Welcome to this, uh, live special edition of the Cybertraps podcast.
Uh, excited to have Nick Moritzi here.
We are here live at the Inch360 event at beautiful Gonzaga University.
Nick, thanks for being here.
Tell us a little bit about who you are and
what you do.
Yeah, thanks Jethro.
Thanks for having me and it's great to be back in Spokane.
Nothing like, uh, The Bulldog on the yard right outside.
Wished I could have gone to the basketball game last night.
Oh, no kidding.
Couldn't make time for it.
Great team.
Yeah.
And it's a lot of fun.
And everybody around here gets excited when they're, when they're doing well.
I bet.
Yeah.
A little background on myself.
I'm about 30 years in high tech, building businesses, many startups,
some large companies for the last 10 years in cybersecurity.
Um, Cloud Cyber Security specifically, so I actually
didn't do much network security.
I went straight into the cloud world when cloud actually hit.
Like right around 2012 when AWS started to become really popular and AWS
and Azure and Google were launching.
That's when I Landed in the cloud security space.
So, been an interesting eight years.
That's for sure.
Very bloody, very bumpy, very bruised.
Not a lot of knowledge on how to secure the, the new world.
Yeah.
You know, we all, we knew how to do network controls.
Yeah.
We knew how to do internet security.
A bit.
But we didn't know how to really secure the cloud.
Definitely things have changed.
Yeah,
and, and would you say that the cloud is secure now?
I would say the, the folks who do it well definitely secure it, right?
And you have to own that.
It's, you know, it's a shared responsibility, right?
The cloud is, it's, they own the infrastructure, but we own the results
and the outcomes of that, of that cloud.
And, um, so I would say for sure, You know, over the last, call it
five years, I'd say the tools have become very purpose built because
we know what the problems are.
Where ten years ago we were guessing what the problems were.
So we were building solutions that were more guesstimates
than they were right on point.
Yeah.
And so over time you, you, you hit, you get, you guess some right and
other times you guess some wrong.
Things wrong.
Mm-Hmm.
. And so now I'd say that the purp, the pro, the solutions that you can deliver,
that, you know, after you've architected, after you've done the work to figure
out what you want to do, that the tools that are there are very purpose built
so you can actually really succeed.
Yeah.
And it's easier to succeed.
It's not a, a big lift and shift motion that we've gone through the last decade.
Mm-Hmm.
, it's definitely very purpose built.
Yeah.
So there are normal everyday folks running businesses, leading organizations
who rely on cloud services and don't understand how, how they work, how
they're secured, uh, any of those things.
how do you help people like that?
Stay aware enough that they, that they do what they need to do?
Yeah.
But not go over their head or above their level as you're trying to help them.
Yeah, sure.
Good, good, good question.
Um, so I work for a company called HP Aruba.
Um, we have a very solid cyber security enablement program, so
we can, we help companies do that.
Now, really it boils down to what type of company you are.
If you're, typically if you're an SMB type of a client.
You, you want to outsource that work.
You don't, you want to focus on your core business, like you Jethro, right?
You're, you're, you run a podcast company.
Right, yep.
You don't want to manage your own cyber security.
No.
You, you need that outsourced.
Yep.
You need to just be secure.
Yep.
So you, I would advise you to go find a strong managed, managed service provider,
managed security provider, managed IT provider, somebody that you trust.
There's lots of them now.
That's the difference.
Ten years ago there wasn't that many.
Now there's lots of them.
So you can compare and contrast very easily.
But obviously as you move up that chain from SMB to more like mid market, large
enterprise, multinational corporations where we're hiring large staff, we're
managing lots of products that in that situation what I would do is,
you know, I would want to engage them.
Go through some enablement, go through some architecture.
Um, understand what they're trying to accomplish.
What's the business value for doing what they're doing?
Because at the end of the day, if we're just trying to secure stuff and
we don't know why, What's the point?
Yeah, exactly.
So, you know, I'm always trying to understand the pain.
Right?
The metrics of the change.
Like, if you're going to do that, what's the value to the business?
Um, are you going to save some money?
Are you going to generate a bunch more revenue?
Are you going to Protect your IP better, mitigate risk, what are you trying
to accomplish, what's the outcome?
this is interesting because, uh, one of the school districts that I was a
principal for, uh, we outsourced all of that security to, uh, GCI up in Alaska.
Sure.
And they took care of all of that for us because, we were on a small remote island.
It was really difficult to get I.
T.
professionals to come there because they would only be coming for the job,
and, uh, and it was just, it was just tough to find qualified people to do
that, and so, rather than, you know, paying a six figure salary for someone
to come and be that, we were able to pay that or about less to, to have all of
that managed, but then over time, uh, as expertise grew within the community,
then it made more sense to move, uh, in house rather than have it be outsourced.
And it's just, it's interesting how those growing pains, like, the school
district size didn't change, but the proficiency within the organization did
change.
Yeah, I agree.
Actually, you see that just in general.
That it's good you have very explicit, you know, school analogy, but reality
is that The biggest challenge is lack of talent in the world right now.
Cyber security talent.
There's um, I read just a month back, there's 700, 000 unfilled
cyber security positions in the U.
S.
alone.
Really?
That means globally, there's probably close to 2 million.
Wow.
700 here, 700 in Europe, Middle East and Africa, and probably
another 600 in Asia Pacific.
That are unfilled.
Yeah.
