Joe Carson | Now that Everyone’s Home
In this episode of The Cybrary Podcast we hear from Joseph Carson, the Chief Security Scientist for Thycotic. Speaking with Mike Gruen, Cybrary's VP of Engineering, they talk about WFH best practices and the unique issues that arise when your family is home as well.
Share it with friends now!
In this episode of The Cybrary Podcast, Cybrary's VP of Engineering Mike Gruen is with Joe Carson, the Chief Security Scientist of Thycotic. Having worked remotely for over 15 years, Joe shares the best work from home practices to us amidst the pandemic.
The first thing to consider when working from home is connectivity. Joe addressed some common issues that affect connectivity and security. Joe admits that parenting requires a ton of effort. He and his wife made a schedule that proved to help organize their kids' daily tasks. Joe advised that finding the right work-life balance is essential. Mike and Joe discussed how they communicate with their fellow company members using various video conferencing apps. Joe stressed the need for security when transferring sensitive data. He noticed that IT security professionals are bewildered at this rough time since most of the security controls aren't being implemented. Joe recommended that organizations should provide education and training to employees to enhance their skills. Reading books has become a part of Joe's leisure. He sees this time as an opportunity for self-development. Since the start of the pandemic, Joe noticed an increase in attendance of webinars and podcasts, which he thinks is great. He believes that technology truly helped us to cope up with this pandemic. Mike and Joe shared similar scenarios of how technology helped to teach their kids new skills. Joe shared his experience working as a Desktop Support for the Northern Ireland Ambulance service. He realizes the stress that healthcare workers undergo at these times. Joe is confident that we will find new solutions in the future to deal with these kinds of situations. We will improve ourselves from the lessons learned and be innovative. Mike and Joe ended their talk by thanking all the hardworking individuals of the healthcare services.
Mike: So, Welcome to another episode. This is Mike Gruen. I'm here with Joseph Carson from Thychotic. I'll let him introduce himself.
Joe: Sure. You know, it's a pleasure to be here again, Mike, and we've had discussions in the past and, so I'm based in Tallinn, Estonia. I'm the chief security scientist. And, you know, I've been working from home for a long time. And so given the current situation, I thought it would be good to have a discussion around, you know, some of the new experiences that I've had over the past two weeks that have been something that I've never foreseen before.
Mike: You know, I agree. I used to work from home for a while and I had two smaller kids. It was a little bit of a challenge, but a little bit easier because they just stayed on the other side of the door and didn't have as much, cause they were really little that there wasn't the homework and the rest of it. I really enjoyed, by the way, I know she read a blog. I really enjoyed reading it. You know, is there anything, you know, just sort of from there that you'd want to sort of some tips and things that you might want to summarize.
Joe: I mean, absolutely. I mean, one of the things that I've been working remotely for 15 years, and I've had a lot of lessons and experience from, you know, electricity going off and having to switch the battery to make sure you stay connected. I've been in situations where I've had to take emergency calls from bus stops. I've been in remote islands doing webinars. Even though, the last, during the swine flu. I was actually self quarantined for just over two weeks with the swine flu.
Mike: Oh, Wow
Joe: So I don't like to be in isolation as well. So some of them, you know, that I've had is really ironic, It’s one of the most important things we always have that question starts off with is staying connected. That's where you kind of, you know, when you're working remotely, you're working from home. One of the first things you want to think about is your connectivity. What's your network bandwidth? Is it, you know, is it limited or unlimited? Are you sharing with other people, you know, other family members? Now It's not just you at home. You may have a bunch of kids and you may have, you know, your spouse or partner that are also connected and using up that some might be watching, streaming. Some might be surfing, looking at, you know, videos, or whatever it might be or listening to music. And you're having also used, you know, for work-wise. So, you know, connectivity becomes important, understanding your bandwidth, switching off hungry bandwidth applications. Even, you know, it gets into the point of security side of things is that your laptops in the same network as those devices, can they see each other, is your file sharing enabled and print sharing that's enabled in those devices. So sometimes even I would recommend is when you're on a home network is you create a dedicated guest network that is separated and isolated just for your work devices. So, therefore, you can also then maybe even decide to throttle other types of applications as well or give time limits to the kids these days. And that's where you kind of get into is that isolation. And then also thinking about when to switch between, you know, using your wired, wifi or mobile and to get the almost optimum speed as well. And those are some of the things, you know, and also make sure that your network itself and your home rider is not default credentials. Most out there might, some might even be using older wifi authentication, even WPA, or WPS that has known weaknesses. So it might be a time to make sure to revisit that and choose a much stronger and also change the default passwords as well. So connectivity, that was one of the most important lessons I learned is that wherever I am, I have to figure out how to stay connected.
Mike: Yeah, I totally can relate. Earlier this week I got kicked off or my laptop refused to join the wifi because there were too many other devices on the wifi. So, definitely set up a separate one, a separate VLAN just for my work computer. One of the other things I think is interesting is knowing when to use the VPN. You know, if my office has a VPN. Why should I be on the VPN versus when shouldn't I be doing the, you know, zoom VPN sometimes not ideal.
Joe: And that's, I've had the same thing is, all of a sudden recently, you know, I have my VPN zone by default and all of a sudden I have to switch into a zoom call or, you know, go to webinar or something, whatever it is to do like a collaboration. And all of a sudden, it's just taken forever to connect.
Joe: What's causing it and we know what's happening. And then you realize, Oh, okay. You know, I've got VPN connected and this might come through different, you know, locations in different, you know, like different, channels. And you're also using computational bandwidth and you have a VPN on, so absolutely you have to decide, you know, when to disconnect and connect again, are, you know, hopefully it's asleep. You might say, turn it , you know ,off for two hours and reconnect back again. Cause security at this point is, you know, you want to also, you know, maintain connectivity, but at the same time, you also do want to ,you know, increase the risk and disable security at the same time.
