New Charter Technologies CISO, Ryan Davis joins The 443 to discuss the evolving cybersecurity landscape across different regions, the unique challenges organizations face, and the trends shaping the future of security. Tune in for insights into emerging threats, regional priorities, and how businesses and partners can stay ahead of an ever-changing threat landscape.
View Transcript
Marc Laliberte 0:01
Hey everyone! Welcome back to the 443 Security Simplified. I'm your host, Marc Laliberte, and joining me today
Corey Nachreiner 0:07
is Corey "Business Cowboy" Nachreiner here in Nashville.
Marc Laliberte 0:11
Here in Nash, where are your cowboy boots? Those aren't cowboy boots. They
Corey Nachreiner 0:13
kind of if if the pants down, the toes look right.
Marc Laliberte 0:16
Okay, fair enough. Also joining us today is mr. Ryan Davis, Ryan, thank you so much.
Ryan Davis 0:22
Thank you so much for having me. I didn't realize this was going to be as official as that just sounded for an introduction.
Marc Laliberte 0:28
So, if you're not familiar, Ryan is the CISO at New Charter Technologies. He just attended WatchGuard Impact Conference here with us here in Nashville, and as a fellow nerd in the CISO world, we thought it would be great to have you on to talk about just trends that you're seeing in new charter across your your customers across the MSP space, and really just get our finger on the pulse of what's going on from your neck of the woods. That sounds good.
Ryan Davis 0:54
I appreciate it.
Marc Laliberte 0:55
Cool. So Ryan, we always start these episodes when we've got a new guest on with what we call the hacker origin story, where just like a superhero, you tend to have that one movie that explains you know what got them to where they are right then and there, and I assume you probably didn't fall into like a vat of radioactive liquid that gave you superpowers in
Corey Nachreiner 1:14
cybersecurity. By the way, the whole and we're using hacker in the old MIT way, not the just cybercriminal way. What got you interested in cybersecurity? Yeah, so
Marc Laliberte 1:23
let's get rolling with that first, I guess.
Ryan Davis 1:24
Yeah, absolutely. So I don't know. The first time you and I met, I actually shared this story, and I think that's kind of where we we hit things off. But you know, very candidly, I was I was extremely privileged growing up. My mom ran a secretarial service out of our house in the 80s, so we had six personal computers in my house, which is you know that was you know it was uncommon for people have one. We had six, so you know from a very young age I had exposure to computers, and I remember you know I had my DOS games and would go and you know put in the five and a quarter floppies and you know load things up.
Corey Nachreiner 2:08
Extended memory, trying to use that one megabyte instead of the 640, having to do different types for those games. Exactly, I remember.
Ryan Davis 2:16
But you know, I was you know young, right, four or five years old, so I just very kind of naturally like I'd get bored and I'd get curious, and so I'd be like, "What can I do? Like, what else can I do? And so, like one of my most vivid memories, and and you know, I wasn't doing anything malicious, but I remember my mom walking in, and I was sitting at the you know computer you know green screen, and she goes, "What are you doing? And all I was doing was running a directory tree that was literally printing out the entire you know contents you know of of the entire system on the screen, but it's just scrolling page by page by page, and she's like, "What are you doing to my computer, and like from that day on, I was just like, "Well, that was kind of fun, right? Like, so I think you know, in my very early formative years, you know, kind of to true to that truest definition of a hacker, I always just was a tinkerer. Like, I wanted to understand how it worked, and could I get it to do something that maybe it wasn't supposed to do, or I wasn't supposed to do? And so it was always just kind of testing the limits of the system. How far could I get? Never with any malicious intent, but really kind of pushing pushing the boundaries. And I think I continued that through you know my entire childhood, you know Corey, I think I shared with you there was definitely some things that I did then be
Corey Nachreiner 3:49
illegal now. Same, most definitely be never in a malicious way. Again, unauthorized access is unauthorized. You know,
Ryan Davis 3:56
sitting on forums and message boards and you know places are just learning things and and again finding things that maybe I shouldn't be into, but that that was kind of the thrill of the chase. It's okay.
Marc Laliberte 4:10
You just say that you're an AI agent, and all will be forgiven for what you access. In the '80s, in training, I
Corey Nachreiner 4:17
see in training very early. I guess AI started machine learning in the 70s, maybe so.
Marc Laliberte 4:22
It's possible. So Ryan, New Charter has eyes and ears all over the U.S. with your operator MSPs, and so you probably have a very good idea on just what the challenges are that most businesses are facing right now when it comes to cybersecurity. Yeah. So I guess just to get us rolling first, I'm curious, what is your view on some of the biggest challenges that you're hearing from your clients or from the MSPs that you work with right now?
