Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Robert M. Lee on hacking industrial systems, pay transparency and oysters
Guest:
Robert M. Lee
Published:
Updated:
Duration:
62 min
Episode summary
Dragos CEO and founder Robert M. Lee has been talking about cybersecurity risks to critical infrastructure long before threats to utility operators and water plants were making headlines. In this episode of WE’RE IN!, he discusses the ongoing dangers to the grid from nation-state hackers and ransomware gangs, but also the progress the U.S. is making to better secure its most vulnerable assets. And there’s also a great conversation about pay transparency that anyone working in infosec will want to hear. A few more reasons to listen:
It’s a candid and sobering interview with one of the world’s leading experts on industrial cybersecurity.
You might be surprised how Dragos approaches pay transparency, hiring and job interviews.
Better understand how critical infrastructure operators should approach cybersecurity differently from enterprise technology.
OT security is about systems and physics Robert frames enterprise IT security as data and system security, while industrial security means understanding the plant's mission, system-to-system interactions and what physics allows an attacker to do.
Start with board-level risk scenarios Boards should agree on scenarios such as a Ukraine-style grid attack or OT ransomware first; protection, detection and response controls follow from that, not the other way around.
Frameworks lean heavily on prevention Dragos found that about 90 percent of controls in regulations and frameworks are preventative, leaving organizations without the visibility to detect and respond in OT environments.
Air gaps rarely exist in modern plants Plants that were disconnected in 1998 are now tied to cloud services, vendors and remote monitoring, so the old assumption that OT is isolated no longer holds.
Pay transparency removes negotiation bias Dragos lists exact salaries, does not negotiate offers, shows internal pay bands by level and raises existing staff when market rates rise.
Notable quotes
Everything that the adversary wants to be able to do is bound by the world of physics.
More power sites have been taken down from well intentioned IT people than Iran, China, and Russia combined.
Air gap is a great security control, if you could actually maintain one and have one, but if you were running a modern business, it's impossible.
If you can do that position, then you should be getting that pay. Let's take out the negotiation of it.
Questions this episode answers
How is industrial control system security different from IT security?
Robert says IT security is mostly about protecting data and systems, while ICS security is about systems of systems and physics. Defenders need to understand the plant's mission and how one system can affect a physical process. Read this section
What was one of the first real cyberattacks on an industrial system?
He points to the Maroochy water services incident in Australia, where a fired insider used radio equipment to manipulate the sewage plant's control system and release sewage into rivers. Read this section
Why do OT security programs focus on prevention instead of detection and response?
Most standards are prevention-biased, and OT teams long believed their environments were air-gapped. After the 1998 presidential directive, spending went to the enterprise side and was never revisited as plants became connected. Read this section
Is ransomware in critical infrastructure worse than reported?
Yes. Robert says Dragos has seen close calls and unreported OT ransomware cases, enabled by poor inventory, no monitoring and forgotten remote access paths. Read this section
Do attackers need ICS-specific malware to disrupt industrial systems?
Usually not. Only a handful of ICS malware families exist; most cases rely on IT malware for access and then native functionality in the environment, with malware mainly needed for long-term physical damage. Read this section
About the guest
Robert M. Lee is the CEO and founder of Dragos, an industrial control system (ICS) cybersecurity company he started in 2016 after helping investigate the 2015 attack on Ukraine's electric grid. He began his career in the U.S. Air Force, was tasked to the NSA to hunt for unknown state actors targeting industrial environments, and at the time of recording also taught SANS courses and sat on a World Economic Forum committee on OT cybersecurity.
Is that Dragos, or should it be Dragos? Dragos? Anyway, we'll figure this out in the episode. Robert is one of the leading experts on industrial control systems, cybersecurity, and the many digital threats facing utility operators and other critical infrastructure.
We'll get his take on that and other issues in infosec ransomware and issues like pay transparency and the cybersecurity diversity problem. First, a quick word from our sponsor.
WE'RE IN is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers twenty four seven pentesting, intelligence, and vulnerability management from a global network of vetted and trusted researchers. Their work is enhanced by smart technologies to accelerate your critical cybersecurity missions. Synack gives businesses the best chance of finding every vulnerability that matters. Find out more at synack.com. That's synack.com.
I think I think it's a fantastic organization to begin with. And and one of the things I was originally looking at initially was was you as well are also a former service member. Is that is that correct?
No. I mean, it does. It does. Right? Like, I've got, I've got plenty of friends who are currently still serving in the Air Force. It's just a different mission.
Just signed up for the test it out phase. That's great. And so thank you for your service. I wanted to make sure I said that. And, again, it's a pleasure to have you on the show, so thank you so much.
Yeah. We're very excited to get to to chat with you today. I wanna start out with a pretty simple question. Could you clarify for us exactly how you pronounce the name of your company, please?
It's good. They're good oysters. Like, they're like, they're really good. They're not like Maryland fresh like oysters, but charbroiled. They're they're they're pretty good. You know?
I... The the confusion of the oysters only comes on Google reviews. And we'll get it every now and then we're like, super nice service just didn't really like the oysters or something like that'll be like on our like HQ page, which is hilarious to me. We've had a number of oyster calls in our instant response call line. That's always fun. The pronunciation, I don't care. You know, there's a ton of people pronounce it Drago. My my thing is if there's not expletives, you know, around it, I don't really care how you pronounce it.
Nice. Totally fair. So getting into the actual more interesting questions, I suppose. So I want to talk a little bit more about you, your background. You started focusing on industrial control system security while working for the National Security Agency, kind of a while before a lot of others were really paying attention to cyber in this area. And I thought it would be pretty useful to start by talking about some of the unique challenges facing critical infrastructure providers and maybe like the key differences for security when you're, you know, considering a utility company versus a company like Facebook or Bank of America, for example?
Yeah. Sure. So, yeah, it's been really interesting to see it evolve for sure. So I started my career, as mentioned, the air force side of the house, but I was tasked over to the NSA pretty early on, and they didn't ask me to focus on ICS. They... What they asked me to do was go find the unknown unknowns. And I was like, what is that? And they're like, we don't know, but Rumsfeld's really big into it. I was like, oh, okay. You know? And so I was was like, go find the state actors we're not tracking today. And I like, yeah, no problem. And so I had a background in building control system, not an engineer by trade or anything. But but I spent a short time doing like humanitarian projects in Cameroon and other places building like water filtration units and wind turbines and things like that. And and so I really liked control systems like, so what are what are we doing on control systems? They're like, what are control systems? Like, oh, god. You know, they're they're everywhere. You know, the the stinky things that you wanna say stunk those those submarines, that... That's them. The floaty things you wanna keep floating, that's that's on there too.