Mike: Right. Another thing. My friends and I were just talking about yesterday with regard to VPN is, make sure that your network doesn't collide with the corporate network. I use a 172 dot 16 at home because at several jobs, I go, they were using the, you know, 192 dot 168, which is like, that's what everybody's home is on. So, just knowing how to troubleshoot that and recognize when there's collisions and how to deal with that is I think an important thing as well, test ought to be.
Joe: Absolutely, I've had similar experiences that, you know what, we're, you know, I'm in my kind of lab environment right now. And there's a lot of things that you wouldn't want to be connected. So sometimes you absolutely have to be very cautious. I did, you know, create network that's been separated here just to make sure I don't have those collisions as well. So, but there's another big lesson I've learned and you know, a lot of the things I can share has been good experiences, but one thing I know that every person and it's been different experiences over the past few weeks has been sporadic but the thing I faced that, but I'm based in Estonia and about a week and a half ago, we got the announcement that, you know, schools are closing. So I have been working home. And it's been no problem doing my things. You know, everything's been great, you know, moving along with my tasks and projects and so forth, then my security research and then all of a sudden I've got the whole family at home, kids at home and not just being at home and not having, you know, nothing to do or just end up being on a computer watching, you know, whatever, you know, movies or whatever,
Mike: Sucking up all your bandwidth
Joe: But they're also, they're doing homeschool. And so one of the things, you know, we quickly realized. This could go really bad. So me and my wife got together and we made a plan the weekend prior to going and we went through and we created a schedule. We mapped out all of their classes that they have, the breaks that they have, what projects are going on. We, I, you know, set up, you know, of course, and not every family has multiple laptops or devices they can use as well. And that also becomes a challenge. You might have to share one between, you know, siblings. And so getting it all setup and getting a plan and we thought we'd done everything from lunches. And we also set up a plan so that the kids could also help as well. So taking out the garbage, making breakfast and stuff,
Mike: Emptying the dishwasher, cause our dishwasher's running nonstop now
Joe: Even you know, sometimes even electricity companies are making, you know, huge money right now because we're using it during peak times too.
Joe: So we can use your electric bill.
Mike: Well, it's not peak times now in a way.
Joe: Exactly. But these were so Kim to the first Monday, and I, and we kind of set up my environment. So I had my working space at home. My wife had hers set up and we had the kids set up. 10 minutes into it, It's all gone chaos. You know, questions that my kids are doing Russian language, they're doing different tasks or they're interrupting each other. So they're interfering with each other and just goes, okay, no matter how any parent plans for this, not only are you working from home, but you're becoming a full-time teacher. A full-time chef, a full-time dishwasher, full-time laundry person. It just means that. You're taking on these additional tasks that you may have separated or done individually, and it's still all happening at once. And what I find this past week and a half is that you really need to switch days, decide who's going to do what work one day, and then try to balance it back and forward and get the kids really involved in also planning and having some reward system to make sure that they stay focused and motivated. And this is, I know that every listener to this is going to start relating it in somehow, even worse is that when we started this a week and a half ago, and we thought, Oh, you know, the school's announced that it was only homeschooling and, you know, for two weeks, One day into the second week, we got told that this is going to go on for another three weeks and maybe even to the end of the school year.
Mike: Yeah, we just gotta send more notice.
Joe: I just put my hand on my head going, Oh my goodness, how am I going to survive this? And I think this is, you know, all my best practices and experiences of working from home will help people. But these experiences, this is really by getting a balance is by good communication supports, you know, everything you do for yourself, work-wise, you'll have to actually incorporate that into your kids and your spouses and partners, wives. It’s a really good, solid communication, who's going to do what, when and when you're in self-isolation or you're you know, isolating, quarantined at home. You can't get out. You know, it's not like I'll go for a walk and just get out of, you know, and get some fresh air. Is that you have to kind of bear with us during that time as even getting the challenges that you've mentioned, these choice yourself is you opened up the fridge in the morning and it's also empty.
Joe: And then you get into these other challenges. So, For remote workers, I think this is going to be probably the most challenging, you know, lessons learned at the liver have sometimes there's no way other than jumping straight into it. But you know, I've learned a lot of new things, I can tell you in this past week, just to like yourself as, you know, bandwidth, connectivity, and, you know, more devices connected through the wifi than there's ever been before in time. And all day 24/7 all day long. So, you know, staying connected, but also good planning will definitely help people get through this and then prioritization, communication.
Mike: I think, I mean, staying connected and balanced, there's also a space for essentially disconnecting or like one of the things when I first started working from home, I noticed was, I just felt like I'm at work all the time. It's just easy. I could, like it didn't even, I didn't feel a burden of it. I just felt this draw of, Oh yeah. I'll just spend another five minutes. And next thing I knew it was midnight. And you don't, you know, just so making sure that you have that like disconnection. And one of the things that I do that was that I found really helpful. Cause I have my room. I closed the door and I have this like threshold, right. When I crossed this threshold, I'm in work mode. When I crossed it in the other direction, I'm at home and try to really not feel like I'm always at work. Like and so yeah, if I'm sitting at the TV and I have a brilliant idea, you know what, it can probably wait until tomorrow, just like it would’ve had I not been working from home
Joe: Just write it down and put it to the things that list to do later. I mean, I have the same when working from home for the last 15 years, I made a decision actually three years ago and I had the same challenge that I used to have, even in my home office door. I had a sign that says working and the other side that said playing. So at least people knew that, you know, I'm either at meetings or I'm focused on a project or I'm just doing research implying. So at least people in, you know, in the house knew what activity you were doing at the time. It was nine o'clock at night. He had playing in the door, you know, knew that it could come in and disturb you and so forth. So it's really having that also letting yourself know, but also letting other people know what you're doing as well. But I made a decision three years ago, that I separated a home office to a small office away from home. So that meant that you know, you're getting up, you're getting dressed in the morning, you're getting fresh air and you have a bit of a walk. And it also has that separation so that, you know, I'm in the office, I'm in the office working, it's dedicated so that having that, you know, if you can't do that, Not everyone can, but like yourself have a dedicated place that you use all the time for this for your work and
Mike: I say, I mean, it could even just be a spot at the kitchen table. I mean, it can, you know, just, but I think it's important to be able to like, sort of have that like, I'm working now, I'm not working like being able to turn that on and off.
