Willie: Well yes, but I love the customer, so I always focus on the customer. No, but seriously, that's the one thing. To your point, it might be a little bit of both that and let me take that back. I know from experience, it probably is a little bit of both in that.Making the User Experience EasierWillie: There is this idea that, okay, we have to tolerate some bit of inconvenience to allow us to have a secure system. Now, I think what I went through was the extreme.Carolyn: Is it?Willie: Well, and unfortunately it might not be, but at the end of the day, there is this idea, you have to tolerate this thing. But I also made the point during the keynote that industry has solved some of these. Like if you look at the financial sector, for example. I used the example of trying to set up MFA on this government system versus setting up MFA on my bank account. And when I was forced to do that, obviously they had tested this system 15,000 times. Because when I went in, by the time I was forced to go for my really insecure password and I should have better passwords. But I went from that password to having to set up my MFA, I was thinking it was going to be a long process. The bank was about to put me through this long process. It took me less than 45 seconds. It took me about a minute. Most of that time was me waiting for a response back on my phone. As soon as that was over, now, literally whenever I log in, I get a text message on my phone. I hit a button, I'm logged into the system. Those kinds of things. And I think Jamie even brought up the point that at some point we need to get away from even multifactor and have more biometrics. It should become even easier like we have a thumbprint reader or something like that.OMB Is Pushing to Move Too FastCarolyn: Yes. But I don't want anybody to kill me for my eyeball so they can break into my system.Willie: Yes, you've been watching too much Netflix. I think that was that Thor, one of the Marvel movies?Carolyn: I'm sure it's more than one. So there's an article that cites a study, the article is called How Federal Agencies Can Implement a Secure and User-Friendly Zero Trust Architecture. It states that nearly four out of five federal cybersecurity decision-makers, they know there's an urgency. They want to implement zero trust. However, 87% of them say the white house and the OMB are pushing to move too fast. Mark, I know you have an opinion about this. So talk to me about that pushing to move too fast. Are they? Should they be?Mark: Yes, they should definitely be pushing. I think that the white house has to push fast because I feel like we're probably five years behind where we should be today to feel comfortable. If they don't push, then you're going to have agencies across the government be at different levels of maturity. They're going to be all over the place. So you're going to have gaps and things like that. If you leave it up to the agencies to go at their own pace, it's kind of like the concept of, you don't need it to be a hundred percent perfect, but you need it to be 75% perfect. Then we'll work on the remainder of the 25% that's not perfect and get it there. Done Is Better Than PerfectMark: So we have to push. It was almost like the way agencies adjusted when the pandemic hit, they didn't have a choice. And they had to deal with remote workforce. They had to do it. They had to digitally transform and modernize and it made them do things out of their comfort zone that I think that they have to do.So there needs to be a push. I feel like when you hear experts across the government, talk about this, that it's just got to be a very modular, agile approach to doing it and billing it. So that has technology advances and changes and things change that they can pull things in and out. They can move things around and bring things in that work together and that kind of stuff to get to where they need to be.Carolyn: Yes. Done is better than perfect because perfect never gets done, is one of my favorite quotes. And you just said something, I was going to ask you and Willi. So we think that the white house should push hard. Yes, they're pushing. If they don't, then we're never going to get started. Then you said something about a modular approach to do this well. So is that the sense that we got from our speakers at the summit, is that one of the solutions that we heard from them?Willie: So I'm thinking, and the modular approach or what I took away from the conversation and also with what Mark was saying. I think it was Jamie who has kind of taken this approach of, we need to use kind of agile development methodologies in this process. Minimum Viable SecurityWillie: In the agile mindset, there's this idea of the MVP, the minimum viable product. This is really something that we see a lot of an industry, kind of getting that minimum built product out there to get into the market. Then start iterating through functionality and fixes and so forth as you find them and improve the product rapidly. Rapid improvement of the product.I think what Jamie was kind of alluding to was this idea of minimum viable security, where you've got to start somewhere. We can't just plan and nothing ever gets done. But get the minimum viable out there and then start iterating through basically building that framework with a more agile type process. Also this would impact the end-user. We talked about customer experience. Learning from these first iterations, what worked, what didn't work, how do we make it better? Obviously, you have to make it secure enough. You don't want to just leave the gates open. You don't want to put something out there that is insecure. But we're never going to reach a point where it's just Nirvana, everything's in place. Everything's secure. Nobody's ever going to get into our systems because that's just fallacy. I mean, this is an arms race. As soon as we find some way to, secure a system, there are hundreds and thousands of hackers out there. State-sponsored ones, people living in their basements, whatever, all trying to break into these systems. So it's just kind of back and forth. So we've got to constantly iterate. We've got to constantly build on what's worked in the past and what didn't work in the past. That's kind of what I took away.How to Ensure Zero Trust Does Not Disrupt the Employee User ExperienceMark: I think those are two things that work against each other. Because I have to imagine there's a tremendous amount of pressure on your average federal government agency, CIO and CSO, to do it right, to plan and make sure it's right. Because some of these agencies, they don't have room for error. We've heard this, not just on the panel at the event, but we've heard this from past podcast guests that some of these agencies, they can't fail. The attacker keeps coming at them and they have no margin for error.Carolyn: But isn't that why we do like sandboxing and we set up staging servers and we run the scenarios? Let's fail and fail fast and do it in a safe environment that's not out in the wild.  We've addressed this a little bit, but what are the steps to take to ensure that zero trust does not disrupt the employee user experience?Willie: My personal take on it. This is kind of what I talked about in my keynote. First of all, you've got to measure, you've got to observe, you've got to know what your experience is. So observation and testing. Something we are notoriously bad at unfortunately, and we've seen this time and time again where we don't do sufficient testing of a new product, to the user experience. Like if I'm implementing a new authentication system, whatever it might be, test it, have simulations run quality checks....

Improving the User Experience in a Zero Trust World: Event Recap with Willie Hicks

Bob Stevens

This week, Carolyn is joined again by Bob Stevens, AVP Public Sector at GitLab, this time to talk about the power of hyperautomation. Listen in as Carolyn learns what can be gained through fast, accurate application security. Episode Table of Contents[00:32] What is Hyperautomation[09:02] What Has Changed in HyperautomationEpisode Links and ResourcesBob StevensMalcolm Gladwell: BlinkWhat is HyperautomationCarolyn: I'm excited to welcome back Bob Stevens, Area Vice President of Public Sector at GitLab. Bob is a seasoned veteran in public sector technology with over 36 years of experience.As the AVP at GitLab, he is responsible for helping government organizations become more productive, efficient, and effective. Bob has experience on both the industry and the government side of things. Prior to industry, he served in the United States Air Force as a computer specialist at the White House Communications Agency.Today, we are going to talk about artificial intelligence, machine learning, and what hyperautomation is exactly. Why Bob thinks it will be 2022's biggest trend. Bob, welcome back to Tech Transforms.Bob: I'm happy to be here. Thank you. Appreciate it.Carolyn: I'd like to talk about an episode that you just did with GovExec Daily. And on this episode, you mentioned that hyperautomation will be 2022's biggest trend. I'm going to be honest. I haven't really heard hyperautomation. And I get automation. I can deduce what hyperautomation is, but I would love for you to explain it to me. What's the difference between automation, hyperautomation, DevOps, all of that?Bob: Yes, I mean, it's the strict definition of the word. It's rapidly identifying, vetting in automated processes in order to produce whatever it is that you're working on as fast as you possibly can. And it trends today because if you think about the government space, they have a lot of compliance issues that they need to deal with. The Benefits of HyperautomationBob: If they can automate those compliance processes and ensure that when they build software, in the end it's going to be compliant and they don't have to go back and vet it. I mean, that's going to save them a world of time.Carolyn: Are you talking about missed compliances, automating some of those missed controls? There's 300 of them, I think.Bob: Yes, those. I think you're talking about FedRAMP. Carolyn: Yes. One of. Or authority to operate has all of those. Right? I mean, I don't know all the details.Bob: Yes, no. There's the STIGs. That the government has to put all software through and that's all about compliance. The government has to get the authority to operate, ATOs, for everything that they run.Carolyn: And renew them every two or three years.Bob: Or sooner. It depends on how much of a change occurred in the application. If you can hyperautomate all of that by the use of AI or machine learning. Again, and so by the time you produced that software, all those compliance issues are addressed. You know they're addressed because you've got confidence in the system and the way that it was done. It didn't require as little human intervention as possible, which is unfortunately, where some mistakes are injected.Then you've saved a world of time and you've made life really, really easy for the folks that are doing the development. As well as the folks that are using the applications in the end. Because they don't have to sit and wait to get the authority to operate, which sometimes can take a year.The Bad News: We Haven’t Tried HyperautomationCarolyn: Is the differentiator between automation, DevOps, and hyperautomation really adding in, automating those compliances? And are you telling me that that hasn't happened before now?Bob: Unfortunately, it has not happened. I mean, that's evident by the fact that the government still has to produce ATOs and they still are doing STIGs at the end of the development cycle. Unfortunately, it hasn't happened. I think the government will embrace it and has started to embrace it. And therefore, will embrace hyperautomation, otherwise referred to as DevOps automation. Because it's really during the DevOps process that all that automation occurs. But it is going to continue to have focus.Compliance is just one area. Security is another one. If I can ensure that when I'm done with my software development, it's free of vulnerability or known vulnerabilities. Then again, the developers can help the security folks be more supportive of those applications and getting them out to users faster, rather than having to put them through some other processes or manual processes in the end. Hyperautomation, it's not going to go anywhere. It's only going to build and become more important for everybody.Carolyn: What's made it a thing now? First, my head's still spinning that we haven't automated a lot of these controls. But what's made it a thing now? Are there new tools coming online or did somebody just go, "Oh, you know what would be a good idea?"Bob: It's a combination of both. It's the collision of DevOps with compliance built-in. Just having the ability to do that. This gets back to what we spoke about last time, which is the building of a platform, where all 10 aspects of the development life cycle are incorporated into one platform. Misconceptions About How Hyperautomation Can Be UsedBob: And now I can start to include things, like ensuring that code is vulnerability-free when it's complete. Ensuring that I've met all compliance requirements during the process, rather than waiting till the end and doing all the tests. It's a combination of both. It's new tools, new capabilities, as well as the fact that somebody said, "Hey, wouldn't it be a great idea to combine these?"Carolyn: Yes. Right. Why haven't we been doing this in like forever? Are there any misconceptions about how hyperautomation can be used?Bob: Well, I'd love to say that it's going to be the end-all, be all for everything, but it's not. It never is. And they'll always require some manual intervention at some point or some additional thought that needs to be required. But that just means we get to continue to iterate on it, which is part of the GitLab culture. We put things out in small batches and then we iterate them in order to get them closer to perfection. Rather than wait for perfection before we introduce whatever it is that we're working on.Carolyn: I think you already kind of answered this, but is there a point where DevOps and hyperautomation overlap? Are they kind of the same thing? Are they two sites? How do they work together?Bob: Yes. I think there's overlap, which is why I was saying that it's also referred to as DevOps automation.Carolyn: Yes. It is the same thing, kind of?Bob: Yes.Carolyn: Okay. You did the interview just this February of 2022 with GovExec Daily. Do you think much has changed in hyperautomation, just even in the last two to three months?What Has Changed in HyperautomationBob: I think it has. I can tell you just from a GitLab perspective, you can now use our tool for some of those compliance, automated compliance processes that we talked about.Carolyn: What kind of lift is that to get, for example, GitLab to make it so the government will accept that automation?Bob: Yes. That's a good question. You know what? I have not been through that process yet. Carolyn: But I would imagine you got to do an ATO kind of process on the automation side, so the government can accept it. Right? Bob: Yes, no, that's true. I mean, they take our software and put it through the ATO process. What tool could you use to put ours through that would give us an ATO in the end? It's to your stacking tools, upon tools, upon tools.Carolyn: Yes. Or maybe it's just eyeballs on it saying, "Yes, this works."Bob: Yes. Again, back to our culture. I mean, transparency is key and we're going to be 100% transparent with the government or any entity that uses our technology. And we're going to show them exactly what's happening under the covers so that they're fully aware and can make their assessments.I already know the government is embracing. Just as an example. I mean, they're required to produce a software bill of materials in the end. Because a developer can pull libraries from anywhere, it's important to build that software bill of materials in order to assure compliance. Well, our tool will build it for you.AI and Machine Learning’s Part in HyperautomationBob: We'll tell you where all those libraries were pulled from and produce the list. So that you don't have to go back or keep track or do some sort of manual process. I can tell you the government has embraced that. I mean, they want that to be an automated process. They don't want somebody going back through what could be hundreds of thousands of lines of code to figure out where did it actually come from?Carolyn: Yes. I mean, talk about a security risk, to not know everything that was involved in building it. And then I would imagine, if you've got a tool that builds your SBOM, it's got to be aware as things get updated. The next version of the software, that's part of it.Bob: Yes. I mean, that's where AI and machine learning really play a major part. Because you're right. We've got to know about every library that can be discovered out there and was written.Carolyn: My chief technologist, Willie Hicks, likes to correct me when I interchange machine learning and AI. Is one used as part of this process more than the other? Do they both have their place? Because you've mentioned both, machine learning and AI. Bob: Yes. I mention them because they're part of hyperautomation. I'm not going to tell you I'm an expert on either one of them. And of course, they can often have different definitions or be used interchangeably. I think to answer your question, I'm going to say it depends. Depends on who you're talking to at that particular time.BlinkCarolyn: That makes sense. Well, we are coming up against time again. I'm going to thank you for your time. But before I let you go, I want to throw some more tech talk questions at you. I won't give you the same tech talk questions that we did last time. Let's go with books. Who was the author that you mentioned last time?Bob: James Patterson.Carolyn: Okay. Do you like Tom Clancy too? Sorry. He makes me think of Tom Clancy.Bob: I have read Tom Clancy. Honestly, he uses too many words, so I don't read.Carolyn: Right? You can skip a whole chapter and not miss the story. But okay, good. On the same page there. But do you have a favorite genre of books? Is it thriller?Bob: Well, it is the criminal thrillers. Those are interesting to me because I guess, maybe that's the way my mind works. I'm trying to figure out what the end is long before I get to the end. I think that's what engages me quickly. I also like any leadership book that can help you be better.Carolyn: Do you have a favorite or some favorites?Bob: Yes. One of my favorites is Malcolm Gladwell’s Blink. I know people like to go to his Tipping Point, but I think Blink is the best one. Blink is really all about you trusting your gut. Because if you've done something for long enough, you're an expert. Therefore, you should trust your instincts. And I don't think that happens all the time. I think people question themselves and others. And I just think that book does a really good job of leading you towards trusting you.IntuitionCarolyn: Yes, I agree. I mean, I think that we have an intuition. That intuition gets a bad rap. That it's not knowledge, but it is. It's knowledge that we've built up over the years that I think we can respond to faster than our neat computers that sit on top of our shoulders can compute. We've got that knowledge somewhere that we've gained over the years. And maybe it is even encoded into us through centuries of our ancestors learning to run from the bear.Bob: Yes. I've heard. For me, it's wisdom. That's what we've gained is wisdom.Carolyn: Yes. There we go. That's a better word.Bob: Yes. We need to trust that wisdom. We also need to impart that wisdom. That's part of our responsibility to our coworkers or our families, friends, whatever, whoever it is that you're engaged with.Carolyn: Well, great. You've inspired me to go back and revisit Blink because it's been a while. Well, Bob, thanks again for joining us and taking the time to share some insights with our listeners. Listeners, thanks for joining us. Please be sure to visit the website for the show notes and references that Bob made. We also want to thank our sponsors Dynatrace. Visit dynatrace.com to learn more about how you can literally transform faster, smarter, and easier. Please share and like this episode. 

<p>This week, Carolyn is joined again by Bob Stevens, AVP Public Sector at GitLab, this time to talk about the power of hyperautomation. Listen in as Carolyn learns what can be gained through fast, accurate application security. </p><h2>Episode Table of Contents</h2><ul><li>[00:32] What is Hyperautomation</li><li>[09:02] What Has Changed in Hyperautomation</li></ul><h2>Episode Links and Resources</h2><ul><li><a href="https://www.linkedin.com/in/bob-stevens-1237564/" rel="noopener noreferrer nofollow" target="_blank">Bob Stevens</a></li><li><a href="https://www.amazon.com/Blink-Power-Thinking-Without/dp/0316010669" rel="noopener noreferrer nofollow" target="_blank">Malcolm Gladwell: Blink</a></li></ul><h2>What is Hyperautomation</h2><p>Carolyn: I'm excited to welcome back Bob Stevens, Area Vice President of Public Sector at GitLab. Bob is a seasoned veteran in public sector technology with over 36 years of experience.</p><p>As the AVP at GitLab, he is responsible for helping government organizations become more productive, efficient, and effective. Bob has experience on both the industry and the government side of things. Prior to industry, he served in the United States Air Force as a computer specialist at the White House Communications Agency.</p><p>Today, we are going to talk about artificial intelligence, machine learning, and what hyperautomation is exactly. Why Bob thinks it will be 2022's biggest trend. Bob, welcome back to Tech Transforms.</p><p>Bob: I'm happy to be here. Thank you. Appreciate it.</p><p>Carolyn: I'd like to talk about an episode that you just did with GovExec Daily. And on this episode, you mentioned that hyperautomation will be 2022's biggest trend. I'm going to be honest. I haven't really heard hyperautomation. And I get automation. I can deduce what hyperautomation is, but I would love for you to explain it to me. What's the difference between automation, hyperautomation, DevOps, all of that?</p><p>Bob: Yes, I mean, it's the strict definition of the word. </p><blockquote>It's rapidly identifying, vetting in automated processes in order to produce whatever it is that you're working on as fast as you possibly can. And it trends today because if you think about the government space, they have a lot of compliance issues that they need to deal with. </blockquote><h3>The Benefits of Hyperautomation</h3><p>Bob: If they can automate those compliance processes and ensure that when they build software, in the end it's going to be compliant and they don't have to go back and vet it. I mean, that's going to save them a world of time.</p><p>Carolyn: Are you talking about missed compliances, automating some of those missed controls? There's 300 of them, I think.</p><p>Bob: Yes, those. I think you're talking about FedRAMP. </p><p>Carolyn: Yes. One of. Or authority to operate has all of those. Right? I mean, I don't know all the details.</p><p>Bob: Yes, no. There's the STIGs. That the government has to put all software through and that's all about compliance. The government has to get the authority to operate, ATOs, for everything that they run.</p><p>Carolyn: And renew them every two or three years.</p><p>Bob: Or sooner. It depends on how much of a change occurred in the application. If you can hyperautomate all of that by the use of AI or machine learning. Again, and so by the time you produced that software, all those compliance issues are addressed. You know they're addressed because you've got confidence in the system and the way that it was done. It didn't require as little human intervention as possible, which is unfortunately, where some mistakes are injected.</p><blockquote>Then you've saved a world of time and you've made life really, really easy for the folks that are doing the development. As well as the folks that are using the applications in the end. Because they don't have to sit and wait to get the authority to operate, which sometimes can take a year.</blockquote><h3>The Bad News: We Haven’t Tried Hyperautomation</h3><p>Carolyn: Is the differentiator between automation, DevOps, and hyperautomation really adding in, automating those compliances? And are you telling me that that hasn't happened before now?</p><p>Bob: Unfortunately, it has not happened. I mean, that's evident by the fact that the government still has to produce ATOs and they still are doing STIGs at the end of the development cycle. Unfortunately, it hasn't happened. </p><p>I think the government will embrace it and has started to embrace it. And therefore, will embrace hyperautomation, otherwise referred to as DevOps automation. Because it's really during the DevOps process that all that automation occurs. But it is going to continue to have focus.</p><p>Compliance is just one area. Security is another one. If I can ensure that when I'm done with my software development, it's free of vulnerability or known vulnerabilities. Then again, the developers can help the security folks be more supportive of those applications and getting them out to users faster, rather than having to put them through some other processes or manual processes in the end. Hyperautomation, it's not going to go anywhere. It's only going to build and become more important for everybody.</p><p>Carolyn: What's made it a thing now? First, my head's still spinning that we haven't automated a lot of these controls. But what's made it a thing now? Are there new tools coming online or did somebody just go, "Oh, you know what would be a good idea?"</p><p>Bob: It's a combination of both. It's the collision of DevOps with compliance built-in. Just having the ability to do that. This gets back to what we spoke about last time, which is the building of a platform, where all 10 aspects of the development life cycle are incorporated into one platform. </p><h3>Misconceptions About How Hyperautomation Can Be Used</h3><p>Bob: And now I can start to include things, like ensuring that code is vulnerability-free when it's complete. Ensuring that I've met all compliance requirements during the process, rather than waiting till the end and doing all the tests. It's a combination of both. It's new tools, new capabilities, as well as the fact that somebody said, "Hey, wouldn't it be a great idea to combine these?"</p><p>Carolyn: Yes. Right. Why haven't we been doing this in like forever? Are there any misconceptions about how hyperautomation can be used?</p><p>Bob: Well, I'd love to say that it's going to be the end-all, be all for everything, but it's not. It never is. And they'll always require some manual intervention at some point or some additional thought that needs to be required. But that just means we get to continue to iterate on it, which is part of the GitLab culture. We put things out in small batches and then we iterate them in order to get them closer to perfection. Rather than wait for perfection before we introduce whatever it is that we're working on.</p><p>Carolyn: I think you already kind of answered this, but is there a point where DevOps and hyperautomation overlap? Are they kind of the same thing? Are they two sites? How do they work together?</p><p>Bob: Yes. I think there's overlap, which is why I was saying that it's also referred to as DevOps automation.</p><p>Carolyn: Yes. It is the same thing, kind of?</p><p>Bob: Yes.</p><p>Carolyn: Okay. You did the interview just this February of 2022 with GovExec Daily. Do you think much has changed in hyperautomation, just even in the last two to three months?</p><h2>What Has Changed in Hyperautomation</h2><p>Bob: I think it has. I can tell you just from a GitLab perspective, you can now use our tool for some of those compliance, automated compliance processes that we talked about.</p><p>Carolyn: What kind of lift is that to get, for example, GitLab to make it so the government will accept that automation?</p><p>Bob: Yes. That's a good question. You know what? I have not been through that process yet. </p><p>Carolyn: But I would imagine you got to do an ATO kind of process on the automation side, so the government can accept it. Right? </p><p>Bob: Yes, no, that's true. I mean, they take our software and put it through the ATO process. What tool could you use to put ours through that would give us an ATO in the end? It's to your stacking tools, upon tools, upon tools.</p><p>Carolyn: Yes. Or maybe it's just eyeballs on it saying, "Yes, this works."</p><p>Bob: Yes. Again, back to our culture. I mean, transparency is key and we're going to be 100% transparent with the government or any entity that uses our technology. And we're going to show them exactly what's happening under the covers so that they're fully aware and can make their assessments.</p><p>I already know the government is embracing. Just as an example. I mean, they're required to produce a software bill of materials in the end. Because a developer can pull libraries from anywhere, it's important to build that software bill of materials in order to assure compliance. Well, our tool will build it for you.</p><h3>AI and Machine Learning’s Part in Hyperautomation</h3><p>Bob: We'll tell you where all those libraries were pulled from and produce the list. So that you don't have to go back or keep track or do some sort of manual process. I can tell you the government has embraced that. I mean, they want that to be an automated process. They don't want somebody going back through what could be hundreds of thousands of lines of code to figure out where did it actually come from?</p><p>Carolyn: Yes. I mean, talk about a security risk, to not know everything that was involved in building it. And then I would imagine, if you've got a tool that builds your SBOM, it's got to be aware as things get updated. The next version of the software, that's part of it.</p><p>Bob: Yes. I mean, that's where AI and machine learning really play a major part. Because you're right. We've got to know about every library that can be discovered out there and was written.</p><p>Carolyn: My chief technologist, Willie Hicks, likes to correct me when I interchange machine learning and AI. Is one used as part of this process more than the other? Do they both have their place? Because you've mentioned both, machine learning and AI. </p><p>Bob: Yes. I mention them because they're part of hyperautomation. I'm not going to tell you I'm an expert on either one of them. And of course, they can often have different definitions or be used interchangeably. I think to answer your question, I'm going to say it depends. Depends on who you're talking to at that particular time.</p><h3>Blink</h3><p>Carolyn: That makes sense. Well, we are coming up against time again. I'm going to thank you for your time. But before I let you go, I want to throw some more tech talk questions at you. I won't give you the same tech talk questions that we did last time. Let's go with books. Who was the author that you mentioned last time?</p><p>Bob: James Patterson.</p><p>Carolyn: Okay. Do you like Tom Clancy too? Sorry. He makes me think of Tom Clancy.</p><p>Bob: I have read Tom Clancy. Honestly, he uses too many words, so I don't read.</p><p>Carolyn: Right? You can skip a whole chapter and not miss the story. But okay, good. On the same page there. But do you have a favorite genre of books? Is it thriller?</p><p>Bob: Well, it is the criminal thrillers. Those are interesting to me because I guess, maybe that's the way my mind works. I'm trying to figure out what the end is long before I get to the end. I think that's what engages me quickly. I also like any leadership book that can help you be better.</p><p>Carolyn: Do you have a favorite or some favorites?</p><p>Bob: Yes. One of my favorites is Malcolm Gladwell’s Blink. I know people like to go to his Tipping Point, but I think Blink is the best one. Blink is really all about you trusting your gut. Because if you've done something for long enough, you're an expert. Therefore, you should trust your instincts. And I don't think that happens all the time. I think people question themselves and others. And I just think that book does a really good job of leading you towards trusting you.</p><h3>Intuition</h3><p>Carolyn: Yes, I agree. I mean, I think that we have an intuition. That intuition gets a bad rap. That it's not knowledge, but it is. It's knowledge that we've built up over the years that I think we can respond to faster than our neat computers that sit on top of our shoulders can compute. We've got that knowledge somewhere that we've gained over the years. And maybe it is even encoded into us through centuries of our ancestors learning to run from the bear.</p><p>Bob: Yes. I've heard. For me, it's wisdom. That's what we've gained is wisdom.</p><p>Carolyn: Yes. There we go. That's a better word.</p><p>Bob: Yes. </p><blockquote>We need to trust that wisdom. We also need to impart that wisdom. That's part of our responsibility to our coworkers or our families, friends, whatever, whoever it is that you're engaged with.</blockquote><p>Carolyn: Well, great. You've inspired me to go back and revisit Blink because it's been a while. Well, Bob, thanks again for joining us and taking the time to share some insights with our listeners. </p><p>Listeners, thanks for joining us. Please be sure to visit the website for the show notes and references that Bob made. We also want to thank our sponsors Dynatrace. Visit <a href="http://dynatrace.com" rel="nofollow" target="_blank">dynatrace.com</a> to learn more about how you can literally transform faster, smarter, and easier. Please share and like this episode. </p>

Hyperautomation with Bob Stevens

Sara Jones

Sara Jones, CEO of InclusionPro joins Carolyn and Mark to talk about all things diversity, equity, and inclusion. Sara explains gaps in authenticity and perception and gives tech leaders everywhere new goals to strive for when it comes to company culture.  Episode Table of Contents[00:54] Why We Always Go Back to Company Culture[10:38] How Leaders Respond to Employees’ Desire[23:03] What Attracts People of Color to Apply[30:54] Why Leaders Avoid the Important Things About Company Culture[41:37] What Technology Can Never ReplaceEpisode Links and ResourcesSara JonesInclusive Research and the Authenticity GapTED Talk: My story of love and loss as a transracial adopteeSheTechSUU Women In TechSorenson CommunicationsAriel AlternativesBattlestar GalacticaWhy We Always Go Back to Company CultureCarolyn: Today I am really happy to have Sara Jones with us. Sara's a friend and we've spoken before. Almost all of our guests, even though we're talking about tech, they always go back to culture. We're going to talk about that with Sara today.Sara Jones is the CEO of InclusionPro. She has over 20 years of experience in technology, business development, law, and leadership. You were a practicing attorney, right Sara?Sara: For 10 years. I'm still recovering.Carolyn: So as the CEO of InclusionPro, her mission is to guide leaders in building inclusive company culture that promotes team performance and team innovation. She's written a book recently called Inclusive Leadership and the Authenticity Gap, that we get to talk about today. Sara: Thank you. And this is a fun opportunity for me to merge my love of technology with diversity, equity, and inclusion. As most folks know, it is pretty hard to do. I've had a couple of decades talking about this, so hopefully, we can share some really great learnings. Most importantly, I think for the folks listening that might be thinking "DEI again."Carolyn: Which stands for?Sara: Diversity, Equity, and Inclusion. A lot of things have shifted. I think a lot of folks come to this type of conversation with the old thinking in mind. I'd just like to invite listeners to get rid of what you know. Just be open to hearing some new thoughts around diversity, equity, inclusions, and things that we're able to do now that we weren't able to do even five years ago. That's my little plug for saying, "Open-minded today?"InclusionProCarolyn: That leads really nicely into my first question about being a recovering attorney, your love for tech. What inspired you to create InclusionPro?Sara: InclusionPro is the end of a long 20-year journey having diversity, equity, inclusion as part of my personal career journey. Now, it may not be part of everyone's and a significant part of that is because I did start in patent law. Having an engineering degree and a law degree, put me in an industry that had only 5% women and people of color. I get a lot of people that are like, "Oh, our industry has no women." I'm like, "Yes, I've been there."I actually know what it's like. It's not like I came from academia or some area that was just flushed with a lot of diversity. I have lived this and I understand the impacts of it at a very personal level. But I also have been an executive. I know the challenges of being an executive, those operational aspects and how it really works in business.There's some big misalignments that can happen that we need to talk about when we get to this idea of authenticity. What is the individual need versus the larger organizational needs? Those can be very complex, very hard. I think it's something unique that I've been able to understand over my time. That makes me uniquely positioned to be able to help executives in this journey where most of them haven't been in this conversation.I think white men are more recently joining the conversation, which is very exciting. But you got a lot of employees saying, "What about social justice? What about this? I'm not seeing this statement. Where's this ERG, where's this, you're not committed."How Company Culture Makes It Challenging to Be a LeaderSara: It can be really challenging to be a leader. Being able to frankly, make a full-time living, doing diversity, equity, inclusion, it's not something I could have ever imagined would've happened 20 years ago. Happily, here we are and people are willing to invest the time and energy into doing this. I'm just thrilled that I can do this full-time and bring all that knowledge into the companies.Mark: I'd really like to understand what you think that means and what we're doing. I was a little confused at first by the use of authentic or authenticity here.Carolyn: I'm really interested to know what it means for the employee, for us, for me and why it matters to the bottom line for the company. I think a lot of times, that's what creates change. If it helps the bottom line, then we'll do it. I don't know if there's a tie in there.Sara: What's interesting is that's actually the number one thing that executives want. When I work with an executive team, we actually go through an exercise that asks them, "What is the thing that you most desire out of all of these strategic outcomes?" So think about that. That's not actually a bottom-line conversation.I, as an executive and a leader, would really like to be able to do this. It’s not because it's what we've always been saying is the right thing to do. We all know that. Let's just move forward past that because people aren't doing it. At the core, what I find is when you get leaders in a space where they can be self reflective, they actually just want to be themselves.An Angel Double PositionSara: It's so bizarre, but they want to be humanized too. They want to be able to try, and if they may make a mistake, executives get this kind of spotlight on them. We can debate the word unfair, but they have a spotlight on them. Even if they make a small mistake, people are going to notice and be like, "Those people, they don't get it. How can they be so disconnected?" Et cetera, et cetera. Imagine what that starts to do as leaders are trying to learn.Let's say you're a white man. You've recently started learning about diversity, equity, inclusion, and you have folks that are expecting you to be perfect at it. That's a lot of pressure for leaders. By the way, I'm not perfect either. So we've created this interesting dynamic, not necessarily recently, but I think for leaders having to be on guard and in this angel double position.Mark: Maybe more so for publicly traded companies.Sara: Yes, public, but even private companies. This is any culture where leaders have this pressure.Carolyn: Even government, I'm thinking about our defense leadership. I feel like they almost can't afford to be authentic.Sara: That's exactly right. Now you're thinking about the give and take of what I am allowed to say. Do I have the freedom to say? How do you shift that? What happens is when you really curate the words that you say, you actually stop communicating. You stop having conversations with people and say, "If that's the reaction I'm going to get, I'm just not even going to try."How Human Connection Stops in the Company CultureSara: So the learning stops, the engagement stops, the human connection stops in the company culture. That's been the whole problem to begin with. If we would just get together in a room, sit down and be able to have conversations, actually knowing and expecting people to make mistakes. Then how do we help people through that and help each other learn?By the way, it's not just white men that are going to make mistakes. It's going to be people of color to make assumptions, it's going to be, LGBTQIA identifying people. We're all going to make mistakes because we're all human. We've created this interesting boundary around what's permissible and what's not permissible. It's really slowed down our ability to change culture within leaders or companies.Now, what I'm not saying is say whatever you want, that's not what I'm saying. What I'm saying is that authenticity, the goal to reach that is really a journey. It's really like "We're going to help each other. We're going to learn side by side, because I, as the executive, don't know everything. You, as the new employee don't know everything either and it's okay, we're going to help each other out."Now it's more of a partnered experience rather than what would be considered a top down. The leaders need to model or grassroots because neither works by itself alone. That's an example of the shift that enables more people within an organization to really be more authentic and reduce the misalignments that can help.Carolyn: Is the authenticity gap more in the leadership or in the employees or everybody?How Leaders Respond to Employees’ DesireSara: I would say it's how leaders respond to employees' desire for more inclusion. There's actually many options available to leaders. If they are not in touch with the way to get that true connection with their employees, they're more likely to create an authenticity gap. They're more likely to have people say, "They're doing it to check the box. They don't really mean it. They're doing it for marketing reasons, but they don't actually believe it." It's that sort of sentiment that you're trying to reduce. There's methods that produce that and there's also methods that create more authenticity.Carolyn: I absolutely see how being authentic is good for your soul. Is it good for your company?Sara: Yes. We're in the great resignation period. We have had some pretty rough business experiences. I think executives are just scrambling right now to figure things out. Some are saying, "I can't afford right now to do diversity, equity, inclusion." In my mind, if you're thinking of diversity, equity, inclusion, as something on top of your day job, you're probably thinking about it wrong in the first place.It's really how we show up, how we make decisions, how we grow the business. It is not about just keeping employees happy. If you're just trying to satiate employees and that's very patronizing and it is felt, they know. They're not dumb. They know when leaders are just doing it to make it seem like they're doing it, but they're not really committed. The teams I work on usually have very genuine interests. I'm actually not working with folks that are just talking the talk. If they're talking the talk, I guarantee they will not hire me.How to Make an ImpactSara: That's just a fundamentally easy thing for me as a DEI consultant, to know who's genuinely committed, who wants to do the work, and who's not interested in doing it. My day-to-day is really more focused on those organizations and what they can do to make an impact.I'm actually seeing the work going on inside of the organization. Some of that's a little bit more invisible to folks on the outside. That's the leadership challenge right there, it’s that communication piece and things like that. I don't necessarily go and approach, and says, "I look at the executive team or boardroom and I'm diversifying now”. You're going to get a lot of backlash."That's absolutely not my approach. From an executive leadership standpoint, we know how hard it is to keep the ship running. Having a lot of changeover at the top is just not smart. So what is the learning, the growth and cap, and capacity we start to build on the leadership team so they can start to make decisions in a more deep, inclusive way? That's when you're going to start to see the real authenticity happen.Sometimes it takes a year or two for change to happen. So if we're looking for immediate change, again it is reactive. What I'm trying to do is get folks to move from reactive to intentional. Again, we went from decades of "Let's invite a woman to speak and talk about her gender". How much did that make us mad? We're like, "Oh my gosh, I have a brain. Please let me showcase my talents, not talk about what it's like to be a woman".A Company Culture Where a Person of Color Can ThriveSara: We want the same thing as men. It's not really that different, the things that I want for my career versus what a man wants in his career. So whether that's a person of color or anyone, we've got to get people better at seeing genius in a wider range of forms. That's the learning that leaders have to do. It’s to be able to say, you know, cybersecurity experts, don't just look one way. They don't talk one way or solve a problem one way, they actually solve it in a lot of different ways.If they don't have that exposure, if they've not worked with a group of diverse thinkers, they're very unlikely. They're much more likely to hire, like if they really want to diversify, somebody based on an optic characteristic rather than an internal skills. It is ultimately the right way to hire whichever anyone wants.Mark: How do we get more women and minorities involved in STEM early? By the way, getting people involved in STEM early doesn't mean that in a year you're now seeing results. You're probably seeing results a decade later. Something that I'm struggling with, as our company at Dynatrace grow, we are looking for diverse candidates that we would like to hire. I'm looking at the candidate pool and I see a disproportionate amount of white males in the candidate pool in technology.I don't know how I can change that. It's significant. I've worked at companies in the past who are heavily involved in STEM and things like that, but I don't feel we're seeing the results of those efforts in the marketplace now. Maybe we will, and I'll be out of the marketplace by then.The Truth About Company Culture and the Talent PipelineSara: It'll be a decade from now, but how do I handle and deal with these kinds of things that I have to deal with today?Carolyn: What Mark sees anecdotally, I'm guessing that's pretty universal. On the flip side in the marketing world, even though I'm in tech, when I go to hire, most of my peers are women, which I find very interesting. I would say 80, maybe 90% are women.Sara: Here's a couple of thoughts and I guess I'll just get real honest. It's interesting because I've been doing this work for 20 years.The observation of the talent pipeline is very common and it is actually not true. What typically that comment comes from is a lack of self reflection on the company culture. Just because you are not getting candidates means candidates don't want to apply to you. That's just the end.People are like, "What, why wouldn't they? We're awesome." If you're awesome at hiring white men, good for you, A+. But that's where the perception gap comes in. You actually fail at hiring women, you get an F. This is where the leaders have to sit down and start to get really honest with themselves because my network is full of women in tech, full of it.So anecdotally, I could sit here and say, "I actually know hundreds and thousands of women in technology. You don't know any? So, who's right and who's wrong?" We both have our life experiences. It's just that I've made the intentional work and decision to include in my personal network, a lot more women in tech. They are there. You just haven't done the work to build your network. So that's the moment of honesty.Authenticity GapSara: Now this is where the authenticity gap comes from. I can say that as an outside consultant. Unless you listen and hear that, and accept the ownership and responsibility instead of deflect and say, "Well it's because the talent pipeline isn't full, instead of, "Wow, we are not getting women applying to our company. We are doing something wrong. We're actually really great at targeting white men."I've had people say, "I don't want to change things because I just don't believe in targeting women and people of color." I'm like, "You're already targeting white men." That is an interesting statement if all you're hiring is white men because the talent is there. It's just, are you willing to do the work to find it and really bring it into your network in a meaningful way?What happens if you watch the research, people will make a decision before they ever hit the submit application button. Just because you are not getting applicants is not a reflection at all of the true talent pool. Leaders somehow have decided that, "Oh, well, there's nothing I can do because there's just no talent out there.Mark: I see your point. It's probably up to me to be more active in that process. As I was thinking through your explanation on this, we have an internal resource, a talent recruiting team. They're the ones who get the candidates and bring them to us.Sara: The talent decides to go where they can thrive. If you think about that, why are they choosing not to come to your company? There's something about how you're describing or the interactions where they can't get that sense of thriving.Strategic Risk ManagementSara: It is actually a strategic risk management skill if you think about it. So I have a law degree and an engineering degree. I'm not s**. What we're doing is, we're looking at these cues that companies are giving off.We're making a risk management assessment of "Is that where I want to spend my time and energy? Is that where I think they're set up to actually help me thrive? Do I really feel like it's going to be an emotionally exhausting place to work?" Because "No, thank you. I'm not even going to hit apply."BYU did some interesting research where they had job postings and they had one job posting that said, "Was very neutral." They had one job posting that said, "We really encourage people from all backgrounds, diversity, please apply." Then they had another posting that talked about their inclusive culture. Now I'm not saying this exactly right. You know, but Mark, which one do you think got the most submit application clicks? They might not have gotten hired, but they got the most submitted application clicks.Carolyn: What are our choices again?Sara: Neutral. We want all these types of diversity, please. If you meet these diverse identity, care characteristics, please apply. Or the third one is, we have a mission and inclusion. It’s a really important part of our culture and more of that type of statement.Mark: I would assume the latter.Carolyn: Me too. The third one?Sara: You are right. It got more applicants. This is actually a Goldman...

