#127 – Douglas Brush (Part 5): Analysis Paralysis

[00:00:00] I'm Douglas Brush and you're listening to Cyber Security Interviews. Cyber Security Interviews

[00:00:15] is the weekly podcast dedicated to digging into the minds of the influencers, thought leaders

[00:00:21] and individuals who shape the cybersecurity industry. I discover what motivates them, explore

[00:00:26] their journey in cybersecurity and discuss where they think the industry is going. The show

[00:00:31] lets listeners learn from the expert stories and hear their opinions on what works and doesn't

[00:00:37] in cybersecurity.

[00:00:47] Welcome to Cyber Security Interviews, it's back. After a long hiatus and a lot going

[00:00:52] on in my life, I am bringing back the podcast. In order to do so, I brought my good friend

[00:00:58] and colleague and data privacy and cybersecurity personal interest, Dan Ayella, to interview

[00:01:03] me. So over the next few episodes we'll discuss where I've been in the past 18 months, what

[00:01:09] I'm doing now and where I think this industry is going and why I plan to leave it within

[00:01:14] the next 7 years.

[00:01:16] Do you want to talk about the two projects that you and I are working on together or one

[00:01:19] that we've done together and one that we've got in the hopper, first around hanging out

[00:01:23] your shingle is a building out of your own business and the other around selling two

[00:01:28] CISOs?

[00:01:29] Yeah, it's funny. I almost forgot about the hang out your shingle on town thinking about

[00:01:36] things I needed as I'm stepping up this business. Like holy crap, Dan, I have a whole list

[00:01:41] of this. We put it together and I found myself referencing it for myself and then as I've

[00:01:44] seen more and more people in the marketplace now trying to start businesses, it became

[00:01:50] a really valuable thing. And this idea that kind of creating this repository of resources

[00:01:57] for people that want to get in this because there's not that, you know, when I started

[00:02:02] computer house calls, 9495, my advertising budget was limited. It was pay up front and

[00:02:09] wait newspapers, radio, yellow pages, five, $10,000 and stuff. And I would have to wait six

[00:02:17] months to a year that said really it's a year two you really see the results. We want

[00:02:20] you to expand them and get a bigger ad placement. I'm like, I feel like I'm being sold at

[00:02:24] timeshare. What's going on? And it's just like this really like where am I putting my money

[00:02:29] on and where's the results? And it really didn't, didn't pay out. And then when I started

[00:02:36] the digital forensic group, it was insane to me that when I launched the website within

[00:02:42] seconds, I was seeing or seconds is probably a little dramatic. But within hours days,

[00:02:47] you know, I can see what ad words were, were jet, generally, what was driving traffic

[00:02:51] to the site and I can track it to a sale. And for me, it was funny. You know, I was doing

[00:02:55] things like computer forensics. I say computer forensics because that's the terminology

[00:03:01] that we use. And I found out there was a unused ad word that Google suggested that was

[00:03:10] a people at search for, but nobody else was bidding on in the marketplace PC forensics.

[00:03:15] Landed a bunch of work once I put that in as a driver because that's what the lawyers

[00:03:21] are thinking about. They're like, hey, you know, they would yell down the hallway some

[00:03:25] partner. They don't understand. They're not going to say, I need a computer forensic

[00:03:27] expert witness on a rule. It looks like I need somebody knows PCs, give me a PC expert.

[00:03:34] And so they get PC forensics in that I think, oh, it's like no, your audience know what

[00:03:39] they're thinking about. And so there's a lot of this that I think allowed me to shape

[00:03:43] and changes. And even as I was doing some of the community stuff, I built out a logo this

[00:03:49] this week for something I'm doing for the special masters. I don't know community, I guess

[00:03:55] this is the best way to put it, but it's around, you know, it's like basically creating

[00:04:02] a safe place for for special masters and stuff. And so there's going to be a website

[00:04:08] and it's called in Latin Newterms Spashing, which is basically a neutral, neutral territory.

[00:04:16] It's a place to be in confer, but it's going to be resources similar to kind of what we

[00:04:19] do with the Hangar Show, but a resource, a Slack channel where people can go and find

[00:04:24] other like-minded people that have the same problem. Long story short is, yeah, what

[00:04:28] you and I do and what we try to do is build these community things. I think what is important

[00:04:31] is as people start entering this, there's so many good things you can use now. It was

[00:04:35] really hard back in the day. It was actually more cultured. Now actually it's still

[00:04:39] extensive in a bad way if you use the wrong thing. It's all about order of operations,

[00:04:43] choosing what you do when you do it, how you do it. And I take it for granted that I can

[00:04:47] go register domain, whatever I want. I did the DNS records, point out the same thing.

