COVID Chronicles Ep.03 | All SOC Episode

Chronicles Podcast Icon

In this special episode of the Cybrary Podcast we bring you the COVID Chronicles. Hosting this series is Brian Dykstra, the CEO of Atlantic Data Forensics, who will be joined by guests from across the industry in a discussion about how the Covid-19 Pandemic is affecting them. In this episode we will hear from Rebecca Blair, the Director of SOC Operations at Ironnet Cybersecurity, Xavier Salinas, the VP of Threat Operations at Blackpoint, and Ernie Pritchard, the Director of Information Security at HealthSouth.

Topic: How the Covid-19 Pandemic is affecting the industry
Hosted by: Brian Dykstra, Rebecca Blair, Xavier Salinas, Ernie Pritchard
Length: 50 minutes
Released on: June 3rd, 2020
Listen to the Audio
Enjoyed this podcast?
Share it with friends now!

This episode was the third one of the COVID Chronicles Podcast series and was hosted by Brian Dykstra, the CEO of Atlantic Data Forensics, sponsored by Cybrary. The three guests are SOC experts. 1st one is Xavier Salinas, the VP of threat Operations at BlackPoint, Rebecca Blair, the Director of SOC Operations at IronNet Cybersecurity and Ernie Pritchard, the Director of Information Security at Encompass Health.

The overall discussion was about how companies are handling the pandemic and what will be the future of work, once this pandemic is over. Will companies be more flexible in terms of remote work?

Brian started the episode by introducing himself and then asked each guest to introduce themselves.

Then he asked a total of five questions to each guest one at a time and asked them to share their experiences around the industry and precisely how that is impacting their own company.

  • How the whole COVID19-pandemic affected the industry overall and their company?
  • What was the most unexpected thing that happened because of the pandemic that you guys had to deal with?
  • What advantages have you discovered from the mandatory quarantine?
  • What did the future look like for your industry, your company specifically?
  • So how long is it before you feel comfortable? Again, being in a room of 50 people.

Overall there were initial hurdles since companies were not fully prepared to handle the complete remote workload. They had to invest in VPN and remote collaboration, communication software like Slack, Microsoft Teams, and Discord. There was also an increase in remote network scans initially.

Xavier mentioned how things have changed since pandemic, customers who never allowed access to the servers, are now asking them to help. He saw increased interaction between the individuals in his company.

Ernie mentioned that this would change the overall hiring process. Now hiring managers have seen that remote work is possible. They will not restrict to one geographical area to find the right talent.


Brian: All right. Welcome to the third episode of the COVID Chronicles, the Atlantic DF COVID Chronicles, sponsored on Cybrary, which is awesome. I always forget to do this until the end, but today is May 27th, 2020, just so we know where we are in the whole pandemic scheme. When we're watching these 200 years from now. And I have with me for the all SOC episode, three excellent SOC managers, directors, whatever you want to call yourself, from, from three different, folks that we work with and all of them are excellent in their field, but they don't know each other. So it's going to be a lot of fun and I'm letting them all introduce themselves and start with Xavier.

Xavier: Hey, how are you doing? I'm Xavier Salinas. I run the threat operations at Blackpoint cyber. So that includes a SOC, some, like product management for our software product that actually catch attackers. And, the SOC also all falls under, under me. I, by my side where we do a MDR service.

Brian: Rebecca, what about you?

Rebecca: Hey, I'm Rebecca Blair. So, I'm the director of SOC operations at IronNet. Basically my team handles all of our security monitoring. We help out with some integrations, some compliance, basically, anything that my VP and CISO and CIO say that we have to do. We, we, we handle.

Xavier: Awesome

Brian: That was a nice cover for the boss there.

Xavier: I like that Rebecca

Brian: That's a solid and Ernie what about you?

Ernie: So my name is Ernie Pritchard. I oversee the SOC and operation side. our security stuff at Encompass Health. So that includes the guys that manage the firewalls and, and the guys on the SOC team and everything like that.

Brian: Alright, so we got here is we've got ourselves an MSSP, a Rebecca, what would you call IronNet? You guys are kind of a multinational security organization thing, right?

Rebecca: It's a product focused company, but we also have our internal security and then we also kind of have our services with our homes. So we're just a hodgepodge group.

Brian: Right, and then, then Ernie, I mean, you guys are at what, nearly 700 hospitals now.

Ernie: No, we're not on 700 hospitals. so we have, we do some, so we, we, we do rehab and home health. So we have a, 130 odd hospitals or facilities and many more, branch offices and stuff like that for our home health operations.

Brian: Right, and then, and then Xavier, you guys have got a pile of clients as your MSSP service, right? Lots and lots of points we got

Xavier: Yeah lots of fun points more than that more than I've ever bought in I thought I'd ever manage in my life. Yeah. And that's more, more, more than Microsoft has that's for sure. Probably a lot.

Brian: All right, there we go. We'll get it. We're going to go again from right to left, well right left for me. Who knows what you guys are scattered as, but we start with Xavier on this. So first question, real simple softball one here, how's the whole COVID-19 pandemic affected your, your industry being, you know, kinda the MSSP thing and then the, your, your company specifically.

