Episode 37 · · 48 min
Dr. Eric Cole Accidental CIA Hacker To Fortune 500 Security Advisory To Entrepreneur
Cybersecurity executive advisor and entrepreneur
Episode summary
Dr. Eric Cole is an accomplished cybersecurity hacker and executive advisor. His career has been a mix of sixth-sense chance encounters and wisdom/foresight of the future. His uncanny ability to see the opportunity in cybersecurity combined with the wisdom to listen to those smarter than him is why he is where he is today. His interview is chock full of poignant advice and tips.
Dr. Eric Cole also has a creative side to him: he's a musician. He was a French horn player before and now, he's a drummer. He's known as the Tommy Lee of Cybersecurity.
Eric Cole's Quick List of Advice
Always be respectful, Don't be an A**Hole to other people… but don't give a crap what other people say or think because we're unique and different. If you're an entrepreneur in cybersecurity, they're not gonna get ya.
Listen to people that are smarter than you and have made the mistakes before you make them.
Life will force you to repeat lessons until you learn them.
The biggest gap is in the monitoring, detection, and analyst side.
Quotes
"It's all about looking at calculated risk, understanding [the] pros and cons, and taking chances."
"You've done the same thing six times in a row, and it doesn't work. What makes you think if you do it a seventh time [that] it's actually going to work?"
"Try different things."
"Have advisory board members for your life."
"If the best professionals in the world have coaches, why shouldn't we?"
"If people are not listening to your advice, 99% of the time, it's because you didn't answer the right question."
"Smart people know the right answer. Brilliant people ask the right question."
"Good cybersecurity people solve problems. Great cybersecurity people solve the right problems."
"Don't overlook the obvious."
"It's never a lack of resources, but a lack of resourcefulness."
Getting Into Infosec
Other episodes, transcripts, a career guide to Getting Into Infosec:
See omnystudio.com/listener for privacy information.
Before infosec: CIA professional hacker and long-time SANS course author
Chapters
- 0:00
Intro: Dr. Eric Cole's path from the CIA
Ayman introduces Dr. Cole's offensive career at the CIA, his move to defense and his advice on putting yourself out there.
- 1:50
30 years in cybersecurity: CIA hacker and SANS author
Cole summarizes his career as a CIA hacker, creator of SANS SEC401 and a leadership-focused advisor.
- 4:01
Why eight years of hacking got boring
He explains that offense became a routine checklist and that defense offers new challenges every time.
- 5:23
High school geek to a CIA co-op slot
Cole describes planning to study architecture, taking advice to study computers, and getting the last CIA recruiting slot.
- 10:29
Raising a hand: how do we know these systems are secure?
A question in a CIA auditorium put him on the path to being a hacker, and he explains why putting yourself out there matters.
- 15:47
Leaving the CIA: startups, patterns and responsibility
He describes leaving government, bouncing between dot-com startups and learning to accept responsibility and spot repeating patterns.
- 20:19
Coaches and advisory boards for your life
Cole argues that everyone needs coaches, comparing it to golfers on the PGA Tour practice range.
- 21:54
Advising presidents: answer the right question
He tells how a presidential briefing taught him to ask clarifying questions before answering.
- 27:32
What CISOs need: business fluency and strong detection
Cole explains why CISOs must read financials and why the biggest gap is monitoring, detection and analysts.
- 33:18
War stories: the fax machine and the hijacked router
He recounts an insider leak through a fax machine and a government contractor whose email was rerouted to Germany.
- 44:20
Resourcefulness: turning a bankruptcy into a win
Cole explains how he bought and resold a bankrupt client's servers to save his company.
- 47:43
Closing: Ayman's new community
Ayman thanks Cole and asks listeners to check out his new community in the show notes.
Key takeaways
- Be willing to put yourself out there by asking questions, emailing people and raising your hand, because that is how opportunities arrive.
- Listen to people who are smarter than you and have made the mistakes before you make them.
- Look for repeating patterns in your life and career, accept responsibility, and change your approach instead of repeating the same thing and expecting different results.
- Have coaches and advisory board members, since even the best professionals have people who see what they cannot.
- If people ignore your advice, you probably did not answer the question they were actually asking, so ask clarifying questions first.
- CISOs must speak the business language, including financials, and the largest talent gap today is in monitoring, detection and analysis.
Notable quotes
It's all about looking at calculated risk, understanding pros and cons and taking chances.
You've done the same thing six times in a row and it doesn't work. What makes you think if you do it a seventh time, it's actually going to work?
The good cybersecurity professionals solve problems. The great cybersecurity people solve the right problem.
Questions answered in this episode
- How did Dr. Eric Cole get into the CIA?
- Cole was studying computer science and almost majored in architecture. After weeks of doubt, he went to the co-op office on a hunch and learned the CIA was recruiting on campus the next day with one slot left. He took it, did well and ended up working there for eight years as a professional hacker.
- Why did Eric Cole move from offensive to defensive security?
- After eight years of hacking, he found the work routine because he had a methodology and checklist that always eventually succeeded. Defense gave him new challenges because attackers keep finding new ways in and every company is different.
- What skills do CISOs need according to Dr. Eric Cole?
- He says CISOs must speak business language, including reading balance sheets and understanding revenue, so security spending is tied to the business. He also says the biggest gap in teams is in monitoring, detection and analysis.
