Elevating Cybersecurity: Importance of Relationships, Mentorship, and Honest Feedback with Ken Foster

Aaron Crow (0:1.286): Hey, welcome to the show. Ken, I appreciate you taking the time today, sir. Last time we saw each other, were, we were having fun and shooting guns and talking cyber security. So why don't you introduce yourself? Tell us who you are and a little bit about your background.

KEN FOSTER (0:13.046): Yeah, good to see Aaron. Yeah, what a great trip out there to get to enjoy a good day of just good conversation and good day at the range. My name Ken Foster. I've been a CISO IT leader, veteran, started when I was in the Navy about years ago now. Back when we still called this information assurance and...

Aaron Crow (0:23.326): That's right.

KEN FOSTER (0:40.510): working on the technology systems that ran radar weapon systems and stuff like that. to successfully transfer that into a civilian career after the fact of just working on whatever came at us, right? Back in the early days of cybersecurity, was, you're the guy who knows about what's plugged into the network and these computer things. Here's this firewall, here's this antivirus. here's the new thing that came out. So I kind of grew up in the industry that way, which

KEN FOSTER (1:9.550): A lot of us that are around the same timeframe, that's kind of how we started out. know, security was new and exciting and was something that got tacked onto your resume. you know, that's kind of where I got into it. And it was something that I gravitated towards and felt, you know, enjoyed it. It's a new puzzle every day. And the interesting thing about it is, is 30 years later, it's still a new puzzle every day.

KEN FOSTER (1:35.082): Unfortunately, we still suck at it, you know, from an industry standpoint, because it's kind of funny because it's the everything that's old is new again, right? I remember giving a keynote six years ago. I was talking about the number one threat vector we were dealing with at that day, and it was ransomware. And I gave a keynote last year and the number one threat vector we were talking about was ransomware.

KEN FOSTER (2:1.114): And I just got through reading through the IBM breach report and ransomware is still the number one problem we're dealing with. it's, you know, it's cyclical, but it's also one of those things. Yeah, they're figuring out new and better ways and they're improving at a faster rate a lot of times than we are on the defender side, right? Because they've got more time to do it. We've got a day job we got to worry about and that gives us a...

KEN FOSTER (2:29.258): It puts us at a disadvantage.

Aaron Crow (2:32.156): Yeah, you know, and it's so true. You know, my, my career has been, I've worked in cyber security without ever having that title way back in the day, you know, doing network design and making sure, but, we were locking down, you know, I was an exchange and, active directory administrator for, you know, large companies like AT &T and, things like that. And cyber, that term was never part of what we did, but we were locking and least privileging and making sure, you know,

Aaron Crow (2:58.078): people weren't getting into systems they didn't have access or shouldn't have access to things like that, right? And then we just started, know, hey, you know how to do this. Like this is now your job, right? And how many over my career, almost all of my progression was because, you know, there was a need and nobody else raised their hand and they're like, you're it.

KEN FOSTER (3:16.558): Yeah. Well, you know, it's funny, right? Because I think, I've talked about this a lot. So when we started out in this industry, it was that way. You were a generalist. You learned a lot of things. you either started out on the network or the infrastructure, maybe a database guy, sometimes a developer, although that was a lot rarer, but you know, you, but you still were doing some coding of some kind because you were learning scripting. You were learning all this stuff.

KEN FOSTER (3:44.236): And we were very broad, very general people, you know, and normally it was the people who had the curiosity and the desire and the aptitude and attitude to not be afraid to jump into something new and move into this new realm and understand, dig into it and self-motivation, self-teaching, self, and just get there. And then over time we went, okay, well now I need specialists, I need a fire.

KEN FOSTER (4:13.262): I need a network guy. need an antivirus person. I need an active directory and identity person. And we said, okay, now we need a bunch of specialists. Then the cloud came along and moved it out of our structure and put it on somebody else's infrastructure. went, now we need the DevOps, DevSecOps person who now we need somebody who has a broader understanding.

Aaron Crow (4:38.120): Mm-hmm.

KEN FOSTER (4:38.348): And it's kind of funny to see how the circle is coming back around to what we really want is somebody who's got a broad understanding of how everything works. And I'm not saying we don't need specialists. We need people who are a mile deep, engineering wise, understand the technology, can tear it apart, rebuild it, reverse engineer it, do all those things. But from a person figuring out strategy and a person trying to figure out how to integrate security into business.

KEN FOSTER (5:5.132): I think you need to have this broader understanding of how things work, right? And I think some of the best tapped resources, talent resource pools, that I don't think we're focusing on enough is pulling people from other areas of the business that are not necessarily a cyber person. I want infrastructure people. I want network people. I actually want business analysts. I want people who understand how the business is trying to make money and how they're trying to design applications for what the customer's asking.

Aaron Crow (5:26.622): Mm-hmm.

KEN FOSTER (5:33.250): I want to see them coming over and having an interest in that because this is a team sport. Everybody becomes part of the team if you can get them interested and curious enough about the want to apply knowledge, their knowledge to how we do with security to make it where we're putting less friction on all the other people that we're dealing with, right? Because we've got...

KEN FOSTER (5:57.666): That is by nature of what we do, it breaks things and causes friction. And if we don't have a great understanding of what the business is trying to accomplish and how we're enabling that, then we're kind of doing ourselves a disservice and we're becoming that group that nobody wants to talk to and we're becoming people that goes, what did security do to me today? Right? Because I think there's a great opportunity for senior security leaders that have that great understanding of how the business works and can talk.

Aaron Crow (6:13.949): Right.

KEN FOSTER (6:27.190): and can have the soft skills and the networking skills to be able to talk with those other peers. I think there's a great opportunity for you to move into that more senior IT leader, business leader role inside your company. Because let's be honest, you're not just a technology leader, you are a business leader and you need to be able to translate that into risk. You need to be able to talk to the business in a way that they understand what you're trying to do is actually an enabler for them and can make them actually move faster.

Aaron Crow (6:45.661): Mm-hmm.

KEN FOSTER (6:56.270): process and a set of guardrails that people can stay inside of and work actually speeds up the delivery of things that they're doing. And if you can help people understand how that translates into that speed, I think you have a great opportunity to grow within the company and become looked at more than just that pure technology leader, really being looked at as that business leader.

KEN FOSTER (7:21.218): Having that great depth of understanding and the ability to translate it from complex to not so complex is a key skill set that unfortunately there's a lot of really smart, talented people out there that that is a skill set that they lack because they see everything in an engineer and mindset and they see it in that these are the things you have to do and it has to be in this order and this is the standard or the framework that you're using says it has to be this way.

KEN FOSTER (7:49.952): and they need to be able to step outside of that and think about the problem in a way that says, okay, I need to be able to look at this in a different picture. And I think that's the great thing about the startup community today in the cybersecurity world. And you brought up a great point. 25 years ago, you're talking about access control, network access control, securing the network, securing the data, limiting people's access stuff. Well, Gardner was kind enough to put a marketing term around that for us called Zero Trust a few years ago.

KEN FOSTER (8:17.898): It's the same stuff we've been trying to accomplish for the last 25 years. We just don't do a great job at it because as you said, you start in a company that this problem didn't exist. This problem, we grew up with this problem and we grew up when trying to build a company and build revenue and produce a product or produce a service. And all of a sudden the rules have been changing on us. Well, the problem is going back and applying those rules after the fact.