Joe: I think it's having that sign, you know, whether it being a Pomodoro timer or whatever it is that, you know, we would have used in the past for meetings, but having that timer and setting it for 45 minutes in an hour, you know, and having that time you'll get up and walk around. But you're absolutely right. You know, you want to sit at the kitchen table, have a good seat that you're sitting up, having good lighting, having, you know, power connected, having something that's dedicated to that work. And that means that you can, you move away and leave it and come back. But it's also important to take breaks.
Joe: One thing, you know, it's not just about, you know, having that stop and start when you do work, but also you need to stand up. You know, one of the biggest things I find working from home is health is even if you're working from home, you know, at the moment it might be difficult to do it, but even to walk out and walk, get a five minute, 10 minute fresher. Before you come in to do start your work, just to have that type of separation, and standing up and doing some walking, at the moment, it's a bit challenging with being quarantined or siphon, you know, isolation in some places, some people might be able to , some people not but it's important to have that. Get up, get dressed, go get some fresh air, take a walk. And then come back in and then start to work. Don't kind of just walk from your bedroom into the kitchen table and start working straight away
Joe: Have a routine, have a good plan that has these repetitive things that you do. And I also recommend take your full brakes. I know, take your full coffee break. And I remember, when I started doing this years ago, that I all of a sudden get a coffee, get a lunch. And I'd worked through it and they forget to take lunch and you get into these bad habits of not taking the breaks. Take the breaks. And today, you know, you might get on a zoom call with a friend or a colleague or a peer and just have a chat.
Joe: During these times it's still important to communicate, to collaborate, to get some type of online social interaction. I know people have been doing birthday parties online using zoom and people have been doing just virtual coffee hour or happy hour and even tomorrow
Mike: Yep, we have a virtual happy hour on Friday. We started out with a smaller group and now it’s all, the entire company's invited. We'll see how it goes on a zoom.
Joe: That's awesome. I mean, that's so far it's been holding over, we're doing a pub quiz tomorrow, for our happy hour in the evening. So we're looking forward to that but definitely keep, you know, make sure you take a break, be sociable and collaborate. And one thing is, you know, working from home, sometimes you feel a little bit isolated, disconnected. You don't see what's happening. So one thing I've, there's a couple of things I'd do through my week is a Monday morning. I cancel everything in my calendar and I block it just for reviewing and planning, what I need to do for the week. All my tasks and schedules reviewing what I was successful the previous week, doing a can of someone, you know, lessons learned and look back. And what did I miss? What they need to revisit again. Just taking that time to organize yourself is also critical. And then also during that time, I also see as here's my tasks that I have throughout the week, do I, am I dependent on other people to help me with those tasks? Can I do it by myself and also prioritizing it and making sure you keep that prioritization and mostly make sure it's in sync with other people that prioritizations tend to be changing and sometimes when you are remote or, you know, kind of working from home that those prioritizations get lost. So those focus get lost. So make sure that you also have those kind of weekly sync ups to make sure that everyone's going the same direction as well. Planning, preparing, planning, and prioritization and communication is key to making sure that we all say going the same direction.
Mike: Yeah, I couldn't agree more. And one of the things that I find interesting is, so for a long time, I've been working on my lead infrastructure guy. He's fully remote, traveling the world frequently, you know, five hours off, 12 hours off. He's, it switches all the time. Right now. He's 12 hours off. Having done that for a little while, has sort of prepped me a little bit for what's going on now because a lot of my coworkers that have smaller children and both parents are now, you know, are at home and both have jobs, the way they've sort of split things up is like, okay, from five in the morning until such and such a time, they're, you know, on their working. And then they take over for a little bit in the afternoon and then the other parent, you know, and they sort of have split up their day and so that means if I do need someone, it might mean, Oh, I'm going to actually have to get on at eight o'clock tonight, because that's when they're actually planning on working because during the day they were helping their kids with homework. So I think that's another thing to, you know, sort of on that planning is even if you are used to being on the time, same time zone, that's a big change that's happened now. A lot of people are going to be working alternate hours than what they might've worked.
Joe: Yeah. And with that, I mean, during, you know, if Thychotic, we do have a verdict, a global workforce, and we do a lot of collaboration. People are working from home, you know, that's our norm.
Joe: And so one of the thing is, you know, we have to get into point is we have to expect that, you know, people are going to have uninterrupted guests coming into your calls. You know, I don't, you know, it wouldn't be unusual to see it, you know, a dog in the background barking or a baby crying or kids looking for attention, or I've had, you know, my cat would walk across the keyboard all of a sudden.
Mike: Yeah, But I was just gonna say that the cat across the keyboard is classic.
