Episode 67: How One CISO's Personal Crisis Sparked a Mission to Protect Everyone with Alex East

Transcript

Intro:

Just before we get into today's episode, we experienced interview fraud. So this is everything from fake profiles applying to proxy interviews where people are swapping themselves out mid-interview or AI fraud. But we hear a lot about it and that's why we launched 909 Shield. It's a platform that keeps you safe during that interview process. Learn more at 909shield.ai. So let's get on with today's episode. Hope you enjoy the show.

Narrator:

Welcome to 909 Exec, the executive leadership podcast from 909 Cyber where cybersecurity intersects with business strategy. Your host is Den Jones, founder and CEO of 909 Cyber. For more than three decades, Den has led enterprise security at Adobe, Cisco, SonicWall, and Banyan Security, helping executives navigate risk, trust, and transformation. Each episode goes beyond headlines and hype with conversations that matter to leaders shaping the world of technology. So please join us for 909 Exec episode 67 with Den Jones and Alex East.

Den:

Hey everybody. Welcome to another episode of 909 Exec. I'm your host, Den Jones. And like every other episode, we're trying to bring some wit and wisdom. And today I've got a fellow Brit with me, Alex East. Alex, man, you are an author, an evangelist, a consultant, public speaker, and I love this on your LinkedIn and all around smarty pants. So welcome to the show, Alex.

Alex:

Thank you. Pleasure to be here.

Den:

Now, one thing I was really excited about this conversation because we've spoken a few times before. So yeah, so one of the things for me that I was really, really keen to talk to you about really is all the books and stuff that you've been working on, some of the public work that you've been doing, trying to help people. Within our community, we always get narrowed out on the latest hack and all these things and practitioners and our network, but a lot of the work that you've been doing goes beyond that. So I want to dig into that a little bit. But before we do that, why don't you introduce yourself? What's your role? How do you describe yourself to people?

Alex:

Well, I describe myself to people as what you just said, and they usually lead with the smarty pants part of it or a less friendly version of that, let's say. But yeah, been around since God was in shorts. I started out as, and this is going to show my age, tinkering around with the old Zedex spectrum. Remember that back in the day, Clive Sinclair? And just trying to play around with coding and things on that. And that led me to a development career and used to do some stuff trying to break things, trying to find weakness in things before other people did, which led me into some ethical hacking and maybe some not so ethical hacking sometimes. And wound up over here in the States. My wife's American, so the long distance thing was tricky. So we ended up deciding that this was going to be the place.

I'm glad she did. I much prefer California to rainy old England, although they've been getting some insanely hot weather there that didn't happen when I was growing up. But I've worked for many different cybersecurity companies in lots of different kind of capacities, forensic analysis, endpoint, SIM management, worked SOC, all of those kind of things. And it wasn't until something happened in my family that led me to write the books, and I guess we can dig into that later, but that's about me. That's what I've been doing for the last

Den:

30 years. So born and bred in England, hence the cool, intelligent accent. People say that about me as well, but I only bought glasses so that people would think I'm smart. But yeah, I mean, you've had a fascinating career, right? Because you've went from software engineering to architecture, sales engineering, and really pretty much working with clients about building their environments and securing what they're doing as part of that journey. What would you say from just your experience, and you're still in this capacity as well. I mean, how would you think the role has evolved? I mean, when you think of sales engineers 10, 15 years ago, and then now, I mean, what do you think that evolution's been like?

Alex:

So before there were very defined processes and procedures that you would go through back then. And this is the script for a demo. This is the process you go through for a POC. I think now, certainly more so in the startup phase, you are wearing a lot more hats. You are doing almost pretty much an implementation every time you come to demo. It's become a lot more technical, I would say, than it used to be. You have to know a lot more things than you did before, especially now in the AI age where it's not necessarily. I always use this adage. When I was coding, you would write code and you knew what the outcome was going to be if your code worked properly because it was going to follow these steps and then this was going to be the output. I think with AI now, it's a lot more nebulous.