KEN FOSTER (8:47.574): is cumbersome, at best it's cumbersome. A lot of times it's costly, it reduces the time you have to produce features or to release new things and understanding the full scope of how a new security product or a new security problem integrates into that overarching how do we refactor? And refactor is more than just recode, right? How do we redo processes? How do we rewrite our code? How do we redo access? How do I?

KEN FOSTER (9:17.314): How do I take unencrypted data, encrypt it and still keep business processes running that that is probably going to break? And it's having that great understanding of the overarching scope of how this has changed over time and how am I going to go back and get time and effort and resources? And the real trick to that is, is what is the actual business value and risk that we're trying to accomplish? Do we actually need to do all this or can we do other things that mitigate this risk?

KEN FOSTER (9:44.800): in a way that allow us to keep operating and keep going. And when we're talking about, you know, the OT world, we were having a great conversation about OT when we were out at the, with the group at the gun range, right? Because there was a bunch of us in that. A lot of times that's old technology. You just can't do anything with it. So the best thing you can do is put up some mitigations or fences or walls, whatever you want to call it.

KEN FOSTER (10:7.214): You want to isolate it, you want to document it, you want to understand it's there, you want to limit access control to it, put as many protections around, but you need that system to stay running in the state that it is, you need it to be resilient, and you need it to keep producing product. So you have to think about it in that mindset and go, if I can explain to whoever is asking me questions about why I did something, if I can put that story together around this was the risk, this is what we did to mitigate this risk,

KEN FOSTER (10:33.294): These are how we're monitoring and watching it. And this is what we're doing to keep our business running. If you can explain all that and document it and have that clearly articulated, then a regulator, an auditor, a business person is going to be able to have that conversation with you. And you're going to be able to keep the business doing what it's doing. And now you're a business enabler and a partner. You're not somebody who's coming in and going, you can't do that because the book says you can't. Right. And that's, think we got to get away from that. We got to get better at that part of it.

Aaron Crow (11:3.324): Yeah, absolutely. It's such a, you hit on so many things there, right? And we see this, know, look at medicine today. You have specialists everywhere, but who is looking at the whole body, right? And really tying those things together, your heart and your weight and the food that you're eating and your exercise and your blood pressure and like, you've got all these specialists, but they're looking in their domain, but you need that person that can tie and see all of those.

Aaron Crow (11:29.530): you know, house MD, the old show that was on TV, like he could really pull all those things together and pull data from all these specialists and say, yeah, but you don't need a heart transplant. You need, you know, take some salt or whatever the thing is. Right. But, but it's, it's really being able to tie those things together. And you also hit something else there that I really want to kind of focus on is it was really easy. In a lot of my career, I was the tech technical guy. Right. I was, I was the smartest at this and I was the best.

KEN FOSTER (11:32.704): Right,

Aaron Crow (11:58.184): firewall guy or the best network guy or the best whatever, right? And along in my career, I was introduced and started doing these softer skills, the communication, the presentation, the leadership stuff, right? I was always, I feel like a natural leader in what I did, but being able to translate that, like to be able to have a communication or a conversation and be able to get my point across to sell to the business.

Aaron Crow (12:26.814): to the leadership, that was a skill I didn't have. Like I could sell it and I would just beat you over the head and try to show you I was smarter than you, but that didn't win friends or influence people, right? But when I started understanding those softer skills of, wait, I'm a salesman. Like I'm an engineer, but I'm really a salesman because it doesn't matter how smart I am. If I can't convince you that this is a valuable thing and why it's important, then it doesn't matter because my smart idea is gonna sit in the corner and it's never gonna get done.

KEN FOSTER (12:56.663): Yeah, you're 100 % correct, right? And I tell people that all the time. said, ultimately, we're salespeople. I said, there's so much in what we're doing now. We're not necessarily selling a product. We're in our strategy. We're selling why we're doing what we're doing. But it's still a sales type of job, right? And I think one thing I like to talk to people about too is that soft skill development. Same thing, Early on in my career,

KEN FOSTER (13:25.142): I wanted to be the smartest guy in the room. Now I want to hire the smartest guys in the room and I want to step back and ask them the right questions, right? And help guide them along in their career and help mentor them along. Because I realized a long time ago, no matter what I do, I can't keep up with everything that's coming out, right? And, you know, no matter what you do, you can't read minds as long as much as I've tried, I've still have failed at becoming a mind reader.

KEN FOSTER (13:51.906): But now it's about asking the right question and asking people, did they think about this and did they think about this? And it's more giving guidance to those super smart people on your team or people you're bringing in from outside and going, here's overarching what we're trying to accomplish. Here's what we have. Here's what we think we're missing. Help us understand and guide us through. let's pick this apart because getting two things to work together, not

KEN FOSTER (14:20.770): the most complicated thing, right? But now I've got five other things that are also got to work with all of those things and making sure I don't break any one of those in the path because they're all critically important and understanding that. again, it's about that resilient design. It's security-based design, it's resiliency by design, and it's a data problem. Truthfully, it's an analytic problem. Now, the latest newest...

Aaron Crow (14:42.610): Mm-hmm.

KEN FOSTER (14:44.470): You know, we can't do anything anymore, anything without talking about AI. But I do think that that is one of the benefits that we're going to have when we're not. And I'm not talking about public AI models. I'm talking about building you a model that uses your data. And it goes back to what I've always said about threat intelligence, right? Threat intelligence is data with analytics and context. Without that, it's noise. And you're going to make a bad decision off of not having all those pieces. So.

Aaron Crow (14:58.408): Mm-hmm.

Aaron Crow (15:9.501): Mm-hmm.

KEN FOSTER (15:14.314): AI, you take a public model, it's probably going to make some bad decisions, right? It's going to have hallucinations. It's going to have some false data in it. But if you're building specialized models, smaller models internally, have your data set, you understand the bias in your data, you understand the risks that are in that data already, and can put that context around what we know about our environment, it's going to be able to help you make decisions faster. And then you want your super smart people

KEN FOSTER (15:43.864): to be the experts in their domain to look at the data and validate that it is correct. And then it hasn't hallucinated and it hasn't given you a false positive. And where you can trust that model and that help you're getting from it to be more efficient. The biggest, one of the, you know, it's funny, I've been reading a lot on it too. And I know OWASP has produced a recent top 10 on AI too. One of the things in there is over-reliance on AI.

Aaron Crow (16:8.755): Mm-hmm.

KEN FOSTER (16:13.666): So, and I think that ultimately is the thing at the beginning that people get to relying on it, it's going to answer all these questions for so they're not spending enough time validating the data. So they're automatically over relying on it, which now means they're going to miss some of the other risks that come along with it. And I think we do the same thing with a lot of things, we get over relying on a tool set. mean, think about the CrowdStrike problem that happened a little while ago. CrowdStrike is a great tool, don't get me wrong.

Aaron Crow (16:36.254): Mm-hmm. Yep.

KEN FOSTER (16:38.624): It's a phenomenal endpoint, ADR, XDR, whatever the hell you want to call it, ThreadIntel. It's got a lot of things with it. It's a great tool. But you just showed that if you were completely relying on a single tool, that it can become, not maliciously, but it can become the thing that it produces risk in your environment. And that wasn't necessarily security risk, it was operational risk, right? It took companies down. We lost production time because of it.

KEN FOSTER (17:7.021): A lot of companies lost production time because of it. And now you've got to think about how do I have, you know, that's made a lot of companies who didn't necessarily have an out of band way of communicating with people and out of band way of getting people on site in the remote areas. And it's like, crap, we didn't think through this. And let's think about what just happened with Hurricane Helene in North Carolina, right?

