How Security Awareness Drives Business Enablement With Greg Johnson

Fantastic, and thank you for allowing me to be here today.

You know, this will seem really silly, but for most organizations, and I'm talking most of America's small and medium enterprise, so that may range from 5 million or maybe 50 to 100 million in revenue, but the biggest risk topping is that they don't have a cyber program. They don't have policies, they don't have an incident response policy, and so when they get hacked, they go into fibrillation, you know, like a heart attack, and they go, 'What do we do?' That's the big piece of pepperoni on this one.

Yeah, you know, we could have fun with this. The way you've learned it, there are a lot of them that don't have security awareness and they open themselves up to phishing. But the bottom line is a lot of these problems could be solved if they just had that framework to follow and they understood what the best practices were and they were documented and then held accountable to it. And that's what most organizations, I think, are missing today.

Yeah, absolutely. And you know, usually, John, it comes in the form of business enablement, right? So in other words, business is kind of flying along, we're doing fine, we're making some sales, you know, we're swimming along, and then all of a sudden they land a big fish or even a whale. And I'll give you some examples. So we had a mortgage company that had some technology stack, as you can imagine. Mortgages are now, banking is finally starting to gravitate more towards technology. It's taken them a while. We were still sending faxes a few years ago, right?

So as that world has matured, a lot of companies aren't prepared for what's coming. So they landed a deal with Costco, and Costco came back and said, 'Hey, we're excited to offer your mortgage services to our clientele nationwide. And by the way, New York, the state of New York has these specialized financial services regulations and you need to meet them. Our security team will be in touch.' So what they sent was a spreadsheet, big spreadsheet, to the client and said, 'Here, fill this out.' And that's a scary moment for most businesses because they think they need to meet all of the criteria on that, and frankly, they don't know what a lot of it means, whether they have the controls, whether they don't have the controls, whether the controls are applicable, and most of the time they don't have the policies to back them, right? And so that's when they would turn to our company, Webcheck Security, to help them out.

It completely makes sense. We've seen that as well, and it's definitely that scary moment of, you know, am I going to be able to keep that revenue or am I going to lose that revenue because of a cybersecurity issue or an insurance issue or something along those lines. And that's what brings it to the fore that most organizations, particularly small business where they ought to be concerned about cybersecurity, or even medium enterprise, they just don't know what to do. They've got IT and it's concerned with security, but IT, as you know, and cybersecurity are really not the same thing. One is business du jour, IT gets business rolling and operational, and you throw in some technologies that hopefully are keeping you secure. But security is a lot of things. I like to equate it to Thanksgiving at my grandma's, right? So if you think of Thanksgiving at grandma's, there's pumpkin pie, there's apple pie, there's mincemeat pie, there's pecan pie. What's your favorite, George?

Pumpkin or pumpkin chiffon, there's even pumpkin cheesecake. But my point is this: if you think about a pie and all of these different pieces, they're all important. You really can't have grandma's Thanksgiving dinner without them. And cybersecurity is that way. It's not just one piece of technology and one IT guy or gal saying, 'Hey, let's throw on CrowdStrike and we'll be safe,' right? CrowdStrike, cell phones, whatever, they're great endpoint products. But what about your incident response policy? What about your HR onboarding and offboarding policy when people leave with keys to the kingdom, right? Who retires those and what's the policy there? What about data encryption? What about network segmentation? Yada yada yada, vulnerability management, penetration testing. All those are important pieces of pumpkin pie that have to be there in order for business to not only continue and have succession and continuity, but anyway, all that to say that it is cyber program management.

Yeah, and that's a good insight in my mind because I've been involved with it for so long. As we were discussing before the call, I worked for A-LIGN, which has now hit 100 million in revenue, and they do a lot of assurance services, right? SOC audits, ISO 27001, PCI, HIPAA. I also partner with Arc360, which is a CPA firm, Johanson Group, which is a CPA firm, the Moss Adams. We do penetration testing and advisory services for all of those and many more. And what's interesting is that some of those certifications are merely that, they're kind of check boxes, right? And you can kind of tailor, for example, a SOC 2, it's good to have a SOC 2, but it's really, if you're doing a Type 1, it's just a review of the design of the control, so you can convince your auditor that the design of your cybersecurity program is okay, and it's not really following a framework. On the other hand, what most businesses don't realize, right, and this is what I've kind of learned over the years, is that there are these best practices frameworks, and they're not rocket science. So take CIS for example, they've got an Implementation Group 1, and then a kind of intermediate Implementation Group 2, and then an Enterprise. So a business that has nothing can start with just the basics, Implementation Group 1, and they can be a lot more secure tomorrow than they are today just by following that best practices framework. So with a lot of organizations, it's just education, right? It's just helping them understand that there are a lot of smart guys out there that have developed these best practices based on years of practice and observation, and if you adopt these, you're probably going to be okay. So anyway, just some observations there.