Joe: So, I mean, we have to, you know, as you know, companies, employers. As well, we had to make sure that, you know, that's seen as okay. And it seems normal and we have to give them out attention and allow them to tend to needs at the same time. So absolutely, you know, finding that balance between, you know, the family life and the business is important. And, you know, we have to expect, there will be, you know, unexpected guests joining the calls at some point. And that's the norm. That's what we have to get into is as people's working from home, they will have their family around them. And it's important, to be also at the same time a world of who’s around you. So even when you're talking about sensitive content that might be company financial, it might be hiring processes, or it might be, you know, acquisitional details and you don't want those family members to hear. Then decide, you know, is now a good time to have those conversations or can you, should we switch it to later when it's a bit quieter when no one's around and not only about people, but also, you know, about who, you know, is your walls thin? Can your neighbours hear you? You know, are you on the balcony? Are you in the garden then?
Joe: Being very aware of virtual assistance as well, you know, Alexis. You know, in the background, that's always listening all those on. Then if you're having sensitive conversations, be very, very aware. So some of my recommendations is, you know, before you have those conversations, take a look around and just think like, you know, is this the right environment to have those conversations? Get a good headset. Get a headset that allows you at least to mute one side of the conversation as well, get a good microphone as well so that people can hear you clearly so that you don't get, you know, muffled noises. You don't get, you know, white noise or background stuff, get something that allows you to be heard clearly because when you are working remote, a good headset and microphone is as essential to make sure, you know, you're communicating. And that you're hearing correctly what people are saying, and also be able to, you know, people hear you also. So good headset and microphone.
Mike: It's funny you say that because five minutes before now, about 10 minutes before this call, I was scrambling. I was like, where's my headset. Oh, that's right. I left it at the office. Perfect. So I had to hop on something together and, for this. So, but yeah, I couldn't agree more than having a good quality headset and blocking half the conversation. The other thing that I think is especially with smaller kids and, you know, everybody has their own way of parenting and sort of recognizing that, you know, some language that maybe is appropriate at the office, is not appropriate for young kids and maybe it's appropriate for your kids and other people have a different opinion. So I think that's the other thing is just being aware andalso communicating effectively to other people on the call. Who might be within your shot, who they can't see, you know, just because you can't see them in the video. It doesn't mean that there's not somebody nearby. And if you're not wearing a headset, suddenly, you know, my oldest actually used to pop and he's like, you're talking to Paul, aren't you? Cause he could tell by the person's language, like he's the only one who drops F bombs all the time.
Joe: That's when headsets come in, very helpful. The other thing that really, you know, is also the one challenge that I've always had with working remotely is time zones, you know, and there's a comical meme going around right now, about, you know, this weekend in Estonia. We're putting the clocks forward one hour. And I, you know, everyone's saying, you know, Can we move it a bit further? Can we move it six months? Can we move the clock forward six months?
Joe: But also being very aware of people's time zones. So you're saying, you know, your point, as you know, in the US it might be a little bit, you know, where you've got multiple States having, you know, East coast, West coast and so forth. And in Europe we have multiple times almost to deal with. But just be very conscious of the other person's time zones as well, and make sure that you'll always have a kind of company culture of what time zone you're talking about, have a standard that's agreed upon beforehand. And when I'm always kind of, you know, scheduling calls or meetings or whatever it might be and what was putting, you know, here's my time zone. You know, this is where, you know, talk about your local time zone and be very clear to when you're doing those. So time zones is one thing I do hate. But there's a lot of tools out there that's making it easier today
Joe: You know, how'd that visibility of when people are, available and what time it is in their local location.
Mike: Yeah, The person I referred to earlier. Who's traveling around, he has an integration in Slack so that it actually says like, what time is it? where he is? Because he's traveling all the time. So it's not like I can just remember, Oh yeah, that's right. He's 12 hours or four hours. So that's a handy thing. And then one of the things I also learned to do was, like Google calendar has the ability to add a second time zone. So, you know, I deal a lot with people on the West coast. So let's just add that as a time. So it’s as well, just so that I can sort of eyeball it really quickly, nothing more frustrating than saying, Oh yeah, I'll talk to you at 10 and have two different definitions of what ten it is?
Joe: I mean, I had the same today. I was like, Oh was the scheduling Call for one o'clock today and I was talking about, I wanted, you know, can we have the call at two and they're like, yeah, we'll schedule it two assuming I was in the same time zone and all of a sudden, you know, I was like, I'm looking at the calendar invite. It's like one, I was like, okay. Oh, you have to kind of work around. So that's a challenge. And the other thing as well, you know, is collaboration. I think it's really important to choose the right tools as well. You mentioned Slack and you know, we're using zoom here to have this conversation across the world and they all work well, but it's really important as well, to make sure that, in these times, frequent communication is so more important, especially knowing what the other person is doing and what you're working on, having that, you know, I know that even if I went six months without being in the office, sometimes you just want to have a call or video call.
Joe: So sometimes now is a good time to even put the camera on. And have that visualization rather than just doing audio conferences and how that sense of team and, you know, knowing and getting to know how we communicate and how you interact with each other is critical. So, you know, and knowing what's the right tool. If you're going to have more sensitive conversations, then maybe certain social tools are not the right ones that might have be sharing data, might be collecting certain data. So choosing the right tool for the right type of communication is also critical. So I would tend to kind of, you know, switch between the things that like whether being Slack for that just frequent collaboration and sharing and making sure, Kind of like a replacement for email, but also using WhatsApp to do certain types of calls, when you're on the go or you're, you know, you don't make to have a certain connectivity, making actual phone calls, getting on the phone and, you know, communicating, using Zoom or Go ToMeeting. Using Signal or Telegram for different types of conversations, I even know that, there’s some journalists and some of my peers even get to the point where I'd find communications using one and inbound communications, usually another. So it's something very sensitive
Joe: Talking about maybe a data breach or investigation that they want to make sure that, you know, if it. Even they were hacked or, you know, a data breach and there’s one of those that they only get one's context of the communication. So some going that extreme, but you know, definitely use the right tool for the right type of communication is critical.