Like, you know, it's it's everything. And so they just kind of unleashed me to just say, Ash or whatever, you know, dumb lieutenant, go for it, have fun. And, and, you know, what I found was we had this view in the government, I think this transcended to the private sector as well of well, there's not really industrial threats. Yeah, so I focus on it, we're not seeing any attacks. But when I dug in, the reality was is we weren't collecting data out of industrial environments. We were collecting in the enterprise IT networks expecting to find industrial attacks. So that doesn't make any sense. It's like the old intelligence parable when the drunk guy is underneath the the light, and he's looking for his keys, and a cop comes by and says, hey, what are you doing? He's like, I'm looking for my keys. Like, okay, well, you know, I'll help you and then after fifteen minutes or so, he's getting pretty frustrated in this dark alley. He's like, what's going on, man? Where'd you lose your keys? He's like, oh, over there. Why the hell are we looking in here? Well, this is where I can see.
You know, and so that's that's kind of the problem that has existed. So we adapted our collection, started getting into industrial networks, we started finding everybody, not only the the state actors that you expected to find, but state actors, we didn't even expect to have cyber programs at that time. We're already going after industrial environments. So it's pretty interesting from there. When you talk about the kind of the key differences, I'm sure there's plenty and there's plenty of skill sets that you have in IT security that'll help you know, IT security, don't get me wrong, but but there's a real necessity to understand the mission. It's probably the first thing I would say, What's this plant in the business of? Is it a water filtration plant? Is it a rail switching yard? Is it a power generation? What are we trying to do here? So a lot of IT security folks, and I don't mean this in any wrong way, but a lot of IT security folks have our biases. Right? Everybody does. You know what works. You've done it for twenty years.
Hey. I'm gonna come into this place. And of course, I wanna ask about a patch, you know, management system. And you're like, no. No. No. Stop. Like, what are we trying to solve here first, then figure out what actually makes sense based on your skills and and what brings in and the unique ways you need to do it. And and in a big hand wavy way, I'll say that IT security in the enterprise writ large is data security and system security. And those are very hard and they're very important. But it's how do I protect the data encryption, encryption at rest and transit DLP, whatever else? How do I protect my systems, patch it, product security, endpoint protection systems, whatever else? How do I make sure I keep my assets off the internet? So, know, tax service and all that kind of stuff. But basically, how do I protect the system, how to protect the data? And that drives a lot of what we've seen in product security and so forth. When you get into industrial security, whether you call it OT for operations technology or ICS, industrial control system, it doesn't really matter.
Industrial security, when you're dealing with that, what we care about is systems of systems security and physics. Everything that the adversary wants to be able to do is bound by the world of physics. Like I'm gonna open up this valve and kill 30 people. Well, no, the valve doesn't open that far. So that's not possible. So I don't care. Or, hey, actually, if you mix those two ingredients together, you're gonna create an explosion that matters a lot. And then you care about system to system. So I don't care that the control system itself, like the little controller, I don't care that it has a vulnerability that lets you have a password on or whatever. Okay, what are gonna do with that? But can I get on an engineer workstation and change the logic on a controller in such a way that's gonna impact a valve that impacts the physics, okay, that system one plus system two plus system three, that matters? And whether you do it with the vulnerability of malware or native functionality that's resident in the environment, doesn't matter. If you understand the operations of the engineering and the mission of that environment, and you can then learn the systems and navigate around that system to system security, you can hurt some people.
And so that that... That's the... To me, the key difference is what are we trying to accomplish and break away from the system and data security to understand the systems of systems.
So in an operational technology perspective or or ICS systems attack, right, what's one of the earliest compromises that come to mind for you that really took advantage of these kinds of devices?
Yeah, probably the I mean, there's so many like stories, and so I'm gonna give you answers, and there's gonna be someone online. It's like, well, what about the Trans-Siberian Pipeline? No, that's completely BS. So there's there's a lot of stories out there that are fake. But the probably one of the earliest ones that was real was an insider, and it was the Maroochy water services plant down in Australia. Was essentially a contractor or an employer, I don't know if his employer contractor, but he got fired. Yeah. And he was very unhappy about that. And he got some equipment basically, you know, equivalency of Radio Shack, going and getting some like RF type equipment to be able to access the control systems of the water plant, the sewage treatment plant, and he was able to manipulate the control environment to reverse the flow of sewage to empty it out into the rivers there in the town. And that to me is a classic. He knew the inside knowledge, he had an understanding of the operations and engineering.
And so then it was access and manipulation of systems of systems to be able to impact the physical environment and that was, I don't know, was the either late 80s early 90s, probably early 90s and so then from then on there was a lot of cases, but never really anything public. It was very hush-hush stuff of, hey, we have something going on here with the logics changed across 20 substations. Can you come in and investigate? It was it was stuff that you didn't really talk about. And there was some of that reason that they didn't get talked about was quite honestly just the media would overreact to everything. A phishing email got sent to a power company. They're gonna take down the grid. And it's like, there's not one grid and that's not how that works. And so there wasn't really an environment to have those conversations, wasn't there is no benefit to doing it. Probably the next you know there was compromises and espionage, there's a lot of espionage, If you go back to even the old, like, Night Dragon cases or operation Aurora and so like that with the RSA breach and similar, a lot of the companies that got hit in a publicly named, like Dow Chemical and these others, the APT one story from Andy, it hasn't...
Well, you'll you'll read those reports, there's not a whole lot of mention of industrial and SCADA and DCS and all that stuff. But if you look at what they were taking and why they were targeting those companies in the first place, they were getting into those environments. But the people may have not had the skills to go into those sites, but also as big cultural divides that they weren't welcome in to the plant inside of the house. So there's a lot of historical espionage cases that had an industrial flavor that just wasn't properly explored. But the case that everybody says, and of course, we can't get through any discussion of ICS without dropping the s word, but you know, Stuxnet comes up in two thousand and nine, twenty ten timeframe.
It it it had a net benefit in some ways of getting people interested in industrial, so that's good. And... But there was also this sort of like, well, of course, The United States and Israel could do this. And, of course, they do it to somebody else, but nobody could do it to us. So so nothing really changed after that. There was interest, but nothing really... I don't think anything was massively changed. The one that really changed things in a way... The next one that was probably pretty big was 2014. It was an attack on a German steel facility. It caused massive physical damage across the plant, but the one that really changed the discussion was the twenty fifteen attack on the electric system in Yeah that was the one that I got to be involved in and that was cool But that one changed the discussion for a very simple reason and it was at the national policy leader level, there was always an expectation that critical infrastructure was a red line and yeah, you know, okay, a nuclear enrichment facility, but it's really a military facility that count, you know, that doesn't count for anything.