Yeah, well, there are several ways. One is we have a robust channel. We love the channel, meaning managed service providers, managed security service providers, and MDR companies, managed detection and response companies, as well as, as I mentioned before, CPA firms. All of these will bring us in and they will white label or resell our services because it's not their core competency. So in other words, you take a CPA that's doing the SOC 2 audit, they can't be the CSO and write the policies and then audit those policies, right? So we'll partner with them to come in and we can put a CSO in there for, you know, 250 or 300 an hour, which costs them a lot less than half a million to have a real CSO, and these are real CSOs by the way, but they can use them as little or as much as they want during the month and help them, educate them. So we go to a lot of events that are channel-oriented. So Channel Futures in Las Vegas, MSP Summit in Orlando, there are so many channel organizations. We've just become involved with the CompTIA organization, and they have a ChannelCon that we'll be going to later this year, I believe it's either in Vegas or San Diego, I don't remember which one. And so there's that, right? There's channel-focused shows. But we decided early on, about three years ago, I guess not early on, but three years ago, we decided let's do a cybersecurity summit. And we were just coming out of COVID, Utah was one of the more progressive states in kind of relaxing in-person events and so forth. And so back in 2021, we held our first annual Webcheck Cybersecurity Summit, and we basically invited anybody outside of Utah or inside Utah, obviously mostly local focus, but we had people coming from out of state to have this wonderful full day of cybersecurity with a keynote speaker. We had Jack McCauley, who was one of the Oculus founders, for example, did a keynote speech. We had CEOs, we had breakouts on writing policies in the organization, Web3, NFT, and we're doing it again this year. So now we're in the third annual Webcheck Cybersecurity Summit. This year is going to be a lot of fun. It's on, for your listeners, mark your calendars for April 27th. That's when it is. If you go to our website, webchecksecurity.com, and just click on events, they'll see it there. In fact, I think there's a pop-up that says, 'Hey, learn more,' or you can make it go away, whatever. But that's going to be a fun event this year. We've got DeepSeas presenting on threat detection and some of the latest in cyber analytics. We've got, speaking of CompTIA, Juan Fernandez, who wrote the Security+, A+, Network+ security exams for CompTIA, is going to be the keynote speaker. A wonderful gentleman who built a multi-million dollar series of MSPs and sold them off, and now he just wants to help people. Very exciting individual, has his finger on the pulse of cybersecurity and what it takes to succeed there, and so he's going to be a keynote speaker. Anyway, so we do that, right? We've also had some of those events in San Diego and Arizona. But aside from that, lots of webinars, podcasts like this. This is a wonderful podcast to educate people about cybersecurity and how we might serve them. And then we have our own branded podcast, John, called Vistas. And Vistas is mainly cybersecurity-focused, but occasionally we'll deviate and we'll talk about entrepreneurship and leadership, growing organizations. We'll talk to successful leaders of cybersecurity companies and ask them not only about their product or service, but what they did to grow and where they see the market going. So lots of fun. We've got a lot of initiatives going, and I've probably missed a dozen. We want to start kind of lurking in Reddit, maybe doing some Reddit chat sessions and things of that nature. So that's kind of where we're at right now.

So really? Yeah, I will say it's, you know, it used to be big and sexy, and it's still big and sexy and big and expensive. And you kind of walk around and all the big cybersecurity vendors, yeah, that'll show up and do the same old song and dance. And you know, it's different strokes for different folks. We've gone some years, in other years, this year we're not going. In fact, we're having our cybersecurity summit pretty much on the last day of RSA. I haven't run into too many conflicts, so yeah.