KEN FOSTER (17:28.526): A lot of great people up there doing a lot of incredible work and a lot of people, you know, I'm pretty close to that area. I'm only like 60 miles out of Asheville is where I live. And we're, sending people up constantly. And, but you look at, there's a local, grocery store chain, regional grocery store chain that's headquartered in Asheville. They couldn't take credit cards and debit cards for almost two weeks. I lean because they didn't have a backup system.

KEN FOSTER (17:57.496): for their credit debit card processing because they never thought about a natural disaster of a flood or a hurricane in the mountains of North Carolina. And their entire data center and warehouse was under like eight feet, six, eight feet of water. So it took them two weeks to get a partnership worked up with somebody else to start processing credit cards on. Now, is that a once in a hopefully 500 year incident? Yeah, but it's still something you have to be thinking about.

Aaron Crow (18:7.123): All right.

Aaron Crow (18:13.374): Mm-hmm.

KEN FOSTER (18:26.648): They don't necessarily have to have a hot, site, but they need to have resiliency built in that goes, if we lost this, how would we go about getting a business partnership with somebody else to continue us to do business? And I think that's where companies get into this analysis paralysis when they start talking about resiliency and business continuity. DR is a of that, right? So some people confuse DR with that, but overarching

KEN FOSTER (18:51.990): I want my business to be resilient. BCP and DR are part of that resiliency program. And I need to think through, okay, I don't necessarily need to spend a lot of money to have a hot hot, but I do need to have a plan for who I'm going to call and a partnership, maybe a prearranged negotiation. We all do it with people like Mandian and some of these other providers out here to have an incident response plan or retainer out there. you you got to think through those problems like that and go, what if this happened? How we continue to operate.

Aaron Crow (19:9.341): Mm-hmm.

KEN FOSTER (19:20.654): And you got to do the same thing in your business is like, what if this happened? you don't have to plan on the moon hitting the earth, but you do need to think about the things that are going to be kind of common to you,

Aaron Crow (19:34.090): That's a great point. And you've got to have these conversations. And it's not always a technical solution. Sometimes it's, hey, we're going to roll back and we're going to manually do pen and paper. And a lot of times that is the answer. It doesn't have to be, I need to have a hot hot and you'd have a third data center. I came from OT and a lot of my career has been spent in critical infrastructure. So supporting nuclear power plants.

Aaron Crow (19:59.166): They have tertiary of everything. Like they've got analog and then they've got, you know, triple redundant everything, but that's for obvious reasons. But then you look at like Fukushima, right? And they had everything and it was a great design and they, the 500 year thing happened and their backups of their backups of their backups because of the water got the generators, the generators stopped pumping. Now they were able to control the thing, which is the most critical part, but they still found a whole bunch of things.

Aaron Crow (20:28.508): The great thing about the nuclear and the critical infrastructure environment is every people are scared of nuclear because of, you know, Chernobyl and Three Mile Island and all these things, right? But every time there's been a major incident, wherever it is in the world, the whole industry learns from it and they do an after action and then they implement changes across the board. Everybody does it.

KEN FOSTER (20:54.498): And you're bringing up a great thing, right? And that is a problem in our industry. Look, I lived on top of or beside and slept beside two nuclear reactors for six and a half years of my life on board a ship, right? So yeah, and I was elaborating, right? But yeah, mean, you see the safety mechanisms in it and you see the control and the process that they have around it.

Aaron Crow (21:7.132): Right. When you're a librarian, right?

KEN FOSTER (21:21.708): biggest thing you just brought up was information sharing within the community. The energy sector talks to each other. Now there are the ISACs for the financial sector for critical infrastructure. I've been part of those. They're still not great at sharing information because there's this distrust for the government involvement in that and people are afraid that if they share too much information they're going to get in trouble. So they hold back on that.

KEN FOSTER (21:50.860): The best sharing I ever have is with the other people I know, CISOs and CIOs and other security leaders I know, that we all have each other's cell phones or a Slack group or a private LinkedIn channel where we all share information there. That's probably the best sharing information sharing or the networking dinners and things like that where we get together. Nobody's recording. It's a great conversation. Everybody can be free to have that conversation. And I think

KEN FOSTER (22:20.034): That is the thing I tell everybody is as there's nothing for the most part that any of us are doing that's super secret squirrel stuff. We're all finding the same problems. We're all built different magnitudes, different scales. We may not all be dealing with the exact same problem set, but we've probably dealt with it over our careers in some shape or fashion, or we figured out how to not have to deal with that ever again. And we should be talking through people, helping our peers out going, hey,

KEN FOSTER (22:49.686): If you're having this problem, think about it in this way. That mentorship and that coaching that is being provided by these networks of people that you build, that you build these relationships, is probably the most important thing you can do in this industry. it helps you figure out a problem. It helps you when you're thinking about a product or you're thinking about a new process, you can reach out to these people and go, I'm looking at X.

KEN FOSTER (23:19.534): Has anybody dealt with this? And they're going to come back to you and go, yeah, avoid this, avoid this, or this is a problem we ran into, this is how we got over it. Make sure you think about this as you're thinking out a problem. Like, you know, I, I like to tell everybody about rolling out cell point because I've done it multiple times over my career. And it's like, if you don't understand how identity is being used in your environment and all the use cases that are out there,

KEN FOSTER (23:47.168): If you automate a process and there's a bad HR process because you didn't have a conversation with HR, next thing you know, you're spending a holiday weekend trying to get everything back up because HR was doing something that they do on a regular basis. They kicked off an automated termination for 200 employees. shit. And it's also the administrator for cell point that they just kicked half the administrative team for cell point just got terminated in the...

Aaron Crow (24:0.541): All

KEN FOSTER (24:13.166): Now we got to go back and do all this work, right? So it's thinking through those types of problems and making sure you've got every stakeholder involved and have a scope discussion to keep from biting yourself. you got to quit. The best way to say is you got to quit kicking your own ass sometimes, right? You got to, you got to have the convert, be willing to have that conversation. Let people ask you questions that, and make sure that your smart people who are sitting in a room don't ever tell people that they think that's a dumb thing because they understand the product.

KEN FOSTER (24:43.158): Stakeholders that you're bringing in don't understand. It goes back to what we're talking about, soft skills. I need people, but I also need them to understand their audience and understand you can't tell everybody they're stupid for not knowing this because that's not their job to know this. It's their job to know their piece of the process. Now what I need you to do, because you're super smart, is understand how their piece of the process ties into your piece of the process and where the problem is. Where's it going to bite me down the road? So if you can do that,

KEN FOSTER (25:10.262): then you're going to build the relationships and the partnerships with Inside the Business that you really need and are going to be incredibly important.

Aaron Crow (25:17.468): Yeah, you know, you're hitting on the culture side, both from an information sharing between within your industry and outside of it, the networking side of CISOs and how important those networking events are, but even internal to your company. And that was where I've been really successful in my career has been pulling all of those people together. Again, working in OT, working in the business, you know, I used to tell my team, I'm going to get us a shirt that says I'm from IT or I'm from corporate. I'm here to help. Right.

Aaron Crow (25:46.546): and they'll never let you in the power plant, right? They'll just kick you out and you can stay right out there with, we'll let the UPS guy in, but you're not coming in, right? But when you build those relationships and the business understands that you're there and you're there to listen and you will hear their concerns and you're not just going to say, I'm smarter than you, you're gonna do it because I said so, like my father used to tell me, like, well, dad, why do I have to do this? Because I said so. Well, okay, that's cool, but why?