Xavier: You know, the biggest thing I've noticed is when we're interacting with our partners they are, you know, because we're providing service to many, many MSPs. They actually have a slower response time themselves, because a lot of times they don't have people on site to, you know, pull that cable or turn off that firewall to make sure they can turn it back on. So we've seen a lot, you know slower responses, some of them maybe even changed their playbooks up to allow us to have more control over some of them don't say that, you know, you guys cannot mess with our servers. But now they are like please mess with our servers. We have no one on site they can actually go there. And a mess of their servers in a timely manner. So that's probably the biggest change that I've seen. And it's, it's happened a couple of times to where they're like, Oh, we don't have anyone on site. We don't know when we can. you know, what, what can you do to help us out of here? to further along an investigation or an actual like, response that we have to take. So actually yeah yeah. Okay, and then like, just like you said, everyone's response plans now have to change to take into effect a remote working, you know, before it's like, Oh, just go to the desk, grab the laptop. Well, you can't really go to the desk and grab the laptop when everyone's remote and you have to provide shipping boxes. What do you do with this? You know, when you get it now, who takes it into the office, you're going to have to have, you know, forensics on their house now, or, you know, a way to gather up a. Information on an infected computer. So I sent a lot at people. Hadn't changed their response plans.

Brian: Right, our response plan now includes hosing everybody's computer down that comes in with Lysol.

Xavier: That's the way to do it

Brian: yeah it got to make sure you guys take no chance. There's like pack the gloves in there and just Lysol. So if your, if your stuff goes by smelling lemony fresh from us, that's why

Xavier: Just smear hand sanitizer on it.

Brian: Yeah no it's

Xavier: like my phone. I just dip it in and pull it back out let it air dry don't do that.

Brian: Don't please please don't take that advice. It was okay,

Xavier: That's like I said yeah said this cleans my phone.

Brian: Oh my goodness. Rebecca, what about you guys over there at IronNet at, you know, what's what's what would you say is, you know, been the biggest change.

Rebecca: Yeah, I think for the most part, we're actually pretty fortunate that most of us work at least a portion of the week from home already. So transitioning to a closed office wasn't very hard for us. One of the things I think, both with how we communicate with each other when we're investigating an incident or just that we don't directly talk to customers, but we do talk down to say different units. So that, that kind of became a change a lot more through email, a lot more random Slack calls didn't really matter the day. I think kind of the days I'll just blend it together. So I really had no idea or no concept of time when we were working. Kind of like you mentioned with. Yeah. You know why selling everybody as they came in our new trivia gifts are now a roll of toilet paper.

Brian: Nice. Actually, I mean, I know some people be damn happy to get that toilet paper thing. We, we actually started supplying out of the office stash here because folks were running low. So that, that, you know, that's the one thing I haven't seen or know about your area, but, you know, a lot of the supply chain stuff seems to have popped back, but. Yeah, paper products is just, it's still not there.

Xavier: Like cleaning stuff. I still have no assignment. Some of that is

Brian: Is crazy. you know, just in time, I guess. Right. But you Ernie what have you guys? well, healthcare in general, you know? Yes. It's become a huge target, but, yeah.

Ernie: Yeah. And I mean, there's a, you know, when we talk about how it affects that, so I don't really do any of the operations part of it. So like, you know, what actually happens to the hospitals and that sort of thing. I really don't have any insight to, from a security perspective though, you know, in an IT organization perspective as a whole, We didn't really have to change a whole lot as far as how we do business and that sort of thing. There was obviously a migration to, to remote workforce or more of a migration or remote workforce. You know, and there's some social, you know, you just kinda have to get used to that a little bit. Right. I think, you know, we saw, we've seen, an increase and. Events and that sort of thing, you know, coming from external adversaries and stuff like that, I mean, obviously they're kind of hopping on the band when I'm going to take care of everybody's stress levels and that sort of thing. It hasn't really been anything that we haven't been able to cope with. you know, so, thankfully we didn't have to change our game, our runbooks or onboarding and new services or products or anything like that, but that whatever required us to kind of retool. Our operations and our procedures and that sort of thing, that would have been a nightmare. You know, I feel for anybody whose business kind of, you know, totally was flipped over and now everybody's in the cloud or something like that right.

Brian: Yeah.

Ernie: Because, because the bad guys are taking advantage of all that stuff. so, you know, I think that, that our response was adequate and, you know, we really haven't had any problems that we couldn't solve or any challenges that really posed a real big problem.

Brian: Yeah, no, a couple of the hospitals I was talking to that we've provided DFR support for said that they were seeing like a tenfold increase in the amount of external probing and bouncing on the outside of their network and stuff. And, and systems is that mirror what you're seeing or.

Ernie: Yeah, so I mean that, that's, I just kind of consider that a little, just kind of some noise floor, so to speak, but we have seen increased scans and that sort of thing. I think the more interesting. threats would be, you know, threat actor. So we've kind of moved there who are moving to take advantage of, you know, everybody's needed to get PPE and, you know, potential other problems that people might have, whether it's some kind of an HR thing based on, you know, maybe a riff or what have you. those are the, the guys that are probably getting a little more traction out of all that stuff. But, and there has been some increases in that, that honestly, I kind of, in some regards, I thought it would be more, you know, but it hasn't been anything that we haven't been able to, just to, just to kind of plow through. Like we normally always do it.