Oh my gosh, I'm a voracious consumer of books, and a lot of my book reading I do on Audible these days because I find I'm driving so much and I can get so much more time. One of the books I love is called The Compound Effect by, I think it's Darren, is it, Hardy? He was the editor of Success magazine for many years. And it basically is the principle of small and simple things done consistently every day is what leads to greatness and success. One example that kind of stuck with me, I'm kind of a fitness buff, I'm 60 years old, but I deadlifted 425 pounds yesterday, right? And I work out every day. And one of the things he says in the book is he tells the story of three guys, right? So speaking of fitness, and he says, so if one guy decided that he wanted to lose weight and so he ate about 60 less calories every day, the other friend decided to just kind of, I'm good, status quo, so he did nothing, kind of your control group, and then the other guy decided I'm just going to eat a bowl of cereal every night. So I'll eat healthy when I'm hungry, a healthy bowl of cereal, but he was eating kind of an extra 60 calories. So after a month, no difference, right? After three months, right, the guy who restricted his caloric intake was starting to notice some pounds fall off, and the other guys were pretty status quo. But you fast forward another 18 months, and there was a 120-pound differential between the one that was eating the bowl of cereal every night and the one that had started to reduce his calories by about 60 calories. And that's a great example of small and simple things done every day. And so his whole book goes into that. I love that book. One I'm reading right now, or consuming audibly, is called Change Your Brain, Change Your Life, and it's by a Dr. Daniel Amen. And he's a psychiatrist that back in about 1989 started scanning brains with a SPECT, single-photon emission computed tomography type technology. And what they do is they shoot you with a radioactive compound that then when they image the brain, it shows where the blood flow is. And what they found was that all of our problems, ADHD, depression, bipolar, anger, lack of libido, whatever, a lot of it stems from brain damage. And he learned how to look at the brain and then be able to treat the sections of the brain with nutrition, medication, there's a spiritual component, a counseling component, and he would watch those brain portions light up or if they were overstimulated to normalize. Fascinating book, so I'm reading that. One of the best cybersecurity books, though, that I've read in a long time is Sandworm. Have you heard of it? It looks like George has.

So yeah, Sandworm talks about the Ukrainian power grid going down and the big transport company Maersk, and all these big companies. Essentially, it was Russia, and it was kind of the precursor to the war that's going on now. They did this, was back in 2005, I believe, so it was a while ago. But Russia's been playing with cyber warfare for a long time. Fascinating book, gives you a lot of insight into what's going on in Ukraine right now. And then I've written a couple of my own books, John. I have a book out called Testing and Securing Web Applications, of which I'm a co-author with Ravi Doss. I call him Professor Doss, he's written about 10 books. And between the two of us, we discuss kind of the whole cybersecurity framework that has to support secure web applications, from infrastructure and algorithms to pen testing to threat hunting. And it even goes a little into ISO and some of the frameworks we talked about. So there's that. And then I've got a contract to write a new book, and I won't share the title just yet, it's kind of a fun surprise, but it's more geared towards the general public, kind of like Sandworm, only talking about how we're being spoofed by hackers and the whole ransomware epidemic. It'll be an interesting book. I've just barely started that, so I won't predict when that will come out, but I'd like to get on the ball here and get it done by the end of next quarter. You can say no George R.R. Martin kind of things, you know, and I'll get it done before the pandemic, I'll get it done.

Thank you, yeah.

Absolutely, I look forward to that.

There's a lot of exciting things going on. As you guys know, the big chat right now is ChatGPT. And sometimes it's interesting how buzzwords and buzz technologies, I'll call it a buzz technology, maybe it's a technology, but it's a buzz technology because it's kind of pop culture right now, right? Everybody's talking about how is it going to hack us, how are we going to incorporate it into cybersecurity. If you think back to the whole blockchain thing, right? Blockchain was going to be the answer to cybersecurity. Would you agree with me? It's probably not.

Exactly. It's a cool technology and it's very valid in different scenarios. And of course, the whole cryptocurrency, and you could go off and talk about how all of the stocks and the cryptocurrency values have gone down, and that may be just a thing. It doesn't mean crypto is dead by any means. But I think what the community realized is that there have to be controls around the servers that run the cryptocurrency and do the mining, and the cybersecurity principles still apply. And basically, anything that has ones or zeros can be hacked eventually. And so that leads to the next thing, which is ChatGPT. So AI is coming into play, and AI has always been a kind of a buzzword, right? A lot of companies, especially in the threat detection realm, will say, 'Well, we've got AI, our SIEM, security information event manager, it has AI, it'll find the threats,' you know. Well, that's BS. It'll find some of them. But you know, AI essentially still today is mostly heuristic algorithms. Yes, they learn a little bit, but we're not to the point where Isaac Asimov had iRobot yet, right? If you saw the Will Smith movie.