You can do exactly the same thing in one LLM as another one and get a completely different output. Even if you put the same thing into the same LLM, you might get a different output depending on what it does. So I think certainly with the introduction of AI into things, both on the security product side as well as the ancillary side of things where people are using AI to help with their day-to-day work, but also we're using AI to do things like red teaming and testing for vulnerabilities, as well as adversaries using AI as well to scale up their attacks and things.

Den:

Yeah, I was just going to ask that. It's like you work with a lot of CISOs and architects and people, and I'm curious when you're engaging with them, how are they responding with AI, especially when it comes to looking at products and trying to decide what risks they're going to solve?

Alex:

Yeah, I think the problem right now with most of the people I talk about, certainly from a security point of view, is they don't know what they don't know. They don't know what AI applications people are using in their environments. They don't know if it's good or if it's bad. They don't know if they have a sanctioned AI product that people are using it for the right reasons. Are they using it for work or are they creating cats riding bicycle videos? And so there's a lot of unknown there. And trying to get a handle on that is probably one of the biggest problems is you can't fix what you don't measure. And first it's the finding out, and then it's like what I call putting bubble wrap around it. So it's not misused either accidentally or on purpose.

Den:

Yeah. And as I speak with a lot of CISOs or even CEOs, one of the things that strikes me is we're all still trying to figure out the difference between the hype and the marketing bullshit and the reality. And I think that the reason this becomes harder now than it was in the last five years is because AI has also enabled a lot of companies to be born. And then there's a billion AI vendors doing lots of the stuff that sounds the same, but the nuances, they kind of differentiate. So what advice do you have for a CISO that's trying to get ahead of this AI craze without wasting time or money on everything that exists?

Alex:

I would say plan ahead. There's an old adage of know your outcome. So before you just go all in and push all those chips forward and go, we're going to go all in AI, find out which tools work best for your particular use cases because there's great claude, ChatGPT, those are great and everything, but there's lots of other kind of more niched AI products out there that are better at doing those specific tasks than just generally using Copilot or Gemini or something like that. So invest in the products that will help you and then make sure you put guardrails around that so that you know that you're not wasting time and money and make sure people aren't using those tools for tasks that aren't necessarily work related.

Den:

Yeah. And I think that's a great point. One of the things is there's some very niche specific AI tools depending on your industry or depending on the task at hand. And everybody knows about the ChatGPTs and the Claudes and the Copilots, but there's a ton of other very niche tools that are probably better. I mean it's cool though. You can use an AI LLM to ask you which ones are good for your niche. So use AI wisely. And I think the one thing, and you hit the nail on the head here is, look, you can't protect what you don't know. And if you're not bringing visibility into AI usage in your company, maybe that's the first step.

Narrator:

So

Den:

I always think of it like you've got guardrails and policies and the documents no one gives a shit to read anyway. And then you've got the technical controls that try and help you bring the visibility and the control into the environment. You got to start there really. I mean, somewhere that matters. And too many people blow their time on AI, so we're going to take a break and then when we come back, I want to dig into some of the author piece of your life because that for me is the thing that got me excited. We'll be right back.

Hey folks, just want to take a minute to say thanks for listening to the show, watching the show, however you engage with us. If you're liking the conversations, if you think we're adding some value, we'd love you to like, subscribe, and share the show with your friends if you know of anyone else that would benefit. Ideally for us, that will help us be able to grow the show, invest more in the quality, get some more exciting guests, and keep bringing you some executive goodness. Thanks everybody. Take it easy and enjoy the rest of the discussion. Okay, Alex. So the one thing that excites me on this conversation is books. Not that I'm an avid reader, but the one thing I am really enthusiastic about is protecting our community's people who are not in our industry. So why don't you share a little bit about what got you into book writing in the first place?

Alex:

Yeah, so I kind of stumbled into it accidentally. It began with getting a phone bill actually. So we have a family plan and it's the same amount every month, except one month it doubled. And so shocked I did what most right thinking parents would do. I went and shouted at my kids and they both looked at me incredulously going, "It wasn't us. It wasn't us." So I looked at the bill and at the time my father-in-law was on our plan and I saw a whole bunch of phone calls coming to and from The Bahamas. So I spoke to the wife and she said, "Well, I don't know, maybe he's got a new girlfriend or something." So we went down to visit him, asked him about it, and he kind of sheepishly looked at us and he said, "Well, I'm not supposed to tell you this, but I've won $10 million on the lottery." And that's when my heart sank.