A Company Culture We Can Trust with Sara Jones

Elizebeth Varghese

Remote

Join us on Tech Transforms Federal News Round-up segment, So What? Hosted by Carolyn Ford and Tracy Bannon. This week, we talk to Elizebeth Varghese, Global and Americas Leader – HR Transformation Client Offerings at IBM about one of the biggest topics in federal news: remote work. Listen in to find out how agencies can implement a smarter protocol, how remote work impacts the trust equation and the role technology can play in the workforce culture. Episode Table of Contents[00:40] The Future of Work for Federal Employees[11:28] Work-Life Balance Expectations in a Remote Work [19:01] Big Push in In-Person Protocol[26:12] Do You Need a Home Office for Remote Work?[32:01] Provide Options to Persuade People to Stay and Junk Remote Work[39:04] The People Who Are Not Approving Remote WorkEpisode Links and ResourcesElizebeth VargheseIBMSouth Asian Youth ActionThree Ways the Future of Work Must Change for Federal EmployeesHybrid work for many is messy and exhaustingWelcome Back to the Office. Isn't This Fun?Thousands of employees are testing a 4-day workweek starting today: ‘It’s inevitable we’ll see bigger companies doing thisSuper Better by Jane McGonigal[Block] Chain ReactionThe Future of Work for Federal EmployeesCarolyn: This month, we're hosting Elizebeth Varghese, Global &amp; America's Leader: Client Offerings in Talent and HR Strategy at IBM. And outside of IBM she's an active board member at South Asian Youth Action, a nonprofit providing after-school programming, education, and college support. She was recognized as Global Top 100 Influencer in HR for 2020. And we are glad to have you joining us today, Elizebeth, to discuss returning to the office, the great resignation, and companies potentially switching to a four-day workweek hybrid, all of that. Welcome Elizebeth, how are you?Elizebeth: Great, thank you so much, Carolyn. Wonderful and delighted to be here. Great to be back on here with Tracy as well, friend from a couple of years ago as we've been going through some of these pandemic podcasts. So thank you for inviting me and I am looking forward to this.Carolyn: Yes, well this one's going to be a fun one and it might get a little heated. I've already seen some stuff on LinkedIn. I'm like, oh, that gets my blood boiling about returning to the office. And I want to start off with a question, there's an article called "Three ways the future of work must change for federal employees." The article states that at the end of the day, we need to have an IT and HR Alliance. This was due to exceptional communication between the agency's chief information officer and HR functions. In your experience, is the relationship between IT and HR something government agencies need to improve on? And industry too?Does the Relationship Between IT and HR Need Improvement?Elizebeth: Now what we've seen, the pandemic is highlighted so nothing new. This was happening for a while. I have to preface it with that. Because I think in lots of our conversations we hear this thing about, hey, this is what the pandemic caused. The pandemic caused a lot of suffering and hardship for many people, but it highlighted things that were in play for many years. And the fact the intersection of HR data and how IT's using it and accessing it has been an eternal problem. It's been going on for many years. But things came to a head when we were forced to be virtual in the federal sector and in the commercial sector. People realized that that intersection hadn't really been explored. It hadn't been addressed. It hadn't been managed in a sufficiently coherent fashion.There were a couple of reasons for that and some folks in the federal sector or commercial, the reason I say that is because this is a universal problem. It's not endemic just to one sector and we should take that. But when the pandemic hit, there were lots of tropes. Even before that around what can be done remotely, what data can be accessed in what fashion, what is secure and not. What the pandemic highlighted is that those issues were not really based upon real cybersecurity issues or access issues or single sign-on issues. They were really managed or impacted by cultural constructs of where work can be done. A great example of this is if you think about our friends on Wall Street, you could not do investment banking or trading from remote work. It's impossible. There were so many reasons for that, all of them good.Subcultures and Subgroups During Remote WorkElizebeth: But come March 15th monitors were shipped to basements in Westport and patios in Westchester county and Wall Street just continued. So we really found that it wasn't, can it be done? It was more of do we want it to be done? I think that is the question that was highlighted through the pandemic in the federal sector as well. Are we really understanding what technology can do and are we using it to really manage HR data? So that's kind of what I've seen. Tracy, would love your thoughts too. I know you've been working at this intersection for a while as well.Tracy: It struck me as strange when the pandemic hit because I've had remote teams. I think it was 2009, 2010 was completely remote work with global teams, everybody geographically dispersed. So it was first nature to me, but I never realized with other IT workers how much they did not get that opportunity. So when we got into the pandemic and I realized different organizations. I changed my job just before the pandemic and what I was starting to realize is how campus-centric or office-centric some of the cultures could be. Even inside a big organization you can have subcultures, subgroups that really do form these tight bonds. Whether it's going out to lunch or whether it's meeting up at the water cooler or what have you, there is or was this sense. It was a cultural sense that they built together. And that was hard for them, hard for everyone to learn, how do I emulate that? How do I replace that now that I am on remote work?How People Collaborate in a Remote Work SetupTracy: So Elizebeth, if you and I are going to walk to the water cooler and we were going to make a deal or we were going to talk about something or some new topic that we want to research, how did people do that? Or how did they start to do that during the pandemic? What did some of the research show on how people are engaging now?Elizebeth: People have engaged, as you said, remotely even before the pandemic. There were virtual teams and there were lots of collaboration tools. But I’ll give you an example. The experience that I have as an IBM employee, much like you Tracy we have employees all around the world working on very complex things. People without having ever met each other or worked in the same room and that was really happening through technologies. Whether it's Slack or chat messages or online Wiki forums. Or what we call Lighthouse at IBM where we share intellectual capital. There were lots of different ways people were connecting. So what happened in the pandemic is that the companies that had some of the cultural constructs around it is okay to engage that way. Or it's common to make friendships or have friendships evolve over distances and remotely, found that they just moved seamlessly into that.The companies that struggled with that, again, were less about having the technology and more about people being used to engaging, forming relationships, forming friendships and collaborative pods without technology. The Question to Ask to See if Remote Work Can Be DoneElizebeth: So again, it's less about the technology and more about how we work together. And I think we see this, I have teenagers, now they're used to texting versus making a phone call. Now if you are used to texting, it's a lot easier to never have a phone, you don't need the call function. So it's really a habit, it's a way we think about how we communicate, how we are comfortable communicating. I think that is a learned behavior.So I've learned to text more because I have teenagers. I call them when I need to but you get my drift. I think similarly in organizations, if you're able to provide different channels and different ways of access, we find that people actually learn and embrace them. They do make deals, they plan vacations without having met each other. We've had experiences where we had kids come in fresh from undergrad or grad, working together in collaborative pods using technology, planning ski trips. Never met each other but a great group that works together. They're all partnering and operating as a team. So it can be done. The question is who chooses to be in that situation? Or who's comfortable with that kind of maybe job interview process? Lots of people are taking jobs in the pandemic and after without ever physically meeting their teams. So I think that would be my challenge to all of us, not the why but the why not? Why can't we do it?Technology Etiquette in Remote Work SetupCarolyn: So I'm like you, Tracy, I've worked remote. I live in Utah and I've supported teams that support the federal government for the past 15 years. So I've worked remote since 2010. Most of the time going into the office occasionally which I always said, when I went into the office, those were the days I didn't get anything done. And what was interesting for me, so this comes back to the culture thing, when everybody went remote was the abuse of the technology. What I mean by that is I felt like we needed to train ourselves in etiquette. Don't text me at three o'clock in the morning.  I had to train myself. That's my responsibility to make sure my phone is on silent, do not disturb when I go to bed.But also I was so good and am so good at getting in the zone and really focusing. The Slack messaging and stuff, I nearly lost my mind when everybody went remote. Because it was constant barrage, constant interruption and there was no time. You had to get into the zone, into the flow. And it's definitely gotten better, but what do you think about that? Elizebeth first, do you have anything to say about that? And then Tracy I'd love to hear your thoughts.Elizebeth: That's a great example because actually personally I have the same experience and I think lots of my clients do. Because one, if you're across different time zones, everyone's Slacking you when they're working. So I had to learn, me personally, I had to turn the notifications off. I had to discipline myself to not reply in the moment, but wait and even if I looked at the texts. Because I couldn't bear to not look at it, but tell myself not to. And in some instances I think also, be cognizant. That sometimes we are responding or we are sending a text because I don't want to forget I'm working now and I make a note of it. But the person at the other end is receiving it and thinking, oh my God, I have to reply. It's an unseen, unexpected pressure that we may not be conscious about. Because we are not doing it to get a response back.Work-Life Balance Expectations in a Remote Work Elizebeth: So I think some of those things again require a different way of working. Like you're saying, when do we turn on, when do we turn off? And how much do we really listen to the implications of really having a remote workforce? Both in terms of whether you're in a different time zone or different work-life balance expectations.Tracy: For a long time I have counseled those coming into their careers to be very specific about when they answer emails. Now I know that the first time that they get their corporate phone and it's connected that they're looking at it.I realized that I had a responsibility to not send weekend emails. As a leader, they were immediately responding and I realized that I also had to train myself. Now I still do queue things up when I have time. I have had the blessing of being able to have some latitude with I'm going to focus a little bit more this evening. Because I'm going to go and do something with my daughter tomorrow morning. Had some flexibility. So I have also trained myself to be very specific in my emails. I'm sending this tonight, please don't read or take action till tomorrow. I let them know this is not a rush. If I need somebody, they also know that I'm like a bloodhound and I will find them. We will get ahold of each other if it's truly something that is that much of an emergency.Tailoring Remote Work Culture to Team DynamicsTracy: But you brought up another good point. Prior to the pandemic, except for very close work relationships, those work spouses, I did not text with anybody in the workforce. I would Slack, I would use any of the other tools that were available to me but not that. When the pandemic started, I have two phones now. I never thought that I would be the two phone person. The work phone and the life phone. But I do. One of the reasons that that has become important is the ability, to your point Carolyn, to turn it off and put it over there because I'm now leaving this part.Now that all sounds like that I have a really great division between career and life. For me, it's very intermingled, I'm thinking about it all the time. And so if I know that Carolyn is thinking about it. I might feel okay sending you a Slack message or a text message at six or seven at night. This is when I know that you're out there taking a walk or something. So there is a bit of tailoring after you learn just the culture of it, your individual teams and people. But it's not coming in with rigid expectations, you've got to build that together because each team dynamic is so dramatically different.Hybrid Work ModelCarolyn: Yes. So I want to talk about, the push now is people coming back to the office. So we talked about this already a little bit and there's a bunch of different models that are being proposed. I want to talk about the hybrid work style first. There's an article, it's called "Hybrid work for many is messy and exhausting." And we'll put links to all of these too in the show notes. But it says that about 60% of offices will adopt a hybrid work policy this year. So Elizebeth, what policy changes have you seen within IBM or otherwise surrounding the hybrid work model? It sounds like you guys were already hybrid, to some extent.Elizebeth: Our IBM HR folks are the best folks to answer this question. They've done amazing work over the years for a truly hybrid model because we've had different variations and policies. What we've seen across the board is that organizations are making different kinds of policies. We have seen a trend definitely around the organizations that traditionally did not like remote work. Lots of organizations in financial services are expecting people to be back in the office. Expecting people to be back for a defined number of days and a defined set of days. So people are being quite prescriptive about that, so we're definitely seeing that. And as we've seen in the news, there's also been quite a bit of pushback on some of those prescriptive policies. I think some of that is going to continue to evolve. I don't think that has been completely sorted out.The Optionality of Work in Every IndustryElizebeth: Now I think in the case of the federal government and really honestly every industry, what we're finding is that the optionality of work has increased. We've seen this in news. The smartest kids who were looking at going to become bankers in a particular well-known organization. I won't name. They are maybe thinking, you know what, I don't really care as much for the hours of work and the expectation that I will be in the office so I'm not going to do that. I'm going to go to a startup. Now that plays out in the federal government as well. It has for many years in terms of how do we compete for the best talent? And there's a reason the government does need the best and brightest for practice of national security or science and space exploration, a variety of things.The pivot has really then come to be more around, what's the best way to attract the best talent in our industry? And that's becoming the lens by which policy making is happening. So the one other thing I just wanted to mention, there's an organization again I won't name. But as they looked at the variety of labs that they had across the country, pre-pandemic everybody had to be in the labs doing their work in their teams. But the pandemic required them to obviously be remote and the serendipitous outcome of that was that they found there was a lot more cross-pollination and sharing of information and collaboration across labs which they hadn't had historically. Because people tended to work with their own physical teams. The Real Estate You Need to Give Up for Remote WorkElizebeth: I say that because I think organizations have recognized that there's been much good to come out of the remote work and that the return to work answer is not a simplistic one of just get back into your offices. I'm curious to see what you both have seen too. It's really been an evolving strategy for most people, I think.Tracy: I think that quite a number of people are asking why. If I'm interviewing with you or if I already work with you, just talk to me about the why. Some firms and some government agencies have a tremendous real estate footprint that they own, that they're not renting. They can't give that space up. So if you own that and you have a dramatic dependency on that, what do you do? We're seeing that with higher education right now as well. They've got huge campuses and they found out that we don't necessarily need all the students on campus. What's the balance, what's the change off between it? So I'm finding as we're interviewing, when we talk about work styles, when we talk about hybrid, when we talk about the possibility of being a full teleworker, that's the government term. It came around, I think it became law in 2010 that you could be a teleworker if you could show productivity.Big Push in In-Person ProtocolTracy: But as you are trying to talk it through, there are so many people asking me, well, what is the advantage that I have of being in person? What's the advantage that we will...

So What? Federal News Roundup on Remote Work with Elizebeth Varghese

Bob Stevens, AVP Public Sector at GitLab joins Tech Transforms to talk about the imperative mission of DevOps to combine efficiency, speed and security. With emphasis on empowering teams to fail fast, moving security to the left, and a deep dive into Platform 1, you won't want to miss this episode!Episode Table of Contents[00:27] DevSecOps’ Speed of the Mission[09:02] The Cultural Shift That Needs to Occur to Upgrade the Speed of the Mission[19:21] The Future of DevOpsEpisode Links and ResourcesBob StevensPlatform 1Dateline PodcastAlex Cross Series John WickDevSecOps’ Speed of the MissionCarolyn: This week Bob Stevens, Area Vice President of Public Sector at GitLab is joining me. Bob is a seasoned veteran in public sector technology with over 25 years of experience. As the AVP at GitLab, he is responsible for helping government organizations become more productive, efficient, and effective.Bob also has experience on both the industry and the government side of things. Prior to industry he served in the United States Air Force as a computer specialist at the White House Communications Agency. I am excited today to dive in and talk about the ways that we can use DevOps to modernize and secure government IT, and what the outlook for DevOps is. How are you doing, Bob?Bob: I'm doing great. The weather's getting better in DC, so it's good to see the sun from time to time versus what we've had. But yes, doing fantastic.Carolyn: Well, good to hear it. So let's just dive in. And let's walk through what DevOps is and why implementing these practices is critical to helping modernize and improve government IT?Bob: Great. So I guess DevOps is combining efficiency, speed, and security all into one. And creating software at what I like to refer to as the speed of the mission for the government. The business side is a little different. But for the government, it's all about the mission and you being able to accomplish the mission faster and stay ahead of our adversaries. In the case of DoD and on the civilian side, it’s to ensure that all of the citizens that any given agency supports gets the best possible support that they can. If you look at the organizations like the Veterans Administration. You can imagine they've got a lot of applications that they've written. The Platform the Government Is Looking For to Improve the Speed of the MissionBob: To help the vets accomplish what they need to accomplish in a timely manner.  So DevOps really will help them to produce the software at speed, more securely, more efficiently, and provide the most or the best service that they possibly can to all of the veterans out there, just as one example.Carolyn: So, you know Tech Transforms is vendor agnostic. And I would love for you to just take a couple of minutes and talk about how GitLab helps with that. And just what GitLab does. I've read the marketing statements and it's a little nebulous for me. I would love to have you explain what GitLab does and how it's helping agencies achieve this?Bob: I appreciate that you're letting me do this in a vendor-agnostic community. I mean, there are a lot of tools that are required to produce software. But the way that the industry or the government in particular is heading, and you can see this in some of the articles that DoD has recently released. Is they're looking for one platform that encompasses the entire software development life cycle.As you can imagine right now, I know agencies that have anywhere from 14 to 20 different tools that they're using. And the issue with that is that there's developers that like the tool that they like. So they bring their own and they develop their portion of the software. Unfortunately, when it all comes together, it doesn't always work because they've used different tools across the development organization.And so, with the use of a single platform, you can ensure that at the end, everything is going to work. The nice thing is you can continue to bring some of those other tools. Because they integrate with the platform. Speed of the Mission and Security CollideBob: Just as an example, JIRA, the government's using a lot of JIRA.  And JIRA integrates with GitLab so that you can use them seamlessly together. So the developers that are using their favorite tools can continue to use some of those. It's just that it's going to be more efficient because in the end you're going to have an application that works out of the box.Also what GitLab is trying to address is moving security to the left. Developers are a lot of times at odds with security folks because developers are tasked with developing code fast. They want to get it done quickly. And security folks want it to be done secure. So sometimes the two collide. But when you're building a single platform and you allow, or you have the ability to move security to the left, which means, when I check in a line of code, I'm going to do a security scan to make sure that I didn't somehow introduce a vulnerability. If I did, I could fix it immediately rather than waiting until the end of the process. Then running security scans and realizing, I may have to go back through hundreds of lines or thousands of lines of code to figure out where that vulnerability was introduced and do the repair.The other thing that I'll tell you is visibility. Not everyone has to be a developer to use the platform or GitLab. You can be in the executive branch and know nothing about how to write code. But you can see the process during the whole time. You can ensure that what's being produced is going to best meet the requirements of the people that it's being produced for. You don't have to wait till the end to produce the app.The Very Important Role of the CIO and CISO in the Speed of the MissionBob: The users start using it. And they're like, "Oh my God, this is not the way that I wanted this to work." Or, "This doesn't work for me." Or, "It would've been nice to do this." It can be integrated during the process so that you can make sure that the application is usable in the end.Carolyn: What you just said helps me understand what GitLab does a lot more than any reading I was going to do on my own. And it certainly sounds like a smarter way to do things. So you've written many articles and often you talk about the need for DevOps, DevSecOps, a big part of it is just cultural. And so is that starting at the CIO level? And if so, what are CIOs doing right now?Bob: I mean, first of all, I have empathy for CIOs because they have so much thrown at them right now. It's incredible. I actually don't know how they are able to get as much done as they do. But having said that, I think most CIOs know that they need to move away from the legacy development waterfall to the agile software development world. And I think they're making gains towards that.Bob: Nothing in the government moves quickly, but moving to agile, it does require a cultural shift. And that's where the CIO or the CISO plays a very important role because they've got to convince the organization that failure is okay. Because when you fast fail, you actually make more progress than waiting till the end. Which is a cultural shift for any organization. That shift has to start at the CIO level. It can't start at the lower levels. The Cultural Shift That Needs to Occur to Upgrade the Speed of the MissionBob: The lower levels have got to be empowered to fast fail to experiment in order to produce the best possible software application that they can.Carolyn: So you talk about this in an article that I just read Modernizing and securing government IT through DevOps. You say that, "Federal CIOs embarking on a DevOps journey should embrace continuous integration, continuous delivery pipelines to reduce toolchain complexity, management, and maintenance." What can CIOs and CISOs do to embrace that statement? Because that's like you said, that's a lot.Bob: It is, yes. And unfortunately they have many more mandates coming at them from OMB and NIST. Even though NIST doesn't generally put out mandates, more guidance. But they're starting to come forward with a few more mandates. And so I don't know how they're keeping up with it. They're doing the best that they can. But it's the cultural shift that needs to occur for the development life cycle. It's also the building of the platform.I say this often, it's not really the money. And I think that CIOs can find money to buy tools. I think it is more of the resources and the cultural shift that needs to occur. And that's where the CIO can really have the influence, is to be able to provide the resources, be able to have the backing at that level for experimentation and fast failure. And it's not necessarily because they can get the Technology Modernization Fund. I mean, upgrading your DevOps world is modernization, so they can tap into funds. It's really the other things that need to be considered for the shift to the new DevOps environment.How Platform 1 Helped in the Speed of the MissionCarolyn: Do you have any good use cases or stories that you can talk about where you've seen this shift happen and this DevOps, this new process, this agile process be implemented?Bob: Yes, sure. I'm going to go back to my Air Force roots, which makes me proud. The building of Platform 1 was a huge shift. And as a result, the Air Force is able to produce software so much faster than they were. And when they produced the applications in the end, they're closer to what the user needs in order to do their job. Because who better to inform the developer about what's required than the person that's going to use the application.As an example, you can imagine there's a lot of software in the F-35, just tons of software. So who's the best person to tell the app developer what they need for flying that jet? It's the pilot. So if they can participate in the DevOps process and they can, in the way that things are designed in Platform One, then it's going to be a more efficient use.Carolyn: Okay. You just said something about Platform One that made some light bulbs go off. That term gets thrown around a lot. I use it a lot. I didn't understand that the end-user was involved that way.Bob: Oh yes. I mean, that's the beauty of building a platform or using a tool like GitLab. They have the visibility, they can see the software as it's being developed and can have input.Carolyn: And they do participate? They'll look at it and say, "No, that's not going to work?"End-Users’ Participation in Improving the Speed of the MissionBob: Sure. Yes, absolutely. And that's how you can take the use of an application from months or a year down to weeks or days. The modification of a software package could be done in hours versus the way that it was done in the past. So it's just a lot more efficient way to be able to produce a usable application in the end.Carolyn: Okay. My mind's still spinning on this end-user can say, "No, that's not going to work." So for them to participate, are they actually using the end result somehow? So they use it the way they would really use it in the field, like through a simulator or something so they can test it kind of real life? And then, I mean, how does the pilot test and give feedback?Bob: Yes. Well, a couple of ways. First of all, they have the visibility, they see the code being written. Although they don't necessarily need to understand what each line is, or how to write it.Carolyn: Right. Well, because I would think the pilots, that wouldn't mean anything to them.Bob: Yes. Like you said, they can see the simulation, but they can also see or respond to questions from the developer. They can see what the developer is thinking in regard to what they're producing. So all that's valuable information for them to be able to provide feedback. So again, in the end, the application works as expected and meets the requirement and the mission. It's all about the mission.Carolyn: But spending time answering questions in a chat room about something developers doing. Is that part of their job description? Like every hour or every day they spend an hour responding to developers? How does that work?GuideauxBob: Probably not, a little short story for you. Several years ago, I was in a meeting where a very high-level person in the Air Force said every airman will be a developer. And I thought they were crazy, absolutely crazy. But by producing a platform that allows them to participate, not necessarily write code, but participate, they can all be developers in a manner of speaking. So I think that the Air Force has been able to come as close to accomplishing that as you possibly can. Which of course, again makes me proud. That's not to say the other branches aren't doing the same thing, they are. It's just, the Air Force was out in front of the other branches.Carolyn: Yes. I have a whole new respect for Platform One now. I really did not understand that everybody was participating like that.Bob: And yes. I have to point out Top Gun is the Navy, not the Air Force.Carolyn: Thank you. Well, so in the same article that I referenced earlier, back to Air Force, you talk about Master Sergeant James Crocker. I don't know if you want to share his handle?Bob: He goes by Guideaux.Carolyn: Yes. His story and some of the stats that you shared with his story were pretty beyond impressive. I mean, they're almost like you say, that a hundred years of program time and software release timelines were reduced. You went from three to eight months for that cycle to just one week.Bob: Yes. I mean, it's a great story, and he's built a great software factory. And he continues to run it today. He is a strong, strong advocate for a DevOps platform. And he's proven that it'll work. He continues to do that every day. How Failure Was Embraced to Boost the Speed of the MissionBob: And again, he established the bar for speed to mission, and what they've been able to do there. We're going to continue to support him and get him whatever he needs to be able to help produce the applications the way that they have been for a few years now.Carolyn: I want to revisit what you said about a culture of failing fast. Was he a leader in that? Because to me, that's not something that gets advertised about any of our defense agencies. That you would brag that yes, we fail all the time. That's part of our goal. That's part of our objective. So, if he was one of the first to embrace that, or how does that get embraced? I would imagine it's still resisted a lot to fail.Bob: Well, I mean, yes. I mean, especially in the U.S., the word failure is bad. But it's how we learn and it's how we move forward rapidly. I'm in sales. I'm chartered with selling to the government. And I'm always telling the team whenever they're involved in an opportunity is like, fast fail. If it's not really an opportunity, then move on, because you're going to waste your time. And frankly, you're wasting the government's time. So stop wasting their time.So, it is a big shift. But like I said, Guideaux's definitely one of the people in the military, the Air Force that embraced it. He also had support from executives, which is required across the Air Force. It is a great story and I'm glad it's public so that I can talk about it.The Future of DevOpsCarolyn: Yes, me too. So what do you think the future of DevOps looks like?Bob: It gets back to the building of the platform. Where all tools are integrated and there's no more BYOT.Carolyn: Device. I knew you weren't saying BYOB. Although, maybe we should.Bob: It's really getting the teams to collaborate. Here's another great example of what the Air Force has done. They've put software factories in downtown, in cities, Austin, Salt Lake, many others, where they can find and retain top talent. This, I think is genius. And they've given them an environment that they enjoy working in. I mean, honestly, some of the bases they're old, the buildings are old, nobody wants to go to them. But, if you can go to this nice fancy office in downtown Salt Lake City, then you're going to be a much happier person and more likely to show up and be productive. So, I think that's another thing that DoD has embraced is where they're building the factories, and the talent that they're able to attract and retain as a result of that.Carolyn: Do they allow remote work in these software factories or does it all have to be on-prem?Bob: No, they do. And that's another great thing to point out. Three years ago, if you said to me that the DoD was going to allow people to work at home, I'd say you were crazy. It's never going to happen. But the pandemic forced the issue. And now DoD has embraced it. I think that what they've found is that folks are perhaps more productive than having to commute and being in an office. A lot of good positive lessons learned as a result of remote work. I think that it's going to continue.GitLab Is a Hundred Percent RemoteBob: I don't know if you know this, but GitLab is a hundred percent remote.Carolyn: How long? Is that just because of the pandemic or has that been a while now?Bob: No, it's pretty much since inception. We did have an office for a few short months, which was closed. And I think that was about six or seven years ago now. So, we're quite proud of being an all-remote company, and the way that we've made that work. There's been a lot of papers written on it. There's a lot of great information on our website that can help organizations understand what it takes to be an all-remote company. But one of the strong benefits from it is, if I'm looking for somebody with development skills, they can be anywhere in the world.Carolyn: Exactly. You open up your talent pool just exponentially. And I've worked remote for 10 years and I've had to jump through the hoops and every year, fill out the paperwork. I've worked in government supporting the government mission for over a decade. It was a battle until the last two years. And now it's, everybody gets it.But it's interesting because there's this movement right now to get people back into the office. And I'm just wondering what that's going to do to talent retention? If somebody had told me I had to go back into the office, I don't think I would do it, Bob.Bob: Well, I think there's a negotiation that's occurring now, based on what I'm hearing with the companies that are trying to reestablish the office. There's a lot of pushback from the employees. And it's tough enough to get talent today. You don't want to create any other barriers. What Bob...

