Chaos Lever Podcast

A review of a core keynote presentation at the 2024 Gartner Security and Risk Management Summit and what it means for the IT industry.


One of the Good Ones: The 2024 Gartner Security and Risk Management Summit
Sometimes it's worth putting pants on. In this case, it's for the 2024 Gartner Security and Risk Management Summit. Despite previous criticisms of Gartner, Chris found the conference surprisingly enjoyable. In this episode, he provides an overview of the event, which featured over 150 sessions. One important keynote highlighted the unhelpful obsession with perfect IT security performance, emphasizing the need to focus more on recovery than prevention. Ned and Chris discuss the resulting industry burnout, which affects productivity and creativity. Other topics include evolving security behavior programs, AI and its risks, and the future impact of quantum technology.


Links

What is Chaos Lever Podcast?

Chaos Lever examines emerging trends and new technology for the enterprise and beyond. Hosts Ned Bellavance and Chris Hayner examine the tech landscape through a skeptical lens based on over 40 combined years in the industry. Are we all doomed? Yes. Will the apocalypse be streamed on TikTok? Probably. Does Joni still love Chachi? Decidedly not.

Ned: It is slightly more important than some half-marathon thing, where I’ll just overheat and then drink beer.

Chris: I mean, I suppose… yeah, you could do that at the child’s birthday party.

Ned: Oh… it is at a place called Urban Air. I guess they would have beer and maybe treadmills. I don’t know.

Chris: Or it’s like a hipster place that makes mead.

Ned: No, it’s not. There’s no axe throwing. It’s a kid’s trampoline park kind of thing.

Chris: Whoa. Whoa, whoa, whoa, whoa. Kids on trampolines, throwing axes.

Ned: [laugh]. That sounds great, doesn’t it?

Chris: Tell me that is not a happy birthday.

Ned: Let me tell you, the waiver I had to sign for this sucker went on for 36 pages.

Chris: [laugh].

Ned: Hello, alleged human, and welcome to the Chaos Lever podcast. My name is Ned, and I’m definitely not a robot. I’m a real human person who has feelings, dreams, the need to sleep every once in a while, possibly while some sort of programming tutorial is running in the background. Really, isn’t that the best possible white noise? With me is Chris, who is also white noise. And here [laugh]. What’s up, Chris.

Chris: It’s amazing. I am both white noise and the black hole.

Ned: [laugh]. Oh, you’re very Michael Jackson in that regard.

Chris: Moving on as quickly as possible.

Ned: [laugh]. Yes, I immediately regret it. That did not work the way I wanted it to. How about a nun falling down the stairs? What’s black and white and red all over?

Chris: Buh-dum-shh. What is in that water glass?

Ned: [laugh]. It’s not water, man. Okay, now that I’ve quenched my thirst for water, let’s quench my thirst for knowledge about security.

Chris: Not just about security; about security conferences, which is apparently the only thing I talk about anymore.

Ned: [laugh]. Well, this one’s a little bit different because—

Chris: It is.

Ned: You took a different approach this time, one that I have to say I’m a little proud of you for doing, like, actually leaving your house.

Chris: Dude, the complaining that was involved in that effort—

Ned: Entirely by you.

Chris: Weeks, upon weeks. I went to the Gartner Security and Risk Summit, so you didn’t have to.

Ned: Unless you did. Because you might have.

Chris: It’s possible. There were other people there.

Ned: Some, from what I hear.

Chris: But, you know, if you didn’t go, you might want to consider it. The TL;DR here is, I was pleasantly surprised by how much I enjoyed this conference. And based on the conversations I’ve been having, you know, with coworkers and people that were there, that’s a pretty common thought. This seems like one of the good ones.

Ned: Okay.

Chris: So, let’s just start with the positive. It was held in National Harbor, Maryland, which I can’t for the life of me tell if this is just, like, an area that’s, like, designated, is it actually the name of the town, it’s all very confusing. But National Harbor, Maryland, is isolated by itself. It was like specifically purpose-built for this. They have a conference center, they have a lot of restaurants right up the street, there’s a casino, and the whole place has that distinct feeling of mandatory fun at high, high prices.

