Security Strong Podcast

Host: Jeremy Cherny interviews Gjeret Stein, Owner of Ultra Scary LLC.

"I started in the IT world in 1994. I started learning computers and an operating system called Open DMS. So anybody who knows about DMS is usually old and has gray hair. In the 2000s, I became an IT administrator for a couple of different companies in the Milwaukee area. Then, in 2007, I decided to strike out on my own. So currently, I run an IT services company (Ultra Scary LLC) for small and medium businesses. We focus on security because that's sorely lacking in the small-to-medium business space."

What got you interested in security?

It's always been something that we dabbled with, we just never saw a reason to sell it. Mostly because I'm not that smart in that world. But one of our clients used to forward their emails from their on-premise mail server to their AOL account because they did not like the on-premise 2003 mail server. However, their AOL account got breached and they didn't know about it. So the sales manager that was doing this was going on vacation, and suddenly, the CFO got an email from him, stating that a vendor didn't get paid and was going to pull all of their products until one of their old bills was paid in full to the tune of $34,000. And the CFO was freaking out. He was sure that the bill was paid. But he didn't want to piss off this huge vendor and was about to hit send on the wire transfer when the sales manager, the one who was hacked, walked in the door and saying, "Hey, I'm on the way to the airport, I just want to stop by and say hi before I hop on the airplane." And that's when we discovered that that was not a real email. That was an attack vector we never thought about and so we started to relook at not only our processes but what the processes of our clients were.

How do you stay on top of the latest security threats?

Constant training, constant training, and, and constant reassurance that if they slip up, it's not that big of a deal. Everybody makes mistakes. One of the worst things I have seen is when there's a phishing attack or a phishing exercise, and somebody clicks on the wrong link. And then IT comes in and starts berating the user who did click on the link - who made the mistake. All that does is reinforce to that user that they're going to hide when they do something wrong. Where you go, "Yes, it's okay that you made a mistake, let's go find out what the damage is, let's go fix it." Then when they do something that they weren't supposed to do again, they're more upfront. They're there knowing that, yeah, it's okay. I'm not gonna get fired because I clicked on this.

What are some ways that people can protect themselves online?

Different passwords for all of the different sites that they use. We actually recommend going old-school and using a binder to write down what the different passwords are. So if somebody has physical access to your computer - unless you're in high security or the HIPAA space, you'll walk into a receptionist desk, and you need to know the receptionist passwords, if it's not on the sticky on the screen, it's underneath the keyboard or underneath the mousepad. Right. So we just take it one step farther and have a notepad that is in a locked drawer that has a list of their passwords. And they make sure that each one is different. And each one is a bit more memorable.

Host: Jeremy Cherny interviews James Oryszczyn, Director of Security & Network Services at an Am Law 200 Law Firm

"I support network applications, video conferencing, and bundling security. We have a lot of sensitive client data. So we get a lot of client audits making sure that we're complying with all security programs - and also making sure that we keep hackers out."

Why is security so important for an Am Law 200 Law Firm?

Some of the larger clients have very sensitive data and that data gets breached, it's going to cost them quite a bit of money. So why it's important is reputation. number one. Number two is losing clients. You don't want to be on the front page of the news. Number three, your clients trust you with the data. So you have to make sure you're protected and doing the right things because you're agreeing to certain stipulations and what they call outside counsel guidelines. Outside counsel guidelines are actually the arrangement that most clients have with law firms that explain billing, explain how you're going to do the work, and finally, they have a lot of security requirements in those outside counsel guidelines. So what'll happen is a lot of the clients will come in and they'll audit us saying we're doing what we said we're going to do when those outside counsel guidelines.

How do you stay on top of the latest security threats?

There's a number of things. I listen to a lot of podcasts and read a ton of different blogs. We also have a managed security provider that sends us information when there are types of critical security alerts that we need to be aware of.

How do you handle awareness training for your clients and for your team?

We have a product called KnowBe4, which we do yearly security awareness training through that. A lot of it's for compliance purposes, along with having good security awareness training programs. We have a fairly robust HIPAA practice or healthcare practice. So the healthcare attorneys, on a monthly basis, send out tips on how to be secure. Because of HIPAA, they are very secure environments. So a lot of the users get tips from them too.

Have you ever had to really sit down with someone who keeps clicking on things they're not supposed to?