And long story short, he'd lost tens of thousands of dollars to this lottery scam. So that was when my wife said, "Look, you've spent the better part of 30 years protecting corporations from being breached. What about something for the ordinary people?" So did a bunch of research and it turned out that seniors are a massive target for scammers for a variety of reasons. One is that there's an unfamiliarity with the tech. Another one is trusting nature. And also there's a nest egg to go for them. Many of them have paid off their mortgage. They've got pensions and stuff, they've got savings. So there's a goal to be got after. So we kind of brainstormed and we though, well, what's the best way of doing this? And we though, well, why not write a book that helps seniors protect themselves? Looking what red flags to look for, what to do, what not to do, all of that kind of thing.

And then that led to a variety of speaking engagements. So I've been going around speaking at retirement homes on TV, on radio, podcasts and stuff in the local media as well in newspapers. Just trying to get the word out there. In fact, I gave away 4,000 copies of my book in the first couple of weeks of it being published. So it's not my retirement plan. I was going

Den:

To say, could you use the words gave away? Which for Brits, we're not usually the ones you think of as giving shit away for people. Well,

Alex:

That's you, Scott's. That's not

Den:

Us. Yeah, yeah. Yeah, maybe we've got that accolade, I guess. We don't give away beer for free, but books. Maybe after we read a book, we'd probably give it away. So how long ago was the first book then, the seniors?

Alex:

So the first one was about, what, coming up on two years ago now. So that one went out. Like I said, gave away a whole bunch of copies. It got a lot of positive feedback on that. In fact, it's awesome. I go to retirement homes and stuff, and some people come up and they say, "Oh, we bought this book for my dad." And soon after he'd read it, he actually received a phone call from someone pretending to be from Medicaid. And because he'd read your book, he said, "No, I'm going to verify this before I do anything." And he hung up and he called back, called Medicaid, and they said, "No, that wasn't us." And he said, "That saved him from getting scammed, so thank you so much." And that's always gratifying when you hear stories like that.

Den:

Yeah, that's brilliant. And then the follow-on book, so why don't you share what that book's all about and then how that came about?

Alex:

Yeah. So after the first one, so my nephew works in law enforcement, and he was talking about the book to the cyber team there, and they actually reached out and wanted to chat. And it's always a little bit nerve-wracking when law enforcement reaches out to you and says, "We'd like a chat with you." So I went in and had a word with them, and they said, "We think what you're doing is great. But most of what we do is actually with children." Because with seniors, the attack or the reason for the attack is usually financially based. They're after the money, sometimes prescription drugs, but mainly it's money. With kids, there's so many more what we would call attack vectors. The attack surface is larger for kids, to put it in that way. So there's cyberbullying, there's grooming. There's also a financial thing as well, trying to get to the parents' finances through the kids.

So that led me to, with working with law enforcement, they were brilliant. They gave me a whole bunch of real life examples of different things that had happened using AI to create pornography, all of that kind of thing. So that all went into the book and then published a parent's guide to online safety and helping parents have those conversations because kids, especially teenagers, they don't want to hear it from the parents. They don't care. It goes in one ear and out the other. So it's kind of teaching parents how to have the conversation with them as well, not just being preachy and, "Don't do this, don't do that." It's like, "Oh, I've heard about this thing that's going on." Swatting, for instance. "I've heard about swatting in the news. Have you heard about that? Have you heard of any examples? "And the kids will either say yes or no.

If they say yes, oh, tell me about it. What's going on? Or," Oh, you haven't. Well, this is what I heard. "And it turns it more into a two-way dialogue rather than being preachy at your kids.

Den:

Yeah, because as we have all learned as parents, the minute you tell your kids not to do something, then they're probably going to go straight out and do that thing there.

Alex:

Yeah.

Den:

Because we were kids once, right, Alex? So obviously that's how we've done it as well, right? Yeah. And I do think that, yeah, I think there's a dialogue. In the journey of writing the first couple of books, what was the biggest lesson you learned?