The Speed of the Mission with Bob Stevens

Mike Maciag, Chief Marketing Officer at Dynatrace joins Tech Transforms to talk about the power of observability. Careful monitoring is of paramount importance for any successful operation, and observability can take your agency to the next level. Listen in as Carolyn and Mark get some tips and tricks for improving cybersecurity posture with the most accurate technology.Episode Table of Contents[00:31] The Vital Role That Observability Plays in IT[10:40] Observability: When You’re Asking the Systems to Share[22:48] The President’s Memo on User Experience[34:01] Let Machines Do the Stuff That Doesn’t MatterEpisode Links and ResourcesMike MaciagDynatraceAmerican Moon ShotThe Vital Role That Observability Plays in ITCarolyn:  Today, we get to welcome Mike Maciag, who is Chief Marketing Officer of Dynatrace. One of our own, one of the clan is here with us today. And as CMO, Mike is responsible for Dynatrace's global marketing organization. We're really excited to hear his expert opinion on observability and the vital role that it plays in IT, and especially the cloud.Mike: Thank you, Carolyn. Mark, nice to be with you both today. And I know this is a long time in coming, but I'm excited to be sitting down and talking to you today.Carolyn: We've been able to talk to a few of our guests a little bit about APM. And just recently we talked to a former CIO at VA. He is very bullish on APM, and he talked a lot about the advances that they were able to make in the VA with APM. Just that at least within the VA, APM moved from a nice to have to a must-have. And what I'd really like to hear you talk about, just to dive right in, Mike, is so there's the APM part. But then in my mind and I might be positioning this wrong. In my mind, I think that observability is like APM 2.0. But can you speak to that APM versus observability? What's the difference?Mike: As long as we're talking about terms, we might want to mix monitoring in there as well. All terms that are thrown around, is it monitoring, is it APM, is it observability? And it's changed, it's changed a lot. Let me start with the simplest definition, then maybe we can unpack it from there. Think of observability as the umbrella term, as the broadest umbrella term that goes above all of this. Monitoring, APM, ObservabilityMike: Observability fully includes APM, and observability also subsumes monitoring, both of the things that we've been doing. There are kind of two megatrends in the industry that have been driving this move towards observability. One is the move to the cloud.More and more systems are moving to cloud architectures, probably more important digitally native architectures. We're going from monolithic systems that we could understand, that we could see, that we could touch. We could understand what's happening with them into cloud increasingly complex, even multi-cloud architectures that are driven by microservices and the like.The reason for that movement is it has made digital transformation, application development faster and easier in that regard. Which is this digital transformation fundamentally looking at everything that I've been doing in every aspects of my business. Whether it be on the front end or in the services I provide. Whether it be on the front end or in the backend machine to machine conversations is happening in cloud architectures. And we're trying to figure out how we can automate more of it and things are happening that way.Does that make sense, just from a starting point, from observability’s umbrella, fully subsumed monitoring, fully subsumed APM, kind of in that the drivers being cloud and digital transformation making that happen. And I can get into more details.Mark: That absolutely hits the mark. And we also say end-user performance or experience.Mike: That's right. Carolyn: Yes, that sets me straight. Because me saying that observability is APM 2.0 is wrong. APM, like you said, it's underneath observability. It might be, I guess, one way into implementing an observability platform into your organization, but it's not all of it.Where the User Touches the ApplicationsMike: Yes. When you say observability, kind of what pops into my mind is thinking through there's APM, there is infrastructure monitoring as part of that, what's going on in the infrastructure that's underneath it. There's, as Mark was kind of alluding to, digital experience management. Where does the end-user fit into this? And kind of making that happen.Then you have increasingly even elements of systems that are achieving what they need to achieve have security in there as well. Because really, we think about a world where software works perfectly. The expectation is that we live in a world where software works perfectly. Now, that's a vision. It's a long way coming. But to make that happen on an end-to-end basis, you really need to bring all of those things in there.APM, I often think about as the high ground in this, because APM is where the user touches the applications. It's where the business needs meet the IT needs of what's happening. And it's kind of what people can touch in that area. It's a very interesting place to enter. That obviously is an important part of it. But it's absolutely essential to have the infrastructure that's monitored underneath it and the user experience. At least specifically as you may kind of thought.Mark: You mentioned a couple of different things. And in the federal market, there's two things. And if we have time, maybe we can talk about these. But one is the executive order that the president came out with at the end of the calendar year around end-user experience. It was something very new that we had seen coming out of the government. So maybe we can talk about that maybe a little bit later if we had time. Infrastructure Monitoring Is ObservabilityMark: But the second one, and you mentioned security, was zero-trust. The whole cybersecurity, and of course everybody's trying to figure out ways that they can improve their security posture. And people like Carolyn and I figure out how we can tap into the cybersecurity budgets that have been allocated to that.Carolyn: Well, okay, for our listeners, I want to back up just a little bit and define APM. It's application performance monitoring. You made me realize that we didn't define that, Mike. Because when you said there's the infrastructure monitoring too. You're right, in my mind, application performance monitoring includes infrastructure monitoring, but not necessarily. That would be the observability.Mike: Yes. Carolyn, just to not get too inside baseball and Dynatrace, I understand why you think about it that way. Because our APM does in fact include. We think of APM as full-stack. It goes all the way down to the infrastructure that it's monitoring. When people work with Dynatrace, they're getting that as part of included. So absolutely makes sense why you kind of giving your steeping of Dynatrace kind of thinks of it that way. The rest of the world does not, by the way.They think of APM and infrastructure as two different things. You basically buy those off cardless. We don't think they can be separated. Because what you want to be able to do, I mean, the goal here is to simplify cloud complexity to the point where you can get a precise root cause answer if something were to go wrong. And drill all the way down to, "Here's a specific line of code that's making that happen." Or, "Here's the piece of infrastructure that's making that happen."How Can We Better Position the Concepts of Observability and FederalMike: Let's say it's in a Kubernetes environment, just a container that spun down in a second. But it does that 60 times an hour, you need to be able to find that as it comes and goes. That's why you need to have full-stack as you kind of think about that.Mark: You said some interesting things there, Mike, and I want to dig into this a little bit deeper. Because in the federal space, we feel like we're three to five years behind the commercial market. And the use of these concepts of observability, even APM, we rarely see RFPs coming out that have APM listed in it.We might see infrastructure monitoring, we might see other terminology like that, but we rarely see these concepts. And the government has been in this transformation for years, moving to the cloud. Some agencies have had more success than others. Can we talk a little bit about how we might be able to better position the concepts and terminology of observability and federal better?Mike: You mentioned three to five years behind, debatable exactly how many years. But the curve that the commercial space has gone through increasingly seems to be exactly the curve that the federal space is on. Which is with the moves towards moving to the cloud, whether they be trusted clouds or public clouds. The same kind of breakup of monolithic architectures has taken place.When you break up the monolithic architectures, speed and scalability come with that, and flexibility come with that. And the other truth that I think you'll run into is complexity also comes with that. Guess what, no one, and I'm guessing the federal government is the same, is getting additional resources to monitor this in the old way.Observability: When You’re Asking the Systems to ShareMike: The idea that a system should be able to be monitored. You can understand whether the system is up or down and they go figure it out from their monitoring health. When you move into observability, what you're doing is you're asking the systems themselves to share, to become observable, to put out data that says, "Hey, here's what's going on with me". And so that it can begin to understand in that way.That's the purpose of trying to simplify that complexity. So that when you don't have greater resources to get your jobs done, you can still stay on top of it. The last thing that people want to do is get bogged down in monitoring and not be able to innovate. And be able to drive those new apps that are driving better services for citizens that are driving more security in DoD-oriented areas, et cetera. That's where this idea of observability is.I'll even go one step further than that. Observability today does not include the concepts of intelligence and automation, but we think it should. And that's because this overwhelming amount of data that's being generated by these systems is really beyond the capability to the old ways. Where I'm going to put some data up on dashboards.I can look at the dashboards and figure out what's going on and have a good sense of what's going on. It's just not possible to stay on top of it that way. We think about it as moving to a world where we're providing answers. The answers are allowing people to automate more and get more out of their teams.Mark: Well, that's a good answer.What the World Is Lacking in Terms of SecurityMark: We'll get that out to the sales team right away. One of the things that you mentioned that we run into is security. Some of the customers that we have, have a very different or stringent, higher stringent security requirements than others. Obviously, as you can imagine. That's maybe a level of complexity we run into. It's certainly an issue. We see that come out a lot. Is that the same kind of answer that we would provide about security?Mike: Yes. One of the things that we're seeing more and more of kind of in the security sphere is how do you think about security in real-time and finding precisely identifying security issues in production? We have all kinds of things in the world that try and keep the bad guys out, or the bad actors, or the bad code out. We have even more things in the world that test, and says, "Okay. Before I do a check-in, kind of do a static code analysis on this and understand whether it's got known vulnerabilities in it."What the world has been lacking has been the idea of, "Okay, so now there's something out there. How do I know who has it, or what systems have it, and how do I precisely identify it and make it happen?" Log4Shell helped us see this kind of in very specific ways, later not as large of an issue. But Log4Shell showed the same thing. Which is all of a sudden there was a zero-day exploit that was out there. Or it was a zero-day exploit that was discovered in a very popular open-source package that could be manipulated. In the entire world, they find it and fix it overnight. Identifying Vulnerability Through ObservabilityMike: By providing observability on the whole stack and understanding where it existed, our customers at Dynatrace were able to find that instantaneously.  The minute it was identified as a vulnerability, we could show specifically what was going on and at least helped people with the, "How am I going to get to the point where I know exactly what happened and I can close that door as fast as I possibly can?"Now, as we move on, it gets to, "Okay, great. Now let's move it into, 'I'm going to take automatic action and do a remediation on that.'" And there's more and more of that going on. But security is playing an increasingly large role in this. We should really be talking about DevSecOps teams to correct myself, are increasingly expected to build security into the applications and in the infrastructure, and setting up and ensure through things like what we're doing.Carolyn: How do you see observability fitting into DevSecOps?Mike: It's an absolutely essential piece of it, and here's why. DevSecOps, just in the broadest, most simple terms is the idea that responsibility for all of this shifts left. When I say shift left, it used to be we'd write monolithic code, we'd throw it over the wall. The people would operate the code on the other side of it. And there'd be this finger-pointing game of, "It didn't work well. What I gave you worked. Your system must be messed up," et cetera.The DevSecOps at the broadest sense is let's shift that responsibility left and give development the responsibility to build operability into reliability, resiliency into the product, as well as building the security of the product from the beginning. How Observability Fit Into DevSecOpsMike: To make that happen, you need to provide the instrumentation so that they know what's happening in production. Or what would happen in production when I put it in production.Then if I can provide precise root cause and get it to the next level of like, "Not only did this go wrong, or could it go wrong, or there was a slowdown, but here's specifically why," I can go fix it faster. I want to be able to make this happen. And really the purpose behind all of this is the world wants and expects flawless and secure interactions. Whether that's a machine to a person or whether that's a machine to a machine, you expect it to be flawless.That's a fair expectation. And as we go more and more digital with the world, and that's kind of the whole idea of digital transformation. That's why we expect this flawless result. In the commercial sector, it may be in many ways more forgiving than elements of the federal sector, where you guys are talking in your audience sense.The idea of having something go wrong or making a wrong assumption in software that the interaction doesn't go right can be immense. It hits not hundreds, not thousands of users, but tens of thousands to millions, to hundreds of millions of citizens.Mark: Well, it could be life dependent. I mean, and the DoD in the IC space where mission criticality means the life or death, it couldn't get any more gray than that.Making Decisions With Precise Accuracy Is RequiredMike: Yes, that's absolutely right. A big part of this then is all of this data that these modern systems are putting out, it's like, okay, how do you take that data and you turn it into an answer so that you know specifically what's happening? And then once I have, if I can get my answers precise enough, how do I then automate based on that? So that I can get to a point of being able to automate as things go on?Mark, to kind of go on your life and death scenario, it's like sometimes I talk about this from a self-driving car's perspective. Which is it's a car needs to observe everything that's going on in its environment in real-time to kind of make it happen. What's it like outside, what's the speed limit, where am I on the road? Are there other issues to deal with? But then it needs to make decisions, and it needs to make decisions with precise accuracy.In order to automate, you need to be able to make decisions with precise accuracy. You can't approach a crosswalk in a self-driving car if that day ever comes, and be unsure whether it's a shadow or a pedestrian. You just can't and you need to get down to that. It's no different than IT, and it's no different in the observability space. Which is if you're going to automate remediation and allow people to innovate, that's going to have to happen with very precise root cause and a positive AI that's kind of underneath it and those types of things.Mark: Well, that's a great example of that, kind of putting in it context so everybody can understand. Monitoring Versus ObservabilityMark: Carolyn, if it's okay with you, I know that Mike started tapping into this whole DevSecOps concept and I wanted to ask a question about that. Maybe you could peel in and back a little bit further, Mike. And so in a recent article by Dark Reading, you stated that today's rapid pace of innovation coupled with the complexity of modern software development has elevated the need for automated orchestration.Mike: Yes.Mark: Can you talk a little bit about this and how do you see this changing for us?Mike: Yes. I remember the entire context of the article. But I certainly kind of understand the subject and kind of what we're talking about that way. This complexity curve is not going to stop. As we go from monolithic architectures to cloud architectures. As we go to containers and microservices, as we go to multi-cloud, as we go to huge scale. These systems, we go to change that just does not stop. It's kind of a constant change. These systems are all generating immense amounts of data. Both in the variety that they're generating, the volume that they're generating in the speed at which they're doing it. Basically what it says is things have to change in the way that you manage your systems.We started at the top of this as monitoring versus observability. That's a good example of we just need to think, kind of change our mindsets as we're going to go through that. You have to change the way that the teams work as well. And that is getting the teams from reactive, "Hey, I've got a problem. How do I go fix it?" Observability DataMike: To proactive looking and observability data, and anticipating what problems are going to come up and how do I address them before they impact end-users. Otherwise, people would just be completely buried and there'll be...

Observability Explained with Mike Maciag

Richard Ford

Richard Ford, Chief Technology Officer at Praetorian joins Tech Transforms to talk about the cyber security threat landscape. Red team versus Blue team is a common and effective threat protection practice, but what could cyber security experts gain from team Purple? Listen in as Carolyn and Mark learn about the importance of managing your attack surface, implementing multi-factor authentication, and protecting against cyber phishing attacks. Episode Table of Contents[00:30] Our Biggest Cybersecurity Threat in the Last Quarter[07:39] Which Is Easier: Defense or Offense[16:40] Why Do We Need Single Sign-on[24:54] The Team Purple IdeaEpisode Links and ResourcesRichard FordPraetorianThe Clothes in the WardrobeSauces and ShapesEssentials of Classic Italian CookingGame ChangerOur Biggest Cybersecurity Threat in the Last QuarterCarolyn: So today our guest is actually an old friend, Richard Ford, who is Chief Technology Officer at Praetorian. For over 25 years, Richard has been able to design and implement NextGen product strategies and provide customers with the best threat detection available. Today, we're going to talk to Richard about the cyber threat landscape and what a good defense looks like. Richard: Hi, it's nice to be back on a call with you Carolyn, and Mark, it's good to see you.Carolyn: Yes, really good to have you today. So let's just jump right in. I want to know what your view is, what are our biggest cybersecurity threats? What does the cyber security threat landscape look like and how do we defend ourselves from it? So there's like three-part question there.Richard: So, we're starting with an easy question. I think the threat landscape is incredibly messy and I think that the most important part to think about is change. So if you think about just the last quarter or two that we've gone through you had, like log4shell someone we're all running around looking for log4j vulnerabilities. Then it's Spring4Shell, which wasn't as serious, but was still pretty nasty if you were impacted. The problem, we have this tremendous rate of change so the thing that was important to you yesterday may not be the thing that's important to you today. It's unlikely to be the thing that's most important for you tomorrow. So when we think about the threat landscape, the first thing to say is, if I give you an answer, it's like looking at a single, still image from a movie and telling you've watched the movie, right?Cyber Security Threat LandscapeRichard: Then as soon as we go click, you know that threat landscape will change. With that said, I do think there are some common themes that keep coming back, right? So there's a threat we have around being desperately short of people. There's a threat around, we don't know what assets we have. Even if we did know what assets we have, we don't know what they're running. Then the business conditions are driving us forward so quickly that it's difficult to keep security on the front burner. It sometimes drops to the back burner so we don't think about security as much. Perhaps, as how do I meet these business objectives that we have. I think this has created this sort of very unpleasant, perfect storm that will keep us well on our toes. I don't know, for the next couple of decades, it feels like.Carolyn: So when you say that we're constantly moving forward, changing, at the same time, I mean, are we still dealing with like SolarWinds? So as we're having to look to the future, we're still dealing with all the shit that's happened even a year, two years ago. Is that true, or like, are we good? We took care of it?Richard: No, it's definitely correct right, so all vulnerabilities never really go away. So you have all those things sort of trailing behind you like the comet has a tail, and new stuff coming at you. I think to be a successful CISO or to operate the business successfully, what you need to be really good at is prioritization. So it's about dealing with what is the biggest risk for you right now. Cyber Threat Landscape Varies Depending on Who You Are and What You DoRichard: And I think that leads us to a very important point that we talk about cyber threat landscape. But it's different depending on who you are and what you do. So the biggest risk, for example, for government might be very different than critical infrastructure, might be very different for sort of mom and pop SME that's sort of operating the corner store. Each one of these has a different threat landscape that they live in, different risks and different risks to the business.Not only that, but yes, this is all additive. So we still see scams for all vulnerabilities as we look at our threat intel. I remember going back a few years, there were viruses that used to trigger on certain days of the month or certain months of the year. For years afterwards, you would see these viruses fire up and start scanning things. Which means that there were still people out there who were still infected, which is just stunning to me.Carolyn: Ah, the good old days when we knew the day that it was going to happen, the day of the month it was going to happen.Richard: Yes exactly. I still remember the old Michelangelo virus, right? When it was like a trigger day was coming and everyone was counting down to what would happen on Michelangelo day. But I guess that just shows my age or perhaps the more positive spin is my longevity in the industry.Carolyn: Your experience.How Richard’s Experience on the Offensive Side Affected His Approach to the Defensive Cybersecurity LandscapeMark: So speaking of experience, Richard, you have an interesting background. Because you have experience in both the offensive cybersecurity landscape and the defensive cybersecurity landscape. So can you talk a little bit about how your experience working on the offensive side has impacted or affected your approach to the defensive cybersecurity landscape?Richard: Yes, so I think the offensive and defensive sides that are so intimately related, it's like thinking about two sides of a piece of paper. They're really one, you can't peel one side off a piece of paper, at least not very effectively. So I think that to play a good defense, you have to have mastered offense. I think we were chatting earlier, as we thought this through and we were talking about chess. It would be like me saying I was a chess master, but I can only play the white side of the board. I'm not very good at playing black or I'm a master at black. I'm not really very good with my white opening systems.You have to be good at both to really be rounded out. I use chess as an analogy because it's an adversarial game and that's exactly the sort of wrestling around we do in the attacker space. So I don't think you can truly be good at defense without understanding the ways of the attacker. I don't think you can be a great attacker without having a good understanding of the pain that your attacks cause to defenders. Because there are things I can do as the attacker that make certain defenses untenable, even if they're effective. In the sense that they stop me from getting in, but I can make it so it's really hard to use. Maybe I make it noisy for you.Which Is Easier: Defense or OffenseMark: Well, is it easier to play offense or is it easier to play defense?Richard: Oh, that's definitely an easy question. Yes. So I'll say that I've never really lost playing offense. I'm sad to say that playing defender is much harder and we can talk about why, but it's definitely easier to be on the offensive side.Carolyn: Let's talk about why.Richard: Well, I mean, step one, it's more fun, right? Who doesn't like going on the offense. It's that adrenaline rush when you sort of manage to get your exploit past some of these defenses. But I think the other thing is that if you're a business, you have this very large attack surface, right? And all of it has to be secure and it has to be secure all the time.So if you think about a pen test, a pen test might tell you that your attack surface at 7:55 PM on a Tuesday in April is perfect right? Can't get it. But an administrator spins up a box for testing or you miss patching something because a new vulnerability came out at 8:00 PM and suddenly you're vulnerable again. So as an attacker, I'm pretty good at finding vulnerabilities today. But if I don't find a vulnerability today and it gets me into your system. I'll wait till tomorrow and I'll nail your system tomorrow. You have to be good 365 days a year, 24 hours a day. I have to be good once and I can just wait for you to slip up.Mark: Do you guys do this in your current role? Do you play these games? You know, red team, blue team kind of thing?We Are Not Taking Advantage of Team PurpleRichard: Yes, we absolutely do. Praetorian is a company, it’s a mix of product offering and services offerings. Our services offerings, we absolutely do red and blue teaming with some pretty large customers. One of the things that people don't take advantage of enough is a purple team, right? Which makes it less adversarial. So the thing with the red team is we're coming in, we're going to root your network. That's fun and there is value for the customer. But it's very adversarial. You're trying to catch me, I'm trying to wear.What's really fun is a purple team where we're working on both sides of the line. We're working with the blue team to see if we can see it. And we're working as a red team to see if we can get it and that's a little bit more of a collaborative game. So there's a lot of opportunity for knowledge transfer and learning to our customers. It's not just about, can we get in? Because we pretty much always do, it's about did you see it? And how can you improve your defenses so that when you're breached that way next time, you do better?I think purple teams are actually underutilized in the industry. They do move away from this adversarial game to more of a collaborative game. I think they're more fun in some ways, too, and they have better business value.Carolyn: Would you say that the purple team is where your own employees would fall? Like you've got your unintentional insider. You've got your admin that spins up some server that you didn't even know was coming and creates this vulnerability. So is that like, just as you're describing, I haven't heard the term purple team.Do Employees Fall Under Team Purple?Carolyn: But as you were talking about it, it made me think that's where we live as employees. Is that a fair statement?Richard: Kind of. I mean, I think there's a lot of unintentional harm that we do as employees. A lot of well-intentioned moves lead to security risks. But a purple team is sort of when you blend, obviously, from the name. A red team where you've got a group of people who's trying to get in. Blue team, a group of people who's trying to stop you from getting in where you blend those. So it's more about, did you see the attack? It's about improving the defenses and the resilience of the system. As much as it is about breaching the system.Mark: So, Richard, you've seen this kind of play out across government agencies and commercial industry. Who's better at it? Commercial or government?Richard: So I think it's really hard to lump any large group of people into buckets, right?Mark: He just went right down the middle. He went purple.Richard: Yes. I mean, I think they have very different challenges for a start, right? But I think businesses range from really very, very good to really very, very bad . There are some targets that come across our radar when we're on the offensive side of the world where we're like, oh, that's a really hard target. These folks really know their onions, they really know what they're doing. We're going to have to pull out our A-game to find a win. There are other companies where it's like shooting fish in a barrel where the barrel is big and only contains fish.Who’s Better in Playing Team Purple, Government or CommercialRichard: Now the government is different. The government, especially when we're talking about the federal government, it's shocking to say this, it's a little bit more organized. Because there are certain standards that they're required to adhere to. So there's more sort of governance. Now, there are still different levels within the government and especially when you get into state government and sort of governmental agencies that have complicated missions, NASA would be a good one if we want to chat about that because they have some very interesting mission requirements.But I'd say, in some ways, the government is a little bit more homogenous than the top end. Some of our intelligence agencies, they have pretty solid security. The fact that you can legislate and you can enforce does make some of that a little bit easier. The flip side is that it's very difficult for the government to compete on salary with a top salary in an industry. So there's a sort of constant sucking sound from the business side of the house pulling top talent away from the government. So they definitely have challenges around staffing.Mark: Well, you talked about staffing, this is the, like the second time you brought up people. As a challenge, can you talk a little bit about that? What you've seen, how maybe it can be addressed or how you've done that in the past?Richard: Let's define the problem. Cybersecurity people are really expensive and they're hard to come by and they're hard to retain. If I was a mercenary, I could flip my job every 12 months and probably have a very nice raise sort of built into my paycheck and that's a problem. What the Industry Can Do to Win as DefendersRichard: There are only two ways to solve for that. You either need to get more people or you need to use technology to get better productivity out of the people that you have. The right thing to do of course, is both. You need to take that sort of left-hand and that right-hand approach. I think there's some interesting things that we can do in both that will dramatically improve the outcomes that we have as an industry.Carolyn: Going back to being a defender. You know me, Richard, I like you to just tell me like how we fix this. So give me the McDonald's version, like top three things that government, industry can do for some quick wins as defenders.Richard: So I think that it all starts the really honest assessment of where you are in your maturity. So there's no one size fits all. Especially in the business world, there are small companies who don't have endpoint protection. Or they're not following anything that's remotely like best practice with understanding even where they are. They haven't even asked the question of what is my cyber maturity?So I think all these discussions start with a good measure of where are you on that curve because where you are defines what you should do. With that said, I think that most businesses get breached because of software rot. That's something that's hanging out there and it's unpatched and you don't even know you have it.So managing your attack surface is incredibly important. I think moving to things like single sign-on and multifactor is incredibly important. And I think having a robust set of defenses around phishing, which is the sort of easiest, common way here.Why Do We Need Single Sign-onCarolyn: Still number one way, right?Richard: Yes.Carolyn: Like still today. It is the number one way.Richard: Yes. I mean, because people are people and computers can be quite difficult to break. But getting somebody to send me 500 Steam gift cards because I texted them can be quite easy, right? Especially if you take your time in target selection. From a mathematical standpoint, if you think about it like a game, there's no cost of predation. If I text every one of your employees say, "Hey, this is Nathan, the CEO, can you call me back? I want you to buy some gift cards for surprise for accounting" and boy will accounting be surprised. You know, all it takes is one person to go, "Oh, it's the CEO. I'm so excited about that."Carolyn: Yes, no, I just had this conversation with my mom this morning. I said, "Mom, there are people praying on our need to help with Ukraine right now. You're going to get asked for money from people who are bad people and who are stealing it and are not. But we're in this state of emergency right now where we all feel like we need to help. So we forget this good hygiene of don't respond to that."Richard: Yes, exactly. So that's why I would say things like single sign-on a multifactor go hand in hand with phishing because they can reduce some of the risks of being successful.Carolyn: Okay, but help me with single sign-on. Again, like I know it's good but if all my passwords are in one place, if they hack the single sign-on, then I'm really screwed. So tell me why it's more secure?Why Single Sign-on Is SecureRichard: So, as I like to remind customers, one ring to rule them all did not work out very well for Sauron in Lord of the Rings, right? So yes, you have a single point, that's scary. And if we wind back to the news cycle, we just had a little bit of an Okta scare. Which was a really interesting story. I mean, it was a third-party issue, it wasn't core Okta, but it was still pretty scary. It made people think a lot about the value of single sign-on. But what you're doing is you're trading one set of risks for another set of risks, right? So the question is, if you don't have single sign-on, you probably have either password reuse run rampant. Or you have people getting breached because they gave up their username and passwords, they're not using multifactor. So in the sign-on, yes, you're putting your eggs in one basket, but then you need to watch that basket really carefully.Carolyn: Oh, the multi-factor thing. That's key, right?Richard: Yes. Multifactor is really important nowadays. I mean, we've all been sort of speculating about the death of the password for years. One day that prediction in a threat report's going to come true. Or we're finally going to get rid of usernames and passwords and do something that's a little bit more sophisticated. But the reality is, I think, we're stuck with it for a while, but yes, multifactor is a way to buy down risk around account breach. The Things You Can Do to Buy Down the...

Threat Team Purple with Richard Ford

Join us on Tech Transforms Federal News Round-up segment, So What? Hosted by Carolyn Ford and Tracy Bannon. This week, we talk to Katy Craig, retired Navy Chief, now Adjunct Faculty at National University, &amp; Director, Security Architecture at Aquia, Inc. about some of the biggest news in the federal space. Listen in to hear her thoughts around deep fakes, non-traditional warfare, and President Biden's recently released announcement to protect against cyber attacks.Episode Table of Contents[00:25] Monthly Federal News Roundup [02:20] Federal News #1: President Biden’s Cyber Security Fact Sheet[10:12] The Catalyst[14:24] Federal News #2: Zelenskyy’s Deepfake [20:55] Federal News #3: The Threat Model[25:26] Federal News #4: Russia Is Running Out of Storage SpaceEpisode Links and ResourcesKaty CraigAquiaFact SheetOrder 14028 Monthly Federal News Roundup Carolyn: This week, we are launching our newest series, 'So what?' It is Tech Transforms' federal news roundup. Every month, Tracy Bannon, senior principal at MITRE joins me to unpack some of the biggest trending news topics in federal technology. Tracy, we've been trying to do this, make this happen for a while. I am so happy that this is our inaugural episode. Tracy: Thank you. I'm really excited because there's so much incredible stuff going on and we keep talking and now we want to talk with others and I'm doubly excited to have a good friend and mentor with us today for our first episode, Katy Craig.Carolyn: Yes, and Katy is a return guest. We've had her in the past on Tech Transforms and Katy is Acquia's chief of staff, cyber security expert, and retired Navy chief. Today, we're going to talk about, really the number one headline in the news these days. We keep hearing terms like nontraditional warfare, which is essentially the fifth domain of cyber, and President Biden's recent cyber security fact sheet. And just what it all means, like why is it all happening right now? And I want to just go straight to President Biden's recent announcement, this fact sheet that is. It's titled 'Act Now to Protect Against Potential Cyberattacks'. I want to go to you Tracy, and just unpack this for us. What does it mean?Federal News #1: President Biden’s Cyber Security Fact SheetTracy: So I believe it was March 21st, the White House released this set of guidance and it is really practical, general guidance. And it really is focused on two different areas. It's kind of like for everybody, for corporate America back up your data, use multifactor authentication, encrypt your data. There's also a call to arms, to tech companies and software organizations that says, you know what, there's a NIST standard and we have an order out here, it's order 14028. We can provide all the links later. But those two things, they're saying we got to get real about this. And the reason that it came out now is that we need to hear it now with all of the things that are going on in the Ukraine. It was an opportune time. We've had all kinds of security incidents and breaches and other things over the last year or two, but there are some shockers that are coming to the surface that made this very timely for the White House to release this guidance.Carolyn: So you really feel like this guidance came out because of the war in Ukraine?Tracy: I think it was probably teed up before that, probably for quite a while. None of goes very quickly. Any kind of guidance that comes out in this way has good generalized information. I would've put it out a year or two ago at least, if not before that. So for me, a little late to the game, but I'll take late because it's there and we've got to have a full-court press around this. A Call to Federal Agencies, Industry, &amp; CommercialTracy: I'll say the one thing that I found super curious in the entire set of materials was that there is a call that says, "Hey, all of you corporations, doesn't matter how big or small you are, get to know your local FBI field office or your CISA regional office." Which is your, I think it's cyber security and infrastructure security agency.  I thought that was curious because it kind of meant to me, it was kind of a leading indicator that there might be more that's on the horizon that we're not anticipating, if I need to have a relationship with the FBI.Carolyn: Interesting, this is a call to our federal agencies and to industry to commercial.Tracy: It is absolutely. The first section is a call to corporate America. Hey, corporations do this and get to know your FBI field offices. The second part of it is all around tech companies and software companies. He doesn't necessarily directly say, "Hey you government agencies, hey DoD, hey IRS, hey any of your organizations." It's for the population. This is a broad sweeping set of recommendations.Carolyn: Katy, do you want to comment on the significance of the timing and just this announcement in general?Katy: Yes. I agree with Tracy that I think it's probably been in the works for some time, better late than never. I think the encouragement for agency or organizations and industry to reach out to CISA and FBI speaks to both pre-positioning for if something else does happen and we have to coordinate. It will be helpful for organizations to know their local FBI and CISA rep.Executive Order 14028Katy: But it ties back to the executive order that he released on zero trust, 14028, Tracy mentioned. There's guidance in there for government agencies to encourage vulnerability reports. Almost like if you find something vulnerable in our site or any of our systems or services, please tell us. So this move toward transparency, it's new and it's not yet been codified. Don't forget, there are still some states where if you report a bug in a website, they can arrest you for violating computer privacy statutes and regulations. So this is very curious because it's kind of out ahead of the legislation, but it really does point to, we need to be transparent. We can't have silos. We have to share the information across, especially if we're worried about critical infrastructure, like we are.Carolyn: Okay. You've talked about this a lot, Katy, about trust in culture, our work environment culture, and you just said that if I report a bug, I can get arrested. How is this going to work? If we're being called to, if we see something, say something, and oh, by the way, you might get arrested. Did I just interpret that wrong?Katy: No, you didn't. That's the conflict that currently exists and why government and the administration is making it very explicit and overt. Please get to know CISA, get to know FBI. I'm sure there's federal encouragement across the states to update their cyber legislation. Federal News #2: Now Is When We Need More TrustKaty: Because the law currently is like, if you hack, or if you use a system not for the intent that it was meant to be used for, the laws are currently written to punish the person who got in. So it's a sticky wicket, something that I'm sure they're thinking about. But to me, that's what I hear the president saying. Like, we know that we have been very discouraging in the past when you let us know we had vulnerabilities in our systems. That time's over. We want to encourage, we want to have bug bounties, we want to splash on our pages that say, "If you find anything, let us know." And so I think that's really what's being discussed here. It's time for us to be more trusting and transparent between industry and government.Carolyn: Okay. I see. So this fact sheet is hopefully a way to build some trust back.Katy: It restates what's in executive order 14028, which encourages more transparency, which tells the federal government, you will be more welcoming to vulnerability report. So that is the direction we have to go in if we expect industry to do this with us. with the government. Tracy: I mean, at the core center of this is getting back to trust, trust, and trust. Which is boy, that's quite a commodity right now. And I don't mean that in a negative way. I mean, it's hard to come by trust and trustworthiness at all different levels, interpersonal, corporate, governmental, government to government. It is messier than it has ever been. And yet now is when we need more trust than we've ever had, or at least the scaffolding to provide us with that trust. The CatalystTracy: I kind of think that's where you're going, Katy, is that this gives some scaffolding. If we're going to be transparent, this gives more scaffolding to people to react.Katy: Yes. I mean you think about private industries, they're not required to. And so what incentives do they have to be open about a vulnerability they've discovered, right? So it's going to take some time for policy and legislation to catch up, but I agree. The scaffolding, it needs to be in place so at least there's a means and a method for sharing the information, especially if something major happens.Tracy: And do you think any part of this was driven by, the timing of this was driven by what we're seeing in the Ukraine or any other catalyst moment?Katy: Yes, I do, I think we've seen this before this isn't new, right? We can think about the last time critical infrastructure was brought down by cyber. There's been several incidents in recent history. I mean, we saw the signs, the intel was there, and when Russia annexed the Crimea, they used cyber also. I think all of us are seeing the impacts of the Russian invasion in Ukraine. Some of the coverage, how certain American social media companies like immediately shut down. The fact that so much of our world economy is supported by cyber, by the networks, by internet protocol traffic, logistics is impacted, all of it. There's so many ways to hurt a state or a country. And cyber is a very low barrier to entry now. How Important Is the Fifth DomainKaty: And it's kind of like, what can you trust if anybody can get in there and start mucking around with your networks? I think the fact that Russia and Ukraine are at war, it's obviously a catalyst for why president Biden is paying more attention to the fifth domain, in my opinion.Carolyn: How important is the fifth domain in any war, but specifically right now with the Ukraine?Tracy: I think it's front and center. We're watching what's happening on the ground. We are seeing new technologies like the usage of drones, and so we're seeing six gen and other UASS. So the autonomous vehicles, unmanned autonomous vehicles. But at the end of the day, we're also seeing this dramatic impact on the different pieces of cyber, how we can impact the population, how we can impact the country, how we can shake the foundations in very different ways. It's not only mucking with the network as Katy would say, it's not just that. Also, it's being able to find different ways to affect people groups. It's interesting, my daughter did some studies in how social media could help as there's new government uprisings. And she was looking in the middle east a number of years ago, and I paid attention to it a little bit, but didn't apply it in my day to day. Until this Ukraine thing popped up on the horizon and we started to realize how much you could influence a population.I mean, think about the deepfake that came out in March about Zelenskyy. It was very poorly done, thank heavens, and he had already prepared for it. But here he is in this deepfake. Federal News #2: Zelenskyy’s DeepfakeTracy: If you're not familiar with what a deepfake is, they can sample enough of your different recordings of you and your voice to be able to put together an algorithm of you saying something. And there have been some famous ones of Tom Cruise and other people that are wonderful and fun. This wasn't wonderful or fun. This was Zelenskyy saying, "Hey, countrymen, we're going to surrender." And he very quickly, immediately shot back so there was that fast credibility. It was poor quality, and he immediately was credible to come and say, "This is bunk. This is not me."But just imagine, imagine as those deepfakes get better and better, that's got to scare people. Not just from a government perspective, but that has to scare corporate America as well. Katy, are you seeing people concerned about deepfakes or doing anything to obfuscate or to protect themselves or, what do we do about that piece? That's such a scare. For me, I normally don't believe something. I go and look at it. Well, now I'm going to look at it and now I find out that my reality is bunk.Katy: Yes. I'm scared too. I don't even know how to respond. I mean my mind is churning like how would I validate it? Because I usually believe my eyes. I'm like you, I go and look it up. I want to validate what I'm being told or what I'm reading. And so these deepfakes are super concerning. I know that there are people who are less skeptical than I am, who just believe what they see or what they hear. I mean, like even in my own family. So I do get very, very worried about that type of technology in the hands of very skilled propagandists.How Cyber Ties Into the Kinetic Part of WarfareTracy: There are a couple of companies that I'm learning about who are debunking deepfakes. They've got algorithmic techniques that they can figure out very quickly if it was manipulated.Katy: Fantastic. That's what's wonderful about cyber, right? Something happens that we didn't know or didn't have before, and maybe it's used for bad. So up springs a counter force to fight for good. And so that's how the cyber domain keeps evolving. We don't even know yet what the future's going to hold really.Carolyn: So yes, we talk about the deepfakes and they are very scary. And then I think about guys on the ground that are fighting with guns and dying. How does cyber tie into the kinetic part of warfare? So we hear this untraditional, nontraditional warfare. I was like, that's not right. So deepfakes definitely like the psychological part of it is devastating, but I feel like there's a tie into the kinetic part of it too, from the cyber angle. Can either of you, Katy, can you speak to that?Katy: Everything's enabled by cyber, so it's not any different for armies and navies either. And you know, like Tracy was mentioning unmanned craft, autonomous vehicles, that is the future of warfare. When you think about like Navy ships out in flotillas, they chat. I mean to be sure there are fallback methods. But when you think about GPS and timing and how easily you can take down a force's ability to fight back by attacking a logistics chain. Or disrupting their air traffic control, all the systems, all the infrastructure that is facilitated by cyber then becomes part of the battlefield.Lower Barrier to EntryKaty: And so the fifth domain, cyber, being added to sea, airspace, and land that's in there for quite a while. I think DoD has been dealing with cyber as a war-fighting domain for well over 10 years. So now it's almost like in a lot of ways, it's still the same as the other wars in the past. It's just, we have better means and greater reach and technology is just making the battlefield and the war smaller. But psychological operations, propaganda, misinformation, those have always been part of the approach.Carolyn: And easier to do because of cyber.Tracy: It is easier.Katy: Low barrier to entry.Tracy: It's a much lower barrier to entry. Again, going back to the deepfake mentality, before it might have been a leaflet or a pamphlet, right? A couple of generations ago. I could choose to read that and say, it's bunk or it's real. But it's much harder when you are looking for right, we used to turn on the TV to get on news and the news was true. Now, what do we turn to? And I'm not talking about news sources. I mean, what if that deepfake, getting people to identify that as early as possible.And Katy, you brought up something else about trying to reduce the number of humans on the battlefield. It brought to mind an example of a cybersecurity, one of many, many, many cybersecurity risks. If we're thinking about a drone, for example, if we're thinking about the ability to have unmanned weapons. So there's talk about what that's going to look like in the future. Federal News #3: The Threat ModelTracy: There are a number of different protocols that are being discussed on what you can and cannot do. But imagine the situation where they send an armed drone to take out a tank. From a cyber perspective, somebody taps into that and changes the algorithm. So it's not really seeking a tank. It's now seeking a school bus.That potential is hyper-scary from that perspective when we think about tapping into networks. So the core of all of this, our ability to rapidly identify, predict, identify, and to deal with cyber is an amazing thing that we have to double down on. And I know, Katy you've been in this space for a long time dealing with that. But how does that change or do you think it changes? Do you think it amplifies what we're doing these days from a ZTA and from looking at the threat modeling? Does it change the threat model? Does it make it bigger?Katy: Absolutely. It does make the surface bigger, but arming an autonomous vehicle with live ordinance and then pointing it at an adversary's infrastructure or enemy armored vehicle, I don't know how soon we're going to get there. There's just so much like international laws about armed conflict that I think would have to be revisited. It's still kind of a gray area when we cross from cyber to kinetic. Whether or not the nation is justified and you in escalating to kinetic, for example. Even today we're not really responding or hacking back. If someone hacks us, we say we're defending forward. We All Live in The Same House Katy: Nobody's really stepped out there yet to clearly define how using cyber with kinetic impacts, how that's changing the laws of armed conflict. I don't think we're going to be able to answer that today either. But it's definitely introducing far more complexity and it's moving so much faster than we can actually codify and update laws and policies and treaties.Tracy: And I think it's going to depend on the different nations, right? The different actors in all of this. My question kind of came from some reading I was doing. I read a book recently called 'The Kill Chain'. I think it's by Cameron Boozer. I'll find the name and post it out. But that led me on a little bit of an afternoon Google chase one day, trying to understand. And there have been some recent tests by China that would point to them preparing and trying to figure out how they would do this....