Generally, no. We have an IT security mailing list that people send stuff to. So most of the attorneys are very scared to click on something they shouldn't. They're very judicious about actually sending it over to be reviewed, which I appreciate. Every so often, you'll have somebody click something they shouldn't, but it's getting rarer and rarer.

What's your home network like?

If you're familiar with Palo Alto networks, I have a Palo Alto firewall with a bunch of threat protection on it. I'm running a VMR system with about 10 VMs. One of those VMs is a product called Teapot, which is a ree honeypot where I can actually see people trying to attack my network. I have some three-layer switches and some pretty advanced wireless stuff. For my wireless network, I split it into two - I have, what I call, my Internet of things. So that is my fire alarms, thermostats, things of that nature. Then I have just my regular network.

Host: Jeremy Cherny interviews Arlene Petersen, Owner and President of T.E. Brennan Company

"We are an insurance and risk management consulting firm, not an agent or broker. We don't sell insurance. We provide advice on how to handle risk to our clients. That is oftentimes an insurance product, but not always, there are a lot of ways to handle risk. So that's what we talk with our clients about without actually selling them a product."

You're not our typical guest of an IT geek, but you definitely deal with risk. So why is security important?

It's not only important for us to safeguard our own data, but it's important to our clients as well that their data be properly protected. Without proper security, it increases our clients' risk, and cyber insurance can become pretty costly or might not even be available if our clients don't adequately secure their data.

How do you stay on top of the latest security threats?

We read everything we can on the topic, and we subscribe to a lot of publications and blogs, seminars are great - those are often very timely with the latest threats that are out there. Most of those, of course, is virtual today. We try and stay ahead of the changes, but as you know, it's a challenge.

How quickly is cybersecurity insurance changing?

It depends on the insurance company, some companies are more flexible, more able to respond, and quicker than others. With some of the larger companies, sometimes it takes a while. And there are governmental constraints on the use of policy forms so that sometimes adds time. We don't always get the response we want from insurance carriers as quickly as we'd like.

How do you address security awareness training for your clients?

It's kind of interesting that no two insurance policies with different insurance carriers are exactly alike. So one of the steps, of course in the insurance process is to complete the application. What we find is that once the client works through the questions on the application with their IT department, and some of these applications can be pretty lengthy, we help them evaluate their answers, and how those answers will impact the coverage and maybe the price. In more than one case, we've advised clients to actually bring in an expert like you guys, to work with the clients, improve the security and then reapply for the insurance. Because one of the things we don't want for our clients is for them to have a record of being declined for cyber insurance or any other kind of insurance for that matter. That red flag can stay on the record for a number of years. Then once they have the improvements in place, we have them complete the application again, which oftentimes, results in a more positive response to those questions on the application. Then we have them obtain cyber insurance that meets their needs. From there, it can often be at an affordable price and an affordable deductible. Pricing has gone down significantly over the 15 to 20 years that cyber insurance has been around.

Host: Jeremy Cherny interviews Paul Riedl, CEO of River Run

"River Run is an IT firm in Wisconsin, we focus on working with small- to mid-sized businesses. My role in the organization is to help. As CEO, I get to be the chief cook and the dishwasher. I get help with the vision and the direction of the company - and that's one of the biggest topics that we talk about on a regular basis. I've got a team of wonderful and smart people that do the hard work to make things happen and keep our clients secure."

Why is security so important?

The answer really comes down just being able to protect people. As we look at the things we do - we're protecting them physically and also mentally because any security incident is so mentally draining, and in a lot of cases, it can be very traumatic for people. A lot of what we're protecting is people's data and making sure their financial well being is intact. The ripple effect of any type of data or security breach can be devastating for the people involved - and not just the company. It can hurt the company's clients, their clients and clients after that. The other point to this is because so many people are working from home because of this pandemic. This is a new territory. The use of Zoom, the use of Teams, the use of remote access to things has increased drastically and because of that, there's so much more vulnerability. And so again, we really have to make sure that we're staying on top of security.

How do you stay on top of the latest security threats?

It's quite time-consuming and quite exciting! What we do is w subscribe to any of the main providers of IT in the marketplace and constantly scan their information - making sure that we're receiving any types of alerts about IT and security. Because of this, we can react very quickly when new things come up. The other thing is that we have engineers whose job is to stay on top of that stuff. We also go to leadership groups in the IT world to make sure we stay on top of the latest information from all different sources.