[00:04:52] Basically had a presence op on the internet with a logo for all of about $70. Again,

[00:04:58] 23 years ago that would have been $30,000 project over a year. So we want to be able

[00:05:03] to show people that enable them, but also show it look- it's very easy to get lost too.

[00:05:07] Because now there's almost too many options. And so if through the Hangar Shingle work,

[00:05:11] it's the speedless they look, do these things. Here's your corporate structure.

[00:05:15] Here's what you need to worry about in the different, whether it's a C corporation,

[00:05:18] S corporation LLC, how are you going to structure the company? What's your exit? How to brand

[00:05:21] and market, how to do all these different things to get your business off the ground. And I think

[00:05:26] a lot of people that are either going to be solo entrepreneurs or building to some kind of other

[00:05:31] practice in particular we see the marketplace changing where I think over the next six months as

[00:05:36] the economy recovers in all these people that lost jobs in the in the current marketplace. Because

[00:05:44] it's very important for stockholders, VCs, and investors to make the best capital gains this year

[00:05:49] while they take the tax right off from the losses this year so they can pay the lease amount of taxes

[00:05:54] and make the most amount of money while everybody else uses their job or healthcare. So as a

[00:05:58] economy makes this amazing recovery in six months, which are well people are going to be I think more

[00:06:03] suspicious of going back to work for bigger companies and more companies are going to come out of

[00:06:08] this. And I want to be able to help these individuals that want to be entrepreneurs know what they're

[00:06:11] really getting into because I think a lot of people are kind of like have this this e-mith

[00:06:16] or entrepreneurial myth that they can do it. It's like, hey, can't but there's a lot of business

[00:06:20] structure behind it. Here's some shortcuts. I hope they work for you if they're not

[00:06:24] get out go work some but you know it's this idea where we have this this community resource

[00:06:28] of things to help people get off the ground. Yeah, you can go find it at smartlyremote.net

[00:06:35] There's a video presentation as well as other collateral to take a look at which is really a lot

[00:06:40] of fun to do. It's two years old, but I think it's actually it's four it's three years old now almost

[00:06:46] uh but I think it's as fresh today as it was then. Let's talk a little bit about CSOs in selling

[00:06:51] to CSOs. Yeah, I think one of the challenges that I had are always had is that whatever

[00:07:00] org I was representing said you know as you talk to these CSOs I need you to really say or push this

[00:07:06] I'm like cool I'm not going to do that. Um absolutely not. I'm going to talk to them because

[00:07:12] again one of the things that I kind of butted heads with focus said well you know you're not

[00:07:16] technical it's like yeah but I just got not my focus area right now I can do that but really my

[00:07:21] area is this is the the community the collaboration the friendships I've built in the CSOs community

[00:07:30] so I talked to them we talked to CSOs too now guys like you talk at them do you talk with them

[00:07:36] because a big difference they didn't get that. Well you're not you know you're not really spreading

[00:07:42] our matches it's not about us it's about them understand what their problems are understand the

[00:07:46] mentality of my CSOs and how you sell to them is understanding their psyche the problems the things

[00:07:51] that they're going they're going through and that's how you really do it is connecting with

[00:07:56] them on a human level and most of the times I would get on these calls with CSOs are go meet them

[00:08:01] yeah they want hour long prep meetings and I make sure we position this as I know I'm not

[00:08:05] going to do any of that nope I already know what their problems are tell me what name is coming

[00:08:10] okay here's our problems after the call how did you know that I was like because I've done 500

[00:08:16] of these like I know I've seen every cyber security program that exists they're all the same they're

[00:08:22] underfunded understaffed there's a lot that are good don't get me wrong but most people are not

[00:08:26] at levels where they they can it should be and they're scared and I was like that that fear that

[00:08:30] I'm never gonna get this done and it's overwhelming it's because there's there's too many competing

[00:08:34] priorities it's analysis paralysis so what I go in and do let's say look here's the here's

[00:08:39] the things that you need to do this order these build on each other so not three different steps there's

[00:08:44] three steps in a row and three to six months we're going to get you here and we're only going to

[00:08:49] do these things and this is going to build out your program and yeah the salespeople can only