Brian: I was just thinking if I did a Walmart charming, triple ply adverti fish, that could be the answer. That, that could be how I make my millions right there.

Xavier: That's how you do it yeah, just send out that angel soft email campaign there for Spain.

Brian: Exactly no no that's scott's I'm talking to good Sharman.

Xavier: I just have to hear the good stuff, get it, get it at one point prices. Right?

Xavier: I said, I had a story about, about, you know, the shift in, remote work section. We actually had a client who they had a laptop. That they used on their, on site, for like looking at new cameras and it was a shared laptop, that people would get into and it was fine cause it was in the office and it wasn't really hooked up to the internet. Well, one of the guys decided to take it home and you know, everyone still needs access to this laptop. So they got dangerous on their own, out at work and figured out how to open up a desktop into this device, which had, you know, it was not supposed to be online default credentials and it took a day. For someone to log into that. And it was kind of interesting, really cool. You know, we saw this weird. Device, getting logged into and, you know, we went back and looked at some of the data on it and you can see I'm trying to poke around the antivirus and trying to run stuff and trying to launch some things. And I was like, Oh man. I mean, nobody, like we contact the client. They're like, Oh yeah, like I took it home and obviously wired straight up to the internet. So that, that was interesting. How people start to get a little dangerous on their own and someone else has access to us.

Brian: You can't leave RDP, exposed for any period.

Xavier: It's kind of interesting that like you know someone just scanning everything.

Brian: Yeah.

Xavier: They found his house, you know, and a scan and it was probably admin admin to log in. And there he goes.

Brian: Yeah. you know if it's not somebody actively scanning the show. Dan's going to hand it to them for you and, you know, You know, it's just, you're not gonna, you're not going to make it on that.

Xavier: And this was like day two of like the quarantine. I was like, wow, really? They must have really ramped up some external scan, you know, getting hit in the house.

Brian: So we saw a bit of a drop. Kind of, what was,that sort of end of March there was a little period of time where we saw like a reduction in overall phishing. It was almost like they retooled, right? Like they just kinda like, Oh, okay. We got to change up all our playbooks and patterns and stuff again. And then it just like search for, but there was like a good two week period. There was a huge dip, you know, just. We did nothing. We all thought they went home and died or something, but yeah.

Xavier: Yeah, I was following some, I was following some, you know, advanced campaigns, like Emotet and all those ones. And I noticed that they had, you know, when the, when the quarantine for star, there's a huge dip and, and, samples found for these, for actors. And I was like, I guess, I guess they are other things to worry about right now. Also they might write back. That was interesting. The trends didn't dim down for a little bit.

Brian: Back hard right now.

Xavier: Oh yeah. I have a following that ran the Netwalker ransomware campaign pretty closely. And they have been like, you know, five, six, seven companies.

Brian: We just took a call for that right before this.

Xavier: Did you? Yeah, they're ruthless right? Now I have been really following them close.

Brian: Yeah, yeah, netwalker out there. Just, just ripping people up. yeah all right. Cool. all right, so let me move on to my second question here we'll never make it through all this stuff. let's see. okay. This, is I like this one. It's not my favorite one, but it's my second favorite one. All right. So, again we'll start with Xavier on this one, but, what was the most unexpected thing that happened because of the pandemic that you guys had to deal with? Like you just never saw that. Right. It was like that truck out of the dark come in and then like, how did, how did you adjust. And handle that thing. Sure, share your experience with us on that.

Xavier: Most unexpected. well I guess, you know, I'll be transparent here. We never, so when we, you know, it was really, it was probably like late February. I told the whole SOC that we know it's going to be working from home now. So everyone works some more. And, you know, so it was probably like first shift or second shift and everyone worked from home. You know, I started getting, you know, we have a whole escalation mode for our phone calls and I kept getting a call and I was like, what the heck are these guys doing? They, you know, it's, I'm like fifth on the call.

This, if someone, you know, where are they. Someone calls into the SOC and where it goes. And I was like, Oh my goodness, they're not in the SOC. They don't have them. They don't have their, you know, the phone's right next to them right now. So, I was like, Oh, damn. Now we gotta get everyone with these remote phones. I just totally blew over my head. You know, that someone's going to have to answer the phone when someone calls to SOC, you know, that a quickly scrambling and out of my SOC manager equip everybody with, You know, soft phones so they can answer those. another one, another one was, you know, we're a software company actually at heart. We make all our own software. We didn't really have a way to share our repo repositories for remote developers. Everyone start working from home.

They're like, wait, how do we commit this code? I just made. Everyone's like, Oh, you know, so it's like, ah, dang it. I'm gonna access. You know, everyone's going to get all the developers, even this blessing I want to do is to give the developer VPN access, sorry, other developers out there make scramble and make some policies on them. So those are two things that kind of blew over and it really quick, or like, Oh, you know, it's just such a drastic. Hard cut over to, everyone remote. Now those are probably the two ones

Brian: Right, there was no transition, right? It wasn't like a few people and that a few more, it was just a, everybody out of the building.