How do you handle awareness training for your clients and for your team?

There are automated type things like a phishing awareness testing tool and those will send out tests to see how well people do and then include some videos to help them learn how to be more secure. And then there are the face-to-face interactions and training. We do that for a couple of reasons. First, we like being able to sit down with people and talk to them. People aren't as afraid to ask questions in that situation. The objective is just to create some more awareness because awareness is critical.

Being a business owner and dealing with COVID, how do you know how to make the right decisions?

I'm fortunate in that I have a wonderful network of professionals. I've got mentors that aren't afraid to hold up a few mirrors to me and make sure that I'm seeing things as clearly as I should. And so I learned a lot by talking with experts and spending time with the experts in different areas. Another thing is just absorbing and asking questions and then making the connections that I need to make. The other thing that's wonderful are the people that work with me at River Run. They're top-notch and they stay focused and they're able to accomplish a lot of things and break everything down into very manageable solutions that are easy to understand. I also spend a bit of time on the wonderful web here and just hitting different groups to find more information about specific topics, especially how things are changing with COVID. What are we doing to keep our people safe, keep our clients safe and continue to be able to do business? So luckily as I said, I've got some great mentors and great people in my network circle and it's just through a lot of conversations and a bit of research that really does help move things forward there.

Host: Jeremy Cherny interviews Brian Lamantia, MacOS Administrator

"I've been doing this for a few years now just completely involved in that. And I use that to ride security down to our macOS users in our environment. We're fully Integrated with an MDM. We use Jam, which is one of the premier MDM providers out there. So I've been using them for the whole duration for about three years now since we set up the infrastructure and started enrolling our first Mac's."

What was it like enrolling your first Mac's?

It was very interesting to start out with because MacOS is coming into its own for security with all of the different security features that they've been adding. For example, the system integrity protection and the T2 chip which is a chip they're putting on top of the system boards and is a secure enclave for the boot process. So lots of new security features, lots of challenges for an admin like me to integrate those security features into the deployment. In the beginning, we weren't fully into automated enrollment yet so it was - get a Mac, get the endpoints on it, get the user set up and then mail it out to them. We didn't have to image but we had to do a lot of setups. Then gradually, as things were starting to come around, and when we got enrolled into Apple business manager and we became an Apple DEP customer, we were able to then automate enrollment, which was really just an eye-opener - functionally and security-wise, for our C-level folks at our company.

What about that was the eye-opener?

The fact that we could do direct shipping from vendor to employee, and then have them just enroll. Then, all the security endpoints come down - zero imaging and zero-touch. That was huge.

Why is security important in this process, and why is it important to your job as a sysadmin?

It's important for us because we have auditors that come in to audit our systems. They find that we have to have a certain security stack in place. So those requirements are handed over to our security teams, and they have to work with me closely in order to get those security features in place, which is the primary reason why we have an MDM - to be able to enroll but also to provide all those things and to provide all the security features to ensure that they're locked down and safe.

So if you work closely with the security team, what is that relationship like in terms of staying on top of threats? Are they doing research and then handing down policies?

We started out doing our own homegrown policies to try to match the Windows world a little bit to get everybody familiar. We just now recently are going to be updating that to basically go off the CIS benchmark. I've now been handed that whole guide. So now we're picking through that one by one to firm up our security and our policy and then once that policy is set in place, it's my job to make sure that every box is checked off on my side and enforced and that we can prove that.

What do you see as the future of security?

Related to Mac OS, there are lots of changes. A lot of the security features that we use on the Mac OS side at our company have come because we already have a relationship with that security vendor on the Windows side. But we're learning that Mac OS is not the same as Windows, it's a completely different OS. So some of the conversations I am now having with the security folks are maybe changing over to some of these newer products that are on the market that are now agentless and also serverless. They actually have a product out there that is agentless and serverless that we could be using that would greatly improve our performance on Mac OS. It seems like security is ever-evolving, right? I mean, the old days of binary agents, I think there's going to start going away for more MDM and scripted based solutions even on the Windows side.

Host: Jeremy Cherny interviews Roger Heindl, Owner of Tech Lab, Inc.