Show notes and links
Show the original episode notes
Dr. Eric Cole is an accomplished cybersecurity hacker and executive advisor. His career has been a mix of sixth-sense chance encounters and wisdom/foresight of the future. His uncanny ability to see the opportunity in cybersecurity combined with the wisdom to listen to those smarter than him is why he is where he is today. His interview is chock full of poignant advice and tips.
Dr. Eric Cole also has a creative side to him: he's a musician. He was a French horn player before and now, he's a drummer. He's known as the Tommy Lee of Cybersecurity.
Eric Cole's Quick List of Advice
- Always be respectful, Don't be an A**Hole to other people… but don't give a crap what other people say or think because we're unique and different. If you're an entrepreneur in cybersecurity, they're not gonna get ya.
- Listen to people that are smarter than you and have made the mistakes before you make them.
- Life will force you to repeat lessons until you learn them.
- The biggest gap is in the monitoring, detection, and analyst side.
Quotes
- "It's all about looking at calculated risk, understanding [the] pros and cons, and taking chances."
- "You've done the same thing six times in a row, and it doesn't work. What makes you think if you do it a seventh time [that] it's actually going to work?"
- "Try different things."
- "Have advisory board members for your life."
- "If the best professionals in the world have coaches, why shouldn't we?"
- "If people are not listening to your advice, 99% of the time, it's because you didn't answer the right question."
- "Smart people know the right answer. Brilliant people ask the right question."
- "Good cybersecurity people solve problems. Great cybersecurity people solve the right problems."
- "Don't overlook the obvious."
- "It's never a lack of resources, but a lack of resourcefulness."
Getting Into Infosec
Other episodes, transcripts, a career guide to Getting Into Infosec:
https://gettingintoinfosec.com/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
So in my 20s, I basically was trained to break into anything on the planet. And while some pen testers might think that's cool, and hopefully nobody gets offended by this, after eight years of doing it, I got a little bored.
Welcome to Getting Interned for Sec. I'm your host, Ayman Elsawah. My guest this episode is Dr. Eric Cole. Dr. Cole started off doing offensive cybersecurity with the CIA. His career path was quite serendipitous, actually.
And they say, Eric, it's so funny you came today because the CIA recruits on campus once every two years and they happen to be coming tomorrow and we have one slot left.
As his thirst for growth went unquenched, he discovered the defensive side of the industry.
But what I love now being on the defensive side is there's always a new challenge. Anything we fix today, the adversaries are going to figure out a new way into the system.
We had an amazing conversation and he shared some excellent war stories and tons of inspirational quotes and wisdom.
And that's my probably biggest piece of advice to anyone in cybersecurity or that wants to get into cybersecurity is be willing to put yourself out there. If I didn't raise my hand and expose myself and ask that question that you could argue might have been a silly question, I would have never been given that opportunity.
All right. On to the show. Hi, Dr. Cole. Thanks for coming on the show. Oh, it's my pleasure. Thank you for having me. Yeah, this is a great honor to talk to you. So for those out there that may not be familiar with your experience, can you tell us a little about yourself and what you do today and what you've done in the past?
I am one of those folks for the last 30 years, I started my career in cybersecurity, and I continue my career in cybersecurity. I just love solving complex problems and help making cyberspace a safe place for people to live, work, and raise a family. So I got started at the CIA, where I was actually a professional hacker for eight years. So in my 20s, I basically was Trained to break into anything on the planet. And while some pen testers might think that's cool, and hopefully nobody gets offended by this, after eight years of doing it, I got a little bored. Because you can always break into anything. Everything has exposure points. Everything has vulnerabilities. I always joke with people, if it's a computer and it's connected to the internet, or it has any external access like Wi-Fi or things like that,
It's hackable it was funny i was just over my friend's house the other night i was social distancing so don't worry okay and he comes up with his new ferrari and he's like you can't hack that and so they placed bets what do you think it was three and a half minutes i was in his ferrari driving away and he just he had big his eyes got real big and he was like how could you do that but the point is with functionality there's always exposure points but i spent most of my Time after the CIA, really helping make the organization safe. I spent 20 years at SANS building a lot of their courses. One of my big accomplishments is built the number one cybersecurity course, Sec 401 Security Essentials, and actually built it, ran it, and managed it for over 18 years, trained over 40,000 people, and really just love helping people understand, get into, or advance their careers.
In cybersecurity. And now I'm really focused a lot on cybersecurity leadership. I think the world needs a lot more security leaders, chief information security officers, people that can actually speak the language, sit across the table with executives as equals and actually put together a strategy that's needed in order to secure companies and secure the country.
Yeah, that's excellent. So there's a lot to unpack there. So it's interesting you mentioned how you got bored after eight years of hacking. I guess that dopamine and that high no longer really cut it for you. Is that right?
Exactly. Because what it comes down to is I love challenges. I'm one of those people that get bored very easily. Nothing wrong with a lot of great professions like accountants and teachers and things like that. My hat goes off. I mean, very, very well respected, but that's not for me doing the same thing or teaching the same thing or that repetition. I like new challenges. So after eight years, you get the methodology down, you get your set vulnerabilities and exposures, and it wasn't challenging anymore. It was just routine. I had a checklist and I knew eventually at some point in the checklist, the system would give and I would get in and I would accomplish the mission. So once I had the methodology built and the process that I follow, then the excitement, like you said, was gone.