So What? Tech Transforms Federal News Round-up with Katy Craig

Listen in for part 2 of our women's panel with Kris Saling, Chief Analytics Officer for the Army Talent Management Task Force and Director of People Analytics in the office of the Assistant Secretary of the Army (Manpower &amp; Reserve Affairs), and Jazmin Furtado, Liaison at AI Accelerator and Data Strategy Lead at US Space Force. In this episode, Carolyn, Kris, and Jazmin get real about the power of the collective, emerging solutions, and the importance to assess and provide within federal government technology. Episode Table of Contents[00:31] Meditation Is Really Good[07:40] Where Are We Going With AI[13:14] Are Women in Tech Paid Equal Like Their Male Counterparts[20:40] Tell People How Much You’re MakingEpisode Links and ResourcesKris SalingJazmin FurtadoM&amp;RASpace ForceMarket Connections SurveyMeditation Is Really GoodCarolyn: We are in part two of our women in technology panel, with Kris Saling, Deputy Director of Army People Analytics, and Captain Jazmin Furtado a Data Strategy Lead at the US Space Force and Space Force Liaison at the MIT AI Accelerator.On today's episode, we're going to dive more into government technology in general. I get Kris and Jazmin to do a little fortune-telling on where tech is headed. What advancements they've seen in their careers. And we get real with some salary talk. Just a little reminder, the views of Kris and Jazmin are their own and do not necessarily reflect the views of their agencies. Now let's get to it on Tech Transforms with our women panel. I know that meditation is really good for the monks that live in caves in India. And I know that I should probably do it. Until I saw the science behind it and what it can really do for my brain. I dabbled in it. I never fully embraced it. And once I started understanding why it was working and that there was true science behind it, man, I'm all in. I'm just thinking of just one example of things that are good for me in my life, that I've been able to embrace and bring into my life because I understand them. I understand how they work rather than like you said, Kris, the leadership saying, "No, we don't give a shit about how you got there. Just give us the answer."Make The Process More EfficientCarolyn: But now you're getting people who really want to understand why. I would imagine that the program for the answers that you've been spoonfeeding them. The programs are becoming a lot more powerful and effective. Because the people who are taking those in the past spoonfed answers. Now really understanding them can truly implement them at a level that is a lot more powerful. Is that true?Kris: I would say that's definitely true because we're working on a couple of projects right now where we are trying to integrate machine learning into promotions and selections as a decision support tool. I'd never in a million years, would've thought we'd get a chance to work on that data and introduce something that is an algorithm into a just intrinsically human process. But we have enough people thinking along this vein. We have enough people looking at the data we've collected about how we read records and how we read files. And they're like, "There's got to be an easier way to do this. There's got to be something we can do to support the board, to pull out the key insights. To package them differently, to display them differently, to sort." And they came to us with the question of how can we make this process more efficient?And I just came back with exactly what the computer is supposed to do. It doesn't get tired, it doesn't get bored. Its attention doesn't wonder, and it can read things a whole heck of a lot faster than we can. So let's see how we can crunch your data a little bit better into more digestible packages for you to review. A Long Way to Go For AIKris: So we keep the human in the process. We keep that comfort level, but now the humans have enough comfort with the machine process.  It's not quite human-machine teaming yet. I'm hoping that we'll get to some true instances of human-machine teaming. But we've got an algorithm producing a product that's digestible and a receiver on the other end that trusts it.Carolyn: So you guys both heavily involved in AI, Jazmin, what are the advances that you see coming up in AI? Be my fortune teller for a minute. What is the landscape looking like in the next year, three years, even five years. Where's it going?Jazmin: I guess currently what we're seeing is a lot of actually pretty narrow cases of AI. I would say AI is at its current state, not as pervasive in all industries, as we probably would expect. It’s definitely very prominent in a select few industries. But there's quite a few businesses and just overall industries too, that just haven't embraced it to the same extent. And so we still have a long way to go until we see AI really integrated with a lot of our day-to-day work.Carolyn: Why do you think that is? I don't want to derail. I want you to come back to that, but why?Jazmin: So I think there's still nervousness by some groups that haven't used it or not as familiar with it. They are not sure how to use it. Or they don't know how it could immediately benefit their operations. Because they don't see the parallels or they don't understand how those parallels could apply in their day-to-day work. So that's a piece.A Legitimate ConcernJazmin: Also I think the lack of policy and regulation on AI technology. How to utilize and integrate AI technology into your business also scares a lot of people like, "Am I going to be sued? That's a legitimate concern. To what extent can I use this?And it's also seen as an extra investment if I'm not using it now. I don't know exactly how it's going to benefit me. It's a coin toss if that's really going to help in the long term. I think some people may think of it like that. Then why would I put up that investment now, if what I'm doing is working for me for the meantime. So there's that near-term view as well.Carolyn: So we conducted a survey. I worked with Market Connections to pull IT mission owners within the DoD and Fed CIV. And we asked them some of these questions. So what you just said, from your own experience is backed by the data, which we all love. Just that some of the biggest barriers that we saw IT mission owners site for not embracing AI.First, they thought it was super important and then they needed it. But they hadn't implemented it. And they didn't really have plans to implement it, partly because they're scared of it. They don't understand it. There's a big learning curve. There's a perceived expense. And their challenges, interestingly enough, were finding root cause and accomplishing everything that needed to be accomplished with a limited staff. I'm just sitting there going, "Hey, I can do this for you and you're not implementing it." So what you just said, like I said, has been validated. I'm sure not just by the survey that I did, but by others. So back to where are we going with AI? Where Are We Going With AIJazmin: I think we're seeing a lot of pretty big breakthroughs in AI technology in the industries that AI's really being embraced. I think we all know about autonomous vehicles, for example.Carolyn: Really are we going there?Jazmin: I think it's just a matter of time. Carolyn: Well, am I going to get an iron man suit then? Because that's what I really want.Jazmin: That may be a little bit further away. Flying, like individual flying capability is a little bit further away for transportation purposes than recreational. But the autonomous vehicle I think gives technology or just autonomy there in navigation I think is advancing. I think it is, that will be pretty transformative in terms of our job landscape. What we do on a regular basis. How much time is spent driving tour or driving to places, whether it be leisure, for business, and having that free time. I think a lot of people would buy into having that free time. Of course, there's still things to work out in that arena. But when that's ironed out, I think that'll be a pretty big breakthrough.I don't know if it's more near term or not. But the concept of the metaverse. I think AI is going to be very important there. AI is very foundational to both of these areas. But I think with the metaverse it's going to provide opportunities for a lot of advancements in AI technology in terms of how it's utilized. With the creation of the metaverse, I know the concepts are still really new. But the potential for it to gather a lot of data and be able to create virtual world. Exciting and Terrifying Possibilities With AIJazmin: It's going to be leveraging AI in ways that it wasn't thought of before. So I think those are really great areas for breakthroughs in AI.Carolyn: Yes. And think about what it can do to the diversity and inclusion arena. Because we can be whatever we want in the metaverse. I can be a woman, but I can also be a lion if I want.Jazmin: And interact. I know the possibilities are exciting, but also equally terrifying.Carolyn: Yes. A little bit.Jazmin: There’s so much unknown in that. But can't discount the impact that AI and technology is going to have in these arenas. Of course with great power comes great responsibility sort of thing. But I don't think there's any stopping it. It's just a matter of who's going to be at the table to help shape and mold those technologies. The who is the biggest part of it.Carolyn: Yes. So Kris, you were nodding your head a lot and really a lot when it came to the metaverse. So what are you seeing? What's your prediction?Kris: Oh goodness. It's hard to top things that Jazmin listed out. Those are kind of the ones that are top of mind. Looking in the personal space, one of the things we're studying is the psychology of human-machine teaming. I don't think it's science fiction I think a lot of it's happening right now, even with our limited AI. Since we have a lot of folks using virtual assistance of some kind to do any number of different functions.Human-Machine TeamingKris: We have virtual chat. We have all these different types of things that we're already interacting with. And we've done a lot of exploration of what the ethics look like in this. I think that's the piece that's going to come up fast because the technology is just going to explode. We have tremendous innovators. Both for better or for worse are going to go out and develop amazing things. I think if we don't think about how we're going to use these things and how we're going to expect them to interact with us. I just have a policy letter out for staffing on the use of personnel data for various purposes and various roles. And one of the roles we had to include was autonomous systems. What kind of data about our personnel are we going to share with these autonomous systems? Because they're going to be making decisions about how they interact with us.So I see a lot of interesting things happening in that space. But it's one of the things we've got to get through simulation. We've got to get through the world of what if and figure out how we want these things to interact. What kind of capabilities we need to build in our humans to interact with them. Because I think restraining technology at this point, just Jazmin said, it's not happening.Carolyn: Let's go back to Spiderman. With great power comes great responsibility. And I am so grateful that I am looking at two leaders in this space that I truly believe have our best interests. Our world, our children's best interest at heart and are going to use this power for good. Are Women in Tech Paid Equal Like Their Male CounterpartsCarolyn: But I want to come back around to something that we talked about in our last episode.  That's just the disparities that we've noticed in the workforce as a woman, challenges that we've run into. So statistics say that we are still not being paid. I hate that we're coming back to pay. But this is an important topic. That we are still not being paid the same as our male counterparts. Now I would hope that in the government, that might be better. But let me just ask you both. Do you think, do you believe that you are being paid exactly what your male counterparts are being paid? Kris, let's start with you.Kris: We're not going to take the cheaters' rule out and say that because of law and statute, we have to be.Carolyn: Yes.Kris: So I think the bigger question is, it's not a monetary cost. It's an opportunity cost more than anything. I'm going to talk both about women and minorities progressing through the system. We see different kind of fall off points where we fail to retain them and we fail to progress. And when we look at it, it's not because of any kind of overt bias or anything that we could fix easily with policy. It's because they're not being brought in.Again, kind of coming back to that topic about bringing into the network, bringing into the mentorship, bringing into the opportunities. They're either in branches or functions that don't typically get some of the all-star opportunities that allow them to progress rapidly. Or there are other things that kind of contribute to that opportunity cost. An Opportunity CostKris: So I think there are people who are moving through the space. There are people with very good reputations who are moving through the data space, especially. But I think as an organization, we kind of have to figure out how to broaden the talent bench that we're pulling from. So that we don't overly constrain who we're pulling from, for some of those opportunity positions.Carolyn: You've seen that with the data that you're looking at, this is not anecdotal. This is not just, this is what I think is happening. This is what you're seeing at a very macro level with the data, the opportunity.Kris: Yes, anytime we see the disparities, it's like we can almost directly pull back and look at who's in the organization? What functions are they performing? And as an army, we are very focused on command channels. And then anything that kind of falls in as staff or key enabler. Just even with the word enabler, you kind of classify that as secondary. It's something that is supporting my main effort. We've been trying to challenge that a little bit. Just looking at what the future of warfare, multi-domain operations, enjoying all domain operations look like. There's a lot of digital in those domains. And a lot of the functional areas, a lot of the talent sets that we need are I think going to become a lot more front and center. If they haven't already. I think not at the risk of sounding a little bit doom and gloom, but we really need to focus on those areas. I would say we are, but I can't stop beating the drum to focus on those areas.Are There Missed Opportunities for Being a Woman in Tech?Carolyn: Do you personally think Kris that you've had missed opportunities throughout your career because you're a woman?Kris: I wouldn't say because I'm a woman per se. I think it's more just because I'm an ORSA, I'm an Operations Research and Systems Analyst. And I'm not on a command track. So I've been lucky. I've had commanders who have seen some of the stuff that I do. They’ve seen my value and pulled me into positions where I can exercise that. But that's not true throughout my career field. So I don't necessarily want to say, "Hey, look what the Army's doing." Because they've empowered me to do all this stuff. I was like on one data point and I'm not a representative sample.Carolyn: Yes. And just for listeners that maybe aren't familiar and you too correct me if I'm wrong. But especially in the DoD, the pay scale is whatever your rank is, that's what you get paid. It doesn't matter if you're a man or a woman or a person of color. And that's why Kris, it was a very good point that it's the opportunity that there's the disparity in. Because theoretically, that pay has to be the same across the board. Jazmin, how about you, as far as pay goes, we just kind of level set that, but have you noticed missed opportunities or anything else through your career?Jazmin: So I've actually seen quite a few people in the technology realm. And I think this is echoing a lot of what Kris was saying in that, a lot of the incentives for tech professionals in the military are not equal. Or they're not at the same level as maybe more operational roles. Monetary Incentives for Serving LongerJazmin: So as in like the air force gives you incentives. Pilots, you have incentives to stay in for a little longer, you get a little, I don't want to say carrots. But there are some monetary incentives to stay in and serve for longer. If some folks are trying to get out after their commitment. But you don't necessarily see that same incentive structure at all is different depending on what sort of career fields you're in.And I think there is an effort and you see it in various ways that the services to try to flag people that do have technology specializations or technology backgrounds to try to focus on certain tech fields and operations research was one of them. To try to provide incentives for folks to stay in these fields. So we're seeing a little bit more. But it's definitely not as ingrained as the incentive structure that we see more in the operational community. I think that does play a role in that disparity, not so much from a gender specific realm, but from a job perspective, from a stem point of view.But I think all of these, the various disparities we see really can be combated in part by increased transparency. So exactly what Kris is doing and providing the analysis and providing that information out to the masses of what the challenges are and leave it to the individual to determine what to do with it.How is it going? This is hopefully unbiased. So this analysis, this is the information, this is the data, do with it as how you see fit. And that provides incentive for those that are being assessed to make sure that they are making the necessary changes to provide.Tell People How Much You’re MakingJazmin: Or to better their own organization in the long term and change their policies or procedures or incentive structure. To be able to keep and attract the talent that they need, which we need to attract the minority diverse fields.So I think transparency not just on the analysis front, but also on just the pay, just to get broadly speaking outside the government, there are more and more applications now where you can see how much someone in your career field's making. And I think some people want to hold that close and like, "Oh, I don't want to share what I'm making." I'm very much a proponent. Tell people how much you're making. Mentor people, tell them how much they should be expecting to make in these career fields?  Because if you don't have that...

Women in Tech Part 2 with Space Force's Jazmin Furtado and U.S. Army's Kris Saling

Tech Transforms: More Than Meets the Eye.  Global technology is changing the way we live. Critical government decisions affect the intersection of technology advancement and human needs. This podcast talks to some of the most prominent influencers shaping the landscape to understand how they are leveraging technology to solve complex challenges while also meeting the needs of today's modern world.

Women in tech unite on this special episode of Tech Transforms featuring Kris Saling, Chief Analytics Officer for the Army Talent Management Task Force and Director of People Analytics in the office of the Assistant Secretary of the Army (Manpower &amp; Reserve Affairs), and Jazmin Furtado, Liaison at AI Accelerator and Data Strategy Lead at US Space Force. Carolyn, Kris and Jazmin discuss the impact of self-awareness and the importance of data education and fostering change when it comes to government technology. Episode Table of Contents[00:27] Introducing the Women in Tech: Kris Saling &amp; Captain Jazmin Furtado[10:32 ] Take It From a Human Approach[17:27] Pulling Other Women in Tech Into the Circle[24:45] Women in Tech Are Influencing One Another[30:14] Women in Tech Are Making Sure They’re Helping EverybodyEpisode Links and ResourcesKris SalingJazmin FurtadoM&amp;RASpace ForceIntroducing the Women in Tech: Kris Saling &amp; Captain Jazmin FurtadoCarolyn: This week we are going full girl power, so Mark got uninvited. Today we have our Women In Tech panel featuring a couple of guests who have previously been on our show, Kris Saling, Deputy Director of Army People Analytics, and Captain Jazmin Furtado, a Data Strategy Lead at the U.S. Space Force and Space Force Liaison at the MIT AI Accelerator. Welcome back Jazmin and Kris to Tech Transforms to talk about your journeys in government technology.I'm really excited to talk to both of you again, but before we get into that let me do a little housekeeping. So I just want to remind our listeners that the views of both Kris and Jazmin are their own and do not necessarily reflect the views of their agencies. I'm just going to say that for myself, too. Because I warned this, too, before we started. I'm like, "I got some stuff I need to get out." And I want to be able to talk freely today.Let's start talking about challenges that both of you have faced being a woman in the technology space. The fact that we even have to say, "Being a woman in the government technology space," other than, we're in the technology space and we kick ass. I hate that we have to do that but I still feel like we do. I'm already getting up on my soapbox. But, let's start with you, Kris. Some of the challenges that you've faced.Kris: So, it's one of those where I don't want to say there aren't any challenges. But I've encountered so many of these challenges throughout my career. I just hit 20 years last summer, I'm going to hit 21 years this coming summer. Yes, it's almost the summer again.Kris Saling’s Challenges for Being One of the Women in TechKris: So it's been a long time of sitting there with the typical, the anxieties, the imposter anxiety, the "What is my balance between being assertive. And how do I not come off as, "Insert your," kind of "The common anxieties"? It really hasn't been all that different. I've been trying to figure out the right balance of how to present different things. How to present facts so that they are listened to. How to present data to an audience where not only do we have the schism between having an audience that's operational and I'm on the technical side. But sometimes it's very obvious that I know quite a bit more about the subject than the people I'm talking to.I think one of the biggest challenges is I really didn't get to know myself and how I wanted to present these things. Because I was very much fixed on how to present that particular image until I really got into data education and started teaching people. That really helped me find a balance in how I wanted to talk about very technical subjects, both with a technical and a lay audience.So I won't say it's overcome all the challenges. You still go out a lot of times, still the only woman sitting in the room. I do have a little bit of a reputation now that I can trade on. So I come into the room with a certain amount of that reputation. But I've seen a lot of cases where that hasn't been the case. Where people have come in and haven't quite known how to throw all those and hold their ground in areas where they're competent. How we make the opportunities to do that because that's where other opportunities come from.Captain Furtado Shares Her Perspective on Being Part of the Women in TechCarolyn: Jazmin, have you felt that?Jazmin: Yes, so a lot of the same things. I'm very aware of how I may be coming across. And depending on the level I'm speaking at, I have to maybe change the way I present something. Because I'm having to always pick apart and analyze what makes that person tick. I'm not saying that's maybe something specific to women. I feel like maybe everyone has to do that to some extent.But of course, I only know from my perspective how much of my time goes into not just the content but just my body language, my tone, the inflection in my voice, the pacing of my words. Because a lot is taken away already from visuals and the unspoken. So there's already a front that I put on and that I present to people when I walk into a room. And there's already preconceived notions of who I am and what I can do. So having to overcome those is maybe an extra thing that others may not need to.But I've thought about this a lot and I try to think about the other's perspective. I've come to realize that a lot of times, most of the times, there's not necessarily any ill intent behind how people perceive others. Maybe there's an audience that is not conscious of their own biases. I think it's beneficial for all of us to check ourselves and check the comments that we make in the workplace. Because things that may be seen as teasing or something that's lighthearted may actually be eating away at the mutual respect that you have for another person. They may eat into the other person's credibility as a professional, as a leader.The Imposter Syndrome Experienced by Women in TechJazmin: So please be cognizant of these comments because these small things, especially in a public forum, they start eating away at that. And it's not appropriate in the workplace to be making these side comments and thinking that there's no consequence. So just as an input, I guess, for everyone out there, when you're speaking just be aware of your slang or colloquial. Be aware of the unintended consequences of some of the things that are being said.Carolyn: I'm just going to admit this right upfront. I have found myself through my career. Because I've been in technology for 20 years now. Often the only woman in the room. I've felt like a little bit of an imposter. I started out in product management, definitely felt like an imposter there. Because I was interpreting what developers were saying, trying to understand what users needed. I was always the only woman in a sea of men. Then when I moved to marketing I suffered another kind of imposter syndrome where I thought, "I'm not really in the tech field, but I am." Like, "I need to be able to tell this story."This is taking a really long time to get to my point. Throughout my career as I look back, I've noticed that I have done things and portrayed myself in a way and used language that I thought would make me fit in more, drink too much, swear like a sailor. But I have to say I love swearing. So I've just embraced that as part of what I really like and no longer consider that me attempting to fit in with the boys because I just like to swear. But other things, even what you were just saying Jazmin about being cognizant of slurs.Fight Like a GirlCarolyn: I grew up with a cold war Army dad. Believe me, I have some slurs. And I didn't even realize how offensive they were until pretty recently. Some of the stuff that has come out of my mouth, I'm like, "I can't believe I said that," and towards women. I used to say, "Fight like a girl" all the time as an insult, not as props. So have either of you noticed that?Kris: So I think there's a lot of that, that's part and parcel. I've enjoyed my later years of being a little more senior ranking and a little more salty overall, of being able to call that out. And to stop people when they're making statements, or even making assumptions about anything having to do with women. Like, certain programs should be marketed this way towards women. That's usually where I start throwing things at them figuratively because we're virtual. But try to at least get their attention and say, "Hey, guys, you just othered an entire 50% of the population, 17% of the Active Army population. But that still is a large percentage of people that you just said, 'All of these people think the same way.'"One of the principles that we've been working on in talent management is getting away from the one-size-fits-all method of work and method of leadership. And that has really lent itself to fostering a lot of these discussions about how we work. In the Army at least, it's 1.4 million people when you consider all three components in our civilians, and they're all different and everybody is different.Carolyn: Oh, so take it from a human approach, is that what you're saying?Take It From a Human ApproachKris: Shocking, isn't it? As opposed to the industrial model that we employed over the past 50 years where everybody is interchangeable. And we don't see you as a human. We see you as some kind of a cog categorized by your grade and your career field. Instead, let's look at you as a person. Let's do some, shocking again, human-centric design, and let's start seeing people as people for capabilities. Rather than what we assume comes with and based on people's personal biases.They make a lot of assumptions that people come with a lot of baggage. So I think we're making some progress. Again, when I say we're making some progress it's like we're starting here. We know it still goes on heavily throughout the organization. But we're getting our foot in the door there.Carolyn: So you're not going to admit to anything that you've done in the past?Kris: Oh, you mean as far as things I've said or things I've done?Kris: I just spent 12 years as a combat engineer. So that was the first 12 years of my army, work hard, play hard, swear hard, still swear hard. I have to remember sometimes that I'm in an office building.Carolyn: Did you go into combat to prove something?Kris: I graduated from West Point in 2001 and all the women that I trained with there, all the women I met in my officer basic course in our first unit, we always were under pressure to prove that we belonged. It was always the, "Oh, we're going to prove that we can do this and we can do that thing." But it was always earning your place and proving you belonged, which was a heck of a lot of pressure.Women in Tech Experience a Lot of PressureCarolyn: Yes, the first has to be better, stronger, the first always has to. So what about you, Jazmin? Are you going to admit anything?Jazmin: Well, I can't actually think of any examples but I know it has happened to me. And I don't think anyone ever perfects the self-policing of the agency. Check yourself before you make statements. But as long as the intent is there and the effort, at least, in some regard have measured. And the progress is being seen and being able to proactively catch things before you say something. Or recognize that a topic may not be the best one, maybe there's another topic to bring up, it's great.I think in my previous job I didn't really appreciate the role that a person that's put in a leadership position or authority has over that culture. It's the little things that a leader does. The topics they bring up, the things that they decide to talk about just in a forum. What topic? Are you just going to talk about one topic all the time? Maybe sports, the stereotypical one. Who are you leading? Get to know them. What are the things that they're interested in and then as a leader, make sure that you can represent your team and their interests, and talk to them and connect to them in a way that is more comfortable for them.So when I was at Kessel and I actually saw that quite a bit. There's a lot of these cultures that are pushing for psychological safety and the training that comes with it. And seeing it more in the workplace, making me more aware, it makes me take a look, "Oh, what are things I said before." An Environment of Psychological SafetyJazmin: And I'm still trying to think of an example but nothing comes to mind right now. But yes, I think those trainings have been really great because the people in specific roles have a big part to play in that.Kris: Jazmin, if I can jump on one of the things you said about talking about the same topics all the time and here's how people connect. We've talked about that a lot in the return to the office, the people who are pressing for it and the people who aren't. A lot of the people who are pressing for it, we're finding some commonalities in the ways that they want to connect. And a lot of the workforce that they have who doesn't want to come back hasn't connected with what they feel like that office culture is.So I think when you start talking about providing an environment of psychological safety and providing an office identity that people can connect to. How do we connect ourselves with that culture? We really have to think about that if we want people to maintain that connection, both remotely and when they come back to the office. Or if they come back to the office. I'm a big proponent of remote work. I just have to throw that in there.Jazmin: Yes, and definitely it has to be very proactive. It's a lot of work to do that. And it takes people out of their comfort zones to push for certain topics, push for events, push for these kinds of forums to happen. It doesn't just happen by itself, you can't just will it. So yes, it's really great to hear.Women in Tech to Fostering ChangeCarolyn: So I'm going to put us all on the spot a little bit to foster this change. Because the truth is, at a macro level we are still grossly in the minority. So what have we done personally to help foster this change? Maybe an easier question is what have you seen leaders do to help foster this change or have they? Or are we still missing this? So, Kris, I know this is a focus for you because it's your job. What do you recommend? What's happening?Kris: Are we talking about just making more opportunities, more mentorship? I'm going to guess, all.Carolyn: All of it, is that where we start, just making more opportunities and how do we do that? I think what we're doing right now is an important thing because we're talking about it.Kris: I think we're talking about it and we have three women in tech in this conversation who have been imminently successful in their own domains. And we've all been in domains where there's not a whole heck of a lot of us. We've had mentors who are male who have come in, who have seen something in us. Who have seen those qualities and have provided advice, who have provided guidance.And every time, at least lately since I've been more aware of it, I've had a mentor provide that guidance. I've encouraged them to think about, "Why are you providing me that guidance? Is it because of this particular thing, that particular thing?" Let's reach out and look at all the people you have in your mentorship circle and figure out who's not there. What are the other kind of opportunities? Pulling Other Women in Tech Into the CircleKris: And I've started learning to ask myself, I need to be better about it, it's like, "Who else can I pull into that circle?"Carolyn: So are you mentoring then? Even officially, unofficially, you find people to mentor as well.Kris: I do. I've had a lot of people talk to me. Because I work in a very interesting niche. There are a lot of people who try to figure out what exactly my job categories are. Because we're doing all the things, people analytics, we're doing talent management for the Army's data workforce. We're doing data education and there's been a lot of focus on just, "Who's going to take over the programs? Who's coming up?" Because they know at some point or another I'm going to retire. I'm going to go do something else. And I'm going to go start other projects. I'm going to try to carry on the somewhat entrepreneurial frame that I've looked at things in the Army with some other venture.So I look around like, "Okay, who's coming up? Who's got interest in some of the same projects I'm working on? Who really wants to foster change? How can I bring them in and get them some of those connections and get them some of the experiences working with the different types of projects and project leads and leaders." And as I'm doing that I really want to make sure that I'm bringing in all of those perspectives. That I'm bringing in not just more of the same. Because we want new perspectives. We as an organization have said very emphatically that we want change. Now we just need to prove it by bringing in people who can make the change and who see things differently.Good Mentor vs Bad MentorCarolyn: Well I love that you have a mentor and that you are mentoring. Jazmin, have you had mentors, male or female? Do you participate in some official or unofficial mentoring?Jazmin: So I have had quite a few great mentors. I've had a couple of pretty bad supervisors take on leadership roles. I think what has distinguished them is the good mentor, the people that I really look up to listen. They figure out what motivates me. They really try to find what am I really looking for out of my career. And they don't look at what can I provide to their organization right now. That makes all the difference when you're not seen as just someone that outputs and delivers products.I think the people that have been great mentors look at the potential that I can provide in the long term. And that being able to give me those opportunities that feed my own personal and professional growth does both things. It both helps myself and it helps the organization. Because I'm being put in the best capacity and being put to best use in the organization. So like I said, I've had the opposite as well where folks are just, how do I say this? I am in this organization for two years. As much time as they can put into me doing that one and one job only, and my scope is this big, there's no way for me to say anything else around it. Because that role is really important to the organization and they need me to do X, Y, Z. And those are positions that I do not thrive in.Women in Tech Are Helping Each OtherJazmin: But from a mentorship or from a supervisory standpoint, if you don't get to know your people then you're going to realize the limitations that you put on yourself and your organization as a result, so, yes. In terms of me mentoring other people, I have found LinkedIn to be great. This is not a plug but it's the only way actually that I get to talk to people outside of my realm here. There are some events that I'll speak at via recruiting events or...