But civilian electric power, what? And so it was sort of this head fake moment for a lot of the community. And when it happened originally, I remember... And I don't... Again, I'm not trying to put anybody down here, but I remember the US government's original response was, don't worry. That can't happen here. And there's a lot of downplaying of it. And Mike Assante, Tim Conway, myself did kind of a roadshow out in the community of, oh, yes, it can. And this is exactly the way that it would look. And some elements may be different in the recovery, may be harder to do on the front end, but like manipulating control of a distributed control system or distribution management system. Of course you can. And you know a lot of credit to the power companies because of the power companies and their CEOs that originally came out and said hey Congress, White House, we hear you but yes you can like you could absolutely do that here and they're the ones that got the narratives changed.
Then it just accelerated. 2016, see it again. 2017, you see the first ever cyber attack to target human life take place in Saudi Arabia. 2018, '19, 2020, you see, you know, dozens of compromises across infrastructure in the way that would not be espionage, but would actually be prepositioning. 2020, you have solar winds, everybody's talking about the IT side of it. But actually, that was, you know, there was OEMs, original equipment manufacturers are getting compromised, you had an adversary have to remote bidirectional access to gas turbine software systems across the planet. And it's just it's kind of just blown up in the sense that people are realizing like, oh, we haven't done all the things we thought we did at a time that the adversaries are going, Oh, well, there's not a whole lot of reasons not to do this. Know, there's no, you know, warheads on the foreheads coming from compromising an electric system, all this bluster that's been done over the years.
No. No. No. I think I think this is a completely viable target for geopolitical concern as well as intellectual property. And so that... That's that's kind of where we are today.
So I think, to your point that there have been a lot of misconceptions around how this affects, whether it be IT or OT and how it implements together. We're seeing an incremental shift in how individuals ultimately think about this, right, with MITRE developing the industrial control system sort of implementation that can be utilized for testing these devices. And then, of course, with with with you founding the company Dragos and and then with SANS creating courses that you, by the way, happen to be teaching on some of them. What do we do? Right? How do we prevent this stuff from an industry perspective? As an executive, how do I how do I focus more on these things if these things are in my environment?
Yeah, so the first thing that must happen is there's got to be a board level conversation. And you can you can get your C suite aligned first, that's fine. But but trying to solve it from buy a product, build a process, hire a person, you got to get aligned on the risk first. And that's going to be inherently a board conversation. And the mistake I see most companies make is they think the boards are stupid. Quite honestly, they think, they don't get cybersecurity. And we gotta we gotta we gotta put it into FICO score or something. Like guys, like they deal not only with risk scenarios all the time, they deal with like gap accounting of revenue. Like you tell me gap accounting is not complex. Okay. Like they they're smart people, you just can't use your jargon. And so I don't like when I see folks get in front of boards and be like, there's 300,000 scans in the firewall. And we see here's our phishing protection. And here's what we're doing on VPNs is like, stop.
What's the scenario? Are we a power company? Should we be prepared for a Ukraine like scenario? Are we a manufacturing company, we should be prepared for an espionage scenario as well as a ransomware scenario? Like what are the scenarios that we want to build in, get aligned on the risk, then your C suite and your CSO can come up with what are the protection, detection, and response mechanisms that we wanna put around that. Maybe we choose a framework like this, cybersecurity framework to be able to, you know, ground the conversation. Whatever it might be, then we can figure out what what the actual mechanisms are. But probably the biggest mistake I see beyond that is right now, and this actually is what's driving a lot of the shift. Right now at the board level, they're getting views in a cybersecurity. There's no critical infrastructure company that hasn't been talking about cybersecurity for the last twenty years. That's that's that's not new. But they're used to getting the here's our patch rates, here's our detection rates, here's our NIST cybersecurity framework rates.
Like in a good company, they're getting all those things. And they go, okay, yeah, yeah, yeah. No, we're good. Why are we talking about more investment? And I had this experience recently in a fortune fifty board, I got invited in to come brief on the threat landscape kind of stuff. And CEO, super smart guy, great board, CISO, great CISO briefs that exact view. Here's the... All these things and this and all this and look how great and wonderful we are. And it's like, hey. This is great. So the CEO turns to me like, see you, Rob. You know, it's kinda like showing off like, what do you think about this? And I was like, I think your team needs lauded. They've done a lot of amazing work, and they're and they're absolutely doing the right things. I I would have told them if they weren't. I was like, they are. However, I called them the CS, and I was like, are you saying enterprise like the enterprise? Enterprise? Are you saying enterprise like enterprise IT? He said, Well, IT. And the CEO was like, Eyes just opened.
I was like, Wait, hold on. Do you mean that doesn't cover our plants? And he was like, Yeah, no, no, no. That's the enterprise IT. And it just like the board erupted. And so there is an expectation at most companies that all of these things are being done. So why are board members, why is the president of The United States last year coming out with an ICS specific national security memorandum? Because they never thought they needed to, but it turns out they had to. So we've been talking about cyber at a presidential international leader board level for a long time, but they never knew they needed to differentiate between IT and OT. And now they're realizing all the resources have been spent on the non revenue generating side of the business. And they're going, holy crap, what's our ot cybersecurity strategy? So the first thing is to make that awareness available, then get aligned on what the risk scenarios are, then you dig in and go, okay, what are those controls understanding that most of the standards, frameworks, regulations, whatever have a strong prevention bias.
We did some work on this where he looked at every single regulation and framework out there and found that about 90% of all the controls were preventative in nature, patch passwords, AV, you know, that kind of stuff. So there's a lot of prevention bias in these standards that you never get to controls around detecting and responding, which means then you don't even have the visibility of what's happening in the environment, which means you don't even know what's in your environment, which means you're not applying prevention appropriately or watching it and atrophies over time anyways. So so for the CSOs, it's not only understanding that OT is different, but understanding that a lot of the frameworks we might be using are pushing us towards a very IT centric approach that even in the IT environment is probably pretty legacy.
I think that's pretty scary, right, from an executive's perspective, especially when you are running a company. You're dealing with a lot of the business aspects. And when you deal with these things, you have an expectation of, like you said, of of the enterprise being taken care of from the divisions that should be controlling those things. And to your point, when you first got started in this from the air force, you know, it's find what you don't know that you don't know. And and that's a scary aspect when it comes to, executives because they're relying on the individuals that are running the organization to inform them to, to help them to understand where the gaps are. And in a lot of in a lot of cases, with this not being such a hugely, focused on area within cyber or within the industry as a whole, it's left this weird gap.
