NSA "Red Team" Hacker | Jeff Man (throwback episode)

original airdate 4/1/24 Support the show here:⬇️ https://www.patreon.com/TheTeamHouse --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Jeff Man is a respected Information Security expert, advisor, evangelist, and co-host on Paul’s Security Weekly and Tribe of Hackers. He is currently serving in a Consulting/Advisory role for Online Business Systems. Jeff had over 37 years of experience working in all aspects of computer, network, and information security, including cryptography, risk management, vulnerability analysis, compliance assessment, forensic analysis and penetration testing. He is a certified NSA Cryptanalyst and he previously held security research, management and product development roles with the National Security Agency, the DoD and private-sector enterprises. He was also part of the first penetration testing “red team” at NSA. For the past 20 years, Jeff has been a pen tester, security architect, consultant, QSA, and PCI SME, providing consulting and advisory services to many of the nation’s best known companies. Become a supporter of this podcast: https://www.spreaker.com/podcast/the-team-house--5960890/support https://www.spreaker.com/podcast/the-team-house--5960890/support?utm_source=rss&utm_medium=rss&utm_campaign=rss.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down rather than giving teens the answer. Study mode helps teens work through problems, and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.comPARENTS to learn more.

• 0:27Speaker 01

  Cash Flow Crunch? OnDeck's small business line of credit gives your business immediate access to funds, up to $200,000, right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 0:58Speaker 02

  The Team House, with your hosts, Jack Murphy and David Park.

• 1:12Speaker 03

  Hey, everybody. Welcome to The Team House, episode 269. I'm Dave Park, co-host Jack Murphy, and Behind the Wheels of Steel, D. Tonight, we'd love to, you know, we welcome our guest, Jeff Mann, NSA for 10 years, 28 years in the crypto and hacking community outside of the NSA. So Jeff, thank you very much for coming out from the shadows and sharing your time with us.

• 1:44Speaker 04

  Hey, happy to join you here this evening. Looking forward to having a fun conversation, a little stroll down memory lane, as it were.

• 1:54Jack Murphy?

  Hey, I just want to hit everyone up before we get started and let you know about our Patreon. You can find the link down in the description. If you guys sign up, you get access to all of these episodes ad-free. We really appreciate you guys supporting the channel. So if you can, please go take a look at it. Again, the link is down in the description.

• 2:14Speaker 03

  All right, and Jeff, on to you. One of the things we like to ask our guests is, what's your origin story? Like, how did you grow up? And what led you into the crypto world, the cryptography world?

• 2:30Speaker 04

  Well, it's a great question. And ironically, on the podcast that I'm a co-host on, Paul's Security Weekly, we often tell, start with the interviews with the same kind of, how'd you get your start question? And for many years, if somebody asked me, how'd you get your start? I'd say, well, I sort of cut my teeth. I got started at NSA. But I realized a couple of years ago that that doesn't really tell the story. The real story is how did I get to NSA in the first place? And I'll try to be succinct. I grew up in a family of pretty smart people. My dad was a physicist. He actually, in the 1950s, came to the Washington

• 3:15Speaker 04

  DC area, went to work for the Naval Research Laboratory, around the time that they were experimenting with hydrogen bombs, hydrogen devices. I guess the first one was not technically a bomb. He used to tell stories about how he was on a ship in the South Pacific and he got to watch the detonation of the first hydrogen device, obliterating a little atoll called Aniwak. So my dad being a physicist and me being like many people having daddy issues, I grew up, I was like, I'm not gonna be a physicist. I tried to avoid physics

• 3:55Speaker 04

  and I did. I'm the youngest of four boys. We all liked to do puzzles. We were all sort of analytical problem solving. And I really grew up doing puzzles, crossword puzzles, crypto quizzes, back when we used to have newspapers and comics pages. There'd always be like a little Caesar cipher type of cryptogram that you had to solve, usually like a famous quote or something like that.

• 4:21Speaker 04

  Yeah, I went to college, didn't know what I want to do. I graduated with a business degree because it was the easiest major I could find that required the least amount of work, the least amount of term tapers, and I didn't have to take physics. My, my mom at the time had gone back to work and she was working for a different naval

• 4:45Speaker 04

  institution called Naval Surface Weapons Center at the time. And she actually got me a summer intern job before my senior year of college, uh, working, um, ironically for a physicist, only this guy was, uh, doing anti-submarine warfare research. My first week on the job, my first day on the job, he asked me, "What do you know about anti-submarine warfare?" Of course, I didn't know anything about it. And he's like, "Well, I could explain it to you, but, uh, you know, there's a book came out recently, uh, it, it explains it about as anything, as good as anything does." So he handed me a copy of The Hunt for Red October. So I thought, "This is really cool. My first week on the job and I get to sit and read a book."

• 5:28Speaker 04

  So, uh, summer intern job, uh, graduated, looking for, you know, what do I want to do with a business degree? Uh, was putting in applications to a lot of different places. My mom, who worked in human resources, or personnel as they called it back in the day, she had a friend whose daughter had gotten a job at this place called the National Security Agency. And being born and raised in Maryland, I'd never heard of it because it used to be very, uh, clandestine and nobody knew it existed. Nobody was supposed to know it existed. There were no signs on the highway or anything like that. But, uh, I filled out a standard government application, mailed it in, uh, got a response from them and, uh,

• 6:10Speaker 04

  went to Fort Meade for a couple of days of aptitude and skills testing, psych exam, polygraph, you know, all sorts of different prodding and poking. But most of it was just taking these various skill level exams, uh, aptitude tests. And long story short is I scored really well on the tests and so they offered me a job. Uh, what I didn't know was they had just hired me when I first went to work for NSA. And this is back in nineteen eighty-four, uh, I'm sorry, nineteen eighty-six. Eighty-four was that George Orwell book.

• 6:46Speaker 04

  I I was I was granted a secret clearance, but I was going through the background investigation to get a top secret clearance, so I had to wait a couple of months. While I was waiting, I essentially went on a bunch of job interviews and I ended up in what at the time was the defensive side of the house, which we called at the time communications security, soon to be renamed information security, later on to be renamed information assurance, now sort of dissolved and you have US Cyber Command, but I'm getting ahead of myself. So I went to work for the manual cryptosystems branch and they were looking for someone to do cryptographic

• 7:25Speaker 04

  analysis of manual cryptosystems that they'd produced and were fielded by primarily the military. So I went to work for them. I had somebody that was there on assignment from the operations side, a real cryptanalyst. He sort of took me under my wing and became my mentor and he was actually the one that advised, yeah, this is a pretty good job, you should take this. So one of my one of my first assignments was actually my customer was US Special Forces, so there's a little connection there. And I can tell that story in a minute, but the day I knew that I was in the right place and I had found the right

• 8:10Speaker 04

  place to be was, you know, I'd mentioned growing up, my whole family liked to do puzzles and when we would go to vacation at the beach in the summer, we'd buy a single copy of a Dell crossword puzzle magazine that had all sorts of different types of puzzles in it, but they always had one or two logic problems. And we all loved to do the logic problems and there was usually like a little table that you could use to fill out and kind of help you solve all the clues. And basically the logic problems were like maybe eight or 10 statements about a bunch of different things and you had to try to just based on a couple of clues, connect the dots and, you know, maybe it was there's five

• 8:52Speaker 04

  different students taking five different classes, what's their favorite subject from five different teachers in five different classrooms and they'd give you just very Sparsed types of clues like Sally loves biology and it's next to the red room. And statements like that, you put it together and try to figure out whose class, you know, who's the teacher, who's the student, what's the subject, that type of thing. My, uh, one day at lunch, you know, so that was something I grew up on. One day at lunch, I'm talking to my mentor and he's working on something. And I asked him what he's working on. He says, oh, I'm writing a logic problem. Like, oh, I love logic problems. Says, yeah, I write logic problems as a side job for Dell.

• 9:39Speaker 04

  So it was like, you know, the planets were in alignment. I knew I was in the right place. So my started NSA was really in cryptology and I was doing analysis of, you know, systems and really just designing systems. My very first assignment was to come up with a replacement, a new memory crypto system for special forces. When they were deployed, they had at the time one time pads, paper pads with the key, the random key written out on it that they would use to manually encrypt and decrypt messages and then send them. But if they had to, you know, exit someplace really, really quickly or they're on their run

• 10:21Speaker 04

  and they had to drop all their paper, they still wanted to have a way to communicate securely. So they needed to have a way of doing a memory crypto system. So that was my first assignment was to come up with a new memory crypto system for them. In doing that, I, um, I had just been through, you know, the five months of waiting to get my clearance, taking all sorts of introduction to cryptography classes, history of cryptography classes. I'd learned about things called cipher wheels. If you've seen A Christmas Story, you know, the little orphan Annie decoder ring. And I thought, you know, there ought to be a way to take. A visionary table, which is what special forces used,

• 11:04Speaker 04

  which is the alphabet 26 offsets in a big table, which for special forces actually translated into, try to get this on screen for you. I think it's 123 unique three-letter groupings that they called trigraphs. They would memorize these things, the combos.

• 11:22Jack Murphy?

  When you put something through a one-time pad in a trigraph, it's considered impossible to decrypt, right?

• 11:31Speaker 04

  Absolutely. There is no cryptographic solution for it. There's no brute forcing. It's completely random based on the fact that there's only two copies of the key in the world, one on each end. As long as it's not stolen or compromised and used only once, it's unbreakable.

• 11:48Speaker 04

  But anyway, I was struggling to, I wanted to use the same essentially algorithm, use these trigraphs and use this visionary table. And I thought there ought to be a way to do it on a wheel. So I like figured it out with graph paper and drew one out. And my mentor helped me with it and we kind of came up with the design. And first one was glued to cardboard. I took it with me the next time I went to, what's that place in North Carolina called now, Fort Liberty?

• 12:17Jack Murphy?

  Yeah.

• 12:18Speaker 04

  It used to be called Fort, we can't say it anymore.

• 12:23Speaker 04

  But I turned my back to write on the board, turned around and the thing was gone. They'd stolen it from me and I'm like, guys, where's my wheel? And they're all like looking around. So after a couple of visits and bringing multiple handmade copies, I finally said, you know, we're in the business of, you know, we're NSA, we're in the business of making crypto systems and all sorts of crypto for you. Why don't we just make a bunch of wheels? So there was a machine shop at the time of NSA because back in those days, they were building little black boxes, engineering little black boxes that would go in different places. So I had them make a prototype of this thing that we called the visionary wheel.

• 13:05Speaker 04

  So the three-letter combinations would just line up. You get your two letters and the third letter appears in the window. They loved it, so we ended up producing 15,000 of them and distributing them to US special forces.

• 13:20Speaker 04

  This was all the different groups. This is probably in 1988, I would say. And as far as I can tell, they were using it up into the early 2000s until, you know, digital crypto solutions and encrypted phones and stuff became popular. So that was my very first assignment, made a wheel. And if I may, shameless pitch. At Fort Meade, which is where National Security Agency is located in Maryland, there's something called the National Cryptologic Museum. And at the end of this month, end of April, a copy, one of the production models of what came to be known as the Whiz Wheel, or I came to learn that that's what they called it,

• 14:04Speaker 04

  is going to be put on display at the National Cryptologic Museum. They're excited about it because, you know, they're not usually putting stuff on displays where the people responsible for it are still alive.

• 14:14Speaker 03

  Right.

• 14:15Speaker 04

  I'm excited about it because, you know, something I did that was just a little, a silly little thing as far as I was concerned, actually turned out to be very instrumental in the mission of US Special Forces for all, you know, over a decade. I had the opportunity to meet

• 14:33Speaker 04

  someone that was a former Green Beret a couple of years ago at DEFCON, a hacker conference in Vegas. And actually, a friend of mine met him and found out he was a Green Beret and asked, "Oh, do you remember the Whiz Wheel?" And he said, "Yes." And they said, "Would you like to meet the guy that invented it?" So I met the guy. And long story short, he said, "You know, I think you might qualify for membership in our alumni association because you've kind of made a significant contribution." So he got me a lifetime membership in the Special Forces Association.

• 15:04Speaker 03

  That's fantastic.

• 15:08Speaker 04

  And I had the opportunity, you know, COVID came along, kind of blew things up, but I had the opportunity to speak at their convention last year. It was in Indianapolis, which is Chapter 500, like the Indy 500. And I asked the guys there when I was speaking, I said, "You know, I've been walking around with the prototypes. I have two of them for..." You know, thirty some odd years, I'd never seen a production model of the Whiz Wheel before. And I put out an appeal if anybody was willing to to donate them. You know, I was trying to get a couple, one of which was to be put in the National Cryptologic Museum. That was the goal anyway. They came up with two. One has been donated, will be put on display. This is another one.

• 15:53Speaker 04

  This is a production model of the the Whiz Wheel. And this one is designated, if we ever get a contact, for the Special Operations Museum that's down in North Carolina at Fort Liberty. Now, that's where the we want to put the other one. This is a little piece of history.

• 16:11Jack Murphy?

  That's amazing.

• 16:14Speaker 04

  So I'll pause for a minute. That's how I got my start, just solving puzzles, got into crypto, designed something, came up with a little quick fix. It was really just an aid for me and then ended up being something that was, you know, pretty um, critical to the mission, many missions that I don't even know about, many special forces teams.

• 16:35Jack Murphy?

  Before we get deeper into it, since you're the first, I think you're the first guest we've had on from NSA. We've done all kinds of different federal agencies. Could you explain to, you know, our audience a little bit about what the National Security Agency is? What their mandate is, their job, why they came about?

• 16:55Speaker 04

  Um, sure. I mean, I'm not a historian. I can give you a little bit of the history. Um, I've probably forgotten more than I know about it at this point. NSA, I believe, was started in the late 40s. It was sort of after World War II. You know, organizations that were doing code breaking and and things like that during World War II uh, kind of got reorganized and they came up with this idea for the National Security Agency. I'm gonna say 48 or 49 was when it was commissioned.

• 17:28Jack Murphy?

  So it was like the National Information Agency or something first, wasn't it?

• 17:32Speaker 04

  Yeah, you probably know more and you can Google quicker while I'm talking.

• 17:36Jack Murphy?

  Yeah, sure.

• 17:36Speaker 04

  Uh, to get the exact story. Um, uh, it'll come back later on in my story, but I'll share it now. Uh, you know, the charter, the mission of NSA is, I always used to describe it to people. The operations, what we call it operations is basically to be the big ear uh, of the country. Uh, responsible for primarily uh, monitoring and intercepting signals. Anything that was going out over the airwaves, which back in those days was mostly radio. Little bit of, uh, you know, eventually television, um, you know, maybe some telephones. But primarily radio waves, the whole spectrum of, of sound.

• 18:18Speaker 04

  Um, NSA's mission was to listen to everything and, and try to intercept. Uh, whatever they could from other countries, adversarial countries, third, you know. Uh, nation states is what we call them these days. And, um, you know, just keep tabs on everything. So i- i- at one level was a big collections agency. It would collect a lot of information and there'd be people that would try to break codes and ciphers. When those were in play, others would translate foreign languages that they, um, intercepted. And there, there'd be other people that would read it and try to, you know, uh, extract useful information. That gets put together on, on, you know, daily reports that get sent to the White House and the Pentagon and other places.

• 19:02Speaker 04

  Anybody with, you know, i- is a customer, uh, uh, intercept collections and communications that are collected. I mean, at a broad level, that's what, uh, the, the mission has always been. Um, with some rules that were put in place in the early seventies after Watergate. And, uh, Watergate investigations, uh, Senate Subcommittee hearings that happened after Watergate. Um, one of which was a, a Senate Subcommittee that was chaired by, uh, Senator Frank Church. And their output was called the Church Proceedings. And they published several volumes of material. But the, in essence, what they, they discovered a- as a result of the Watergate Investigations.

• 19:46Speaker 04

  Uh, the Watergate break-in from the early seventies. Um, was that the, the three-letter agencies like NSA, FBI, the CIA. Had a lot of power and a lot of, um. capabilities at their hands with not a whole lot of any kind of oversight or rules dictating how they would operate, you know, rules of engagement as it were. So one of the outcomes of that was what I came to learn when I went to work for NSA is the NSA Charter. Which is still to this day a classified document, but basically what it says is that NSA can only do what NSA does to

• 20:27Speaker 04

  other countries, foreign nationals and specifically NSA cannot do what it does to US citizens. Now, fast forward to nine eleven in the Patriot Act. The rules kind of changed a little bit, but I mean, that's the charter that NSA was built on.

• 20:45Speaker 04

  So.

• 20:48Jack Murphy?

  But you you guys are also in charge of like maintaining America's communication security as far as the US government, right?

• 20:59Speaker 04

  Well, yeah, I was, you know, just warming up to that, you know, like when I went to work for NSA, I was working on what we would have called the defensive side in information security, communication security. And it was, you know, probably classified, but maybe ten or fifteen or twenty percent of the mission, you know, of the the personnel and the resources of NSA. So even when I was there at the time, there there were people there that were had been there for a while, working the mission for a while, and everybody sort of had a chip on their shoulder. Everybody was considered InfoSec as we called it, sort of the bastard stepchild because operations got all the headlines, operation got all the budget, operations got all the glory.

• 21:40Speaker 04

  And and InfoSec, which was the mission of providing secure communications and crypto to all of the all of the US, whether it's the military or. Um, any level of government where they needed to have, you know, secure communications. That was NSA's purview. That was NSA's responsibility, the Infsec side. So I came into an organization that kind of had an inferiority complex, always, always did and probably always will. Of course, it doesn't exist anymore. Um, but it was, there was always this conflict between operations, what everybody knows NSA that.

• 22:16Speaker 03

  The sexy stuff.

• 22:16Speaker 04

  Yet they know what NSA is, what they're doing, and then us doing the really important stuff that you don't get any credit for. Like making sure that people can't steal any of our communications. So a lot of cryptographers, a lot of mathematicians coming up with the algorithms and the, and the machines, the little black boxes that would secure the communications for, you know, the, the military primarily, uh, any level of government, uh, interdepartmental communications, uh, um, you know, embassies abroad and things like that.

• 22:51Speaker 03

  And, and you, you went in, you said you went in, in around eighty-six, is that correct?

• 22:55Speaker 04

  Correct.

• 22:56Speaker 03

  So, so the Cold War was still a very real thing at that point in time.

• 23:01Speaker 04

  Why? Yes, yes, it was, which is one of the main reasons why I was hired. I was hired at a time when NSA was hiring a hundred people a week. And, and they'd been doing that for a couple of years because they'd gone through a, a lean time in the seventies, uh, where they really didn't hire that many people. Like the guy that was my mentor had been hired in the early seventies. And then they just had a handful of hires from like the early seventies to the early eighties. And they really hired a bunch of people. This is where I get a chip on my shoulder. Uh, we didn't call it STEM back then. They called it critical skills, but they were mostly looking for mathematicians, computer scientists and engineers. And if you had a degree in any of those fields, you, you would get a job offer

• 23:46Speaker 04

  and you were paid on an accelerated pay scale. So you got paid extra. I think the engineers made the most, but don't quote me on that. You know, anywhere from ten, fifteen to twenty or twenty-five percent more than what I was making as just a peon, regular employee.

• 24:03Speaker 04

  But you know, they hired me because I scored well on the aptitude test, the, the skills test. And so I was not a, a critical skill. And those hundred people around me that were hired the same week I was, they were first in line for promotions. They were first in line for training opportunities, first in line for diversity tours, going to other organizations. Because the game at the time was if you wanted to be promoted up past a certain level, you had to have what was called a professionalization degree. And the professionalization degree would be similar to certs that we know of in, in the cybersecurity field these days. And to get that, to get that professionalization, you had to have a certain amount of work experience,

• 24:48Speaker 04

  certain amount of diversity of work experience, working in different places. You had to have continuing education. And various, depending on what field you were choosing in, various, various other things. You know, if you wanted to go into the computers, you'd have to write a computer program at some point and so on and so forth. So I, being just a regular employee, was, you know, not getting the opportunity to get the diversity tours. And I tried to get into an intern program and I wasn't qualified for it. Not because I wasn't a critical skill, but because I had a horrible GPA in college. I won't say what it is on air because people would be shocked.