Women in Tech Part 1 with Space Force's Jazmin Furtado and U.S. Army's Kris Saling

Bill James

What does it mean for an agency to monitor applications with empathy to achieve successful mission outcomes? Bill James is the President of Federal Business LLC and FedSmarts LLC. He is also a former Deputy Assistant Secretary of Development and Operations in the Office of Information and Technology at the Department of Veterans Affairs. He joins Carolyn and Mark to talk about the importance of application monitoring, culture, and empathy when executing a mission. Episode Table of Contents[00:30] Introducing Our Guest, Bill James[09:29] The Onus of the User Experience[20:33] Applications Monitoring Is Integrated into the VA ProcessEpisode Links and ResourcesBill JamesFedSmarts LLCFederal Business LLCDepartment of Veterans AffairsIntroducing Our Guest, Bill JamesCarolyn: So today, our guest is Bill James. He is president of Federal Business LLC. In his previous role as Deputy Assistant Secretary of Development and Operations in the office of Information and Technology at the Department of Veterans Affairs, Bill led the VA's largest information technology organization to deliver enterprise-wide technology products and services to veterans. He has been able to carry those skills into his current role as president of Federal Business LLC. And today, we're going to get Bill's perspective on why Application Performance Monitoring or APM is no longer a luxury, but a necessity. And he just recently put out a blog that, I'm going to nerd out here, I really like the blog. It's easy to understand.One of the things he says in it, or some of the perspectives we're going to get from him, is how APM for VA software applications is necessary now and critical for the future. And how it helps the VA, and I'm going to throw in there, like any organization, any agency, avoid or recover from outages, increase VA OIT productivity and observability, offer insights into investments needed for innovation and understand and improve the customer experience of veterans. I love that last bit. The customer experience. Bill: Thank you very much, Carolyn and Mark. I'm really happy to be here today, and you've touched one of my hot buttons. I'm really interested in all of it, how the technology ultimately relates and improves the end-user experience. Specifically and particularly, our veterans. And that's why I loved working at the VA so much.Focus On Veterans’ ExperienceCarolyn: Well, and that topic I feel like is especially timely Mark. Especially with the presidential executive order around user experience. I mean, you're kind on the cutting edge, Bill. I mean, you've been doing this before it was cool. You've been worried about the customer experience.Bill: That's right. I grew up as a programmer, a coder, and as a mathematician. It was always interesting to me how we could build a code and write it. And we thought our job was done when we hit the end card, back in the day when we had punch cards. But that wall, was frankly was a false wall, and what we never thought through, I think clearly enough into what that code actually did for the end-user. So I think with the new executive order and clearly the focus on the veterans' experience in the VA, that wall came crumbling down for me particularly. It was really a great place to work and a great place to exercise this whole idea of customer experience from the IT perspective specifically.Carolyn: We're definitely going to dive more into that. Before we go there, for our listeners that may not be as familiar with application performance monitoring or APM, will you give us a quick definition of what that is?Bill: Yes. It's the heartbeat of your systems, and specifically of software. So, many folks have gone to the doctor or seen these electrocardiograms, where they put these things on your chest and you have the little needle that draws how your heartbeat beat is beating.  What Is Application Performance MonitoringBill: Software needs that very same type of telemetry, where it can show everybody it's alive, it's working, it's working well. And then you can also take that very same monitoring capability and say, "Well, okay, fine. You think your software's working well in the black little box, how is the user experiencing it?"So your software may be working, but the user network may be down so the user can't see the software, even if the software's running. This end to end understanding of what is working and how does it relate through all of the layers of technology to the end-user, and having the tools that really give you a dashboard to allow you to see that from a management perspective, see that monitoring data from a management perspective, that's APM. So in my view, it's the software EKG.Mark: I think this is a very fascinating topic, not just because we work at Dynatrace, but because of what you've said and what I've read in your articles. I have seen resistance across other agencies, to adopt and to look at the world the way that you have described it. Why is that happening? Can you help us understand why we see this across other agencies?Bill: I think that a lot of it is cultural. I used to say, and I still believe this, that DevOps equals empathy. And it's not just empathy for the end-user, but Dev and Ops, and the other phrase, DevSecOps, the development, the security, and the operations, grew up as stovepipes in the IT world. Empathy: Monitor Applications and Care About Your NeighborBill: And they still operate that way in a lot of ways. So empathy means you care about your neighbor. You care about the other parts of your organization and you obviously very much so, care about the end-user. I think every organization, every federal agency, every company, needs to first of all, think about who your customers are. But secondly, internally, think about, how can our culture be inclusive and empathetic in the sense that, I don't live in a stovepipe, everything that I do affects somebody else.It's more than just soft words because you can measure that and you should be able to monitor that. Which takes us right back down to, from a software perspective, the application performance monitoring. I want the software folks to care at three o'clock in the morning, if their software application goes down, I want them to be the first one to get the phone call, "Hey, your code broke." And then the blog, I quoted my YBI YOI "You built it, you own it, right?" You don't drop and run. Once you build that code, you own it forever. And not only do you own it, but you own it with your partners, the security partners, and the operations partners. So I think APM gives that foundation for everyone to share a common view of what's going on. Therefore it begins to break down those stovepipes.Carolyn: That goes back to what I mentioned before. One of the most important benefits to me of the DevSecOps is that everybody becomes responsible for that user experience. We take the onus off of the user. You gave an analogy of the airline pilot. I'm going to let you share that analogy.The Aha Moment to Monitor ApplicationsBill: Yes. So the idea is, imagine if you were a passenger on an airline and the pilot announced "I have no instruments in the cockpit, so please let me know if one of our engines stopped running." You're asking the passengers to let you know, because "Hey, I'm flying blind and I sure hope everything works out, but if it doesn't, please let me know." I mean, that's silly. But that's how IT used to work, and to a large degree, in VA, it's very different now, we've changed, come a long way. But we have plenty of instruments that monitored networks and plenty of instruments that monitored computers. And of course, we had thermometers and data centers. We have all sorts of instrumentation around the computing part, but we didn't have much instrumentation or monitoring on the software part.So the ops had a lot of instrumentation, not so much the Dev, not so much the applications. And so, when we came up to the delivery of the software supporting the mission act in June of 2019, I was nervous. Because we didn't have what we needed from a software monitoring perspective. We scrambled and cobbled together, a lot of things, but it's come a long way since then. And that was that aha moment for me really, it's the, "Oh my gosh. We don't have the instrumentation, the monitoring observability that we need on this code."Carolyn: Well, I love what you say in the blog. I'm just going to read directly from the blog here. The software folks needed to feel like they were part of a larger team, the mission, right?Bill: Yes.The Onus of the User ExperienceCarolyn: That was responsible for the end-users experience. So we take the onus off of the passengers, to let me know if there's an engine out and we own that. And it seems like, especially within government, the onus of the user experience has been on the end-user a lot and partly because where else are they going to go, right?Bill: Exactly right. Trouble tickets, that was the way that the software folks knew when their application was down, was when a trouble ticket was issued by a user. "Hey, this is not working." And so it's like the pilot, when a passenger, raises his hand, "Hey, one of the engines is out." That shouldn't be the first time you hear that. You should beat your users to the punch in terms of knowing what's going down when a disc drive is filling up or when some application is having problems and it has to be taken the entire perspective, from the code to the end-user. We have to be observant of what's going on. And so exactly right. It's really, really critically important that we take measure of what's happening in our infrastructure and how our users are affected.Carolyn: So, you mentioned that at the VA, you saw a lack of APM, the lack of APM exposed a cultural crack. What do you mean by that? Unpack the cultural crack that you saw?Missing to Monitor Applications May Result in Cultural CrackBill: Right. So as the deputy secretary for DevOps, I saw both sides. I saw the development and then I saw the operations. And when you have a lot of the metrics and the instrumentation on the ops side, and very little on the dev side, to me, it exposes a responsibility gap. And to your point, this is a joint responsibility and the whole idea of product management, which is something that the VA has pivoted to as opposed to project management, when you move to product management. That product idea includes everybody, your user, the inside developers, your operations. It is the manifestation in a lot of ways of this DevOps or agile way of life and way of developing and operating code. So the cultural divide that I saw was that the software folks and I'm one of them by the way, would write the code, and what I call drop and run. They'd write the code and they would expect the operations teams to run it. Well, that's great.And when things break, the software folks are the ones, in some cases, if there's a bug or some security exposure or something, they're the ones that get called. But the responsibility was pretty much on the operations side of the fence. So from a cultural perspective, I wanted to balance that. So everybody had a role, Dev, Ops and the user, nothing like having a great champion, a business champion who owns the operational responsibility of the outcomes, for example, of a specific piece of software. But if you have that great team and they're bound together, that's the essence of a product team, as opposed to a project team where you have milestones and you have an end, right? We’re All in This TogetherBill: Every project has an end, but that's not, in the software business, that's exactly the point. It does not end. You as a project manager for building an application, you build the application, and your responsibility doesn't end there and you get to move on to another project.Yes. You get to move on to another project, but your responsibility for the previous project does not end. It endures. And you are now part of a team with the operations and the security and the end-user, to make sure that the end-user experience is good and frankly, great.So that idea that we're all in this together, that we are a holistic team, not just chunks or pieces in a series of milestones, or that we are all in it together, forever together in service of the veterans. So that's a very passionate thing about anybody who works at the VA. Everybody that has heard me talk about that before, that working at the VA is like no other agency. Their purpose is so clear, like no other company, and it's so noble. You feel good about working there and you get passionate about providing the services to the veterans that they've earned. So when you tie that fantastic noble objective, with the toolsets and the culture being able to deliver it, it's just a fantastic experience for me.The Culture in the Veterans AffairsMark: Bill, do you feel like, obviously the culture helps with the mission because your end users are veterans and you want to support veterans, et cetera. So, I completely get that. Do you think having everything under your purview when you were there, helped make that happen, as opposed to maybe some other organizations within government?Bill: Yes. I think yes. And I don't get the credit for that. We have some fantastic leadership, that moves VA in that direction. Frankly, we had some fantastic technology support. VA has a great digital service team there. They brought a lot of great new ideas. APM was one of them. I give them credit for that. My friend, Steve Vito says, "Lead with your ears, not with your mouth. Everybody was born with two ears, one mouth, use them in that ratio." But in order to adopt those ideas, you have to be open to listening to them. Then from that perspective, having a DevOps organization, now it's DevSecOps organization, you do have all the levers in front of you to knit the culture and the toolsets and the objectives together. Frankly, that was really one of the reasons why we could do what we were able to do in VA and why they've continued to move ahead in a lot of great ways since that point. I think a lot of other agencies, they absolutely should look at this DevOps model or the DevSecOps model and consider that. The other thing that's different that the VA had, that all the other agencies don't, is that we have a strong CIO in the VA, and they had the financial accountability and authority that was viewed in the CIO role, by the Clinger-Cohen Act. The Challenge to Monitor Applications in DoDBill: A lot of other agencies don't have that single accountability from a budget perspective. So when you have the culture, you have the purpose and you have the ability to control the finances with a single governance model, that makes your life a whole lot easier. A lot of agencies don' have those very same authorities and powers imbued into the organization. So I think those are all necessary pieces of the puzzle.Mark: Do you think that your colleagues on the DoD side of the house struggle with that? Because there's not that connection between the DevSecOps side of the house and maybe the mission owner, you wouldn't say line of business, but the mission owner?Bill: I think so. As an IT person, it's hard, like in the DoD, for you to see the outcomes of your activity. So you might be writing a line of code, and maybe if you're in the air force, for example, you may have six or seven layers removed from still on target or some mission outcome. So it can be more difficult in organizations like DoD than in an agency like VA where the purpose is so absolutely very clear and crystal clear. We build kiosks or at least the software for kiosks that our veteran touches. That's very close to you as an IT person and you can see the outcomes directly, not so much in DoD, your outcomes are farther away and it's harder for you to see.The Old Waterfall ModelBill: Having said all that. I do believe that the idea of tying your operators and the users, for example, an air force pilot let's take the software person and the hardware, the operations infrastructure person, tying those three legs of the stool together, I think, produces the aha moments that you don't otherwise get when you live in your own little stovepipes. And so I would absolutely recommend that.Mark: When you were on that side of the world, were they creating software factories at that time?Bill: Yes, there were a few software factories, but it was still the old waterfall model. And so the software factories produced code that someone else implemented and operated. And so the software factories that the VA is building and a lot frankly, everybody's thinking about the idea of virtual software factories. But if you do that in an agile sense, in a DevOps sense, you get very different outcomes. So let's build something today, that's fully instrumented and fully secure. But let's build and deliver something today as opposed to plan to deliver something perfect, maybe never. So the whole waterfall model I think really builds and frankly constructs a lot of these cultural boundaries that we try to erase in the DevOps. And so, back to the APM, it doesn't matter what you build, and it doesn't matter what process you use if you don't know how it operates. If you have no observability, no insights into whether it's up or down, no understanding if it's alive or Dev. Two in the morning, I want to be able to not literally, but figuratively hear that heartbeat of the application that my code is running. And so it puts a smile on your face and you can sleep comfortably. Applications Monitoring Is Integrated into the VA ProcessBill: But if it's not, I want to be the first to know. So that's a critical piece of operation, frankly. And it's something that ties you as a software builder to the operation in ways that frankly you don't get into in a waterfall model.Carolyn: Do you think that the VA has now baked APM into their process? Like they're using it?Bill: Yes. Policy-wise, yes. Tools wise. Yes, I think culturally, we still, the VA have a way to go. I mean, we made huge progress. I mean it’s night and day difference. But I think there's still a way to go there. The software inventory in a VA is huge. 800 to a thousand applications in the VA software inventory. A lot of that code is legacy code that has been and still works and runs OnPrem. And they still turn out the goods and batched jobs like it has for years. So now you've got these applications. And I think a lot of agencies do these applications that are very successful in what they do and what they accomplish. How do you go back into those and introduce modern tools? Say like APM, how do you move, what I call the electronic alligator clips? How do you attach those to these old legacy...

Monitor Applications with Empathy with Bill James

Eric Trexler

Consolidation, innovation, and perspective all need to work together in government IT according to Eric Trexler, VP of Global Governments and Critical Infrastructure Sales at Forcepoint. IT acts as an enabler of business in the challenging landscape of government technology. Listen in to find out what Eric believes the United States IT space should be focusing on in order to stay ahead of the adversaries. Episode Table of Contents[00:25] All About Innovation with Eric Trexler[10:39] An Enabler of the Business[18:27] We Haven’t Seen Consolidation[21:37] Choosing Fiefdom Over Consolidation and Innovation[27:49] The Commercial Component of Innovation[32:32] There Are Productivity Gains Out of InnovationEpisode Links and ResourcesEric TrexlerForcepointTo the Point Cyber SecurityThink AgainThe GeneralsAll About Innovation with Eric TrexlerCarolyn: Today, our guest is Eric Trexler, Vice President of Global Governments and critical infrastructure at Forcepoint. Eric is an expert in the technology industry with more than 25 years of experience with both the public and private sectors. And Eric and I used to host To The Point Cybersecurity podcast together. So today is actually a real treat for me to see your face again, Eric. So, good morning.Eric: Good morning. And it's bizarre being back on the air with you, Carolyn.Carolyn: So, today, we're going to talk about the perplexing and growing cost of cybercrime and how we can shift the paradigm. But before we jump into that, Eric, you have actually a pretty fascinating background. So, can you just tell us a little bit about your journey?Eric: My journey in IT? Or where would you like me to start?Carolyn: Let's not go all the way back to birth. Let's start at your Airborne Ranger days. How about that? And then how you got to where you are today. So yes, technology.Eric: So, I was an aimless kid at about 17 with no potential to pay for college. No easy path at the time. And I said, I'm joining the army against my mother's wishes to become an Airborne Ranger.The Requirement to Be a Navy SEALCarolyn: At 17?Eric: Yes. She had to sign the paperwork so I could join the delayed entry program. The military throws at you when you have a high ASVAB score, that's the entrance. And I had a high ASVAB score. So, I saw the Navy and they wanted me to be a nuclear engineer. And I just wanted to be a Navy SEAL back in the day before people knew what the Navy SEALs were. But you had to pick a rating, I believe they call it in the Navy. So, I'm sitting in front of the recruiter, and he's like, "Okay, but what do you want to do?" And I'm a dumb kid, I'm 17 years old. "I want to be a Navy SEAL." "Well, you can't do that. You have to have a rating. You have to have this skill at trade." And nothing, absolutely nothing was interesting to me.So, I left. I went to the army recruiter and enlisted. Because they'd let me be an airborne, I was unassigned airborne, technically. How I became an Airborne Ranger? I didn't want to be normal and I was in jump school and talked to a gentleman and I didn't want to wear chemical gear. This was right at the end of the first Gulf War, and everybody was running around in MOPP suits. If you remember that MOPP suits? Hot, heavy, you can't see.MOPP GearMark: You can't breathe.Eric: Same reason I didn't want to be in a tank or a ship or a plane. I wanted to be on my feet and I wanted to be able to move. And I was like, "I don't want to wear MOPP gear." The guy said, "Here's what you do." And that's what I did. So, I literally made the choice because I did not want to wear a helmet and I didn't want to wear MOPP gear.Carolyn: You sound like my six-year-old niece, how she chooses what she wants to do is whatever that doesn't require shoes.Eric: I was probably about as evolved at that point in time. Mark, you know what it's like to be a 17-year-old boy. I mean, you're really pretty low on the intelligent decision-making maturity scale, right?Mark: Maturity scale.Eric: I mean, you're just not there. It was a great choice and it's how I got into IT. Because in about '92 or so I started building computers. And we got a computer in probably '94. The first computer in my unit to run, just to manifest for drops, exercises. It was literally an electronic typewriter, the way these guys thought about it. I’m with a bunch of infantrymen. I was the only guy in the unit who had new computers, the only guy, I built them for gaming. So, I volunteered for college. I said, "If you allow me to set up college courses for the detachment, 60 person volunteer detachment I was in, I will work in the operations department with a computer." And that's what I did and my career just took off from there.The Journey From Army to UniversityCarolyn: How long were you in the army?Eric: Four years, 17 weeks, and I think four days or something with my contract.Carolyn: And then where did you go?Eric: University of Maryland. So, it was a great ride. It was even before the amazing benefits the government gives you in the GI Bill today. The GI Bill in army college plan to go to a college fund. It was like $28,000 for four years of service. That was the optimal breakpoint. You could do five or six, but you really didn't get a lot. You got to like 32,000. And my goal was to go to college.Mark: Did you go to college full time or did you kind of dual shift at school and work at the same time?Eric: So, I probably got about a year in the military when I moved into operations and ran, I didn't run but I did a lot of the operations work with a couple of V6s. At the time I was an E-5. But then, when I went to college, I went full time and I worked somewhere about 40 hours a week. I had a kid. My first son was born at 20. So, I'm out of the military at about 22, and I had to keep the lights on. And I had to get my college education and get moving. So, I was working full time and I was working and I was going to school. I was doing probably 21 credit hours a semester on average.The Innovation to Get Serious in LifeMark: Yes, that'll make you grow up.Eric: It's interesting. I have three boys and I think the maturity level as you watch them and their friends. Twenty-five is the magic age, in my opinion, plus or minus three years for maturity in boys, that's just Eric's principle here. Unless you have a kid at 20 and you're in the military and you don't have a lot of help. And then, you grow up really quickly. I stopped going to Nashville every weekend for parties and concerts. I stopped drinking. It was time to get serious about life and take on the responsibilities that I had. It was good.Carolyn: What was your first job out of college?Eric: So, I bartended a little bit until I got a job at Microsystems working on, I was a QA test engineer for all of two weeks. I don't think I ever told you this.Carolyn: No, I'm learning new things.Eric: It was absolutely miserable. I was the worst QA test engineer ever. So, I'm IT savvy. I can build computers. I've been building computers for years. I know the Windows operating system. I'm pretty good at what I'm doing for that age and that period of time in life. I couldn't sit still. I kept talking to the developers. I'm supposed to sit there and run test routines all day and look, I had a bank of three monitors, and I literally could not sit still. Two weeks later, I was like, "This isn't working." And my boss at the time, I can't remember her last name. It was Melissa. She was awesome. She says, "You're right." And we had customer service problems.From Traditional Apples to AppleEric: So, we took an employee kitchen. We moved a bunch of computers and tables into it. And we became like an R&amp;D faction that helped customer support issues. So, we got all the hardest issues because we sat in R&amp;D. And it worked great for the company. It worked great for the customers, and most importantly, for me. Because I was always talking to people and fixing problems and doing things as opposed to watching automated test scripts build all day. It was the most boring job ever for me. Actually, I sorted apples once for a day and my grandfather was a produce farmer. And he took me to this amazing job. I think it paid four bucks an hour to sort apples, and that was probably worse than the testing, Carolyn.Carolyn: Worse than QA?Eric: Yes, at least with the QA, I have computers.Mark: I thought you were talking about the Apple computers.Eric: No, I'm talking like Macintosh and ROM, and the traditional apples in Pennsylvania. And just moving on a conveyor belt and sorting and checking apples all day was like the most mindless activity and it just did not work for me. But you're getting a lot out of me that I would say many close family members and friends have never even heard.Carolyn: All right. So, which brings us to today. Well, before you came to Forcepoint, were you at McAfee right before Forcepoint?McAfee to ForcepointEric: Yes. So, I worked at Micros and I got my MCSE. I was really good at databases. And I went to Sybase at that point, great database company. I had a friend bring me over. And then, I went to EMC after that and learned storage area networking at the best of the best. So, I've got database IT storage background servers, I built them. And then I went to Salesforce.com for a two-year PhD in the CloudThis was a great experience and it was challenging at the same time based on the customers and the sheer growth there. That's all they cared about. So, then I went to McAfee and really took up the InfoSec or cybersecurity side of the business, which I've been doing for the last 12 years and it drives me crazy. Because we get further and further and further behind the adversary.Mark: That's interesting that you bring up the whole Salesforce thing, because they were probably one of the first software service companies that were out there.Eric: Certainly, at scale. And the scale there right now, Mark, is, I was looking the other day. I have a couple of friends there and I had lunch with a friend. I mean, what they're doing today, I could have never imagined in the 2008, 2010 timeframe.An Enabler of the BusinessCarolyn: So, Eric, you and I have been talking about cybercrime, cybersecurity for a while now. And you've written some recent articles, and you've been talking about it. I want to talk about the problem of cybercrime. And you just mentioned that we're getting further and further behind. And when you and I talked earlier, it just reminded me of the Alice in Wonderland quote, when she's in the Red Queen's race and the Red Queen tells her, "We have to run faster and harder here just to stay in place." And Alice is like, "Well, that's stupid." So, let's talk about the massive amounts of money that we're spending on cybercrime and cybersecurity, and what needs to change.Eric: Yes, I can talk to some of that. I certainly do not have the answers on what needs to change. I thought you put that quote in because of me. Because it's actually something that my old CTO and CMO at McAfee wrote in a book called The Second Economy. They quote Alice, in that specific quote, in the context of cybersecurity.So, we're just talking about my career, up until 2010, when I really joined cybersecurity, hardcore for the first time. I'd always build things. IT is an enabler of the business, it builds things to make business run better, faster, cheaper, whatever it may be, but it's an enabler of the business. First Mover AdvantageEric: And you're always growing and building things. The problem with cybersecurity is you're getting further and further behind. You're not necessarily building things to make things better. You are kind of putting things together to try to prevent things from getting worse. It's almost the flip side of the coin, if you think of it that way.Mark: Eric, do you think that the fact that we're getting further and further behind is a function of the discipline of cybersecurity and that we're just behind there? Or is it the fact that adversaries like China, Russia, Iran, are investing more? And General IT like encryption quantum computing or artificial intelligence and stuff like that. Is it more a function of that or the discipline of cybersecurity?Eric: I really think it's both, Mark. So, when you understand the rules of the cybersecurity world, the adversary gets first mover advantage. They get to decide every single time how they want to attack you, how often they want to attack you. They essentially get an unlimited number of tries. Because it's risk and treasure. When you look at it, what's the risk versus the opportunity? That's the probability of cyber there and the risk is very low. You don't see a lot of people going to jail, you don't see a lot of people losing money in cybersecurity, you see them gaining. At the nation state level, you don't see a lot of sanctions and things like that, because of cybersecurity action. It's almost like there are no red lines, and they're just taken for granted.Innovation and ConsolidationEric: And if we're going to go into a country and surveil their networks, or our adversary steal our IP all the time, it's almost accepted, unfortunately, these days. So, you've got the adversary first-mover advantage, they get as many tries as they want. There are no silver bullets here. And then you look at the defender side, we don't have enough people, depending on who you look at data-wise, where cybersec.org is good. They'll show you we're probably a million-plus people behind on the cybersecurity side of just being able to hire. We don't seem to innovate and that's an interesting comment, if you're me, in an industry that has four or 5000 players.But that leads to my next point, we don't consolidate. The industry really hasn't consolidated. If you look at most of IT, look at storage or I mentioned databases or operating systems or even networking, there are usually two or three key players. We don't have that. And then, when you look at the incentive side of the equation for the defender. If you pick a tool, a cool tool, I'm going to take you back to 2012, sandboxing. Sandboxing was the end all be all as FireEye at the time. Kind of took what was in academic labs and productized it and marketed the hell out of it. Palo Alto did the same thing with the next-gen firewall to iterate on the firewall side. You take a tool that's really hot and really cool as an IT operator, a security operator, and you buy it and bring it into the business while you're doing pretty well.A Quick Innovation of the AdversaryEric: What's the efficacy rate? We're probably not able to measure that as businesses, most people don't care. And you just deployed a cool tool in 2012, called sandboxing. Well, the adversary quickly innovated around that. They had the ability to look for sandboxing, am I running in a virtual machine, is my malware running in a virtual machine. They put in things like time delays, which are really easy. The sandbox isn't going to sit there for 30 hours and wait for your malware to activate, it's going to look for it to activate right away. So, I'll just put a seven-day delay in and you can quickly innovate around that. And that's okay. But the defenders aren't any much better for it, let's put it that way.Now, if you're the person on the team who brought in that tool, you can probably go to a bank or another company and say, "Well, look at my resume. This is exactly what I did. Regardless of effectiveness, I can do the same thing for you and get a huge increase." Because we all know or I think most people know, the only people really making money in cyber, in general, are the employees. But if you're on the defender side, if you're on the attacker side, if you're on the vendor side, maybe you could argue government employees aren't making as much as they could be. That would be accurate. But the employees are making the money. A lot of cybersecurity companies still today run at a loss.There’s No Innovation Since 2012Eric: So, we've got all these dynamics in the market that make it a really hostile environment, when as a business owner, or a network, cybersecurity defender or whatever it may be, you're just trying to protect information. You're just trying to protect business. It's a tough space. And it's equally as easy for the adversary. If they want to steal something, if they want to make money, it's a pretty low risk, not so hostile environment. It's perplexed. It's really why I stay here. I'm not an IT anymore. I'm not building things really. We're falling further and further behind. I think there's an answer, but we don't have it yet. And to me, that's the ultimate puzzle that maybe by the end of my life, I'll have some clues to how to solve it. Well, I'm certainly not solving it. Carolyn: So, you said a couple of things that I want you to unpack a little bit for me. So, you said in cybersecurity, we don't consolidate. What would that look like if we did? And then, you said something that really got me. You said we don't innovate. Are you suggesting we haven't innovated since the sandbox in 2012?Eric: I'm not, but I'm thinking about it in a maybe a different way. We Haven’t Seen ConsolidationCarolyn: What would the consolidation look like?Eric: So, there are four or 5000 companies, right? We haven't consolidated like most of IT, like most businesses do. Michael Porter talks about industry clustering, and we've seen clustering, but we haven't seen consolidation.Mark: If we have, well, half a dozen. We have half a dozen kind of players in our market compared to the cybersecurity space, four or 5000 is crazy.Eric: Pick any space and they're probably 10 to 20 larger organizations. And there are dozens to hundreds of startups. And I think the market drives in that direction with venture capital, the private equity, all the investment, all the hype. The fact that you can launch a product. I mean, Splunk, I don't remember when they even became profitable. They were operating at a major loss. Not to pick on Splunk, there are majority of companies who do this. And look at the stock price and look at how they took off because they were going for market share.Here I am at the time 2010, I left McAfee in 2018, the beginning of it. We were profitable, I believe the whole time. Not an interesting company, didn't have the funding we wanted to innovate the way we wanted to. It wasn't interesting in the...

Consolidation, Innovation and Perspective with Eric Trexler

Jennifer Ewbank, Deputy Director for Digital Innovation at Central Intelligence Agency joins Carolyn and Mark to talk about the unparalleled work in integration and integration she and her teams are doing. Jennifer talks about the importance of partnerships in IT, data and cybersecurity and how Digital Innovations, the newest branch of the CIA, is transforming security. Episode Table of Contents[00:58] Jennifer’s Opinions on DDI’s Unparalleled Innovation[08:35] Integration of Digital Capabilities and Unparalleled Innovation[16:06] Unparalleled Innovation on Cloud Computing[24:04] Unparalleled Innovation in the Digital Landscape[32:00] Applying Unparalleled Innovation Into Our Mission[39:44] A Space Nerd With Unparalleled InnovationEpisode Links and ResourcesJennifer EwbankCIA.govFull Digital NationThe Party2034The Girl With Seven NamesJennifer’s Opinions on DDI’s Unparalleled InnovationCarolyn: Today, our guest is Jennifer Ewbank, Deputy Director of CIA for Digital Innovation, also known as DDI. Jennifer is responsible for accelerating the development and integration of digital and cyber capabilities across all of the CIA's mission areas. We're so excited to hear from you today, Jennifer, and get your opinions on the DDI and its contributions to the CIA.Jennifer: Thank you so much for the invitation, I'm really excited about our conversation today. I love nothing more than sharing a little bit about the great work that the men and women of the CIA are doing on behalf of the American people. To talk about how this intelligence landscape is changing dramatically along with the digital transformation we see around the world.We're here on the 1st of March. I wanted to acknowledge that, as we have a conversation today about one of these topics I love tremendously. It's really critically important for the intelligence business, it is taking place against the backdrop of events unfolding in Eastern Europe. So, just about a week ago, Russian troops invaded a sovereign nation and brought war back to the European continent in a completely unprovoked act.I just wanted to assure anyone who might be listening to the podcast that the CIA is intensely focused on our national security around the world. We're focused on that crisis and working as part of an integrated US government team to do what we can to bring about a rapid end to these senseless hostilities and the return of Russian troops to the Russian Federation.Unparalleled Innovation on What Matters MostJennifer: I just wanted to ensure, whenever people listen to this, that they understand that we are focused on what matters most at the moment. I'm taking a few minutes out of an otherwise very hectic day to talk about this topic. It’s really important from a strategic perspective but is perhaps not the most urgent topic on our plates today.Carolyn: Honestly, what you do is integral and so important to everything that you just mentioned. Let me see if I can get the words out right but in supporting the sovereign nation. What you do with the digital side of things and this mission, that cyber domain is incredibly important.Jennifer: Yes, we've seen it play out a bit so far in unprovoked attacks on Ukrainian entities. Our role, sometimes, may not be known to those outside of the intelligence community and that's most of America. We work for the US government, we work for the US people, absolutely. But we also support our allies and partners around the globe. Any major challenge requires those partnerships to succeed. Anyway, that was my little PSA at the beginning.Carolyn: Let's talk about your story. Let's talk more about your background, your role at the CIA. Describe the position and what the DDI is.Jennifer: I can't imagine that most people would know what it is. I certainly knew very little about the CIA before joining it. Generally speaking, I lead the Directorate of Digital Innovation at CIA. It’s one of the five large directorates that comprise the whole of CIA. Some of these are going to be a lot more familiar to your audience and your listeners.Intelligence OperationsJennifer: The first is the Directorate of Operations. They conduct intelligence operations and information all around the globe. They work very closely with our partners and allies in all those countries.Our Directorate of Analysis, they produce what we call all source analysis. Taking information from all over the place and weaving it together and producing objective analysis to inform policymakers about the key issues of the day and strategic issues. Our Directorate of Support is a truly extraordinary, probably an unparalleled innovation anywhere else organization. They do everything to keep this business running on a global scale.So, it is HR, finance, logistics, medical services, anything you could possibly imagine and a global enterprise. Then we have our Directorate of Science and Technology which is probably our closest cousins in the organization. They develop technological capabilities to support our intelligence collection mission around the globe.You might think of Q and Bond films but without as many high-speed chases or deadly firefights. Then there's DDI, the part that I oversee. If we think about the DS and T, our Directorate of Science and Technology, primarily focused on technology with a physical manifestation, we are that counterpart in the virtual or digital world. In essence, all the ones and zeros for the organization.We are the agency's newest directorate and our mission spans are really broad spans. We've got data, data science, artificial intelligence, enterprise information technology, cyber security, cyber collection, cyber analysis and open source intelligence to support the CIA's mission in all aspects. We also have another really important role, we have established DDI University. That is a learning enterprise dedicated to raising the digital acumen of the CIA workforce as a whole.Leverage the Unparalleled InnovationJennifer: So that we actually have a workforce that's ready to leverage all of these capabilities, whether they're technological experts or not. In terms of my background, I did come to this role through a non-traditional path. My own career spans well over three decades. Initially, as a foreign service officer with the State Department serving overseas with our diplomatic corps. Then later, and for the bulk of this time with the CIA but in the Directorate of Operations.That is the organization that is posted all around the globe, working with our foreign partners, collecting insights that we feed into our analytic products here in Washington. Prior to this current role, there were a couple of key roles, I think, were formative. They do inform how I approach this job. One was spending the majority of my time overseas and serving as a chief of station. That is the officer that's charged with leading these integrated teams in the field. I do have, let's say a favorite job. I'm not supposed to have favorite jobs but I do along the way.One of those roles was working in Washington overseeing all of the CIA's engagements inside the United States. Think about all of our partnerships with intelligence community counterparts, with US government departments and agencies, and with academia. But most importantly, I think for our conversation today, with the US private sector and industry, finding those valuable partnerships for both sides.It's only six years old at this point. The DDI, as you call it, is, I would say, changing the very way we approach the intelligence mission. We're focused on this deep and meaningful integration of digital capabilities across all of the CIA's mission areas.Integration of Digital Capability and Unparalleled InnovationJennifer: My role as deputy director of CIA for digital innovation is just that, the integration of digital capabilities across the entire mission. In that role, I have the opportunity, the pleasure of leading probably the most talented, creative and mission-focused workforce that I've ever seen.Mark: You hit on a few things there. In a recent article that you did with the Cipher Brief, you mentioned how the DDI approaches partnerships with industry to create innovation hubs. Well, you didn't mention that but you talked a little bit about industry partnerships. Can you talk a little bit about how that partnership has helped contribute to the mission of partners harnessing data and artificial intelligence?Jennifer: For context, and maybe this is implied in what I've said already, but DDI's work driving innovation and forging closer partnerships with industry is really essential to the future success of the CIA. Our focus continues to be on identifying those best in breed, cutting edge capabilities, commercially available solutions and exploring how we could rapidly leverage those to meet our evolving mission requirements.There was a really great article on unparalleled innovation a few years ago in the MIT Sloan Management Review. It had an important line in there and it said, quote, long term organizational success depends on developing and implementing new ideas. It's funny because it's complete common sense. You would think, "Well, how is that not known?"But in any large organization, I think, surprisingly, it's an easy thing to forget. For us, recent research that we've explored really identifies a need to find new ways to enable what has been called an adaptive space.Networks and Organizational StructuresJennifer: It’s thinking about networks and organizational structures that allow information, resources, and ideas to flow across in a way that can foster unparalleled innovation. For us, that often starts with small entrepreneurial teams and then later, bigger programs and structures.That's what we're trying to do at DDI and that's one of the many areas where the industry is tremendously a helpful partner. Our outreach and connections with the industry are helping us do this. We’re finding new ways to bring in new ideas and rapidly put them in the hands of our officers to enable success in our mission.We are partnering with companies in the industry to create the so-called adaptive spaces that allow us to rapidly experiment. To do so in a flexible, often unclassified, laboratory environment and that's what I mentioned about the innovation hubs. Those environments allow us to test out new ideas and capabilities to fail fast, to iterate, to rinse and repeat and innovate ultimately.Artificial intelligence is a critical piece of that but I would say it's not the only one. It is an important one because industry's leading development is in that space. But our partnerships are more than, let's say, sharing the latest algorithm or model. Although that's important, it's also about working smarter and working side by side to create and deliver solutions to protect national security.Just a last thing because I think it's an important disclaimer. DDI isn't alone in this, there are other elements of the agency that are working in these new spaces. Not long ago, we created CIA Labs which was a really exciting effort to reimagine how we engage with industry and national labs in particular.We Are Home to Unparalleled InnovationCarolyn: I love that quote from the article. To your point, it seems like it's a no-brainer. Yes, you've got to constantly be bringing in new ideas or, to quote my dad, there's more than one way to skin a cat. We have to remember that and it's so easy to forget. I love that your team, it sounds like, not only embraces this idea, but you're setting up these environments to foster and grow the ideas. It sounds like you're sandboxing.Like you said, fail quickly, rinse and repeat, all of that in a very safe environment that can then go out. It brings me back to this point of all the mission areas. So, you're responsible for pushing out this digital innovation to all CIA mission areas. How do you see technology evolving in the CIA and government agencies overall? Six years your department's been around, right? What have you seen?Jennifer: Certainly, we have been on this digital journey much like many other organizations. I like to think we're a little bit ahead of some in the government, though it's not a race. We just happened to get in the race a little bit earlier. Sit back just a little bit to say that one of our strengths as a country is that we are home to unparalleled innovation.That is one of our greatest strengths as a nation, what industry brings and new capabilities. We were talking about phones earlier. I look no further than the phone in my handbag to see how technology has evolved dramatically in the past 10 years. Then think about where it's going to go in the next 10 years, it's almost unimaginable.How Technology and Unparalleled Innovation Is EvolvingJennifer: I'll take one little slight tangent, when we're thinking about how technology is evolving, its use, its focus in government. I think it would be a real mistake and some people do this.It would be a real mistake to think about this whole second machine age and digital transformation as some sort of a fancy modernization effort. I think about elastic cloud computing, big data, the internet of things, artificial intelligence, and machine learning. These things are transforming the day-to-day life in America. In many ways, they're doing the same to the intelligence mission.Our digital journey, as I said, it's well underway but we have a long way to go. I think the next few years are going to bring tremendous change. And so, I think about what's coming, this is my sense based on the work that we're doing. I see the maturation of AI capabilities across the intelligence community. With that, an ability to really harness the true power of data for us, we save for operational advantage and analytic insights.I see AI and automation in particular taking routine tasks off our daily calendars. They’re freeing up time and mental energy for officers to devote to higher order cognitive functions. The things that only a human brain could do but are tied up with the drudgery of routine business. I see for us and many others the expanded use of augmented and virtual reality. If you think about the intelligence mission and what we're required to do all around the globe, different cultures, different languages, different environments, you name it, AR and VR can be really powerful tools in that mission.Unparalleled Innovation on Cloud ComputingJennifer: Cloud computing, of course, continues to be the foundation on which we're building all of this. But by thinking about how things are changing, we're going to need to develop new, let's say, forms of edge computing. To enable this processing at the edge and, for us, the edge is global so that's a real challenge.Another one that folks may not think about, but just as with any organization that is devoted to work all around the globe, further refining and building our natural language processing models is going to be really critical. Particularly, as we want to embrace this flood of open source information that's so readily available on the internet and you name it.We're going to have to be able to collect it, translate it, structure it, tag it, filter it, prioritize it, add in your verb and do that all at scale and at machine speed. One of the last things I'll mention as an emerging area for us is digital twins. Thinking about all these other capabilities, digital twins might actually give us a really productive and cost-effective environment in which to experiment, innovate, fail, et cetera and do so in a safer environment.Mark: What do you mean by digital twin? You mean like high availability backup?Jennifer: I'm not a huge expert on this but setting up what's, in essence, a digital record of some other issue, event, place, you name it. Then using that in a sandbox environment to explore how you would really tackle this challenge.Carolyn: When you do this digital twin stuff and even the sandboxing, this is a little bit of a tangent.MetaverseCarolyn: I'm fascinated by the metaverse coming online and augmented reality and virtual reality. Have you got to play with that?Jennifer: I have played a little bit with VR, for sure. People are excited about showing off what they're doing. It has been eye-opening. You think about putting yourself in the position of another person's perspective. It's been powerful for lots of things. These are early days in the space. But it might put me in a different physical environment where I can become familiar with a different country, different environment, et cetera.It's great for foreign language practice, that's great. It's interesting just in terms of the inclusive and positive management environment we want to create, it also has applications in that cross-cultural organizational way. Put yourself in the mindset, in the person of somebody that you're trying to understand, empathize, support. What is it like to be blind?Mark: Or psychological.Jennifer: What is it like to be deaf, to experience it as best you can? VR can do that. There’s one thing that I also want to mention, just because the CIA is unique in this area. I think it's valuable for our partners elsewhere to think about this. Just as we are focused on leveraging these new technologies and bringing them to our complex mission, we also do so against a backdrop of adversaries who are investing in the same technologies and deploying increasingly aggressive versions.Think cyber-attacks that we see these days, think ransomware, think supply chain attacks. There are a lot of other actors out there who are leveraging these same capabilities and doing so in a way that is not in our national security interests.Monitor and Control an Unparalleled InnovationJennifer: There's a subset of these actors, whose governments I would characterize as digital autocracies. They're developing and deploying these capabilities first to monitor and control their own societies. Their own societies end up being the guinea pigs for this experimentation. Those capabilities can easily be projected around the globe at adversaries like us.If I think about that balance for us, we need to leverage or, let's say, understand, deploy these capabilities to support our mission. We need to defend against their use by adversaries seeking to do us, the US, our...