Ned: The kind of prices that only the government can afford.

Chris: [laugh]. Yes, it is quite close to a lot of government-type things. In fact, if you drive there in the right direction, you go right past the front gate to the NSA.

Ned: I’ve been there. At least once of my own volition.

Chris: [laugh]. It’s a weird area, National Harbor. I overheard one humble conference-goer refer to it as something to the effect of, “This place is crowded as all hell, and it smells like pot and body odor,” which, burn.

Ned: An accurate descriptor of almost any city I’ve been in.

Chris: Or just, like, a really expensive frat party.

Ned: [laugh]. Fair.

Chris: Interestingly though, if you’ve heard of this conference, and you’re like, “It’s not in Maryland,” and you’re now confused, don’t be. This conference is not only held in one time, in one place. There are a multitude of them held worldwide, including Dubai, Mumbai, Sydney, the aforementioned Maryland, Tokyo, and London. Okay, that’s not as many as I thought, but it’s still more than the single conference that RSA puts on every year.

Ned: I love that you named off these cities.

Chris: [laugh]. And I pronounced them all correctly. I think.

Ned: And included amongst those cities, titans of—like, these are major cities that almost everyone on the planet has heard of is, Maryland.

Chris: [laugh].

Ned: We’re in Maryland, which isn’t even spelled like it sounds, but we’re here, and at least it’s not Delaware.

Chris: And this is also not a spelling podcast, which for your case, thank God.

Ned: Ugh, valid, though I would be even more ill-equipped at a pronunciation podcast.

Chris: Pronunciat-e-own, if you will.

Ned: [French accent] hon hon hon. Listen, we’re not at that conference.

Chris: Anyway, I think as a direct result of the fact that this conference is held so many different times, the conference is way smaller. They did not throw out an exact count that I caught, but I could have sworn that I heard the number 5000 thrown around.

Ned: Okay.

Chris: Which, if accurate—and felt right—that’s a nice bump over the 4300 they had over the past two years. So, it’s a lot of people, but it’s not a number that feels completely overwhelming and crushing. Having said that, there were still times where the hallways were kind of crowded, and you felt like you couldn’t move all that well, which makes this humble conference-goer, think they might be [stage whisper] outgrowing National Harbor. It’s right on that line of uncomfortability. Which is a word. Don’t look it up.

Ned: I never do.

Chris: So, another thing that’s different: the conference is targeted at leaders, primarily CISOs and strategists rather than hands-on keyboard engineers, all the way up to people in the C-suite. The fanciest-of-pants attendees also got the opportunity to speak one-on-one with Gartner analysts about whatever topic they chose. So, whether they wanted to do a breakdown of a recent publication, whether they wanted to talk in private about a real specific use case, whatever they wanted to do, they were able to do it. Now unsurprisingly, my pants were not that fancy. Y’all are lucky I was wearing pants, is all I’m going to say.

Ned: Fair.

Chris: Now. I did spend some time at the lobby bar having unofficial one-on-ones talking to some analysts and other Gartner employees—Gartnerites? Gartnerers?

Ned: Garteners.

Chris: Gardeners—and basically found them all insightful and delightful to talk to, which of course immediately made me wonder why they let me in the door.

Ned: It’s fair. And I think in the past, you and I have given Gartner, its fair share of lumps for always being one step behind in their advice and their observations, and charging absolutely ludicrous amounts of money for their reports or membership. But we can’t really pin that on the individual analysts.

Chris: Right.

Ned: It’s more of an institutional problem.

Chris: And, probably in comparison to some others, they might actually even be reasonably priced. I’m not a hundred percent certain, but I think there’s a chance.

Ned: I do recall Forrester being even more expensive and less useful.

Chris: So anyway, “What did they actually talk about at this conference,” I’m sure you’re frustratedly growling to yourself under your breath. I suppose we can talk about that.