• 25:32Speaker 04

  But, you know, my mentor did a good job of kind of nurturing and, and talking to friends of his, like on the operations side of the house and getting me some diversity tours on my own because he knew I was gonna need it. But yeah, they, they hired a bunch of people. They would go off to get a graduate degree and, and the government would pay for it. They called it the 2020 program. So they'd work 20 hours, go to school for 20 hours. And then they had to give back government time to, to offset the time that they went to school. But what they failed to figure out for many years was the clock was running while they were in school. And their retirement.

• 26:13Speaker 04

  So, so you could literally like go, go to grad school, get a graduate degree, completely paid for by the government. And after about three months, you could quit and go out to the private sector and get paid more. And that's what a lot of people did. So they were kind of growing by attrition. And because I didn't qualify for the 2020 program initially, I didn't get to go to that. I didn't get to do the intern programs. I just sat in this little office and designed a wheel that was used by special forces for 12 years and, and I'm told saved lives.

• 26:47Speaker 04

  I was also there at the sort of the beginning of the computer age, you know, IBM PCs were kind of a thing. I think, you know, my first office, I had a standalone IBM PC. It wasn't, it wasn't networked yet. It didn't have Windows on it. It was just DOS. In fact, I think my first one didn't even have a hard drive. But one of my, my, one of my early assignments, can't say it was my second assignment, but one of, one of my early assignments in this office was I was approached by another customer, another military branch. And they were, um, they were responsible for communicating with one-time pads with people that, shall we say, had been recruited in certain places in Eastern Europe.

• 27:30Speaker 04

  And, um, the one-time pads that they were using in the field were really tiny and they could hide in the heel of your shoe type of thing. And they were printed on rice papers so that when you used it, you could destroy it by eating it. But the, the caseworkers, the handlers were in SKIFs, controlled spaces, offices on the, you know, on the good side of the world. And their version of the one-time pad was sort of like a legal pad. But they came to us and they said, you know, it takes us hours and hours to decrypt and encrypt these messages because they're getting situation reports from these people. And they said, there's this PC sitting on our desk. Is there any way we could use that? And me being young and naive, like, yeah, I don't see why not.

• 28:14Speaker 04

  Of course, I didn't know it at the time, but I was working for an engineering organization whose mantra was there's no such thing as software, there's only hardware. All they did was build little black boxes. So I took up the, the project of coming up with a design for writing a computer program that could run on the IBM PC and taking the one-time pad key and instead of printing it on paper, putting it on a floppy disk, which I forgot to grab. So you'll have, look at the save icon on your, on, on your Word document. And that's what a floppy disk looks like.

• 28:49Speaker 04

  And I had to go through an engineering process, a design review process called the F S R S, Functional Security Requirement specification. It was specifications to build secure hardware, and I was building a software program. So I kinda had my, to fudge my way through it, I had to go through a review process with all the executive management of InfoSec. InfoSec was Oregon, it was, it was a directorate and inside the directorate were various groups and every, and every group had offices and divisions and so on and so forth. But all the group chiefs, and there was like five or six of them, got together, and that was the board of directors, as it were, and I had to present the ideas to them,

• 29:34Speaker 04

  and they said, "Yeah, go ahead and do it." And I came back with the design and had to go through its own security review, which produced issues that had to be addressed, and I went through that process and eventually went back and pitched it to them and said, "Okay, I've, I've met all the security requirements, met all the objections, we're ready to go, it's ready to field." And the, the, the, the director, the chairman of the board, don't know what his exact title was at this point, he, he said, "Okay, we'll let you do this." And literally, he said, "Don't do this again." To my knowledge, it was the first software-based system that NSA ever produced, and it was simply a computer program that would automate the process

• 30:16Speaker 04

  of doing a, a manual encryption and decryption with a one-time pad. But I actually ran into somebody about 10 years ago at a conference that remembered using it. We called it Centaur, because it was a half-paper and it was half-electronic. So, Centaur. Every, every system we produced had to have a cool mythological name attached to it. So we came up with Centaur, semi-automated one-time pad. Can't show it to you, because it was software.

• 30:42Jack Murphy?

  So, so just to like, uh, uh, correct me if I'm wrong, trying to paint the picture here, the person on the, the end user in good guy land is taking like an Oregon Trail floppy disk, putting it into the computer, and then typing in the encrypted message he had received, and the computer would spit out the decrypted message.

• 31:02Speaker 04

  Correct. Yep.

• 31:05Speaker 03

  That's pretty cool.

• 31:07Speaker 04

  And conversely, if he wanted to send a message, he's typing in a message hitting the hitting the button to encrypt it. And the trick was, um, one of the secrets of a one time pad is you use one page at a time, as much of it as you need, and then you destroy it. So we had to come up with a way of securely deleting a page of key at a time off the floppy disk. And part of that was coming up with a secure deletion or a secure overwrite routine. That was a requirement. And so I went searching and asking various offices, you know, can you, can you show me one? Can you give me the specs for one? And it had never been done before. So we had to come up, you know, it was a requirement, but we had to come up with, what would this look like?

• 31:49Speaker 04

  And so we had to come up with a routine for doing a, an overwrite of the one time pad key that was on a floppy disk. Doing it enough so, you know, other, uh, really smart people at similar agencies, uh, couldn't figure out how a way to read the, read the data off the, off the. A floppy drive you, used to be like a flimsy piece of, uh, plastic where stuff was printed on it, you know, bits, bits and bytes. In various sectors, kind of like a vinyl album, only smaller and much more compact. And, um, you know, things that get deleted off of memory space on floppy disks and hard drives traditionally, at least in those days.

• 32:31Speaker 04

  Didn't really get deleted. You would just, you would move the needle to a different part of the record and, and start writing new information there.

• 32:38Speaker 03

  Right.

• 32:38Speaker 04

  And the, or to where your information was, which was sort of kept in a master list on the drive or on the floppy disk. That was erased. So you didn't have the location anymore, but nothing was done to remove the data off the drive itself. Eventually it would come around and get overwritten. So we had to figure out how do we zone in on exactly where it is and delete the right amount of keys so that it can be done. So there, there was some, uh, engineering, as it were, or software design that had to be done. Um, and people weren't happy about it, but they let us do it.

• 33:15Speaker 03

  It, it, you know, in, in the late eighties or around that time, um.

• 33:21Speaker 03

  How were you keeping up with what was going on in the computer industry? Because it was moving fast. Like, I remember like in eighty-eight, hearing about like the first one gig hard drive and thinking, what would anybody ever do with a gig of a hard drive? That's insane.

• 33:40Speaker 04

  Hey, I had the same thought when I got my ten megabyte hard drive on my IBM PC.

• 33:44Speaker 03

  Yeah.

• 33:45Speaker 04

  Who would ever fill that up? Um, and now I think I have more storage space on my smartphone than the supercomputer that I used to use.

• 33:53Speaker 03

  Yeah.

• 33:53Speaker 04

  In the early days of NSA. So, yeah, I mean, there was.

• 34:00Speaker 04

  Try to be a politically polite answer to that question. Um, on the operations side, all you've, all you have to do is figure out how to intercept stuff. And as communications got more advanced in terms of the cryptography, you, you and other sister organizations perhaps come up with other ways of capturing the data, perhaps maybe before or after it's been encrypted or decrypted.

• 34:25Speaker 03

  Mm-hmm.

• 34:25Speaker 04

  Um, you know, and that's the land of espionage and so on and so forth. On the infosec side, um, it was actually really a struggle. And I saw it at the very beginning and it came to a head, you know, later on in my career in the early nineties, where technology was catching up with infosec, which was, you know, responsible for taking three to five years to design a little black box and we'll get it to you when it's ready. And we're responsible for providing, you know, all this here communications. Um, probably the first, I'm skipping forward a little bit, but the, the, the first real test of that, uh, for the government in general,

• 35:06Speaker 04

  uh, but for NSA in particular, was when a, a program came out called Pretty Good Privacy.

• 35:13Speaker 03

  Mm-hmm.

• 35:14Speaker 04

  Which, uh, you know, don't quote me on what year it came out, probably late eighties, early nineties. Um, and it was an encryption program and it was written with public algorithms, not NSA-designed algorithms. And it was based on what we call public key cryptography, which is, uh, where you have a pair of keys, one that does the encryption and one that does the decryption. And everybody uses it.

• 35:41Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 35:55Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic, in a big way that defined a lot of my childhood.

• 36:06Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 36:12Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 36:17Speaker 06

  So join us and hear their stories and more, because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast, on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 36:37Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down rather than giving teens the answer. Study mode helps teens work through problems, and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 37:05Speaker 01

  Cash flow crunch? OnDeck's small business line of credit gives your business immediate access to funds, up to $200,000, right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 37:35Speaker 04

  If you're online at all, every day, multiple times a day. But the idea is you have a public key that is used to encrypt the data and that can be sent anywhere. It's not secret. And the only way you decrypt a message that's been encrypted with that key is if you hold the secret key and you hold that close. That's the private key. And it's a one-way relationship like that. So you have to do a key exchange. If I want to communicate with you, I give you my public key. You give me your public key. We do something to verify we're really talking to each other. And then we're off and running. We can send messages to each other. Well, so fast forward a little bit. You know, I left the Manual Crypto Systems office.

• 38:20Speaker 04

  I was there for about three years and then I did finally get into an intern program. There's not much to this story, it'll get quick. I went over to the operations side of the house. I did happen to be there during Desert Shield, Desert Storm. So I got my certificate

• 38:38Speaker 04

  of appreciation for participating in Desert Shield, Desert Storm.

• 38:45Speaker 04

  I was an intern, so I was doing six-month tours in various offices. My last tour of the intern program was back on InfoSec side in what was called fielded systems evaluations. So we're back into the, I'm back on InfoSec, it's the early 90s.

• 39:05Speaker 04

  There was a time when one of our clients, and this was probably, I would guess 93 or 94. One of our clients, one of the military branches, came to NSA and said, why are we spending multi-millions of dollars on a secure communication system with you guys? Why can't we just use PGP? And that was really a slap in the face to to the power structure, at least the InfoSec side of things. And there was literally an all-hands-on-deck call put out for everybody in InfoSec to stop what you're doing. Everybody work on an attack against PGP.

• 39:47Speaker 04

  And there was a couple guys in an office nearby that actually did come up with an attack against it. And they were paraded around as heroes. They got huge cash awards. They were taken down to the Pentagon, the White House. I mean, the red carpet was rolled out for these guys. Months later, um, you know, when all the dust dust settled down, you know, everybody's got a short attention span. They did a luncheon learn in our lab to just tell us Pons that worked with them about their, the attack that they'd come up with PGP. And what they essentially had done was figured out a way to send a document, let's say a word document, only it wasn't word, it was but some predecessor.

• 40:32Speaker 04

  And they found some unused bit space in the document that they were able to insert a virus, as it were. And, uh, you know, if they sent this document to, to somebody and could trick them into opening the document, it would execute this code that would essentially steal the key rings, the secret key rings and attach it to an email back to whoever had sent the email. That might sound familiar to you guys if you keep up with cybersecurity schemas today. Yeah. Sounds a little bit like a phishing attack. Yeah. Uh, only we don't, you know, we don't click on attachments anymore. We click on links. Um, but I, I remember sitting there and, you know, hearing them describe this and then

• 41:16Speaker 04

  they got to the point where they're asking, you know, does anybody have any questions? And I raised my hand, I said, wouldn't this work against our stuff too? And they kind of looked at each other and they're like, well, yeah. I said, so what's the big deal? I said, well, our mission was to come up with an attack against PGP and that's what we did. I'm like, okay. If that's what, if that's how you sleep at night. Um, but yeah, I mean, they, well, and which is very, and I'm not.

• 41:43Speaker 04

  It was funny then at the time and it's kind of a funny story now, but I mean, they did make a difference. They did come up with an attack, but as is true most often, uh, and I've been in this business, you know, forty some years. Uh, when you're attacking crypto, very rarely are you going after the algorithm itself.

• 42:02Speaker 03

  Uh huh.

• 42:02Speaker 04

  Um, you're, you're going after the implementation, uh, and either the implementation of the cryptography itself or what we call the key management or the key distribution. So they didn't essentially break the algorithm, they just stole the key.

• 42:18Speaker 03

  Right.

• 42:19Speaker 04

  When is, when has that ever happened before in, in the history of the world?

• 42:23Speaker 03

  Right. Jeff, can I, can I back you up real quick? I just want to ask because you were, you know, the, the Soviet Union was a real threat when you joined NSA. And then in eighty-nine, the wall fell and the Soviet Union was no longer. Did the NSA at all go through any kind of identity crisis? Were, were there issues where like who's our enemy now? Or did you guys just kind of have a mission and drive forward?

• 42:48Speaker 04

  Um, there, I don't know if anybody in power would admit to it, but absolutely there was issues because once the great Satan fell, uh, that was Reagan's term for President Reagan's term.

• 43:02Speaker 03

  The evil empire.

• 43:03Speaker 04

  The Soviet Union, the evil empire. Um, once they fell, yeah, for the first time in a long time NSA had to worry about, uh, you know, budget requisition. They had to go before Congress and justify what they were doing.

• 43:19Speaker 03

  Right.

• 43:19Speaker 04

  Um, and I'm not a conspiracy theorist, but, um, you know, Desert Shield, Desert Storm happened shortly after the wall fell and, you know, terrorism became kind of the, the thing that kept things alive, but that wasn't really a, a clear.

• 43:38Speaker 04

  A clear and present danger. Mm hmm. Wrote in my Tom Clancy books. Um, it it it wasn't something you could put your finger on. I mean, I, you know, I remember watching videos about terrorists when I was uh waiting for my my top secret clearance to come through and and um, you know, classified briefings at the time about, you know, what did the terrorists do back in the seventies and eighties? They'd hijack planes, they'd blow them up. You know, that, you know, they, that was the thing back then. Um, you know, there, there was, you know, one plane in particular that, you know, nobody knew it, but there was people on it from NSA and CIA, and there was suspicions of whether people knew. Um.

• 44:24Speaker 04

  Oh, you're talking about Lockerbie? Uh, I can neither confirm nor deny, but it's been a long time, so it's probably declassified at this point. Um, uh, there was the one plane where um, they landed somewhere and they they killed a passenger and shoved him out the wind, the pilot's window. Yeah. And and it was a, it was a, I think it was a Navy enlisted person. Yeah, it was a diver, I think, right? And they, they, the reason they tagged him or or or pulled him out is because he was in uniform. Because uh, what I remember hearing at the time, the, you know, the briefing I got, the video I watched about that was there is a a flight attendant

• 45:07Speaker 04

  that uh had been asked to collect the passports of all the passengers and for whatever reason, US citizens get a blue passport, but government employees get a red passport. And so she was able, as she was collecting the passports, to somehow hide the fact that she was collecting red passports. I mean, when I was at NSA, I was issued a red, you know, it's more like a burgundy passport. And that's your official passport to use on international travel. And you're only allowed to use that password, but then I was pulled aside and said, take both. And I did. And uh, you know, for the official get through customs, the red one comes out. Everywhere else, it was the blue password. I'm just Joe Citizen, much because of that experience of that plane being hijacked. So, um.

• 45:53Speaker 04

  Yes, there was an identity crisis. There was a justification for budgets that had never been realized before and computers were becoming much more a thing. I mean, we sort of leapfrogged over the whole machine age into the digital age and NSA was largely unequipped for that and slow to respond. You know, think, you know, probably too soon, but you know, think a large ship that's, you know, pointed towards the pylon of a bridge and how hard is it to steer that and turn that thing? Right. I'm five miles away from that particular, what used to be that particular bridge.

• 46:32Speaker 04

  So they were very slow. There was also a certain amount of attitude, I would say, in sort of the old guard where like, you know, people can, you know, was it Henry Ford? You can have whatever color car you want as long as it's black. I mean, they sort of had a monopoly on crypto and so they weren't very quick to change. They did start farming things out to contractors and third parties. The classified telephone that was popular at the time that I was there called a

• 47:11Speaker 04

  secure telephone unit, STU, and they were up to the Stu three, the third version, which looked like an old fashioned office desktop phone and there was three contractors that were allowed to build it. It was RCA, GE and Motorola, I believe, were the three models. If you're old enough to remember those and have worked for the government. So, early 90s, I'm back in this fielded systems evaluation office and that's where I started doing.

• 47:45Speaker 04

  Uh, penetration testing is what we called it then, but trying to break into computers and network systems. We were, we were assigned to break into uh, military facilities throughout the world. And at some point, we decided, why don't we just call it penetration testing? Cause that's what the world's calling it. Let's become hackers. Um, so that was early nineties. Um, the, you know, NSA trying to respond to the changing world. They reorganized and formed what they called the Systems and Network Attack Center. It was, the vision was that it was going to be a center of excellence and it'd have all the really smart people. And NSA has lots of really smart people and they were going to be experts on everything related to computers and networks.

• 48:30Speaker 04

  And of course, we'd been doing this for a couple of years at that point, this small team of people. And we were, we had realized because of being involved in something that's interconnected. We realized very quickly, there's a whole lot of people in the world that are focused on this problem. I don't care who you are, you have a small subset of ten, twenty, a hundred, two hundred people. There's no way to compete against the whole world.

• 48:54Speaker 03

  Right.

• 48:55Speaker 04

  For that kind of brain power and, and distributed thinking, let's say. Um, but they, they, they went about doing the reorganization. And that's when the, the office that I was in got pulled into it. And we were sort of formally given the task, the small group of people that I worked with of, of just doing. Um, we called it vulnerability and threat assessment, but for lack of a better term. We said, we're hackers and we're, we're learning how to do pen tests. Um, so that was, we were formed officially, I guess, ninety-three, ninety-four. Uh, at least in terms of this new organization. We moved to a, I'm sorry.

• 49:34Speaker 03

  I, I just want to, I'm curious because you coming from cryptology. Um, had computers been a hobby, uh, you know, had you been learning, um, C or like C plus, like, I don't, I don't know what language or languages were prevalent at that time. But.

• 49:54Speaker 04

  Right.

• 49:55Speaker 03

  But how were you personally, and then as an organization? How were you managing, how were you catching up with these teenage kids? Who had nothing better to do than to figure out how to, you know, break into shit?

• 50:13Speaker 04

  Well, um, I mean, I graduated from high school in nineteen eighty and I remember taking a computer math class. So it was late seventies, but it was a, you know, very rudimentary type of PC. I think I was programming in BASIC. That was kind of cool. We wrote our programs to punch tape. Um, it was, it was even before the, before the era of floppy disks. So, you know, I'd have two or three or four feet long of punch tape that I would have to feed into a machine to read my program. Um, so, yeah, I was kind of interested in it. I had an older brother, one of my older brothers, uh, you know, sort of the brain of the family.

• 50:54Speaker 04

  Um, he was, uh, he, he was into physics and engineering and, and he was always buying the new toy of the month. Uh, so he, you know, he built a computer, uh, you know, built it from scratch. Kind of like you build, you know, the old ham radios. Of course, he did that when he was a kid. But at some point he built his own computer, very rudimentary. And then, you know, what was popular at the time, the Apple two E or Macintosh or something like that. He was always getting computers. He was the first one to have the first video game, Pong. And he was the first one to get a Nintendo and an Atari. Um, you know, I kind of grew up playing video games at the arcade.

• 51:36Speaker 02

  Mm-hmm.

• 51:36Speaker 04

  Everybody remember that, um, you know, put a quarter in the machine and play the game and, and keep putting the quarters in. Um.

• 51:47Speaker 04

  So I, I was into it because it was new and it was kind of fun and different. But I wasn't like, how does this work and, and digging into the innards of it. But at NSA, um, you know, when I was in the intern program, I had to write it. One of the assignments was to work for a, a programming office. And I had to write a computer program. That was one of my assignments. And at the time NSA was converting from their own.