Unparalleled Innovation with Jennifer Ewbank, Deputy Director for Digital Innovation at Central Intelligence Agency

Mike Gruss

Mike Gruss, Editor-in-chief at Sightline Media Group has eyes on news related to all things DOD. He and his reporters are asking the smart questions when it comes to government defense technology. IT savvy leadership, user experience, and gamification are just some of the topics Mike unpacks in this episode of Tech Transforms.Episode Table of Contents[00:38] The Biggest Trending Topics in Government Technology[09:11] The Lethality of Government Technology[20:05] Predictions for Government Technology in 2022[31:22] How the Government Technology Is Put TogetherEpisode Links and ResourcesMike GrussSightline Media GroupDoDThe Biggest Trending Topics in Government TechnologyCarolyn: Today we get to talk to Mike Gruss, editor-in-chief at Sightline Media Group. He’ll discuss some of the hottest topics in the IT industry. Sightline Media Group is the leading news organization covering military, defense, public sector, federal technology, C4ISR, and cyber defense. Today, Mike unpacks some of the biggest trending topics in government technology. We also get his perspective on the DoDs advancement in technology.Mike, I love having you on the show because you have such a broad knowledge. You really have your finger on the pulse of what's happening in the government. So you're over a lot of publications. Can you tell our listeners briefly about your role as editor in chief of Sightline Media Group and the different publications you oversee?Mike: Sightline oversees a number of brands, as you mentioned. I like to think of us as the largest national security newsroom in the country. We have two or three different buckets that our publications fall into. What we've really concentrated on the last year or so is working collaboratively across the newsroom. You may recognize specific brands, but I think our reporters are working across several brands or across the newsroom.There's the military times brands, which are Military Times, Army Times, Air Force Times, Navy Times, and Marine Corps Times. Those are geared toward the troops and you'll see those publications, obviously online. They're available at commissaries, and then there's also our business to government groups.What’s Happening With the Government TechnologyMike: Those are publications like defense news, which covers the defense industry and what's happening at the Pentagon and on Capitol Hill, the business and politics of defense acquisitions. And also C4ISR net, which focuses more on that network warfare aspect of the defense industry. The last publication we have is Federal Times. It focuses on the federal workforce and what they need and what's happening there on a day-to-day basis.It's a lot, but we have a really passionate and skilled newsroom that thinks hard about these issues. They work really hard to get scoops up and to get enterprise news stories that will help people understand what's happening at their job and make better decisions every day at work.Carolyn: I love the specialization. Obviously, you get a lot of stories that are going to be broad across. But when you take it and get specific to the mission of the different branches and the different missions, I really appreciate that.Mike: I don't like to use the word expert because I think it's overused. But I'd say all of our reporters have a tremendous amount of knowledge in their field. They work really hard to ask smart questions, to be able to explain issues clearly and to know the nuances. I think that comes through in our reporting.Carolyn: I definitely agree and I would absolutely use the word expert. Talk about your perspective on how the DoDs are making advancements in government technology. Do you think they're taking the right steps right now?Mike: This is a difficult question and I think there's such a push-pull that we have to do here. I'm curious how you think of it too.What DoD Has to Do With ITMike: On one hand, I think we have to recognize the complexity of what particularly DoD has to do when it comes to IT. They have to be the most secure, for example. If they are not secure, no one's going to give them a pass. No one's going to say, "Whoops, you missed that part. You didn't patch that, you didn't have that working. Oh, well."That's not going to happen. We give them no leeway and that's how it should be. They have a tremendous budget to make sure they have no leeway. On the other hand, I get, I wouldn't say frustrated, but I think sometimes we're expected to celebrate advancements that industry made 10, 15 years ago.Carolyn: Are you thinking of something specific?Mike: I think cloud is the one that probably comes to mind first. But I think when you also talk about bringing your own device, you talk about even telework. These are things that many major corporations across the country figured these ideas out years and years ago. I think to say, "Well look at us. We did this." It's like, "Okay. You shouldn't get so much credit for doing it."At the same time, I started with, there is that complexity of doing it at the size and scale they do it and with the level of security they do it. That's where I have this push and pull where I'm always careful of saying things like, "All right. This is a step forward for them, but are we judging them on the right scale?" I think that's where I sometimes have questions.Mark: You bring up something really interesting. It brings to mind the executive order on user experience that's come out.Executive OrderMark: When I think of the DoD, I think of, "Okay. There's an element of the DoD that fights wars, protects the country. That's one element of it." But then there's the other element of luck. Making it easy for the people who work in the Department of Defense to actually live their lives, get healthcare, make sure that they're being paid. All these things seem to dovetail on that. I wanted to get your thoughts around that executive order. Are you guys tackling that at this juncture?Mike: Yes, I think we're watching. I can't speak specifically to that executive order but I think those are the types of issues that we're constantly grappling with. And I wouldn't necessarily disagree with you that there's two separate schools of thought on IT in DoD. A couple of years ago, and you saw this, there was this, in the maddest era, everyone wanted to speak his language and use the same glossary of terms he did.I very clearly remember being at a DISA event where someone said, "No. Sending an email promotes lethality." You're like, "Come on. Email is not lethal." Similarly, we have to draw the line. Yes, every little bit contributes to kinetic war operation, if you want to think about it that way. But I have a hard time pulling the thread that far where I'm like, "Okay. Email is lethality."Mark: DoD looks at the world. You mentioned the commercial sector, which I've worked in both and I 100% agree with you. I think that the commercial world has adopted technologies much faster. They're ahead of the game. Of course, they also have employees, which the DoD has, which is their end-user.The Lethality of Government TechnologyMark: Unless it's an enemy, then they're the end-user of lethality, so to speak. But in the commercial world, they do have customers that they have to cater to, which I think the DoD maybe has neglected.Mike: Yes. Maybe to your point, it doesn't think of its employees as customers and that's probably one of the issues.Carolyn: I've been learning recently about ATOs, Authority to Operate. In my brain, I thought an ATO got a stamp and they got to use the application. Like once they got the ATO, it's done. Not the case. I am baffled and the thought of what they have to go through on a regular basis to maintain that ATO, like thousands of hours per application is just unwieldy to me. It makes me sick to my stomach. I'm like, "That's about when I would quit," when I had to go through that ATO again. So they have that. I'd like to put you on the spot here a little bit. What has DoD excelled in that maybe the commercial world hasn't in technology?Mike: That's a great question. I'm not sure. I'd be curious what you guys think of this too. There's part of me that thinks from a security standpoint that as much as that's an area where it slows them down and they're critiqued for, I think in many instances they seem to have gotten it right. So let's take, for example, Solar Winds. There was a vulnerability there and it seems from what we know, and obviously, I don't know everything. But from what I've read and what our reporters have said, other government agencies were hurt or were more vulnerable.Who Have Been Hit With VulnerabilityMike: DoD seems to have been done okay there. They knew there were attempts. But it seems like everything that's been said publicly, and the best that our reporters can tell is that because of the strength of their network, they were able to withstand this. I think there's part of me that is skeptical like, "Well wait a minute. What did you guys do differently than everyone else did?" But we also have to give them credit for that. We look at the companies across the world that were hit with that vulnerability.Mark: I think that bar is so high. There's no alternative. It's table stakes. They had to do it right. Maybe they suffered in some ways, adaptability or agility, but they had to deliver on it. My gut feeling would tell me, and I don't know this. I'm speculating like most of us that the ability to wage war is an area where technology is something they do well. But that doesn't necessarily help a lot of the day-to-day IT workings of the Department of Defense.Carolyn: But what I hear you saying is the mission of the DoD is to protect and defend and they excel at it. I like that.Mike: To use Mark's word and I think he's absolutely right there, the agility. There is a trade-off, you can't have it both ways. You can't excel in this area and also there's zero room for error. There is a trade-off. I think maybe what the conversation that's happening now is that trade-off, are those trade-offs kind of balanced or aligned the way that they should be?Zero Trust and ThunderdomeMark: I'm a great straight man. So speaking of zero trust, can you give us your thoughts on zero trust and maybe even touch on the Thunderdome?Mike: Yes. I think the Thunderdome Award is interesting from DISA, but I guess I have a couple of questions. We see these, and I'm coming off way more skeptical than I really am doing this podcast. I think that's the rolling plan. We see these cybersecurity philosophies come up every couple of years. I'm blanking on the name, but the risk framework we heard about a couple of years ago, I think all these ideas evolved. We're not too far away from where we were maybe five or 10 years ago, but this is just the most natural evolution of that.I think, as a late person and so many of these ideas I relate back to my home or my own personal security. I'm like, "Oh, well this makes sense that this is how zero trust operates. I don't want someone else speaking to my bluetooth speaker that's on right now." And I don't want to say its name or I don't want someone else turning on the lights in my house or something. That all makes sense, someone accessing my bank account.I guess the couple of questions I have right now are like, how will this work in the future? How will it work with legacy systems? As we have these legacy systems throughout DoD, I guess one, will they be able to be upgraded to work with the zero trust architecture? Two, how will they do that and, again, what's the trade-off there? How much are you going to pay?How Much Work Is Going to Take To Build Government TechnologyMike: How much work is that going to take to make sure that every element of a new destroyer works with that zero trust architecture? I think that's difficult. The other question I have is we're obviously moving into this new world where everything's connected and the program is called JADC2.But this sensor to shooter where you use any sensor in the world connected to any shooter in the world, how does zero trust architecture work with that? How does it work with international alliances? I feel like they're big ideas, but again, this is something where zero trust only works if it's working with everyone. So I feel like there's still a lot of room for explanation and improvement. It seems like it's the right path for now and getting everyone on board and making it kind of the universal approach.It’s what we've seen the last what, 12, 18 months. Maybe there's been more concerted effort during that time to get everyone on the same page here. It feels like this is the way that it's going to go and this is the way it's going to work. Not just DoD, but also industry is kind of on board with this idea, which is what you need.Mark: Feels that way to me too.Mike: Maybe in the next two or three years, we'll see the next evolution of whatever this is and we'll be talking about something else.Mark: It feels to me that cyber security generally is a weapon system that needs to be invested in like you would invest in warfare capabilities like the F35. It needs that type of investment.Politics or Scare TacticsMark: Certainly, it seems like, and I don't know how much this is politics or scare tactics or what, but that our adversaries are looking at it that way. Using it as a means to disrupt what we do and take our eye off the ball, wherever that may be going. It just feels that way.I also feel like zero trust is a current path that should change. This should all change every couple of years. Certainly, the landscape is changing so fast. It can't be something that we say, "This is what we're going to do for the next 15 years."Carolyn: So Thunderdome, aside from being an awesome name, to be honest is a little perplexing to me. Maybe I've just been in this industry too long, but I feel like we've been talking about zero trust for a decade. It's been a big push for the DoD for at least five years. When I read about Thunderdome, the way I understand it is we're going to build out a prototype. I thought we already had that. So I'm a little confused. I would love to hear your thoughts on that.Mike: I think the most recent word was more for specific prototypes involving specific technologies. I would say generally the idea has been out there. It's been adopted and we've seen it be a top priority for the IT leaders. I think maybe now some of the questions are, how do you implement that philosophy? What are the tools in place to make sure that everything is working as expected? That's how I'm reading some of these more recent contract announcements in this area.Predictions for Government Technology in 2022Carolyn: That actually helps me. I would love to get your predictions. So what are your predictions for government technology in 2022?Mike: I thought a little bit about this and you can tell, some are more surprising than others. The first one is, I think we're going to see IT savvy leaders, and that doesn't necessarily mean just IT leaders. IT savvy leaders are going to have a bigger seat at the table or will be invited to the table where maybe they weren't in the past. I think that's something that's been happening the last couple of years, but that's going to continue to evolve at a faster and faster rate.Carolyn: Are you thinking more of DoD specifically or is this across the government?Mike: I think it's probably happening across the government. I spend most of my time on DoD issues. I'd say what's going to happen, but let me give you an example. I was at a breakfast in October and there was a general officer. Someone who's been around for a while and been promoted a number of times. He said, "Only in the last six months did I fully understand what data as ammunition means." I thought, "Wow. How could you have only heard or really grasped that in the last six months?"I've covered national security for about 10 years. I feel like that's been an idea the entire time. That's why I say IT savvy leaders who have really adopted and embraced the data first mentality, I think they will get promoted more and have a seat at the table. Whereas maybe folks who are a little more, I don't know if the right word is data hesitant, not data curious, won't.Government Technology Faces a Little Language BarrierCarolyn: Do you think that it might be a semantic thing? We've got a little language barrier going on because our DoD leaders, like Intel, are king. I think that they would all agree with that, and data is Intel. Is it a language barrier?Mark: Or is it culture?Mike: It's probably a lot of both. I don't think the culture has been there. When people say data they're like, "Oh, I'm not an IT person or I'm not this person." I just think that's not the way the world works anymore. Like everyone's a data person.Mark: Do you see any shift in that culture of late? A lot of the military shifts seem like every 18, 24 months and have new jobs. Maybe IT is not a place where that should be done. Do you see any of that?Mike: I see it evolving the last couple of cycles to use the idea you're talking about. It feels, from where I sit, that there's been some more savvy folks, but not just in the IT departments or not the IT like the CIO's offices. I’d say it's across the board that we're seeing. My prediction is I expect that to continue to happen faster and faster. I think the other thing that's related to that I expect to see less of is, I just wrote down patience with IT.So I expect that when there are problems, there's not going to be the folks who do so much of that now. I don't know if you guys followed this, but last week there was a letter from an air force officer that went viral. The hashtag was “fix our computers”.Money, Time, and Red Tape in Government TechnologyMike: I hope I got that right. It’s all about how much money, time, and red tape is being wasted just because basic functions don't work. If you're seeing that type of very public outburst, I don't say that pejoratively, the complaints were merited. But if you're seeing that happen at the officer level from folks who are running tech incubators, imagine what's happening by folks who don't feel empowered to speak out. I think the patience there is very thin.Senior leaders are going to say, "We just can't operate this way anymore." I don't want to put too much weight on it, but you saw the air force CIO. You saw other CIOs weigh in on LinkedIn and say, "You're absolutely right. We got to fix this. Here's some of the steps we're taking." If that conversation becomes public in that way, I think the patience may be worn out.Mark: It's an interesting perspective. I didn't think of it that way.Carolyn: They're demanding a user experience. I just saw a tweet from Nick Chaillan that said, "Would it be faster to list everything that is not broken?" No.Mike: I think he was part of this. We've seen it with some of the Navy IT leaders...

Government Technology In Sight with Mike Gruss

Sandy Carter

Sandy Carter, Unstoppable Domains SVP and Channel Chief again joins Carolyn and Mark, this time to discuss the importance of diversity in technology. She gives us an exciting inside look at her event, Unstoppable Women of Web3. Sandy walks the walk when it comes to getting women and girls involved in tech. Follow her on social media to get the latest updates!Episode Table of Contents[00:55] The Vision for Unstoppable Women[05:42] Unstoppable Women Are Learning About IOT and Machines[11:09] A Dream to Start the Groundswell With Unstoppable WomenEpisode Links and ResourcesSandy CarterUnstoppable DomainsUnstoppable Women of Web3Web3The Vision for Unstoppable WomenCarolyn: So we have Sandy Carter back. The last time we talked to her, she gave me the 101 on Web3 and FTs, crypto. My head's still swimming a little bit but I'm actually really excited about it. She did a great job and one of the key things that Sandy talked about was for Web3 to be the vision that she has for it and to be really strong, it needs diversity.Today, we're back with Sandy Carter, renowned technologist, bestselling author, and current senior VP at Unstoppable Domains. She's one of the leading pioneers in the digital business and also a former Fortune 25 business executive. She is a leader focused on helping companies with innovation and digital transformation through culture and technology like AI and the internet of things. So let's jump into it. As an advocate for diversity and women in technology and your involvement within girls in tech, what advice would you give to women pursuing roles in technology today?Sandy: There's a couple of things. Technology is moving at such a pace that I think you need to develop this learn and be curious notion. Probably, what you're studying today in school or what you're doing today at your job will change significantly.Top Jobs Today for Unstoppable WomenSandy: I was on the diversity group for the World Economic Forum and one of the interesting pieces of data that they shared with us was that the top jobs today in technology didn't exist five years ago. So unless you're going to be stuck in an old legacy role which will decline over time, you've got to be continuously learning and curious about what's coming so that you're ready to go in a lot of those new areas and those new fields.Carolyn: How do we stay current? Getting a degree is a good foundation and things are changing so often. What are some conferences or certifications that you would recommend for women in tech?Sandy: There is a lot of really good material out there. There's so many classes and things that you can take just to refresh yourself, like YouTube. One of the things I do is to dedicate time every week. I mark an hour in my calendar every week. It probably could be more, but at least, an hour every week to check out something that I don't know about. Maybe it's quantum computing or spatial computing or a new thing that's happening in Web3. I'm always constantly on that front edge.I still remember when I was with IBM and I got selected to lead a lot of our artificial intelligence work. People were like, "Wow, you're so lucky to get to do artificial intelligence." I would say, "No, I'm not lucky. I've been studying this. I took two classes at MIT. I've been playing around with this. I was learning and being curious about it so that when this opportunity came, I was ready."Where We Are Today With TechnologySandy: So if you're just doing your day job today, I don't think it's enough. In fact, I have two daughters and they love Alice in Wonderland. One of the parts I love so much about that book is, Alice said, "I had to run twice as fast just to stay in place." And that's where we are today with technology. I think you can't just focus on your current role. You always had to be learning about what that next role might be or might hold.Mark: You got your degree in computer science at Duke University. It's not surprising to me that you're the innovator and entrepreneur that you are in this arena. But how do we get women involved in technology at a younger age? How do we get them started with Math and Science so that by the time that they get to college or they get into the professional world, they're already teed up for this?Sandy: I think there's a couple of ways that we do that. One, I love what Girls in Tech are doing and truth in advertising. I am Chairman of the board for Girls in Tech. One of the things we do at Girls in Tech is host workshops and hackathons for the younger generation but we make it relevant to what they like. For example, a lot of young girls like fashion. So, we did a fashion tech hackathon. They get to create a ring with an IoT sensor in it and if you press the sensor, it would call for their parents. It was beautiful. The ring was beautiful and so they were all really interested in it.Unstoppable Women Are Learning About IoT and MachinesSandy: As they were learning about the ring, they were learning about IoT and machine learning. We put it in an application that was right for them. The other thing we did at AWS is teaching reinforcement learning which is even a higher level of artificial intelligence. We created a race car, it was called Deep Racer. It has IoT sensors around it and it races around a racetrack. You know a lot of young girls like to race cars. It's fun. We had kids all over the world racing these cars.What they were really doing is learning again, IoT technology, cloud technology, and AI. I think it's about us putting it into their language. I’d also say when I lived in New York. We fought really hard to get computer science to be mandatory in high school. I also think there are policy issues for states. I just saw the governor of Colorado when we had an event in EatDenver. He says he wanted his state to be the number one digital state. Miami wants to be the city of crypto. In order to do that, you have to train your kids, the next generation at earlier ages, as well.Mark: How do we do this at scale? How do we get the groundswell really moving across the country to do this? Maybe we can do it in pockets but I think we've really got to generate a groundswell.Sandy: That brings me to an announcement that we are going to be unleashing on March 8th which is International Women's Day. Obviously, a lot of women are mothers and aunts. They have an impact on the next generation and themselves as well.The Next Generation of TechnologySandy: As we started looking at Web3 which is the next generation of technology, we started noticing that there is already a discrepancy in a lot of the numbers and a lot of what's happening. For example, only 15% of bitcoin holders today are women.There are about 150 top crypto companies, only five are women. Men invest in this Web3 space so much more prevalently than others. Only 9% of women say they even understand Web3. So we're going to announce on March 8th this thing called Unstoppable Women of Web3. The whole mission is going to be around making this Web3 accessible for all. We want to help them with the first step. We're going to give away 10 million dollars of free domains as the entry point for Web3, and we're going to be action-oriented. We've got education that's launching, networking that's launching. We have real-life events and virtual events that are launching to help women support women in this mission.Now part of this, we're going to do a one-hour YouTube live session on March 8th. We're also going to host a 24-hour Twitter space with a different guest speaker sometimes every half an hour. So it's a big ordeal. One of the things I'm really excited about, for example, Nyla Hayes. I don't know if you guys know her. She's 13-years-old. She is a young woman who started creating an NFT collection of her art. They're called the Long Neck Ladies. She's made millions and millions of dollars.How Unstoppable Women Accomplish Things at a Young AgeSandy: She is Times' first artist in residence and she's going to do one of those Twitter spaces on how she accomplished this when she was 12. Now she's 13. How did she accomplish this at a young age? We're going to have women talk about what blockchain is. What is decentralization and what is digital identity? All the elements of Web3 and why we think the future of Web3 is female-focused. There's tons there.We're hoping, our mission and our goal is to create that groundswell. That will begin on March 8th with all this education. We've partnered with over 57 different companies, big companies, small companies, Web3 companies from Google and Deloitte to folks like blockchain.com and BlockFi. Some of them work really well, and of course, Unstoppable Domains, to make this happen. I feel that if we all come together to be action-oriented, to have the 8th be that first push of the groundswell, this will continue.We're also going to publish a top 100 inspirational women of Web3 and we're going to do a speakers bureau of women. The reason I want to do that is, I was announced as keynoting at South by Southwest on what Web3 is. You would not believe the number of people coming out of the woodwork now who want me to come speak because they want diversity. They're like, "How do we find other women doing this?" Well, we're going to create a speakers bureau so more women can be front and center.A Dream to Start the Groundswell With Unstoppable WomenSandy: So sorry that was a long-winded answer but I am so excited about what we're doing. My dream is that we do start that groundswell with all of these unstoppable women that will just expand and expand and expand.Mark: It seems to me that at many universities and colleges throughout the United States, the number of women that are enrolled in schools might be over 50% across the board. But I really would like to see a lot of that moving to data science, computer science, those types of schools. So I appreciate the insight on it.Carolyn: Honestly, I'm having chills as Sandy's talking because we talk about the need for diversity. We talk about the need to get more women in tech and girls in tech and we know the stats. We've got somebody who's walking the walk. I mean you're doing it. So I am so excited to get this out to our listeners.Thank you for sharing this with us. We will get these links out to all of these different things that you mentioned so people can go. Do you want to give us your top three things to do right now for everyone, not just women? Top three that we can do to be involved.Sandy: First, I would just say number one is to have that desire to learn. It is hard but make sure that you attend one of these Twitter spaces. They're half an hour, an hour investment of time and you'll just get excited. You can ask questions and just learn.Discord and TelegramSandy: Twitter spaces work a little differently, it's a link where you can set a reminder on Twitter. It’s a little different but I'll share those with you. Then for the YouTube live, we'll do a YouTube live that's one hour on what is Web3. Just like the last session that we did on what is Web3, that's a whole hour on all the details with visuals. I'm a very visual learner and so that will be a visual. We'll get you that link right away so that you can help people do that.The second one is, I would say just interact. Both of you are asking questions today and I think that interaction is how you learn. It's also how you figure out who some of your trusted advisors are so when you need to ask a question, you can do that. There are also two tools that most Web3 people use, Discord and Telegram. If you're not on those, you could go explore them.Then the third thing, I think you have to experience it. You have to play with it. If it's Web3, you can't learn it in a book and then talk about it credibly. You've got to do it. You're going to run into challenges like I did. I ran into challenges too and I consider myself pretty techy. Setting up your domain, linking it to a wallet, figuring out how to buy Eth or bitcoin is a daunting experience. But once you go through it, you'll get hooked on it and what we call it as going down the rabbit hole. Then you want more and more.How Unstoppable Women Develop Their SkillsSandy: That would be my three things: learn, interact, and play. I think that's really how you develop a set of skills that are hands-on.Carolyn: I'll give a fourth. Again, follow Sandy Carter on LinkedIn. I know that you share your word of the day and you share insights that you have. That's a really easy way for our listeners to get involved and to learn. Thank you so much for your time today, Sandy. I really appreciate you taking time out of your busy schedule for us.Sandy: Thank you for the honor of being on your podcast as well. I really appreciate it. Thank you, both, for helping me to evangelize what's happening on March 8th. I really do want it to be all of us working together to push this agenda forward.Carolyn: Absolutely. Thanks to our listeners for joining us today. Please like and share this episode, this is an important one. We will talk to you next week on Tech Transforms sponsored by Dynatrace.

<p>Sandy Carter, Unstoppable Domains SVP and Channel Chief again joins Carolyn and Mark, this time to discuss the importance of diversity in technology. She gives us an exciting inside look at her event, Unstoppable Women of Web3. Sandy walks the walk when it comes to getting women and girls involved in tech. Follow her on social media to get the latest updates!</p><h2>Episode Table of Contents</h2><ul><li>[00:55] The Vision for Unstoppable Women</li><li>[05:42] Unstoppable Women Are Learning About IOT and Machines</li><li>[11:09] A Dream to Start the Groundswell With Unstoppable Women</li></ul><h2>Episode Links and Resources</h2><ul><li><a href="https://www.linkedin.com/in/sandyacarter/#experience" rel="noopener noreferrer nofollow" target="_blank">Sandy Carter</a></li><li><a href="https://unstoppabledomains.com/" rel="noopener noreferrer nofollow" target="_blank">Unstoppable Domains</a></li><li><a href="https://www.eventbrite.com/e/unstoppable-wow3-youtube-live-registration-269962624477" rel="noopener noreferrer nofollow" target="_blank">Unstoppable Women of Web3</a></li><li><a href="https://web3.foundation/" rel="noopener noreferrer nofollow" target="_blank">Web3</a></li></ul><h2>The Vision for Unstoppable Women</h2><p>Carolyn: So we have <a href="https://www.linkedin.com/in/sandyacarter/#experience" rel="noopener noreferrer nofollow" target="_blank">Sandy Carter</a> back. The last time we talked to her, she gave me the 101 on Web3 and FTs, crypto. My head's still swimming a little bit but I'm actually really excited about it. She did a great job and one of the key things that Sandy talked about was for Web3 to be the vision that she has for it and to be really strong, it needs diversity.</p><p>Today, we're back with Sandy Carter, renowned technologist, bestselling author, and current senior VP at Unstoppable Domains. She's one of the leading pioneers in the digital business and also a former Fortune 25 business executive. She is a leader focused on helping companies with innovation and digital transformation through culture and technology like AI and the internet of things. </p><p>So let's jump into it. As an advocate for diversity and women in technology and your involvement within girls in tech, what advice would you give to women pursuing roles in technology today?</p><p>Sandy: There's a couple of things. Technology is moving at such a pace that I think you need to develop this learn and be curious notion. Probably, what you're studying today in school or what you're doing today at your job will change significantly.</p><h3>Top Jobs Today for Unstoppable Women</h3><p>Sandy: I was on the diversity group for the World Economic Forum and one of the interesting pieces of data that they shared with us was that the top jobs today in technology didn't exist five years ago. So unless you're going to be stuck in an old legacy role which will decline over time, you've got to be continuously learning and curious about what's coming so that you're ready to go in a lot of those new areas and those new fields.</p><p>Carolyn: How do we stay current? Getting a degree is a good foundation and things are changing so often. What are some conferences or certifications that you would recommend for women in tech?</p><p>Sandy: There is a lot of really good material out there. There's so many classes and things that you can take just to refresh yourself, like YouTube. </p><blockquote>One of the things I do is to dedicate time every week. I mark an hour in my calendar every week. It probably could be more, but at least, an hour every week to check out something that I don't know about. Maybe it's quantum computing or spatial computing or a new thing that's happening in Web3. I'm always constantly on that front edge.</blockquote><p>I still remember when I was with IBM and I got selected to lead a lot of our artificial intelligence work. People were like, "Wow, you're so lucky to get to do artificial intelligence." I would say, "No, I'm not lucky. I've been studying this. I took two classes at MIT. I've been playing around with this. I was learning and being curious about it so that when this opportunity came, I was ready."</p><h3>Where We Are Today With Technology</h3><p>Sandy: So if you're just doing your day job today, I don't think it's enough. In fact, I have two daughters and they love Alice in Wonderland. One of the parts I love so much about that book is, Alice said, "I had to run twice as fast just to stay in place." </p><blockquote>And that's where we are today with technology. I think you can't just focus on your current role. You always had to be learning about what that next role might be or might hold.</blockquote><p>Mark: You got your degree in computer science at Duke University. It's not surprising to me that you're the innovator and entrepreneur that you are in this arena. But how do we get women involved in technology at a younger age? How do we get them started with Math and Science so that by the time that they get to college or they get into the professional world, they're already teed up for this?</p><p>Sandy: I think there's a couple of ways that we do that. One, I love what Girls in Tech are doing and truth in advertising. I am Chairman of the board for Girls in Tech. One of the things we do at Girls in Tech is host workshops and hackathons for the younger generation but we make it relevant to what they like. For example, a lot of young girls like fashion. So, we did a fashion tech hackathon. </p><p>They get to create a ring with an IoT sensor in it and if you press the sensor, it would call for their parents. It was beautiful. The ring was beautiful and so they were all really interested in it.</p><h2>Unstoppable Women Are Learning About IoT and Machines</h2><p>Sandy: As they were learning about the ring, they were learning about IoT and machine learning. We put it in an application that was right for them. The other thing we did at AWS is teaching reinforcement learning which is even a higher level of artificial intelligence. We created a race car, it was called Deep Racer. It has IoT sensors around it and it races around a racetrack. You know a lot of young girls like to race cars. It's fun. We had kids all over the world racing these cars.</p><p>What they were really doing is learning again, IoT technology, cloud technology, and AI. I think it's about us putting it into their language. I’d also say when I lived in New York. We fought really hard to get computer science to be mandatory in high school. I also think there are policy issues for states. I just saw the governor of Colorado when we had an event in EatDenver. He says he wanted his state to be the number one digital state. Miami wants to be the city of crypto. In order to do that, you have to train your kids, the next generation at earlier ages, as well.</p><p>Mark: How do we do this at scale? How do we get the groundswell really moving across the country to do this? Maybe we can do it in pockets but I think we've really got to generate a groundswell.</p><p>Sandy: That brings me to an announcement that we are going to be unleashing on March 8th which is International Women's Day. Obviously, a lot of women are mothers and aunts. They have an impact on the next generation and themselves as well.</p><h3>The Next Generation of Technology</h3><p>Sandy: As we started looking at Web3 which is the next generation of technology, we started noticing that there is already a discrepancy in a lot of the numbers and a lot of what's happening. For example, only 15% of bitcoin holders today are women.</p><blockquote>There are about 150 top crypto companies, only five are women. Men invest in this Web3 space so much more prevalently than others. Only 9% of women say they even understand Web3. So we're going to announce on March 8th this thing called Unstoppable Women of Web3. The whole mission is going to be around making this Web3 accessible for all. We want to help them with the first step. </blockquote><p>We're going to give away 10 million dollars of free domains as the entry point for Web3, and we're going to be action-oriented. We've got education that's launching, networking that's launching. We have real-life events and virtual events that are launching to help women support women in this mission.</p><p>Now part of this, we're going to do a one-hour YouTube live session on March 8th. We're also going to host a 24-hour Twitter space with a different guest speaker sometimes every half an hour. So it's a big ordeal. One of the things I'm really excited about, for example, Nyla Hayes. I don't know if you guys know her. She's 13-years-old. She is a young woman who started creating an NFT collection of her art. They're called the Long Neck Ladies. She's made millions and millions of dollars.</p><h3>How Unstoppable Women Accomplish Things at a Young Age</h3><p>Sandy: She is Times' first artist in residence and she's going to do one of those Twitter spaces on how she accomplished this when she was 12. Now she's 13. How did she accomplish this at a young age? We're going to have women talk about what blockchain is. What is decentralization and what is digital identity? All the elements of Web3 and why we think the future of Web3 is female-focused. There's tons there.</p><p>We're hoping, our mission and our goal is to create that groundswell. That will begin on March 8th with all this education. We've partnered with over 57 different companies, big companies, small companies, Web3 companies from Google and Deloitte to folks like <a href="http://blockchain.com" rel="nofollow" target="_blank">blockchain.com</a> and BlockFi. Some of them work really well, and of course, Unstoppable Domains, to make this happen. I feel that if we all come together to be action-oriented, to have the 8th be that first push of the groundswell, this will continue.</p><p>We're also going to publish a top 100 inspirational women of Web3 and we're going to do a speakers bureau of women. The reason I want to do that is, I was announced as keynoting at South by Southwest on what Web3 is. You would not believe the number of people coming out of the woodwork now who want me to come speak because they want diversity. They're like, "How do we find other women doing this?" Well, we're going to create a speakers bureau so more women can be front and center.</p><h2>A Dream to Start the Groundswell With Unstoppable Women</h2><p>Sandy: So sorry that was a long-winded answer but I am so excited about what we're doing. My dream is that we do start that groundswell with all of these unstoppable women that will just expand and expand and expand.</p><p>Mark: It seems to me that at many universities and colleges throughout the United States, the number of women that are enrolled in schools might be over 50% across the board. But I really would like to see a lot of that moving to data science, computer science, those types of schools. So I appreciate the insight on it.</p><p>Carolyn: Honestly, I'm having chills as Sandy's talking because we talk about the need for diversity. We talk about the need to get more women in tech and girls in tech and we know the stats. We've got somebody who's walking the walk. I mean you're doing it. So I am so excited to get this out to our listeners.</p><p>Thank you for sharing this with us. We will get these links out to all of these different things that you mentioned so people can go. Do you want to give us your top three things to do right now for everyone, not just women? Top three that we can do to be involved.</p><p>Sandy: First, I would just say number one is to have that desire to learn. It is hard but make sure that you attend one of these Twitter spaces. They're half an hour, an hour investment of time and you'll just get excited. You can ask questions and just learn.</p><h3>Discord and Telegram</h3><p>Sandy: Twitter spaces work a little differently, it's a link where you can set a reminder on Twitter. It’s a little different but I'll share those with you. Then for the YouTube live, we'll do a YouTube live that's one hour on what is Web3. Just like the last session that we did on what is Web3, that's a whole hour on all the details with visuals. I'm a very visual learner and so that will be a visual. We'll get you that link right away so that you can help people do that.</p><p>The second one is, I would say just interact. Both of you are asking questions today and I think that interaction is how you learn. It's also how you figure out who some of your trusted advisors are so when you need to ask a question, you can do that. There are also two tools that most Web3 people use, Discord and Telegram. If you're not on those, you could go explore them.</p><p>Then the third thing, I think you have to experience it. You have to play with it. If it's Web3, you can't learn it in a book and then talk about it credibly. You've got to do it. You're going to run into challenges like I did. I ran into challenges too and I consider myself pretty techy. Setting up your domain, linking it to a wallet, figuring out how to buy Eth or bitcoin is a daunting experience. But once you go through it, you'll get hooked on it and what we call it as going down the rabbit hole. Then you want more and more.</p><h3>How Unstoppable Women Develop Their Skills</h3><blockquote>Sandy: That would be my three things: learn, interact, and play. I think that's really how you develop a set of skills that are hands-on.</blockquote><p>Carolyn: I'll give a fourth. Again, follow Sandy Carter on LinkedIn. I know that you share your word of the day and you share insights that you have. That's a really easy way for our listeners to get involved and to learn. Thank you so much for your time today, Sandy. I really appreciate you taking time out of your busy schedule for us.</p><p>Sandy: Thank you for the honor of being on your podcast as well. I really appreciate it. Thank you, both, for helping me to evangelize what's happening on March 8th. I really do want it to be all of us working together to push this agenda forward.</p><p>Carolyn: Absolutely. Thanks to our listeners for joining us today. Please like and share this episode, this is an important one. We will talk to you next week on Tech Transforms sponsored by Dynatrace.</p>