Aaron Crow (26:12.126): Like just explain, I'm not an idiot. Explain it to me. help me understand why all this stuff that I don't understand is a requirement for me to put in my process. It's going to cost me money. I'm going to have to hire people. I'm going to have to have people process and technology that I didn't need last year or for the past 40 years of my career. And now you're telling me I'm stupid because I don't have it. Like that's not the answer. It's not the way to win friends and influence people. Bringing everybody to the table and making this an environment, a culture.

Aaron Crow (26:42.034): that you encourage people to raise their hand and say, I don't get it. Or I disagree, right? And that's okay. And you don't want somebody to ram it down the throat because they're smarter than them. Again, I used to be that guy and it didn't get like, I was good at cramming a process in or a project in, but I didn't, when I need to come back in six months to do something else, like it was amazing how I didn't have a warm welcome. Like, I wonder why.

KEN FOSTER (27:5.506): Yeah. Well, it's kind of funny, right? There's a big difference between being a very smart type A personality and being a leader, right? And I think the leader thing is, is yeah, you probably are a type A personality more than likely in that leader role, but you've also learned how to address your audience. And this is one thing I think, talking about the CISO networking events and the security networking events, now granted,

KEN FOSTER (27:33.966): being on where you are in the country and we're both in places where we have pretty good access to them, right? But what you wind up with is I think there's plenty of senior guys who go out to these things and we all talk to each other and we all for the most part agree on the problem and how that we got to address these problems. We may disagree slightly on how to approach them, but that's a great part of the conversation. What we're missing from this is that next down.

KEN FOSTER (28:3.512): two down level people come into these things, asking, feeling comfortable enough to ask these questions and get up and have a conversation with the groups of people who've seen these problems over time and have seen a broad swath of problems. It's kind of like the State Farm commercial, right? I know a few things because I've seen a few things, I've seen a lot of things, right?

Aaron Crow (28:27.078): Right.

KEN FOSTER (28:28.364): And that's the thing, right? I've worked in multiple industries, I've worked across multiple verticals, and you start seeing, you see recurring themes, but you also see some unique stuff in there, but then you, like I said, then again, you just scale. So one of my things is, and this is also a great retention tool for your team, I think it's a talent development tool.

KEN FOSTER (28:49.898): It also helps people with their career. Look, I may not be able to advance them where I want them to, but if I advance them to the point where they get a better job at another company, I'm happy for them. But I don't want to be the person doing all the presentations inside the company. I may be doing the board presentation because you have to, but if it's external team presentation, if it's a project presentation, if it is presenting an idea to the internal group, I want...

KEN FOSTER (29:19.618): I designate my team to be the ones who put those together and do that presentation. Because it gives them an opportunity to get in front of groups of people that they're somewhat familiar and comfortable with and starts getting them used to putting together a presentation, putting together a talking point, getting in front of a group. Then you get them, then I want them going. Any of these free conferences that I can get them to, I want them to take a half a day when a conference is in town.

KEN FOSTER (29:47.138): to go out and see these and get the opportunity because once they start getting their name out there too and people start realizing that they get on panels. Do a panel first. Volunteer to be a speaker on a panel. Volunteer to put together a small presentation. If you're a really smart technical person and you want to go do a B-sides, B-sides are that more technical. Go do an IANS and ISACA. Go put together a technical presentation if that's what you want to do.

Aaron Crow (30:7.646): Mm-hmm.

KEN FOSTER (30:14.786): You know, go to some of these larger groups if you want to do more of a strategic or some other presentation. Like we talk about talent retention all the time and the job market all the time because it's a hot topic right now because we still have the problem of most of us can't keep our people because we can't get our HR teams lined up enough to not let them escape to other companies or we just don't have the right opportunities for them. Or we're doing a poor job of showing them how they can move within the company and grow, right?

Aaron Crow (30:26.728): Mm-hmm.

KEN FOSTER (30:44.808): I think that's the important thing is you've got to mentor and coach your people on the skills. You can't be mean about it, but you've got to be transparent and you've got to be truthful. You've got to tell people where they're good and you've got to tell people where they need to work. But you can't just tell them, suck at this, go fix it. You've got to give them point. You've got to tell them, look, you...

KEN FOSTER (31:11.160): presented this in a way that made it confusing for people. saw, you could see the reaction in the room. You saw people's faces, you lost them. You need to think about how to think through this problem. You need to dumb it down or talk it down to a point that makes sense to other groups that haven't worked with one of these products all the time. You need to make sure that you're putting out enough information that they ask you the right questions of if it's a IT team or an HR team or legal team or privacy team.

KEN FOSTER (31:38.786): they need to understand what questions they should be asking you because you need to be explaining it well enough that they understand how it's going to interact with the thing they care about. So, and I love to use that as a coaching method and a mentoring method for my teams because I think if you show people that you've invested in them getting better at their jobs and giving them the opportunity to grow, they're going to stay with you longer.

KEN FOSTER (32:3.542): Now, you're going to lose some of them to those places that offer from 50 % pay raises. There's nothing you can do about that, right? Without having a great relationship with HR. And that takes a long time to get it, to understand the cost of not doing that. But you're building the next set of leaders who are thinking about these problems in a way that allow them to ask those critical questions and teach them to think about this problem, not just from a technical standpoint, but are overarching.

KEN FOSTER (32:31.586): business interaction, business risk. like I said, I use the term resiliency a lot because everything we're doing should be building resiliency and enablement for the business to keep doing what the business is doing. So.

Aaron Crow (32:46.238): You know, as you were saying that, I think back in my career and I was very fortunate and I worked in an asset owner, a power utility here in Texas. And again, they brought in an outside consultant and they built this program. called it this outside consultant called it Leadership Circle. And they brought like a hundred people in and they said, hey, all of these people are really good in their technical field. And that was everything from

Aaron Crow (33:11.998): know, electrical engineers, mechanical engineers, chemical engineers, know, technical IT type people, networking people, whatever. And they brought them in and they put us through this thing. And it was a six month program, I think the first one. And we did book reports and public speaking and all that kind of stuff. And then they kind of took the cream of the crop and they moved us into the level two of that, which I made the level two and I made the level three. I did this like three years in a row. In the beginning, it's funny because I remember as an engineer, I'm like, I don't have time for this.

Aaron Crow (33:41.118): How's this going to help me? I want to go get a certification in XYZ technology because that has been the way, know, what got me here won't get me there. The thing that it had pursued or grown my career over the years is learning a new technical skill. And that had always got me the next job and it got me the next promotion because again, I was focused on being the smartest guy in the room. What I didn't realize is I was limited in that career track.

Aaron Crow (34:8.530): because I was only focusing on the technology and there's a ceiling in how smart and how much you can grow on that technical track. It just is. And so I was very fortunate because the company that I worked for, paid, I'm sure not a cheap price, not to mention that they took me out of work and we were there, paid for food and all the things and the consultant have very much that cost. And I did this for three years, but it-

Aaron Crow (34:37.406): catapulted my career. Like I became a CTO and all of these things, consultant for EY and all these things that I've done, I never would have been able to do those because on the technical track I was going for, I never would have acquired or maybe if I did, it would have been another 10 years in my career. But so few companies are offering that as a guidance and a training track for their staff.

Aaron Crow (35:4.892): Yeah, they can go to a conference. Yeah, they can go maybe do a certification, but I rarely see anybody that offers that to their customers, their employees. And it's a great thing for retention, but it's also a great thing to build leaders from within instead of trying to recruit from outside.