Mike: I would also say making sure you have a backup. So, right now, right, Like in our office, Slack went down. We can still talk to each other but now that you're remote, like if Slack went down, what would we do? And we had, luckily, Slack had gone down a couple of years ago. And I think it was like 2017 or so. And so we have a fallback and everyone on my team, all the engineers, on day one, when you start as an engineer, Cybrary, you get on key base and that's our fallback for, like communications. It's also what we use for sending super secure stuff that needs to be, you know, sensitive, end to end encryption, so, and sharing. So it's a tool that we already use, but then we also can fall back to and then. Last week, we had problems with phones, our sales team. We had just switched from one phone provider to another. I'm not going to name any names and they were having a lot of problems. And luckily we hadn't fully split. We still had the old account. So when the new one was having problems, we could fall back to the, you know, and I think making sure that you have those plans is an important piece as well.
Joe: Yeah, absolutely. I mean those are all part of the crisis management and incident response types of things you have and that, you know, I've always been, that's one of my kind of back, you know, history experiences. I've been involved in lots of incidents, lots of, kind of disaster scenarios.
Mike: I mean not to work with you
Joe: I'm still here. That's, I always, you know, they always say, there's a term, you know, if I fell into like a river of mud, I would come out smelling like roses. Oh, there's a common saying that we have. And this one thing that I've been always fortunate. Even during, you know, whether it being when I had swine flu and isolated, I remember, you know, this similar disruptions with flights, cause I do travel a lot as well. And I remember when I was on my way, coming back from Vegas during a major event. And, Iceland volcano decided to erupt, and it meant that all flights going from US to Europe had been canceled. So you have similar experiences and you look at those situations and how do you deal with them? And, you know, you just looked at me like, well, you know, it is what it is, and you'll find ways to get home, or you find ways in order to get by. And this is the same as now is unfortunately, you know, with the coronaviruses going around that, you know, we're in a crisis management situation and it's not just one company or one region. It's the world. I think it's one third or one quarter of the world is right now, and is in lockdown or shutdown for at least two to four weeks. And that does put a lot of incident response and some of my experience as well, just like you mentioned, you might be in transition of two technologies and sometimes that's your saver is that haven't completely left the first one to go to the second one. But since the second one is available, at least the first one is an option and I've had similar situations. I remember. I was working in foreign exchange and money markets. I'm certified trader from Pascoes. Some of the technologies, I like to know what it's like to be a user. And so, I've worked in situations where transatlantic communication went down. And it was lucky enough that we still hadn't left our, we were transitioning all of the cables, and ISPs across to new, faster, and that was the one that went down. And we were lucky enough. We had an old, I think it was like a 64 K line from an old ISP. And we switched all transatlantic communications over that one line and lucky enough, because it hadn't been decommissioned and removed, it was still there. And it meant we were able to continue actually European North American foreign exchange of money markets through that link. So you're always in a situation it's always important to think about, you know, backup, means and backup communications and alternative means these are so critical right now. And even if Thycotic, we have multiple, you know, and it's also not just based on types of communications of failures. It's also based on time as well. We have, you know, a 20 minute turnaround and one, a two hour turnaround and another two day turnaround then another. And they all fall backs on each other and different means of communication. So it was critical. Just get on the phone call it's urgent use. This means if it's not so urgent, you know, go to the another method. Certainly multiple means of communication is critical, but one of the things is from a security perspective right now. If you look at the IT security professional, their job right now must be chaotic. If I'm looking at, I even saw, you know, in the surroundings I am here, people were going into their offices, packing up their laptops or computers. Everything was desktops, you know, and they were going in different times of the day to do so. And they're walking out the door, putting those laptops, desktops in the trunk of, even huge iMac monitors and screens.
Joe: It can all under the office, in the book, a trunk of the car, driving it home and setting it up at home. This is the biggest mass movement to working from home ever.
Joe: And it means that, you know, you look at that at first of all, if you're a security professional, and you're thinking about what's on those devices. You know, what data on those devices? Is it sensitive? And, you know, do they have local administrator access? What applications that are on those devices? Can they still function? And now all of a sudden, those are taken from the secure corporate network where you hide. Security can have boundaries and security controls and IDSs, and firewalls, you know, kept people from going into bad websites. And we take those devices from a secure network. You walk them in the door and you put them into people's home unsecure environments
Joe: I mean, that must be chaos and a headache for any IT security professional right now. So to be watching that happening.
Mike: Yeah. I'm really lucky in that everything we do, there's nothing, like the laptops. There's nothing stored locally. There's nothing. we frequently have this happen where, you know, somebody gets locked out or whatever. We just wipe it and you can start over. There's nothing, you know, everything's stored in cloud storage and stuff like that. But even still, it's still, you know, now I'm worried, like, right, they're taking their laptops home, they're working all day from home. What does that home network look like? Who are their roommates? You know, like at the office we have this, like, you know, Hey, keep your, make sure your laptop's always locked. And if you leave it unlocked and somebody sees it, like we play games. Like we do things like, well, we'll do crazy internet searches. And, we call it gardening, the person's like laptop. What happens when you're at home and now you're with like trusted people, they're your roommates, but like, I don't trust them. So keeping that in mind, as well as, that’s definitely scary. And we had a similar thing where I was. Last couple of weeks, I've had to go into the office a couple of times and get some things ready because people don't have monitors at home. And so we wanted to make it like, well, what can we do for people? Which monitors do we want to allow out the door? And which ones like, yeah, probably not the Apple cinema display, like that's going to stay here, but here's, you know, some of the other ones that we can loan out and then having people schedule a time to come in. So we don't have, you know, 20 people in the office at the same time. You know, new and unique challenges. Another one was,really early on, one of our sales rep, her laptop. She couldn't get it, you know, went through an update and didn't come back out essentially. So now what are we supposed to do? Like if she was at the office would be super easy. If you just go to the closet, get her a new one. Yeah. Where you go, but now it's like, now it takes like a day and a half to diagnose and get her, you know, get her set up again. Actually, I think it was more like two days, when all of a sudden, done by the time she was back up and running, which was if she was in the office, it would have been two hours at the most.
