Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Dennis Fisher on the future of cybersecurity journalism
Guest:
Dennis Fisher
Published:
Updated:
Duration:
32 min
Episode summary
Dennis Fisher, editor-in-chief at Decipher, reflects on his journalism career covering cybersecurity for more than two decades in the latest episode of the WE’RE IN! cybersecurity podcast. He began in 2000, covering email before transitioning to security. Soon his focus shifted to vulnerability reporting, including blockbuster bugs in Windows and Internet Explorer. This led to Microsoft’s trustworthy computing memo and significant changes in the software industry.
Dennis also discusses the challenges of cybersecurity journalism and the importance of democratizing information.
Listen to hear more about:
The overlap between cybercrime and traditional organized crime and the impact of cryptocurrency
Dennis’s interest in crime novels and the challenges of incorporating his background into his own books
The surprising topic Dennis would cover if he wasn’t focused on security
Listen to the episode
S3 E5 · Dennis Fisher on the future of cybersecurity journalismWE'RE IN! Podcast · 32 min
Key takeaways
Trustworthy Computing reshaped software security Dennis describes how the Bill Gates memo led Microsoft to pause Windows development, rework its development practices around security, and eventually set up the Microsoft Security Response Center. The effects spread across the software industry over about a decade.
Legal threats against researchers have eased Existential legal threats against vulnerability researchers are less common than twenty years ago, though vendors may still ignore or publicly shame researchers who report bugs.
Vendor-backed journalism can stay independent Dennis sees corporate-sponsored, editorially independent publications like Decipher as a viable path for security journalism as advertising-based media struggles. Duo and later Cisco left the editors alone to cover security for a broad audience.
Cybercrime and organized crime now overlap Traditional organized crime groups now directly sponsor cybercrime groups, especially around cryptocurrency, because the barrier to entry and the risk of consequences are low in some countries.
Unverified stories stay unpublished Dennis and a colleague had strong information about a leak of bug information inside a major software vendor but never published it because they could not get the final confirmation.
Topics covered
Talent Gap
Thought Leadership
Notable quotes
You know, the security industry is an industry that shouldn't really exist. It exists because humans write software, so software has bugs.
When one of us is safer, we all get a little safer.
…there are steps you can take, and there's people out there trying to defend it and trying to help you.
There was almost nothing going on in the early two thousands. Now it's like there's 50 things happening every day, and you sort of have to pick and choose.
Questions this episode answers
What was the Microsoft Trustworthy Computing memo and why did it matter?
Bill Gates wrote to the company that customers said Microsoft software was not secure enough and they would stop using it if it was not fixed. Microsoft stopped Windows development to add security features and change its development practices, which influenced the whole software industry. Read this section
How does Decipher maintain editorial independence from Duo and Cisco?
Dennis said Duo hired the editors to do what they do well and left them alone, with the goal of informing customers about security problems. That philosophy carried over after Cisco acquired Duo, and he said management has fully supported their independence. Read this section
What is the future of cybersecurity journalism?
Dennis believes corporate-sponsored, editorially independent brand journalism is one of the most viable options, since advertising-based media models are struggling. He welcomes more outlets covering security because more information is better for everyone. Read this section
How are cybercrime and traditional organized crime connected?
Early cybercrime groups were already tied to organized crime in places like Russia, and the overlap is now much tighter, especially with cryptocurrency. Organized crime groups sponsor cybercrime because it is less risky than traditional crime. Read this section
About the guest
Dennis Fisher is a longtime information security journalist who began covering security at eWeek around 2000 and co-founded Threatpost and Decipher. At the time of recording, he was editor-in-chief of Decipher, an editorially independent security news site published by Duo Security, part of Cisco, and host of the Decipher Security Podcast. He started his career as a crime reporter and has published two crime novels.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer. And today, we're hearing from Dennis Fisher, editor in chief of the independent security news site Decipher and a longtime infosec journalist. We'll talk about the state of cyber journalism today, reminisce on a few big stories, and dig into Dennis' background as a crime reporter and author. But before we jump into the conversation, let's hear a quick word from our sponsor.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.
Now you cofounded both ThreatPost and now Decipher and have been covering Infosec in some capacity for for over two decades. What are some of the biggest changes that you've witnessed in the beat since 2000 in the in the y two k bug era?