KEN FOSTER (35:21.686): Yeah. And I, you bring up a great point, right? Like, so, I got lucky too. mean, yes, I got put through the same, you know, a leadership school while I was in the, in the Navy. So, you know, the military, right. So I went to a leadership school, which kind of funny, it's kind of same thing, right? They put you in, they give you scenarios. They make you get up and speak in front of the public and do all these reports and all this. It was great training, right? Luckily, I was, God, I guess I was 10.

KEN FOSTER (35:51.918): 12 years into my career outside of the military. I'd always been in somewhat of a senior role, right? And it's kind of funny. I got out of the military and kind of almost automatically was right into kind of that more senior role. you know, I always had people working for me. But I will admit, early on in my career, I was a shitty leader because I was that smart ass, smarter than you.

KEN FOSTER (36:17.782): I'm just going to hammer it into your head and we're going to move forward. I'm going to get this, this is going to be successful by my sheer will and stubborn headiness. And, know, it worked to a point. And then I got lucky and it was my first CISO job, a company I worked for. They hired a consultant, leadership consultant, coach and consultant and offered it to the entire executive team.

KEN FOSTER (36:47.598): And they got us, and people probably heard of this, but it's a 360 degree review, right? So they go out and review not only your direct reports, but to people you work with, outside people. They put together this big report and you get to find out how much of an asshole you are when they do that, if they've got honest people doing this stuff. So it was kind of interesting, right? And it's not always easy to hear.

KEN FOSTER (37:16.280): But if you can get your ego out of the way and take to heart the things you're hearing and go, you know what, they're 100 % correct. If you can ever get your mind shift to go, they're right. That is me to a T. And how do I deal with that? And that's where you have the great conversation with that coach and going, how do I fix this? How do I think through this problem? What do I need to change in me to do this? And that's where.

Aaron Crow (37:16.510): Mm-hmm.

KEN FOSTER (37:44.846): a coach or a mentor is so important. Somebody who's lived through this stuff and somebody you trust, somebody you'll listen to when they tell you, you've got to stop doing this because it's detrimental to you. And if you can find somebody in your career path to help you do that, it's going to be, it's going to change the way you think and the way you work and the way that you approach life in general. you know,

Aaron Crow (37:57.267): Yep.

KEN FOSTER (38:14.222): Like I said, we've both been lucky to have some of those opportunities put in front of us I agree with you companies because we've all heard of this over our careers as somebody's been over promoted You know or the Peter principle I guess is the other way people talk about it right is some and the truth is is you're gonna have those individual contributors those technical folks Who may never want to lead people and you shouldn't put them the people leadership position if they don't want to lead people

Aaron Crow (38:28.254): Mm-hmm.

KEN FOSTER (38:43.394): They may be perfectly happy and they're going to be phenomenal for your team because they've got that historical knowledge, they're technically experts. You may want them, but you know the only way you're going to figure that out is to have one-on-ones that are meaningful. One-on-one with your employees should never be a status update. Don't come in an email weekly with bullet points to say, here's the things you need to be worried about. And that should be daily conversations. What you should be doing in one-on-ones is talking about career.

Aaron Crow (39:3.326): Correct.

KEN FOSTER (39:13.006): Career development, career growth. Talk about the good things, talk about the bad things, because you should be talking about bad things in private, right? You should be having that clear conversation and go, you're good at this, you're not good at this, these are things that we can do. Let's get you here, let's have you go take this class, let's get something for you if you can pull the budget forward. Or even suggest, look, I can't afford it, but you know what, look into this kind of training or this kind of education or this thing that will help you. And those are the most important

Aaron Crow (39:37.096): Mm-hmm.

KEN FOSTER (39:42.254): important people conversations you can have in a leadership is just being transparent. Not being a bully, not being mean, being transparent and honest with them and go, but you should also be asking for the same thing about you. What can I do to help you? How am I not doing what I should be doing from my leadership seat? What are things that you think that I should change? You should be managing up to, and we don't train people enough on that manage up piece of it. And I think that's...

KEN FOSTER (40:10.222): one of the great things that, and I do tend to lean towards hiring the veteran community because a lot of us have been through that and we've had some training on that and we've been taught how to manage up and because we've been put, we get thrust into high stress leadership positions a lot of times when we're very young. And, you know, it gives us an opportunity to grow a little faster, I think, than it does if you're just purely getting it out of a higher education setting. But,

KEN FOSTER (40:37.838): And then that's the other thing I want to tell everybody. When you're looking at, you don't need to just be focused on higher education. You need to be focused on people. There's a great program that's rolling out country-wide, nationwide actually, but they're getting it set up in different places. And I can't remember the name of it off the top of my head, but I'll find the information for it. Community colleges. Look at community colleges, because think about the typical student at a community college. Yes, you've got the first out of high school and that's what

KEN FOSTER (41:7.042): they can afford and that's where they're going. But you got a lot of mid and late career who are dedicated to re-educating themselves. So not only are they working their ass off to get a college degree, they're also working a full-time job.

Aaron Crow (41:11.666): Hmm?

Aaron Crow (41:19.966): And they probably have family and kids and...

KEN FOSTER (41:21.784): They got family, kids, they got commitments. They are committed to being better. They are committed to learning. Those people will work harder than anybody you've ever seen. And you've got, that's an overlooked community. doesn't matter where their degrees from. It doesn't matter if they got a degree. mean, I'm, I'm that guy who's been a CISO twice, been a senior leader a bunch of times. I never finished college. I may eventually go back and finish it, but I've never gotten around to finish it because the job always get in my way. And,

Aaron Crow (41:51.528): Same here.

KEN FOSTER (41:52.110): But I think we have to work on talent. And as a guy right now who's on the market looking for a new job, the networking part of this is important because you're going to, especially as senior role, and especially as weird as the job market is right now, you are not going to find, rarely, I'm not going to say you're not, but rarely are you going to randomly apply for a job on LinkedIn or any job board and get that job.

KEN FOSTER (42:20.352): It's going to be through the relationships you have developed. It's going to be getting out talking to people. It's going to be making sure you're being heard. It's making sure people understand where you're coming from because I know one, I don't like bragging about myself in a resume. put basically what I've done, but I feel if you get me to where I can talk to you and we can talk about a problem, I'm so much better at the talking part of it than I am.

KEN FOSTER (42:50.258): writing a dissertation about myself. But that's the, and I think a lot of people are that way. We struggle with getting that, hey, this is me on paper. And, if you get people out and you talk to them and you ask them questions and you have the conversation, I think it's super important. And I think the networking events, the getting out to go into these conferences and stuff and just talking to people and don't be afraid to put yourself out there. Get out there to people, this kind of stuff.

KEN FOSTER (43:19.266): Getting on a podcast, getting it out there, getting the viewership that comes in from these things, it's all helpful. Don't be shy because you never know when that right opportunity, that right person is going to come up. mean, I've learned over the last, COVID, being locked down for couple of years, not a lot of travel and everything going on. I spend a lot more time sitting in front of my computer, sitting in front of my desk. I spend a lot more time on LinkedIn.

KEN FOSTER (43:45.902): Next thing I know, because of stuff I'm producing, stuff I'm talking about, all of a sudden I've got CEOs and founders of companies reaching out to me. And the next thing I know, I'm now on a bunch of advisory boards because I was willing to, because I had some time on my hands, but I was willing to have the conversation. I was willing to give transparent feedback. I was willing to tell them, go, why the hell did you start a company in this vertical when there's 500 other people doing the same thing? What are you doing differently?