Alex:

I would say employing a professional editor. So one of the things we did when we were looking to get it published was trying to tout it around publishers. And most of them didn't look at it because they're looking for the next Harry Potter or the next 50 Shades of Gray. There's something that's going to make them a gazillion dollars. And a book on cybersecurity isn't the sexiest thing. So my wife actually said, "Well, why don't we just start our own publishing business?" And so I said, "Well, I'll write a new publish them." So she actually took on the whole business building side of things and what that entails. And there's a lot more to it than we realized. And editing, I would say, is probably one of the biggest finding. There's lots of editors out there. And what they do ranges from, some of them just do spell check, run it through spell check and go, "Yeah, this is good," to others that will actually read the content, understand it, and provide feedback around the flow of the book.

What makes sense? You've got this chapter before this chapter, maybe we should move things around. Or you've got this part in here that's in this chapter. Maybe it belongs in this other chapter. So finding an editor that does that is more of a collaborator is super helpful. Unless you are a career author, which I'm not, that is a massive thing. And then copyright is another one. We found after we published the first one, a lot of looky-likeies suddenly started appearing with almost the same title. And looking into it, what had happened is they'd taken our book, run it through AI, and said basically rewrite this a little bit and then published it under ghost names. So being able to nip that in the bud, spending the $69 to get that copyrighted is worth every penny as well.

Den:

$69 does not seem a lot of money, right? Well, when you said to get that sorted, what are you able to do if someone releases a book? I'm assuming in that case, they probably released a digital version as opposed to a paperback or hard back, right?

Alex:

You'd be surprised. So if you publish through something like Amazon, Amazon will actually print on demand for you. So all you have to do is upload a manuscript to Amazon and they'll take care of everything else, whether it's e-reader or an ebook or a physical book. So if we do find copyright infringements, we report those to Amazon or whoever the publishing company is, Barnes & Noble or whoever it is that's actually selling that, and then they will investigate and then remove those from the shelves.

Den:

Wow. And then, so I think the one thing from the editor perspective, does that mean that you find editors that actually are in the industry you're writing in?

Alex:

I haven't done that yet. I've been really lucky. We kissed a lot of frogs before we found the right one, I will say. But once you find one, they're worth their weight in gold. And then what I would do is maybe put those on retainer or pay them over and above what they've actually asked for because some of them for the work they do. Well, some of them for the work they do, they're overpaid. But the really good ones, they're worth their weight in gold. So that's what we've done is with the editor that we found now, she's still freelance, but we will let her know two, three months in advance, "Hey, this manuscript is coming. Can we book you in? Here's a deposit." So we've kind of blocked out that time for her and made sure that we are on track to get the book published on time.

Den:

Yeah, because I can imagine it's a lot of work. Books around the corner, so you got two under your belt. What's coming up next?

Alex:

So there's two in the works. One is already edited. I've actually got the proofs of it back, so that's it. The AI scam survival guide. So that one should be out relatively shortly, I think by the middle of August. Hoping to get it out by black hat, which is actually the first week in August, only a week away. Yeah, I

Den:

Was going to say if you're hoping to get it out by then, you got a week.

Alex:

Yeah, pretty much everything's done. It's mainly the marketing side of things. So sending out pre-release copies and stuff, so that part. And then the one that is currently with the editor is cybersecurity for small businesses. That one came about because a few of the speaking engagements I've done with rotary clubs and local business communities, they were asking about, "Well, we don't have the budget of a Starbucks or a Capital One. Do we need to worry about cybersecurity?" And again, with AI, before they weren't such a target because the risk and reward or the rate of return on investment wasn't that great. But now with AI, they can attack small businesses at scale with a minimum of effort. And now they're the biggest target there is out there. So I created a book to help small businesses, teaching them, again, what kind of attacks that will be coming after them, how to recognize them, what to do if they have been hacked, recovery, all of that kind of thing, putting processes and procedures in place, training their staff as well to learn about phishing, spear phishing, vishing, all of the shings.

Den:

All the shings. That'd be cool. Actually, we should probably throw links on our 909 Cyber website. We are building a resources section, funnily enough, so we'll need to throw that in there. And then yeah, at time of recording, we're recording just before Blackcat. The release of the show will probably be just after Blackcat or thereabouts. So I think by that point we'll have the link to the new book because that will be launched, I'm guessing, at that point. Yeah. And then there's another one, I think, like the secure passwordy thing.