Ned: I mean, we’ve only danced around it for the last ten minutes.

Chris: But before that, let’s have a deep dive into peanut butter preferences.

Ned: Ooh, crunchy all the way. No questions.

Chris: Okay, good. You can stay on the podcast.

Ned: Wooo.

Chris: Because there was in fact, only one right answer.

Ned: [laugh]. Oh no, I know. So, I will caveat and say if you were trying to bait traps, creamy is better.

Chris: Why would I want to—

Ned: But that’s because you’re trying to catch vermin. So, there’s that.

Chris: So, what you’re saying is people that eat creamy peanut butter are vermin?

Ned: I did not say that. But it didn’t not not [laugh] say that [laugh]. Moving on.

Chris: Anyway. So, the conference was held over three days and included over 150 sessions, so I’m not going to be able to cover everything. And there actually were some technical ones, like, yes, it was mostly aimed at leaders, but there was some really into the weeds type of stuff, particularly on the expo floor. The vendors would do 20-minute sessions, and unfortunately, these were not recorded, so even if Gartner does make stuff available, those are not going to ever be available to anybody. Which is annoying because I saw an awesome one about Passwordless by YubiKey that I did not take enough notes on. In terms of the formal conference sessions, however, there were blessedly only two formal Gartner keynotes—count them: two—

Ned: One, two.

Chris: —and then there were three guest keynotes. Now, it’s still too many keynotes, but it’s way more reasonable than the RSA’s 36. If you would like to hear the full summary of the summit from Gartner themselves—which hilariously, they published before the show started—got links in the [show notes 00:09:18]. Also, the two formal keynotes, as well as one random session about strategy from the CEOs perspective, are already published on YouTube. Also, also, also, if you just can’t get enough Gardner—

Ned: Who can?

Chris: They publish, like, 40 podcasts, which is a fun fact that I literally only learned yesterday.

Ned: Huh.

Chris: And scanning through them, they’re all nicely organized, and there’s a lot of episode titles that sound a lot like session titles, is all I’m going to say about that.

Ned: And they’re just giving those away?

Chris: [laugh] Yeah. Yes, they are.

Ned: Fascinating.

Chris: So, the main keynote that opened the show had an interesting position that I think is worth exploring in depth. And that position is this: IT, especially IT security, is paranoiacly [sp] focused on a hundred percent perfect performance. And that is not helpful, and we need to change that expectation. Now, it’s probably not a natural-feeling concept because you’re probably asking yourself, isn’t perfection the goal? Well, I mean, it is, but it isn’t.

Think about anything. There’s no game, no job, no hobby, no activity at all where you can or should expect a hundred percent perfection. You’re going to lose a tic-tac-toe every once in a while. It happens. You didn’t get a hundred percent perfect grades in school, right? I mean, obviously Ned didn’t. It was a generic question. Even your valedictorian missed a question here and there.

Ned: I was valedictorian.

Chris: No, you weren’t.

Ned: I sure was.

Chris: You were only one of those syllables.

Ned: [laugh].

Chris: The comparison that was made at the conference in multiple places, not just this keynote, was retail. There is no expectation that, in retail, loss prevention teams, which do exist and are taken very seriously, there’s no expectation that they’re going to stop all losses. In fact, they don’t even call them losses, they categorize it as inventory shrinkage, which is a delightful term.

Ned: It is. But there’s a reason.

Chris: Right. It is a common and expected measure. And these losses are incurred, not just from shoplifting. It could be internal theft, external theft, errors in shipping, vendor fraud or vendor mistakes, or damaged goods that can’t be sold or returned.

Ned: Or even mistakes when taking inventory.

Chris: That’s a good point, too. Stuff in retail goes missing. It is just the reality of the business, and if you’re thinking, well, this is just the dollar store that you’re talking about, no. Even the craziest of high-end stores have shrinkage. Tiffany’s has losses. Ferraris gets stolen.

Ned: Impressive.