Yeah. It's kinda crazy to think about how long it's been, but when I first started covering security, it was end of two thousand, beginning of two thousand one. I was at what had just become eWeek magazine at the time. It was PC week before that. And the guy who had been covering security at the time had just left. And so I kind of put my hand up and said, hey, that looks like a fun beat. I wanna do that. I had been covering email before that, which is like... Yeah. Imagine how exciting that was.
Essentially. Yeah. It was extremely uninteresting, but I was like, hey. This was in the era of, like, VB script viruses and things like that. Like, I love you and the Anna Kournikova virus and that that kind of stuff. So I had done some security stories with Scott Berinato, who was the the security reporter at the time. When Scott left, I was like, hey. I wanna I wanna do this. So I ended up getting it. Nobody else wanted to do it. And, really, all it entailed was... Like, email borne viruses was pretty much everything at the time. And then pretty quickly after that in, like, the o two, o three, o four time frame became the, hey. Let's focus on how bad Windows is and how bad Internet Explorer is and how many bugs there are in the software that we're all using and why is everybody in this monoculture and we're all exposed to these serious problems at the time.
And this is when groups like L0pht and then @stake and some other security research teams were really starting to look for bugs actively in, you know, popular software like IE, Windows, not so much Linux at the time, but popular enterprise and consumer software was really coming under the microscope for for these early research teams. So that became a big thing, and, you know, that led to the trustworthy computing memo from Bill Gates and this real sort of turnaround for Microsoft at the time. There was almost nothing going on in the early two thousands. Now it's like there's 50 things happening every day, and you sort of have to pick and choose. It was more a case back then of, like, damn. Am I gonna have anything to write about in the next, like, five days, you know, for the magazine? Like, what am I actually gonna come up with from this conference or just on a random Thursday?
It does seem like things have kind of continuously picked up steam. I've heard it quipped before that the cybersecurity industry is the only one that's been allowed to fail up, so to speak. The problem just keeps seeming to get worse and worse with each passing year, but, of course, that can't always just be pinned on the big tech titans or the the companies trying to solve those problems. But it is an interesting trend nonetheless.
You know, the security industry is an industry that shouldn't really exist. It exists because humans write software, so software has bugs. You know? So we had to wrap this whole other industry around it to try and make safer this product that isn't safe. A lot of people compare it to cars and seat belts and that kind of thing, which isn't a perfect analogy, but you get the idea. You've got software and hardware that everyone has to use on a daily basis for every task in their lives. But a lot of it was built without the understanding of how humans were gonna interact with it and what the potential vulnerabilities and weaknesses might be. Now we have a several billion dollar industry that that is trying to fix all those problems.
Yeah. Yeah. And thinking back to the L0pht folks, it's... What's old is new again in a way. Right? We're still seeing huge Microsoft vulnerabilities crop up in the news from time and again. And I guess the difference now is the the big companies are less inclined to try to sue or threaten researchers who are exposing bugs in their systems, which is, I guess, a positive development in some ways.
That's... That is that is definitely a positive development. Although, I think if you ask some of those... The loft guys, they could probably point you to some things that are still happening or other researchers could be like, yep. We told you that this is still happening. And you do see it every once in a while, not really the the legal aspect of it, but more of, like, you might see some social media shaming of a researcher or in an advisory, the vendor might say, you know, or ignore the researcher that reported it to him or something like that. But, like, the existential legal threats aren't quite as prevalent as they were twenty years ago.
Yeah. How impolite. How uncouth. So against that backdrop, what's your most memorable stories? Whether it's a vulnerability, a particular event, or or something that you've covered in your in your cybersecurity journalism career here.
There's probably been a few that that come quickly to mind. One, honestly, was that trustworthy computing memo that I mentioned earlier. For folks that that haven't been in the industry that long, you can go Google that. But I I can vividly remember coming into the eweek office. It must have been a Thursday morning because that's when our print deadline was.
Print deadline. Look that up too. And seeing an email in my inbox, and it was from somebody I knew at Microsoft who had forwarded me this memo that Bill Gates had written and I think sent out to the company the day before or maybe maybe overnight, essentially saying, hey, listen. Our customers are telling our... Telling us our software is not good enough. It's not secure enough, and they're running into big problems. And if we don't fix it, they're gonna stop using us. And that led to essentially Microsoft taking a whole bunch of different actions. They set up the Microsoft Security Response Center as eventual result of that. And, like, approximate effect was they stopped development on Windows at the time. I forget what version it was, probably XP, and just stopped
Stopped development on it and said, hey, listen. We're gonna we're gonna hard stop, and we're gonna go back and add security features, look for problems, and sort of redo our development practices so that we're focusing on security first and not putting features and usability above everything else. That led to huge changes not just at Microsoft, but across the software industry, honestly, some of which took, you know, a decade to to play out. That was a big one, and that had really long term effects that, you know, we're still seeing. Some of which have kind of been rolled back by some of the some of the vendors, I think. But that was a big one. And honestly, another one was a story I wrote, like, right when we launched Decipher a few years ago was this oral history of the L0pht, which wasn't so much me writing it, but it was me, you know, talking to not just the L0pht members, but people who were around the the BBS and hacking scene at the time, you know, in the the mid to late nineties and very early two thousands.