Joe: Yeah, that's definitely the turnaround in helpdesk type of scenarios and supportability. I mean, you know, so for some companies that are not fortunate, like yourselves that have, you know, moved to cloud and have everything, you know, moved off devices and you think about those that are heavily dependent on things like GPO policy to be upgraded. They're the ones that are heavily dependent, you know, data stored locally and now it's outside the office, is that they even been backed up anymore.
Joe: You know, how often is the backups? And a lot of companies may have moved to more network-based security, where they're looking at, you know, gateways and proxies and firewalls, IDSs, and so forth, IPSs, and now their data is not going through any of those. It's outside in the public internet.
Joe: Now, you know, where's your visibility. You know, I've seen a lot of companies now seeing employees spending hours on, you know, streaming services and downloading and checking personal things on their corporate devices that you may have had more control when they're going through your own internet connection, but that's all gonna do window and others take it at home. So that leaves the big question for a lot of security professionals is where's the, where is my security? You know, we know that the perimeters are gone, but now the question is, was my security on my network. Or is it, am I hundred percent now relying on the actual endpoint protection that's on that device and the human sitting in front of it, is that where my perimeter security is remaining? So there's a lot of organizations that you need to really know as one is, what data's on those devices. Hopefully you're using some type of cloud storage that allows you good audibility. What local administrator access do they have when they leave, whether it be installing applications that you may not want to be on those devices. Now that you know, you may have been able to restrict it or have better policies, but now there may be opening up to more applications unlicensed, unauthorized, you know, bad privacy, you know, policies and bad security elements that could be exposing my system. And then applications, what applications will work outside the firewall?
Joe: You know, They may have proprietary applications, which, you know, in my experience, things like, you know, foreign exchange, money market trading systems, that you may only function on the corporate network because they're reliant on things like, you know, streaming from data services. In order to populate that the interfaces, how does that maintain? So, you know, a lot of, also compliance, will you still be compliant as those devices are going outside of the office or will you know, it'll be an exposure. If a data breach does happen, now you're not compliant. And does your insurance cover you. If you do have cyber insurance as well
Mike: Cyber insurance is a whole another, probably a topic for a different day.
Joe: Absolutely. But these are all, I mean, I've seen a lot of these challenges, that's going through a lot of security professionals and trying to figure out all of this things and will their infrastructure be able to support it.You know
Mike: Yes, I was gonna say VPN, I mean, are you ready for that 9:00 AM monday morning when everybody's VPNing in, because that's the blood, you know, that's where all the resources are or whatever it is. I have a friend who worked at Amazon and that was, I think one of the things that they like right early on, and in Seattle, when they closed that office, had to go through, it was all of a sudden, there's a whole bunch of people hitting this VPN where in the past they wouldn't have been, are you, do you actually have the network to handle that?
Joe: Yeah, can you actually spread it out over, you know, some time. Can you do some type of
Mike: Find the curve?
Joe: Yeah. Find the curve. Seems to be a common term, can you find that curve and VPN,, you know, was it? Do you have some type of load balancing in order to handle it? Mike: Right Joe: Infrastructure questions? I'm pretty sure a lot of those. You know, public facing services, web services, VPNs, DMG equipment, is being maxed to this limits. So it's a very challenging time but you know, it's a good time to try your disaster recovery plan and to also, you need to update it as well to deal with these changes. Is that your disaster recovery or business continuity or incident response might be very dependent on, you know, you're sitting in the office
Joe: And now, you know, there's no one at any office or you know, working remotely, you might have, you know, a very, you know, a small crew coming in and doing critical services from the office that are, you know, keeping their social distance and so forth. But in this situation, this might be good time to even task your incident response plan, to see if it's still viable in this situation. You know, As mentioned, people are accessing the personal email and social media from home. What do they get around somewhere? You know, and a loss of their systems and what if they had a VPN connection open, and now it comes in through that connection into the network. How can you isolate it and keep that separation? So there's a lot of, you know, kind of risks happening right now. And I think incident response definitely needs to be revisited to see what's still viable in these situations.
Mike: Yeah. And I also think about like work from home policies. Like in the past, there were a few companies I worked at that had very rigorous, like, Hey, you have to answer these questions and then we'll let you take a laptop home. Right? Like, what's your home network? Like, you know, run this scan, do this. There's no way you can go through that now and then, and expect that people. So being able to like, recognize like, yeah, our work from home policy has to be updated and make sure that you've really communicated, like what people should do in case of X, right? If your laptop gets stolen, like. What do you do? Hopefully it's not that big of an issue because we're all stuck in
Joe: No one's going outside. I'm pretty sure robberies are lowest ever at this point, but yes, definitely. Crime was ,you know,traditional crime has gone down. It's all moved to online crime at this point.
Mike: Yeah, Let's hope so, I guess.
Joe: I'm pretty sure anyone going out on the street right now in Europe gets fines
Mike: Oh, really?