• 52:16Speaker 04

  Mainframe supercomputers that they had their own custom operating system on it. And and their own primer programming language that all their number crunching. Cryptic cryptic analytic calculating statistical counting types of programs have been written on. They were migrating over to what at the time was fairly common Unix workstations. Primary Sun Microsystems later, you know, Sun OS later to be called Solaris. So the IBM PC left and in came a Sun workstation, the old pizza boxes. Spark five tens, whatever they called them.

• 52:59Speaker 04

  So I had to I had to rewrite a program that had been written in a in a proprietary language at NSA in C. And of course, I got it to compile and then got it to hang the first time I ran it because it it worked, but it didn't optimize for the number crunching type of thing it needed to do. So, you know, I did that. It was kind of cool, but I wasn't really into it into it. But the idea of breaking into things, that was kind of cool. The idea of going someplace where you weren't supposed to be, learning a hidden trick or a hidden feature. There weren't many exploits in those days. It was mostly

• 53:43Speaker 04

  features of the operating system undocumented or undocumented. We're just learning the tricks of how to fool the computer or trick the computer into giving you stuff. And of course, a lot of stuff was there and it wasn't that hard to do. And, you know, other people had figured out a lot of the ways to do stuff. So, you know, the terminology in those days was script kitty. So, starting out, I was much more of a script kitty, just doing the stuff that other people had figured out. But trying it on our classified networks, even though it was, you know, something that was discovered out in the real world. But because I had a cryptic analytic background, one of the things that I enjoyed doing was password cracking.

• 54:25Speaker 04

  And, you know, of course, I didn't write the programs. I was using the programs that were available at the time, but learning how to tweak them and and fine tune them. Password guessing was a thing back then. I was actually pretty decent at guessing passwords. Nobody does that anymore these days.

• 54:46Speaker 04

  There was a lot of our, a lot of our customers when we were doing these fielded systems evaluations, we were going to military bases throughout the world and they always had like some, you know, real whippersnapper teenager, but he was also, you know, an E4, an E5 now. And he was, you know, because he knew computers, he was responsible for computers. So he came up with an idea of coming up with a random password generator. Uh, and so they had all, you know, they knew passwords, security was a thing back then. So they wanted to come up with ways of defeating the password cracking tools or just making passwords less prone to being guessed.

• 55:27Speaker 04

  And, um, they inevitably were horrible because, you know, from a crypto analytic statistical brute force and perspective, uh, they almost inevitably fell. I mean, I remember one guy, I want to say he was at a base, doesn't matter where he was, but you know, he, he thought he had this program that was really cool and was producing really random looking passwords. And we cracked a hundred percent of them in minutes. It, you know, it, it just, it was that bad. Um, so that's where I kind of like applied the crypto analytic stuff that I'd learned to some, to some aspect of it. And we didn't call it cybersecurity at the time. We, we actually called it internet security. Um, but that was something I could kind of focus on as sort of a niche area.

• 56:12Speaker 04

  It's like, oh yeah, I'll focus on like password cracking and, and how to come up with strong passwords, random passwords, and any of the, any of the few types of crypto analytic things that were associated with operating systems at the time. Um, that was sort of my focus. The other focus I had, I guess, was I, I worked with people, um, both while I was at NSA and then even into the private sector days, years after, that would love to just break into a system, get root. It was all root because it was all Unix back then and say they were done. And I was more like. Well, we've just broken onto a computer or a server. Why don't we look at what's on it and see what's there? What kind of information is there?

• 56:56Speaker 04

  They were all about the hunt and let's conquer another box. Let's root another box.

• 57:01Speaker 03

  Right.

• 57:01Speaker 04

  I was more about the analytical, what kind of information is here? And what can we learn about our, our, our target or our customers? Or what, what, what is sensitive here that might give us more of a clue of where to look next? Or, you know, have we found the crown jewels? Or, you know, just whatever it was, but just looking at stuff. So I tended to do more of a analytical, deep dive. Let's see what we've got, rather than just keep knocking over boxes after boxes after boxes and saying, we're done.

• 57:33Speaker 03

  Right.

• 57:33Speaker 04

  Moving on.

• 57:34Speaker 03

  So, so how did that develop for you? Because while all these other people are trying to like get root. Now you want to get into the system. You want to go through the various like, uh, you know, file systems and everything like that.

• 57:47Speaker 04

  Right.

• 57:48Speaker 03

  Uh, you know, and move throughout the system. Like, what does that look like for you compared to what everybody else was focused on?

• 57:57Speaker 04

  So, back in those days, um, the, sort of the methodology, uh, which ironically is based mostly off a, a, a film that came out in the early nineties called Sneakers. Robert Redford and Ben Kingsley were the stars. Um, and that was sort of the first movie that showed, um, what people would more, more commonly refer to as a red team exercise these days. Cause you know, a combination of computer hacking, but maybe physical penetration testing. Um, the methodology was simply back in those days. You have a target, you have a company, an organization.

• 58:40Speaker 04

  Um, everybody had their own IP, routable IP addresses. There was no masking back in those days or no private addressing. Everything was internet reachable.

• 58:51Speaker 04

  Because everything was connected. So you'd you'd find out what the target was, whether it was a class C address or a series of class C addresses, which is two hundred and fifty five potential addresses. And then you do a um a a probe of each IP address, do some sort of rudimentary scan to see what's alive, what's answering. And so, once you found live targets, you do a port scan, which is basically, okay, what's what's this machine talking on? You know, in T in TCP IP, there's sixty five thousand five hundred and thirty five potential channels that you can talk on. And there's some commonly associated uh reserved ports that are associated with specific

• 59:35Speaker 04

  protocols, specific services. Start with there and and most of the protocols, communication protocols back then were clear text. There wasn't a lot of encryption going on. Um, so you would find what they were talking on. And then, you know, that's usually when you could, you know, connect to a system, maybe steal a password, maybe guess a password, maybe force a uh one of the programs that was listening to hiccup and give you access. There's there's many different methods of doing it. But uh the goal then was uh to get access.

• 1:00:09Speaker 06

  Hmm.

• 1:00:10Speaker 04

  And it didn't have to be root. It could just be any user account. And then, once you had that foothold, that toe in the door, then you try to elevate your privileges to root. And once you're on the system, there was any number of ways of doing that, including reading the password file, which was world readable. Anybody could look at what the password hashes were that I'm not using the word correctly, the encrypted passwords. They're hashed passwords. But you could copy that and run it into your computer pracking program, which conveniently was called crack.

• 1:00:44Speaker 04

  So elevating privilege, I mean, that was sort of the modus operandi. The first thing to do is get to root because once you're at root, you have access to everything. Any file system, any folder, any, anything that was locked down and protected, root had access to. Because root was what we called the God account. It could go anywhere, it could do anything, which is why we used to say to our clients, if we've got root, we're done. But they would very rarely understand that, comprehend that and, and take it to heart. Which is why it was, it became beneficial to say, okay, you're not getting it that we have root. But would you understand it if I said, we're looking at your financials for the previous quarter? Right.

• 1:01:26Speaker 04

  And we can, and we can see all of it, or we can look at the payroll and tell everybody, you know, what they're being paid? And who got what bonus and the people sitting next to each other, one person's getting made, paid 15% more. And he's a guy and she's a woman and we can blow things up. Or, you know, research data, or we know where the money is, you know, there's, there's any number of things. That tends to be something that, you know, I have no idea what you're talking about getting root, but you can do this. Right. Um, I mean, when I was, a- and I'm blurring the lines a little between my NSA days and my private sector days. But when we first started out doing this at NSA and people started, and we started calling it pen testing.

• 1:02:10Speaker 04

  Um, and we started being asked not by just, you know, our military customers, but like offices within NSA and other classified networks, you know, within the, the community. Um, we started kind of having to come up with processes and kind of formalize a methodology. Because we had to get permission to do it. Um, you know, I mentioned early on in the interview, um, the church proceedings in the NSA charter. Um, that became an issue, at least early on, because, you know, even though we were white hat hackers, we're the good guys trying to break in, um.

• 1:02:51Speaker 04

  Because we're NSA, we technically weren't allowed to to break into computers and networks that were US. Right. Owned and operated. But, you know, as long as it was in the classified world, it wasn't really that much of an issue. Um, but we did have to start talking to our general counsel and for whatever reason, I volunteered to to to do that. Uh, you know, I was a business major. So finally I was like, oh, we need organization, we need structure. I can do that. My friends that I worked with, they were much more into the gears and and, you know, the weeds of the technology and like business processes. I got that, I can do that. So I started talking to the lawyers.

• 1:03:30Speaker 04

  Um, I I tell a story that, uh, uh, well, to level set, everything that we did in terms of our techniques for breaking into computers and networks, when we were working within the classified realm, everything we did, uh, by rule had to be classified at the level of our target. So naturally, if we were working on top secret systems, everything that we did was classified top secret. In order to get authorization to do top secret stuff against top secret targets, you had to go through bureaucracy and red tape and and get all sorts of permissions, which took a god awful amount of time.

• 1:04:13Speaker 04

  I mean, we literally would have to wait weeks to get permission to try to break into something that was even, you know, within NSA, like another organization, another office within NSA. And of course, what nobody, what we didn't tell the powers that be, we'd already broken in, we already knew how to do it. And then we'd do the paperwork of, you know, this is the way we're gonna try it, this is our attack methodology and and, uh, then we'd have to go off and get permissions, which was on a typed up piece of paper that had to be signed or initialed by every level of management from our our branch on up to the group level, over to the group that was the target and down their management chain.

• 1:04:55Speaker 04

  And this was paper passing from desk to desk, secretary to secretary, it might sit on a desk for hours or days. So it would it would take weeks. Um, I tell this story in a talk I've given a couple of different conferences, but usually when I'm telling the story about what was our tradecraft, what did we do, I have to qualify and say technically I can't tell you what we did because it was top secret. And then at some point I say, okay, I'll tell you one. So I have this big, you know, disclaimer banner, top secret. And I say, okay, are one of our primary cyber weapons that we use to get against top secret systems was something called the ping command.

• 1:05:40Speaker 04

  Let that sink in, or if you don't know what a ping command, it's a system level command that comes with every Unix operating system. It's basically, and it's named after a submarine sonar. You know, it sends out a signal and waits for a response. Are you there? Yes, I'm here. And it'll ping every single address on whatever your target space is. Very rudimentary, very common, part of the operating system. It's a feature. But because the lawyers looked at it and said, well, you're eliciting response from the target. Therefore, this has to be considered an active attack. Therefore, it qualifies as a top secret cyber weapon. Wow. That's the logic that we were dealing with. And that's where I kind of like, okay, we got to fix this.

• 1:06:24Speaker 04

  So I started talking to the lawyers and started teaching them about our methodologies. And their idea was, why don't you just show us what you do? And we'll pre-approve it so that when you get a job request to do an attack, you can just tell us, well, we're going to do a little of this and a little of that and a little of this over here and a little of this. And it'll be kind of like an a la carte menu. And we already know what they are and what they do. And we'll just pre-approve it and it'll be pretty quick. I'm like, yeah, the problem is you don't know what you're doing until you're in the middle of it. Right. Um, and you know, it starts with the probing. We called it recon, you know, what's out there? And what's out there? What are they talking on? What, you know, how are they communicating? What are they listening on? What are, you know, what are the ports and channels that are open?

• 1:07:09Speaker 04

  So I went through a process. I would meet weekly with our lawyers and just sort of teach them the fundamentals of penetration tech, testing and hacking and how do the computer networks work?

• 1:07:22Speaker 04

  And I say all this because one time um I was showing the lawyer uh even though he was sort of on an isolated sup network that he thought was very super secret because he's dealing in all sorts of legal proceedings and investigations and he had his folders and files on his computer that he thought was completely protected and top secret. I'm like, well, let's look at that. So we were sitting in our office, which was in a a physical building that was different, probably ten miles apart. I said, let's go, let's, let's go over to your network. See, here we are. Here's your file system. We're on your system now. We, we, we had him log in. And I said, let's look at your directory structure. And I'm looking through it and, you know, Unix file permissions.

• 1:08:07Speaker 04

  There's this concept of the owner, a group membership, and then the world. And for each category, there's the option of read only, read and write, or read and write and execute. Um, let's just go with read for now. I was looking at his folders that were supposedly top secret, his eyes only. I'm like, that folder is not only your readable, and not only the lawyer group readable, general counsel's office readable. It's set to anybody read it. Look, I've just clicked on the folder. Here's all these files. Look, I can click on, oh, you know, this document here and open up. He's like, oh, my God, don't do that. That's all secret stuff. Oh, my God. So he got this really great education on

• 1:08:52Speaker 04

  how to set file permissions so he could actually lock down his folders.

• 1:08:55Speaker 03

  And, and you're not doing anything supremely technical right now. You're, you're just accessing his network. And he has open permissions. Like, you're not even technically really hacking. You're just showing him how, how much access a knowledgeable person would have.

• 1:09:14Speaker 04

  Right. Yeah. And that's a good way to sort of summarize it. I, you know, I, I mean, the hackers that are out there these days, the security researchers. They're trying to come up with creative ways of breaking things, using a methodology that's similar to what was done back in those days. But in the early days, it was much more just taking advantage of what I would call undocumented features. You know, what can the system do? And taking advantage of knowing more about how it works than the users. Because in the early days.

• 1:09:48Speaker 04

  Most users didn't really know how it worked. They could barely get it to work and they were happy if they could get it to work. It wasn't anybody telling them to do anything else.

• 1:09:57Jack Murphy?

  I, I, I have a question. As, as you describe all of this, it actually reminds me a bit of, you know, Richard Marsinko's Red Cell, uh, which was testing physical security at military bases. You guys were of course doing that in the electronics space. I was wondering, did, did you guys get any sort of like pushback or political fallout from what you were doing? Like people who are shocked or embarrassed and maybe even angry that you were able to penetrate their systems?

• 1:10:26Speaker 04

  Um, interesting segue question. Um, initially, no, when it was mostly, you know, military, targets that they'd asked to do it and then internal, uh, targets that, yeah, I take that back. We did have one internal target one time that, uh, you know, supposedly that they were isolated with internal segmentation, what we would call it these days, but supposedly there's a firewall or some sort of router, uh, with, with some sort of access control lists in place. And we were doing initial program, probing and we had, I think we had a target of either an IP address or maybe an IP range.

• 1:11:10Speaker 04

  But us being us, we just kept going. It's like, what else can we see? Where else can we go? And this particular target, which was an internal office, they did have some sort of monitoring in place. And they were detecting our activity and, um, you know, we technically went beyond the bounds.

• 1:11:32Speaker 04

  But, you know, we, we didn't break into anything. It was like, well, the door was open, you know, everything was answering, you know, we were just, we just kept going. There was nothing blocking us. We didn't subvert anything. We just, this is how far we could go. But there was a point where, uh, we sort of got called to the carpet and I guess I've been doing a lot of the work and I got called into a meeting with the customer and that poor guy, I, I still feel sorry for this guy. The guy that they had assigned to be like the investigator, he was a very. Apparently some branch of the military police and he came in with like a stack of notebooks with printouts of all the activity that he'd seen us doing, me doing and had it all printed

• 1:12:15Speaker 04

  out because they thought they'd caught a bad guy. He was like, they're ready, they're ready to throw the book at us. And we're like, well, no, we had this request to do this thing and we just kind of didn't know where the boundary was and we just kept going and they're like, oh, well, thanks for letting us know. We didn't realize it was that for us. And the guy was like, he didn't, he never got a chance to open it. I mean, he, it, it must have been a foot high.

• 1:12:38Jack Murphy?

  As far, this might be a little sensitive, but I mean, as far as like the attack surfaces that you guys used, I mean, did you have to be inside the NSA to get to, to even launch this attack? Or were you guys replicating an outside attack, you know, perhaps a foreign adversary?

• 1:12:56Speaker 04

  Well, you know, our targets, at least in that case, were internal to internal and technically, whatever we was doing, what we were doing was classified at the level of the targets. So technically what we were doing was top secret, but uh, it's probably a safe bet to think that we were doing a lot of the techniques that were publicly available because guess where we were learning how to do it, publicly accessible stuff. Um, so yeah, that's how I'm going to answer that question.

• 1:13:27Speaker 03

  What, what was your relationship like? Because like I remember, you know, in the late eighties, going to my local game shop to buy D and D stuff and there's always a copy of twenty six hundred there.

• 1:13:40Jack Murphy?

  It's a magazine.

• 1:13:42Speaker 03

  And, you know, and for people who don't know, twenty six hundred was like, like the OG, I think, uh, you know, hacker, like little booklet, magazine pamphlet type booklet thing. And then the DEFCON started in the early nineties. So there was this, there was this vibrant,

• 1:14:01Speaker 03

  hacker community out there that was moving along with the times from, you know, crap, Captain Crunch, you know, and, and freaking and, and all that. How was your relationship with them, these people who are sort of breaking the law and on the cutting edge, but also like pushing it?

• 1:14:23Speaker 04

  Right.

• 1:14:25Speaker 04

  I mean, at the, at the time, um, we didn't interact with many of the people in, in, in that part of the community. I've certainly, over the last 10 years or so, had the, had the privilege of meeting many of those folks.

• 1:14:38Speaker 03

  Yeah.

• 1:14:39Speaker 04

  And comparing notes and so on and so forth. Um, but I mean, we were certainly learning from them. I mean, we, we, you know, back in those days, it was bulletin boards and mailing lists and, you know, you know, our, our best resources was the internet and, and learning all the places where people were posting stuff about hacking and breaking into things. So we were certainly learning from them. And I, I would even say that we, we felt like we were behind them. I mean, when we were, when we were considering ourselves to be students and learning all this stuff, I mean, that, they were doing it and we were just trying to pick it, pick up on it and learn from them. Um, so there was, I guess

• 1:15:22Speaker 04

  from our perspective, a certain amount of respect, but, um, you know, there, there's a handful of people that kind of went south of the law and got caught and prosecuted. Uh, you know, I have different opinions on some of those people. Um, there was, you know, certainly, uh, mythology associated with it. You know, there's sort of, you know, the, the elite or leet hackers that, you know, the, the uber hackers is what we called them back then. You know, I, I hope to somebody meet, someday meet some of them. Um, but we were kind of learning and doing stuff and figuring out stuff. We, we certainly

• 1:16:03Speaker 04

  had access to a lot of resources that a lot of people don't have access to. I mean, we had access to Unix source code, and this is the, before the days of Linux. And, and the Unix source code is something that, you know, that, that the agency NSA paid, you know, God knows how much money for. Um, so, you know, we were able to look at all the internals, all the function calls, all the libraries. So we, I mean, we, we had a fair amount of opportunity to tear things about, we had to tear things apart. We had a fair amount of resources that maybe not everybody has, but we still considered ourselves to be students and learning. Um, you know, it's funny, cause, uh,

• 1:16:45Speaker 04

  Yeah, we'll get to why I left NSA in a little bit, hopefully, but you know, was out in the private sector for, for a few years doing the penetration testing and trying to get, basically trying to convince companies back in those days, if you're going to play on the internet, you really need to have a firewall, you really need to have some sort of secure architecture, you need to have some sort of clue or plan as to what you're doing. So you need to put a security program in place and figure out what it is you want to protect and need to protect. And at some point, I got really frustrated with, you know, being hired by clients every six months to break in and we'd break in the same way time after time. And we tell them this is really easy to fix and they didn't seem to

• 1:17:26Speaker 04

  want to care to fix it. And at some point, I'm like, okay, I'm done pen testing because that doesn't seem to be getting the message across. And I ventured into, you know, I need to, I need to just be able to talk to companies and explain it to them and explain why they care and explain why it matters. And, and about the time I made that decision is about the time that this thing called PCI came along, the payment card industry. And I got, I got sucked into that, but it was nice at the time because there were a lot of companies that had to do PCI and it's, it's a, it's a, it's a private sector regulatory security standard that's of, by, and for the, the credit card industry. So it's not

• 1:18:11Speaker 04

  a federally mandated thing. So it's voluntary, but if you don't do it, you don't get to take credit cards if you're a retailer or any kind of business that wants to make money. So it was, for me, it was beautiful because-

• 1:18:24Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 1:18:39Speaker 07

  People would always think I was lactose intolerant. So I just kind of shortened my explanation to I'm deathly allergic in a big way that defined a lot of my childhood.