"We're an IT support company. We provide home and business support for companies in Southeast Wisconsin. I've been working in IT for almost 20 years. We have four tech people that also work with me at Tech Lab, and I've been interested in computers probably since I was a teenager. Our first computer was actually an Amiga, which we later upgraded to a Mac. And then I ended up buying a PC to go to college. So I've been interested in tech for a very long time."

Why is security important to you?

There's a lot of companies and even home users that are getting scareware and ransomware, and that really costs people a lot of money. And the hacker is just trying to get money out of the person or if it's real ransomware that actually locks down important data - say healthcare or a law firm - it can prevent people from doing the work that they need. It creates a lot of anxiety among customers - so for me, it's really about helping people navigate through the world of tech and keeping them safe.

How do you stay on top of the latest security threats?

I follow a bunch of tech news sites and also encourage my staff to follow them as well because those are good sources of information on what's currently happening. We also attend DEF CON in Las Vegas every year. DEF CON is an annual security conference that tech people, government officials, and, potentially, hackers all attend to increase their security awareness. I believe a lot of that is happening online this year - with all their training and presentations.

How do you address security awareness training for your team?

Security awareness training is something that we've been pushing more and more over the past couple of years. A big one that we do is help people learn about social engineering because there are so many phone scams. We also do online training and classes through our partner organizations to provide our customers with the ability to do things on their own time. As a team, we also meet and do a weekly review of everything that's going on where we also sneak in a lot of talk about the latest security issues that come up with different customers. We really make it a point to stay on top of it as best we can.

What are the most important things people can do to protect their data online?

For us, the number one thing is to be aware of what you're clicking on. We work with a lot of people that work in stressful environments so they click without fully reading or understanding what they're clicking on - and that is the number one way we find people getting in trouble. When someone clicks on something it often spirals them into a stream of very bad things.

Where do you think the future of information security is headed?

We've been starting to see third party reviews of trusted authorities. You can't just go out and pick the first tech solution provider that comes up because, for all you know, it could be a scam from India. So it's becoming more important to show value to customers that you have other people reviewing.

Host: Jeremy Cherny interviews Sandra Estok, Founder and CEO of Way2Protect

"I'm an expert in the fields of cybersecurity, IT, and data privacy. Through my stories, experience and expertise, I help people feel empowered in navigating the cyberworld. I help people find ways to protect what matters against hackers, scammers and cyber monsters, even if people feel they are too busy or do not understand the why, what or how of technology."

How do you stay on top of the latest security threats?

Every day something else pops. It's either a vulnerability or a new way for us to be hacked or to be breached. And so how I stay on top is I read a lot. I research a lot. I could read all the news, and I can read everything that's going on, but I'm always trying to find a way to take what's going on and make it a message that is different. And have it shifted in a way that gets into my audience. And that's what I focus on the most. How to take what's happening in the world and articulate that in a way that is more simple so people can understand it.

How do you handle awareness training for people about what the current security threats are and about the specific security threats that might impact them?

Let's take an example with phishing, which is very common. We all need emails, and so it's an area where we're exposed, whether you're in security, just a regular business or a mom or dad, or kids, like everyone gets emails that are trying to either impersonate, steal or do something. So, one way that I teach phishing prevention is when we change our mindset to cybersecurity The first thing that I teach is just brief, just stop knowing that you have control over your cyber life, knowing that you can decide whether to click or not, it's so powerful. And when we start seeing it that way, we start changing. So now we are not so unconscious to just click or browse and get malware in our computers because we're not even realizing it that we're clicking on a malicious link.

What are the most important things that people can do to protect their online information?

I have three steps. The first is mindfulness. What I mean by that is when you get an email, when you get a phone call, just briefly pause. And once you do that, make whatever decision or go in whatever direction you want to go. I think number two is taking care of the basics. And by that I mean, we have a lot of different tools, devices, technology, and if we don't take care of the basics of updating and keep doing the housekeeping of things, it's gonna break. It's like if you never clean your carpet, your house. My third recommendation is that I'm a believer in intentions, decorations and keeping a positive attitude in life. I'm super grateful for everything that has happened to me. So what I do is I use a password manager. I have one long phrase as my password. And that phrase has meaning to me, because every time I type that phrase, I'm reminding myself of something that I want to achieve or something nice that it's in my day. So it makes me happy and at the same time, it's a very long phrase that protects my passwords.

What's your favorite tech gadget?