And it it... It's exactly why I came back from Ukraine. Like, I... And I don't mean this against your company or any other company. We're all love each other. But I have generally never in my life been like, I want to start a software vendor. Know, I always remember being on the client side and being like, here's what's coming in the roadmap. I'm like, no, it's not. This is how we use AI. I'm like, it's snake oil, know, like I've never wanted to be a software vendor, But I came back from Ukraine and did all these briefings. And then as they started talking in the companies, the CSO was like, oh, that happened because they didn't have a patch management program and didn't have AV on the SCADA system. Like, what are you talking about? And so it was out of a very, like, strong desire for my son to have lights and water when he grows up. I was like, oh, we need to make a software company to, like, codify knowledge on this, and we're also gonna go have smart people on staff to do, like, response and things like that to inform that. And so, yeah, you're you're spot on of of of where that came from.
I have... You mentioned something that I wanted to, like, just kinda get more information about. You said something about how, like, in particularly in industrial security, there's this focus on like proactive or preventative. Like if there's a focus on security, there's an emphasis on this proactive preventative approach, but a lack of emphasis on detection and response. And so I have a background in mostly application security. Industrial security is something that I still have a lot to learn on. And when you said that, it got me really interested and curious. Like, why is that? Why is there this disconnect? Because it does seem like a lot of other areas of security, there's plenty of focus on detection and response.
Yeah, I think if you look in the 1% of the community, if you look at the larger companies out there, you will find that they are doing prevention, detection and response. And there is a lot of discussion. All get involved in the infosex circles, we talk about detection and response, it's some of the sexier stuff you get into, right? It's fun. It's exciting. Even though prevention, there's a lot of the hard work you gotta do. But if you actually look at the standards in the broader community, not even IT or OT right now, it is extraordinarily prevention bias where, you know, whether it's from the NISA risk free framework, the top 20 critical controls that come out of CIS, you look at, you know, NERC CIP on electric power regulation side of the house, whatever it is, it's all preventative or heavily preventative. There's a couple reasons for that. One, sometimes we've talked ourselves into like a pound of prevention is what you know, it's like, okay, whatever. There's some like anecdotal crap that's got thrown in there. Some of it has been well intentioned of, hey, look at all these attacks, how do we stop the attack?
And it's like, Oh, you should have used multi factor authentication, which is an awesome control. And but people don't have the larger discussion of like that. And I hate to use the buzzword, but like that kill chain kind of view of regardless of the stopping the attack, what all places did we have an opportunity to disrupt it to collect data and understand it and to respond to it. And so I don't know that outside of like leading companies in general, that people are actually all that focused on detection response, it or OT. In OT, though, it's been magnified by the belief for a long time that those environments were disconnected, that that fuzzy word air gap has been thrown out time and time again, and gets defined a million different ways by people. But it's not real. Regardless, if you're not operating a nuclear power generation site, you don't have an air gap. But either way, they did exist at one point. And and, you know, not to go on too long of a diatribe here, but if you go back to 1998, presidential directive 63 came out of the Clinton administration and said, you need to protect critical infrastructure.
And they said, hey, asset owners and operators, our critical infrastructure is vulnerable to cyber attack. That, you know, that doesn't seem like a sexy statement, but that's a big statement, especially in '98. And it's a big statement for a country, a leading superpower to say we know we're vulnerable to cyber attack. That's a big message to our adversaries. And they said, look, as an asset owner in the private sector, you operate our electric water, oil and gas, you know, manufacturing infrastructure. It's not government owned. We can't do anything about it. Therefore, if you want to go reduce cyber risk from a business impact, you do as much or as little as you want. But you can't skirt your responsibilities from a national security perspective. You got to do enough on the national security front. And when that happened, there's not a CEO or board out there that said, Screw them. You know, they all said, Oh, let's do it. Let's invest in cybersecurity. And they turned to their staffs, which were generally at that time CIOs. They didn't have a whole lot of CSOs that were running around the companies at that point.
Were some, but not as many as today. It was all well intentioned. None of it was malicious. The CIOs went to their security staffs, which were just sort of spinning up, and they went to their VP of operations and plant managers and so forth. Well intentionedly, the plant side of the house largely said, What are you talking about? Like, We're not connected to the internet. We're not using the applications you're talking about, like you've got a limited budget and a whole lot of work in front of you. Why don't you all focus on that? Disconnected, the risk isn't really here for us. And so immediately, everything got started spending on the website, the domain controller, the enterprise side of house, the PCs, etc. And they never revisited that. And in 1998, that was probably true. By 2006, 2007, a lot of those environments are getting connected up. By 2015, it's a buzzword, but we had that whole digital transformation thing starting to happen.
And that was where these plant environments really were taking advantage of hyperconnectivity, cloud resources, interactions directly to the vendors and the supply chain for optimization, predictive maintenance, turbine monitoring systems, etcetera, etcetera, etcetera. So at one point in time, it was a well just disconnected and keep it disconnected. And we're okay. And that's a prevention thing. The reality of the business is you can't do it. So some people look at an air gap and go, Yeah, that's stupid. No, actually an air gap is a great security control, if you could actually maintain one and have one, but if you were running a modern business, it's impossible. So let's get it off to the side and go, well, now that we have all this, what else do we do? Some of those preventative controls make sense in OT. If you can roll out multifactor authentication or remote access, you should be doing it. But then what are we going to do to get network visibility and monitoring to see system to system interaction to communications and how do we respond to this?
And more importantly, I got to be aligned from a board level on down on what those response scenarios need to be. What are the questions we're going to need to ask from a compliance, legal and regulatory, business risk, national security risk, etc? What are the questions we're going to ask in the response, which is gonna determine what kind of response scenarios we need to plan for, which is gonna determine what collection we need in the first place, which is gonna set our detection strategy, which then should inform what we need to make sure we prevent that we don't have to deal with. A lot of people go, let me roll in my prevention, then I'll get to detection, then I'll get to response. And by the end, it's all misaligned.
Right. It reminds me of like, I think there's been some shift at least. I feel like something that I've started to see a little bit more in the last few years from my perspective in cybersecurity is this emphasis on like threat modeling and risk based testing and just security in general, right? Like this risk informed perspective. And it sounds like that's even like it's important in every industry. Like it's really so important to know. Like you've talked about like, okay, we can do all of this, but like why? What's the most important? What's the what are we actually securing? But it sounds like that's just so much more important when we're talking about industrial security.
Especially because many of these companies are very mature companies, but they haven't gone down that OT security journey yet. They're new to it. And we don't have time to reinvent the last twenty years of InfoSec. It's got to be more targeted, more tailored. Hey, I don't care about your 20 controls. Are the five that are gonna be most impactful that we can get this rolled out quickly? And so taking a risk based approach and having an understanding of your threat model is incredibly important to that. I remember going out a couple years ago doing assessment at a facility back back when my teams would still let me do an assessment. Now, they give me the elevator eyes. I'm like, okay, sit down and stick to power. For you guys. Anyways, back back when I was relevant, I I I went and dealt this assessment at a at a hydroelectric facility out in the middle of nowhere. No CCTV, nothing else, gate guards, everything was there but it was out in middle of nowhere and we go in and there's a sticky note with a password on the human machine interface that allows somebody to interact with the turbine piece of the hydroelectric facility.