• 1:18:50Speaker 06

  And while there are challenges, there are moments that remind you, you're not alone.

• 1:18:55Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 1:19:01Speaker 06

  So join us and hear their stories and more because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At The Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At The Table and start listening on the free iHeart radio app today.

• 1:19:21Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, study mode helps teens work through problems and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 1:19:48Speaker 01

  Cash flow crunch? OnDeck's small business line of credit gives your business immediate access to funds, up to $200,000, right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 1:20:18Speaker 04

  Because it gave me a captive audience. And I did that for a lot of years. And one of the, one of the people that I worked with at NSA in our little hacking group, our pen test, went out into the private sector, became an entrepreneur, started a company, and it finally agreed, you know, we finally came to terms and he found a way for me to come work for him. And when I came to work for him, which is, gosh, it's been 10 years ago at this point, he said, oh, I want you to be an evangelist. I want you to start going to the conferences and start telling stories and do some, you know, you know, talk about the stuff that we did and.

• 1:20:57Speaker 04

  And so I, I, you know, having, I mean, there wasn't much of a hacking community in terms of conferences and training and certs, you know, back in the, in the, when did I walk away from the early 2000s, 2004-ish? But, you know, compared to 2013, 2014, 2015, where there's lots of hacker conferences all throughout the country, there's security B-sides conferences, so on and so forth. Um, so I, you know, I was like, I was kind of nervous because I'd kind of been away. I walked away from pen testing. I was just talking to people for, you know, the better part of 10 years and explaining a particular security standard, which to this day is still a decent standard. And, you know, here's all the fundamental things that you should think about and do.

• 1:21:41Speaker 04

  But, um, as I went back to these conferences and started meeting people and over time, I, you know, one of the thoughts I had was, oh, I'm going to meet all these smart hackers and they've had 10 years to keep working and growing. And I've been going to these conferences now for 10 years and I'm still waiting to meet those Uber people that, uh, were, that my perception was they were so advanced. Not to say that I'm advanced, but I think we were all in it together and we were all at a similar, similar level, which is always learning. I mean, nobody, nobody claims to have the complete understanding of all of this.

• 1:22:21Speaker 04

  Uh, there's always more to learn and there's always more to discover and there's always layers and layers and layers, but, um, I, I've had the privilege of meeting a lot of the people that were, I considered to be the pioneers and my heroes uh, over the last couple of years. I've met a lot of people that were members or some of the famous, um, you know, hacking groups and hacking collectives from back in the, back in the day. And I, I've, I've, I've met a lot of people and they, and I apologize if this, I hope this does not come across as egotistical, but,

• 1:23:00Speaker 04

  um, as I meet all these people that are, you know, far away from the Midwest, you know, got into phone freaking to get free long distance and then later free cable and they just kept going and they figured out some things. Um, nobody's had the experiences that I've had. Right. Um, you know, which, you know, and for me, it was just, you know, The right time in the right place type of thing. But I've never met anybody yet to this day that I'm like, I I'm completely in awe of. In Uber hackers. Two exceptions, the Uber hackers. Um, most of them are almost as much as excited to meet me as I am to meet them.

• 1:23:42Speaker 04

  Uh, I remember before COVID, I think the last DEF CON, so it would have been 2019. I was, um, sitting around with some folks. And, uh, one of the guys I was sitting with was a, a guy whose name is Weld Pond. He's a member of, uh, the Loft, which became famous back in the, in the, in the nineties for, uh, figuring, producing one of the, the, one of the first, if not the first, uh, password cracking routines that would work on Windows passwords. Uh, so it was called Loft Crack. Uh, and they, they were a hacker collective, a bunch of smart guys out of Boston, you know, Berkeley, Harvard, MIT type people.

• 1:24:26Speaker 04

  And I'm sitting there with one of them. And then one of the other guys I was sitting with, uh, I was introduced to, he's one of the original members of Call to the Dead Cow. And they're famous for other reasons. And I'm like, wait a minute. He's the, he's the Loft. He's Call to the Dead Cow. Um, and now is probably when I should mention the, the nickname for our hacking group at, at NSA came to be known as the PIT. And so I'm a member of the PIT. I'm one of the founders, architects of the first penetration testing team at NSA. And we called it the PIT. Um, so I'm like, it's the Loft, it's the PIT, it's Call to the Dead Cow. I'm like, guys, let's get our picture taken together. So I had somebody take our picture and I was like, you guys don't know this, but this

• 1:25:09Speaker 04

  is really historical because, you know, dark side, dark side. White hat guy, inside of the good. Um, but you know, smart guys, uh, nobody's, nobody's Uber that I've ever met. Most of the people that especially from the early days are all pretty humble.

• 1:25:26Speaker 03

  Yeah.

• 1:25:26Speaker 04

  You always, you always hear about all the real elitist arrogant jerks. And there are some out there, but most of the people that are really serious about this craft, as it were, are pretty humble. And, and pretty eager to share and, you know, love to swap stories and share stories. And I've certainly had a lot of great opportunities to do that. One of my idols, uh, you know, one of our motivations back when we were forming the pit. And we formed, we, we, when we were reorganized into this thing called secure, uh, systems and network attack center, the SNAK. Uh, the center of excellence for computer and network security back in 1994, we got moved to a new building and we got moved to an office.

• 1:26:11Speaker 04

  And we nicknamed our office the pit. And, uh, one of our, uh, motivators was a book called The Cuckoo's Egg. Written by a gentleman named Cliff Stahl. Cliff Stahl is like a, you know, Berkeley astronomer, you know, physicist, smart guy. Um, and he had, he had noticed that, uh, by a matter of circumstances, that somebody was breaking into the, the university mainframe and stealing a lot of government secrets, because back in those days, the only thing that was connected on the internet was mainframes from either, you know, the government and research university. And, uh, he, he set out to track down and find the people that were breaking in.

• 1:26:57Speaker 04

  Fascinating story, uh, sort of invented forensics. Uh, and he, and he, and he documented his, his experiences in a book he called, that's called The Cuckoo's Egg. Uh, must read if anybody's, uh, interested at all in this, uh, discipline.

• 1:27:15Speaker 04

  Um, couple of years ago, again, pre-COVID, uh, in fact, I'm going back to the same conference where I met Cliff Stahl. Yeah, end of this week, but I was at a security conference up in Canada. He was the keynote. So I'm like fanboy. I get to meet Cliff Stahl and he, and he's a goofy, quirky, weird kind of guy. He did a keynote presentation with a view graph projector. That's how quirky this guy is. Two thousand nineteen. Guys probably don't even know what a view graph is. Overhead projector. Yeah. His, his, his talk was a, a. Transparency.

• 1:27:48Speaker 03

  Laminous, yeah, the transparency.

• 1:27:49Speaker 04

  A transparency that he laid down on a box that lit up through a, through a lens that would project. Yeah. I mean, old school, totally, totally geeky and quirky and cool. And it was, and I had to go up and introduce myself and meet him. Get my picture taken with him and I told him I was NSA and he's like, oh yeah. He visited NSA as part of his tale of trying to figure out how to hack, catch these bad guys that turned out to be Easterner hackers. Um, and, uh, to my chagrin, the only time I've really been nervous to give a talk. Cause my, you know, he did the keynote and I think I was the second or third talk after him. Um, he's sitting in the front row, like, you know, one of my heroes, he's going to sit and listen to me give a talk.

• 1:28:35Speaker 04

  Um, but that's how cool he was. Uh, I've met the guy that wrote PGP, Phil Zimmerman, a couple of years ago. Um, I've pretty much met all the pioneers at some point. Um, and what's funny is a lot of those people. Because, uh, they got into it out of necessity. They, they didn't start out as computer scientists and they didn't start out as programmers or, um. Administrators, they just had a job and computers became a thing. And so they wanted to learn about it and make it work to get something done. A lot of them went back to their day job, you know, Cliff Stahl is still an astronomer or whatever he does. And a lot of these other guys that.

• 1:29:16Speaker 04

  Were a lot of university professors, university researchers, they went back to their first love. There's very few of the early rounded people that actually, oh, you know, saw the dollar signs and, and went with it and, and became a millionaire.

• 1:29:31Jack Murphy?

  To, um, to backtrack a little bit, do you want to talk about, um, I mean, you mentioned it briefly, why you ended up leaving the NSA?

• 1:29:38Speaker 03

  Eh, eh, even before that, though, you do have, when, when, um, when we met at a conference, you showed me orders, uh, or, or, uh, military wise, I'd call them orders, but a, but a document authorizing you to do the, was it the very first pen test of an outside organization?

• 1:30:00Speaker 04

  All right. It's the same question to the same story.

• 1:30:03Speaker 03

  Okay.

• 1:30:04Speaker 04

  And, uh, and so I'll, I'll try to, uh, there's a lot, I have a lot of stories. I apologize. Hopefully people are entertained.

• 1:30:11Jack Murphy?

  It's, this is a podcast. People love stories, Jeff.

• 1:30:15Speaker 04

  All right. So I'll keep going and they can play me at 1.5, which makes it go even quicker. Um, so, you know, I'm in the pit. We're, we're doing all these, um, you know, pen tests of, uh, military bases throughout the world and, and NSA facilities and, and other classified, uh, uh, environments and

• 1:30:43Speaker 04

  for whatever reason, and all I can say is, you know, it's because I was the business major. I was sort of the, I became the biz dev person and was trying to formalize what we did. Uh, I was the only one that was really interested in talking to, you know, managers and suits and, and, you know, people other than just talking the tech and doing the stuff, talking to the lawyers. So in, you know, in doing all that, we were putting together a methodology and we were writing it down so it could be a repeatable process. It was something that had a beginning and end and, and we'd take into account all the things we needed to think about before, during and after doing the engagement.

• 1:31:23Speaker 04

  And somewhere along the line, I started working with some people um from another organization called DISA, Defense Information Systems Agency, I think is what it's called. And they got me connected to some people at the Department of Justice. And, you know, everybody was just, the internet was new, everybody was plugging into the internet. And everybody was like, woo-hoo, all the, all the potential for the internet. But then they were also saying, oh, but maybe we should think about security. So I went down into DC. Um, this is nineteen ninety-six, I was probably, the first time I met him was probably April or May.

• 1:32:06Speaker 04

  Went down to the Department of Justice buildings, you know, went into some big, beautiful conference room, you know, mahogany walls, big, huge table, everything's wood. Meeting with these people and, and basically they wanted us to do a pen test of their internet presence. And I'm like, yeah, sure, no problem, we can do that. So I go back and talk to the lawyers and lawyers like, well, hello, timeout. It's an unclassified network, that's, that's kind of new and different. And, and NSA is responsible for the security of classified systems, but the, the organization that was responsible for the security of unclassified organizations at the time was NIST, the National Institute of Standards and Technologies.

• 1:32:50Speaker 04

  Um, and at the time, that was kind of a tongue-in-cheek kind of running gag, because NIST didn't have a whole lot of capability in the, in, in any technical respect, similar to the kind of stuff that NSA did. So I'm talking to the lawyers, I'm like, well, can we make this happen? And the lawyer's like, yeah, we can make it happen, but there's hoops that you gotta jump through. So we proceeded to go through several weeks and months of hoop jumping to uh make this happen. And one of the first things he told me was, well, You know, when when you have this type of relationship, it's got to be sort of a handshake agreement between cabinet level positions. And like, well, what does that mean?

• 1:33:32Speaker 04

  He said, what it means is the attorney attorney general, which is what the DOJ rolls up under, basically has to ask the Secretary of Defense for a favor and say, hey, can you have your guys come over and take a look at our system? So, uh, you asked me to look it up. I've got a copy of the the original email, uh, not email, I'm sorry. Letter that came from the Office of the Attorney General saying, hey, your guys have been talking to our guys, and I'm paraphrasing it, and basically, we want you to, well, I can read it to you. Uh, I'm, therefore, I am formally requesting that DISA and NSA work with us to provide a vulnerability assessment on the security posture of DOJ, sensitive systems and network

• 1:34:17Speaker 04

  connectivity to include the system network architecture, SNA, and virtual telecommunications access method, VTAM. It's it's government, it's everything's got to have an acronym. Also, the secure network architecture. Did I say that already? I am requesting that the assessment begin with the testing and evaluation of the security configurations in the Financial Management Information System, which is used by several components within the DOJ. It goes on and on. A little over a page. Signed by the Attorney General at the time, Janet Reno. You got that? Yeah. Yep. Okay. And it was actually addressed to the person that was designated within the, um, the, by

• 1:34:59Speaker 04

  this, uh, Secretary of Defense at the time, uh, the Assistant Secretary of Defense responsible for three, C three I, uh, the Honorable Emmett Page. Page Junior. Wow. Okay. So that was the first step. And then what had to happen was, um, gosh, hope I get this in the right order. Um.

• 1:35:27Speaker 04

  This is a response from NSA. Of course, letters by the government, they're all written by peons like me, and they just eventually get up and sign by the people. You've seen the movies where they, they throw papers in front of the president, and he just signs them one after another. So this is a draft letter from Emmett Page back to Janet Reno, saying, basically, "We're on it."

• 1:35:49Speaker 04

  Then there's another letter that I have.

• 1:35:53Speaker 04

  This is from somebody at DSA, to the Department of Justice, saying, basically, "We're on it."

• 1:36:02Speaker 04

  And probably then the most interesting one is,

• 1:36:08Speaker 04

  and it's had a official, official processing form, because it's gotta have lots and lots of signatures Right, right. to approve it. But this is the letter that was drafted by, for the signature of the Director of NSA. And if you, you see that there... Yeah. Right there on the bottom line, "I am the point of contact for this project", which says, "Yeah, we'd be happy to, you know, members of the System and Network Attack Center will go down and do this." Now, on the cover sheet, it actually talks about, uh, I think you can see this here. It had a, it had a code name. Project Eagle. The effort is Project Eagle.

• 1:36:49Speaker 04

  So, uh, this letter, which is, you know, a copy of it, but it's signed and it's dated. You'll see the date, 21 August. 1996. Yeah. 1996. So... That's super cool. This is what happened.

• 1:37:08Speaker 04

  You know, of course, the letter's signed, this is all going back around, getting all the signatures. It had not yet been delivered yet. I think the 21st of August 1996 was like a Wednesday or Thursday. The weekend before, and it's before the letter had been delivered, uh, the DOJ website was popped. First hack of an, of a DoD... Wow. ...or, or government, uh, website. Uh, rather famous, um, the hackers, uh, defaced the entire, basically replaced the entire website. They, uh, replaced Janet Reno's picture with a picture of Adolf Hitler. Um, they had all sorts of more colorful things on it, and...

• 1:37:49Speaker 04

  This happened like on a weekend, the weekend before this letter was gonna be delivered and we were gonna be golden. So I get a call Monday morning uh from my contact at the DOJ saying. Uh, we had a problem over the weekend. We, you know, we were hacked. I don't know if you heard about it, but help. And so I'm like, well, let me see what I can do. I hung up the phone and I called the lawyers up the general counsel's office and I explained to them what happened and I said. You know, we're s- we're this close to being legal to going down there and doing the work. What do I have to do in order to get a team of people down there the next day? I mean, I wanna help them out. Right. They've had, you know, uh, you know, you know, they, they're desperate. They need help. Wha- what can we do for them?

• 1:38:32Speaker 04

  And, and they gave me three criteria. Um, they said, well, don't go on your own accord. Make sure you're sent by management. Get the request in writing from the DOJ. And uh, don't go alone. I mean, that was it. I'm like, okay, I assembled a team. I got, I called back the DOJ and said, send me something that requests this. I got it, you know, hours later. And then we went to our management and said, hey, this is what's happening. Will you let us go? And they said, yes. So Tuesday morning, we go down and we're looking at everything. Of course, in those days. Everybody had their own servers that were serving up their web servers that were a part of their network. Maybe they were outside of their network. Maybe they weren't.

• 1:39:14Speaker 04

  But when they were, when they discovered the breach, the, the DOJ admins, they took the s- systems down, took them offline. And wiped them and rebuilt them. So whatever evidence might have been there. Oh, wow. Gone to begin with. Yeah. Um, I mean, there were no forensic guides. There were no rules back then. This is nineteen ninety six. Nothing had been written yet about how to do this. Other than Cliff Stahl and the Cuckoo's Egg, but what he was talking about was mostly on phone lines and phone switches and, and PBXs, public exchange servers. All phone related. So we're there Tuesday, Wednesday. There were other systems that hadn't been affected, but we were looking for evidence of tampering and any footprints, as it were, electronic footprints.

• 1:39:58Speaker 04

  To see if we could pull anything together. We're there Tuesday, we're there Wednesday, we go down Thursday, mid morning Thursday, I got a call from somebody back in the pit. And they said, Jeff, the shit's at the fan. You guys gotta drop what you're doing and come back now. So we dropped what we were doing. We went back and got raided into the deputy director's conference room and the lawyer that I'd been working with for the previous year proceeded to read us the riot act and yelling at me in particular for um doing something that was potentially illegal that could get the director not only fired but prosecuted.

• 1:40:37Speaker 04

  And what the hell were you thinking? And I'm like, you knew about it? Like, well, and technically, when I called the lawyers on that Monday morning, both the general counsel, this guy, and his deputy answered the phone. And I said, I've got an issue. Who wants to take it? And the attorney, the the general counsel deferred to his deputy. So I I did this with the deputy general counsel, not the main guy. But it's the main guy that was yelling at me. So I got put on double secret probation since I was the ringleader and I first time I've ever heard of the church proceedings is when the lawyer was yelling at me saying, don't you know you violated the NSA charter? Don't you know you could get the director

• 1:41:19Speaker 04

  fired if not prosecuted? I was put on probation. I was investigated internally. I found out many years later because I bumped into this lawyer after twenty some odd years at DEFCON, ironically. Uh, turns out they were not only trying to fire me, they were trying to prosecute me as well.

• 1:41:38Speaker 03

  That that is that attorney or the the the the administration, the director?

• 1:41:44Speaker 04

  The the powers that be.

• 1:41:45Speaker 03

  The powers that be.

• 1:41:46Speaker 04

  The this was above him and it was above me. In fact, I learned that, you know, I mean, I'd been pissed off at this guy for twenty some odd years for yelling at me when we were buds. And it turns out he was getting a lot of flack too, because he had ultimately sent us or his office had sent us.

• 1:42:02Speaker 03

  Yeah.

• 1:42:02Speaker 04

  His deputy, his deputy resigned. Um.

• 1:42:06Speaker 04

  But, you know, after going on double secret probation and having to talk to internal security and tell the story and pretty much everybody I talked to, like, that's it? You were just trying to help? It kind of soured me on continuing to work there. We eventually were exonerated and we got pulled back into the deputy director's office and a bunch of the senior level management were talking to us and counseling us and they basically said, you know, we like what you guys do. We want you to do it, but if you're going to do it here, you have to follow our rules. And so we said, fine. I was gone from NSA by the end of September of 1996.

• 1:42:49Speaker 04

  So like six weeks after this all went down, I was gone from NSA. Because it was end of the fiscal year. They had done it, they were doing a buyout to get people to leave. This is one of the fallouts of the Soviet Union fighting for Bud.

• 1:43:05Speaker 06

  Hi, I'm John Ashkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 1:43:20Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic, in a big way that defined a lot of my childhood.

• 1:43:31Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 1:43:35Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 1:43:41Speaker 06

  So join us and hear their stories and more, because living with food allergies isn't just about what you can't eat, it's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart radio app today.