Xavier: Right. We're not quite prepared because we have a lot of remote sales and we have remote offices around the world. So we know we have good infrastructure there, but you know, just some of the generic office operations just didn't dawn on us. right, right then and there, well, outside of that, you know, we really haven't had many other, unexpected things happen. Everyone seems to be working great from at home. Time, time to wake a time to bed. Exactly the same as in the office. Maybe even better since some of the employees don't have to drive and they're happier.

Brian: So right. Rebecca, what about you? What, IronNet experience, we just didn't see it coming. Now, I know that you guys are one of my only clients ever that had a TTX. that was actually pandemic based. That was almost two years ago.

Rebecca: I know, I have been telling everybody

Brian: that I was like, it's crazy. They actually did this.

Rebecca: Yeah, I was talking to the person who, you know, on our side, who works on the TTX is, and I told them they have to stop doing them because the couple of have come true now. And so it's great that we've practiced for it, but just stop. So we're actually pretty fortunate. I can't really think of anything. Do you want to expect it other than like the basic, you know, permission issues and things like that? We've had to cheat a lot of things. Operations wise, though. That I think were, were expected. We were just kind of, we're hoping to never have to, especially with the increase of VPN.

So we've, as a company we've upgraded our VPN, like to make it a little bit more faster. the one thing that I think is my favorite that we've implemented is a bot called judge dried. so when people aren't logged onto the VPN within an appropriate amount of time, or when they try to install. Unauthorized like browser plugins, you get a Slack bot that comes out that is judge tread and it tells, you know, to remove it and take you through the steps and alerts. But it absolutely does. And it's been hilarious just to see who would catch is like the people that calm off. That's been my favorite. And I think it's like a little bingo board now of, you know, who does it catch today?

Xavier: I should do something similar like that, in a past company, we used to have a people that like to log in from home. They like to lend us computers and stuff to the VPN, and they used to do this similar action with them, blew them off send them email.

Rebecca: So, I mean, yeah, maybe it was the first day it went out and obviously caught a lot of people and the amount of people that were like, I think there's this case we got, I don't think this is legitimate. And we're like, no, you should, you should just do what you're supposed to do. You're good.

Xavier: you would do what the judge says

Rebecca: Right

Brian: Yeah, no, this is the good Keith urban judge Dredd, not the bad Sylvester Stallone joke spread. Right?

Rebecca: Of course. Okay.

Brian: Okay. Just making sure I can't support that Sylveste Stallone one, right? Oh, that's a good one. That brings up Slack too. So everybody uses Slack.

Xavier: We use, team by now, man. All in, we went on, we went all in with the poker chips and the Microsoft stuff.

Brian: Ernie What about you already are Slack?

Ernie: No, we don't. So we're not really in the cloud. So to speak so much, I mean, some of the stuff that we do internally or with vendors and that sort of thing is Slack based, but we're not, we're not doing that.

Xavier: And he started their pocket, right. Plain old telephone.

Brian: That's that's I wouldn't die in Slack, actually, actually one of the things we did was actually invited some of our key clients into our Slack channels and stuff. I guess it's easier to get in touch with them or put them in school for them to get in touch with us. I mean, you know, just you're right there. Boom. We know who you are, right. Ernie. So, so what was the, what was the black bus that came out of the dark and gotcha.

Ernie: Well, I mean, I, you know, I certainly wasn't expecting this. Right. wait, it wasn't in your TTX. Yes. I think that, I think that we, you know, there were always like some kind of disaster or something like that, but I mean for actually to happen and, and I guess, so, you know, we had to ramp up some capacity, that stuff and that sort of thing, but we really didn't change a whole lot.

Other than that, I think. Most of the guys on my team had really kind of adapted to it and that sort of thing. you know, and we've got a pretty good culture. I mean, no one really gets excited if, you know, somebody has kids screaming in the background as an it organization as a whole. And that sort of thing. I think that, that, you know, depending on your environment, you know, stress, there can just from not being able to isolate yourself from your family and stuff like that, could really kind of be overwhelming. And that sort of thing, but it hasn't really helped got us so much. I think one of the things that, like one of the unexpected things that happened to me really was it's the.

Like when we look at security threats that face us and that sort of thing, a lot of times it's more internal or introspective, you know, like how do I combat this? you know, are our controls effective across these different areas and that sort of thing. But I really wasn't planning on like having everybody's workforce, you know, that supports the company and, and businesses that we work with and stuff like that to get pushed into this remote model. So where they're struggling to adapt to the changes and that sort of thing. Right? So like it like the recent ransomware incident with Cognizant. You know, like I'm, I'm really sensitive right now to, supply chain problems and that sort of thing, because everybody's workforce has kind of been, you know, kicked out of their normal environment and they're more susceptible to, you know, the social engineering that all of these bad guys are up to.