Well, ChatGPT has a series of interesting algorithms. Now Google's upped the ante, and because Microsoft made a significant multi-billion dollar investment, now Google's claiming we've got an AI that we're putting into the Google search engine. Kind of reminds me of when they bought Ask Jeeves, right? So this is the next generation of Ask Jeeves. So there's that. You combine that with quantum computing now, right? And quantum computing's still out there. I mean, China has it, the US has it, IBM has it, Dell, some of the big manufacturers are playing with it. And when we'll see that come more into mainstream, it's probably still going to be a while. But when you start to combine that with AI, then it presents an interesting red team and blue team scenario where hackers can use the technology to think faster than a human can respond, and then manufacturers, vendors are going to have to start creating, so you take your CrowdStrikes and so forth of the world and DeepSeas and Arctic Wolf, they're going to have to start incorporating the same technologies to defend as fast as the spears can be launched, right? So there's some exciting things happening out there.

Right, right, right. And they're scary too, because, you know, are they moral, are they amoral? Basically, when whoever's programming them is programming the algorithm and the arrays, you know, so if it's a serial killer, then you're going to have serial killer algorithms.

And that's an interesting metaphor, you know, which means that, you know, John and George, long after we're dead, the AI will kind of evolve to the level of my six-year-old granddaughter, maybe. I don't know. Who knows.

Yes, yes, I have. And a while back, so he was an MSSP, let's go back 17, 18 years ago. And you know, at some point as the industry evolved and the SIEM thing came out, he started managing QRadar instances. So that's been around for a long time, that's kind of old boxy technology, but it's robust, it works. And so he did that. Then at some point, he found these scientists in Poland that had developed this really cool algorithm based off of something called rough set math, and implemented called approximate query, which would take all of the log data from a system and represent it digitally in a metadata layer. And then the technology, if you could figure out how to ask the right question, it would pull back anomalous results. Well, he bought that company, and what happened was, so you take basic SIEM and regex, regular expressions, and the known knowns, right? And you run logs through it and it says, 'Oh, there's a signature for this thing we know, so go fix it,' you know, it's a Log4j, whatever. But what about zero-day stuff and all of that? So this technology is kind of next level because it identifies a lot of that stuff. So he bought that company based out of Warsaw, Poland, and the PhDs that went with it, and applied it to threat detection and response. And now he recently sold that company to the Nautic Group, who then went and bought an EDR company, Booz Allen Hamilton's MTS threat detection company, and now it's called DeepSeas. Right? So it's been exciting to watch how these MDR companies have kind of grown up and started to add services and AI, and in the case of formerly Security on Demand, the advanced query technology that finds more of the anomalies than Curator would have done back in the day. Right? So that continues to evolve, which mostly helps higher medium and enterprise clients. You don't get a lot of small businesses buying threat detection. They'll just grab CrowdStrike and stick it on their machine like I do. We all work mostly out of our homes, our pen testers, our CSOs. We make sure they have VPNs, we make sure they have Sophos or CrowdStrike, and that's pretty good for us. But you know, you get an organization that has a lot of infrastructure, they've got to have the threat detection, particularly if they're warehousing data, even if it's in AWS, it's got to be monitored. So those technologies are really exciting, guys, and it'll be interesting to see where they go.

Yeah, yeah. So I'm a guy that has been married for 38 years and has four kids, one girl and three boys. And I lift weights, play racquetball, and I sing in the good old Tabernacle Choir on Temple Square, which has been broadcasting for 94 years straight through radio stations and now on the web everywhere. In Europe, just picked up the television show. I'm on TV every Sunday morning, you'll see me upper right-hand corner with the bass section on something called Music and the Spoken Word. It's a lot of fun, you guys should tune in.