Chris: It happens. So, in terms of tying that back to IT security, the point was twofold. First, this causes us as an industry to be way too focused on prevention of breaches and not nearly enough on the recovery from breaches. The second point was that this obsession is causing people to drive themselves crazy with overwork, and brings about—you guessed it—burnout. So, let’s take the points in order.

First off, we’re focused too much on prevention and not enough on recovery. And it feels weird that this is a problem because one of the major things that we say about security is, “It’s not if you get breached. It’s when you get breached.” So, on the one hand, we have this recognition that bad things are going to happen. On the other, we expect a hundred percent perfection. What are we doing?

Ned: What are we doing?

Chris: And this [sigh] paradox, dichotomy, whatever you want to call it, is doubly true when consistent evidence clearly shows companies, including CEOs and boards, are all perfectly willing to increase their risk exposure in order to achieve growth. You look like you were going to say something, but you might just be gassy.

Ned: No, I’m thinking about the concept of risk and how it’s just, any large corporation, part of what sort of the financial side of the house does is assessing risk and determining what are the actual risks involved, whether it’s cyberattacks or something else; what is the expected cost of that risk, and what is the impact; and then, are we willing to do what needs to do to prevent that risk from occurring or are we willing to just accept the risk as is, and pay the penalty if we think it’s sufficiently unlikely or not expensive enough?

Chris: Right.

Ned: So, it’s more of a financial question than anything else. But I don’t think that perspective tends to trickle down to the rank and file InfoSec people, and those are the ones who need to get the message that a hundred percent perfection is actually not the goal. It’s mitigating the risks that are worth mitigating.

Chris: Right. And being prepared to react when something goes wrong.

Ned: Right. There’s a certain group of people who think of it as a defeatist attitude to say, “It’s not about if you get breached; it’s about when,” and they go, “Well, that’s just defeatism. I can prevent everybody,” you know? Or, “We should strive for perfection.” And I’m not in that camp, but I understand where they’re coming from, where you don’t want to just complacently accept mediocrity. So, there’s a balanced be struck.

Chris: Yeah. And incidentally, one thing I didn’t have time to talk about, but they talked about in-depth is, how do you as a company, actually figure out what level of risk you’re comfortable with, you know? Designing a risk portfolio, and a risk registry, and all that type of stuff. It was an interesting topic that honestly, probably could have its own episode. But the point that they’re trying to make in terms of the business and how you operate as an IT shop is, you’ve got to focus on that recovery, and you’ve got to take it extremely seriously.

So, this means things, like, actual immutable backups, creating and maintaining recovery runbooks, and especially DR practice needs to be brought further into the forefront. And based on what they talked about, it would be, frankly, irresponsible to do otherwise. And the other part of this is, that it’s super unfun.

Ned: Oh, yeah.

Chris: But it is totally necessary to practice your disaster recovery procedure. Everybody always thinks that recovering from an incident is as simple as I’ll just follow all the steps in the document, which is how people think.

Ned: Right. Mm-hm.

Chris: But anybody that’s ever been in a disaster situation, of any kind really, knows that it’s not that simple. You’re simply not in a state where you’re thinking clearly. Even the most basic of tasks is exponentially harder because the adrenaline is overwhelming your system, people are yelling, systems are slow, and oh, my God, this document hasn’t been updated since 2016. Jake? Why is Jake’s name in here? He doesn’t work here anymore. And he’s the one that knows all the passwords? These are not things you want to have happen at three o’clock in the morning when the systems are all on fire.

Ned: My favorite was that all of the passwords were stored in a password security application that ran in the data center that had gone down.

Chris: Nice.

Ned: Sooo [laugh].

Chris: Facebook had a little incident like that a few years ago, where—

Ned: They sure did.

Chris: Couldn’t get into their building because the system that controlled the front doors was in the building.

Ned: Oops.

Chris: These are the sorts of things you figure out when you practice.

Ned: Yeah.

Chris: So yeah, recovery has to be a priority because you all know eventually something is going to go wrong. And as I wrote in my notes about this point from when I actually watched the keynote, quote, “You are going to get breached at some point because, math.” And goddammit, I think I nailed it.