But what I love now being on the defensive side is there's always a new challenge. Anything we fix today, the adversaries are going to figure out a new way into the system. And every company is unique and different. So every time I work with a new engagement, it's always a new challenge, a unique opportunity. And one of the things I really focus on now is customized solutions. So that keeps the creative juices flowing.
Nice. That's really good. And how did you end up getting into the CIA? Like, what was that progression? You know, you went from high school and like, were you hacking and they just found you? You know, how did that happen?
It's actually funny because it's not what you would think where I was like the high school hacker. I was the high school geek, right? I got my share of flushies and thrown in lockers and stuff like that. But I always tell people that the best revenge in life is success.
Yeah.
I'm not big on high school reunions, but my last one I went to, and when you're showing up in your sports cars and private jets and everything else, and the kids used to make fun of you aren't successful at all, it just sort of gives you a little grit in life that don't let short-term things or other people's opinion influence who you are or what you can accomplish. That's probably sort of one of my first themes in life is, Always be respectful don't be an able to other people yeah but don't give a crap what other people say or think because we're unique we're different and if you're an entrepreneur in cyber security they're just not gonna get you so that's sort of first theme but i did some programming
I like technology and science. I was actually going to major in architecture because I'm fascinated with how buildings and bridges work and operate. I still today, you look at a skyscraper in New York City and you're like, how the heck does that thing stand? And how did they design it and build it? And a friend of the family actually said, why don't you go into computers? This was in the 80s. He goes, everything's moving into computers. Why don't you major in computer science? It's a new field. You can be one of the first people that get a degree in it. And if you know how to use computers, you can then go into any field you want, including architecture.
And did you have a computer at home at the time?
I had my Commodore 64 that I actually saved up a year and a half working. And you'll laugh, it was $900. So I have this piece of crap in my basement. My wife wants me to get rid of it. But because I spent my life savings on it, when I was in my teens, I'm like, I'm keeping that thing forever, even though it has no value today.
Right. And so you were using it in high school. So you had some computer exposure in high school as well before college, right?
Exactly. So a basic programming. So just some of the programming and basic games and things like that. But I was always fascinated with computers and how they work and how they operate.
That's awesome. That's awesome. So now in college, you're getting this advice to kind of take on this step of looking into computers as a career, but you were considering architecture. And so what was that thought process there? And what did you end up deciding?
So the thought process was, and this is one of my other big pieces of advice is, Listen to people that are smarter than you and have made the mistakes before you make them. So this is a 45 year old engineer who worked at Grumman at the time, who is very, very successful. And I'm like, he probably knows what he's talking about. And it was probably a good thing. So I did listen to him and went to New York Tech. In computer science, but after two semesters, I'm sitting there in the Fortran classes, because remember, this is when it was sort of an engineering degree with a couple of programming classes. Computer science wasn't mature like it was today, and I'm sitting there, and I'm like, is this really what I want to do?
Is this really what I want to do in my life? And I thought about it for many, many weeks. And I still remember it was a Thursday afternoon and something inside me said, you need to go to the co-op office today. And I was like, I'm busy. I have these other things going on. And some just kept pushing me. So I go down to the co-op office after my class at around 3.30 in the afternoon. And they say, Eric, it's so funny you came today because the CIA recruits on campus once every two years. Huh. And they happen to be coming tomorrow and we have one slot left. Do you want it? And I'm like, heck yeah. Which means if I went a day later or a week later, I would have missed out on that opportunity, which really became a pivotal part of my career.
So I went to the interview the next day, did well, got the application. And I think based on what we talked about with my resume, we know things worked out fairly well and I ended up working for them for eight years.
Okay, that's awesome. And were they looking for technical computer folks? Or did they see that in you and decide to put you in an app?
No, they were looking for people that majored in computers and technical fields because the government is usually a little farther ahead. So they had computers and internet when the rest of the world in the 80s had America online and dial-up connections.
Yeah, that's excellent. So that was, you know, kind of an opportunity that just dropped in there. And do you ever think about your architecture days?
Not really, because I love what I do so much, and I love the cybersecurity area and solving the problems. I mean, I'm still fascinated when I travel and fly on airplanes and look at bridges, especially when I go to Dubai and look at some of those crazy buildings, the tallest in the world. I'm still fascinated, but it's one of those where I definitely know deep down inside I made the right decision.
Okay. And so at the CIA, did you start off in cybersecurity right away? Or, you know, what was the progression internally there, if you could share that?
Absolutely. So what's interesting with the CIA is once I went through all my clearances, so they flew me down to Virginia and I got my poly and my background and all that. As an intern or a co-op, you have full clearances just like employees, but you're a free resource. It doesn't come out of their budget. So now when I'm going in and I'm interviewing at all the different offices from networking to operating system to programming to the cybersecurity, they're really trying to sell me on why I should work at the office.
Oh, interesting.
And this is going to sound a little contradictory, but I went and I asked everybody, my advisors, what should I major in? And everyone's like major in networking. Everything's going networking, networking, networking. But in this case, something told me that cybersecurity was going to be a cool area. And I was going to be able to do some things and test some things. So that's one where I decided that, you know, something I took the advice. I listened to the advice, but I also recognized that it was one summer intern. So the risk was relatively low. If I did a intern for seven months with security and I didn't like it, I could always do networking the next summer. So it was one of those where the risk was low.