I will say wearables. I love to see my data and what they are. My new gadget is about wellness. It's a ring that measures how I sleep and I love it because it changed the way I do things every day. It helps me to keep myself on track. A lot of people are paranoid about having health data, but this is locked down enough where it's safe and I can have data that helps me.

Host: Jeremy Cherny interviews Pat Riley, President and CEO of New Horizons of Wisconsin

"We've grown to be Wisconsin's largest provider of technology training and skill improvement. We work with clients on everything from end user training in Microsoft Word all the way to cloud computing and cybersecurity, IoT, blockchain and AI - and then everything in between. We also work with people who are looking to convert their career paths and want to get into computer learning."

Have you seen an increase in people wanting a career shift with everything that COVID has brought?

There's two things that I think are really driving that. The first is our ability to bring live instruction into people's homes - everything we do is live. We deliver our training either in-person, which we're doing very little of these days, but we also do what we call Online Live. This way people can interact via video, they can raise their hand, ask questions and get face-to-face interaction with an instructor. It's an incredible experience and a huge differentiator for us. The second part is just the growth of technology. The two hottest areas to be in right now are healthcare and technology. So we've got the ability to deliver into people's homes a live experience and we've got the growth of the industry as well.

Why and how is security important for your business?

So we have a lot of people come to our facilities to take certification exams. Those are very important and can be worth $20,000 in compensation based on a person's level within certain companies. In addition to that, these certifications are generally very difficult, so we have to have certain things in place to make sure no one is cheating or anything along those lines. We also have a lot of data on our students and the companies that we work with, so security is extremely important there as well. We work with a hybrid cloud solution to ensure that everything anyone shares with us is and stays secure.

How do you address security awareness training for your team?

I think the biggest thing is the relationships that we have with the vendors that are delivering the actual component of security - so we have relationships with everybody. We're a Microsoft gold partner, VMware partner, Cisco partner, Google AWS, Redhead partner, the list goes on and on. So we're actually getting information first hand directly from these companies and, a lot of time, have access to information even before products are on the marketplace. The second part, is that we are very aware of the marketplace itself - specifically what's important to particular customers. We are really client-centered and offer our clients what will best fit their needs.

Since you're seeing these things ahead of time, is there anything you can tell us about the future of information security?

I think one of the trends we're seeing is a movement of cybersecurity from being a hardware solution to being a software solution. A lot of companies are moving away from cybersecurity as a hardware solution to making it into a software solution. The other thing that we're seeing a lot of is the creation of incident response teams. Cybersecurity touches every part of the business so these teams are made up of all kinds of people - lawyers, communications departments - and they're building these teams to be ready in case there's an incident.

What's your favorite tech movie or show?

I just got done watching Altered Carbon on Netflix - I was bored at the time and didn't have a show I was watching so I thought why not. It's very Blade Runner-ish. It's about a dystopian future where you can live forever by having your life force be on this little disc, and when your body runs out they can pull out the disc and upload it to what they call a sleeve, which is just a human body. It's a pretty interesting show - people living forever and accumulating a lot of wealth, and there's a murder that the main character has to solve. Once I started watching I got hooked, and I thought it was really good.

Host: Jeremy Cherny interviews Chris King, Network Analyst for a large petrochemicals corporation.

"I provide second level network support for a large company in the petroleum world. What that entails is for our retail locations around the country, I can do anything from placing communications orders to writing and verifying firewall rules for new technologies that we have rolling out at the site to trace network traffic. We support about 6400 locations so we have a standard template that goes out for our retail locations, and which template gets applied is solely based on what type of technology exists at the site."

Why is security important to you?

The industry that I work in is all about protecting customer data. You want to make sure that when your customers go out to a site and swipe their card, they have comfort and the peace of mind to know that out of all the threats that are out there, we're staying vigilant and their customer data is not going to be stolen and used by someone else. So on top of that there are legal ramifications. The government has established payment card industry standards, which require us to go through and vet our networks on a quarterly basis and have an independent auditor come review those findings to make sure that we don't have any material breaches in our network security.

How do you stay on top of the latest security threats?

So obviously the government requires us to do our scans quarterly, but we do ours monthly - just to make sure that everything is the way that it should be. Also, there's nothing quite like physical security. If you walk up to a pump and you see that there is some security tape that has been breached or you see something that says "void" or "alert" absolutely do not use that pump. Technology is sophisticated these days where we used to have skimmers on top of what would be where you swipe your card. Now they put devices inside with Bluetooth transmitters. So they may be sitting in the parking lot, watching your card data come into whatever capture tool that they're using real time and capturing your pin.