• 1:44:02Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, study mode helps teens work through problems, and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 1:44:29Speaker 02

  OnDeck is built to back small businesses like yours. Whether you're buying equipment, expanding your team, or bridging cash flow gaps, OnDeck's loans up to $400,000 make it happen fast. Rated A+ by the Better Business Bureau and earning thousands of 5-star Trust Pilot reviews, OnDeck delivers funding you can count on. Apply in minutes at ondeck.com. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 1:44:57Speaker 04

  They were paying people to leave, and we'd been kind of toying around. A bunch of us were looking for, you know, more, more high-paid jobs in the private sector and all that kind of stuff. So I took the first offer that came along, and I was offered money to leave, and I got the hell out of Dodge. And, you know, end of September 1996, you know, tried not to let the door hit me on the way out type of thing. Which, you know, is, you know, looking back on it almost 30 years later, if, if it hadn't have gone south, I mean, you know, there was something cool and fun and patriotic about doing it

• 1:45:42Speaker 04

  there. You know, we were thinking we were doing a good thing. You know, there was the allure of more money out in the private sector, but I'll tell you what, when I went out into the private sector, more than, you know, I got an increase in pay, it was the idea that I could be hired by a company to do a pen test one week, do the job for the next couple of weeks, take a couple of weeks to write the report, you know, maybe a month later, come in and do, present our findings, give them recommendations, and we were done. In and out, you know, maybe a month, maybe six weeks. Whereas six weeks at NSA, we would have still been trying to get permission to run the PIN command.

• 1:46:19Speaker 03

  Right.

• 1:46:20Speaker 04

  So, so much more than the money was the, the lack of the bureaucracy and the more focused. Less complicated, there there's a job to do, do it. Uh, report on it, give the feedback, thank you. You're done type of thing. That was very refreshing. So, but the reason I left NSA was because I was very much, they they tried to get me to leave involuntarily, but I I kinda took the the opportunity when they, when they, when they gave it to me to get out and uh, go out to the private sector where um, largely I've had a more receptive audience of my clients o- over the years, uh, you know.

• 1:47:02Speaker 04

  N- not every time do they wanna hear what I have to tell them in terms of, you know, how they're insecure and what they need to do differently, or what they need to invest in. But um, but generally, uh, if you, you know, if you can explain it to people, and I I think I do a reasonable job of explaining to people why they should care, why they should worry, um, what they need to do to invest in, or at least, okay, you've got limited resources, here's your options. Um, you know, here's the pros and cons of what you decide to do or not do. So at least they have, they can make an informed decision, or at least what I believe is a more informed decision.

• 1:47:42Speaker 03

  Yeah.

• 1:47:43Speaker 04

  About how to approach this thing that we now call cybersecurity and protect your organization. And oh, by the way, we're losing and uh, it's, you, you, nobody can afford to do everything that they need to do to to provide that mythical hundred percent level of protection because it doesn't exist. And um, yeah, we have a very burgeoning industry that keeps going and, you know, hundreds of billions of dollars are spent on technology where what ultimately causes m- many companies to fall i- is a process issue or a a failure of people and personnel to do something pretty trivial.

• 1:48:21Speaker 03

  Yeah.

• 1:48:22Speaker 04

  When it, when you get down to it.

• 1:48:23Speaker 03

  How, how?

• 1:48:24Speaker 04

  Keep spending your money, people.

• 1:48:26Speaker 03

  How, how, how does, you know, uh, when, when we look at the United States and we are, we are a, a free country and limits on the government is a good thing. And.

• 1:48:43Speaker 03

  And yet, I don't want to say and yet as though we should erase freedoms in any way, shape or form. But how does the NSA, particularly in this infosec environment? How does the NSA compete against countries like China, Iran? You know, country Russia that do not have any moral compunction, any laws that, you know, limit their, their government's reach? How do, how do we compete against that?

• 1:49:18Speaker 04

  Well, that's, that's a very complicated question to answer. And philosophically, it does, and I just, this came up a while ago in a conversation. I'm, I now have the opportunity to say it, so I'll say it. But I, I think it's, one should think twice about automatically assuming that what we're doing is moral because we're doing it to protect us. I'll just throw that, just throw that out there, just to make people think. But generally speaking, you know, we are a moral, responsible society and government

• 1:50:01Speaker 04

  that does operate under rules and, and most people take the rules fairly serious. There's always exceptions. And because there's rules and there's bounds and, and more than that, there's just, there's so much that could happen, there's so much that could go wrong and you never know what's going to happen and where and where do you, you know, where do, where do you put your attention and focus and your limited resources? We're almost setting ourselves up as a, as a society, if not pockets of industry within our government, which some would argue, argue that the government should be protecting.

• 1:50:38Speaker 04

  Um, it it's it's it's not really a winnable situation in my in in my uh opinion.

• 1:50:49Speaker 04

  Whereas other countries, we are certainly told that they, you know, aren't as strict on rules and regulation and and, you know, I I doubt if Chinese hacking groups, whether they're military or paramilitary or funded by the government, are going through a lot of procedures and bureaucracy and red tape. Just a perception. So, I mean, we handcuff ourself and of course, you know, I I I work tangentially, I have relationships tangentially with a lot of people that are involved in, you know, the the mission of protecting the country, cybersecurity, national defense and so on and so forth. To be honest, and if any of them are listening, I apologize ahead of time, but you're given

• 1:51:34Speaker 04

  my experience working with the government and under the private sector, I've I've always felt that if you're working for the government, it's because you're not good enough to make it in the private sector, so you're kind of second tier to begin with.

• 1:51:48Speaker 04

  And there are exceptions. I mean, that's just a very broad blanket, probably ignorant statement, if you need to say. But in my experience, uh, the the real cutting edge stuff happens in the private sector. And here's why.

• 1:52:06Speaker 04

  For better or for worse, in the private sector, everything's driven by the dollar. Everything is financially motivated. Companies exist because they're trying to make money. That's free commerce. That's what we do as a free country.

• 1:52:21Speaker 04

  And and I I often tell my clients in the private sector, when they talk about risk and you you you hear all these words bandied about like risk and vulnerability and threat, security.

• 1:52:35Speaker 04

  I tell, I tell my clients and anybody that'll listen frankly, you know, when I was in the mil- I was working for the military when I was working as a civilian. Um, the idea of risk was all computed around loss of human life. Troops on the battlefield, citizens abroad and domestic, uh, uh, embassy workers, state department employees and stuff like that. But it all had to do with loss of life. In the private sector, it's all about money. That's very different. Uh, especially when everything you do comes at a cost. Or everything you don't do potentially comes at a cost. So it's a different motivational factor. And I'm not saying it's a.

• 1:53:21Speaker 04

  I'm just saying, I, uh, somebody posted on LinkedIn.

• 1:53:28Speaker 03

  We're losing you just a little bit. We're, we're losing you just a little bit. I think your, your signal's a little low, but.

• 1:53:34Speaker 04

  Oh, no.

• 1:53:35Speaker 03

  Yeah, can you repeat that last?

• 1:53:37Speaker 04

  Can you hear me now?

• 1:53:37Speaker 03

  Yeah, we got you.

• 1:53:40Speaker 04

  Okay.

• 1:53:41Speaker 03

  Yeah.

• 1:53:41Speaker 04

  Um, how far last do you need to go?

• 1:53:43Speaker 03

  Just like the last sentence or two, yeah.

• 1:53:48Speaker 04

  Well, what I'm saying is the, the, the idea of risk, why you do security, why you do the things. It's very different if you're, you know, pursuing the national defense, which is basically loss of human life at some degree versus the private sector, which is how much money are you gonna lose? Or how much money are you gonna spend? Or how much revenue are you gonna lose? Or how much, you know, it, it's, it's all a financial basis. And it's not that one is right and one is wrong. It's just the very different. Um, and in a lot of ways in the private sector, it's a lot better to understand dollars and cents.

• 1:54:27Speaker 03

  Right.

• 1:54:27Speaker 04

  You know, that's a pretty easy equation to understand. In, in the national defense, um, concept.

• 1:54:36Speaker 04

  Uh, it's, you know, how do you put a price on a human life?

• 1:54:40Speaker 03

  Right.

• 1:54:41Speaker 04

  You know.

• 1:54:42Speaker 03

  Right.

• 1:54:42Speaker 04

  That, it, it, I mean, you intuitively don't wanna lose anybody's lives. But, um, you know, I, I, I'm sure we've all seen reports or heard, heard people talk about, you know, um, you know, generals planning battles and, and, you know, even the Normandy invasion in World War Two. Everybody knew people were gonna die.

• 1:55:03Speaker 03

  Right.

• 1:55:04Speaker 04

  Um, and, and the calculations that were being done on what, what was an acceptable level of loss of, of human life, given the potential gain. I mean, and that's where I, I defer to the people that do work for the government and do work for the national defense because, um, they do take that very seriously and it's very hard. Um, but it's also very politically motivated and there's a lot of, there's a lot of stuff, bureaucracy and stuff that goes on with that. Where maybe I'm taking the easy road out by just working in the private sector and it's like all about money.

• 1:55:39Speaker 03

  Questions for Jeff? Yeah, we do, but, but I wanna ask you, so, so in, in your opinion, does, uh, you know, the government is notoriously cheap, right? The, the government is notoriously, what they pay soldiers, what they pay case officer, what they pay NSA, um, analysts and, and, and, and operators, um, what they pay their federal law enforcement, like, it, it, it, it is not, for, and for a lot of the jobs, whether it's a soldier or an FBI agent or whatever, there, there are not a lot of comparable jobs on the outside so they can, so they can pay on the cheap.

• 1:56:18Speaker 03

  When it comes to the NSA though, you know, you guys may be a GS twelve or GS thirteen, step five, but then you can turn around to Mandiant and CrowdStrike or CrowdStrike, whatever, and earn three times, four times what you're making. Do you feel that the NSA?

• 1:56:38Speaker 03

  Needs to, that the government in general needs to deal with this new reality. And the NSA should pay people what they're worth on the outside in order to keep that talent.

• 1:56:51Speaker 04

  I mean, the short answer is yes, but it's complicated because,

• 1:56:59Speaker 04

  and this is where I kinda do have a little bit of deference to the people that do, you know, work for the government because they do believe in mission and are patriots and things like that. But there, but there is this stigma at the very least that if, if they were really good what they did, they'd be getting the private, the bigger dollars, making them more richer. But that doesn't mean that everybody out in the private sector that's making the big bucks is

• 1:57:28Speaker 04

  deserving of the big bucks. So, you know, it's,

• 1:57:30Jack Murphy?

  You might not necessarily want them deciding who lives and who dies either.

• 1:57:34Speaker 03

  Right.

• 1:57:35Speaker 04

  Right.

• 1:57:36Speaker 03

  Right.

• 1:57:36Speaker 04

  Um, I mean, I, I talked to a lot of people, you know, since I go out to a lot of conferences. I was at a conference last weekend and I was, after I spoke, I was talking to probably a dozen college students that had come from one college and they were just peppering me with questions. And refreshingly, they did not ask,

• 1:57:58Speaker 04

  change when I talk to, to students. How much does this pay? You know, how much can you make in cybersecurity? They're, they're mostly, they have passion for technology. They have a passion for whatever this stuff is. But I try to tell people, you know, find something you like to do. Find something you enjoy doing it. Don't get hung up on the money because you can make a lot of money. And that that arriving and making it, but I, I have yet to meet anybody that's happy and satisfied because they make uggobbs of money. Um, but I know a lot of people that are really happy with what they're doing and really satisfied with their job. That some do make a lot of money, some don't make a lot of money. Some are in the government, some aren't in the government.

• 1:58:44Speaker 04

  But the happiest people I know are the ones that are doing what they love and, and feeling like they make a difference. And I think you can certainly, I mean, I've been doing the credit card industry for twenty years. You know, I I go home and at night and fall to sleep thinking, wow, I've I've allowed a company to make money on credit card interests. Woo hoo. Um, you know, in contrast, that was somebody that go night and fall asleep because they knew they helped save lives.

• 1:59:12Speaker 03

  Right.

• 1:59:13Speaker 04

  Or, you know, promote the national defense. So that, you know, it's a hard, it's a hard nut to crack. But I I think there's a stigma that if, at least for me, that if you're for the government, it's because you could have it in the in in the private sector where they they pay the big bucks. Of course, a lot of people put their time in in the government and then they get the posh job at the big companies out in the private sector and and, um, you know, most of the people you know and see, and man, I'm grossly generalizing, I I I'm not impressed by the people that you see, the public figures, the ones that are always getting interviewed on CNN and all the the different news channels.

• 1:59:54Speaker 03

  Yeah.

• 1:59:55Speaker 04

  And and so on and so forth. The people that really are good at doing all this stuff that that and love it and are passionate about it, you don't know who they are. I don't know who they are because they're just in the trenches doing it and they're doing it for whatever makes them satisfied and, you know, God bless them because, you know, we need those people.

• 2:00:15Speaker 03

  I I think it's interesting because you you talk about the mission and and I can see how similar to the military, the N A, the people in the NSA have a mission and a purpose.

• 2:00:27Speaker 04

  Mm hmm.

• 2:00:27Speaker 03

  And as you experienced, I think the the challenge with the mission and patriotism and and that sense of purpose, the only thing that stands between that and bitterness is like one bad manager, one bad leader. And and they can, they can steal that that entire sense from from a person, you know. Um, how is the NSA when it comes to their leadership development and their management development, things like that?

• 2:01:00Speaker 04

  Yeah, I don't, I don't there when I was there, which was, you know, for the better part thirty years ago. There was a stigma between, you know, if you want to advance in your career, go up the pay grade ladder. To get beyond a certain level, you had to get into management. So you had to go, there was either the technical track or the management track. And management track is who made the big bucks. But, you know, if you were good at the technology, and I, and I use that term loosely, technical could be your cryptologist. Technical could be anything, but technical, not management, you know, labor, not management. Um, the people that were really good at it and wanted to advance.

• 2:01:40Speaker 04

  Uh, at some point had to kind of suck it up and like, well, if I want to go further, I got in, got to get into management. I don't know that they've completely solved that. I, I was, I was actually invited back to NSA last fall for an alumni open house. Cause they're basically trying to recruit people that used to work there, because they're, they're hiring, they, there's certainly a need. Um, and we talked about how they don't pay well, and someone like me who's insurance expired. Over twenty years ago, I simply asked, is there any way to streamline me getting back in? You want me? I'm certainly capable. I certainly have a lot of experience, but, uh, there's that background investigation and getting the.

• 2:02:22Speaker 04

  Again, and, and the very long-winded answer that. I really never got a good answer was, no, there is no shortcut. Um, but, gosh, I, I was, uh, I think I was at RSA a few years ago and I went to the NSA booth. Cause that's sort of a pilgrimage every time I go to RSA conference. And I met a young lady at the booth and, uh, she's like, oh, you're Jeff Mann. I'm like, oh, she knows who I am. She knows my stature in the industry and my background and stuff. And she said, oh, I used to go to school with your daughter. So I'm like, oh, okay. So she had no idea who I was, other than I was the father of a, a classmate of hers.

• 2:03:06Speaker 04

  So, you know, my daughter now is in her early thirties. This woman's in her early thirties. She's senior level management at NSA and she might be the smartest person around, but.

• 2:03:18Speaker 04

  My gosh, I mean thirty, you know, early thirties probably has been at NSA since college. So she's got maybe ten years' experience and she's in a really senior level role.

• 2:03:29Speaker 03

  Yeah.

• 2:03:29Speaker 04

  That doesn't give you warm fuzzies and it's nothing personal against her.

• 2:03:33Speaker 03

  Right.

• 2:03:34Speaker 04

  It's not because she's a woman, it's not because she's young, it's because she's got maybe ten years of experience. And how much of that ten years has been off on the twenty twenty program, getting more education and training and and doing this, that and the other. And my impression is they're they're working with what they've got to work with.

• 2:03:52Speaker 03

  Right.

• 2:03:53Speaker 04

  And and again, it's nothing, it's not a knock on her personally, I'm sure she's, you know, she seems to be very smart and very wonderful. But she's made comments about how NSA is on top of their game at this open house. The director was talking about how NSA is on the top of their game. He's a very compelling speaker. But I'm like, yeah, then I started talking to some of the people, I'm like, yeah, you're still full of it. And that's just my opinion. Uh, so that, you know, they talk a good game, but at the end of the day, it's still a government job and they've got lots of stupid bureaucracy and rules and regulations. And because they're sort of the, you know, only game in town and they all, they sort of look inward. They don't see what the big picture and they don't see the outside.

• 2:04:36Speaker 04

  I've been trying to offer them, hey, I've been out in the private sector for twenty five, twenty six, twenty seven, twenty eight years now. I've learned a few things that maybe you, you that say you want to be more engaging to the private sector. Why don't you bring me in to let me tell you how to to maybe do that? Because, you know, your your me first approach, we're NSA, you should listen to us. That's not going to cut in the real world because people are like, yeah, you know, oh, yeah, you're NSA, but what does that mean at the end of the day?

• 2:05:04Speaker 03

  And.

• 2:05:05Speaker 04

  Gosh, I hope I'm not getting fired or arrested after this.

• 2:05:09Speaker 03

  And and one last question before we get to like viewer questions. I'm I'm curious about. You know, like, you know, when, when back during the naval era, when you had the letters of Mark, you know, during, you know, when we've had these times when the government can control and, you know, everything, we had the idea of sort of privateers. Do you think that the government in this cyber warfare world, in this cyber environment, when, when there are 14 year olds who are just brilliant and doing crazy, you know, amazing stuff, and, and, you know, there are groups out there, do you think that the

• 2:05:51Speaker 03

  government in this one arena should turn to like a privateer model?

• 2:06:00Speaker 04

  It's an interesting question.

• 2:06:02Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 2:06:17Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic, in a big way that defined a lot of my childhood.

• 2:06:28Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 2:06:33Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 2:06:39Speaker 06

  So join us and hear their stories and more, because living with food allergies isn't just about what you can't eat, it's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 2:06:59Speaker 00

  ChatGPT for teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for teens supports active learning by breaking concepts down. Rather than giving teens the answer, Study Mode helps teens work through problems, and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options like setting study hours and quiet hours. Visit chatgpt.comPARENTS to learn more.

• 2:07:26Speaker 09

  Cash flow crunch? OnDeck's small business line of credit gives your business immediate access to funds, up to $200,000, right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 2:08:02Speaker 04

  I would say, I was having a conversation in the last couple of weeks with some people at one of the conferences I go to. And they were talking about, actually it might have been on the podcast I do. But they were basically talking about how, you know, there's certain hacker groups out there that are just going after certain, not necessarily nation-state actors, but, you know, sex trafficking, child trafficking type of groups. You know, there's conscientious hackers that just kind of go after them just because it needs to be done. And it's not technically sanctioned by the government,

• 2:08:47Speaker 04

  but sanctioned by anybody, but nobody's really complaining. So, I mean, that's my most recent frame of reference. I would say, I don't... My bias is NSA or the government puts its fingerprint on it. It's going to get stupid at some point. Could there be sort of a handshake unofficial, well, there's this shadow group out there that's just doing the responsible, right thing? That might work for a while, but of course, that could go wrong for many reasons too, because, you know, absolute power corrupts absolutely.

• 2:09:27Speaker 04

  But you know, the serious hackers out there that are socially minded, you know, socially conscious, uh, want to do the right thing and are frustrated at bureaucracy and, and the, the limits the government puts on out of necessity. But it makes it very difficult to do what needs to be done in a, in a fashion or a manner that can and should be done. Um, yeah, I, I would, you know, I don't know what you would call it, if you would call it privateering per se, or just looking the other way. Does there need to be some oversight? Does there need to be some kind of stopgap? But, uh, I could see that happening.

• 2:10:10Speaker 04

  On the other, on the flip side, do I believe in vigilantism? Not necessarily.

• 2:10:15Speaker 03

  Uh huh.

• 2:10:15Speaker 04

  Uh, that sounds intuitively wrong, but, um, uh, I mean, anything, anything can work for a while and anything can go south when the wrong personality and the wrong motives come into play. Um, you know, people often ask about hacking back and whether that should be done by companies, you know, or leave that to the government.

• 2:10:37Speaker 03

  Right.

• 2:10:37Speaker 04

  Yeah.