Even though I didn't listen to the advice. And then probably the life-changing moment for me was I was in a big meeting in the bubble. It's the big auditorium at CIA headquarters. And it was with the entire office, all of the execs, everyone there. And they were talking about these new internet systems, putting out these systems on the internet. And I'm sitting there in front of 2000 people and I raised my hand. And my boss looks at me and she's like, put your hand down, put your hand down. And I was young and stupid and I kept it up. And I asked a simple question that changed my life, which is this, how do we know these systems are secure? How do we know that they're protected? And they looked at each other and they said, Eric, thank you for volunteering to solve that problem.
And I said, I wasn't volunteering. I was just asking. But if you ask hard questions in the government, then you get tagged with solving it. And that's what put me on the journey of really hacking, being a professional hacker for eight years, understanding how The tech really works so I can then do the defensive solutions that I do now. And that's my probably biggest piece of advice to anyone in cybersecurity or that wants to get into the cybersecurity is be willing to put yourself out there. If I didn't raise my hand and expose myself and ask that question that you could argue might have been a silly question, I would have never been given that opportunity in order to be able to do that. So I know so many people in cybersecurity are super good at the tech and they ask me, Eric, how do I get promoted?
How do I start my own business? And I say, well, start asking your friends and neighbors, start talking to your boss. And they're like, I can't do that. I said, why not? Why can't you do that? And some of my best relationships that I have is because I sent an email, I picked up the phone or I put myself out there. So if you really want to be successful in this field, take some risks in your real life, put yourself out there and see what opportunities are waiting around the corner.
Yeah, and you know, that's something to be said, you know, it took a lot of courage for you to raise your hand in that big auditorium, you know, so there's a certain level of entrepreneurial spirit, I would say, right? I mean, all this risk and courage, that's all part of the entrepreneurial spirit, wouldn't you say?
Exactly. It's all about looking at calculated risk, understanding pros and cons and taking chances.
Yeah. Part of you actually had a concern of like, hey, you know, how do we know these systems are secure? Whereas I suppose someone either may not have that mindset to question and to see, you know, how an attacker can get in or just may not care. Right. And so, you know, taking the initiative and really having some concern, you know, wouldn't you say?
Exactly, because I always look at everything and it's a good skill in cybersecurity. It drives my kids and my spouse crazy, but I'm always looking at how can you break things and make them better? What are the exposures? What are the risks? What are the things that can go wrong? And then what are some better options or better solutions?
Yeah, I think they should have support groups for spouses of cybersecurity professionals because it seems to be a common thing here.
I think you're on a big business model. They could probably make a lot of money with that.
Yeah, I think there needs to be something because, you know, I mean, my kids have adopted it. But, you know, my wife is like, why would you even think that way? I'm like, what are you talking about? That's my job. Exactly. So it's quite extraordinary. Cool. So that's good to know. So even in the CI, when they were recruiting you, like cybersecurity was not necessarily the default. And what was it called back then? What was that department called? Was it called cybersecurity? What was it called exactly?
It was actually called the Office Security. And then the subtitle was actually infosec.
Okay.
So infosec was sort of the big word. And then it's sort of some people still like I'll still use that and people I date myself and they know I came from the government because that's more a government term. And nowadays we tend to use cybersecurity.
Well, yeah, you have the purists out there that, you know, try to stick with infosec. So it's good to know government did use the word infosec at some point in time.
Yeah, exactly.
Great. So now doing security at the CIA gave you a tremendous opportunity to, you know, such exposure to the field and everything, especially since it was very nascent, you know, probably a decade or two ahead of everyone else in the private industry. And so how was your shift from government to private industry?
For me, it was a very, very positive one. And the reason is simple is when I left the agency, I realized that I also have an entrepreneurial bug in me. Where I love building, starting companies. And I think it goes sometimes with people that are really good at something. They don't work well with bosses that don't necessarily know as much as them. So I sort of got really good evaluations on all my technology. But I remember at the agency, I used to get Ming like, doesn't play well with others, doesn't share his lunch at lunchtime, and doesn't necessarily listen well to his bosses. Because there were a lot of cases where I'm like, okay, this is the wrong thing to do. And they're like, I know, but I'm your boss and I'm telling you to do it.
I'm like, but it's the wrong thing to do. We're going to crash the car now. I've learned better on how to deal with that. But that was always a challenge for me. So when I got out and starting and building companies gave me an opportunity to sort of Be your own boss, realize that being a boss is a much harder job than you realize and give you a different perspective. But it's one of those things I never regret. Working at the CIA was one of the best things I did, but I never regret leaving. It was also one of the best things I did. So it was one of those where that chapter in my life needed to come to an end that I needed to then explore the commercial side of business.
Okay. So you went straight into entrepreneurship when you left the CIA. It's not like you went to a private job or corporate job necessarily. Is that right?
I did a few little startups.
Okay.
So I worked for a few, because this was right in the dot-com 1998 time period. So I did a few of those little stints, six months here, six months there. And after about three or four of these, I started recognizing patterns and saying, okay, It's not that every single boss on the planet is an a-hole. It's I just don't do well with authority in those cases. And that would be another big piece of advice I would give to folks is I believe in life you're forced to repeat lessons until you learn them. So start looking for patterns. If you see things repeating itself, if you see the same problem happen over and over again, I have a friend of mine, I kid you not, he's going on his ninth marriage. And I'm like, dude, there's a pattern there that you need to pay attention to that you're not seeing.