KEN FOSTER (44:14.944): And it's just being able to ask those, being not afraid to ask those questions and give real feedback, right? Don't, and I'm, this is probably one of the last things I like to say about our side of the house, the community, the CISO community. Look, you ask everybody you do business with to be transparent, truthful, and honest with you. Do the same for them. Pay them the same courtesy.

KEN FOSTER (44:37.110): You know, you don't drag them on for months on end about something you're never going to buy because you're afraid you won't get invited out to another state dinner or get another Yeti cup because none of you need it. Just like I don't need another one. You know, it's it's give give what value you bring. It's your experience. It's your ability to ask the right question. It's ability to guide them, whether it's a company you're doing business with, whether it's a

KEN FOSTER (45:5.806): junior person coming out of college or somebody coming out of the military who reaches out to you on LinkedIn and says, I'm looking for a job. Can you give me some advice? I'm not telling you to make a full-time job out of it, but you should at least be taking a little bit of time to do some of that mentorship and coaching when those people reach out to you. And if I tell anybody anything, I have gotten more value out of doing that in my career and this past 15 years of my career.

KEN FOSTER (45:32.066): than of just about anything else. And I take so much pride in the ability and just having those conversations. It fills me with happiness when I see these people being successful on landing jobs.

Aaron Crow (45:45.692): Yeah, well, you know what one of my mentors a long time ago told me and it's really stuck. It's all businesses that people business, right? So it doesn't matter if you're the gender or the CEO and it really goes in a lot of different ways, right? We talked about it from a from a hey, you got a technical is great, but you still have to sell your technical idea to somebody. You have to explain it and that is selling. But the same thing on this side, right? Giving back and helping others that stuff. It all comes around like we have a reputation.

Aaron Crow (46:14.610): Right? You know, you, you are your name and people know Ken and they know Aaron, right? And, and what they say to your face and what, what is said behind your back or can be two different things. The thing with me is you may not like me, but I'm the same on camera as I am off camera. I'm the same person. Anytime you see me, if you meet me on the street or you meet me in a, professional setting, in the boardroom or at, you know, drinking a beer, I'm, I'm the same guy, right? I'm an asshole all the time.

Aaron Crow (46:43.474): but I'm consistent with it, right? But my point is, that when you get, that stuff comes around, this is a small network, right? know, everything, your reputation precedes you. It gets out there. Even if somebody hasn't known you, you mentioned that, right? When I'm a vendor and I call you up and say, hey, I've got this new cool thing, you're gonna be like, all right, I'll set up a meeting. And then you're gonna hang up with me and you're gonna call your CISO buddies and say, hey, Aaron just called me. Have you talked?

Aaron Crow (47:9.534): this guy and what is he selling and have you had any experiences with him? And every one of those CISO people or all of your network is going to be like, yeah, he's an asshole, but you know what? He was honest or, or no, don't work with him because he lied to my face and you know, whatever. Right. And, and from my experience, being both a vendor, being a consultant, being an asset owner, you know, beating a C-suite executive, a salesperson or a company values clarity and, and, and, and, and honesty.

Aaron Crow (47:38.618): I had rather you tell me I'm not interested. I'm still gonna send you the Yeti or take you to a steak dinner. Cause to me, I'm not wasting my time on you. I'm just gonna build my network with you because then you're gonna tell somebody else, Aaron didn't continue to hound me when I told him that we weren't interested. That's valuable to me. Again, my reputation is more important than me selling one widget or trying to push you on something that you're not interested in. Yeah.

KEN FOSTER (48:0.119): Yep, 100%. And I mean, that is, it is about relationships. you hear that preached in the sales side of the house all the time, it's a relationship game. Well, what we do is a relationship game too. And it's not only the sales side of the house, but it's also that internal partnership because rarely you as a CISO or senior security leader can do your job on your own. You're providing guidance, you're providing strategy, you're providing process.

Aaron Crow (48:12.606): 100%.

KEN FOSTER (48:29.579): you're providing a tool set. Very rarely are you actually the person that's rolling that tool set out. You need an

Aaron Crow (48:35.782): If I'm configuring your firewall, it's a bad day.

KEN FOSTER (48:38.626): Yeah, but what I'm saying is it's even you may have your team configuring the firewalls and setting that up, but you need the network team involved to get it connected into the network. And or if I'm rolling out a new agent that goes on a server, I need the server admins to do it. If I'm rolling out something that's interacting with a new application, I need the app team and the development team working on that. So rarely are you alone in a vacuum doing something.

KEN FOSTER (49:3.778): security and you need these partnerships, these stakeholders, and they need to trust that you're not just throwing work because you found a new shiny toy that you wanted to go buy and throw out on the network. It's actually, yeah, never happens, but it's actually bringing value and reducing risk and increasing the resiliency of the company. And as long as you're presenting and having those conversations and again, it's that total cost ownership, that total ROI, because that's not just money, that is how

Aaron Crow (49:16.018): That never happens.

KEN FOSTER (49:33.706): effort am I putting on somebody else? What is the workload that I'm going to ask these other teams to do? What is the downtime that's going to be taken? How long is it going to actually take to roll this out? Right? Who's going to support it after the fact? Where's the handover? Does it stay with the security team completely or is this or is this thing going to be collecting data that now increases the workload on the app dev?

Aaron Crow (49:44.060): and then who's going to support it after the fact.

KEN FOSTER (49:56.878): teams or the infrastructure teams because now they got to do a bunch more patching on a much more regular basis because we have better visibility into it or do you cloud thing. It's so entwined and I feel like a lot of times the security teams act like it's we're against the world and we're trying to protect the world and granted I know the mentality it's the protect everything make everything better but you can't do this alone and pretty soon if you're it if you're

KEN FOSTER (50:25.472): If you're doing it alone and being that big of asshole, you are doing it alone and nothing you're ever going to be. I, you know, I saw Jamil from Equifax who's for, you know, I know pretty well, he posted something on LinkedIn the other day that was phenomenal. It was talking about all the CISOs out there selling themselves, right? Ultimately, if you can't deliver, if you can't actually execute and deliver on any of the strategy and stuff you put up, what's the point?

KEN FOSTER (50:55.576): Cause you very quickly that'll also get out in the community is that yeah, they talk a lot. They never actually able to deliver anything because you're biting off too much of the world and selling a bill of goods that you're never going to be able to implement on your own anyway. And if you haven't built those partnerships and come up with that and have a strong execution plan, all you're doing is telling people that I can talk a lot, but I can't execute. And sometimes execution is

Aaron Crow (50:59.358): Mm-hmm.

KEN FOSTER (51:25.090): Just getting a small thing, low hanging fruit, rolling it out over time, making sure you understand, like I said, partnerships, scope, understand the actual effort that goes into it. And if you'll spend the time doing that, you're gonna be much more successful.