So we're talking about probably a 2 billion dollar lack of talent problem
that's growing at close to 25%.
Yeah.
Wow.
So there's no end in sight to solve that problem.
So I would say most organizations, it doesn't matter how big you
are, you're trying to find ways to manage that problem, either
becoming more operationally efficient by managing less tools.
Like, I've got my staff, I've got 20 people, I can't find any more.
I've got 10 unfilled jobs, but I've still got a hundred cybersecurity
tools I've got to manage to, you know, secure my, secure my company.
How do I do that?
And the only way you can do that is to become more operationally efficient.
So reduce the amount of tools that they're buying.
Consolidate, so that you can do more with less, essentially.
Or, outsource.
Yeah.
And it's definitely a big problem and it's only getting worse.
My son.
My son's, uh, just finished his fifth year out of, uh, college working.
So he, right out of college he went into cyber security.
Um, I won't share, um, his income figures, but his first job was a
computer science in cyber security.
Uh huh.
And, um, he made a good pay, pay.
Yeah.
But he was an entry level guy, right?
So he made good pay.
But then five years later, he 5X'd.
Wow.
If you're a student, if you're a stay at home mom who wants to go back to
work, um, you know, go start looking into cybersecurity types of roles,
because they're in high demand and they're paying a lot for these people.
Yeah,
I don't know the right way to say this, but Do you need to
be a nerd to get these jobs?
I literally, I had a coaching call yesterday with a friend's friend.
So one of my lady friends has a friend who's been trying to get into cyber
security and so I did a little networking call with her and my answer to her was,
you really actually, the technology is, this is a really simple problem, right?
We're trying to stop the, the hacker, the threat.
And the threat comes in a couple different varieties but, but the easiest
one that we can think of is the threat.
I always use myself as an example, you know, my whole life for many, many years
until I got into cloud security, I always stole data whenever I left the company,
I would always, you know, and so I was the biggest DLP data loss problem, right?
It was just my nature and I was not alone.
I think this was the way people did it back then.
It wasn't because I wanted the data for myself.
It was because I wanted to make sure I was prepared for my next thing, you
know, it wasn't to try to hurt anybody.
And, and so what you'll find in that problem is that you have to stop Nick,
right, because Nick still exists, right?
And so that's the, that's the internal employee who's, who's doing that
which is the hardest one to stop.
Yeah, interesting.
And then you've got to solve for the external ones, which are easier to stop
because they're easier to control access.
Um, and then you've got the social, which is an external hack attacking
Nick internally, but he's unaware.
So he plays along and he ends up getting hacked because he gets
socially hacked, but I look like an internal threat at that point.
Yeah.
And, and so it's tricky for sure.
Yeah.
So tell me a little bit about you, stealing data as you leave a company,
because it doesn't sound like you were.
Uh, maliciously doing that.
It was just part of your workflow.
Tell me about that.
Well, I mean, that's just, you know, like you think about the old days, right?
You were, your, you did some work and it was saved on your computer
and you put the pop it on a USB port and you walk out, right?
That's, that's the concept, right?
So that's the simple concept now today.
, that person is not putting it on a USB port.
They're putting it in their personal Dropbox account.
Right?
Right.
So that's a CSS B use case technically.
Right.
So that's why we invented CSS B.
CSS B.
What is that?
Cloud access Security broker.
Okay.
That's the, the, the acronym.
mm-hmm.
. But the real purpose of that is to crop, to stop data loss to the
personal Dropbox or the personal box account, or my personal Google Drive.
Right.
So I'm on a managed device.
I'm on my work device.
I'm getting ready to steal that data.
In the old days, I'd pop a USB port in.
In the new days, I upload that stuff to my personal drive.
It's the same workflow, essentially.
So that's CASB use case.
These are technologies that we built over the last decade to
solve for that data loss issue.
And so now, like, you can't do that anymore.
Right.
Like, even if I want to, I can't.
I get stopped.
I think Brant said it in there.
We have to stop people.
from doing, right?, Cause there was no maliciousness in me It
just was part of my workflow
that opens up a whole line of questions.
We're going to have you back on the, on the show again in the future.
So, uh, so we'll get into that more later.
Cause I think that's a really interesting use case, especially
for schools specifically where there's, there's so much there
that can be done, uh, with that.
And teachers are notorious for, for that kind of thing.
And some districts have policies specifically to prevent teachers from
doing that and others don't care at all.
And some things that you create while in the employ of the
district are the district property.
And other districts are like, you create it, it's yours, we have no claim to it.
And, there's some blurry lines there.
That would be a great, uh, philosophical talk.
The policy.
Yeah, no kidding.
so what's your big takeaway from Inch360 so far, Nick?
What I would say is it's great to see the local cyber security
people come out in groves, right?
That's a pretty darn full room of cyber security people.
Yeah, it's pretty awesome.
Um, and, uh, and then also it was wonderful to see students.
So it's like, it's definitely, not just a problem of the people
today in the workforce, but it's a problem that the students are
recognizing and they're looking to.
You know, they want to help, right?
You see that the youth is so much more interested in, you know,
solving the climate problems.
Solving the security problems.
They really want to do this, you know, they really want to.
And so they're here and I like to see
that.
Yeah, very cool.
Uh, Nick, any, uh, parting words?
You want people to
reach out to you?
No, thanks, thanks for having me on.
And, uh, definitely appreciate the H360 for the, for the time.
Yeah.
Thank you.
Appreciate
you being here.