And then the other thing that's tied together with patterns is Is if you really want to grow and be successful and be an entrepreneur or successful in any field, you have to accept responsibility. And that was the other big thing is I had to stop blaming my bosses and blaming other people for being stupid and recognize that I wasn't doing what I was supposed to, accept responsibility for that, and then create a scenario where I could use that as a positive instead of a negative. And that was essentially finding some partners and starting my own companies.
That's awesome. And I think you hit it really well there, accepting responsibility, taking it on yourself. You know, we're in security. You're trying to advise people and help people do the right thing. If you're internal and people are not listening to you, you probably need to try something different, right? You know, just being creative and getting around the problem where people are not listening to you instead of doing the same thing and just getting frustrated and going nowhere, right?
Exactly. One of my favorite quotes, and I actually allow all of my employees at my current company to call me out on it, and it's Einstein's definition of insanity, which is doing the same thing over and over again, expecting different results.
Yeah.
I find myself get caught up in that, but I CISO many entrepreneurs where they call me in for coaching and I'm like, you don't see this. You've done the same thing six times in a row and it doesn't work. What makes you think if you do it a seventh time, it's actually going to work? You need to do like Edison did, which is try different things. I'm all about failing a thousand times because you're going to get that, but you need to do different things each failure. You can't do the same thing over and over again, expecting the results to change.
Yeah, I love that quote. It's hard. Sometimes, you know, you're in your own bubble and it's hard to step out of your bubble and see what you're doing. I think for those trying to get into security, you know, a lot of times you're getting frustrated, maybe sending the same resume over and over again and getting no results. But, you know, being able to pivot, right, try to change up your resume or change your tactics or learn something new. I think the same would apply there as well.
Exactly. The other thing I push that I'm also a very, very big fan of is have advisory board members for your life and have coaches because there are certain things that you cannot see. And there are certain perspectives that you're not going to see. And the analogy I give is watch the PGA Tour. You have the best golfers in the world. And when those golfers are on the practice range before they tee off, they have three to four coaches around them having them adjust and tweak and modify things that they can't see. So if the best professionals in the world have coaches, why shouldn't we? You need to have people around you that can say, hey, this might be silly or here's an alternative. And I find especially in cybersecurity because people in this field are very, very smart and they tend to be more on the introvert side.
That they don't want to ask for help or get help from others. And that's probably one of the biggest mistakes I've seen that's going to hold you back from really growing and getting to that next level.
Wow, that is really profound. You see these professional athletes, but behind the scenes, they have multiple coaches. That is really profound. I think I'm going to have to ponder that for a little bit. That's really good. Good. So now pivoting a little bit. So now you're helping CIOs. How do you work with people when they don't take your advice? I know you worked with President Obama as well. And government can be pretty bureaucratic as well. So are there any things you can share Frustrations maybe that you've worked with people and where you try to give them advice and try to give them, hey, best practice here, maybe we should do this, but they don't listen to you?
Yes, that happens a lot. It's happening less and less because I figured out a little secret, which is this. If people are not listening to your advice, 99% of the time, It's because you didn't answer the right question. You didn't actually give them the advice that they're looking for. And this was one of my mistakes that I made the first time. It was actually President Bush. I was one of the first presidents I advised with. I'm like all pumped. I'm going into the Oval Office. This is going to be awesome. This is going to be great. And I had my, they said you had three minutes. So I had my three minute Speech ready to go. And I don't even remember what question he asked, but I went into my three minutes and I gave my speech and it was polished and it was good and it had analogies.
And I remember they said, okay, thank you, Dr. Cole. And they went to escort me out and I respect them a lot for saying this, but President Bush looked at me and he said, Dr. Cole, that was great, but you didn't answer my question.
Oh, wow.
And it hit me when I left. So the next time I went in and he gave me another chance because he saw that I knew what I was talking about. I just had a little maturity issues to deal with. So the next time I went in, he asked the question and I spent a minute and a half Asking him follow up clarifying questions. And then once I really understood what he was looking for, I gave less than a 60 second answer. And then I remember getting up and he goes, Eric, that was one of the best answers that I ever heard. And that's exactly what I needed. We're actually going to act on that. And you walk out. So a lot of times, we want to impress people with how smart we are, but we're not really giving them The answers they're looking for.
So one of my other favorite quotes that I got at the time is smart people know the right answer. Brilliant people ask the right question. So when I'm working with executives and I'm working with other folks, I have a rule. I cannot give an answer unless I ask them three questions. And then that just forces me to clarify and understand what they're really looking for.
Yeah digging deep into it exactly okay that's great because maybe not everyone is able to articulate their question properly because it's still stuck in their head and so that's part of communication not only can you have to listen but ask clarifying questions okay that's really good how was it you know just on the side note how was it walking into the president's office for the first time can we expand on that
So, I mean, it's very nerve wracking and it's sort of a balance between sort of ego and emotion. At least for me, one of the highest privileges is to actually speak and give advice to the president of this great country. So the fact that you got asked out of hundreds or thousands of candidates to Your ego, you got to keep that in check at the whole time. And then you're very emotional because you're like, okay, what if I screw this up? What if I give the wrong answer? What if I do the wrong thing? And then it was funny because the first time I go in, I did exactly that. But what I realized after that first encounter, second, and then over the years, I got to know him a little better, George W. Bush.