Unstoppable Women of Web3: Learn and Be Curious with Sandy Carter

Sandy Carter, SVP and Channel Chief at Unstoppable Domains and former Vice President at Amazon Web Services talks about the groundbreaking work she is doing with Web3. Listen in to get more information on Web3 capabilities and hear about the chaotic creation that Unstoppable Domains is taking on.Episode Table of Contents[00:53] A Leading Pioneer in Web3 and Digital Transformation[08:280] A Hot Topic Element of Web3[15:12] Women Are Getting Involved With Web3[23:04] What Web3 Means for the GovernmentEpisode Links and ResourcesSandy CarterUnstoppable DomainsUnstoppable Women of Web3UberA Leading Pioneer in Web3 and Digital TransformationCarolyn: Today, we're talking to Sandy Carter, and I'm excited to have her all to myself. Sandy is a renowned technologist, bestselling author, and current senior VP at Unstoppable Domains. She is one of the leading pioneers in the digital business, and a former Fortune 25 business executive. She’s a leader focused on helping companies with innovative and digital transformation through culture and technology, like AI and Internet of Things. Sandy, you have an incredible background. You've been with IBM, recently with Amazon Web Services, and now you're working with Unstoppable Domains. I would love for you to tell us your story. What is the journey that you've had with your career? How did you get to Unstoppable Domains, and what is it?Sandy: Well, it's really interesting. You'll notice in all of my companies, IBM, and then you missed a startup. I had a startup in between and then AWS, and then now a startup with Unstoppable. All of those companies were on the leading or bleeding edge of technology. At the time I was at IBM, we were bleeding edge for social media and business, which was that Web 2.0 era. I then went to form my own company and I was doing artificial intelligence. In fact, I thought it was so cool.I was doing like a Myers-Brigg on companies to determine their culture so that we can match them with the right innovation tactic. That way, they didn't go and try something that didn't fit their culture, because culture eats strategy for lunch.Developing the Right Processes for Web3Sandy: Then I moved on to Amazon, and Amazon was all about the cloud, another tech transformation that was going on. I learned so much from each of these companies. Leadership principles from Amazon and how to develop the right processes and mechanisms from IBM. From my startup, how to be really scrappy and to do things that 80/20 rule; not perfect, but good. Good for the customer, valuable for the customer, but not necessarily reaching that perfection mark.When Web3 started out, I was really interested in it. I’ve done some blockchain at Amazon Web Services and I was fascinated with the new technology. So I started doing all of these side projects on NFT, setting up my wallet, doing all this stuff on the side. It turned out that a company approached me called Unstoppable Domains. I was fascinated by what they were doing in the marketplace. They’re focused on digital identity and how, in the Web3 world, you take your identity with you. It's not linked with a particular application.I thought that was fascinating given my history. Looking at Web3, I was like, why would I keep doing these side projects when I could do this full time? So, I came on with Unstoppable. The founding team is great, the portfolio of products is really fascinating to me, and the partners are all the who's who of Web3. So, here I am and I'm having a blast.Web3 Centralization and DecentralizationCarolyn: You talked about several things that are a little baffling to me. First of all, Web3. I'm embarrassed to say that I really haven’t heard that term until I knew that you were a guest. I started looking at some stuff that you've talked about, and I was like, okay, what is this? So, I read some articles over the weekend and I'm still not sure exactly what it is. It's decentralization and centralization and then decentralization.Sandy: I would define Web3 in one word, and that would be an ownership model. When I say an ownership model, if you think about it, let's take Uber for example. I was an early user of Uber. I’ve told all my friends about it because I was living in Silicon Valley. I was Ubering all over when Uber was just in San Francisco and Silicon Valley. So, I was attracting new users and I got value because my friends thought I gave them something of value. But now, Uber is worth about $50 billion and I didn't get any of that financial benefit. I was providing and attracting users for Uber, but the extraction of value came from Uber itself. Web3 turns that on its head. You’re now not a user of the application, you are a member. You have ownership rights in what you're doing. Web3 really introduces that real ownership model to the internet that combines economics, art, game theory, and technology in a very interesting way.The Five Essential Elements of Web3Sandy: Web3, essentially Web3 means that something is built on what I would call five essential elements. One, it is decentralized. You said decentralization, or at least partially decentralized, meaning there's no one company who owns all the servers, all the infrastructure. It is decentralized or at least partially decentralized.Two, there has to be a digital identity that travels with you. Think about today. You go to sign into LinkedIn, you use one ID. Then you go over to Instagram, you're using a different ID. When you go into TikTok, you're using a different ID. But I can now take my digital identity, which I've built with Unstoppable Domains, sandy.crypto.I can take that identity and I can enter a metaverse. With that same identity, I can enter DeFi, decentralized finance with Cook Financial. And with that same identity, I can enter a game like Decentraland or Sandbox. That same identity travels with me, it's all built on the blockchain. That's the third assumption for Web3; decentralized digital identity built on the blockchain. It's trustless, meaning that there is no in-between.I sign a smart contract directly with the person I am purchasing. There's not a bank or a lawyer or anything in between. It financially benefits the members because remember, we have members now. So if I buy an NFT, like a Lazy Lion, I now own that Lazy Lion. I can now create a t-shirt with that Lazy Lion, and that t-shirt could enable me, for example, to create my own business. It's really all about that ownership model.A Hot Topic Element of Web3Carolyn: This reminds me of something that I worked on years ago. I worked for Novell. I'm sure that you know who that company is, even though it really doesn't exist anymore. I was working with developers on a digital identity or a digital wallet, and it didn't go anywhere. It’s a hot topic and it was innovative and cutting edge. It sounds like, is it the blockchain that has enabled it to actually be secure and be something now?Sandy: Blockchain is one of the underpinning technologies and blockchain does allow that transparency and that interoperability. It does help with that ownership too. Make it immutable. It can't be changed for sure. So, it is an element in Web3, just like we talked about those five elements. It has to be decentralized or at least partially decentralized. You have a transportable digital identity. It's built on blockchain, it is trustless and it financially benefits users. Blockchain is definitely a part of the equation.Carolyn: If we were in a Web3 world and Uber's just coming online like it did when you were an evangelist for Uber, you evangelizing Uber to your friends and would give you shares? You would have some kind of ownership in Uber and you would reap the benefits of this $50 billion company?Sandy: I could, yes, absolutely. There is this concept of fractional ownership, and fractional ownership means that whether it is a piece of art or a company or a piece of real estate, you can have a fractionalized ownership of that. For example, NFTs allow for fractional ownership of any digital native asset.Things That Happen in Web3 Sandy: People can own a portion of something that otherwise they might not have been able to afford. It extends beyond art, like a Lazy Lion or a Bored Ape. Of course, the use of NFTs and blockchain enable you to prove ownership, and you do that today. I have a friend of mine who collects Chanel purses. Of course, if you're going to spend that much money on a purse you want it verified.My mom used to be a Boston Red Sox fan. I guess she still is a Boston Red Sox fan and she collects Ted Williams. I don’t even know who he is, but he's an old-time baseball player. She owns that baseball card and she had it authenticated, verified that it's real. It's the same thing that happens in Web3 with that verification.Carolyn: Does the creator of the asset or the company have to say, "Yes, I want to buy into this Web3 idea and have this fractionalized ownership"?Sandy: Yes. If you're a company like Parcel, Parcel is doing Web3 real estate. Or if you look at some NFTs, not all NFTs that are art are fractional ownership. Some of them, I buy and it's outright mine. I own it, I can do whatever I want to with it. Some I buy into it and the artist gets a fractional piece of that forever. If I go and produce a t-shirt and I sell the t-shirt for $10, then maybe the artist gets $1. I get $9 in perpetuity because I'm now a part-owner and they're the creator of it.When Will We Be in the Web3 WorldSandy: This is why a lot of people in music love it. A lot of them today, when they sign on to agents and all these companies, the amount they end up getting is so small. In fact, this weekend I was listening to an artist. They said, "Look, based on the digitalization of music today, after everybody takes their cut my cut is pennies. So I have to do t-shirts, concerts, and ads, because I don't make enough money on my music, which I really should be making the money on."Carolyn: When will we be in this Web3 world, or are we already dipping our toes?Sandy: We're at the very early stages. I would say, we are super early. The tech right now can be very expensive. Think about the gas fees that you have to pay sometimes. A gas fee is not like the gas for your car. The gas fee that you're paying is for the permission to use those decentralized servers. In a centralized world, a company's paying for that. They're going to get the benefit of that too. They are going to get the financial benefit of it. In this new Web3 world, which is decentralized, that gas fee is what you're paying to use a part of that decentralized network. That can be expensive today, and it may not be completely ready. If you think about it, blockchain, there's thousands of articles. Is blockchain scalable yet? Not quite yet, but it will be. I would say that we're in the dial-up phase of Web3. What's that movie? There's a movie, and you can hear the AOL sound of the modem.Carolyn: Oh, You've Got Mail?The Chaotic Creation of Web3Sandy: You've Got Mail, that's right. So think about that sound right now, and you think about Web3, we're in that early stage of it. Or as someone said this weekend at EatDenver, "We're baking a pie and the pie's in the oven. You don't want to take the pie out too early because you can't really consume it. It's not done." We're in that early stage of Web3, and that's why I wanted to jump in early.I like that early stage, I like that chaotic creation for a couple of reasons, and  I just love the tech. I just consume and dive into the tech. But also, because I believe that at the start of this new era of Web3, I want the new era to be diverse. I believe that's what's going to make it more innovative. If we look at the past Web1, Web2, it has not been a diverse group of people shaping the future of it.Carolyn: Meaning there's a few big companies that own all the servers and the services?Sandy: Maybe a lot of men that shape the company. Maybe white men that shape it, not a diverse group of people who are inputting all of their ideas. I think that diversity; diversity of thought, of any kind, is important, having people from multiple countries. Just look at Web3. It is being created in Africa. I was just on the phone this morning with an African company that's doing phenomenal things. They're going to impact what we're doing here.How Women Are Getting Involved With Web3Sandy: Women are getting involved; not at a fast enough rate, but we're going to try to fix that. I was just speaking with Eman who started the Ancient Warriors NFT collection. He focuses on black and brown artists. Now we've got everybody coming in early into the pot. I can feel that pot being mixed up and stirred by so many diverse ideas. The diversity of thought ideas is only going to make it more innovative and more powerful.Carolyn: As you're talking, I'm thinking about baking a cake. I’m thinking, if you only put flour in the cake, you don't have a cake and that's the same with these innovations. Without the diversity, you just don't get the cake. So, I love that. I want to ask about the metaverse.We got some advertisements, some creepy ones, to be honest, with the Super Bowl around the metaverse. When I think of the metaverse, I think about things like Ready Player One where I'm an avatar. There was a movie with Bruce Willis, I think it's called Surrogate. Have you seen that?Sandy: I have.Carolyn: They physically never leave their house. They have a replica of them that they control from a console. These are the kind of things I think about with metaverse. Then last week, I was sick. By the end of the week, I wasn't sick enough not to take a meeting, but I was still sick enough that I looked like I'd been chewed on by wolves.A Metaverse MeetingCarolyn: And so, I didn't want to get on video but I thought, "You know what would be super awesome? It’s if I could do a metaverse meeting and I could go with the perfect outfit and the perfect hair and show up as my perfect self." These are the things that spin around in my head with the metaverse. I would love to hear what the metaverse really is from you.Sandy: It's simply an online digital environment and you are inhabiting that new land as an avatar. You access it through virtual reality or augmented reality. A lot of gamers are already doing this today, if you think about the metaverse. But I like to think about the metaverse in terms of layers. Maybe it's from my tech background. So I see Web3, that decentralized access, that ownership model, being the base or the foundation of a metaverse. That is then dependent on the blockchain for trust, for that secure value exchange, which I then think will be governed by DAOs.We haven't talked about DAOs yet, but DAOs are, again, another voting experience done with tokens. It’s a dynamic governance model of which the metaverse sets. The metaverse is really that digital experience and the worlds, but it requires a DAO structure, blockchain for trust and Web3. The interesting thing is, when we talk about the metaverse and we talk about Web3, I think we're talking about the same direction because the metaverse requires Web3 to really deliver on its promises in the marketplace today.Carolyn: Is Unstoppable Domains building that foundation then, for the metaverse with Web3?Unstoppable DomainsSandy: So Unstoppable Domains is building your digital identity, which is represented as your domain. Think about it as the domain with super powers, unlike the domain of a Web2 world. When I say super powers, I mean it's user-owned and controlled, so there's no renewal fees. You own it. It's back to that ownership. It is decentralized because it's created on that blockchain.Any third party can read it and resolve that name without anybody's permission, not even ours. Others can build tools and applications on it, like metaverses, as they move forward. For example, the Atlantis metaverse is built on top of our digital identity. Cook Finance, that's DeFi, is built on top of it. Parcel, which is doing real estate in the 3D world, is built on top of it. What that enables you to do is to travel with that digital identity. For me, that's really cool because if you think about your digital identity, that travels with you. It travels with you to any application. It's your wallet, it's your healthcare data, it's your education records, it's your finance. It is basically you.Carolyn: It sounds scary. If somebody hacked that, then they have access to me.Sandy: Think about how many people hack you today. It already happened today. So let's think about the hack as one thing. Today, people are selling your information to companies so that they can market to you. People sell, oh, Carolyn just bought a house. I'm going to sell that data to someone so that they can market to her differently because she just bought a house. Carolyn just graduated from college. Because I know that, I'm going to market to you differently.Protect People’s PrivacySandy: Today, that information is not even considered a hack. That's considered their right to share that information, it's not considered your right to that information. It’s their right to that information. It is the whole reason why Europe set up GDPR; to protect people's privacy. If you think about it, in the future, digital identity is going to be much more important than it is today. It will be used in all sorts of apps that we can't even imagine today.I believe that it's extremely important that ownership and those rights sit in the hands of you, not in the hands of a government or a corporation. That would be more scary, if another person had all of my information. Now, in order to achieve this vision I think there's got to be a lot of things that happen. We've got to have a way to protect it. You pointed it out right away, you need to have that be secure.We've got to make it easier. There's a lot of things right now that we need to work on in the Web3 world. One of those is ease of use and UI. Though I consider myself pretty techy, it's hard for me. I could not imagine my parents trying it right now. It's too hard. I do believe if you are a designer sitting out there or you do UX, it's going to become more and more important due to the rate of adoption that we get that ease of use correctly and we do it very fast.What Web3 Means for the GovernmentSandy: Today, it's too hard. I think that if digital identity is going to be what it is, we have to make it easier for everybody to participate in it.Carolyn: What does Web3 and everything we've been talking about mean for the government?Sandy: It's really interesting because governments are reacting in different ways to this. If you think about it, some governments like El Salvador, they've gone all in. They now use bitcoin and crypto....

Web3: The Start of the Power with Sandy Carter

American culture and history is meant to be shared, according to senior application developer at the National Museum of African American History and Culture, and Army veteran Rayvn Manuel. She talks with Carolyn and Mark about some of her goals in her work at the Smithsonian and the importance of sharing our stories and understanding our history. Episode Table of Contents[00:36] On the Record With an Army Veteran[09:18] A Change of Name on the Record[16:35] Growing up in a Lot of RacismEpisode Links and ResourcesRayvn ManuelNMAAHCRenaissance FairOn the Record With an Army VeteranCarolyn: We had the pleasure of speaking with Rayvn Manuel in November of last year. She’s a senior application developer at the National Museum of African American History and Culture and an army veteran.Following our regular recorded episode, Rayvn spoke to us about her opinion on some topics surrounding our history and culture in America. I went to the museum. When I got there, I felt a little bit like an intruder. It’s like I had no right to be there. Can you talk about that? Have you talked to other people who have felt that?Rayvn: Yes, I have. One of my really good friends, Chelsea, we were talking. I make costumes, and I make costumes for Renaissance Fair.Carolyn: I want to see pictures.Rayvn: I don't even let my kids see pictures of me in my costumes, but I love it. I was making her costume and she was just telling me how uncomfortable she feels. She's not African American, she's Caucasian American. She was telling me how she is confused about what to do because she has so much empathy for what's going on with Black Lives Matter.There are certain people in the African American community that will embrace people who are trying to understand. Then there are also other people who actually will make you feel like you feel, Carolyn. It’s like, you'll never understand so don't even try to understand. She's like, "Well, what do I do? So I don't want to come like I'm condescending and I don't want to feel like whatever."  I think that what you do, part of that is guilt.A Big HeartRayvn: That you feel some sort of guilt for something that you had nothing or have anything to do with. You have a big heart and so much empathy that you just want to understand. Not only understand, because I don't think I could ever understand anyone that went through the Holocaust. I didn't feel like I didn't belong in that museum because it was an experience that I wanted to see. And I was in the army and I was stationed, actually, in Germany.I went to Dachau, and that is a place to get a better understanding of the culture, of the society. That culture and that society makes up our culture and our society, and we engage. I engage. In New York, I engaged with people who had grandparents that had to deal with things from the fallout from the Holocaust. I learned that my grandmother, this hurt me to my soul, this is why I became what's called woke.My grandmother told me that they were in North Carolina, her and my mom. My mom was little, and my uncle, they were not allowed to sit in the front of the bus. Up until that point I understood that that's what happened. I understood that from an educational perspective. When my grandmother told me about her and my mother, things changed.Mark: It became personal. Rayvn: Yes, I did. I couldn't because that's the generation before me. You can't feel that you don't belong. Because wherever your background is and where most of us are all mutts most of it, we're totally mixed.Carolyn: I'm a complete mutt.Your Background Is Your History on the RecordRayvn: I am, too. My father's side is Portuguese.Carolyn: Well, I feel like your eyes are green, aren't they?Rayvn: They're blue-ish, but they change colors depending on what I'm wearing. Whatever your background is, that's going to be your history. Ford is actually British, isn't it? That's what it'd be, probably.Carolyn: Well, it traces all the way back to Ireland.Rayvn: There's a story there. If there was a museum, probably somewhere in England or Ireland, that would be your people. That would be something you could embrace, but would you want people to know what your people went through? That's what the museum is about. It's letting people know what our people went through.Carolyn: I didn't feel like anybody was putting that on me. It was my story, and it was really hard. I went with my friend who's also a Caucasian. Surprisingly, we were one of the few Caucasian people in the museum at the time. I felt like it was so hard to get tickets. I was like, I'm stealing a seat that maybe somebody else should get first. There was all of that story going on.Rayvn: I definitely see that, but it is what it is. It is where we are. It's where we came from. If those things didn't happen, then other things wouldn't have happened. If you would've asked me, who was my favorite person, a human being, would have been Dr. King and my grandfather. Dr. King wasn't about African Americans only, he was about everybody. He wanted everybody to experience this type of freedom.How Things Are GoingRayvn: I'm not quite sure what's going to happen. That's actually my thing. It's like, what's happening, how are things going? I don't know and I don't want to be pessimistic and say that it's going to continue down this bad path.Mark: I think we live in the microcosm of what's happening every minute, and social media amplifies it. I feel that way, too. So I try to say, look, because I want to be positive. I got to step back and say, try to think of things in a bigger picture. In the political environment today, this is so caustic. I get so branched with it. It's like, you know what? If you could only step back and say, "In a couple of years."Carolyn: Read The Broken Earth series.Rayvn: Is it dystopian?Carolyn: A little bit.Mark: She does this every time. She waits until we're done and then she goes, "Okay, we're done." Then she asks these really good questions, and we get this really good stuff going on.Carolyn: We can use it if, Rayvn, you're okay to use it.Rayvn: Oh, yes.Carolyn: It was a hard question for me to ask.Mark: I think it's great stuff.Rayvn: I think it's a great question.  There are people, lots of people, who feel like you do. Mark, where are you from? You have a great accent.Mark: I'm from North Carolina. Senell, as you were talking about, you asked Ford, and I wanted to tell my story, but I didn't want to interrupt. It's a made-up name. My grandfather came over from Italy and his name was Simeoni.A Change of Name on the RecordMark: He came over, stowed away on a ship to America when he was 13 years old. The ship went to New York. He wanted to see America so he got off the ship in New York City. Then he went and checked things out. When he came back, the ship was gone. He never went home. They got an interpreter. They figured out he had a brother that had come over to America years before and put him on a train so they shipped him off. He never went home, and he changed his name, his religion, everything.Carolyn: Why did he change his name?Mark: Back then, at the turn of the century, Italian wasn't as cool and chic as it is today.Rayvn: As of now, being Italian is cool.Mark: You were prejudiced against. He didn't want to be Italian, he wanted to be American, so he didn't allow Italian to be spoken in the home. Whenever they would get together with their Italian relatives, they'd all speak Italian. My dad didn’t because my grandfather said, you are American. Speak English. That's my story.Carolyn: See, we're keeping that in. People's stories are incredible.Rayvn: They're people's stories. I know. You would speak Italian with a North Carolina accent. I wonder what that sounded like?Mark: I really don't speak Italian, I never learned it. I learned how to speak Southern, though.Rayvn: Yes, you do Southern really well. It's like smooth Southern, it's just in there and you don't even know you're doing it.Mark: Well, I've been up here for a long time.Culture ShockRayvn: From a New York perspective, when I went to the military, it was the first time I even dealt with the south. I was in South Carolina, to whatever that horrible base is. It was in Columbia. Fort Jackson, South Carolina.Mark: It's a culture shock, I bet.Rayvn: It was. First of all, I was in an all-girl Catholic school for high school. I didn't grow up around African Americans. Carolyn, your story's actually my story. I feel uncomfortable around African Americans, except for the people I work with. A lot of African Americans think that I am not being true to my race because my mom's big thing was education. We went to school. I didn't learn slang because I wasn't allowed to go outside. If you talk to me slang, I have no idea what you're saying.I read a lot and I'm just like that. So I feel uncomfortable around African Americans because I feel like they judge me. When I went to South Carolina, wowzers. First, I was scared to death because I knew that I was below the Mason-Dixon. I was like, this is below the Mason-Dixon, I think I know that this is it. In the military, it was in the '90s, they were actually racist. Everybody was racist. African Americans did not hang out with Caucasian Americans. I had no group because it was so segregated.Mark: I hear you there. I grew up in North Carolina. After college, I moved to Richmond. Richmond feels more Southern to me than where I grew up, in North Carolina. It was bizarre.A Lot of Racial History on the RecordRayvn: I've been to Richmond. Richmond gives me a weird feeling. I don't know what it is about that place but it has a weird feeling to it.Mark: That's an interesting perspective. It's definitely got a lot of history. It has a lot of racial history because Richmond was the capital of the Confederacy but it's also got a very cool vibe that you may not get on the surface. Virginia Commonwealth University is an art university. It’s a big art school. There's a lot of cool vibe that interlaces through there that you don't catch on the surface. When you drive through, you're not seeing any of that but when you live there, you can get into that vibe. There’s a lot of really cool restaurants, ethnic restaurants, and you're like, "Oh, I didn't see that coming."Rayvn: I didn't know that. I have to spend a weekend there then.Mark: If it creeps you out, don't go.Rayvn: I don't know. Hampton, Virginia, creeps me out. My friend lives there. I'm like, "Oh, this place is scary." It's actually really scary sometimes because when you know that there's that racial tension, you just don't know. I told my sister and my daughter that I was practicing what I would do if a cop stopped me because I went for a walk around my friend's neighborhood, and they're very rich. It was one of those neighborhoods.The next neighborhood was not so rich and the socioeconomic status was a little bit lower. If I get stopped by a cop or some cop comes to me, what am I going to do? I was going to scream my head off and say, "Don't hurt me." Raise my hand, whatever.The Civil Rights Movement on the RecordRayvn: I was so scared. I was like, "Why are you so scared?" That's where we are. It's just, I don't know. I like your positive attitude about it, Mark.Mark: Well, it's self-preservation otherwise, I get too stressed out. I try to say, "Look at the world, look at things." And I can imagine what people felt like in the moment during the civil rights movement, about how they felt about different things. You need to look at it now. You're like, "Look at the big picture." All this positive change that took place and all these good things that you're like, "Yes." But living in the moment, it wouldn't have been like that at all. It would have been a very intense situation. I try to think things will get better over time.Rayvn: They are getting better over time. It's just incremental.Carolyn: We're spiraling. I have one more question for you before we let you go, were you in the army?Rayvn: Yes.Carolyn: Do you mind if we use that in your title?Rayvn: Absolutely not. Very proud of it.Mark: Carolyn's dad was in the army.Carolyn: Yes. When you were talking about how racist it was, my dad's my hero. I love him but he was horribly racist. The phrases that I grew up saying, I didn't know what they meant. They were part of my vocabulary because my dad used them all. It’s really funny because he also had really close friends of different ethnic backgrounds, different colors, and he was still intensely racist. I didn't know that, as a kid. Looking back, I'm like, "Oh, wow."Growing Up in a Lot of RacismMark: Looking back, I can see a lot of that growing up in North Carolina. I see a lot of that with how I was raised and just the area that I grew up in.Carolyn: We didn't know.Rayvn: You know what? My grandmother, while I was growing up in the Bronx, was there. I'd be like, "Oh Nana, I met blah, blah, blah." Her first question was always what color they were. I was like, why does that matter? Now I know why because she grew up in the era of Emmett Till. She was in that era. It took me awhile to understand why.Mark: Living in the moment, it's got to be a different experience. I was listening to Bill Maher talk about this recently on his show, we're making progress. We're making progress. I think people are, I'm not going to say enlightened.Carolyn: But we are.Mark: Do we want to call ourselves enlightened with progress?Carolyn: Look at this conversation that we're having now. This is progress.Rayvn: This is progress because we can have this conversation and be okay with it. It's great to be comfortable with it.Mark: It is what we are. It‘s part of the world we live in, so let's embrace it.We Can’t Change What’s on the RecordRayvn: It is. To bring it all round, the whole purpose of our museum is to make those uncomfortable conversations happen. To be able to, here it is, this is not pretty, we can't change it. Let's just talk about it and figure out how we move forward because what we've been doing isn't working, apparently.Carolyn: I love that. We're using that on the record too.Rayvn: Just use everything. You're awesome.Mark: Well, this was great. Thanks, Rayvn.Carolyn: We cannot thank you enough for your service to our country, and dedication to representing our history. We hope you enjoyed this episode of Tech Transforms. Please like, and follow us on social media. We'll be back next week. 