Alex:

Oh, yeah. So people often say, "What's the best way to keep your passwords safe? Should I use a one password or a LastPass or something like that?" And my response to that is always, "Yeah, that's better than using the same password across everything. But as a good friend of mine who's the CEO of LastPass, good old Kareem, found out those aren't necessarily the most secure things either." So I said, "The most secure way of storing passwords is in one of these." You write them all down, you keep them locked in your drawer, and you rotate them every three months. And that's the most secure way. It's a hundred percent unhackable.

Den:

It is really funny because one of my friends did drop off a book like that. It may have been that book. I mean, that was last year actually. So I don't know, when did you release your one? Because something dropped me off one.

Alex:

Yeah, it would've been about that. I put it out shortly after I put the Cybersecurity for Seniors book out because they were the ones that were asking about where to store their passwords.

Den:

Yeah. And it's interesting because 10 years ago, we would've said, "Never write your passwords down." And then 10 years later, we're like, "Maybe you do want to do that after all." I mean, I still talk about password managers as being a critical piece of the puzzle. And I do think, yeah, there's certainly one of those ones that you listed has been breached, I think, twice in the last two years. So you just got to realize, yeah, this stuff, because it's software, it's not billproof. And at some point you've got to assume the thing will be breached. So just keep that in mind when you're picking your password manager of choice. If it's a book, then yeah, it may The get a safe and get a book. And maybe that's the old way of doing it. Just don't put it

Alex:

On Post-it notes and stick it to your screen. Don't do that.

Den:

Yeah, don't do that. I think the hard thing, and this goes back to friction of security in general, is anytime you get more secure, you're introducing friction somewhere generally. If you were going to write all your passwords in a book, then the friction is I'm going to have to get my book out and I'm going to have to type it in manually. I mean, heaven forbid. And it also is very hard to educate seniors or non-technical people on things like UB keys and stuff like that. I mean, that's the other thing. So it doesn't matter what the device is here. It's hard to stay secure sometimes, even as security professionals. If you could write one book that was not a security book, what would you write?

Alex:

Oh man, that's a good question. Probably some kind of fantasy fiction. I'm a huge D&D nerd, so something along the Lord of the Rings type line would be it. Yeah, love that.

Den:

Yeah. Yeah. I don't know what I would write because I don't read a lot of books. I listen to audiobooks now. I mean, I'm a big fan of that stuff, but I never really read books. And the only time I'd read things, it'd always be manuals on the thing I was trying to solve. I mean, so before the internet, you'd sit there and I'd have a Novell network guidebook or some shit built like this and you're going through it and you're like, "Why is the response time on this server so slow?" And you'd be in a book trying to figure out which configuration parameters are most likely to be the ones that you're going to need to tweak. I think kids today have just got it so easy, to be honest. So yeah. And then we are round the corner from Black Hat and all this stuff.

Your role is funny because you're an evangelist and stuff and the consultant. You work with companies all the time on security. What excites you about these conferences and what just frustrates the shit out of you?

Alex:

So what excites me is innovation. When I see something that I haven't seen before, when someone is fixing a problem that everybody has in a new and wonderful and easy way. You and I both know the CISO at Chipotle, good old Dave.

Narrator:

He

Alex:

Told me once, he goes, "Look, all you have to do is show me how you save me time, save me money, keep me safe. That's it. Show me those three things and I'll pay whatever it is." So something that does that, there's a few issues out there I think in the cyber world. One that's been around forever that I don't think there's ever been a good solution for is asset management. ServiceNow does a little bit of it. Axonius does a little bit of it. Some tools do a little bit of it. But I think asset management is something that I think is frustrating for everybody in the cybersecurity world, knowing exactly every single asset that you have and making sure that that is nailed down and safe. And then the other thing is people that are jumping on a bandwagon, and now so many companies are just put in the initials AI after their name.