And I think, based on some of the, you know, if, if you follow your threat feeds and, and the news, I mean, obviously the guys there, there may have been a, a slight low in the beginning. But they're definitely ramping it back up. So, you know, we're, you know, I'm, I'm looking for ways to stay ahead of that to get, additional visibility and to, you know, what these guys look like as they come in and help us. And as we're dealing with them through email correspondence and, and who knows what else? Right. just to kind of get ahead of that a little bit. The other stuff that like I wasn't really ready for is like, so I got a new monitor and I needed to get an external webcam just for this thing. So working on find one, I mean, there's just nothing, you know what I mean? It's just kind of a, it's just kind of nuts. I don't know, but I don't think that that's really impacted us just to find one.

Brian: Yeah, it's interesting because, there's a, at a certain level of employee or mid-management above, you probably have a decent place to work at home. Things like that for the everybody else. They don't necessarily, they're not necessarily set up for that. You know, and, and so you send them home remote, you know, they don't have, they don't have bandwidth, they're sharing a place with three other people. And so that, you know, nobody, you know, they just switch off who gets through the kitchen table for, for, you know, conference calls and stuff like that, all the way down to, I had a guy here the other day come in and, and, He's like, look, you know, my wife took over the, you know, the actual office at the house. He's like, I've been sitting on this stool for three weeks. Can I take my, my office chair home with me and you killing me? And I, you know, never even occurred to me that, you know, You're going to forget to take it all just to ransack you sat on a stool for three weeks.

Xavier: That's ridiculous. That's ridiculous. That's all I got was just to ransack the office, grab whatever, take a picture of it, send it to the HR. Sorry. HR guy in HR.

Rebecca: So Everybody's taking their monitors chairs. I think I have some whiteboard markers here that are like, I don't have a.

Xavier: I did have a, I don't have printer at home, so I had to print something. So I went to the office like last week just to do some printed and it looked like it literally looked like a seed. How the walking dead there's wires hanging everywhere. Like it was like, it was loaded. Everyone's grasped out that abandoned. They're like, yep. We'll that? There's chair, drag marks going out the door everything's coated and literally said we just picked up and left. And I guess that's what we do.

Brian: That's really an aspect of this is, is, you know, not everybody was necessarily set up with space or anything at home, you know, you're just like go remote. Good luck, right? Yeah. Laptop. Yeah. That was another one. I don't know if you all have experienced this, but, I didn't think about a non laptop sort of environment, but a lot of our larger clients, that's not how they're set up. Right. A vast majority of their users have, you know, some little small Dell, you know, to blacks or Lenovo, you know, when these little mini ITX sort of sort of boxes sitting on their desk and a monitor. And, you know, so you send them home and they're going to do what, you know, and even worse. I've heard ones that were boxing up like computers and sending them home with people. And then of course, you know, a day later the help desk is at a hundred percent capacity because people are like, I don't know, I have a green cable and a blue cable. Which one are you talking about?

Xavier: Or they call it, the website is down.

Brian: you know, stuff like this. Yeah. So, some oddness there. Alright.

Rebecca: Not having a working laptop or being in a desktop environment. So my mind is blown out right now.

Ernie: That would be a drag, no doubt.

Brian: Right, you know, for most of us was easy for a lot of companies. It wasn't that, and I think you touched on this before, but it was, the VPN capacity thing. So we, we heard that from a lot of clients that like, you know, Hey, we, you know, we never factored, you know, 20% of our workforce on the VPN was kind of where we were at. Not, you know, 90% of our workforce on the VPN.

And, I talked to some clients that just had to add, to tell people like, look, if you, if you are not, these people just don't get on. We're still paying you. We'll call you if we need something, but don't get on the VPN. It just, you know, things like that. that, you know, having to ban things like people tunneling their, Netflix through the VPN and other stuff, causing all kinds of damage. all right. So coming back around to my questions here, alright. So this is the slightly weird one. Still not my favorite one, but it's close. So Xavier, what advantages, have you, have you discovered from the mandatory quarantine where'd you learn to like was unexpected and it's like, you know, this is a way better thing. Now that we've done this.

Xavier: Probably didn't want else to running a 24 seven operation. A lot of the analysts never really talked to each other. you know, you got night shift, you got a day shifts and then they don't really come mingle too much. so I seen that, you know, now we've really driven everyone towards, you know, chatting and video chatting. you know, it's been the main way I've communicated with them and everyone else. And the way my manager communicates with them, And I noticed like, you know, our, our main, like a soft chats where we kind of just talk freely, it's been way more active. so I feel like, you know, the culture's kind of changes where like, you know, they're all talking to each other a little bit more, and then they're like, Oh, third, everyone responds over this chat really well. And I think if they can start asking more questions and then noticing, you know, since it's going, they're kind of forced to be the communication tool that they've had a better, communication with each other.

Brian: Is there a downside to that because I mean, I've also heard people getting just like burned out. Cause every day is the same day and people just approach you on Saturday and you're like, well, whatever, it's just going to be here anyway. So I'll work Saturday and then they, you know, contact you on Sunday and, you know, and on and on and on. So you're just on just like endless week.

Xavier: Right. I would say that could be downside now that, you know, everyone's like, Oh, I can get to this person at any time, things, but, you know, I don't think, you know, talking more co-mingling between the SOC analyst.

Brian: Better communication.