Joe: It’s in Spain, Italy, UK, and France. There's they're handing out fines,
Mike: Right. I think, yeah, I heard in France like it, I guess you have to have some sort of piece of paper that you've printed out that says why you're out walking the dog. Joe: Yeah, that's sort of go to the shop or it’s just isn't, which I think is ironic, but if that's what it is, that's what the governments have done in order to get people to comply but there's a lot of people were not taking it seriously, so, but you're absolutely right that IT’s policies have to be reviewed to make sure that they actually support these types of conditions and make sure that you're also not making your employees in a situation where they have to make a decision, whether it's to do their job or break a policy.
Joe: Because it might be conflicting against each other when they're actually working from home.
Mike: Yeah. And also, just making it easy for them to reach out, ask for help, like, because you know, again, you want to make sure that they're staying focused on their job that they do know, like when they are bumping up against a policy or whatever like that they know that there's a, like, there's a course of action they can take.Yeah.
Joe: One thing has been good in Estonia as well. I've been quite fortunate to, we do have a country office. So, you know, if you do have the ability, you know, if you're not in isolation and you can get outside and sometimes go find a good place outdoors to work as well in the fresh air. I've, you know, we're fortunate to have a country house, which is about 45 minutes away from the city and the summer I would typically go there and work from there. And it's great to be able to have an environment where you're in the fresh air, you're open and allows you to, you know, from a healthy, work environment it's much better. And the other thing as well, you know, not only by where your location and you were working from, but also now's a good time for self development. This is a good time to do the things that you may have, you know, being put in the backlog saying, Oh, when I have time, we'll get to it. When I have time, I'll get to it. And you find yourself that in your, maybe many out there might be in a situation where some of the work may just not be possible to do for home. And therefore, now what I recommend for all companies are in those situations. Give your employees as much training and education, self development time as possible, because this is the time. In order to help them actually, you know, enhance certain knowledge, enhance their skills, learn new things. Go to the likes of, you know, get into some of the Cybrary courses and actually you start educating yourselves. For me, I think this is a critical time that companies have to make that decision, you know, while your business might be in, you know, stagnant right now where I'm not doing anything is how do you make sure you keep your employees engaged and continuous education and self development is one of the striking things.
Mike: Yeah. Career development is really critical. The other thing, I think, not just, even if you are totally capable of doing your job, right, like maybe nothing's really changed, but. You don't have the same commute that you used to have.
Mike: Your commute is now from your bedroom to wherever. So it's not, you know, In theory, you should have a little bit of extra time on your hands from that. It's nothing else that maybe we’ve been spent in an aggravating car ride, at least in the US, in the DC area. You're, you know
Joe: Absolutely, one thing I have noticed, you know, absolutely. There is no commute time, you know, in Tallinn from me, It's not a lower commute anyway but definitely in places like San Francisco, you know, I lived in, worked in Dublin and Sydney all around the world and my commute time in some of those places, you know, even DC may have been two hours, three hours a day. And if you're getting that time back in order to, you know, learn something. What I find is this past two weeks, I've been reading a lot more, a lot more books. I was impressed. One thing that's Amazon did was they made Audible, the kids' books free during this time to get all of the audible kids' books are now free and you can go online and listen to any kid's audible book, which is in these types of things I think is fantastic. Time to do that self development and learning and I think it's really important as well, you know, from an employer to say, if that can be time, you know, learn something. One thing I've noticed from a lot of the webinars and webcasts and podcasts, I've been doing over the past two weeks is attendance has been through the roof.
Mike: Right, right.
Joe: There's a lot more people attending and listening. So I think this is a really good time for, you know, to take some of those things that we may have been, you know, with conferences being canceled. I can tell you my conference schedule for the next three months is gone.
Joe: My travel schedule is gone. I would have been normally last year, I attended probably just under 50 events globally and did numerous talk probably more than 60 different talks and workshops around the world. And that's gone for a quarter, like three months. My time is just canceled from travel and conferences. So we have to find different mediums and different ways to continue sharing our knowledge and research and our experiences to others, to make sure that we're continually adding, you know, that knowledge and value sharing of what we're doing, regards to whether it be security research or best practices, or even just having discussions around typical challenges and topics. I think those are really important things to share. And then I'm seeing people actually having that additional time to listen in and join these webinars and webcasts and podcasts and video blogs. I think is a great thing and I think companies should really endorse it and tell their employees yet, you know, spend this time to listen to a podcast or a webinar, or even get involved and interact. Do you participate in one? So for me, this is definitely an opportunity, self development, new skills, learning, reading, getting those things that you've been pushing off for a long time. It's a good time to try and to get them done, check them off.
Mike: Yeah, no, I couldn't agree more. I also wonder if some of the reasons why people are joining one of the webinars and things like that is, you know, again, it helps with connectivity, right? But social distancing, you're looking for ways to interact with other people there, you know, whether it's, you know, through a webinar or whatever, there's probably some nice ways to sort of get some interaction outside of, outside of the house.
Joe: Absolutely. And then that's important. You know, to technology, the great thing is that when we're in these situations, you know, if it was 10, 20 years ago, it would be, you know, challenging. The technology is definitely, you know, made us be able to deal with these situations much better, being able to, you know, I remember when I was traveling the world 20 years ago, And staying connected with my family. It was very difficult. You would have, you would already have planned like one hour of this week and this month, you know, this is when I will call
Mike: Right, right.
Joe: And they'll be standing, you know, next to their telephone waiting for that call to happen and we would be collecting really expensive.