Aaron Crow (51:38.386): Yep. Yeah, I mean, you one of the very first projects I got when I was hired on at the power company, it was right after a winter storm and we had like three months to implement these things that our CEO had told the Texas legislation because we'd had some outages and we had three months and I had to basically deploy SCURB satellite communications and weather stations at all 50 of our locations, power plants and all this stuff. And we had three months to do it. And basically my manager said,

Aaron Crow (52:7.772): whatever you have to do, we have to get this done. No exceptions, no whatever. So I, my, you explained it earlier, my type A personality, I just killed everybody in front of me and just blazed a path and I got it done. But afterwards, you know, when I got my review, I'm thinking, Hey, I'm going to get this client review. Cause I did this almost impossible thing. And my, my boss said, yeah, you did a great job, but you left a body, just a wake of bodies behind you that, that I had to help clean up. I'm like,

Aaron Crow (52:35.934): but you told me to do that. Like you gave me the instruction, don't fail at anything. Everybody that got in my way, I just moved them or went around them or whatever and I got it done. So it was good and it was bad at the same time. And you talked about it before with the 360 review is I had to look in the mirror and say, that was true, right? Nothing he said was wrong. Could I have gotten it done politically? Probably not. It was probably the only way I could have gotten it done.

Aaron Crow (53:4.926): But there was an impact and there was a consequence to the way that I implemented and the way that it had to be done. Not all of that was my fault in that, you we only had three months and all the things I waited to the last minute, blah, blah, blah, blah. But still I was the person, my face was the one that pushed that through. And I had a lot of repair of relationships I had to do over the next 15 years at that company or 10 years at that company to repair because I'd broken that trust and I have this reputation in some of those people that I chopped off at the knees.

KEN FOSTER (53:34.680): Yeah, and I mean, I've had that conversation before because it happened to me in my career when sometimes, yes, you are the agent of change and that's what you're there to do, right, is to get something done. unfortunately, sometimes there is going to no matter what you do, there's going be contention, you're going to upset people's feelings, you're going to step on toes because you have to to get the job done. That typically means you're probably short tenure.

KEN FOSTER (54:2.518): If you can't repair that, that you're probably going to be a short tenured person. And sometimes that's what you're hired for. are occasional roles that you were hired to do that. I've been in a couple of those roles and you know they're short term. You know they're going to be short term because you were brought in to step on toes, break some eggs, get people. Now, luckily in every situation I've been in that I've been told, yeah.

KEN FOSTER (54:31.830): you're leaving this place in a better shape and better condition than it was when we got here. But now we're going to make a change because now they need somebody who doesn't have the animosity with the old teams and then that happens. I mean, if you've been brought, as long as you understand that your role going into it, then be prepared for it and understand the detriment that it's going to cause in that company, right? What you want to be able to do is have a conversation and make sure that that is not perceived as your personality.

KEN FOSTER (55:1.062): holistically in the community, but this is what you were brought in to do. you're brought in as an assassin and that happens. mean, you know, most nowadays it's McKinsey that they bring in to that to most people. You know, it's the Bobs, the Bobs show up and you know, and that's, that's happening a lot right now in the industry. There's a lot of that going on because people are having to reevaluate with the way that the economy and the environment

Aaron Crow (55:5.500): You were brought in as an assassin and you. Yep. Yep.

Aaron Crow (55:13.160): Correct.

Aaron Crow (55:15.794): bobs.

KEN FOSTER (55:30.350): political environment is today. Job market's crazy because of it. The way companies are spending and buying product is crazy because of it today. Nobody's doing anything right now because they're scared to death because they don't know what's going to happen. So, know, a lot of companies are like, are we overspending? Have we overcommitted? So the Bob show up and, you know, finding out the efficiency experts are there to figure out what you're doing. And I think I think

Aaron Crow (55:41.864): Yep. Yep.

KEN FOSTER (55:57.314): We're going to continue seeing that for a little while in the industry and people are going to have to be. So you need to be thinking ahead of that, right? You need to be thinking about your strategy and going, am I spending $5 to protect the dollar? Or have I designed a program that actually looks at risk appetite? Have I had a risk appetite conversation with the board and the business leaders? Do I understand what they're willing to accept, what they're not willing to accept? Have I?

KEN FOSTER (56:24.230): looked at my current tools and processes and understand all the gaps and understand where we're good, where we're not good and be honest about it. This we're good at, this we're bad at, this tool we're not using all of its capabilities. Do I need a new tool or do the 80 % that this tool does, is it good enough? If it is, then let's just do that. Let's build processes around it. Let's figure out where the gaps are.

KEN FOSTER (56:48.982): And then we can design a well thought out program that shows I'm being fiduciarily responsible for my budget. And I'm also taking into account making sure the business is still able to do what the business does, whatever it does to generate revenue, how am I enabling them? And that's the first question you have to ask yourself. And it's the first question I typically ask my teams when I first take them over and meet them is like, what is your job? Get them to tell whatever their job is. Then you go.

KEN FOSTER (57:16.782): How does that enable the business to do what the business does? If they can't answer that, then that's where we're going to start having conversation and go, how do we translate what you do into how it enables the business to do whatever the business does? Whether it's produce a widget, provide a service, whatever, you need to make sure you understand how you're enabling and supporting that mission for the business. And as long as you can do that and you're designing a well-thought out program that takes care of that,

KEN FOSTER (57:47.126): you should be successful selling it to whatever your needs are to the business. But you got to be clear about it, right? I need this much money, I need this many people, it's going to take this much time, and I need these other five people to be involved in it so we can make it happen. Like I said, don't go in there that it's a vacuum that only we're going to be able to solve it as security because everybody else sucks. Don't do that. You need it more than you need most of your people, truthfully.

Aaron Crow (58:16.243): I think the theme today is, yeah, I may be the smartest guy in the technology or whatever, but that doesn't matter if I can't get the business on board and you're not going to win friends and influence people or get your thing done and implemented that you think is the right thing. And you might be, but it doesn't matter if you can't convince the business and get it done. And you have to partner with them. You can't cram it down their throat and expect them to take it, right? They're not going to continue to take your bad medicine and smile at you.

KEN FOSTER (58:45.898): No, because there's way too many, there's way too many places out there, too many people who've got millions of dollars worth of hard of software and hardware sitting on the shelf. That's never been, it's never been switched into the O N position. you know, and, you know, board, a board's only going to do that so long. They're going to look at something and go, what value am I getting out of this million dollar a year spent? Or it don't even have to be a million dollar. can be a hundred thousand dollars a year spent. What

Aaron Crow (59:7.762): Yep. Yep.

KEN FOSTER (59:14.476): value is it actually bringing to the company? And if you can't answer that question, why held you by it? Why are you trying to implement it? Yeah, why are we renewing it? It's one of those conversations that you've got to be having and you got to be looking at it constantly because what's happening out there shifts. Now granted, still we got the same primary problems coming at us, right? But

Aaron Crow (59:21.320): Why are we renewing it?

KEN FOSTER (59:40.290): You know, how it's happening and why it's happening is still pretty much the same thing. Somebody wants money, right? They're monetizing it. But how are we protecting against it? And do we understand fully what we need to do to protect against it? And are we only buying what we need and not buying extraneous bullshit? Then that's probably the biggest thing I can say is you got to look at it in those terms.

Aaron Crow (59:46.920): Yep. Yep.

KEN FOSTER (60:5.676): You know, like I said, reading the IBM breach report was pretty interesting because it's went up. I mean, it's pretty damn expensive. Like what? 4.8 million or something like that is the average breach now. But, know, and there. But what's causing that number to go up? And this is something that I'm great that they're pointing out because I've talked about it for years when doing risk and stuff like that is it's not necessarily directly related.

Aaron Crow (60:14.782): Yeah.

KEN FOSTER (60:35.436): like incident response or communication or something like that. It's the actual production outage. How long production was out and how much revenue was lost is one of the biggest factors of what's driving the cost of breach up, is how much that production outage impacted a business. yeah.