• 2:10:40Speaker 04

  You know, this is where it kind of, you know, the difference between the private sector, you know, money, that's the risk and, and the government protecting the, you know, the US and US entities and things like that. That's where it gets a little bit fuzzy for me and tricky, but I, I, I tend to want to like, I'd rather have the government in, in control of the actual warfighting. Uh, cause that's sort of what they're in the business of doing, cause I think it could get real ugly and, and lots of bad things could happen to innocent people. Um, if it's done by the wrong people for the wrong reasons, or even the wrong people for the right reasons, but outside of the boundaries of control. Um, you know,

• 2:11:25Speaker 04

  there's a reason why we have a Geneva Convention, which, you know, it doesn't make sense at some level. Like, why do we have people sitting down, coming up with rules on how to conduct warfare?

• 2:11:37Speaker 04

  At some level, it makes perfect sense. On another level, it's a head scratcher. It's the same type of thing for hacking and hacktivism and tough stuff like that. It makes sense at one level, and at another level, it's like, man, you don't want to go there. That's very sketchy. And I can go either way, depending on my mood and depending on what the situation is.

• 2:11:57Speaker 03

  So, so I, again, I'm sorry, but one more follow on question, because you mentioned the Geneva Convention.

• 2:12:04Speaker 04

  Yep.

• 2:12:04Speaker 03

  And I'm curious, in your experience, if a non-state actor, you know, a hacker group shuts down a hospital over ransomware, should they be considered a viable military target?

• 2:12:21Speaker 04

  Hmm.

• 2:12:24Speaker 04

  It's an interesting question. Um.

• 2:12:31Speaker 04

  From a Geneva Convention perspective, and again, this is a conversation we had on our podcast a couple of weeks ago with a gentleman named Josh Corman. You know, it used to be that the hackers sort of had our, the bad guys, you know, hackers can be good or bad. But the bad guys used to have sort of a code of conduct or ethics that you wouldn't go after, you know, like a children's hospital and hit them with malware or ransomware. But the perpetrators, the bad guys that are doing this, they're looking for targets of opportunity. They're not looking at who it is as much. Um, so there, you know, there is this idea that, you know, there used to be some idea of responsible crime.

• 2:13:12Speaker 04

  Um, and, and that kind of can go away at some point. So are they,

• 2:13:20Speaker 04

  should they be targeted by a military action? I would tend to say yes. Um, but again, those, that's the situation where there's private groups, there's hacking groups, you know, good guys groups that are actively targeting those types of organizations and doing what they can to take them down in a, in a logical technological sense. I don't think it's, it's in a military sense, in a physical sense. Um, but yeah, I.

• 2:13:51Speaker 04

  There's certain lines that get crossed that most people will say, yeah, that's something that shouldn't be done. That's not cool. Um, and, and it used to be that there was responsible criminals that wouldn't do something like that, but that seems to have gone out the window. So, you know, um, whatever works to get the stuff to stop happening, uh, I'd be tempted to condone that to a degree.

• 2:14:15Speaker 03

  Hmm.

• 2:14:16Speaker 04

  If that makes sense.

• 2:14:17Speaker 03

  I, I, I, I agree with you. I mean, I was just curious. I mean, you're, you're the expert here, but I feel as though if, and according to Geneva Convention, if they're responsible for the loss of life, they're a viable target. But I, I don't know from a cyber perspective, somebody's as experienced as you, what, what your thoughts would be. Um, all right, let me get.

• 2:14:38Speaker 04

  Well, well, final comment on that. I mean, what's interesting to me is we're, we're, again, we, we talked earlier about some things are kind of coming full, full, full circle or overlapping. Maybe this was off the air, but you know, signals intelligence is becoming a thing again. The idea that risk now, because we're targeting, uh, hospitals that can't afford the security, can't afford the ransom, critical infrastructure, um, you know, the, the idea of the risk being loss of human life is kind of becoming a thing that's more tangible and real in the private sector. So it's, it's not a, it's not a full circle thing,

• 2:15:20Speaker 04

  but it is a, a, it is a blending where, um, more action is required and more action from the government is necessary, even if that means regulation and regulatory compliance, uh, but also assistance. So it, it is an interesting time we're living in, but I, I think it's interesting that risk in the private sector, which has been money for so long, is now starting to be human life again, which is something that the military understands. So yeah, maybe they should step in.

• 2:15:53Speaker 03

  Um, so viewer questions. M. Corbin, thank you very much. Really appreciate it. Does Bitcoin have a future as a tool for power projection in the future? And also, what is your take on the 2000 U.S. China hacker war?

• 2:16:10Speaker 04

  I try to avoid Bitcoin as much as possible. Does it have a future? No comment. And I haven't heard of the other one. I don't do a lot in the technology realm. I focus more on people and processes. That's just a general disclaimer.

• 2:16:35Speaker 04

  So try to ask me another question. I'm sorry I can't answer the first one.

• 2:16:39Speaker 03

  Johnny, thank you very much for the donation. I don't see a question. If you have one, please throw it in the chat. Oh, I see another one. Global Media, thank you very much. Support the team house. Get those likes up. Yes, everybody, if you haven't liked this, please throw us a like and hit us and subscribe if you haven't. Johnny, thank you very much.

• 2:17:00Speaker 03

  I wonder if Jeff thinks CPU architecture can be secure.

• 2:17:05Speaker 03

  Intel, Apple, TSMC have been shown to have unpatchable physical vulnerability in chips which leak secure keys.

• 2:17:16Speaker 04

  Yeah.

• 2:17:18Speaker 04

  I had a chief scientist, I believe it was, in my early days at NSA, so it would have been in the 80s, maybe early 90s,

• 2:17:30Speaker 04

  that used to have a mantra, what can be created by man can be broken by man. So in that context, you know, can CPUs ultimately be made 100% secure, unbreakable? No.

• 2:17:46Speaker 04

  To me, there's, we're having two different discussions that often get lumped under this mantle of cybersecurity. And that's the idea of securing all the things as much as possible.

• 2:18:01Speaker 04

  So securing.

• 2:18:03Speaker 04

  Creating a secure state, which is kind of a noun. And then the second thing is security. What do you do, given you can't do the first? What do you do to monitor and detect and respond um to your network, your environment? Given that something inevitably is going to fall in terms of the technology. Um, so in that sense, what I'm saying is no, I don't think CPUs can be ultimately secured a hundred percent. Um, but given that, what do you do? Maybe you don't invest as much on trying to find a better CPU.

• 2:18:43Speaker 04

  Uh, what, you know, what, what is done to these, these days by the, the organizations that you referred to? It's probably good enough for most people, but it's that, the, the few that care and the few that are going to be impacted the most by somebody that figures out a compromise. Figures out a way around to work around what we used to call a feature. Um, they're the ones that need to care about it. Uh, but they need to know how to detect it to minimize the damage and to respond to it. Um, I am a proponent of the process. Security is something you do. It's not a state that you achieve. There's making things secure. And then there's security, which is the diligence and the monitoring and, and the, you know, standing guard and standing watch.

• 2:19:26Speaker 04

  And so that you see the attack when it's happening, you intercept it early, you minimize the damage. That to me is the essence of security.

• 2:19:35Speaker 03

  Do you, do you think that, uh, hardware manufacturers and software manufacturers are transparent enough? With like the community in terms of what they think the weaknesses are so that people can be diligent? Or do you think they could be more transparent?

• 2:19:52Speaker 04

  Um, short answer is no, I don't think they're as transparent as they could be. Uh, the podcast that I do, Paul's Security Weekly, securityweekly.com. Paul Asadorian, the Paul in Paul. Security Weekly, he works for a, a company that does hardware hacking, hardware vulnerability research company. Well, I don't need to say the name. I'll let him do that. Go to Security Weekly, you'll figure it out. But he focuses a lot on hardware vulnerabilities right now. And so that's a topic that comes up a lot in our podcasts over the last year or so. Um, and he, he reports very routinely on the research that he's doing with his day job

• 2:20:35Speaker 04

  on the insecurities of hardware and how hard it is to um to secure hardware and it's, it's not really the new frontier because it's been around forever. I mean, I worked at NSA when it was all hardware and there was no software. Um, so you know, it's semantics, it's blurring the lines, but you know, hardware is um, also prone to insecurities and vulnerabilities and bugs and weaknesses and misconfigurations. And um, they're out there. They typically don't become publicly known until either somebody exploits them or some researcher discovers it.

• 2:21:18Speaker 04

  And then it's, you know, the sky is falling. You have to temper it with you know, the likelihood that somebody's going to go after something like that, going to go to that degree of um, attack that they're going to try to exploit that. Um, it, a general principle I'd say is, you know, the bad guys are going to do whatever works, whatever's the easiest. I mean, they, they have their own uh, cost benefit analysis, as it were. So they're going to do what's works and what's easy and they're going to hit the targets that are vulnerable. They don't, they don't necessarily target specific organizations. Which to me is one of the big eight hundred pound gorillas in the room is that we,

• 2:22:03Speaker 04

  we have this industry that makes people protect against all sorts of stuff. But most of the bad guys aren't targeting specific organizations. Um, if they did, they sort of have unlimited resources and they could go after them any way they can and they can take the time. And if it means exploiting a hardware vulnerability, they will. I think the line is drawn when the hardware vulnerability, it can be exploited in a way that is sort of um uh, reproducible and it, it, it, it can become something that's

• 2:22:39Speaker 04

  You know, random in terms of let's find somebody who's vulnerable. We don't care who it is.

• 2:22:43Speaker 03

  Right.

• 2:22:43Speaker 04

  Even if it's a children's hospital and let's exploit it and make money off of it. Uh, commodity, you know, commoditized types of attacks that that you target anybody. No offense. It's just, we're just targeting whoever's vulnerable.

• 2:22:58Speaker 03

  Do you think that ransomware as a service has, has kind of uh, like increased that type of tendency that? You know, you might have ransomware gangs that do have those codes, but then when it's ransomware as a service, you just have some script kitty out there who's like, ah, fuck it. I'll just find whoever, whoever will pay.

• 2:23:18Speaker 04

  Well, I mean, it's simple economics and it's, it's, you're not really paying attention to the who the target is. It's whoever's vulnerable that you can make money off of. Uh, I mean ransomware in general, I think has changed

• 2:23:33Speaker 04

  the dynamic of cybersecurity significantly because uh, you know, the way I was classically taught about this problem, which we, back in the early days, we called data security or information security. And um, most people have probably heard of the CIA triad, the three components of security of data being confidentiality, integrity and availability. So confidentiality, keeping secrets secret. Integrity, uh, knowing that the data is valid, you know, it hasn't been altered or tampered with. And then availability, can you get to the data when you need it? Uh, most of this cybersecurity industry, which is mostly technology based,

• 2:24:18Speaker 04

  um, focuses on the confidentiality problem, trying to keep things secret, trying to keep things safe, trying to keep things inaccessible in terms of stealing it. You know, denial of service uh, has been a problem off and on distributed denial of service has been a problem off and on over the last 20 years or so. Um, but we sort of solved those, those problems. Integrity issues, faking the data, do you trust the data? Um, you know, that can kind of come into play with phishing schemes and fraud schemes, scams and stuff like that. But availability, that's something that we haven't really.

• 2:25:01Speaker 04

  Invested a lot of technology solutions in it and everybody believes that believes that technology is how you solve the problems. And it's even more twisted than that because it's not just ransomware where we're going to hold your data and if you don't pay, we don't give it back to you and you lose access to it. But now it's sort of the, the, uh, I don't know if somebody's come up with a good term for it, but holding the data and threatening to release it.

• 2:25:29Speaker 03

  Right.

• 2:25:29Speaker 04

  Rather than just sending it back to you. So sort of, uh, uh, I don't know what's a good term for it, but that's been coming up more.

• 2:25:37Speaker 03

  Yeah, it's the exploitation.

• 2:25:38Speaker 04

  Kind of a blackmail.

• 2:25:39Speaker 03

  Yeah, yeah.

• 2:25:41Speaker 04

  Um, you know, that, there are no good, there are no good technical solutions to prevent that other than the things that we've been preaching for the last 30 years of sort of basic security hygiene to try to, to, you know, prevent that stuff from happening. I mean, we don't, with all the ransomware attacks that are out there, you don't often hear people talking about how the ransomware attack was launched in the first place, how, how it, you know, got into the environment, but it's usually a phishing attack, which is not a technical failure, although you could argue that it could be. Why am I getting an email in my inbox that's got a, a phishing link in it?

• 2:26:20Speaker 04

  Why isn't there technology out there that filters that or, or blocks it? But there, there's that aspect of it, but you know, we, we don't have a lot of good technology out there that prevents people from clicking on a link or, or falling prey to a really, really convincing clever, um, phishing scam.

• 2:26:42Speaker 03

  Right.

• 2:26:42Speaker 04

  Or, or, you know, to date myself back almost 30 years to, to open an attachment of a document in an email that I got from a trusted source that says, hey, read this. And by doing so, I've launched.

• 2:26:55Speaker 03

  Right.

• 2:26:56Speaker 04

  A virus or malware, what we used to call viruses and trojans and malware, but what we pejoratively call ransomware these days.

• 2:27:04Speaker 03

  Right. Well, I mean, in these days and times, it's amazing how many organizations aren't even enforcing a basic like two FA, like, uh, you know, a, a two FA to, to log into stuff. It, it's incredible that basic steps that aren't being taken often.

• 2:27:21Speaker 04

  Um, I agree with that and, and what I often shake my head out is the fact that, uh, while there's so many vendors out there that are trying to sell you convincing solutions, there's for, and I'm talking pri- primarily the private sector because that's where I've been most of the last thirty years. Um, without regulation, without compliance, most companies aren't going to do it because why should they? They don't have to. And until they get popped, until they get breached, they don't get the religion of, oh, we really should have done that. Um, uh, you know, I've been doing the payment card industry for twenty years.

• 2:28:04Speaker 04

  It's a, it, the pay, the, the PCI data security standard is a, a pretty decent, high level set of rules of things that you should do to secure, uh, your organization, your, your network, uh, to protect data that you care about being stolen, you know, it specifically it's credit card information, but you can apply it to anything. Most organizations that I work with are doing it because they have to. And in the early days, they weren't say, you know, even before PCI, when I was working with companies in the private sector, and even in the beginning days of PCI, the questions I was, was, was being asked from, from companies that I worked for was,

• 2:28:49Speaker 04

  what do we, they weren't asking, what do we need to do to be secure? They were asking, what is everybody else doing that's a peer in my industry? So that, you know, I can do as, as little or as much as anybody else that when something bad happens, I can say, well, I was doing best practice and therefore not get fined or not, not be held liable or accountable because it could happen to anybody and it could happen to anybody. Um, it, it.

• 2:29:17Speaker 04

  It's a weird, it's a weird dynamic, but most companies out there, if they don't have a reason to do it, they're not going to do it. But you could sort of explain that in a financial model because everything's, you know, money based in terms of the risk model. Well, it hasn't happened yet. Why should we spend something on, you know, spend money to protect against something that hasn't even happened yet? Um, so there's, there's a, there's a financial logic to it. And of course it blows up when the bad thing happens. And that's when we get called in and we help them straighten things out and, uh, you know, they get religion. Um, but, but, but you know, what, what's in the news these days in the private sector?

• 2:30:01Speaker 04

  Critical infrastructure, utility companies. I, you know, and people are talking, you know, I hear people talking about, well, there's, there's NIST this and NIST that. And MITRE Tech Framework can do this and that and the other, and there's all these things. I'm like, they're a utility. Somebody in that company is, is, you know, collecting credit cards to pay for the water bill, the electric bill. Uh, so they know PCI is in there somewhere. If you just did what PCI said to do, you'd be, you'd be pretty much okay. Uh, but nobody seems to be connecting the dots on that. PCI is this, oh, nobody likes to talk to PCI. That's old. It's stupid. You know, it's, it's not flashy and new and shiny.

• 2:30:43Speaker 03

  Right.

• 2:30:43Speaker 04

  Uh, but, but it is today because PCI four point O is, is now the law of the land.

• 2:30:49Jack Murphy?

  Do you have, uh, anything else for Jeff?

• 2:30:51Speaker 03

  Uh, how long, uh, do you think it will take? Uh, thanks, Sean Jones. Um, how long do you think it'll take for AI-based security controls to become as commonplace in the private sector? As layer seven firewalls are today?

• 2:31:03Speaker 04

  Oh God. Um. AI, the latest buzzword thing that I'm trying to avoid ever dealing with. Um.

• 2:31:16Speaker 04

  You could probably map this to other things like you're you're you're using the firewall is the analogy. Everybody's got a firewall these days. I'm sorry, they don't have firewalls anymore. Because their infrastructure is now in the cloud and it's protected by software. Hmm. Ten years with a little bit of acceleration, I'll say five years. That's my guess.

• 2:31:42Speaker 03

  Uh, and then, um. I'm Corbin. Oh, uh, Justin Zulu, thank you very much. What are some things that average person could do to protect themselves going forward?

• 2:31:55Speaker 04

  Uh, probably the biggest thing is put. What the industry calls multi-factor authentication, what we used to call two-factor authentication on everything. Um.

• 2:32:09Speaker 04

  I'm not a, I'm not a personal fan of password vaults because I I'm old school enough to think that you you shouldn't put all your secrets online. Period or rely or trust technology period. War games nineteen eighty-three. Uh, don't trust the Whopper. Um. But, uh, use a really, really, really long password and I would even advocate. Uh, phrases, poems, song lyrics, try to think of obscure song lyrics and then apply random. You know, uppercase, lowercase, special characters. Everybody knows to substitute.

• 2:32:48Speaker 04

  You know, the number four for the letter A and the number three for the letter E, but don't do it on the first letter last year. La- last letter, don't do it on every letter, letter, put spaces in between the words. Or better yet, put spaces in between, somewhere in between the word and not between the words. Because that's going to, that's going to protect against password cracking, brute forcing. Um, but more than that, I I I would say make sure you're always using some sort of multi-factor authentication on everything. Um. There's a lot of, there's a lot of, um.

• 2:33:27Speaker 04

  A lot of people talking about using password vaults and you get to use those super long, random password generated things that are stored in the vault, but password vault companies have fallen victim to compromise, so they're not a perfect solution. In fact, I interviewed the CEO of LastPass last summer at Black Hat as part of the podcast I do. We did live interviews of executives. That was an interesting conversation. I didn't know the guy wasn't the founder of the company of LastPass. He had, he had become CEO like in October, you know, two years ago. You know, months before they had not one, but two major breaches. So I was kind of like ouch.

• 2:34:13Speaker 04

  But I mean, I'm old school. I don't believe that you should put all your eggs in the technology digital basket. I think this is your best tool right here. My, my current domain password for my day job company is like,

• 2:34:29Speaker 04

  I think it's like thirty eight characters long. It's a song lyric. It's, it's a, it's a line of a song that's, you know, a song that I know. And I, I mix it up a little bit enough to just to protect against the cracking. But just the sheer length of it, thirty eight characters, nobody's going to guess it. Even I would even say if you knew what album I was citing a lyric to, you know, because of the, the various permutations, yeah, you could compute it brute force, but it would take you a while because I, I mix up the, the spaces and the upper end characters and lower characters and special characters and stuff like that.

• 2:35:09Speaker 04

  So, uh, but because I grew up typing with ten fingers and not thumbs, I can type my thirty eight character password in faster than probably most people can do a ten or twelve character password, but they're just doing it like this. That's just me being a crotch.

• 2:35:27Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 2:35:42Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic in a big way that defined a lot of my childhood.

• 2:35:53Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 2:35:58Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 2:36:04Speaker 06

  So join us and hear their stories and more, because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 2:36:24Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down rather than giving teens the answer. Study mode helps teens work through problems, and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.comPARENTS to learn more.

• 2:36:51Speaker 01

  Cash flow crunch? OnDeck's small business line of credit gives your business immediate access to funds up to $200,000 right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 2:37:22Speaker 04

  The curmudgeonly old timer, get off my loan, get off my lawn.

• 2:37:25Speaker 03

  So Jeff, my question, because I do use a password vault, like my question to you would be, in this, in this digital world where everything we do requires a password, and obviously you don't want to reuse the same password, but how do you manage 30 passwords without a vault? Do you write them all down? Do you personally just remember them all? Like, how does the average person manage that?