Ned: Ah, yet another thing we have to blame math for.

Chris: [laugh]. So, pivoting on to point two: burnout. This constant obsession with perfection, which we have established and agreed is an impossible target, is ruining people, has been doing so for years, and we are only now starting to reckon with it. It is interesting enough to me that it came up at RSA, and now it’s in the keynote at Gartner. Obviously, this is a thought.

And there were, of course, statistics to back it up. Gartner—shar—bleh—Gartner sharted? No. No, no, no, no.

Ned: Let’s hope not.

Chris: I mean, they were all wearing dark suits. I’m not sure. Moving on. Gartner shared a statistic that I thought was interesting, and that is 62% of cyber leaders reported experiencing symptoms of burnout last year, quote, “At least once.” And if you know anything about self-reported stats is that the actual number there is probably well higher.

Ned: Agreed, yeah.

Chris: So, one of the guest keynotes attacked this problem head on. First, though, I think it’s worth grabbing a definition. Burnout is a specific consequence of occupational stress. It’s a work hazard. So, it’s not in the DSM, although there is some argument that it should be.

The World Health Organization defines it as, quote, “A syndrome conceptualized as resulting from chronic workplace stress that has not been successfully managed, characterized by feelings of energy depletion or exhaustion, increased mental distance from one’s job, and reduced professional efficacy.” Unquote. It is chronic and repeated stress that depletes your mental energy, which energy does not get recharged. And what she said was, it’s basically a permanent state of fight or flight. It is pernicious and damaging, and you might not recognize it when it’s happening at first, and it can take months to properly recover from it.

Ned: Most people I know that have gone through severe burnout were not aware of the severity during the time they were actually getting burned out. And they all had a tipping point where they just collapsed, emotionally and sometimes even physically, and just were not physically capable of doing their job. And it was only when they went back and looked at what they’d been dealing with over the past, you know, six months, year, whatever, that they came to realize the level of burnout they’ve been experiencing. And this isn’t the sort of thing where, like, Joe goes on holiday for, you know, a week, and now he’s fine, and everything’s cool. This is the sort of thing where people just move to a totally different industry because they, they can’t do it anymore.

Chris: Right.

Ned: People will drop out of InfoSec because they are burned out, and that’s not, like, a thing, you can take a week off, or even two weeks, and be fine with. That’s something that you’re going to have to deal with more holistically.

Chris: Yes. And it’s nice that it’s being talked about at this level because frankly, I wasn’t sure that I was hearing correctly. Because as I said, they’re talking to leadership, and leadership doesn’t often want to hear about it. But they shared more stats. Do you want to hear more stats?

Ned: I love stats. You know me. Stats guy, all the way.

Chris: In the past year, burnout is estimated to have costs the world economy $2 trillion in lost productivity, in days off, in inefficiencies, et cetera, and burnout related mistakes was a direct contributor to 83% of security breaches.

Ned: Wow.

Chris: And a lot of it, I think, comes down to exactly what you just said a second ago, which is when people start to suffer from burnout, they don’t recognize it right away. It becomes the new normal, and that normal means that you are now at 90% efficient, and then 80% efficient, and then 70% efficient, and then you feel tired all the time. And then everything is negative, and you are distancing yourself from your job. You are feeling complete sense of hopelessness, a total lack of initiative, and just want to get through the week, so you can sleep all weekend. And as the nice lady said, you can’t fix that with a fucking pizza party.

Ned: I hope she said that on stage.

Chris: She didn’t really say it, but I was reading between the lines. I think that’s what she wanted to say.

Ned: No, I agree. And I mean, to compound problems, we have sort of this rockstar… mentality, warrior mentality, whatever you want to call it, where it’s like, well, yeah, things are tough right now, but I’m tough, and I can work through it, you know? It’s on me to help save the company. Like, that… [sigh] it’s even self-imposed sometimes, but sort of this expectation where we laud the people who persevere through adversity without reckoning with the fact that they’re probably traumatized at the end.