And sort of chronicling not just the growth of the L0pht and the birth of that, but, like, how that spread its tentacles out into the larger cybersecurity world, the effects that all of these folks have had on the broader security and software worlds themselves. You know, if you go and look at what those folks have done over their careers, it's pretty wild. I know you had Space Rogue on here. Space Rogue,
a friend of the podcast. Yeah. And it is it is a... Are such a gold mine of the L0pht members, such a gold mine of that cybersecurity history, the how we got here point. Exactly. And it is so important, I think, because in this industry, you do keep seeing so many of the same mistakes repeated. And, you know, and so I do think revisiting that and speaking with L0pht and getting that oral history is a is a very powerful piece of journalism in the in the cyber world. So so definitely, I can see how that's a that's a seminal moment in your in your career there, getting that... Teasing that out. Now on the flip side, do you have a story that got away, one that you really thought you could nail down but didn't quite bring over the finish line?
God, that's such a tough one. There's... You know, I think any journalist will tell you they have... There's a bunch of those if you've been doing it for any significant amount of time. There's there's one that me and one of my colleagues worked on. I don't want it... Like, the problem is I can't really... Because we didn't pull it across the goal line. Like, you
Yeah. I can maybe tell you about it later, but, like, it's it's a pretty good one that I... We had some pretty good information that there was a significant leak inside one of the major software vendors of, like, their bug information. So it was getting out before public disclosure. So you could imagine what the effects of that could have been. You know, you could end up with... Depending on how the leaks were happening, you could end up with cybercrime groups or even APT teams having access to a bug in, you know, software x before even, you know, maybe the development teams inside the company knew about it or before it was fixed, obviously, before a patch is available. So
Yes. Yeah. We worked on it for a long time. We essentially knew we were right and had pretty much everything we needed to do, but couldn't get the last little bits to to really get it into print. You know, it's still one of those things that that me and this person kinda talk about every once in a while and think, man, god, we're this close. You know, we could... If we adjust, you know, we need, like, one more person to say, yep. That definitely still bugs me. I think about it every once in a while, but
Well, yeah. Maybe maybe stay tuned. Who knows? Maybe that'll still come out of the woodwork. I I do know probably for the better that you did wait for that to become fully ironclad, though, because as we just mentioned earlier in our conversation, some of the big software vendors can get litigious. So you definitely don't wanna put out a put out a story that isn't a 100% there on that front.
And that's also, like, the worst feeling as a journalist is if you put something out and then you get told that it was wrong or, like, you got some important facts, like, a little bit...
oh my god. Especially back in the day when it was print and there was no good way to fix it. Like, you know, you can't just go into the CMS and be like, oh, let me fix that typo or, like, whatever. Issue a, you know, an update. Like, you know, fifteen years ago, that wasn't possible.
It was pretty brutal, the corrective that had to be issued. Now it's it's been a it's been a pretty tough decade. You know, obviously, cybersecurity media, it's so important, and the the ecosystem is is still very vibrant. And you have all these amazing sources offering the cybersecurity community news, whether it's free or with a subscription. But, you know, unfortunately, there have been a series of layoffs. There have been some buyouts and closures. Yeah. Protocol recently shut its doors, and more recently, the the Washington Post Cybersecurity two zero two folded into their technology newsletter. Where do you see the future of cyber journalism against this pretty challenging backdrop?
Yeah. That's something I think about quite a lot, honestly, in in me and, you know, other journalists I know in the industry talk about quite a bit because we've all sort of had to adjust or make changes in our careers because a lot of us started in that world where there were big technology magazines that were... You know, had been around for a long time and were stable. And then within a cup... A couple years, that all deteriorated very quickly. So you move to online, you know, and some of us started our own things and and stuff like that. And I was always really happy when I saw something like the the two zero two or those other publications start. Like, great. Let's get more people writing about this. More information is better for everyone. This is a really complex topic. And the more that we can make it, you know, understandable for general purpose audiences, the better off we all are.