Xavier: Yeah. Like I seen him actually talking a lot to more. We were in our Sasha, so we keep it pretty static. Like no one really stressed around too much. Like we have like, you know, this is pretty much their ship and it's always going to be their shift. You know, unless they want to change otherwise. So it's nice to see the it's nice to see them talking a little bit more, or even communicate with me a little bit more, you know, sometimes they'll, they'll message me. They see me on at night and they'll be like, I think I saw something weird and don't check this for me. Otherwise, otherwise, you know, I have to go through the escalations. and you know, if it's something really minor, sometimes they might not feel like it's escalation where they just close it. So I'm gonna have to, you know, the communication's been a lot more open.

Brian: All right, Rebecca what about you?

Rebecca: Yeah, it's interesting how you said. so I think our Slack in general actually have gone down a little bit. However, we stood up a discord channel. so it's almost like the side I could still hang out throughout the day. so we've just been communicating and just different methods a lot more. I'd say the biggest advantage would be just the flexibility. I mean, especially. No in the DMZ area, she's not having that commute is pretty sweet, but you had a couple hours back. and we've seen a lot of people just taking breaks throughout the day, whether it says, have lunch with their family or work out or taking more mental health breaks. And I think that's been great to really implement, so yeah, so just trying to figure out that flexibility. I know at least one thing with our team, we had some really big initiatives. That were going on during quarantine. So we definitely had to deal with some burnout. So, well, you know, just one of those things of noticing. Alright, well, I've these two analysts on my team that have kind of withdrawn to put them on PTO for a couple of days and talk to them to recharge and, and kind of get back to a normal state.

Xavier: That's a good point about being in family more. You know, I have a one year old son I've spent an immense amount of time with them more than I ever have before, because now, you know what waste here, which is, it's actually been really nice to see him, you know, every, I don't know, communicate with them rather than him being away for eight hours come home. And that's all it's bed time.

Rebecca: Yeah. I don't have kids, but I'm extremely obsessed with my two year old lab. Yeah. So I do definitely take breaks to go throw the ball in the yard.

Brian: So the dogs are winning here.

Xavier: That's a good call I have a bulldog so She just sleeps whether I'm here or not, she sleeps.

Brian: What about you Ernie any big advantage that you guys picked up on during this whole thing?

Ernie: Yeah I, I mean, it's not. I've enjoyed my little two month into remote work and that sort of thing. It took some getting used to, I mean, not having to commute. I mean, I get about an hour and a half to two hours back every day. and, I probably turn that into more work time though, to be quite honest with you. And I think that, you know, for the most part, a lot of the guys on my team are, or have, reflected that. Where, you know, they, they like having the flexibility to be at home and they're able to cope with the stressors and stuff like that, that, that brings along. but yeah, to your point, like the family thing, you know, it's, it'd be one thing to work from home for two months and not have anybody here, but it's a totally different thing when there's five people in the house, all jammed together, driving everybody crazy and stuff like that. Right. So it's just, you know, it's kind of. Yeah, that's been a lot of fun to be quite honest with you. I think that like, my kids are so sick of eating hamburgers off the grill, you know, because I'm like, Whoa, you know, I can go outside and cook a hamburger. They're just, they're just so tired of that, you know?outside of the personal stuff, I think, you know, I think what's kind of nice. What's really kind of nice and cool. Is it just kind of seems like, everybody's just really kind of pulling together. On this thing. Right. So, you know, and I really feel for the sales guys and stuff like that, and I'm in, can you imagine being in a sales role, having to call on people and stuff

Brian: Of Course were the first one fired at most places I was.

Ernie: yeah, that's true, but I mean, everybody's just really kind of respectful of the situation and everything like that. And there's more, it feels like there's a little more personal interaction, even when you're dealing with people outside of the company and stuff like that. And then, you know, there's really been some remarkable, information sharing that typically would be intellectual property for companies where they're releasing threat intelligence and stuff like that, based on COVID related threats and stuff like that to the public, you know? So like Microsoft started doing that and there's some other guys that have kind of opened their stuff up a little bit or, or offered even free services to people that are trying to cope with, you know, all the change, I think that that's been really cool.

Brian: All their COVID phishing, the dump it all out on github.

Ernie: Yeah, yeah. The sentinel stuff and all that sort of thing. Yeah, you know, so, so that's, you know, that's been, that's been good. Right? so it's, I mean, if there's an advantage to it, I think that, you know, it's just everybody kind of coming together and helping everybody home and then, you know, spam to get thrown together. With the family and everything like that.

Brian: That's why I go to the office every day. So I don't have to deal with any of them. And there's nobody else here. So I've got a 3600 square feet office there, you know, three bathrooms, kitchen. It's it's wonderful.

Ernie: Yeah. It's not like that here. You're like, I'll have, you know, people run around behind me or the cat tearing me up or whatever. It's always, something going on.

Brian: all the bandwidth, like the only downside is the phone. I still gotta answer the phone, which I have a newfound appreciation for my receptionist because, Oh my God, the number of calls that she must handle in a day, it's ridiculous. But I'm sitting here. I can't let it ring. So, alright. So a final question, and this is my, this is my favorite. Going back to Xavier, what was the future look like for your industry, your company specifically? I mean, you know, how, how long does this thing go on? You know, what, what does it mean to you guys?