• 2:37:55Speaker 04

  Well, A, I'm not the average person. Yes. For better, for worse. Um.

• 2:38:02Speaker 04

  You know, we used to talk about, uh, having passwords you care about and passwords you that are the throwaway passwords. Of course, I've talked to developers that, you know, are doing stuff in, you know, Azure, AWS, where they, they need to know like 300 passwords for all the various different, you know, systems that they got working on. Um, you know, that, that can be a little bit excessive, but I, I guess I'm more of the, of the mindset that you have the throwaway pa- you need to make a password, have it decent, but have, but I, I'm okay with repeating passwords for accounts that I don't care about. Now that, you know, the, the, the, the thinking on that is you don't want to use a password in multiple cases

• 2:38:46Speaker 04

  and use it on someplace where something's gonna get stolen, something you care about. So I sort of distinguish the throwaway password. Oh, I've got to sign up for something. I gotta create an account. I'm never gonna use this again. Some form. I need to have, I need to have a password. Um, so I, I, I have a, I have a, I have a throwaway password that's just something lame. And then the passwords on the accounts that I care about, which are much fewer, they're either unique or they're permutations on a very, very long stream. Uh, you know, but the, there's a couple considerations to be made and I can argue myself out of this because it's not just

• 2:39:28Speaker 04

  stealing the hash and cracking it and trying to, you know, figure out what the password is. There's, if you're using it in multiple places and it gets compromised in one place, it can be used in many other places. That's another type of attack. Um, there's the, the possibility that it, you know, even your best password somehow gets intercepted in, in while you're using it where it's in a fashion where it can be copied. You know, more, more rare, but still a, still a possibility. Um, but.

• 2:40:02Speaker 04

  The bad guys don't often do it that way because there's easier ways to do it. Um, so I, I guess I'm, I could be proven wrong. I'm happy to be proven wrong and argued out of it, but I'm, I'm still of a mind that I have throwaway passwords that I'll use repeatedly in many places. And I don't care if you knock over this account and that account and that account and that account, because I just set up the account so I could download the white paper, damn it, and read it.

• 2:40:31Jack Murphy?

  Right.

• 2:40:31Speaker 04

  Um, but you know, the, I mean, shoot, my, my rental car company that I use, and I won't say which rental car company I use, when I initially set up the, the password on my first app, they asked, they asked for a PIN. So I have a four-digit password on my car rental company. And I keep thinking I should change it, but then I keep thinking, but I don't, I don't really care if somebody rents a car in my name, because I could probably sort that out, you know, I'm not going to be ultimately held liable for, liable for it. And who's going to do that anyway? So I have a four-digit PIN that is my password in my car rental company to this day, and I said it probably 25 years ago.

• 2:41:14Jack Murphy?

  Jeff, um, tell us, tell us about your podcast and where like people can go to find it.

• 2:41:21Speaker 04

  Sure. Um, I'm on a podcast called Paul's Security Weekly. Uh, you can find it at securityweekly.com. Uh, and if you're searching all the podcast catchers, and I think we're on YouTube and Twitch, uh, securityweekly.com is the way you'll get there for subscribing.

• 2:41:43Speaker 04

  Paul Acidorian is the Paul in Paul's Security Weekly. He started the podcast with his friend Larry Pechey, uh, back in 2006, I believe. So it's one of the oldest security podcasts around, and it, and it was built on the premise of practitioners just sitting around, having drinks, talking shop. Paul's a cigar smoker, so much like your studio there. The liquor flows freely, the cigars are smoked. And I met Paul about 10 years ago when I worked to work for this vendor that was a friend of mine. And he got me involved in the podcast. I've been doing it about nine years now.

• 2:42:22Speaker 04

  But we're a weekly podcast. Paul actually made it his own company at some point, which was acquired at some point. But it's a, it's a network of shows. We drop about probably 10 hours of content a week. There's Paul's Security Weekly, the flagship, Application Security Weekly, Enterprise Security Weekly, Business Security Weekly, and twice weekly, uh, Security News segments. So lots of content, but the people that at the end of the day are practitioners that are in this because they're passionate about it. And we talk shop, we talk about all sorts of things like we've been doing tonight.

• 2:43:00Jack Murphy?

  And for people listening, we'll have a link in the description to go and check it out. And where else can people find you?

• 2:43:10Speaker 04

  I do a lot of conference speaking to this day, thanks to my friend that pushed me out into the, into the, into the conference world. I'm going to be, uh, I'm actually going to be up in Canada later this week at a conference called Atlantic Security Conference, Atlantic Security Conference. I'll be at B-Sides Harrisburg, Pennsylvania in two weeks. Uh, end of the month, I'm going to be in Boise, Idaho at the Boise ISSA Conference. In May, I will be in St. Louis at the Show Me Con Hacker Conference.

• 2:43:46Speaker 04

  So a lot of conferences, I'll be around for what we call Hacker Summer Camp, the, you know, B-Sides Vegas and Black Hat and DEF CON. I'll be out in San Francisco for RSA. Um, I'm on Twitter, uh, although I, you know, nobody's on Twitter anymore, but you can find me there at Mr. Jeff Mann. You can, if you spell my name right, you can find me on LinkedIn.

• 2:44:10Speaker 04

  Go to YouTube and type in my name and security and you'll find many recordings of talks I've given. My NSA days, I, my first couple of years where I was in the crypto shop, I did a talk and, and I had

• 2:44:26Speaker 03

  I love that.

• 2:44:26Speaker 04

  The marketing team come up with a sticker for it because hackers love stickers.

• 2:44:30Speaker 03

  Yeah.

• 2:44:30Speaker 04

  So I did Tales From The Crypt Analyst. And then when I did the talk about the NSA Red Team, the first pen testing team, that was the sequel. More Tales From The Crypt Analyst. And this year I'm giving a talk in Commission's New Art. I'm giving Tales From The Crypt Analyst, The Afterlife. Jeff, we, we, we throw stickers up on our door.

• 2:44:52Speaker 03

  We want as many, uh, we want as many of those stickers as we, uh, uh, uh, one of each. Yeah. If you have them, we'd love, we'd love to.

• 2:45:00Speaker 04

  I'm, I'm gonna have to get more of these made.

• 2:45:02Speaker 03

  Yeah.

• 2:45:03Speaker 04

  More of these made, uh, cause I'm down to the last couple, but the, the woman that was responsible for all these stickers, uh, uh, her Twitter handle is OneDark1. She does a lot of graphic art for a lot of the hacker conferences and the B-side. So I call her a con artist.

• 2:45:21Speaker 03

  I have, I have two more questions real quick. Uh, anyway, and, and Dean might have some from Patreon, but M. Corbin, thank you very much. Any way to circumvent hackers for hire used by foreign nations?

• 2:45:36Speaker 04

  Pay them more.

• 2:45:38Speaker 03

  Uh, Mohamed Savani, thank you very much for the very generous donation. Uh, do you, there, so there's a couple of questions. Do you like UV keys for passwords?

• 2:45:49Speaker 04

  I've not used them, but, uh, yes, I, I think they're a good thing to do if you, if you want to drop the money for them. Yes.

• 2:45:57Speaker 03

  Um, seriousness of quantum, hold on, sorry, I lost that. Uh, seriousness of quantum compute threat.

• 2:46:06Speaker 03

  And Chinese

• 2:46:07Speaker 04

  We'll get there, but like any other technology, it'll have the potential for being used for good and bad. So in the old days of the Cold War, it was often referred to the Cold War as a game of cat and mouse. You know, the Soviets would do something that would be devastating, but eventually we'd figure it out. And then we'd do something that was devastating and eventually they'd figure it out. So kind of this cat and mouse game. I think the same is roughly true with all the technological advances. Quantum being

• 2:46:48Speaker 04

  that what we were talking about a year ago, but of course AI is the thing now that is that everybody's talking about. So has the potential for good, has the potential for evil. It's overhyped and not there yet. The quantum thing is becoming real, but you know, until quantum is computing is available on the smartphone or reasonably affordable by people that, you know, aren't nation state status. You know, it's not going to be an issue yet. The what's interesting though about quantum, I will add is because quantum has the ability to to break things. When it becomes popular, that is stuff that was even encrypted in the past.

• 2:47:32Speaker 04

  That's where you start have to think about now what you're protecting with the current cryptography, especially for stuff you're storing, because it could be cracked in the future by by quantum computing. So think about what you're saving and thinking about why you're saving it and storing it. And keep in mind that what you're storing now, based on what algorithms you're using to store it, could become susceptible with compromise. But like everything else, security related,

• 2:48:02Speaker 04

  maybe the protection isn't just coming up with a stronger algorithm. Maybe it's preventing it from being stolen in the first place. Or if it does get stolen, you catch the people doing it and Prosecute them. I mean, there, there's always more than one way to, to, to solve the problem. Um, there are no single point solutions, quantum included, AI included for, okay, we've got this, so we're done. We're good. We can, we can walk away now and not think about it.

• 2:48:33Speaker 03

  Right. Um, how best, and this is still from, uh, Muhammad Savani, uh, how best to develop US talent earlier? Like unit eighty two hundred. And I think this goes into maybe the idea of when, when obviously there's, there are a lot of legal things people can do now to develop their hacking skills. Unlike the past, but let's say you have a kid who is curious, maybe with a criminal balance bent, kind of a narrow do well, but reforms his ways. Is there a way? Do you, do you feel like there's a way to bring these, these people into the government?

• 2:49:20Speaker 04

  Well, not speaking for the government, I would say yes. Um, but you know, the government has rules. I mean, I had, you know, when I was hired at NSA, I had to go through a background investigation. I had to go through a polygraph. They wanted to know all your deepest, darkest secrets. And they, they claimed at the time, it wasn't necessarily if you had done something in your past, it would, it would mean you didn't get hired. They just wanted to know about it so you couldn't get blackmailed in the future.

• 2:49:51Speaker 03

  Right.

• 2:49:51Speaker 04

  Um, so

• 2:49:55Speaker 04

  I mean, I think the government's getting smarter at knowing that they have to sort of cast a wider net and, and not necessarily, um. Go after the the cookie cutter STEM person. I mean, I'm the living proof of that. You know, I wouldn't, I was not a critical skill. I was not a STEM person and I was hired by NSA. And I did some things that were meaningful. And I probably wouldn't be, you know, given my GPA and given my my educational background, if it wasn't for those aptitude skills tests. Recognizing my potential, I would not have been hired by NSA then or even to this day.

• 2:50:39Speaker 04

  So what I'm trying to advocate for is let, you know. Let's figure out a way to find the people with the potential and the aptitude that aren't necessarily the cookie cutter. You know, they're in a, they're in a STEM curriculum or they're uh from a certain neighborhood or they're a certain skin color or they're a certain ethnicity or they're a certain orientation. Let's find the people that have the potential and the aptitude because they test well in a certain skill set and let's promote that.

• 2:51:11Speaker 04

  That to me transcends all the other issues.

• 2:51:14Speaker 03

  Yeah.

• 2:51:14Speaker 04

  And I'm, I'm the living proof of that because I had no business being hired by NSA if all they were looking for was computer scientists, engineers and mathematicians because I was neither of the three. But I ran circles around the people that they hired that did have those degrees that left after three years with a graduate degree and went off and made a lot more money out in the private sector.

• 2:51:36Speaker 03

  Right. We, we, we have a couple.

• 2:51:38Speaker 04

  Yes, I have a chip on my shoulder.

• 2:51:40Speaker 03

  We have a couple of mess uh questions coming in, so I just uh.

• 2:51:43Speaker 04

  Okay.

• 2:51:44Speaker 03

  I just want to make sure we get to them. Uh, uh, thoughts on matter most uh matter most messaging?

• 2:51:52Speaker 04

  I'm not sure I know what that is.

• 2:51:54Speaker 03

  Yeah, I think it's a new secure signal like signal style. I'm not sure of it. Uh, also from Mohammed Savani, how much difficulty, difficulty does a red teamer like you have? Uh, keeping up with the relentless pace of development and knowledge needed like networks to VMs to OSINT to Kali Linux tools, et cetera.

• 2:52:16Speaker 04

  So I don't do the red teaming anymore anymore. I I hung up my my hat on doing or my gloves on doing that about 20 years ago. I've been for the last 20 years trying to talk to people about the possibilities and and what could happen and what could go wrong and what they need to do to prevent it from a process perspective rather than keeping up with the technical stuff. That being said, because we talk about this ad nauseam on the podcast because I'm I'm I'm other co-hosts are actively red teamers. Um, when we do get down to it, the while the technology has changed and

• 2:53:00Speaker 04

  the techniques necessarily change, the underlying motivations and methodologies, the the foundational principles of security have not generally do not change. So in that sense, I don't need to keep up with it because nothing, nothing has changed. And and then, you know, sprinkle on top of that, for all the stuff that's going on, the number, the two reasons why companies still get breached, the two most common reasons why companies get breached to this day, to this day in 2024, is something to do with weak passwords or stealing passwords, exploiting passwords,

• 2:53:41Speaker 04

  and the exploitation of trust relationships. Those are two broad terms, but you know, very rarely is it is it technology related? I mean, we were talking about vulnerabilities and CVE scores a couple of weeks ago and, you know, the the the statistics for something like only 3% of all the published CVs CVEs have ever been used by bad guys to to to steal something, to exploit something. Uh, and yet we have an old industry built around driving down the vulnerability count, driving down the vulnerability count, CVE, CVE.

• 2:54:16Speaker 03

  Yeah. And and so the CVEs, uh, what you mentioned are are the critical vulnerability, like that that come out through the various like Microsoft habits or is it CVE Tuesday or Wednesday? I don't remember. But basically-

• 2:54:29Speaker 04

  Well, it's it's Patch Tuesday.

• 2:54:31Speaker 03

  Patch Tuesday.

• 2:54:32Speaker 04

  The CVE is is common vulnerability-

• 2:54:35Speaker 03

  Common vulnerability, okay.

• 2:54:37Speaker 04

  What's the E stand for?

• 2:54:41Speaker 04

  I can't think of what it is, but basically, I mean, what we're really getting down to is most companies are running a vulnerability scanner of some ilk and responding to the results and the results are ranked critical, high, medium, low, based on some sort of statistical calculation, which is called a CVE score and it's got lots of different factors involved. But, and I'm, I'm somewhat generalizing, but my almost 30 years of experience in the private sector, most companies jump at the scan results and not anything else that they do in their security program. And so, the argument and the discussion we've been having on our podcasts over the last couple of months is what happens when a vendor

• 2:55:26Speaker 04

  discovers a vulnerability in, in something that they produce because somebody discovered it and disclosed it, whether they got a bug bounty or not, but they told the vendor about it and the vendor decides to fix it, but not issue a CVE.

• 2:55:42Speaker 03

  Right.

• 2:55:42Speaker 04

  Does it, does it ever get to the scanner? Does it ever get a finding? Does it ever get a ranking and do companies ever respond to it by doing the patch or the version upgrade? That I think is a very serious issue from the perspective of most companies. They've had it drilled into their heads that everything starts with, what does the vulnerability scanner tell us to do? Because everything we do is associated with driving down the vulnerability count because that's how we manage risk. Overly simplistic, wrong, and we could go another couple hours talking about that, but we shouldn't.

• 2:56:23Speaker 03

  Another one, Mohamed Sabani, again, thank you very much. Final, finally, for the lads, how much difficulty do the glowies, I guess that's the new slang for feds, have in tracing Monero transactions? Beautiful algo lol asking for friends. Of course, Mohammed, we're all asking for, we're always asking for.

• 2:56:45Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 2:57:00Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic in a big way that defined a lot of my childhood.

• 2:57:11Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 2:57:16Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 2:57:22Speaker 06

  So join us and hear their stories and more, because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast, on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 2:57:42Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, study mode helps teens work through problems, and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.comPARENTS to learn more.

• 2:58:09Speaker 01

  Cash flow crunch? OnDeck's small business line of credit gives your business immediate access to funds, up to $200,000, right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat with flexible draws, transparent pricing, and control over repayment. Get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 2:58:39Speaker 03

  Friends. Sure. But when it comes to crypto, you know, and stuff like that,

• 2:58:49Speaker 03

  a lot of people have this impression that it's anonymous. But it's really not. And can you tell us a little bit, you know, from your experience or from your knowledge, like, how do the feds track Monero or Bitcoin or anything else like that?

• 2:59:07Speaker 04

  Um, I mean, I can't speak definitively because I don't work with them or for them anymore. But, uh, given what little I know about it, you know, if they're motivated to, to track it, they can track it. There are ways to do it. Um, I, I would hesitate to say that they're tracking everybody just because, uh, because they're financially and economically bound, just like everybody else. Um, but if they have a reason to go after you, the, the indicators are there. Um, I mean, if you're asking, are you safe to do it and the government's

• 2:59:48Speaker 04

  not watching you, you know, I, I think a certain amount of big brother fear is probably healthy.

• 2:59:54Speaker 03

  Mm hmm.

• 2:59:55Speaker 04

  But, uh, you know, I would, I wouldn't lose sleep over it.

• 2:59:59Speaker 03

  I, I think, I think one of the, uh, you know, and, uh, you know, it was, uh, Darkside Diary is, uh, Jack Reissider, who actually, you know, recommended you to me. And in one of his episodes, he had meant, uh, they talked about a, um, a, uh, Department of Homeland Security, uh, operation against child pornographers and how they tracked, you know, the crypto going in. And the thing is, they may not be able to track like crypto in terms of where it's going inside the system, but eventually you gotta cash out and they can follow it to that cash out point. They can follow it from the buy point. They can follow, follow

• 3:00:41Speaker 03

  it from the cash out point. So, so I think, you know, just kind of emphasizing on your point, if you think you're getting away with something, you're probably not.

• 3:00:52Speaker 04

  Well, I mean, probably a similar analogy is, you know, encrypting data and, and data was encrypted initially for transmission, for communication. And the the mantra back then, or even if you're doing it in the modern world for storage, but if you're encrypting data to protect it, sooner or later, you're you're gonna want to decrypt it so you can use it, or you can refer to it, or you can access it. Um, so the the attack points are either before it's encrypted or after it's decrypted.

• 3:01:26Speaker 03

  Right.

• 3:01:26Speaker 04

  So I think that that's a similar.

• 3:01:28Speaker 03

  Yeah.

• 3:01:28Speaker 04

  Analogy to what you're painting. Um, Jack Resider, uh, it's all him and Schmuckon, that's probably where you saw.

• 3:01:36Speaker 03

  Yeah.

• 3:01:36Speaker 04

  I'm I'm episode eighty-three, if anybody wants to go listen to it, I'm the second part, second half of episode eighty-three. It's entitled NSA Cryptologists. Um, I met I met Jack again at DEFCON a couple of years ago, and I'm like, oh, you do Darknet Diaries, you should really interview me. And he checked me out, and he's like, I really should. So, you know, different el- elements and aspects of the story I've been telling tonight would come out in in the Darknet Diaries episode.

• 3:02:05Speaker 03

  Yeah, he's a really great, great guy. Uh, Andrew just asked a question. Uh, does a cyber liability insurance run its own penetration testing teams?

• 3:02:16Speaker 04

  Uh, I'm not aware of any that do it directly, but they but a lot of times the insurance writers are very closely connected to other companies that do provide some level of assurance that the the insur-ee, if that's the right term, is insurable. And and they would simply do it. But I mean, the first couple of years of the insurance, cyber insurance industry was all questionnaires and and and, um, you know, that was supposed to magically, you know, validate that you were, uh, worthy of the cyber insurance, especially if there was a claim file. Um, so I don't think any of them do it directly, but they certainly, um,

• 3:02:59Speaker 04

  Because of uh claims against it and the and the need to, and I'm not an insurance expert, but actuarial tables, you know, figuring out how much you need to charge people that wanna have this type of insurance based on how many claims are gonna be filed and what's fair and all that kinda stuff, and the insurance companies can still make profit.