Chris: Right. I mean, just to make a quick connection, that’s the same thing where you valorize people on Instagram based on what they post, and not on their actual life. Like, you have this vision of people that is not correct, not based in reality. But anyway, back to burnout, in general. She really did say it can’t be fixed by a field trip or a wellness program. Not that field trips aren’t important, and not that, you know, being mindful, doing meditation, being careful in mind, about your body. And all that is really important, but it’s not like a—you can’t take a pill to fix it.

Ned: Right.

Chris: And as an industry, it is a huge problem. $2 trillion is a lot of dollars. It will only be fixed if we fundamentally rethink the way that we think about work, the way that we report about work, and the things that we make people responsible for. Now, the session made one more fascinating connection for me. I think it is pretty well known, A, that burnout exists, maybe if you don’t understand the severity of it, but it’s pretty well known that the first thing that goes when you start to feel burned out—I mean, hell, even when you start to feel tired—you lose the spark of creativity.

But here’s the thing. IT work is creative in nature. Problem-solving is a creative endeavor. This is not a factory floor. And what is IT if it’s not a series of problems that need to be solved?

Ned: Right.

Chris: Now, the session with the guest speaker is not posted on the Gartner site, as of time of recording at least, but what I am going to include in the [show notes 00:24:02] is a link to the speaker’s previous five minute… it’s not even a TED Talk, it’s like a TED summary that both hits a lot of these points, and also has fun graphics.

Ned: Ooh, I like those.

Chris: One quote that came from it that really summed this up was, quote, “Productivity has wrapped itself up in our self-worth so much that it’s almost impossible to allow ourselves to stop working.”

Ned: Oh.

Chris: That’s the problem, and we need to stop that.

Ned: I feel attacked [laugh].

Chris: [laugh]. So, that’s the gist of it. Oh, Bear Grylls was there. He told us to never give up.

Ned: Ugh, fuck that guy.

Chris: Now, he did well. I mean, he was a good speaker. I was surprised.

Ned: I actually don’t have anything against him. I just—

Chris: You like the—

Ned: —that archetype, I don’t jive with it.

Chris: Would it be better if his name was like Jerome?

Ned: Jerome Grylls?

Chris: Mm-hm.

Ned: Yeah, maybe. Okay.

Chris: Actually, Jerome Grylls sounds like a YouTube channel.

Ned: I will send him a handcrafted note made from my own pressed papyrus, explaining to him in grave detail how he should change his name, so that I will approve of it.

Chris: And really, that’s, I think, the validation he needs in life.

Ned: It’s the validation we all need. Wouldn’t you feel better if you got, like, a handwritten letter on hand-pressed papyrus from somebody else?

Chris: I don’t think I’d know the difference. It just looks like flat oatmeal.

Ned: Fine. There goes your Christmas present, right out the window.

Chris: I hope you at least made it into an airplane. Okay, what about AI? Well, AI is a big thing too, as you can imagine. But I was impressed with how careful, how realistic, and some would say cynical a lot of the presenters were about AI.

Ned: Good.

Chris: AI, in their perspective, simply put, is just another tool with just another batch of risk. No more, no less. It is not anywhere near the level of taking over the world that the press releases would have you believe. Hallucination is a huge problem and a massive risk to the enterprise, and one that in a lot of these tools has not been solved. So, talking about our risk registry above, how much risk are you willing to take around something like that?

Again, it’s different at the enterprise level. Now, one thing that they did talk about was how AI has been tied into certain tools that are out there, and something that it really excels at, which is translating a human language statement into a query that is programmatical. So, for example, a lot of threat-hunting software out there uses proprietary query languages, like KQL. There are more; that’s the only one I can think of because it’s the worst one.

Ned: It really is.

Chris: So, GenAI tools can take a human language ask and spit out a KQL query. Now, this use case is really helpful, especially for people that are already fluent in KQL, right? And this is not that much different than the way we talked about Copilot when that first came out all those years ago. If you know what you’re doing, you can ask it the right question, and you can also vet what it sends back to you. But usually you can do that in a matter of seconds, especially when we’re talking about something as simple as a one or two-line KQL query. That’s a time saver.