Xavier: Right, right. So, you know, here at Blackpoint cyber, you know, we're just, continuing to evolve with the threat landscape pretty much, you know, that's the risk it's changed, you know, for, partners and it's even changed some of the way we do stuff like, you know, we, you know, I've been writing rules more based on, you know, cases that could happen at people at home, you know, essentially documents or, you know, Someone getting in and written around maybe from a, you know, from the home, into their, their devices. So then, you know, kind of writing a little bit more different rule sets based on that. So they're just gonna continue to, to tune bands and then move on. You know, luckily our developers, working out. It's all fine. The kind of lane we've seen, no productivity lost at all. probably if anything, it'd be an increase, from, a lot of our, you know, sort of element.

So, you know, we're just gonna, we've been keeping down the path, the future looks great. I think even more after this, this, I think there's going to be a big shift into a lot more acceptable remote work here, we've kind of proven, you know, to the company and all the players have proven to us that. Ah, that's stupid, really doable, you know, it's, it'd be nice to give me an option to everyone.

If they're willing to continue doing this or maybe split things up, like, you know, if they want to do come in and just for the environment to maybe do a little, you know, a couple of three in the office to Al you know, to an office three at home, really, hopefully I'm up, you know.

Brian: That remote work really justifies that MDR solution, right? Yes, yeah. All your people are remote. What's what's wrong with us being remote, right?

Xavier: Exactly. Yeah. Exactly right. Yeah. So, yeah, so that the future is bright. And I think for the industry, you know, we service a lot of MSP partners. You know, I just continued on with helping them understand, you know, different, new risks that their clients are going to be coming across. You know, I talked to our sales VP this morning and I asked him, I was like, you can any different questions, you know, it's even asking me things like, you know, how would this. You know, what did your service help us with remote workforce and stuff? He says he doesn't get too many questions like that. And it's not, I don't know if it's because of not educated or they just don't think to ask yet. Most people just share stories about coping with them. So going to journey's point, everyone's coming together, you know, salespeople, they're at least getting sharing some stories together about the whole dynamic.

Brian: Now, have you had clients who have endpoint packages? To home users, computers and things like this.

Xavier: I would say yes, probably. I don't know for sure. But, I would imagine, you know, I see, you know, and I've been known to be a good staff, you know, when we do our product, it's will be interesting to see how many new network maps I can created compared to before, you know, because then it would be someone's whole network that's been mapped out, I think kind of an interesting thing. That's all we need before this PowerPoint slide.

Brian: No, I mean, I talked to several clients who, that, that had been their, their solution, especially when they realized they didn't have enough equipment to go around is they just started to push in their end point security stack to the home users, stuff like that. Just go and look, you know, We can't really let you on the corporate network, unless you, we know what's out there.

Xavier: And that's smart. I would, I would do that in my case, everyone in our company is using the corporate stuff. Cause it's probably a better machine. And now that's, that's what you do. You make sure that you can get machine again and better than the one they have home. I'll guarantee you that. Let me see. Oh, what was I going to say? I don't remember. I remember it. I'll let someone else talk.

Brian: All right, which are listening to me anyway, Rebecca. So, so again, the questions, what's the, what's the future look like for the industry? Really? You're all kind of, well, you know, different industries, but, and then, you know, IronNet specifically.

Rebecca: Yeah. So I'll just start with IronNet specifically, because it's easier. so we are moving primarily just from moving forward, and so I think, I think given us a really good test run of how it's going to look and how the feature is going to work. Even a lot of organizations that I have talked to, even when they're allowing people to come back in the office, it's very pure systems.

So, you know, one person per office. And so you're going to have offices at a capacity of 30% filled. So realistically, I don't think anybody's going back to full time in office anytime soon. And I actually really encouraged, again, the flexibility of remote work, with Ironnet as a company, not just our SOC, I'm actually very optimistic about the future with us. I think. With having everybody being remote, it's put in cybersecurity and threat sharing a little bit more in the forefront. So it's something that really interested with iron events is our whole purpose is the idea of threat sharing to, you know, for correlation within our, Iron dome. So I'm definitely optimistic about using some of the use cases that we've had. Throughout this period to build the added to our industry. And just to see how many tools are kind of built from this time period, moving forward in general.

Brian: Yeah. I wonder if that's some of what you're saying or any, they're just people willing to cooperate a bit more, you know, some of the threat groups, you know, cooperating that normally wouldn't have worked together, things like that you could be right. I mean, it could really. Spur that kind of, you know, hacking is bad in any forum and we all, we're all better if we're protected from it sort of thing,

Rebecca: Right. It'll either you add or receive to get back in. We'll forget about everybody else.

Brian: Again. That is pretty much what we do. I focused on me. All right, Ernie, what about you? Because you're, you are squaring center of healthcare, there.

Ernie: What's, I mean, so it's like the future for the industry and companies like this far above my pay grade pay grade.

Brian: I heard it was like, for me, like three you're on the fast track.