And the IT security person from the company I was with was like, Oh my gosh, this is a write up. I can't believe they've done this. I'm like, Why? Why do you care? Like what? It's a password of the sticky note. I'm like, so? Like, well, somebody walks in here, they get access to the system. I'm like, who's walking in here? And like, oh, we have pentest to do that. I'm like, hold on now. Are you developing your threat model on pentesters, or are you worried that Russians are paratrooping into the substation and like, bypassing your gate guards and getting in and like a sticky note, we got it like it. The biggest risk here is that operator who needs to be on top of a safety critical device, that if he's not monitoring it, could have a life impact, can't access the system. So he's either going to not put a password on it, put a crappy password on it, or write the complex password down. And in these scenarios, I want him to write the complex password down.
And so it you know, sometimes we, we get trained by the wrong inputs instead of thinking about what is the risk? What is the point and what is the threat model? If you're a power company, and you haven't planned at a tabletop exercise at a board level and already implemented your controls on the two different Ukraine scenarios, your testimony in front of congress when you get, called up is gonna be bad. If you are an oil and gas pipeline or a manufacturing company and you haven't had ransomware scenarios at a board level with an understanding of what you're doing specifically in OT, your liability and your lawsuit is gonna be bad. Like, there's certain ones that are obvious. Do I care that there was new research at DEF CON released about hacking Bluetooth to spin up a wind turbine and then it caught on fire? I don't care at all. Like, I I care that those other scenarios have literally happened, and now you're in trouble if you're not covered.
You're behind if you haven't done those. But have you not rolled out s bomb discussions yet because it's now interesting and emerging? That's okay. You got time. Is it interesting? Go for it. Yes. If you haven't done it, your testimony in front of congress will be okay.
Don't worry. To those points that you just made, and there was something that you mentioned a moment ago, which was, discussing national security and have you done enough? Are you doing enough, right, with with, regard to national security? And so I just kinda wanna pose that question to you based off of your vast experience as well as, you know, the many operations your company has conducted since then and continues to perform for the industry. Are we doing enough from a national security perspective currently?
Yeah, the answer is no. However, there's lots of nuance there. Right? And I think what normally happens is when somebody like me gets in front of Congress or the press, whatever else and is able to say no, that's the thing that gets captured. I'm gonna I don't know if you hear the dogs in the background is going to disrupt everything as things walk by, but we can keep going. Congratulations to all the listeners in the world, I have dogs. But when I say no, people sort of capture it there and go, Oh my gosh, these companies are not doing enough. And that's not the right takeaway. The answer is still no. But sometimes there's economic drivers, regulatory reasons, all sorts of reasons that it's not. As an example, if you're a investor owned utility, you're one of the largest 60 to 70 utilities in the country, and you're you've got the budget, and you've got the resources, and FERC has come out and said, Hey, you can do rate recovery and all these things, you better be doing a lot.
But are you the one of 55,000 water treatment facilities or water water plants in general? It's not just treatment, but water plants in general that, you know, your Oldsmar, Florida. So Oldsmar, Florida Oldsmar, Florida got called out when an attacker tried to get in and poison the citizens in Oldsmar, Florida through an attack on the OT side of the house. They're a small site. They probably don't even have an IT staff, let alone a security staff, probably sharing an IT person with three or four other water utilities. That's pretty normal. Why? Because they're not able to increase the rate of the water bill. And if you're trying to explain to a small town, well, Russia could do x or China could do y or Iran could... It's not gonna have them increase the water bill by a cent, let alone 10¢. And they're literally not able to. You'd wanna complain about pipelines. Okay. Well, pipelines in certain regions, because they have a monopoly in certain areas are rate regulated.
They're not allowed to charge more than a certain set price for that gas. Well, guess what comes out of that security. And so there are some companies that are negligent that we come across. They're rare though. And there are some that should be doing a heck of a lot more. But there's a lot more that want to do more, but the system isn't allowing them to do more. And that's where we need to have conversations about roles and responsibility of government and how do we message this? Do... You know, every single utility, gas, water, and electric has a public utilities commission inside that state that regulates how much they spend, what they spend it on, how much the rates are, etcetera. Does every single company need to go to every single PUC in every single state to have this conversation? Couldn't Or the federal government lean in and go, hey, we're not trying to, you know, disrupt your state autonomy, but let's have a inter... Like, let's have a national discussion about how we wanna think about the cybersecurity investments for OT that manifest anything into safety and reliability of the services and goods we provide.
So speaking about testifying in front of Congress and and ransomware, I actually wanted to talk to you about this. So last year, you testified in front of Congress about the ransomware problem and specifically how it's growing. It's a growing threat for critical infrastructure. And you said at the time that Dragos responded to numerous ransomware incidents in OT that have gone unreported, which is really interesting to hear. So considering that, is the general problem of ransomware and the risk that it poses to the public, is that a lot worse than, you know, we realize?
A lot worse. Yeah. And so we've had a lot of close calls on some pretty important infrastructure as well. Look, so again, without... I never like to be the fear guy. There's there's a lot of good stuff happening. And again, you know, hug a lineman and, know, say thanks to the IT security teams that are usually at these sites working there. They're understaffed and they're they're keeping lights and water on. But when you look at these companies and we take some of the things we've already talked about here in this discussion today, heavy reliance on prevention, a misalignment sometimes of the board, a heavy belief that environments are disconnected. Well, ransomware is just doubling down on those beliefs versus the reality. And so it's not anything different half the time, but it's, oh, this environment, nobody has an understanding what's in it. Nobody's monitoring it. Nobody knew what was in the environment, their inventory, and oh, there's rogue access devices.
And, hey, that VPN that got stood up for that connectivity that we didn't even think about. All these things now get taken advantage of by ransomware actors. And the next thing you know, you've got ransomware across your operations environment. And sometimes it's not all that impactful. And sometimes it's a close call, and we're lucky the infrastructure stayed up. Sometimes the infrastructure didn't stay up, but those companies were able to move things around to have the production line of the manufacturing, whatever else still produce what was supposed to be produced but somewhere else sometimes didn't happen and there's some interesting SEC filings out there around shareholder value and so forth that could be tied back to hundreds of millions of dollars in damages related to ransomware cases that aren't all that public. And to me that the initial response I get from a lot of people is why and I think we've covered that pretty well. The second response I usually get in this one from Congress as well is well then they need to report those things.