Ned: Totally.

Chris: But the point that they made is that base QL system is still necessary. All AI is doing is an intermediary. When you ask it to interrogate that data directly, it falls flat on his face, then it tries to get up and it falls again. So, that’s where they’re at with that.

Ned: Okay.

Chris: They do have something out there called the AI Impact Radar, which is kind of a—really, it’s a graphic, basically, that helps guide understanding about where Gardner thinks the various pieces of AI are. Because there are more than just ChatGPT. I think there’s 30 of them on there. And they go out in escalating circles depending on how far Gartner thinks these various investments are from being valuable or being mainstream. But if you want the TL;DR, their recommendation is to hold off on long-range future GenAI technology investments at this time. Like I said, reasonable.

Ned: Yeah. Remarkably reasonable.

Chris: [laugh]. So, all right, we’re coming up on time. A couple of quick hits from some of the other sessions. One that came up was around security behavior and culture programs being more meaningful than just awareness. There’s a lot of evidence that shows that we have reached the rational limit of the amount of value that we’re going to get out of fake phishing campaigns, or forcing people to watch a 15-minute webinar once a year.

What you need to do is teach your employees how to act and respond, not just look out for and be aware that this exists. Gartner does have a whole setup for this, which they called the PIPE framework. What that stands for, I have absolutely no idea, and I actually couldn’t find my notes from the session, so that’s all you’re going to get. I did watch a good one about zero trust. One of the biggest [laugh] problems that the Gartner people thought was that they don’t think ‘zero trust’ is a great name.

Ned: Yeah…

Chris: It’s catchy.

Ned: It is catchy.

Chris: But it’s not zero trust. It’s just the right amount of trust, albeit that amount of trust is pretty effing low, and can change at any time if you decide to be naughty. Which is a lot of words.

Ned: I like zero trust for what it expresses. I don’t love how it was slapped on everything for about two years.

Chris: [laugh]. Yeah, I don’t think they liked that either. There were quantum sessions. So, there’s a lot of interesting stuff there that I am, in fact, saving for a future episode, hint, hint. But if you want the real fast summary, there’s meaningful stuff going on with quantum. It’s super serious, but honestly, enterprise-level stuff is not going to become a serious issue until around 2030. Which might sound like a lot until you remember that Jurassic Park came out in 1993, and you don’t even want to do the math on how long ago that was. But it wasn’t ten minutes ago like I think it is.

Ned: Chris, there’s all these formative albums that I really enjoyed from the ’90s that are now starting their 30th anniversary tours, and it just stings, man. It just [laugh]—it hurts. Don’t like it.

Chris: No… no, I think I told you, and this is going to be a reference that only makes sense to people in the Philadelphia area, I died a little bit inside when I heard Alanis Morissette on 98.1.

Ned: [breathes out] ohhh.

Chris: [laugh].

Ned: Hey, thanks for listening or something. I guess you found it worthwhile enough if you’ve made it all the way to the end, so congratulations to you, friend. You accomplished something today. Now, you can sit on the couch, tuned into Alanis Morissette’s “Jagged Little Pill,” and relax for the rest of the day. You’ve earned it.

You can find more about this show by visiting our LinkedIn page, just search ‘Chaos Lever,’ go to the website, pod.chaoslever.com, or you can leave us feedback and comments, which we will read during the Tech News of the Week portion. If you say it’s okay.

Chris: Yeah, if you don’t want us to, we’ll just read it, and that’ll be it.

Ned: Yeah.

Chris: Or if you don’t want us to read it, we can do that too.

Ned: [laugh]. You can just write it and never send it. It’s up to you. We’ll be back next week to see what fresh hell is upon us. Ta-ta for now.

Chris: Seventeen sessions I went to.

Ned: That’s impressive.

Chris: And I remembered so very little. I did take a lot of notes though. But then I lost them.

Ned: Less impressive [laugh].