What are the most important things people can do to protect their data online?

First, random passwords for every account - it's a pain but it's the biggest way that you can protect your information. Secondly, use a VPN when you're out in public. Essentially what you're doing is you're encrypting your data before it gets to the internet and individuals can't sit in between and see what it is that you're sending back and forth. The last thing that doesn't get talked about enough is just having awareness. There are tons of attacks like phishing and fake websites and just having the awareness to know about those is super beneficial.

Tell us about a time where you've gotten attacked.

Oh absolutely. My fiance recently had somebody trying to commit identity theft and they were logging into her websites and trying to figure out her passwords. The good thing is that she had me on her side. I took one of her emails where the IP address of the attacker was logged and used a couple of tools to find the location of the attacker. From there I was able to get property records, names of the occupants, social media accounts, emails, phone numbers and even voting records. From there I let them know that I was going to alert the authorities and that they should stop what they were doing.

What's your favorite tech movie?

That's a hard question, there's so many great ones out there and they all rank really high for me. I'm actually going to change it a little bit and say a series - Black Mirror on Netflix. That series is absolutely amazing. It takes the idea of how technology influences everyday life. It gives a Twilight Zone kind of twist and shows how everything can go ridiculously wrong just from relying on technology.

Host: Jeremy Cherny interviews Sean Tepper, Founder and CEO of TYKR

"I've been in the software engineering space for about 15 years. I started a business in 2006 where I was focused on building custom software and websites for small and mid-sized businesses. Then in 2010 I went through a merger and kind of branched away and started doing more contracting with bigger businesses. In the meantime, I've been involved in the tech investing space, doing some angel investing and then doing a lot of investing within the public sector - which really leads to TYKR. TYKR is a tool that really helps investors find stocks and make a lot of money in the stock market."

Why is security important to you?

From a cyber security standpoint when building custom software, it can be overlooked especially in the beginning. If you get into the build of the software and don't have your foundation built around security, you can run into a lot of rework. And of course, if you don't build it correctly, you can run into a lot of nightmares like clients calling you at late hours of the night, telling you that their site is down. So really, you need to make sure that when you're building something custom, you have a strong cybersecurity foundation. There's also the world of investing where cybersecurity is such a hot topic with cybersecurity businesses being excellent investments that aren't going to go away anytime soon.

How do you stay on top of the latest security threats?

Since investing is really my career right now, I pay attention to the hot businesses in the cybersecurity space. But after I figure out if they're a wise investment or a poor investment, I get to take a deep dive into what the business is all about. So I really learn about the newest trends through looking at a business' products and services. If these businesses are releasing new products and features that they are doing well with, then that's an indicator to me that that's where the trend is going.

What are some ways you address security awareness for the users of TYKR?

With TYKR, fortunately it's a software that we don't collect any sensitive information. We mostly just collect first and last name and then email, which is generally pretty public information. We do keep everything in a highly secure database. There's a firewall that blocks people from getting in and you have to have two factor authentication, even if you're an admin like me. I have built software that you're dealing with highly secure information like social security numbers and that's when you get into data encryption. If we have something that uses credit card information we also use tokenization. So let's say you have a 16-digit credit card number, we then transform that into a token and then that token changes every month. It's a cool process but it's really hard to do.

What do you see as the future of information security and how it might apply to you?

Yeah, here's a different answer for you - estate closures. I've been the executor for several people and it's one of those things where it's really hard to close an estate when a family member passes because you have to look up everything - passwords for this site and that site, bank information. It's a huge process, like six to nine months, to collect everything. I think there's going to be a solution out there where somebody engineers a software where it's an estate - it's everything in a centralized location, one password to get to it. You've got a will connected to it with designees that log in once and they can help close the bank accounts and shut down any subscription services. Today, it is a very cumbersome laboring process. So I see cybersecurity that is highly secure but also highly efficient for the end user to work with.

What's your favorite tech movie?

Inception. It wasn't really cyber, but they want to enter the dreams of somebody who has a really big business and then change the trajectory of the business. On the surface it sounds boring, like business, but it's all about the process and the challenges of entering into somebody's dream - with tech.