Aaron Crow (60:56.842): Yeah, yeah, it's, it's, it's multiple. It's always multiple factors. It's never black and white. It's never easy. If it were easy, anybody could do it. You know, my dad used to tell me that when I was a kid, like if it was easy, anybody could do it. Right. The reason that you're getting paid to do it is because it's not easy. So one of the things I always wrap up with, with, with this is I ask everybody in that, and I don't prep you. So, you're getting this out of left field, but

KEN FOSTER (61:1.570): Yeah, right.

KEN FOSTER (61:7.608): Yeah, that's true.

Aaron Crow (61:22.012): In the next five to 10 years, what's one thing that you are excited about coming up over the horizon in cyber? And maybe one thing that's concerning that we, that you think we need to make sure that we're careful of or, or adjust to, to, to stop before it happens.

KEN FOSTER (61:34.990): So, think one of the biggest things we've got to be worried about in the next five to 10 years, and I'm not going to say the thing that everybody probably thinks I'm going to say, it's actually making sure people are still interested in coming in and dealing with this. And getting the appropriate training and the appropriate knowledge level coming into this, getting people excited about coming into the industry.

KEN FOSTER (62:3.894): Now, do I believe all the numbers saying that we're negative unemployment as it is? No. But what I do believe is, is we do not have a good enough pipeline of new people coming in at junior and mid-level jobs. The analysts, the engineers, those people, I don't think we have a good enough pipeline of those people coming into the environment. And I think that's something that concerns me because the need

KEN FOSTER (62:33.496): for more people in this industry is not going away. And I don't think we have a steady enough pipeline of people coming into it to keep us moving forward in the way we should be. So that's something I'm concerned about is making sure that we're encouraging young people to get into this career. then on the flip side of that, think burnout is a concern of mine. I have seen

KEN FOSTER (63:0.122): Several senior security people walk away from cyber in last few years because this job is stressful and it's a lot of work and I think people are getting burnt out on the... It's a thinkless job in a lot of cases, right? Because you're constantly inundated right now with breaches and stuff happening. You're constantly dealing with the business trying to get budget.

Aaron Crow (63:10.365): It is.

KEN FOSTER (63:29.542): to be able to do something. It's kind of a double-edged sword though. If you understand it well and you can explain it well and you're still not getting help, that's a different reason for walking away from something. But if people don't understand why it's important, then you need to be looking back and go, am I delivering the message correctly? Have I done everything that I should be doing to make sure that the message is clear on why it's important and what it's not? So those are...

KEN FOSTER (63:56.012): Those are some things in the next five to 10 years, I think that we got to really watch for because it's kind of interesting, right? Because a lot of the guys, you know, in 10 years, 10 years, I hope I'm actually retired or longer doing this on a on a day to day corporate basis, right? Be more on that board or advisory side of the world. But, you know, a lot of the guys that have been doing this as long as I have, we're all getting to that point in our career where

KEN FOSTER (64:24.290): We've been doing this for 30 years. It's starting to get time and we need to make sure that we've got that pipeline of talent coming up behind us that are thinking about it in ways that continue the good work that the cybersecurity community is doing and continue to be protecting the environment.

KEN FOSTER (64:44.974): protecting the environments that we're in and protecting the people that the business that we're in and truthfully nowadays with the amount of data that most of us have at larger companies protecting the people that we do business our customers and You know for a lot of us that's globally. We're protecting people's data. We're protecting people's livelihoods So be thinking about that that you're you're responsible for a lot of people's a lot of people's reputation so

KEN FOSTER (65:13.474): Figure out how you're going to deal with that and make sure that you've got an appropriate pipeline of people coming behind you. That's the stuff I'm worried about. Yeah, the new tools and stuff like that, all them tools, those are interesting. They're going to be able to help us. There's risk with that. There are also value that comes with that. Make sure you're focusing on how it brings value and how it reduces risk, not just focusing on the FUD and FOMO that is out there about this stuff.

KEN FOSTER (65:41.920): You think smartly about how you're going to utilize the new tooling that is coming out and talk to these startups because they're thinking about it in new ways. Talk them about the problem they're trying to solve. Ask them hard questions. Give them advice. Get them in because they're the ones investing the money to deal with these emerging technology and emerging problems and hopefully help us deal with problems we've never been able to solve. So give feedback, give advice, be transparent.

KEN FOSTER (66:12.223): don't be an asshole. yeah.

Aaron Crow (66:14.578): That's the tough one, right?

Aaron Crow (66:18.408): Well, awesome man. I can, how can, how can people find you? You're all over the place and networking events and.

KEN FOSTER (66:22.702): Yeah, I'm all over the place, but probably the easiest place to find me is probably LinkedIn. it's just, I think nowadays if you search Kenneth Foster, Kenneth R. Foster on LinkedIn or Kenneth Foster on LinkedIn, I think I'm the first suggestion that pops up for most people in that day. But, you know, I'm out and about, you know, I'll be doing a few CISO dinners and networking events in Atlanta this week. I've got some charity golf tournaments I'm involved in over the next few weeks.

KEN FOSTER (66:51.586): They said I'm actively out there looking for a new role and we'll keep everybody up to date when I find the next place I land and see what's going on out there. But I'll probably be hopefully back out there with you guys in January doing another cool event and we'll get some people out to come out and be part of that. Because there's something about getting a group of like-minded people set down together and have an open, honest conversation about cyber was a big part of that.

Aaron Crow (67:4.605): Yep.

KEN FOSTER (67:20.942): We covered a lot of topics that I thought were incredibly interesting and just getting the points of view and having that conversation and sharing the camaraderie and the brotherhood of that was, and you know, getting the put a few thousand rounds down the range, what a bad way to spend the afternoon either. So.

Aaron Crow (67:37.638): Not a bad way, but talking to that, right? It's so important. And one of the reasons why we did the event is to be a little different than everything else. And there were people there in different verticals and different experiences and different backgrounds and people in government and private and all the different things. But all of those things goes back to the people aspect of the business and how important it is to build those relationships.

Aaron Crow (67:59.452): whether you're looking for a job, whether you've got a problem that somebody else may have seen or issued, or you want a question about a vendor or a product or a capability, like all of those things are value add. And having that network of people in your Rolodex that you can pick up the phone and say, Hey, remember me? I was at this event. We shot guns together. You said you were doing this with XYZ. Let's talk about that, right?

KEN FOSTER (68:20.933): Yeah. Yeah. And I think that's the thing, right? Get out of your own echo chamber, talk to people that are getting different experiences than you and ask them questions on how they dealt with it. Because building that broad base of experience is one of the best life lessons you'll ever get on multiple fronts, whether it's professional, personal, whatever. Get out, talk to people, make yourself available, let people ask you questions. Just be honest and answer the question because

Aaron Crow (68:37.799): Absolutely.

KEN FOSTER (68:50.284): This is how we all learn. This is how we get better. This is how we bring up the new group of people who get interested in what we like to do. So that's probably my big thing is don't be afraid to share your experience.

Aaron Crow (68:57.042): Yep. Absolutely.

Aaron Crow (69:2.130): Yeah, awesome. Well, hey Ken, I really appreciate your time today. As always, it's good to connect with you and definitely look forward to hanging and shooting some guns and connecting and other times as well,

KEN FOSTER (69:11.758): Absolutely. Absolutely Aaron, I appreciate it. Thanks for having me on. I enjoyed it.

Aaron Crow (69:15.122): harbour

Transcript lightly edited for readability.