And and there was this whole discussion in congress, bipartisan support for instant response reporting bill last year that didn't pass. And I'm glad it didn't pass. And I'm probably one of the few that's saying that publicly. There's a lot privately, but I was saying it publicly. It did have bipartisan support and there was some really good and smart people out there at CISA and others who I like and respect that were really advocating for this. But my I had two fundamental problems with the reporting bill. Number one, it wasn't scoped very well Because we were telling people to report an incident, then it gets into what's an incident? What's this? And what's that? And people tried to play the tech game of well, if it hits this type of system, or it's ransomware, if it's a state actor, and there's perverse incentives that can happen. And then there's things like, don't identify if it's a state actor or not, because then we might have to report this or should we report every scan on the system or should it only be exploitation?
It's the only only exploitation of critical systems. And so it gets into all these fundamental questions, which I think we could have bypassed by saying, Hey, you're a critical infrastructure because of the goods and services you provide, not the types of systems you have. If there's an incident that can impact the services and goods you provide, you gotta report that. So like scoping it differently could have been very easy, and there's already precedents for that and regulations like NERC set for that. We could have just copy and pasted. The other problem I have though is what's the value? And people are like, wait. What do you mean? Like, okay. We reported it. Now what? What what intrinsic good is there to come to the public or that company from reporting an incident to the government? What's the value back? Because there's resources getting dedicated that's gonna manifest in your light bill or your... The cost to your manufactured good. I know What's the value?
I know there are some organizations who also have an adverse view of the government for whatever reason. Right? And they feel like, look, if I'm gonna report this stuff, I'm gonna get fine. I'm gonna get, you know, maybe maybe charged with something. I'm gonna get looked at as being negligent or something worse. And then there are other companies who say, look. I wanna partner with the government. I wanna share my information. I want to collaborate, and I wanna build a better infrastructure across the board. How do you bridge the gap, right, between individuals or companies, organizations who are just afraid to share information be... For for fear of retribution, to the companies who are bought in?
Yeah. You have to actually listen. And this is the problem for the government. And and by the way, when you say the government, as you well know with your prior service, what we're talking about post office, we're about FERC, what we're talking about. Right? The the government. But when we talk about government, there's a lot of different agencies and a lot of different organizations, a lot of different priorities, and there are some who have consistently been useful and helpful, and there are some who've consistently gone and tried to find those fines and retribution and so forth, and so a lot of the companies out there that have not tried to partner with the government and kept them at arm's length have real documented experience on why it was bad for them in doing that and I've been a part of a number of incidents where they contacted the government and it was bad and it it went very poorly and there was no value to anybody in bringing them in. And I've been in part of some where it was a wonderful experience, but it's hit and miss.
And when it's your company and your shareholders and your community, a hit and miss, probably not the time to have that discussion during an instant. And so there's a lot of apprehension. So to me, bringing people together and listening on what are your actual concerns, let's have a closed door real understanding of the problem and trying to get through that would be helpful. And look, I think a lot of times it's pleasantries and well, we talked to the CEO and they really want do, okay, well, does the stock analysts think to have to deal with this? Like it's not just go talk to the exec. You know, and I think if you were to ask me, and as Congress did, does DHS, an example, CISA, I'm a big fan of CISA writ large, but does CISA, DOE, DOD, etcetera, have roles and responsibilities to the private sector and critical infrastructure and value add? My answer is yes.
But my immediate question is, what are those roles and responsibilities? Because they haven't defined them. There's a bubble chart, and I remember all that crap too, but there's not a real good clear understanding of do they get involved, when do they not, what goods and service they provide that aren't competitive to private sector like sometimes it's it's Nemo or or you know, finding Nemo like little. Yeah. Seagulls. Mind, mind, mind, mind, mind, mind. It's it's it's a this topic.
FBI can come in and do your instant response. Why aren't you calling a Dragos, CrowdStrike or Mandiant? Why why is taxpayer money getting used to compete with tax paying entities? That doesn't make any sense. And also, they're not skilled up across every field unit to do that. There's some field offices. They're phenomenal.
Yeah. I remember, you know, I... Again, I... I'm actually much more pro government than I ever come off, but because I give any sort of critiques, that's the first thing that people... Oh, Rob said something bad about the government. I said 15 nice things, and you're focusing on the one critique I levied. But the the one, you know, good example of the critique I remember, it was RSA one year, and, one of the DHS leads got up on stage and said, well, we're we're really here for when the private sector can't scale to the incident. So when you have an attack on an electric company, it's actually national security. You should be calling us and not one of these private sector companies. And so when she got off stage, I just nicely went up to and I was like, How many incident responders do you have in your organization that know OT? Well, you know, and I was like, how many? She said, well, four. I was like, cool, I've got 40. So why don't you get back on stage and say, I'm here for when the United States government can't scale to the problem, you know? And so there's a, if you clearly go out and communicate to the asset owners and operators of here is a lane for me and this is what I can do.
And you can depend on me to do those things. And we're gonna put protections in place to not have these bad things happen. The government would find that there is an overt desire to partner with the government and prepare for those types of things but when you don't really know and you don't have SLAs and you don't have identification documents you don't have anything you don't have any standard legislation is this going
go? You don't know if they're gonna be there when you need them and what their role and responsibility is and who does what and who does, then of course, you're not gonna leverage that. And it has nothing to do. It's not anti government. It's just you wouldn't depend on somebody undependable in a critical national infrastructure emergency. And so that's... Yeah. My my advice on bridging it is clearly... Congress should help clearly define because this is where CISA gets short into the stick, and I feel so bad for them is everything is a CISA thing. If if there's any issue that Congress wants to talk about with cybersecurity, CISA, aren't you doing this? Why you doing election security? Why aren't you doing misinformation? Why aren't you doing this? And then they, hell, they had some cybersecurity people they deployed down to the the border wall discussion in the last administration. Like, oh, they're doing that now too. You know? And so it's it's like they're the bullywhip for anything related to security and cyber. CISA is supposed to have an answer.
And that's not fair to them. They're wonderful people, but they don't have an infinite budget and resources. What do we want them to do? Let's carve that out and whatever it is, it's theirs. But whatever it's not, now we have clarification that there should be markets that form and go do those other things.
To shift gears slightly, I know we've been discussing a little bit about some of the things that have, you know, gone wrong or could be better inside of, this whole systematic approach to addressing OT issues, specifically speaking about operational technology and malware these days. Right? Previously, you're gonna be seeing tons and tons of malware specifically being developed for, say, Windows or for, say, those traditional, information technology systems. When you're seeing a huge uptick in operational technology and focus around that, are you in addition seeing a huge uptick in the malware that's being purposefully created for OT?