Ernie: You know, health, healthcare. I don't really, I don't know that I really have any insight into that sort of thing. I mean, I'm not, I don't, I'm not really overly worried about. The future, so to speak, but some of the points you guys were making about, you know, like remote work and how you guys are moving to a more remote workforce and that sort of thing. I think that, you know, as, as like a hiring manager and stuff like that, that, you know, everybody's now going, gonna get to deal with, with that, so to speak or where either your total, you know, if, if you're all on board with the remote work and that sort of thing, you're going to have a much larger pool. Probably, candidates. And then if you're, you know, if you're going to be an on-prem only kind of thing, well, chances are now you're, you're going to get to compete with everybody else regardless of where they're at. Right. So I think it's from an, from an eight, from a human resource perspective and stuff like that, it's really kind of flattened.

We'll see what happens with it. Right. Because it could be that, you know, I mean, for the most part, I think everybody on the calls. Had hasn't been really, you know, negatively affected by their workforce, you know, being able to execute their mission and stuff like that. But, you know, it could be that everything just fell apart for somebody else. And they're like, well, no, we're never going to do this remote thing again. Aand, well guess what, you know, your, your talent pool is going to be greatly reduced. Cause other people that are. In your geographical area and stuff like that. Now we're going to get to, to look at jobs that say remote all the time available on and that sort of thing. So, you know, for me, I don't know that's a problem or anything like that, really, but I just think that, you know, how we do things, not just information security, but as a whole, we're going, gonna look a little bit different when it comes to that perspective. You know, and then the other thing is I don't, I don't know that like, I think they, everybody's trying to cure up and get back into how things normally were, you know, but like, I'm not sure what's going to happen this fall. Right. I mean, so, you know, a lot of people have family and kids that they have to take care of and you know, there's no such thing as daycare when all this stuff is going on and homeschooling and stuff like that. I think that, you know, There's no telling what will happen with all that. But you know, my reflection on that is that, you know, our management and that sort of thing is doing the right thing and they're going to take care of everybody that's working for them and that sort of thing. And, I think that our response to that so far has been great. And then we'll continue to do that, to support everybody that works for us and everything like that.

Brian: I think it's probably definitely changed that upper management view that you know of people working from home or screwing off. Right. So everybody's doing it now. All right. I have a secret fifth question that I didn't tell you guys about. I hide this one. It wouldn't be any fun if I did it straight up. So how long is it before you feel comfortable? Again, being in a room of 50 people.

Xavier: Good question.

Brian: I throw this out there every week and I get exactly the same response from all the faces they're going to go. Do I know them.

Rebecca: Do I know that how big is the room can we appropriately social distance within that room?

Xavier: I'll do it for, I'll do it for a hundred bucks.

Brian: Xavier sold out cheap

Ernie: Right. Yeah. Is there candy?

Xavier: I don't know. yeah especially all these conventions being postponed I heard one everyone's gonna try to do, I can't know which one was going to try to actually do thus contract I think is for October still interactive I would do an in person. So I was like, good luck.

Brian: I questioned what's going to happen in the next 10 days after the Memorial day weekend and some of the various beach and boardwalk scenes that I saw, I feel like we're going to have a bit of a spike here. That's, not, not great for everybody. Although there's, there's whole rural areas of the country that are practically. A hundred percent unaffected.

Xavier: Yeah. Nice, nice Pennsylvania, West Virginia.

Brian: Yeah, exactly where they just they're like COVID what, like

Xavier: No one comes here, no one lives here, They are being quarantined for life, there'll be no change.

Brian: which I think contributes to some people's frustration, right. Is that, you know, if, if there's no cases and there's not expected to be any case, you know, why should we be doing any of this? That's silly or Willie, what seems so we do them all righty. so, so anybody want to give me a hard, fast date when they're good with that 50-50 room people?

Rebecca: No way. Oh,

Xavier: I'd probably be okay with it by the end of the year,.

Brian: End of the year?

Xavier: I'll take out November 27th, November 27th. I'll meet everyone. Can Mark a calendar. It's hold me to it.

Brian: 49 people afforded out of the walking dead.

Rebecca: There'll be a big group this summer, but especially if we don't know, you know, if a second wave is actually going to happen or not, to me, that's the biggest thing with, with everything with COVID's

Brian: There's still so many unknowns or things that we think we know turns out that in that case, Last week CDC puts out something and it's, you know, doesn't live on surfaces this morning at sea. It lives on surfaces again. It's like,

Xavier: it's like those, the studies they always do like coffee, coffee, coffee. Yeah, it's all a bit up in the air.

Brian: I appreciate all of you, agreeing to do this with me. It's this sort of silliness, and a lot of fun. I may call on you again in the future for, for various mixes and matches with it with other groups of people. but thanks so much for being here. there are no home additions or episodes or gifts that I will send you. So don't look for anything in the mail. And what else do we got going on? Oh, next week, next week. I don't know how you know, I don't know. It's all the same days to me now. We are doing, Oh, next week is the wild bunch.

Alright, they're going to tell you who it is. This, this group. Maybe they ask questions next week. So it's going to be, Brian comes on and then these guys just start arguing. So thank you all so much.