When one of us is safer, we all get a little safer. So that always made me really happy. Even if it was a little competition for us, I was fine with that. I do think... And this is, you know, may sound a little self serving, but I do think that kind of the corporate sponsored brand journalism world that we sort of started help at ThreatPost and have continued at Decipher is one of the main avenues that I think is not just for cybersecurity journalism, but for probably tech journalism and some other niches as well is a really viable option because, you know, when we started Decipher at Duo Security at the time, the goal was to democratize information about security. We wanted to make it understandable and and usable for for everyone, not just experts, you know. I'm not an engineer. I'm not an expert. I just, you know, been doing this for a long time.
And most of the journalists that are covering this, you know, some have engineering backgrounds. Most of us are just writers. And I do think that that's one of the more viable pathways for cybersecurity journalism going forward because the, you know, media organizations, it's a tough go. Like, advertising isn't there. The models are just so different now. It's really difficult to see. I mean, even in general purpose media, like, Sports Illustrated just shut down, like, last week. Like, that's been around for sixty years. What are we doing?
Pitchfork folded into GQ. I mean, there's all sorts of changes. Yeah. No. I I hear you. And, honestly, you're preaching to the choir there talking about editorially independent publications that come in under the auspices of cybersecurity vendors in some cases. And I agree, you know, that that is one avenue for getting important information out there. And I don't think that it's a model that automatically taints the the quality of the content. And I I think that's been a misconception. And I think, actually, you've seen in recent years amazing publications emerge like The Record by Recorded Future, like Decipher. To that rising tide lifts all boat point that you made. I think these all are so important for the ecosystem, especially when you consider that some of the traditional legacy media are struggling so much.
I I I did wanna speak to that editorial independence point. You know, Decipher does characterize itself as an independent editorial site that takes a, quote, practical approach to covering information security, end quote. And you are published by this, you know, MFA focused cybersecurity company Duo, which is pretty well known in the community. How do you maintain that kind
of editorial firewall, the sort of separation of church and state? Yeah. We've been really lucky with that. So when we started Decipher, it was myself and my colleague, Fahmida Rashid, who were the two editors at the time. Mhmm. The sort of philosophy at the time was, we're hiring you guys because you're good at what you do. Go do that. We're gonna leave you alone. We want you to give our audience, our customers information about security so that they're aware of the problems. And then if, you know, if we have something that can help them address those problems, all the better. But we just want more people to be aware of what the threats and the the problems are out there. So we were acquired by Cisco not long after that, about a year after we started Decipher, I think, almost exactly a year. And, you know, that philosophy carried over to Cisco, and I'm... I couldn't say better things about the way that we've been treated and how they view us and the editorial independence, several different, you know, sort of managers that we've had over the the years.
Everyone understands that we're trying to get more information into the hands of more people so that people understand what the threats are, what the vulnerabilities are, how to fix them, and that this doesn't all have to be terrifying and scary and everything isn't awful all the time. And there's a lot of bad stuff happening, but there are steps you can take, and there's people out there trying to defend it and trying to help you. So Cisco and the executives that we deal with who are, you know, our higher ups, very clear understanding of what the philosophy is and have been really, really tremendous in in letting us do what we do well.
I'm glad to hear it. I I think it's important. It sounds like these set executives have a high degree of media literacy to kind of understand that, yes. Okay. Just because Decipher isn't out there marketing Cisco essentially products or something doesn't mean that there's not value there both for the for the company, but also, again, to that community point writ large, which which is so important to just emphasize when you have something as tough to market, I put in quotes, as as journalism can be. Now have you ever have you ever considered starting a publication that wasn't about cybersecurity?
Oh, man. Have I ever? I sure have. Like, I have a bunch of different, you know, sort of varied interests outside of, like, you know, outside of technology. You know, I I play a ton of golf. I'd love to do something in golf media at some point, I think would be a lot of fun. I'm like a complete movie nut, so I'd love to do... Like, we do some movie podcasts on Decipher, like, about hacker movies and stuff like that. But I'd like to do, like, some sort of general movie podcast or something. There's a million of them out there, so it's... That's, you know, sort of a crowded field. But writing wise, I don't know. Like, as you know, man, like, writing's hard. Like, it's it's really hard. It's time consuming.