<p>American culture and history is meant to be shared, according to senior application developer at the National Museum of African American History and Culture, and Army veteran Rayvn Manuel. She talks with Carolyn and Mark about some of her goals in her work at the Smithsonian and the importance of sharing our stories and understanding our history. </p><h2>Episode Table of Contents</h2><ul><li>[00:36] On the Record With an Army Veteran</li><li>[09:18] A Change of Name on the Record</li><li>[16:35] Growing up in a Lot of Racism</li></ul><h2>Episode Links and Resources</h2><ul><li><a href="https://www.linkedin.com/in/rayvnkm/" rel="noopener noreferrer nofollow" target="_blank">Rayvn Manuel</a></li><li><a href="https://nmaahc.si.edu/" rel="noopener noreferrer nofollow" target="_blank">NMAAHC</a></li><li><a href="https://en.wikipedia.org/wiki/Renaissance_fair" rel="noopener noreferrer nofollow" target="_blank">Renaissance Fair</a></li></ul><h2>On the Record With an Army Veteran</h2><p>Carolyn: We had the pleasure of speaking with <a href="https://www.linkedin.com/in/rayvnkm/" rel="noopener noreferrer nofollow" target="_blank">Rayvn Manuel</a> in November of last year. She’s a senior application developer at the National Museum of African American History and Culture and an army veteran.</p><p>Following our regular recorded episode, Rayvn spoke to us about her opinion on some topics surrounding our history and culture in America. I went to the museum. When I got there, I felt a little bit like an intruder. It’s like I had no right to be there. Can you talk about that? Have you talked to other people who have felt that?</p><p>Rayvn: Yes, I have. One of my really good friends, Chelsea, we were talking. I make costumes, and I make costumes for Renaissance Fair.</p><p>Carolyn: I want to see pictures.</p><p>Rayvn: I don't even let my kids see pictures of me in my costumes, but I love it. I was making her costume and she was just telling me how uncomfortable she feels. She's not African American, she's Caucasian American. She was telling me how she is confused about what to do because she has so much empathy for what's going on with Black Lives Matter.</p><blockquote>There are certain people in the African American community that will embrace people who are trying to understand. Then there are also other people who actually will make you feel like you feel, Carolyn. It’s like, you'll never understand so don't even try to understand. </blockquote><p>She's like, "Well, what do I do? So I don't want to come like I'm condescending and I don't want to feel like whatever."  I think that what you do, part of that is guilt.</p><h3>A Big Heart</h3><p>Rayvn: That you feel some sort of guilt for something that you had nothing or have anything to do with. You have a big heart and so much empathy that you just want to understand. Not only understand, because I don't think I could ever understand anyone that went through the Holocaust. I didn't feel like I didn't belong in that museum because it was an experience that I wanted to see. And I was in the army and I was stationed, actually, in Germany.</p><p>I went to Dachau, and that is a place to get a better understanding of the culture, of the society. That culture and that society makes up our culture and our society, and we engage. I engage. In New York, I engaged with people who had grandparents that had to deal with things from the fallout from the Holocaust. I learned that my grandmother, this hurt me to my soul, this is why I became what's called woke.</p><p>My grandmother told me that they were in North Carolina, her and my mom. My mom was little, and my uncle, they were not allowed to sit in the front of the bus. Up until that point I understood that that's what happened. I understood that from an educational perspective. When my grandmother told me about her and my mother, things changed.</p><p>Mark: It became personal. </p><p>Rayvn: Yes, I did. I couldn't because that's the generation before me. You can't feel that you don't belong. Because wherever your background is and where most of us are all mutts most of it, we're totally mixed.</p><p>Carolyn: I'm a complete mutt.</p><h3>Your Background Is Your History on the Record</h3><p>Rayvn: I am, too. My father's side is Portuguese.</p><p>Carolyn: Well, I feel like your eyes are green, aren't they?</p><p>Rayvn: They're blue-ish, but they change colors depending on what I'm wearing. Whatever your background is, that's going to be your history. Ford is actually British, isn't it? That's what it'd be, probably.</p><p>Carolyn: Well, it traces all the way back to Ireland.</p><blockquote>Rayvn: There's a story there. If there was a museum, probably somewhere in England or Ireland, that would be your people. That would be something you could embrace, but would you want people to know what your people went through? That's what the museum is about. It's letting people know what our people went through.</blockquote><p>Carolyn: I didn't feel like anybody was putting that on me. It was my story, and it was really hard. I went with my friend who's also a Caucasian. Surprisingly, we were one of the few Caucasian people in the museum at the time. I felt like it was so hard to get tickets. I was like, I'm stealing a seat that maybe somebody else should get first. There was all of that story going on.</p><p>Rayvn: I definitely see that, but it is what it is. It is where we are. It's where we came from. If those things didn't happen, then other things wouldn't have happened. If you would've asked me, who was my favorite person, a human being, would have been Dr. King and my grandfather. Dr. King wasn't about African Americans only, he was about everybody. He wanted everybody to experience this type of freedom.</p><h3>How Things Are Going</h3><p>Rayvn: I'm not quite sure what's going to happen. That's actually my thing. It's like, what's happening, how are things going? I don't know and I don't want to be pessimistic and say that it's going to continue down this bad path.</p><p>Mark: I think we live in the microcosm of what's happening every minute, and social media amplifies it. I feel that way, too. So I try to say, look, because I want to be positive. I got to step back and say, try to think of things in a bigger picture. In the political environment today, this is so caustic. I get so branched with it. It's like, you know what? If you could only step back and say, "In a couple of years."</p><p>Carolyn: Read The Broken Earth series.</p><p>Rayvn: Is it dystopian?</p><p>Carolyn: A little bit.</p><p>Mark: She does this every time. She waits until we're done and then she goes, "Okay, we're done." Then she asks these really good questions, and we get this really good stuff going on.</p><p>Carolyn: We can use it if, Rayvn, you're okay to use it.</p><p>Rayvn: Oh, yes.</p><p>Carolyn: It was a hard question for me to ask.</p><p>Mark: I think it's great stuff.</p><p>Rayvn: I think it's a great question.  There are people, lots of people, who feel like you do. Mark, where are you from? You have a great accent.</p><p>Mark: I'm from North Carolina. Senell, as you were talking about, you asked Ford, and I wanted to tell my story, but I didn't want to interrupt. It's a made-up name. My grandfather came over from Italy and his name was Simeoni.</p><h2>A Change of Name on the Record</h2><p>Mark: He came over, stowed away on a ship to America when he was 13 years old. The ship went to New York. He wanted to see America so he got off the ship in New York City. Then he went and checked things out. When he came back, the ship was gone. He never went home. They got an interpreter. They figured out he had a brother that had come over to America years before and put him on a train so they shipped him off. He never went home, and he changed his name, his religion, everything.</p><p>Carolyn: Why did he change his name?</p><p>Mark: Back then, at the turn of the century, Italian wasn't as cool and chic as it is today.</p><p>Rayvn: As of now, being Italian is cool.</p><p>Mark: You were prejudiced against. He didn't want to be Italian, he wanted to be American, so he didn't allow Italian to be spoken in the home. Whenever they would get together with their Italian relatives, they'd all speak Italian. My dad didn’t because my grandfather said, you are American. Speak English. That's my story.</p><p>Carolyn: See, we're keeping that in. People's stories are incredible.</p><p>Rayvn: They're people's stories. I know. You would speak Italian with a North Carolina accent. I wonder what that sounded like?</p><p>Mark: I really don't speak Italian, I never learned it. I learned how to speak Southern, though.</p><p>Rayvn: Yes, you do Southern really well. It's like smooth Southern, it's just in there and you don't even know you're doing it.</p><p>Mark: Well, I've been up here for a long time.</p><h3>Culture Shock</h3><p>Rayvn: From a New York perspective, when I went to the military, it was the first time I even dealt with the south. I was in South Carolina, to whatever that horrible base is. It was in Columbia. Fort Jackson, South Carolina.</p><p>Mark: It's a culture shock, I bet.</p><p>Rayvn: It was. First of all, I was in an all-girl Catholic school for high school. I didn't grow up around African Americans. Carolyn, your story's actually my story. I feel uncomfortable around African Americans, except for the people I work with. A lot of African Americans think that I am not being true to my race because my mom's big thing was education. We went to school. I didn't learn slang because I wasn't allowed to go outside. If you talk to me slang, I have no idea what you're saying.</p><blockquote>I read a lot and I'm just like that. So I feel uncomfortable around African Americans because I feel like they judge me. When I went to South Carolina, wowzers. First, I was scared to death because I knew that I was below the Mason-Dixon. I was like, this is below the Mason-Dixon, I think I know that this is it. In the military, it was in the '90s, they were actually racist. Everybody was racist. African Americans did not hang out with Caucasian Americans. I had no group because it was so segregated.</blockquote><p>Mark: I hear you there. I grew up in North Carolina. After college, I moved to Richmond. Richmond feels more Southern to me than where I grew up, in North Carolina. It was bizarre.</p><h3>A Lot of Racial History on the Record</h3><p>Rayvn: I've been to Richmond. Richmond gives me a weird feeling. I don't know what it is about that place but it has a weird feeling to it.</p><p>Mark: That's an interesting perspective. It's definitely got a lot of history. It has a lot of racial history because Richmond was the capital of the Confederacy but it's also got a very cool vibe that you may not get on the surface. Virginia Commonwealth University is an art university. It’s a big art school. There's a lot of cool vibe that interlaces through there that you don't catch on the surface. When you drive through, you're not seeing any of that but when you live there, you can get into that vibe. There’s a lot of really cool restaurants, ethnic restaurants, and you're like, "Oh, I didn't see that coming."</p><p>Rayvn: I didn't know that. I have to spend a weekend there then.</p><p>Mark: If it creeps you out, don't go.</p><p>Rayvn: I don't know. Hampton, Virginia, creeps me out. My friend lives there. I'm like, "Oh, this place is scary." It's actually really scary sometimes because when you know that there's that racial tension, you just don't know. I told my sister and my daughter that I was practicing what I would do if a cop stopped me because I went for a walk around my friend's neighborhood, and they're very rich. It was one of those neighborhoods.</p><p>The next neighborhood was not so rich and the socioeconomic status was a little bit lower. If I get stopped by a cop or some cop comes to me, what am I going to do? I was going to scream my head off and say, "Don't hurt me." Raise my hand, whatever.</p><h3>The Civil Rights Movement on the Record</h3><p>Rayvn: I was so scared. I was like, "Why are you so scared?" That's where we are. It's just, I don't know. I like your positive attitude about it, Mark.</p><p>Mark: Well, it's self-preservation otherwise, I get too stressed out. I try to say, "Look at the world, look at things." And I can imagine what people felt like in the moment during the civil rights movement, about how they felt about different things. You need to look at it now. You're like, "Look at the big picture." All this positive change that took place and all these good things that you're like, "Yes." But living in the moment, it wouldn't have been like that at all. It would have been a very intense situation. I try to think things will get better over time.</p><p>Rayvn: They are getting better over time. It's just incremental.</p><p>Carolyn: We're spiraling. I have one more question for you before we let you go, were you in the army?</p><p>Rayvn: Yes.</p><p>Carolyn: Do you mind if we use that in your title?</p><p>Rayvn: Absolutely not. Very proud of it.</p><p>Mark: Carolyn's dad was in the army.</p><p>Carolyn: Yes. When you were talking about how racist it was, my dad's my hero. I love him but he was horribly racist. The phrases that I grew up saying, I didn't know what they meant. They were part of my vocabulary because my dad used them all. It’s really funny because he also had really close friends of different ethnic backgrounds, different colors, and he was still intensely racist. I didn't know that, as a kid. Looking back, I'm like, "Oh, wow."</p><h2>Growing Up in a Lot of Racism</h2><p>Mark: Looking back, I can see a lot of that growing up in North Carolina. I see a lot of that with how I was raised and just the area that I grew up in.</p><p>Carolyn: We didn't know.</p><p>Rayvn: You know what? My grandmother, while I was growing up in the Bronx, was there. I'd be like, "Oh Nana, I met blah, blah, blah." Her first question was always what color they were. I was like, why does that matter? Now I know why because she grew up in the era of Emmett Till. She was in that era. It took me awhile to understand why.</p><p>Mark: Living in the moment, it's got to be a different experience. I was listening to Bill Maher talk about this recently on his show, we're making progress. We're making progress. I think people are, I'm not going to say enlightened.</p><p>Carolyn: But we are.</p><p>Mark: Do we want to call ourselves enlightened with progress?</p><p>Carolyn: Look at this conversation that we're having now. This is progress.</p><p>Rayvn: This is progress because we can have this conversation and be okay with it. It's great to be comfortable with it.</p><p>Mark: It is what we are. It‘s part of the world we live in, so let's embrace it.</p><h3>We Can’t Change What’s on the Record</h3><p>Rayvn: It is. To bring it all round, the whole purpose of our museum is to make those uncomfortable conversations happen. To be able to, here it is, this is not pretty, we can't change it. Let's just talk about it and figure out how we move forward because what we've been doing isn't working, apparently.</p><p>Carolyn: I love that. We're using that on the record too.</p><p>Rayvn: Just use everything. You're awesome.</p><p>Mark: Well, this was great. Thanks, Rayvn.</p><p>Carolyn: We cannot thank you enough for your service to our country, and dedication to representing our history. We hope you enjoyed this episode of Tech Transforms. Please like, and follow us on social media. We'll be back next week. </p>

On The Record with Rayvn Manuel

Willie Hicks, CTO of Public Sector at Dynatrace, joins Carolyn and Mark to discuss the top Cybersecurity news stories so far in 2022. Willie offers his expert opinion on the White House Executive Order on Improving the Digital Government Experience, the recent Log4j vulnerability, and the Pentagon's new Zero Trust office. Episode Table of Contents[00:43] Unpacking the Biggest Headlines in Cybersecurity News[08:21] Major Catastrophe[16:03] Cybersecurity News Highlights the Highest Level of Vulnerability[23:59] A Quantum Shift in Cybersecurity NewsEpisode Links and ResourcesWillie HicksExecutive OrderWillie Hicks Article on Zero TrustLog4jUnpacking the Biggest Headlines in Cybersecurity NewsCarolyn: Today we talked to Willie Hicks, Dynatrace public sector CTO. He’ll unpack some of the biggest headlines of late from the Executive Order on Transforming Federal Customer Experience and Service Delivery to Log4j. I know Willie, you're so sick of this topic, but we're going to cover it anyway, and then Zero Trust Thunderdome Awards. I want to go first to the Executive Order requiring improving the digital government experience. Willie, will you give us the big takeaways from this Executive Order? What does it mean for our agencies?Willie: First of all, I think that the Executive Order on Transforming is transforming the federal customer experience. It is going to impact the agencies, but I also think it's going to impact the digital citizens of the day, the real customers of the federal government. I think President Biden reiterated this, it’s supposed to be a government for the people, by the people.We're trying to put people back into the equation. I think the big takeaway for me is that the federal government is coming back into or getting to a point where they're really understanding that customer experience, well, they already understood it. But they’re really starting to internalize and figure out how to make customer experience like the customer experience most citizens expect to see with anybody who shops on Amazon, anyone who does a Google search.A Fundamental Shift in Customer ExperienceWillie: They expect, with the push of a button, that they got all the groceries shipped to them the next day or the same day. That kind of experience you do not get with the federal government today. I think that we're seeing a fundamental shift now, not just that kind of digital experience, but I think across the board. Like when you even walk into a brick or a mortar building, when you interface on the phone with a government employee, I think we're going to start, hopefully, seeing more customer-focused, customer-centric type attitudes.This is really long overdue. I've been in this business for many years. I remember one of my early visits to a federal agency that will remain nameless, but I was speaking to this agency about what we call our digital user experience. How we need to focus on the real metric who's the end user. Right now, you are focused on the back end. You're focused on, is the server up or down? Is this process running? Do I have availability for this device? No one's actually really looking at the end user. So how do you know they are getting a good experience? Not only are the systems running, but are they running efficiently? Are they getting transactions back in a timely manner, or are they frustrated?I remember one engineer saying, "Well, why does that matter?" I'm like, "It does matter because they're your number one responsibility. That is who pays your salary." This person, an engineer, actually said to me, "Well, there's not another X agency. It's not like they're going to go somewhere else. This isn't Amazon or another commercial entity. If it doesn't work, they'll come back later." That was the response. And I was like, wow!Smooth Government TransactionsCarolyn: It makes me think of when my dad died a few years ago. We wanted to give him a full military burial, but we couldn't find the papers that we needed. He had shown me where everything was except these particular papers that we had to have to get him this burial. We spent hours and hours online trying to track them down. But, we never did, we never were able to find them. Ultimately, it came down to us, calling Camp Williams and saying, "Colonel Ford is gone and we need some help."They stepped up and did it, and it was awesome. Fast forward to today, I'm in Utah and we've got billboards all over saying something about finding my cash.gov. I was like, all right, I'll bite, I want to see how easy this is. You guys, it was so slick. In 10 minutes I put in my name, I think I put in my address. There was a quick database search and it said, "Oh yes, you've got money here from these closed old accounts. We'll send you a check." A week later I got a check. I'm still blown away that I did a government transaction and it happened that smoothly.Willie: Unfortunately, that's been the exception not the rule except for certain agencies that I work with. I work closely with organizations like the VA. To your point, the VA has been making a lot of great strides to improve their customer service, their image and so forth. A lot of that is around, I think, customer experience. Or I should say the veteran experience and making sure that they're putting veterans first.The Cybersecurity News Features How Backend Systems WorkWillie: They're putting a lot of investment there to understand not just how their backend systems are working, but how the actual end-users are performing, how quickly that transaction took.Carolyn: But to your engineer's point, why now? He's right. We have to have these services. We're just going to come back later or we're going to give up.Willie: Well, I would say right now, why now? It’s because to be quite frank, that's the wrong attitude. At the end of the day, that person was right. It's not like I can fire this agency and say I'm going to take my business elsewhere. But there are ways we can speak at the voting booth, calling our senators and our representatives. Getting those types of attitudes changed by having them hold in front of Congress and ask, "Why are you treating my constituents that way? We pay your salaries, so we expect the same kind of response that they would get from any other service." I think that's what we're seeing with the administration today. They focus on the need to bring the people back into the equation, and that the citizenry understands that they are our most important priority. We treat you that way in everything you do. If at the state level, it’s going to the DMV, which I think everyone dreads, hopefully this will translate down to the states.But going to the Social Security Office to get a new Social Security Card or going to, in worst-case scenarios, I think this is even going to translate into disasters. How quickly do I get disaster relief? How quickly do I get relief because I just lost everything from a flood?Major CatastropheWillie: When there’s a major catastrophe, how do I get to the right organization to help me just making sure I have the right avenues? I've seen reports lately where agencies, due to COVID, were slow to respond. They were slow to get PPE out and things like that. Those things, they are customer service. But there are consequences also to bad customer service. People don't get the services they need and they get sicker because they don't have that. They don't do that.Mark: This is a confidence in government issues, Willie.Willie: 100%.Mark: I hope that this Executive Order has the staying power that generates money to put behind it. I mean, really it's a nonpartisan political issue that impacts all citizens. However, I think it's being leveraged a little bit politically. I do feel whatever administration is going to implement services and things like that, that they're putting out there for citizens to take advantage of, you have to have confidence. The citizen has to have confidence that the government can actually deliver. If you can't even access the application and the information online then you lose confidence that the government knows what they're doing.Carolyn: Before we leave this topic, are there any teeth to this Executive Order? Are there deadlines? I mean what is it other than saying, "Yes, we need to do better."Willie: Yes. That is always the issue that we have,  how's this going to be implemented? How is this going to be upheld? Because unfortunately, it is an EO, it's an Executive Order. It is not codified in law. It's not like there was a bill passed on customer service.Hard Deadlines on Cybersecurity News and UpdatesWillie: Although there are ancillary bills that do cover some of these topics, I think of nothing that's more all encompassing as what we're seeing in the EO. So, does it have teeth? We'll see. Right now, I don't know of any hard deadlines that are imposed. I think they're really putting a framework in place to do all of these things. I'm sure the administration wants to be able to report by the end of the term to make sure that they are seeing progress. My hope in all of this is that, in this period of time, even without the teeth, agencies will be forced to think about these things. They will be forced to internalize some of these things. Moving forward, regardless of administration, these ideals are self propagated throughout the agencies. These continue on regardless of the law and regardless of what's in place. At the end of the day, there are certain things that should be done just because they're the right thing and not because it's a law. It’s not because someone has to tell you to do it.Carolyn: We've started the conversation, which is a really good thing. So, all right, let's go to Log4j. Just school me, what is it?Willie: I won't bore everyone with the details, but I think because everyone's really probably heard a lot about this. You've heard of Log4j, Log4Shell. In a nutshell, it's an extremely critical, extremely severe vulnerability in a component. It’s a module of what's called Apache,  a kind of server technology that is utilized.Carolyn: That everybody has.Full Court PressWillie: That a lot of people have. Probably, I've seen millions, maybe billions of instances of this module that is distributed across multiple platforms. It could be in embedded devices, it might be in servers. Honestly, the scope and scale of it is unprecedented. That's why there was this full-court press.Carolyn: Unprecedented beyond SolarWinds?Willie:  I think, I won't mix the two per se because with SolarWinds, we've got documented attacks. We know that our adversaries have taken advantage of this. They were lying in wait in some of these systems for months. They’re slowly making moves, lateral movements and so forth when they get into the system. With Log4j, I think it's still early to find out the true impact of it.At the end of the day, I think from a scale standpoint, yes, because SolarWinds is a commercial product that agencies trusted. They brought it in-house and they left it behind the gates. Unfortunately, supply chain issues were there, which allowed for some malicious code to be in that product that was almost like a Trojan Horse. It was brought behind the gates, and then they were able to take advantage of that.Log4j on the other hand,  was a vulnerability in the code, but that was propagated over not just a few 100 customers or 1000 customers. I don't know SolarWinds' customer base, but whatever that customer base was, versus something that was just distributed across millions of devices. So really different scales.Carolyn: Who did the Log4j?Willie: Well, it's a vulnerability. It wasn't like a supply chain issue. As far as we know, it wasn't like somebody planted this.Security VulnerabilityWillie: It’s just something that has been there for a while, just a security vulnerability that wasn't accounted for. Once it was discovered, it was figured out you could use this. You could exploit this to take over a machine. So basically to get remote code execution capability, so you could run remotely.Mark: That was open source wasn't it?Willie: Yes. So there's a whole other conversation we can have. I don't want to get into that about open source and so forth. Although open source has its merits and its benefits because a lot of eyes are on it, sometimes these things still happen. It also depends on the open source. Some open source projects are very well maintained, and very well scrutinized.People are always looking at it, tinkering with it, understanding when they find a vulnerability like Log4j they quickly bubble that up. There are some open source projects that aren't so well maintained, but people still use them. But the vulnerabilities don't come out as quickly.Carolyn: We're a month into this. Have we got it under control? Do we have our arms around it? What did agencies do to manage this?Willie: I would say, well, that's a loaded question. Do we have our arms around it? I would say we are, well, let's just talk about what happened. Because I can even speak from a company, from my perspective on what our company has done around this. Immediately after at least it became public, I think it was December 9th that this was released or became known, this was escalated to the highest levels.Cybersecurity News Highlights the Highest Level of VulnerabilityWillie: CISA made this a highest-level vulnerability. They instructed agencies to start immediate searches of their systems. I personally know of agencies we worked with where they might have had a team of 100 people plus over weekends. They were going through servers, looking for unfortunately, sometimes looking manually for this vulnerable code to remediate it. We quickly got our hands around it from that standpoint.Is there still Log4j out there that we haven't caught? Of course. I know we haven't gotten to eradicate every bit of vulnerable code. But, there was a very concerted effort, especially at the federal government level. I know at the commercial level, the corporate level, and the private sector, there was an equally frantic push to get this taken care of because it is a major vulnerability. You don't want someone with the ability to remotely execute code on your servers. They could do anything they want at that point then once they get into the system.I would say that, time will tell how well we got our hands wrapped around it. From our standpoint, we were able to quickly analyze our code to quickly find out where our vulnerabilities were. We’re able to quickly notify our customers, our government partners, and agencies of what our vulnerabilities were, and how we were remediating them quickly. We had patches out, I think on that day, to make sure our systems were patched. I think our SaaS environment was doing that. We quickly accelerated our testing cycles to make sure that we didn't break or blow up anything when we applied the patches.Mark: You're also helping our customers with their application security module. Identify those vulnerabilities, yes.Core CapabilityWillie: That was the internal, but from an external standpoint as Mark accurately pointed out, I was saying earlier that some of our customers were manually looking for this. Luckily, for our customers that have agents deployed and had observability by Dynatrace, we actually had a capability that is core to our platform called AppSec. It’s  designed just for this, to look for vulnerability.Within 10 minutes of the announcement, our databases were updated with this vulnerability signature and pushed out to all of our customers that were connected online. Then for those customers that received that, they immediately, who were using the AppSec module, they immediately started getting flags all over the place of where this module was.Those people who had AppSec and had our agents fully deployed didn't have hundreds of people. They were going to their Dynatrace consoles and were seeing all of the vulnerable systems. Then we actually had remediation steps built into the platform where they could see what they needed to do to remediate that. We were able to take that from a multitude of people down to the team that was monitoring the system.Then we distribute that information to the admin teams or to the automation teams so they could use Ansible or whatever they were using to automate the remediation of that. It’s really powerful when you have that visibility, that observability into the system. There was no better example of how important it is for any type of DevSecOps organization. We can talk about it from a zero trust standpoint. I can even talk about it from just understanding the build of your systems.The Last Big Boulder Cybersecurity NewsWillie: There's all this talk about bringing legislation around companies. Having a software bill of materials, SBOMs, built in as part of their products so you can see exactly what components are in software. It’s something we don't normally do in the industry. Having that observability so you might not have that SBOM, but we can light up and say, this is how that application is built and all the components. Really invaluable.Carolyn: Let's go to our last topic, the last Big Boulder news item, which is the Zero Trust Thunderdome contract. I'm going to be honest when I read this seven million contract developed, to develop zero trust architecture, I thought this was already happening. So what is the significance of Thunderdome?Willie: I will preface this by saying I'm not a security expert, but I can talk to it from my industry perspective. But the Thunderdome award, which I like the name by the way, is seven million dollars. It's just a prototype to prove out the schemes and the technologies that they're going to be using. They’re technologies that DESO wants to use to build out their zero trust architectures or to validate the zero trust architectures that they've been developing.To your point, there are pockets of the DoD. There are pockets of the service branches that have been already investing in zero trust. So, you look at programs like Platform One where this is already being built into the platform. It was part of what was really, I think, revolutionary about the Platform One environment and what they were trying to do at Platform One. This was already being built-in in DESO.What Happened With Log4JWillie: The DoD had already been investigating this for, I'm sure, several years. But I think what happened with Log4j, SolarWinds, all the ransomware attacks, the administration basically has put a stake in the...

Cybersecurity News Round Up with Willie Hicks

Greg Crabb

What does it take to secure 160 million Americans privacy? Greg Crabb, former Chief Information Security Officer at US Postal Service joins Tech Transforms to talk about his experiences from his time as Projects Coordinator for International Fraud to his role in the 2020 US Presidential Election. Episode Table of Contents[00:42] Greg Crabb in the House, Founder of 10-8 Cyber[10:33] Good Guys Get Together With Greg Crabb[20:05] They Want To Do the Right Thing[29:32] Greg Crabb Had a Long, Deep, and Intense ServiceEpisode Links and ResourcesGreg CrabbUSPSFBISecret ServiceEuropolInterpolAQAPCISAEbayChief of Police ConferenceHurricane ElectricLexisNexisSergey PavlovichJames WoolseyDamitri GlubophOrange RevolutionRussian FSBSolar WindsChris KrebbsMatt HeartmanAmazonCADJen LimbDelivering HappinessAdam GrantGreg Crabb in the House, Founder of 10-8 CyberCarolyn: Today, our guest is a rockstar. His background just blew me away. Greg Crabb, founder of 10-8 Cyber and strategic advisor to several organizations, but that doesn't even scratch the tip of the iceberg of who our guest is today. Greg: Thank you, Carolyn. I enjoy the opportunity to chat.Carolyn: You recently retired after 20 years with the US Postal Service where you wore many hats. From being a project coordinator for international fraud, assistant director of economic crimes, you ended your career as the chief information security officer and vice president of USPS. That's the very tip of the iceberg of your career. I want to kick it over to you and have you tell us your story.Greg: The mission of my life has been to protect others and drive benefits for society. I was grateful enough to have the opportunity to retire last year after 30 years of federal service. When I joined the postal service in the mid-90s, I spent the first several years of my career being an auditor. I was responsible for the old electronic data processing controls portion of the financial audit. There I learned an amazing amount of information about how computers work, mainframes, networking, and all that sort of thing.In 2000, I transitioned to spend seven years investigating the origins of Eastern European organized cyber crime. That was an amazing experience. I got the opportunity to really attack an organized crime group. It was based out of Ukraine and had splinters all over the world. I worked with Europol and Interpol, the Secret Service, the FBI, and many other organizations in between.Bigger and Better Things for Greg CrabbGreg: In about 2005, I moved to Washington to take on bigger and better things. Then in 2010, the international supply chain was attacked with some parcel bombs from AQAP. AQAP put PETN, it's the liquid explosive that we all know as why we can't carry water bottles onto airplanes. It completely changed the security model of how international supply chains work for moving parcels. I spent a number of years working with an international community of 190 countries to develop new standards. Worked with civil aviation authorities to properly secure the supply chain from a commercial aviation perspective for parcel security.In 2014, I got tapped to respond to a pretty significant breach at the US Postal Service. In that moment, I transitioned from being the law enforcement officer who was the hunter to the chief information security officer who was the hunted and responsible for an amazing network. I was grateful to provide security for 160 million delivery points, private communications, and parcels for all of America for six years. As we talked before the show, I was really grateful to have the opportunity to help protect the 2020 election. It was just an amazing collaboration with the folks at CISA and many other organizations across the country in order to pull that off.Carolyn: Can you talk about what you did to prepare for that? Talk about pressure. You'd been preparing for 20 years.Greg: I had been preparing. I wouldn’t have been as successful in protecting the technology assets the postal service relied on to move 70 million ballots if I had not had those experiences.Greg Crabb Is Dealing With Eastern European Organized Cyber CrimeGreg: I’ve been dealing with Eastern European organized cyber crime and understanding what it takes in order to protect a network from everything. From disinformation campaigns to all of the technical details that are necessary to secure a network. Where do you want to start? From an application security perspective for the organization, from an OT security perspective, all of the technology that was necessary in order to be able to move the ballots were in the consideration.Carolyn: It's interesting because when I think of the US Postal Service. I'm not going to lie, it's a little boring.Mark: You think of physical security, OT.Carolyn: It's a letter and you're moving a physical thing. But like all the cyber that was involved in it, is it the processes that you were securing, the databases?Greg: It was everything. From the delivery scanner, the letter carrier that is driving by your house every day, securing that scanner to know that your ballot was in the mail, to all of the operational technology that exists. Now, imagine big warehouses larger than big football stadiums, where mail processing is made. Huge pieces of equipment were down to your address. All the packages come in and we sort them down to each delivery point.In total, I was responsible for the protection of 1.2 million technology assets. Petabytes and petabytes of data relative to package tracking and those kinds of things. Only 630,000 employees are necessary in order to be able to deliver that mission and interact with all those technology points.Mark: That's just at the federal level. I can only imagine the collaboration across states and everything must have been massive.A Massive Enterprise Focused on CollaborationGreg: I did not have the responsibility of dealing with each of the states. The postal service, in order to be able to secure the election, is a massive enterprise focused on all of the collaboration, developing standards on how mail pieces are supposed to be formed. There's a lot to make sure that everything gets delivered on time. If the ballots aren't there, they don't get counted. That was something that not only my role as chief information security officer but my security partner, who was the chief postal inspector, was out all over the country in facilities. Basically, just making sure that each of the communities were getting their ballots in a timely manner from all of our delivery operations.Mark: I know you've done a lot of work with cyber crime and you've worked with adversaries, I guess, as well. I’m curious to know how you've seen this whole landscape transform over the years.Greg: I started working in organized cyber crime investigations in 2000. I was asked to help the FBI with a case coming out, or some significant amount of fraud against eBay, coming out of Ukraine. It took me several years to wrap my arms around it. I was ultimately able to arrest a number of folks from Ukraine and other Eastern European countries that were involved in this. But really, I had the opportunity to sit down and talk with a lot of investigators from Eastern European countries.We had a conference in Warsaw a number of years ago. These were early days. They talked about how they started to see car smuggling gangs that were based in Eastern Europe starting to have technology equipment in the vehicles where they were getting arrested.Good Guys Get Together With Greg CrabbGreg: Eastern European car smuggling gangs would basically get caught in Poland with stolen cars. They popped the trunks and there would be a bunch of technology equipment, credit card skimmers, and other technology that's necessary in order to be able to commit those types of crimes.There was a conference. Good guys get together and do the International Association of Chiefs of Police Conference and those types of things. But in 2001, there was a conference in Odessa where a bunch of criminals got together. They referred to it as, "The First International Carders' Conference."  The members of that meeting became my targets.Carolyn: How did you find out about it?Greg: I had the good fortune of one of the criminals that I was investigating had hacked into a server in San Jose, California. At the time, I was based in Northern California. The data center was on my drive into the office. He was sending all of his communications through that server. I intercepted 40,000 of his email messages.Carolyn: How did you find that?Greg: Long story. It was just tracing IP addresses and getting back to the source of where all of his communications were coming from. They all sourced to this particular server. The company was called Hurricane Electric in Fremont, California. I worked with the US Attorney's Office and the victim to get approval to go in and review my suspect's messages on a daily basis. So I had this unbelievable wiretap on this criminal and all of his email messages. Not only facilitating his crime but with all of his cohorts in crime who were doing these activities.Greg Crabb With Eastern Law EnforcementGreg: One thing led to another and I learned about this International Carders' Conference based in Odessa and basically focused on this group. That led me to the opportunity to really work with Eastern European law enforcement officers. I had occasion to work with the Russian FSB and the Ukrainian MVD, and even law enforcement officers in Belarus. I proudly display the hat there from my colleague in Minsk, Belarus. Unfortunately, he was actually arrested for working with me. We went to the country in '05. The suspect had a website. The banner on the website said that their objective was to take the United States back to the time of 1929.Fortunately, the Belarusian law enforcement officers were willing to work with us until the government got involved after we left. From the computer equipment in that case in Minsk, we recovered over 55,000 full infos. These are victims in the United States where they've got their mother's maiden name, their social security number, all of the answers to the questions that are necessary for those knowledge-based questions. He had hacked into LexisNexis, and his hack was actually the subject of a congressional debate. The subject's name was Sergey Pavlovich.It was interesting to be able to work with all of those folks and deal with not only, on a personal relationship, the police officers but then the governments from a not-so-friendly perspective. I was never invited back to Belarus again, I was stupid enough to try to go back to Belarus. But I think the US embassy was smart enough not to let me in. Those experiences were foundational for me to understand what's necessary in order to be able to counter what we see from a law enforcement perspective.What James Woolsey Taught Greg CrabbGreg: Like James Woolsey taught me, there's little difference between a Russian businessman, a Russian politician, and a Russian organized crime figure. They're one and the same, like the people that organized that International Carders' Conference in Odessa, I look at where we are in the political world today with Ukraine and Russia, and the United States. And I started going to Kyiv in November of 2003, trying to get the guy's name was Dmitry Golubov. Dmitry Golubov arrested.He was one of the key organizers of this conference, responsible for massive amounts of fraud against financial institutions and online companies. It was very difficult. He was protected by the police in Odessa. They were on the payroll. It really came down to the Orange Revolution. In early 2005, late 2004 to 2005, there was a highly contested election in Ukraine. The first election was called by the international community to be fraud, and a second election was made. It was very close from a decision perspective.You might remember that the candidate that won was actually poisoned by the Russian FSB in Switzerland while he was traveling there. He won. When he took power, the Ukrainian MVD asked for me to come over and actually present my case. I got an opportunity to go over and brief my case to the Minister of Interior to Ukraine. Two weeks later, they arrested Dmitry Golubov.Mark: In London, the UK?Greg: No, it was in Ukraine. It was in Odessa. I do stop for a second. The Orange Revolution was extremely important in Ukraine. It was really that turning point in the history of Ukraine where they went Western leaning, they were looking to democracy.Why the US Embassy Was Giddy When Ukrainians Invited Greg CrabbGreg: They were looking to, how can they become more westernized? At the time, when the Ukrainians asked me to come over, the US embassy was giddy. We actually have a government that's interested in working with the US.I remember going with the special agent that was the FBI leg-att there in Kyiv, Ukraine. His name was John Boles. We drove over to the briefing with the Minister of Interior to Ukraine. He was so excited that we were going to present this case. Then for them to actually, the Ukrainians, to go and arrest Golubov was unbelievable. I was invited back over after the arrest to again do something that had never been done before. Boles was really excited.I was the first US law enforcement officer to ever be asked to interview a Ukrainian on Ukrainian soil. Albeit, we went to jail. He told us to buzz off, but so be it. It was a great turning point in our relations. Now when you see what's going on in the international community, I can only pray for the folks in Ukraine to be able to maintain their democracy and keep the coalition here, or the West to be able to help them.Mark: Given all of the things that are top in the news right now, this is really interesting. Ukraine is in the news every day.Greg: Unfortunately, we weren't able to present our case in Ukrainian court against Golubov. I won't say it was corruption, but after some time the case was dismissed. Several years later, Dmitry Golubov actually became a member of Ukrainian parliament. And you're just, "That's the way the world works, people."Carolyn: The James Woolsey quote holds true.They Want To Do the Right ThingGreg: Exactly. You know it. I saw it firsthand. I've seen it again and again in my interactions with folks that are over in Eastern Europe. On an individual level, I was able to form some amazing personal relationships with law enforcement officers. They want to do the right thing, but governments, politics, and corruption are difficult things to overcome. I think that's where we really need to continue to focus and understand. Thank you for letting me take a little walk down history lane. I think all of those lessons are important today to understand what we face from an organizational national security perspective for the country.Mark: When I think of cyber crime, cybersecurity, I think of technology, bits, and bytes. I think of leveraging cutting-edge kinds of technologies and the way people do what they do. I'm really curious to know because you've talked about a couple of things which makes me think really just grassroots intel, spy versus spy. How much of this world is HUMINT or human intel as opposed to the technology piece?Greg: Technology's just an instrument to the motives of the actors. I think that one of the things that, as we look forward and we look at the attacks like SolarWinds and you name the Eastern European-based attacks that we've seen, they're all motivated by the objectives of either greed or control. Or I often recall, and this is a supply chain story. It's going to start a little weird. One of my colleagues in Eastern Europe always used to say, "Mr. Greg Crabb, trust no one. Not your wife, not your girlfriend and not your lover."Supply Chain Related StoryGreg: How could that possibly be a supply chain-related quote? I knew all three of his, by the way. His wife, wonderful mother of his children, awesome. Girlfriend was just beautiful. His lover, she was smoking hot. But what he would always talk about is that from a mass surveillance society, you need to understand your relations. You need to understand your most trusted intimate relations in order to keep them controlled.I think when we see the types of attacks with SolarWinds and the other supply chain attacks that we're seeing in software development lifecycle, we need to understand that mass surveillance is a technique that is used in those cultures. We need to understand and account for it in our information security practices. There's bits of the story that I've left out there, but you can get the main point.Carolyn: I feel like we're...

Unbelievable Lessons with Greg Crabb Former Chief Information Security Officer of the US Postal Service

Tech Transforms, sponsored by Dynatrace

The best podcast episodes on romantic relationships. Episodes talk about the 5 love languages, intimacy, and the taboo topics of sexual desires and infidelity. This topic is a deep dive into the science and complexities that face us in our relationships with others. Add episodes you're interested into your queue below!

Best Episodes on Relationships & Love

The best podcast episodes of the most interesting stories and things. From skyping someone while they're in space, to tracking down and meeting a telephone scammer in person, to the story of a Galapagos. These episodes will keep you and all your friends entertained and captivated for hours. Learn something new in every episode! Add episodes you're interested into your queue below!