[00:08:53] leave that's amazing and I was like right and did you see them actually add on to the products and

[00:08:57] services that we were selling like yeah but you didn't sell it I know exactly I explained to them a path

[00:09:02] forward and how they should do it because I'm the expert I'm sorry I've seen three other programs

[00:09:08] today they want to know for me what are my peers doing what would you do if you were in my cell here's

[00:09:12] what I would do cool what are some of the technologies I can support that oh glad you ask I have some

[00:09:18] of these you should buy them all I'll sell you one or two right now but when you're ready we'll

[00:09:22] build into some of these things like AI and I'll soar whatever it is but right now you need to start

[00:09:26] with the basics about understanding your inventory cleaning up your logging and aggregation build out

[00:09:30] the right correlation rules so you're detecting threats that matter most of your business I don't

[00:09:33] want you to turn all the threat into I want you to pick a couple use case scenarios that we're going

[00:09:37] to work on that are the highest risk of the business let's just focus on those you can do that yep

[00:09:42] our technology can do that we can help you do it great then let's do that and then we're moving

[00:09:46] along already and then as we go we kind of expand on this and then we get into the greater things

[00:09:50] I think that's how you sell the sea says is understanding where they're at get them moving in

[00:09:55] the right direction but don't like point to the top of the mountain and say all right go hike that

[00:10:00] I'm gonna make fuck you dude I'm gonna die on the way up and they probably will get into base camp

[00:10:05] one take them there sure for them be there with them and be a true business partner and where the

[00:10:12] logo of the jersey who you're playing for at the time and they're gonna trust you build that trust

[00:10:16] they'll buy from you understand they have a lot of inertia in their lives and ought to

[00:10:21] be something as simple as understanding that you know some of the things that I've been able to

[00:10:25] help them out on is they were gonna take out some products I was just representing like I think

[00:10:31] you should we failed you we didn't do it the right job and the kind of look this did you just say

[00:10:38] what I think it's under the salespeople and product or did you just say that I'm like yeah we fucked

[00:10:42] up we're sorry here's how we're gonna do better oh last refretching nobody ever says I thank you

[00:10:49] well tell me more about that and then I got them interested and I was like yeah it's looking

[00:10:52] who's here's what we're making improvements here so I was gonna support you and talking

[00:10:56] on their terms not about me not about who I'm representing what can be done better and it's like

[00:11:00] you know off time say look you know if you give us some time to make this right I know you're

[00:11:03] gonna have to go through procurement process oh my god I've been on the phone with lawyers all day

[00:11:08] they're taking it because I'm trying to go to this competitive product right now that sucks man I've

[00:11:12] been there what if we did this instead and we just give you more room on our product and we'll

[00:11:18] give you some room until you cut over to them knowing that they're not gonna do it because it's

[00:11:22] a inertia it's a business and I understand all their problems internally too again understanding

[00:11:26] their friction points with inside the organization of signing a new vendor making their job easier

[00:11:31] the less likely to just place you so there's all these different things that you have to understand

[00:11:34] where they're coming from um instead of pitching them all the time in this dumb idea if you were

[00:11:41] 30 seconds within an elevator with a c-stone how would you sell them I was like I fucking

[00:11:45] what it because that's the dumbest thing I've ever heard um what I would do is talk to them about

[00:11:50] say hey how's your day going around and I'm talking about anything else other than their job

[00:11:55] and they're like oh cool thanks oh by the way yeah I know so and so I might be in cyber and then you

[00:11:58] know just get them talking about anything other they're they're they deal with their job every day

[00:12:03] long they don't want to talk about it and this stupid idea when you go in and pitch a c-sode

[00:12:07] in your fucking cold email is uh as a c-sue are you worried about cyber security

[00:12:13] wow no no I'm not I'm so glad you asked or the fear and certainty and doubt of or even the worst

[00:12:23] the aim in this chasing that's disgusting I had somebody get fired over that was so happy um

[00:12:28] because they went over the c-sode when the c-sode is in the middle of the house burning down

[00:12:34] well with this is our opportunity I was like no it's not this is our opportunity to shut up and

[00:12:38] listen to their problems and be there as a croak shoulder to cry and that goes over the head of

[00:12:44] the c-sode in the c-i-o who immediately gets email walks down the c-sode's office goes what the fuck is

[00:12:49] this screams at the c-sode calls up the person it was what the fuck were you thinking and then