I mean, I also, like, write books in my spare time. So by the time I'm done writing for work and then writing something, you know, some kind of fiction piece, I'm kind of exhausted. So, like, even if I do feel like, hey, it'd be so fun to have, like, a golf media site or a movie media site or whatever. Like, then you think about what all that entails. You're like, I don't know, man. I'll just read everybody else's stuff and be happy.
no. Spare time activity. Now I'm glad you mentioned your your fiction writing. You do have two published novels to your name, Motherless Children and the latest Be Gone. Yeah. How has your experience as a reporter and editor influenced your fiction writing?
Quite a bit, actually. I mean, both stories have a little bit of a security element to them. They don't... Like, the the main plot points don't turn on, you know, hacking or anything like that, but they do have... Like, one of the characters in both books is essentially freelance hacker type who's, you know, involved in the stories. I definitely have used my background to kind of, like, inform the plots of those stories. And just my experience as, like, a... You know, having been a reporter and editor for so long, understanding the way that story structure works and the way to get... Bring people into a story and keep them there, hopefully, and, you know, communicate the ideas that I have over the course of, you know, 400 pages instead of, like, 1,500 words. That was honestly a big challenge for me because you're so used to writing, like, you know, okay.
You've got, like, maybe forty five seconds for somebody to read whatever it is you're writing on online. Right? But when I decided I wanted to write a novel, I knew that I didn't really wanna do a technology based ones. Like, there's a bunch of people that do that kind of stuff really well, but I wanted to kind of, like, step back from what I write about every day to sort of, like, I've always loved crime novels and, like, murder murder mysteries and that kind of stuff anyway. So I was like, you know what? Let me let me try that, see if I can see if I can do it. And I really enjoyed it. So it's something I'm I'm happy I I got to do and got a third one. It's sort of in progress. I don't know. Things take time, but, you know, hopefully in the next
I tend to wait until the end and and see if I can come up with a few that might work and then close my eyes and point to one on a list and be like, yes. Let's let's go with that.
Definitely. Yeah. Okay. I think I'd... You know, I figured out I have one thing that I'm good at, and so I might as well stick with that. I'm not, you know, I'm not writing
Well, you did start off your journalism career covering crime too, which is interesting because there are, you know, quite a few parallels between the cyber and crime world. I'd be curious to hear your thoughts on, you know, what similarities you see between those beats of of violent crime and cybercrime. And, you know, there are there are some places where they overlap, like, Andy Greenberg's Tracers in the Dark book comes to mind of Yes. Kind of the world of, like, cryptocurrency, dark web marketplaces. And you do get these, you know, knock on the door, bang arrests and all kind of wild physical violence that can offshoot from that. What are your thoughts on those two disparate areas of crime?
They're both really interesting to me on a on a... In a few different ways. I mean, one of the things I really liked about when I was a daily newspaper reporter covering crime was it was something different every day. You never knew when you walked into the office or the courthouse or whatever that morning what what the day was gonna bring. You never knew. So that was always cool to me. It wasn't like going to a city council meeting, like, every Tuesday night and, like, you know, you know what the agenda is. So it was always something different, and that's certainly how the security beat works too. Like, you never know even from hour to hour what what you could be writing about or talking about. So I love that. And, honestly, like like you mentioned, in the last, yeah, probably eight to ten years, the overlap between cybercrime gangs and traditional, you know, whatever you wanna call it, real world crime has certainly...
It was always there from the beginning because some of the early, you know, cybercrime groups were associated with, you know, organized crime groups, especially in, you know, Russia and other places, and that's still true. But it's become much more of a a overlap. You know, that Venn diagram is much tighter now, especially with the cryptocurrency world. You mentioned Andy's book, which is amazing. He's written a couple of others that sort of look into that as well. You you turn over a couple rocks, and you're like, oh my god. This is so bad. Like, the connection between traditional organized crime groups and cybercrime groups isn't even a... They're just sponsored by them. You know, they're directly connected now. And it's, you know, it's a less risky play for organized crime groups than, you know, stealing cars or robbing banks or whatever, like cryptocurrency and cybercrime, you know, in general, is just a much...
There's a lower barrier to entry, and it's like the risks of actually getting caught in facing any consequences for it, especially in some of the countries we don't... You know, western countries don't deal with from a law enforcement perspective. Very, very low. So, yeah, unfortunately, the connection is very strong.