No. No. And so are there ICS specific malware companies? Yep. Right. So Stuxnet, Havex, BlackEnergy 2, Crash Override, Trisis and EKANS were six families of ICS scalable malware and two or three of those could be repurposed and used in large ways other places. And so does it exist? Sure. But it's not necessary for most of things. If you're gonna cause physical disruption, long term impacts, things like that, you probably want a tool to help you and that's gonna be malware and you know can help you in those cases. By and large, whether it's espionage, short term disruptions, maybe even some smaller disruptions not sustained, you don't need it. It's that functionality we were talking about. So I could use IT malware to get access and then it's kind of living on the land of that native functionality moving across the environments. Most of the cases we respond to the malware is the least interesting piece of it.
But that's where a lot of InfoSec wants to focus is vulnerabilities exploits malware. And it's, so it's like patching. Patching is not useless, but it's one of the least important security controls in ICS, but it's one of the first things that people get hit over the head with, oh, you have a vulnerable window system. Like, okay, now make the lights blink. I don't know. Like, what am I doing with that? And so, you know, we gotta have some mature conversations here. And I think we will see more of it in the future.
of thing. Yeah. And like where we've seen like EKANS as an example, using ransomware cases where it was tuning in on various ICS windows processes, and that's interesting. But there could be some really interesting use cases of bricking certain types of controllers, mass, you know, issues down the control level. You know, there's all stuff you could do. And I don't think many of us wanna get out publicly and be like, well, here's exactly what you do to take all this down. But but there's there's some scenarios where malware has a place. By and large, though, it's get access and then have people that understand industrial environments get into those, you can achieve your operations.
We've been talking a lot about the threat to critical infrastructure, and particularly, like, what that looks like in The United States, how we are prepared for it or not, and and who's involved. But we also talked a little bit earlier about how some of the major or most well known attacks on utilities happened overseas, like Stuxnet, the Ukrainian power grid, Saudi Aramco in Saudi Arabia. Those are all happening overseas. Are you seeing more growth with your company, but also with this field in general overseas? Or maybe not just growth, but urgency as well in protecting critical infrastructure compared to The US?
Yeah, absolutely. And so there's different regional differences, and we can talk about those. But by and large, the awareness is there. In some places, the awareness is more. Like I I also sit on the World Economic Forum, and they stood up a World Economic Forum CEO level buy in committee explicitly on electric and oil and gas, and it was focused almost entirely on OT cybersecurity. And so when the World Economic Forum with CEOs and state leaders around the world is taking on an issue, you know it's got some awareness. So it's there, and we're seeing some urgency. However, I would say maturity, and this is where I don't want to put any customers and companies and countries down, but just to have an honest, candid, transparent conversation. The awareness generally gets informed by two places.
One, you either have really close ties with an intelligence community and government that historically have been really good about informing the private sector about what they see. So where do you see a lot of maturity? The five eyes countries, UK, Australia, New Zealand, Canada, United States. Their their government and private sector have been collaborating. Forget the services and the goods and stuff we were talking about earlier, Awareness, briefing at a board level, sharing the insights they see, that's been phenomenal. It's been there, and it's helped raise the profile of it. The second place is you got attacked. And you see those attacks, go, ah, that's a big deal. So all across the Gulf Coast cooperation or the GCC, The Middle East, you won't find a company that doesn't... Isn't... They, you know, they're... They can point to their threat actors on a map. They know where they are. You know, they're they're they're well aware that they're coming after them. The problem then is the maturity and the culture in those organizations to have this discussion.
I was able to get in front of that Fortune 50 and say, Hey, CEO, your whole expectations is off. And when they left the room, they were still proud of that CISO for all the work they've been doing, and now they're readjusting. How many companies around the world do they have that level of maturity that they don't turn around and be like, Oh, you misled us, and so on and so on. And now there's a culture of almost hiding things, and hey, let's not service this up to the board level, and well, let's fix this first, and then we'll show it, and it never gets done or resourced appropriately. So I would say The United States, and I hope this isn't just a Western bias, but I would say The United States infrastructure companies I work with on the whole are much more mature than anywhere else in the world for those reasons and the culture that gets built there. I would say there are other regions, Australia, New Zealand, you know, Saudi Arabia, UAE, UK, Germany, other places that they're coming up really quickly, but I am very worried in some of those places about the copy and paste from IT mindset.
I don't see it as much in the GCC. I see it a whole lot in Europe of, well, here's these ISO standards, and here's this, and here's that. We should just apply these standards and copy and paste it over to OT. It's like, god. No. No. No. No. No. I'd rather you do nothing.
box? Yeah. More. Absolutely. More power sites have been taken down from well intentioned IT people than Iran, China, and Russia combined. You know, plea... Please don't do the bad stuff. You know? Either do it right or don't do
it right. So question around taking things down. Right? When attackers or nation states or malicious entities, whatever you wanna refer to them as. Right? Obviously, nation states have a lot of backing and a lot of resources and a lot of, time at their disposal to focus towards these things. That being said, I'm curious around the specific types of TTPs or tactics, techniques that you, your company's identifying and how that directly relates to what MITRE is putting out with regard to the OT space. Are they relevant? Are they different? And how does that tie together?
Absolutely. So MITRE, they're different. MITRE had their enterprise attack. Right? And, it was really good. And I was really glad to see that come out. And actually, I think not speaking out of school here to say a lot of that originated in the NSA early in the days, and and then MITRE did a really good job of picking up and making it really good, and then got community buy in and published it out. And a lot of wonderful people really took it and ran with it, and it was a good resource. But it's a lexicon. It's an ability to have conversations between people and analysts. It's not if you, do this t one three three whatever, you know, we're done. No. There's analytical breadth and analytical depth. Analytical breadth is do you have coverage across the tactics? Analytical depth is how many different ways can you prevent a tech to respond to those different tactics and the different ways they manifest. And so MITRE did a great job of launching MITRE ATT&CK for ICS, and they engaged us and I'm sure others, and we contributed all of our public knowledge and others contributed theirs and fleshed out this 70 or 80 tactics and techniques specific to ICS.
And on the surface, I've seen some pushback from people going, that's lateral movement. I'm like, yes, we also have lateral movement in ICS. Well, I can just do that with my IT stuff. Like, no, in your environment, you might do lateral movement over these protocols. In our environment, we might use lateral movement over OPC between two controllers. And so the high level language in many ways can overlap, but the way that you actually implement and the detections and the prevention response of those things changes drastically. And so I would say that there is some overlap, otherwise it is fairly unique. You know, what was fun for us, because we are biased, we like ICS, we think ICS is special. You know, my intel team stood, sat down when MITRE reached out about this and we tried to disprove it first.