[00:12:54] it's damage control for that it's like just offensive acts like that and that's such a common thing

[00:12:59] in industry it's like it's not there's one guy everybody does that it doesn't work it's idea

[00:13:03] again why I'm done with this because we keep doing the same things over and we're gonna don't

[00:13:07] work what we've always done it this way yeah well what's your uh what is it working it's working

[00:13:10] good enough could be working better could be working more efficiently you just fired a bunch of people

[00:13:15] you have less resources what if you did things that were more effective and efficient without

[00:13:18] pissing people off for once because really what c-sodes look for are just a few things

[00:13:23] what consolidates business problems into one tool that they have adoption after the sale there's

[00:13:28] somebody exists with a true partnership and somebody looking out for them as a person and as

[00:13:33] their job function and I'll say they buy it from people that have a great vision a great team

[00:13:37] and basically help them get to that strategic goals even faster and that's that's it don't over

[00:13:42] complicate it and if you get to a c-sode it's like you know you've done your research you got to

[00:13:46] them you can recon them build with the relationship with them they're likely to be a handy off

[00:13:51] you don't have to keep bothering them after that they're gonna hand you off to their you know

[00:13:54] hand of the king and you know king's landing speak um and you're good just keep that person happy

[00:14:00] you know the best calls I've had or when the c-sodes I don't use your products I'm gonna

[00:14:07] add touch it in 10 years all it knows you keep my people happy we'll keep buying it

[00:14:12] I have other things to worry about and this like product are like c-sodes don't touch the

[00:14:17] technology I was like no they touch spreadsheets and they touch PowerPoint and they

[00:14:22] curse at them all day long and then they go in their email box and the CEO says again just

[00:14:27] forwarding this from the New York Times we need to report on this it's like they're not

[00:14:30] I'm not sitting down in a sock doing this work that's this doesn't exist you know so you really

[00:14:37] have to understand what their day-to-day looks like um if you like these stories if you like these

[00:14:42] stories you're gonna love the masterclass that Doug and I are putting together available soon

[00:14:47] I had to stop Doug before he gives the whole class away oh no these are teasers but I have all the tools

[00:14:54] or do you or do you exactly so I'm really really excited to do this I'm sure you're a fan

[00:15:03] of pen and tellers of course yeah so when they did their book their food food comedy book

[00:15:11] there was this awesome thing that they did around like I thought it was brilliant it was like

[00:15:16] I don't know it was very early in the book I was like it was like what you want the most out of

[00:15:20] this book skip to this page and they put it is like really little book he was skip this page and

[00:15:24] it was like if you are at a restaurant what you want it or if you're gonna if you're gonna

[00:15:30] pay with the credit card a restaurant first scrape off the barcode and then fill it in with a sharp

[00:15:34] you when you hand it over they'll think it went through and they'll give it back and then you

[00:15:38] you go to the first page that says how many idiots read that then jumped ahead thought they got

[00:15:44] what they needed out of this book and have just totally tanked their credit card and that's the thing

[00:15:48] is like go ahead use these couple things I said let's see what happens you try to run that credit card

[00:15:54] exactly in the whole book wonderful well Doug thank you for joining me here on cyber security

[00:16:02] interviews Doug brush of ex-alconsolving you for joining me joining you to join me yes the little

[00:16:07] two meta usual host to be back again soon until then and I'll get a little peek on that

[00:16:15] haul up you got me talking you can't get me stop like I said people are like hey Doug can we

[00:16:20] get you to talk at a conference it's like getting me talking is not the problem shutting me up

[00:16:24] no it was it was that you know yeah the next series of podcasts are going to be more episodic in

[00:16:30] that sense I'm gonna break them up and a little bit of things stuff on the data privacy subdues

[00:16:33] special master stuff the season stuff and and how some of the things are changing in the

[00:16:38] industry so I'm gonna do more series of things over the next couple months wonderful well I know

[00:16:43] I'm I'm looking forward to hearing them and I'm sure the community is as well thank you thank you

[00:16:51] for letting me have you have me have you have me have you have me have you yes this is a

[00:16:56] decision straight out of airplane thanks to everybody for listening thank you so much for joining

[00:17:01] us today on cyber security interviews I hope that you enjoyed this interview as much as I did

[00:17:06] please go to cybersecurityinterviews.com where you can find every episode including show notes

[00:17:13] and links for each guest there you can also find social media links and just sign up for new

[00:17:18] episode notifications thanks we'll talk soon