And people are jumping on that bandwagon and either have vaporware, don't really have a product, or have a product that doesn't really solve a problem. So that kind of frustrates me as well, is a lot of people jumping on bandwagons. It was like that with Zero Trust as well. When Zero Trust was the buzzword, they were like, you'd go to RSA or Black Hat and there'd be 50 new Zero Trust companies.

Den:

Yeah. Well, the good thing is this year, Dave, there's nobody doing Zero Trust now. All those zero trust companies are now AI companies. So the reality is we're good. Yeah, it's interesting. You mentioned asset management. One of my roles is a CISO at SingleStore and they're the fastest database in the world company. Now they're really jumping into AI as you can imagine. And one of the things we were talking about within the security and IT team was asset management. And we're like, well, wait a minute. Why don't we take our own product and integrate it with the procurement product, integrate it with the MDM product, integrate it with the build product, and then we'll build our own database of all the assets and continually have these integrations, just keep it up to date.

When I'm logging in, what device did you log in from when a server makes a call to an application? It's like, okay, well, what's going on there? And when I was at Adobe, I was being punished. I think I was being punished. They made me run service management for a good number of years, maybe six years. I absolutely hated it. Met some great people, done some great work, but at the end of it, service management for me was just not a passion for my life. But one thing we'd done pretty well was we actually automated the whole thing end-to-end for all the assets, spinning up stuff, spinning things down. I think the reason that it's so tricky and the reason everybody says your CMDB is always out to date is because nobody really does a good job of that automation piece of it.

I think now though, that for me was over 10 years ago, maybe longer. Now though, we've got enough good technology and even AI automation tools that I think there's no reason you need to spend a million dollars plus on a big fancy platform if you've got a database and you've got some AI tools to build some integrations. Yeah, I'm really enjoying the work the team's doing just now because it's night and day of a different experience than what we're trying to do 15 years ago. Yeah, and the ZT thing, I just look at it like, and it's funny you mentioned what Dave said at Chipotle, because I've said this to companies all the time, I said, "You don't need to tell me about the risk you're reducing. Start by telling me how you're going to save me money, reduce friction in the business, and then reduce risk." And it's got to be in that order because one of the biggest pressures we're under as a CISO is actually budget.

And then the next pressure is how do we show to the business that we're not slowing them down? What's their velocity? And basically risk, well, the problem with risk is everybody says they reduce risk, and how do you quantify that?

Alex:

Right.

Den:

And how do

Alex:

You measure it, right?

Den:

Yeah. Yeah, exactly. I can measure saving money.

I can also measure a friction in the business with clicks to done and things of that nature. If you're going to log in and access an app and service, how do you do it in a way that's quicker than it was last month or last year? And then yeah, I wonder how many years though we're going to be dealing with AI being the marketing buzzword, because it feels like it's already been about three or four. I'm just glad that some of these companies have stopped talking about digital transformation and zero trust for the minute. Let's see what they're going to do next. So yeah. Cool, ma'am, hey, if you're going to leave a CISO with one bit of wisdom that you've learned over the years, what would that be?

Alex:

I would say, good question. I'm trying to pick one from the mini. Okay. I would say in the world that we are right now, get a handle on AI before AI runs amuck. Get guardrails around it, know what you've got, know what it's used for, and put bubble wrap around it. That's what I would say.

Den:

Yeah. No, that's perfect. Awesome. Thank you, Alex. So everybody, Alex East, he's an author, he's an evangelist, a consultant. He's been an architect, he's a sales engineer. I mean, pretty much you've done all of these things over the years, but most of all, you're a bit of a smarter parts, Alex. I really appreciate your time, man. Thank you. And yeah, folks, I think we'll have all the links to the books up there, and then we will probably invite Alex back actually, because I got a sneaky feel and he's not going to stop on this book. There's probably going to be a few more after this, so we need to keep in touch.

Alex:

My pleasure. Love to.

Den:

Thanks, Alex.

Alex:

Cheers.

Narrator:

That wraps up this episode of 909 Exec. If you found value here, subscribe and leave a rating to help others discover the show. To learn more about 909 Cyber, our advisory services, and how we help organizations secure growth, visit 909cyber.com. Thanks for listening. And until next time, lead with clarity, build trust, and stay secure.

‍