And what I realized is, yes, He is the president of the United States and he is the most powerful person on the planet. But he's a person just like you and me. He eats three to four meals a day. He has kids. He plays with his dog. He's still a person. So when you recognize that whether you're dealing with the president of the United States Or Bill Gates, or Elon Musk, or Richard Branson, yes, they've achieved amazing, miraculous things that we all envy. But at the end of the day, they're really people just like you and me. So the more that you can humanize and treat them like people and interact with them like they're a friend or somebody else asking for advice, the more effective you're going to be overall.
Gotcha that is really good to say yeah sometimes when i'm meeting someone high up i guess for example for the first time i do get nervous myself right even though i've done it before and so being able to acknowledge that this is just another person same as you as long as they're not you know a big a-hole really but just understanding that they are human that's really good advice i appreciate that and just put on that string a little more ultimately if an executive or the president or somebody very important
Either asked for a meeting with you or they accepted your meeting, that means that they believe at some level you can help them. Because let's face it, if they did not think you can help them or they did not have a problem that they needed help with, they wouldn't have taken the meeting because they're too busy and they have too many things. So that's the other thing that I always remind myself is, Okay, they have a problem in which they need a solution. I need to figure that out as quick as possible because as quick as I can figure that out, I can help them. And the sooner I can help them, the better the meeting's going to go.
That's great. Yeah, at the end of the day, cybersecurity is about solving problems, right? Figuring out how to solve problems, how to make things safer. We kind of want to make things better. At the end of the day, we're all trying to solve a problem, whether it's a human problem or a technical problem or a process problem, right?
Exactly. And the only clarifying thing I would add to that is The good cybersecurity professionals solve problems. The great cybersecurity people solve the right problem. And that's what I see probably if there's one big disconnect that I see in the area of cybersecurity is very often we're solving good problems that will help the organization at some level, but it's not the right problem that's highest priority that they really need.
Gotcha. And so do you work with leaders that are, when you're working with CISOs, do you work with them on advising them who to hire, like what to look for when hiring people?
We can do that, but normally what we focus on is a little more strategic. So what we're going to work with a CISO on is, okay, do you really have an effective plan that the executives understand? And do you really have the right metrics and dashboard to In place. So this way, the executives understand what you're doing, they'll support you, and that you'll have the right resources in order to do that. And then we'll go in and identify what the skill sets are that they need on their staff. But I usually don't get involved The actual interview and hiring process in a few cases where they were key positions we did but most of our focus is really making sure you have the right strategy because I'm a firm believer is and I'm from New York so I am NOT a fan of the New England Patriots but you gotta respect
Bill Belichick, because one of his big things is you don't need the best players. If you have a great consistent playbook, you can turn them into great players. And that's what I like doing with a lot of our clients is let's get a really solid playbook that's proven that we know works, that we know is valid. And then let's train the team on that playbook so they know it inside and out. And then they operate in a consistent manner. And that's how you can turn good people into great people, into an amazing team.
Yeah. More specifically, so I understand that you work at the strategic level. More specifically i think you hit it on there a little bit is as a cso is putting together a strategy you know there's the a lot of times they're having i'm sure many are having trouble executing on that strategy and finding those skill sets so what i really want to ask you is what are the skill sets that you're seeing out there that are in need by a lot of the cso's out there today
Probably the biggest need that I see for a CISO is to be able to speak the business language, is to really be able to sit in the executive boardroom with the CEO, COO, and CFO, and actually be able to have a conversation that they understand. Most CISOs can't read balance sheets. They don't know profit and loss statements. They don't know financials, which I know it sounds crazy, But I'll just give you a short example. If you don't understand the financials of a business and you don't know which products are making the most money, how do you know where to spend the money and how much to spend? Is a million dollars a good budget? Well, if the company is only making $800,000 in revenue and you want to spend a million on security, they're going to laugh you out of the room.
Right on the other hand if you want to spend a million on security and it's a three billion dollar company they're also going to laugh you out of the room because it's too small so most security people don't understand how do you evaluate the business to understand the critical data to identify the exposures tied to revenue and that's how you have to build your plan because if it's not tied to the business that's why so many cisos get fired And so many companies that spend so much money on security get breached because they don't really understand and align security with how the business operates.
Yeah, I think that's well said. And then digging in a little bit with the CISOs that are looking to execute and they've kind of put the strategy together from a resources perspective, like from a skills hiring, where are they having trouble? Where do they need the most skills? Do they need more security analysts to kind of do the threat hunting? Do they need more engineers to build the security systems? What have you seen out there today?
Definitely the biggest gap I see is on the monitoring, detection, and analyst side because most companies do a pretty good job at preventing attacks, at stopping the attacks, configuring the architecture with VLAN, segmentation, firewalls, all that technology in place. But the problem they're having today is when an attacker gets in, And breaches all their measures, a lot of companies can't detect the attack for two or three years. So they need a better set of people that can actually analyze, respond, react. And really what it comes down to is the ability to prioritize and focus on the high exposure areas, because the problem we see with most of our clients is they're getting 3000 alerts a day and their team can only analyze 300.
So if you're only looking at 300 and you're getting 3000, you're going to miss it. And no one's willing to go in and say, you know something, if our staff can only analyze 300 alerts, then we need to tune the tech to only generate 300 alerts. Now I get pushback where people say, but Eric, if you do that, you're going to miss some attacks. Yes but today we're missing all the attacks so wouldn't you rather have a security solution that catches the top 30 of all breaches than a solution today where you're analyzing so much noise that you're catching nothing that's well said cool so dr cole you've seen a lot of things out there can you share with us a couple war stories that you've seen and lessons learned from there
Yeah, that's a great question. I have so many I'm trying to sort of distill down.