Yeah. There's still that sense of impunity in some parts of the world where it's just, people... Criminals feel empowered to carry out some of the worst. I don't even wanna call them... I don't wanna dignify them by calling them shenanigans, but worst crimes. I mean, ransomware in hospitals, attacking our critical infrastructure. It's really... It's grim out there. And you do weigh in on some of these heady security topics pretty regularly with your your own podcast, the Decipher Security Podcast, definitely encourage our listeners to check that one out. You've hosted an array of c suite level speakers. Do any memorable guests come to mind?
Oh, man. That's a good question. Some of my... The favorite people I've gotten to talk to are honestly people that have become friends of mine, like folks that I've had on over the years several times, like Gary McGraw, who's a software security expert, who's been doing, you know, security stuff for almost thirty years, is just one of the smartest and, like, most engaging podcast guests you'll ever have. He's also, like, a world class musician and has all these other, you know, crazy interests. Last year... Oh god. I guess it's two years ago now. Time... Time's moving fast. I got to talk to Meg Gardiner, who's also a crime novelist and was the coauthor of Heat two with Michael Mann, the book that they're turning into a movie. I think I think they've already started filming it as as we're talking.
And, like, I had loved her writing. I just randomly reached out to her when I saw the book come out, and I knew there was some some sort of connection. I was like, would you consider coming on the podcast? She got right back to me. Was like, love to. Let's do it. And I was like, oh my god. I've never been more nervous in my life. Like, she, you know, she couldn't have been sweeter and couldn't have been nicer, but I was so... Like, I quadruple checked every, you know, audio thing, and I was just like, if this screws up, I'm gonna I'm done. I'm gonna be so mad, but that was great. That's the kind of stuff I love just, like, as as an old person who's been around, you know, kind of getting to know these people over the years. I love that kind of historical perspective that informs, like, what we're seeing now. You know, everything everything old is new again. So those are some of the ones that just jumped to mind now. Yeah.
And talking about, you know, circling back to the L0pht conversation, Cult of the Dead Cow was another one with so much sometimes unrecognized influence. And so, yeah, Joe's writing on that has been really impressive and illuminating. I mean, a certain Texas politician is revealing his connection to the Cult of the Dead Cow was was quite a surprise
Beto O'Rourke. Of course. Yeah. Okay. Thank you. I was like, I knew I knew he... You know, people were following his campaign so closely, and then it suddenly emerges that he's just this, like, ex hacker as well as kind of kind of out of left field, to say the least.
we can just stop right here if you're... Yeah. I... This is one of those weird things I didn't even know it was like a a controversy until... I don't know. Like, I never thought about it in college. I never... I was just like, this is how you do it. And then I think at some point in my magazine writing career, one of my editor... Or one of the copy editors kept, like, taking out that, you know, the the final comma or whatever. And I'd see it, and I was like, why why does this keep happening? Like, this is... He's doing this wrong. And then I discovered there's, like, these two two absolutely diametrically opposed camps that are just, like, screaming across the fence at each other. I was like, I don't know, man. It's a little comma. It just makes it easier to read. You understand the sentence better.
I'm I'm not a big sports fan, so maybe this is where I get my rivalry in is with the Oxford comma debate, and I can I can have something to cheer for and against? But but thanks for being honest at least, even even if you're wrong. I I appreciate the transparency there.
Finally, this is something that we ask of all our guests of the podcast, which is what's something that we wouldn't know about you just by looking at your LinkedIn profile?
Oh, god. Yeah. There's probably a lot of things. I mean, one interesting thing is, like, when I was a kid, we lived on this little tropical island called Kwajalein, which is part of the Marshall Islands, which are like... If you fly to Hawaii, then fly another six hours Southwest of Hawaii, you'll get to the Marshall Islands. It's a tiny little speck in a chain of islands called the the Kwajalein Atoll. It's essentially an army base... Army installation. And we... The US army did a lot of missile testing there during the mid century. And my dad was in the army and then he was an engineer for IBM. So we lived on this tiny little island that's literally like, I wanna say it's about a mile and a half long and like half a mile wide. It's one of the most remote places in the world and... But I loved it.
I was like three, four, five years old when we lived there. So I was just like running around with no shoes on, you know, like, having the time of my life, like, not going to school, having a great time. It was amazing. I loved it.
So Nice. So now now... Shoot. Now somebody probably knows some security question, in one of my... But so it goes. Well, thank you so much for sharing some of your your insights on the security media landscape and your experiences. Really appreciate having you on the show here.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack testing platform to their own customers. This approach helps optimize Synack partners technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