I sing low bass in the choir, and that's been a lot of fun. We're actually going to Mexico City this, in June, I believe it is. We've got some concerts lined up down there. And except for COVID, the Tabernacle Choir has sung at every presidential inauguration. They've usually been invited and kind of dubbed America's choir. So that's fun. I've been doing that for about five years, and that'll come to an end soon because when you turn 60, they say, 'Here's a nice plaque and thanks,' you know, and then you're out. But other than that, you know, I'm passionate about providing cybersecurity solutions for our clients from a governance perspective. And if our organization doesn't do it at Webcheck Security, we'll pull in partners that do. And I've been doing that for many years. So, you know, as you mentioned before the show, I worked for A-LIGN. I've worked for SecurityMetrics, which is a big PCI, payment card industry compliance firm. I was there for six and a half years. Then vice president of business development at A-LIGN. And in 2018, I was working with Secuvant, which was one of these managed detection and response companies like DeepSeas. And you know, they had their customers saying, 'Hey, can you do pen tests?' And they'd say, 'Yeah, we've got this partner we outsource it to.' And I went to the CEO and said, 'Hey, I have a number of acquaintances that I've used in the past that are fantastic engineers. I've been thinking of starting a company. Let me take these deals and run with them.' And that worked out really well. So that company kind of funded the upstart of Webcheck Security. And believe it or not, COVID was a fuel for the fire for us, because I got laid off from that. One day my boss said, 'You know, we're losing customers. It's one of the first things to go and budgets are cut is MDR, the thousands of dollars of monthly managed detection and response.' So I decided to take it from a boutique company to a full-time endeavor. And the executive vice president who worked there came with me. You know, I convinced him, 'Come on, Jeff, you got to come over here, let's do this.' And we're not looking back. It's been a great ride, largely in part to great partners. But we're just having a blast, guys, and growing up. So live in Utah, I love the outdoors, you know, I love to kayak, I love to hike. Obviously, I'm not kayaking right now because the lakes are all frozen, but...

I used to have a rock band when I was in high school, and the guitar has kind of been a hobby off and on throughout the years. I can still play. Played the trombone a little bit in college. It's a hard instrument to keep up. It's kind of like, 'Come on kids, gather around the trombone, let's play some Christmas tunes.' It doesn't work, right? So I've kind of let that go a little bit. But yeah, I play a little bit of piano, a little bit of, kind of a jack of all trades, master of none. I actually minored in music, but that was voice, vocal performance. So I guess voice is my primary instrument.

You know, I think what I'd say is get your MBA, and then look at starting a business a lot earlier than I did. But it's easy to say that now, right? Now it wouldn't make sense for me to get an MBA because, not that I know it all, right? Everybody can stop, and there's a lot of great stuff, a lot of business analytics that I would learn, but it would cost a lot of money now to go back and it wouldn't give me a big ROI because I'm already the CEO of a successful company, right? Having fun and enjoying it. But what I would do is I would learn more earlier, and then learn more instead of just going to work in something I enjoyed, I would look to learn more and then start a company a lot earlier, which would lead to more career satisfaction, the ability to bless others' lives more, you know, employ other people, donate and give to the community earlier on than I am now, and just kind of have a little bit more life satisfaction. But then again, you go through life and you kind of figure things out, and at one point certain things click. So would I have changed anything? I don't know. I mean, I was pre-med at BYU, I was going to be a doctor like my dad, and then at one point I realized I don't know that I like sticking needles in people and, you know, feeling for veins in their arms. And I realized I had a gift for languages. I served an LDS mission to Milwaukee, but speaking Spanish, and I learned the language really well. And so I got a degree in Spanish translation, which has kind of helped me in business and writing and so forth. So I don't know, that might help you on that trip to Mexico City.

Well, great. But that would be it. I'd say younger self, you know, get serious, maybe stay in school a little bit longer, and then learn, go to work not to just earn money, but go to work to learn. And try different positions, don't be afraid to apply for more positions within large corporations or whatever, and you'd probably find an acceleration of where you wanted to be earlier.

Well, if they go to webchecksecurity.com, they can reach out to us. We have forms on just about every page. There's an email, get in touch at webchecksecurity.com, and I get those as does some of our biz dev team, but I'd be happy to respond. Or they can go to LinkedIn, Greg Johnson, just type in Greg Johnson and Webcheck Security, I should pop up. Connect with me, and they can do the LinkedIn messaging, I respond to those as well.

And then we have Vistas. So anywhere that podcast, for the most part, the major platforms, Spotify or Apple Podcasts or whatever, if you go out and search for Vistas by Webcheck Security, there you go. You can, in fact, I've got to release the one for this month, we haven't released it yet, so we'll be doing that soon.

Yeah, yeah, it's a fun podcast. The music is sponsored by a really neat band that my son happens to be part of called Suit Up Soldier, that can be found on Spotify and Apple Music. And it's just a neat podcast, so.