We could probably record another episode with all the war stories that you have.
So just for clarification, are you looking at like war stories on catching attackers?
Yes. Like breaches you've experienced or anything that's out there that really, you know, there's so much out there, but would love to hear, you know, either a scenario where you're involved in a breach and found the attacker or really bad mistakes that you've seen companies make.
Awesome. So I'll jump in one. This one was from probably about 10, 15 years ago, but it's still a great story. It gives great examples. Don't overlook the obvious. So I got called into a Fortune 500 company that we knew had an insider threat that was stealing information and giving it to a competitor.
Oh, wow.
And not only did we have proof, but because the CEO of the other company actually called up this company's CEO and said, listen, you have an employee who's stealing information from your company and he wants to come work at our company. We're not hiring somebody who has that poor morals and ethics, but we just wanted you to be aware that he's stealing the data. So we had a pretty good case. Here's the problem. We couldn't figure out how he was doing it because the CEO from the company said he won't testify in court. So we needed to find the actual proof on the network. So we're monitoring his computer. We're monitoring his email. We put on filters on the inbound and outbound of the Internet.
I mean, we are watching all the traffic and we could not find anything. And we are like, how is this person doing it? This person has to be like uber James Bond spy material because we are just not catching it. And I remember it's about 1 a.m. in the morning. And I'm working in the company and we're with the engineers. We're trying to figure this out, pulling an all-nighter. And all of a sudden, I hear from outside my office, and I walk outside and I'm like, what is that? And they're like, oh, that's the fax machine.
Oh, okay.
And like as soon as they said that it was like the heavens opened you heard choirs of angels and i was like you gotta be kidding me so i immediately went and pulled the logs of the fax machine and sure enough that's how this individual was getting all of the data out of the company he was printing it and then faxing it out to either personal accounts Or competitor's accounts. And I hate to say we spent three and a half weeks analyzing all the network traffic because we assumed that he was using email and that was a false assumption. And if we would have stepped back and said, okay, What are all possible scenarios? And let's do a validation and spot check. We probably would have been able to find the individual a lot quicker and a lot faster, but we just jumped to conclusions.
We made assumptions and we ended up missing the most obvious.
That's hilarious. Good old fax machine. There was a bias already in there. So go in with no biases. The lesson learned, I would say.
Exactly.
Gotcha. And any mistakes you've seen companies make, really bad security mistakes?
Probably one of the big ones, and this was a large government contractor. And as you know, government contracts today are almost all electronic. So the bids, the due dates, all of that is all done electronically. They're not actually distributing paper anymore. So they had a scenario where they're bidding on a fairly large contract. It was about an $80 million contract. And they receive an email about two weeks before the proposal's due saying, based on changes in scope, we've extended the due date by three weeks. This happens fairly often. This is common in this space. They didn't take much of it. So they said, great. So they took the extra three weeks. And they submit it the day before it's due.
And the government comes back and says, the due date was three weeks ago. You missed it. You're not eligible. And they said, no, no, no. You extended the due date. And they said, no, we didn't. And they forwarded the email. And the government said that wasn't from us. So they once again assume that, OK, our mail server failed. Must be compromised. So they went in and they signed up for some of these government proposals via personal, like Gmail accounts, and they were getting the correct information with the correct dates, but the email that was coming in to the inbox of the proposal team had false information, false data, false dates, and it was starting to really Impact the business they were losing several contracts and the company wasn't doing well so they said okay our email server is compromised so they went in and hired microsoft they bought brand new mail servers had microsoft configure exchange they spent 2.5 million dollars rebuilding their entire email infrastructure from scratch
Oh, boy.
Brand new systems, brand new servers. And when they finished and deployed it, the same problem was happening. Of course. The same thing was occurring. So they called me in and they're like, Eric, can you help us? They explained everything that I just went through. And I asked them a simple question. I said, how do you know it's the mail server? And it was sort of one of those awkward moments because they're all looking at each other like, I thought this guy was smart.
Right.
And why is he asking such a stupid question? Eric, of course, it's the mail server. If we're getting altered mail and we're not receiving the mails that we're supposed to. And I said, question, you realize that when mail comes in, it goes through your ISP. That potentially could be compromised. It goes through your external router, which could be compromised. It goes through several other pieces of network here that could be compromised. And then it arrives at your mail server. So I ask you again, how Do you know that it's the mail server? And once again, it was one of those moments where they're all like, wow, we never ever thought about that. So we did analysis and we went to their external router and I did a show running config
And no covertness here. As plain as day, there was a GRE tunnel that was set up that was routing all the mail ports to an IP address in Germany. So to make a long story short, essentially somebody broke into their external router. Mm-hmm. Routed all the mail to Germany, and then they were altering and modifying the information and sending it back in. And here's the best part of the story. When we did the analysis, I came back in and I didn't know any history on the company. So I said, yeah, it looks like somebody broke into your router. And was siphoning all your email to germany and they're like what country did you say and i said germany it's not like it's russia or china what's the big deal and like everybody started freaking out because it turned out there was a german company that was trying to acquire this company and they were trying to underbid them and they didn't want to negotiate a lower rate
But since they've been losing all of the contracts, they were going to sell the company at 40% below what they were originally asking. So it turned out to actually be competitive espionage where a company was trying to devalue the company so they could get all the contracts at a lower value.