• 3:03:23Speaker 04

  They're starting to get more responsible. I mean, cyber insurance has been around for almost ten years, and I remember being asked about it almost ten years ago, and I'm like, people are silly to think that they can uh skirt or dodge regulatory compliance by just getting cyber insurance, and in this context, it was PCI. Cause I'm like, have you ever tried to file a claim against an insurance company? You can be damn sure that they're gonna come back and say, were you doing all the things that you should be doing? So if you think the PCI assessment or audit was bad, wait till the cyber insurance adjuster comes out and starts looking under the hood.

• 3:04:02Speaker 03

  And and a lot of times, I think what they'll do is they'll hire, like, uh, the forensics people to go in and say, well, they didn't do this, and the insurance company will have an easy out.

• 3:04:12Speaker 04

  Right.

• 3:04:12Speaker 03

  Yeah.

• 3:04:13Speaker 04

  But I have heard of, I I mean, partnerships, I guess, or or relationships where uh, this, the insurance carriers do have relationships. I don't, again, they don't do it themselves, but they probably have partner companies that will do a little tire kicking, a little bit of vetting of of the of the people trying to get the policy to to make sure that they're meeting some sort of minimal standard. Similar to like, you know, I don't think insurance companies hire doctors. They don't have doctors on their payroll, but you have to get a physical to get a life insurance policy.

• 3:04:46Speaker 03

  Right.

• 3:04:46Speaker 04

  Most of the time.

• 3:04:47Speaker 03

  Right.

• 3:04:47Speaker 04

  Um, so that, you know, they have partnerships and relationships, or or, you know, you have to have the notarized signature of a doctor. Heck, I gotta renew my driver's license, and I'm like, I can do it in the mail, right? Except for I gotta have the back of the form filled out by the eye doctor saying, I can still see.

• 3:05:02Speaker 03

  Right.

• 3:05:03Speaker 04

  So.

• 3:05:03Speaker 03

  So so the insurance companies will hire somebody that'll boot up Cali and say, yeah, okay, you know, we ran port scans, they're fine, yeah, whatever. But then, if things go awry, the insurance company can also, the claim can also be like, ah, well, you weren't meeting this thing.

• 3:05:21Speaker 04

  Yeah, it's very complicated. Um.

• 3:05:27Speaker 04

  There, there's certainly something to be said for, you know, some sort of minimum level of security, which is typically measured by some sort of compliance standard. Yeah. And, and the cyber insurance companies are certainly getting smarter. Um, but you, you, you, you triggered, you triggered me a little bit because there's also this prevailing attitude in our world and in our industry that the ultimate test is a pen test, which at some level, yeah, if you can afford it, that might be true because that's rubber hits the road, live fire tests. Most companies don't wanna pay for that, but they're, and I'm, I'm guilty of this.

• 3:06:10Speaker 04

  When I first came into the private sector, I started with, let's do a, we called it a pen test, but it was really a vulnerability assessment. Let's see what you got. Let's see what we have to work with. Let's see what your holes are, your vulnerabilities are, and let's start by closing them. I kinda thought that the industry would evolve. Right. Almost thirty years ago. Um, God, that's almost thirty years ago. But, you know, when I got back into this, you know, talking to red team in pen testing companies in the last ten years or so, I'm like, wow, it's become, this is, this is the ultimate test and this is where you start. And you should not start to your, your, uh, journey of security with a pen test. That's the last thing you should do, literally.

• 3:06:54Speaker 04

  That's the last thing you should do, because there's all sorts of more cost-effective economic ways to put security in place and test it and stop gaps and check it. And the ultimate live fire test, when you think you're ready for it and you're mature enough, is a pen test, a real pen test. Not a, not a vulnerability scan, not a Nessus scan, not a, um, you know, somebody running a, a tool suite, this, that, or the other. But, you know, an actual, you want people to try to come after you and you're gonna pay them to do it, let them do it. Again, which is the methodology that was portrayed in the movie Sneakers, which came out in 1992.

• 3:07:39Speaker 03

  Right.

• 3:07:40Jack Murphy?

  Jeff, thank you for spending your Monday evening with us and sharing all these-

• 3:07:46Speaker 04

  Heck, it's almost Tuesday.

• 3:07:47Speaker 03

  Secrets. I know, I know. We've kept you so long. We really appreciate it.

• 3:07:52Jack Murphy?

  We will be back on Friday with Jonah Mendez. Otherwise, Jeff, any, any final thoughts? Any final things you want to put out there before we get going tonight?

• 3:08:05Speaker 04

  There's no way to summarize this. Be diligent, be smart, be caring, and don't believe the vendor.

• 3:08:17Speaker 03

  And again, people can find you on Twitter at Real Jeff Man.

• 3:08:23Speaker 04

  Mr. Jeff, Mr. Jeff Man on Twitter. You can find me on LinkedIn.

• 3:08:28Speaker 03

  Two Fs, one N.

• 3:08:31Speaker 04

  Two Fs, one N.

• 3:08:32Speaker 03

  And, and the podcast, one more time for everybody, please?

• 3:08:37Speaker 04

  Paul's Security Weekly. You can find us at simply securityweekly.com.

• 3:08:43Jack Murphy?

  All right. Well, thank you so much, Jeff, and we will see all you guys out there on Friday.

• 3:08:50Speaker 04

  All right. Hey, thanks for take letting indulging me with all this time.

• 3:08:54Jack Murphy?

  Absolutely, man.

• 3:08:55Speaker 03

  Thank you, Jeff. We really appreciate your time. We had a question from Andrew. I'm going to just ask you real quick. And this last question we're going to take.

• 3:09:04Speaker 03

  If I'm a Fortune 500 company, what is a Penn Test going to cost me?

• 3:09:11Speaker 04

  It's probably a percentage of your, of your revenue.

• 3:09:16Speaker 04

  The presumption is a Fortune 500 company is, is a mature enterprise, and so you're going to pay more. But there's a lot of, I mean- Last time I looked, um, nine out of the 10 Fortune 10 companies, 98 of the 100 Fortune 100 companies have to do PCI, at least in some part. And PCI is notorious for taking a very minimal approach to pen testing. So, um, it could cost you a lot, but it's very much dependent on what you want to get out of it. And if you want to do a pen test, the first conversation you should have is what are the goals and the objectives? Because they're, they are legion.

• 3:10:01Speaker 04

  And, and you need to understand what you're, what you're asking for before you ask for it. And you should expect to pay accordingly. Most companies aren't ready for it, even in the Fortune 500, frankly. Uh, I'd say maybe 10% of the Fortune 500 are really, really mature enough and ready for a pen test to really have a pen test. Pen test being no holds barred. Can somebody get in by any means to do something? But again, that's the goal or the objective. Are they trying to steal something? Are they trying to gain access to something? Are they trying to prove a point? Are they trying, you know, whatever it is, exfiltrate data, lock the data? I mean, I don't know how many pen tests out

• 3:10:44Speaker 04

  there that, that emulate a ransomware attack.

• 3:10:48Speaker 03

  Right.

• 3:10:49Speaker 04

  I don't know. I'm gonna have to ask my, my, my friends to do that.

• 3:10:51Speaker 03

  And, and when you talk, when you talk about the, like this full scope pen test, you're not just talking about hackers, you're talking, or, or like the technical aspect. You talk about social engineering, you're talking about physical, like Devian Olam and those guys, you're talking about the entire gamut, correct?

• 3:11:09Speaker 04

  Yeah, I mean, uh, and I apologize because, you know, somewhere in the, in the time that I took off from this industry, this term red teaming came about. What I call pen testing is, is comprehensive.

• 3:11:21Speaker 03

  Correct.

• 3:11:22Speaker 04

  But most people would call what I'm describing as a pen test these days a red team. It's Devian Olaf, by the way, that's how you pronounce that.

• 3:11:31Speaker 03

  Okay.

• 3:11:31Speaker 04

  I said, I said Olam for years.

• 3:11:33Speaker 03

  I said Olam.

• 3:11:34Speaker 04

  Till we interviewed him, but it's Olaf.

• 3:11:37Speaker 04

  Um, but yeah, I mean, uh, no holds barred means somebody wants to go after you. Uh, and they're going to do it by any, any means possible. It's, it's, it's not simply. Now, the presumption was when the internet came along that the path of least resistance, the easiest way, rather than physically having to go to a place and try to break into it was like, oh, they're connected to the internet. Let's try to get in over the internet. Um, but once defenses came, uh, came up in terms of the technology and the, and the network perspective, you know, the, the, the physical type of thing was back on the table.

• 3:12:15Speaker 04

  Um, and you know, the, the irony is if you, if, if you really want to go after a particular company and you're motivated and you have resources, um, no holds barred means you'll try everything.

• 3:12:32Speaker 04

  There was a movie that came out, I don't know, in the two thousands, maybe Harrison Ford, it was called Firewall. Um, and the, the, no spoilers, but the premise of the movie is Harrison Ford is like a, a, a firewall admin or a network admin at a bank. And, um, the bad guys kidnapped his family and put guns to their heads and said, you know, give us the passwords, give us the UB key, give us the RSA key. You know, help us through the multi-factor authentication, log on to this firewall that'll get us into the network, that'll get us to the safe to steal the money. Because we've got guns to your family's head. You know, that's rather extreme. Right.

• 3:13:15Speaker 04

  But, but for motivated nation state bad guys that are really going after you, that's the measures that they'll go to. Uh, most companies, you know, can't and shouldn't afford to pay for a, a simulation of that type of exercise. But you ought to kind of at least talk about it, you know, tabletop it. You know, what would happen if somebody did X, Y, or Z? But not everybody needs to worry about that because most bad guys aren't going to do that. Because it's easier just to launch the ransomware attack or send out the phishing attack and just see who bites. And, and they're not targeting you specifically. They'll, they'll, they'll just target whoever.

• 3:14:00Speaker 04

  Takes the bait and if it happens to be a children's hospital and people die eh, you know, that that's not what they're worried about.

• 3:14:09Speaker 03

  Right.

• 3:14:10Speaker 04

  Problematic world we're living in right now.

• 3:14:14Speaker 03

  Dee, did we have anything on Patreon? Okay. Jeff, thank you so much. We deeply, deeply appreciate your time.

• 3:14:24Speaker 04

  I appreciate you giving me the time and the audience and um, yeah, uh, feel free, anybody that's listening to reach out to me. LinkedIn's probably the best way to find me. I do, I do honestly try to respond to people, uh, happy to give back.

• 3:14:40Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:14:55Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic in a big way that defined a lot of my childhood.

• 3:15:06Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 3:15:11Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:15:17Speaker 06

  So join us and hear their stories and more because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart radio app today.

• 3:15:37Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, study mode helps teens work through problems and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default and parental controls offer families additional options like setting study hours and quiet hours. Visit chatgpt.com slash parents to learn more.

• 3:16:04Speaker 01

  OnDeck is built to back small businesses like yours. Whether you're buying equipment, expanding your team, or bridging cash flow gaps, OnDeck's loans up to $400,000 help make it happen fast. Rated A+ by the Better Business Bureau and earning thousands of five-star TrustPilot reviews, OnDeck delivers funding you can count on. Apply in minutes at ondeck.com. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:16:33Speaker 04

  I'm happy to answer questions and mentor where I can.

• 3:16:38Speaker 03

  And check Jeff out on Paul's Security Weekly. It's P-

• 3:16:42Speaker 06

  Hi, I'm Jenna Ushkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:16:57Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic, in a big way that defined a lot of my childhood.

• 3:17:08Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 3:17:13Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:17:19Speaker 06

  So join us and hear their stories and more, because living with food allergies isn't just about what you can't eat, it's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 3:17:39Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, study mode helps teens work through problems, and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.com-parents to learn more.

• 3:18:07Speaker 09

  Cash Flow Crunch? OnDeck's small business line of credit gives your business immediate access to funds up to $200,000 right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:18:37Speaker 03

  P A U L S Security Weekly, correct?

• 3:18:40Speaker 04

  It is, but the website, if you go there, is just a place.

• 3:18:44Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:18:59Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic, in a big way that defined a lot of my childhood.

• 3:19:10Speaker 06

  And while there are challenges, there are moments that remind you you are not alone.

• 3:19:15Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:19:21Speaker 06

  So join us and hear their stories and more, because living with food allergies isn't just about what you can't eat, it's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 3:19:40Speaker 00

  ChatGPT for teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for teens supports active learning by breaking concepts down. Rather than giving teens the answer, study mode helps teens work through problems, and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 3:20:09Speaker 09

  Cash flow crunch? OnDeck's small business line of credit gives your business immediate access to funds up to $200,000 right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:20:39Speaker 04

  Securityweekly.com.

• 3:20:41Jack Murphy?

  All right, guys.

• 3:20:42Speaker 04

  You'll find us there.

• 3:20:44Jack Murphy?

  We will see you guys on Friday.

• 3:20:47Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:21:01Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic in a big way that defined a lot of my childhood.

• 3:21:12Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 3:21:17Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:21:23Speaker 06

  So join us and hear their stories and more, because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast, on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 3:21:43Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, study mode helps teens work through problems, and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 3:22:11Speaker 09

  Cash flow crunch? OnDeck's small business line of credit gives your business immediate access to funds, up to $200,000, right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:22:41Jack Murphy?

  Care out there.

• 3:22:49Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:23:03Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic in a big way that defined a lot of my childhood.

• 3:23:14Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 3:23:20Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:23:25Speaker 06

  So join us and hear their stories and more. Because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast, on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 3:23:45Speaker 00

  ChatGPT for teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for teens supports active learning by breaking concepts down. Rather than giving teens the answer, study mode helps teens work through problems and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default and parental controls offer families additional options like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 3:24:13Speaker 09

  Cash flow crunch? OnDeck's small business line of credit gives your business immediate access to funds, up to $200,000, right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:24:49Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:25:04Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic in a big way that defined a lot of my childhood.

• 3:25:15Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 3:25:20Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:25:26Speaker 06

  So join us and hear their stories and more because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 3:25:46Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down rather than giving teens the answer. Study mode helps teens work through problems and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default and parental controls offer families additional options like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 3:26:13Speaker 09

  Cash flow crunch? OnDeck's small business line of credit gives your business immediate access to funds, up to $200,000, right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:26:51Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:27:05Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic in a big way that defined a lot of my childhood.

• 3:27:16Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 3:27:21Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:27:27Speaker 06

  So join us and hear their stories and more because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 3:27:47Speaker 00

  ChatGPT for teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for teens supports active learning by breaking concepts down rather than giving teens the answer. Study mode helps teens work through problems and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default and parental controls offer families additional options like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 3:28:15Speaker 02

  OnDeck is built to back small businesses like yours. Whether you're buying equipment, expanding your team, or bridging cash flow gaps, OnDeck's loans up to $400,000 make it happen fast. Rated A+ by the Better Business Bureau and earning thousands of five-star TrustPilot reviews, OnDeck delivers funding you can count on. Apply in minutes at ondeck.com. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:28:50Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:29:04Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic in a big way that defined a lot of my childhood.

• 3:29:15Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 3:29:21Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:29:26Speaker 06

  So join us and hear their stories and more. Because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 3:29:46Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, Study Mode helps teens work through problems and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default and parental controls offer families additional options like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 3:30:14Speaker 01

  OnDeck is built to back small businesses like yours. Whether you're buying equipment, expanding your team, or bridging cash flow gaps, OnDeck's loans up to $400,000 help make it happen fast. Rated A+ by the Better Business Bureau and earning thousands of five-star TrustPilot reviews, OnDeck delivers funding you can count on. Apply in minutes at ondeck.com. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:30:52Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:31:07Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic. In a big way that defined a lot of my childhood.

• 3:31:18Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 3:31:23Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:31:29Speaker 06

  So join us and hear their stories and more. Because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeartRadio app today.

• 3:31:49Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, Study Mode helps teens work through problems and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 3:32:17Speaker 01

  OnDeck is built to back small businesses like yours. Whether you're buying equipment, expanding your team, or bridging cash flow gaps, OnDeck's loans up to $400,000 help make it happen fast. Rated A+ by the Better Business Bureau and earning thousands of five-star TrustPilot reviews, OnDeck delivers funding you can count on. Apply in minutes at ondeck.com. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:32:53Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:33:08Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic in a big way that defined a lot of my childhood.

• 3:33:18Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 3:33:24Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:33:30Speaker 06

  So join us and hear their stories and more. Because living with food allergies isn't just about what you can't eat. It's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 3:33:49Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, Study Mode helps teens work through problems and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default and parental controls offer families additional options like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 3:34:17Speaker 09

  Cash Flow Crunch on Deck's small business line of credit gives your business immediate access to funds, up to $200,000, right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:34:53Speaker 06

  Hi, I'm Jenna Oshkowitz. You might know me from Glee. This is At the Table, the food allergy podcast, a show about food, connection, and what it really looks like to live with food allergies. Each episode, we hear stories from real people like Daniel.

• 3:35:07Speaker 07

  People would always think I was lactose intolerant, so I just kind of shortened my explanation to I'm deathly allergic, in a big way that defined a lot of my childhood.

• 3:35:18Speaker 06

  And while there are challenges, there are moments that remind you you're not alone.

• 3:35:24Speaker 08

  One of the best guys that I dated, he made a point to memorize all my food allergies.

• 3:35:29Speaker 06

  So join us and hear their stories and more, because living with food allergies isn't just about what you can't eat, it's about still having your seat at the table. Brought to you by Genentech and Novartis. Listen to At the Table, the food allergy podcast, on America's number one podcast network, iHeart. Follow At the Table and start listening on the free iHeart Radio app today.

• 3:35:49Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, study mode helps teens work through problems, and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default, and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 3:36:17Speaker 02

  OnDeck is built to back small businesses like yours. Whether you're buying equipment, expanding your team, or bridging cash flow gaps, OnDeck's loans up to $400,000 make it happen fast. Rated A+ by the Better Business Bureau and earning thousands of five-star TrustPilot reviews, OnDeck delivers funding you can count on. Apply in minutes at ondeck.com. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.

• 3:36:45Speaker 10

  She's been thinking about this sleepover all week, but I think about her food allergies all the time. Fortunately, her doctor prescribed Zolair, omalizumab. It's proven to significantly reduce allergic reactions if a food allergy accident happens.

• 3:36:58Speaker 11

  Zolair 150mg is a prescription medication used to treat food allergy in people one year of age and older to reduce allergic reactions due to accidental exposure to one or more foods. While taking Zolair, you should continue to avoid all foods to which you are allergic. Don't use if you are allergic to Zolair. Zolair may cause a severe, life-threatening allergic reaction called anaphylaxis. Tell your doctor if you ever had anaphylaxis. Get help right away if you have trouble breathing or if you have swelling of your throat or tongue. Zolair should not be used for the emergency treatment of allergic reactions, including anaphylaxis. Zolair is for maintenance use to reduce allergic reactions, including anaphylaxis, while avoiding food allergens. Serious side effects such as cancer, fever, muscle aches and rash, parasitic infection, or heart and circulation problems have been reported. Please see zolair.com for full prescribing information. Ask an allergist about Zolair. This is an advertisement for Zolair

• 3:37:43Speaker 11

  paid for by Genentech and Novartis.

• 3:37:45Speaker 00

  ChatGPT for Teens is designed to help teens learn, think critically, and grow their skills. ChatGPT for Teens supports active learning by breaking concepts down. Rather than giving teens the answer, study mode helps teens work through problems and interactive quizzes test their knowledge and provide immediate feedback. Safety protections are on by default and parental controls offer families additional options, like setting study hours and quiet hours. Visit chatgpt.com/parents to learn more.

• 3:38:12Speaker 01

  Cash Flow Crunch? OnDeck's small business line of credit gives your business immediate access to funds up to $200,000 right when you need it. Cover seasonal dips, manage payroll, restock inventory, or tackle unexpected expenses without missing a beat. With flexible draws, transparent pricing, and control over repayment, get funded quickly and confidently. Apply today at ondeck.com. Funds could be available as soon as tomorrow. Depending on certain loan attributes, your business loan may be issued by OnDeck or Celtic Bank. OnDeck does not lend in North Dakota. All loans and amounts subject to lender approval.