And we said, can we take all the incidents and the threats we have and fit them into enterprise attack? Do we really need yet another thing? Because, you know, people are tired of yet another framework or standard? Do you really need something different? And we proved to ourselves, you had to have something different. Here was these 70 or 80 unique tactics and techniques you needed articulated as well. And it's going to grow over time as we get more visibility in these attacks. Because, you know, one of the earlier comments, we see a lot when the attacks are taking down electric system in Ukraine. We don't see a lot when it's preparation and espionage and so forth. And we hear a lot about compromises in electric utilities because they're pretty mature and they're looking. We don't hear a lot about that in mining companies. Is it the adversaries aren't interested in mining? Or is it that most of those companies haven't started their OT security programs yet? So we're not seeing that. And so I usually joke with people.
So I wanna talk a little bit about something that I think we often end up talking about on this podcast is like working in tech and cybersecurity, just like what that's like. And I saw something interesting on... I think I I thought I think I saw it on your Twitter that you've really emphasized compensation transparency at Dragos. And I wanted to know why that's important for you and how compensation transparency affects employees or future employees or, like, you know, the industry.
Yeah. I love doing stuff that everyone says you shouldn't do. Okay. That's not a theme in my life. Everyone's like, oh, you shouldn't do ICS. No. No. You won't... Market won't move, and people don't care, blah blah blah. Was like, well, let's do it anyways. And then everyone's like, oh, ICS is big. And then when Pay Transparency, they're oh, like, you can't do that. People will poach your people, whatever. Like, they're not my people. They're, you know, what are you talking about? And it's like, of course we should. And so anyways, there's a lot of stuff that drag us that we do that's different. And some of it's smart, I'm sure, some of it's probably not. You know, back in the day, we don't have capture forms. If it's a white paper, webinar, or whatever else, I always hated putting my email for people. Was like, screw it, we're not gonna do it. If they like it, what we do, thank you for the time to go read it, they'll come back and contact us. All my marketing people originally, can't you do that. We'll sacrifice leads. And like, yeah, we won't do it. And the next thing I know, I turn around and other companies start copying it because people are tweeting, you know, angrily at these other companies, well, Dragos doesn't do it.
And I'm like, okay, it's working. But to to your point, a couple of things we do around pay. Number one, we have complete pay transparency. So on our applications, on the job website, we list exactly what the salary is. And then we tell you, in addition, here's how we value the equity and the benefits and everything else, and that's the total compensation package. So you get to make an informed choice. And there's no negotiations. It is that package. If that package works for you, great. If it doesn't, don't apply. And what that's done besides the obvious of helping some people self select out, which has its pros and cons, is it also abuses... It also sort of avoids some of the classic abuse. Now we still have to monitor everything else as well. You don't get out of sexism, racism, biases, etcetera, in one fell swoop, But it helps put a dent in it to say, you know what?
Historically, by any research we can find, white men tend to be more aggressive in negotiating compensation packages than people that are in some level underrepresented. And we remove that. We say, screw it. You know, if you can do that position, then you should be getting that pay. Let's take out the negotiation of it. And another thing we do is that pay is the same that that person makes internally. And if you're in that career path, so let's say you're one of our engineers or one of our service analysts or whatever else, you have full pay transparency, up to the VP of L1 through L10, here's what everybody in my career path makes. And what that allows is more informed choices. So you can sit there and go, Hey, if I got promoted three times, what would I be making? And now you can make it a choice of if it's worthwhile to stick around and you can have an informed choice and then you're not bitter about it. You may leave sooner, you may stay longer, but you're not upset about it because you had all the information to make a good choice.
But if we decide, and we do this all the time where we might find that the market's changed and it's changing a lot in like engineering. A 100% of our engineers are in The United States. We don't outsource anything where they're related to our product. Cause if we're deploying a software into like nuclear power plants and similar, I'd like control of the supply chain. It's not that I have anything against other countries teams, but I'd like to have full control over it. So a 100% of our developers in The United States. And The United States engineering market is intense. And so every now and then we have to adjust. But if we adjust to go get someone new, everybody internally at that level also gets that same adjustment. So then nobody ever feels that they got screwed over or whatever else. And routinely people are getting pay bumps that they weren't even, you know, articulating or negotiating for because that's what the market said. And we never take it down either. If the market changes down, it only benefits you.
So I feel that while we may not be the highest paying always compared to everybody, like somebody came along and said, hey, Amazon's offering this person 60 k more. I was like, yeah, they're they're a little bit bigger than us. It's okay. You know? I hope the intangibles of the value of our equity and the work from home aspect that we've always had, the culture, everything else is enough. But if it's not, that's fine. Good on you. Thank you for being a Drago's alumni. Have fun. You know, we wanted this to be a step in your career. We don't expect you to stick around for twenty years. And so I just, I believe in letting people have all the information to make informed choices. And if they do that, then they're going to be happier, more productive, you know, they're going to be better team members. And when it's their time to leave, they're going to do it on their terms, and it's going to be a good discussion. And so yeah, pay transparency, level transparency, job descriptions for everything. No more than three interviews, we don't waste your time, you know, we do a number of things to just try to make this easier.
And we did it because we felt it was the right thing to do. But in the back side, it also turns out we now start having data to go, oh, it's actually also beneficial to the company.
I think that's a huge step in the right direction. So first off, for what it's worth, I'd like to commend you on that. I think it's hugely mature of you and your organization, and I appreciate that. So, little bit of a switch because we're coming up, a little bit. I wanted to ask you, lastly, a question that we ask all of our guests, which is also something that we ask new personnel here as well. Without, you know, what's something that we couldn't tell from you by looking at your LinkedIn profile or company bio?
No. It's gonna be a cliche thing, I'm sure. But I'm, I mean, I am massively introverted. And like people see me author SANS classes get up on stage and keynote places and whatever else and do all this stuff. And they I think they assume that like limelight or whatever else, my happy places, sweatpants at home with my wife, that with my three year old, we don't talk, we just sit in a room, drink some tea, enjoy life. Like I can't stand talking to people, hanging out, doing anything like that. And so I enjoy these types of things because it's value to the community and people can learn things and all that. But it's not that I dislike anybody when they're like, oh let's meet up sometime. Let's go to the bar and do whatever. I don't think I've ever accepted one of those. It's not that I don't like the person. I just, I really don't, I get my energy from being alone, not from any of this. It's again, I I want my kid to have lights and water, so I'm willing to do it.
Alright. Thank you so much for your time. I've got a three year old as well. I... Actually, I'm I'm doing, dad duty right now because as I'm babysitting, while she's sleeping.
So, yeah, man. Three year old daughter. That's really awesome. Again, I'm really stoked that you even came on the show. Thank you so much for your time. And
Yeah. This was a great conversation. If you like today's episode, please give us a five star rating and subscribe wherever you're listening to this. It'll really help us get noticed on your favorite podcast platforms. Also, share this episode with your friends. And if you haven't already, make sure to check out all the other really fascinating that we've already interviewed. We're also open to suggestions. If you know someone we should be talking to, drop us a line at we'[email protected]. That's we're in [email protected].
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