Wow. That is insane. This stuff is real. Yeah.
That's why I like that because everyone's like, okay, that story had to come from a Tom Clancy. And I'm like, no, it was real and documented. And the scary part is I work on one of those every week or so. The attacks are real. People just are not realizing it because they're not looking in the right place.
So this still happens today. You see this happening today? Yes. I'm going to ask the dumb question. I just want to know. So you see this happening today?
Yeah, and I know the data that the media pushes out says anywhere from 18 to 22 months, it takes a company to detect an attack. But I will tell you, we worked on over 30 Fortune 100 breaches that had over 100 million records each. And in every single one of those cases, It took the company over three years to detect the attack. And these are companies that spend over $10 million on security and have teams of over 100 people. And it is still happening today where companies are doing the wrong thing. In the name of security, and they're missing the attack completely. And these attacks are going on for significant amount of time before anybody notices. And then here's the scariest of all. Out of all 30 of those cases, 28 of those cases, so over 90% of those cases were detected because IT noticed performance issues on the server.
It was never because the security technology actually caught the attack. It was after three years, the attackers got greedy. They tried to steal a lot of information and impact the performance of the server. So most attacks are being detected because of performance issues, not because the security software is tuned correctly.
Wow. And then some of these attacks are simple. I mean, a GRE tunnel, that's like quite simple. So are a lot of these attacks that you've seen generally simple?
In the last three years, absolutely. And that's what I say. We got lucky. If you go back 10 years ago, companies were patching, companies were doing a pretty good job. And most of the attacks had to be zero day and fairly complex attacks. But because companies got so sloppy, most of the attacks we're seeing today are three categories. One is servers that are missing patches accessible from the internet and have missing patches from multiple years. Second is critical data not being encrypted, or if it is encrypted, the crypto key is stored with the data, so it defeats the whole purpose. And the third one is... Senior level people are falling victim to phishing attacks, giving up critical credentials that allows the attacker into the network.
So while I have some interesting and cool stories, most of the attacks we've seen over the last 18 months are simple attacks. Basic attacks where companies are just not doing the foundational items they need to do.
Wow, that's really helpful. So do you have any creative sides to you, traditional creative sides, I guess, to you? I asked that question because I have a follow-up question for that.
So yes, avid musician. In high school and college, I was actually a French horn player. So I played in duets, trios, quartets, very well accomplished there. But my favorite instrument now when I play in different bands is I'm a drummer. Mm-hmm. So I call myself the Tommy Lee of cybersecurity.
Nice. Yeah. I found a lot of security experts also have this creative side to them. So I think there's something to be said about creativity in the field. And I'm doing some research in that area. So I'm finding some really interesting things in that area. So my last question is, what was the most creative way you got out of a problem in your whole career? And it could be technical or non-technical.
Man, you have really good questions. These are getting me smiling and thinking because we really love that. So the most creative, probably I would say one of the most creative situations, and it goes back to one of my other quotes, is it's never a lack of resources. It's a lack of resourcefulness.
Mm-hmm.
So I had a situation where I did a very big job for a client and the client ended up filing bankruptcy. And I was fairly doing my business. And this was a pretty significant contract. And I didn't get a deposit. I didn't get paid up front. So if they didn't pay, It would have put my company in jeopardy it would really put the ability of my company to survive in huge jeopardy so i had to get super creative and i'm trying to talk to the banks and talk to everyone else and like eric there's a long line of creditors in front of you and they're going to get the money before you do so i went down to the data center And they were actually going in and auctioning off the servers and all the equipment.
And I went up to the bank and I said, listen, I'm on the list of creditors here. And I know you normally don't do this, but I'll buy the servers at a premium price. And you just offset what the company owes me against it. So they were auctioning them off and it was a large amount. It was something like 200,000. And I said, I'll buy it for 400,000. And then you offset the difference of it. But I still had a $300,000 that I had to raise in order to buy those servers. So then I went to another friend. I know it's gonna sound like a Ponzi scheme, but I went to another friend that I said, Hey, listen, If you can lend me $300,000, then I will go in and pay you back with interest within 45 days. And then what I ended up doing is taking all of those servers.
And this was just maybe eight or nine years ago when they were building out a lot of the data centers. And I went to one of the data center companies who were trying to get servers and they were all on backlog. It was taking 120 days. So I ended up negotiating a deal where I sold the servers to that company for 1.1 mil. I paid my friend back with interest. I got my money from the company and I ended up working away with 400K out of that. Now, all my friends said, but dude, you could have lost everything. And my answer to that was my company was in jeopardy and I was going to lose everything. So why not go in and take some very high state calculated risks in order to do that? And it was just sort of like all the moods aligned.
So to me, that always taught me that if you have a plan, And you believe in that plan, you can convince other people to follow along with it. And if you don't give up, trust me, I'm giving you the short version. But there were nights where I'm sitting there at 11 p.m. with my bottle of Jack Daniels saying, what the F did I do? I'm going to lose everything. But you just keep pushing through, getting creative. And ultimately, things do work out in the long run if you don't stop believing.
Wow, that is pretty creative. That's pretty cool. Well, Dr. Cole, thank you so much for joining me today. I think it was quite enlightening and I love all the different quotes. And I believe everyone will definitely benefit from your story in this interview.
Oh, my pleasure. Thank you so much for having me on the show.
All right. Thank you. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.