Mike: Right, right. Oh, that was my sister's thing. She would just call, collect. And then, you know, then we need to call her back. I remember my father saying one time, it's like, Deal with the cost of this call would have been the same price as a flight. I give it two weeks but those situations, you know, technology definitely has made these situations much more easier to deal with. And I think, you know, one of the things that we also have to understand this is mental health, isolation, you know, even from a friends and family, you know, make sure we, you know, make them understand how to use the technology especially those who are more vulnerable that might be having , you know, health challenges, or it might be an isolation or self quarantined or that they might be even, you know, an age group that are more exposed and making sure that we show them how to use this technology and communicate and have that collaboration.
Joe: So one of the, even this week, you know, my son's learning guitar. My daughter is doing piano lessons and we did it online. You know, we actually had through, we actually had the TV and my son saying, playing the guitar lessons with a teacher on the TV and communicating and the same with the piano lessons as well. So when we do find technology does help us to continue our lives in somewhat normal and chaotic, you know, a crisis and that's what will get us through this.
Mike: Yeah, we had the same thing with the piano lessons with my son. Last Thursday was a virtual, the one thing I'd also say is, you know, we talked a lot about, you know, what it's like to, you know, work from home with family and kids. The other thing is the people who, there's a lot of people that live by themselves. And so I think it's important to just sort of check on them and make sure you're reaching out and I think a friend of mine made a joke the other day about like, now's the time for all you introverts to check on your extrovert friends. Okay.
Joe: Absolutely. And one thing I'd also like to mention as well. I think, you know, we have to also look, you know, is that, you know, we're considering ourselves, you know, we're helping, you know, solve the problem by staying at home. You know, we can be superheroes by sitting and doing nothing and just continue to work remotely. But we also have to look out there to, you know, my peers and professionals and your peers, professionals who are all supporting, you know, the health services and the production of medical equipment and the logistics of getting them to the world, they should be. And those is really kind of making sure, you know, the unsung heroes, I call them the mystery men and women of security that are really kind of making the health services continue to operate, making sure that the infrastructure can support those, making sure that, you know, trucks and, trade and deliveries and manufacturing and still get to where the places where they need to be at the right time. So I think I have a really special thank you goes to all those providing those services because they are in the background hidden. And that's the thing is when things are working and things are moving along, they don't get any recognition.
Joe: And for me, you know, those security professionals, you know, we have to thank them for what they're doing, because it's impressive to do. I've been in that situation 20 years ago, where you're in a crisis situation that goes back to Y2K, during a UPS transition, you know, physically transitioning from the two generator.
Joe: And at that time I was responsible for Northern Ireland service. And during that transition, the systems that actually do the, it was the, for the ambulances to get to the locations at call service, is down. And you're sitting, looking at a clock that you have an SLA and then in the ambulance service. If you go past your SLA, people die.
Joe: And that's, you know, that's the most stressful. Anyone will ask me the question. What's my most stressful situation I've ever been in my entire career. And it's when you're looking at a system that you're actually trying to get back up and running. And that when it doesn't work, people die, that's the most stressful situation. And this is what we're really in. And those that's in that same position that I was in 20 years ago are in those situations, they have to keep their systems running. They have to make sure that they know where hospital beds are and where ICU treatment is, and where ventilators are. And have to make sure that they're available and functioning and working. And the people is doing that right now. You know, I know the stress of that though not work functioning. People can die.
Joe: In that situation where, yeah, it's the people out there that's giving, you know, voluntary service and keeping this running. I have to kind of, you know, praise them for the effort and work they're doing. It's amazing.
Mike: Yeah, I agree. Long time ago, I wrote a blog about like crisis management and like what you can do as a manager. And like one of the first things I say in there is like, just recognize no one's going to die. Right. Like, but that's not true in all situations.
Mike: So yeah. Can't imagine what it'd be like in that world
Joe: I worked in NHS in UK and I did medical records. And I think the most realizing for me was when I was doing the ambulance service. That was probably when I, you know, the realization when, you know, you knew that if your service wasn't running for, I think it was 23 minutes in a row. That there was deaths. That's what happened? The ambulance wouldn't get through an accident or patient within that time frame. The statistics would say that, you know, the people die and that's what's people's in a situation is, you know, I was kind of, makes me relate to is that people's in that situation right now, you think about in hospitals, around the country and globally that those systems, those, you know, intensive care units in the hospitals and the equipment functioning and all of a sudden, if one system goes down, I can tell you that, you know, it's roughly 23 minutes to a half an hour. If you don't get up and running that you got, you know, if there's no alternative and all they're at full capacity. That's happening and that's what we're seeing is, you know, massive deaths around the world and is very likely that’s because they're maxed out on equipment and they don't have alternatives or supplies to keep them going.
Joe: So yeah, so those in this industry right now, just keeping those available and keeping them function and keeping them maintained. It's, you know, like thank them for their hard work.
Mike: Yeah, Couldn’t agree more. So I appreciate you joining us. I think that's probably a great place to sort of end it, but the nice thank you that all the, all the hardworking people, any final thoughts or anything?
Joe: I may find fosters, you know, we'll get through this and this is, you know, this is not the end of the world. It is a Pandemic, but you know, technology will help us. We’ll be innovative. There'll be new solutions coming out to deal with this better in the future. This is something that we all can, you know, have lessons learned from ,about you know, how are we gonna improve in the future? And definitely, you know, for those who's doing remote working, we'll definitely have a more appreciation for teachers
Joe: For healthcare workers . For those that really, you know, those who are doing public service, really. We have a much more appreciation for what they do in our society. And I think that, you know, out of this is that, you know, they are the heroes. It's the ones that's putting the sales forward. So I think, you know, we will innovate, we will improve. we will get through it but definitely, you know, it's the public servants who's the real heroes at this point.