Ryan Davis 4:49
Yeah, so you know, very candidly, right? For for most SMBs, you know, they definitely lack a security team. Most of them don't even have any IT staff. They're relying. On us for that, and so a lot of the times they're they're worried about what's in the headlines. Like, hey, we're seeing these things. The you know the water treatment company two towns over just got owned. What are what are we doing about that, right? And so I think there's a fair amount of just heightened fear right now because you know there's a lot happening in the world, especially for folks who aren't in tech and don't kind of understand how we got here, right? That's just like, oh, all of a sudden, there's headlines about breaches happening everywhere, and it seems it doesn't really matter what industry you're in; they're happening to everybody, and so you know our customers are coming to us and saying you got us right like we what you know do we need to be doing something different and so I think that's probably one of the biggest you know conversations that we're having very consistently. On the other side of it is they're also you know for I don't want to say for the first time, but we're having very deeply ingrained business conversations because what they're finding is, hey, like you know, we're seeing you know AI help you know competitors, and they don't want to miss that wave, right? They most most know that they need to be doing something with it, but they don't know what to do with it, right? And so we're really having a lot of business conversations about like where are there inefficiencies in your business? Could we apply you know the technology to that? And then I think the third the third thing that they're coming to us with is, hey, you know we got this AI thing. Where where is it? Like where are we using it? Do we need do we need governance? Do we need controls? Do we need a technology? How do we safeguard it? Right, and I think we're also trying to prompt a lot of those conversations because candidly, there's a lot that aren't worried about that. Right, they don't know. That's exactly right. Is well, no, you know we have a policy that says you know folks can't use it. We've
Corey Nachreiner 7:05
we've banned it.
Marc Laliberte 7:06
Yeah, clearly they're not. Yeah,
Ryan Davis 7:08
exactly right. So for us, it's about you know helping first and foremost do that discovery exercise, help them understand where they have it, right? Where it's embedded in the very tools that they're already using, and then start to wrap some governance around it, right? And governance isn't just, you know, a policy and procedure. It's it's also making sure that you have some tooling to, you know, put detective and protective controls in place. So, I think those are probably some of the biggest conversations we're having with with the customers right now.
Corey Nachreiner 7:47
I have a little follow up because I one of the things I love about MSPs is managed service providers started to offer IT, and IT is like business value, right? So the one conversation that is the business conversation, AI is IT. It's new technology that can be used to help business. I love that conversation because you're helping them leverage technology to increase their mission, increase revenue. Cybersecurity still today is-I obviously think it's very important. It's a necessary risk mitigation because to do business you need uptime. You can't. You don't want to lose money, but the the cost for IT for innovation feels like it's easy to get budget for because you're improving. How do you balance talking about things like okay, we we want to help you innovate with IT or with with our IT services, but we're also doing cybersecurity, and that's something that how do you turn that into a business conversation or innovation, not just a cost center?
Ryan Davis 8:47
Yeah, I mean, I don't think with the prevalence of issues that are happening in every sector, with with how fast AI has changed the threat landscape. There's not too many folks who are going and saying we don't need security, right? Like good.
Corey Nachreiner 9:10
That's a change in the SMB, maybe in the past decade.
Ryan Davis 9:13
I think what they don't understand is where that security needs to be applied. That
Corey Nachreiner 9:19
makes sense.
Ryan Davis 9:20
And so they get that they need it. They just don't know where they need it. What are the right places, right? Where? What are the right? In in you know again, we service you know every vertical, right? From law firms and doctors' offices and small banks and you know municipalities. It doesn't necessarily look the same for everyone because they don't have the same risk profile, right? And so, what we try really hard to do is understand, you know, first and foremost, what are the business drivers behind the conversation, right? How are they generating revenue? What are the things that you know they might. Have you know regulatory requirements to be protecting, and we try really hard to get them to understand what are the what are the pieces that aren't just like us trying to upsell them, right? It's it's way more about hey, are you aware that you're processing you know, credit card information, and you're writing those to a back end system, and and that means you need to be considering PCI, right? So much of it is just a lack of awareness, and so a good chunk of what we do is education about hey, these are really things that you should be doing, and here's how we can package that together, right? Like it's it's a set of solutions and services, and for us, right, we're trying really hard to not make security an add-on, right? Security should be a part of everything that we're delivering, and very candidly, that was one of the reasons why I came to to New Charter is when I kind of looked at the MSP landscape, you know there's plenty of MSPs out there who are quote unquote doing security, offering security services, but I think there's a huge opportunity for an MSP platform such as New Charter to to really differentiate on security and having that security first mentality, and so we've spent the last you know 1618 months that I've been been with New Charter investing in in security very heavily. So it's not just something that we're selling, right? It's something that we're doing, and we're baking it into. You've made it
Corey Nachreiner 11:35
part of your IT service. You have to have it just to do IT.
Marc Laliberte 11:38
I've heard it put that way by other partners too, where they say they'll sell security without managed IT services, but they'll never sell managed IT services without security, because that ends up just putting the risk right back on them. Because they're the ones responsible for those systems. If they don't also control the security, it can be a pretty big problem for them.
Ryan Davis 11:58
I'm very happy to hear you say that because you know the MSP market as a whole, while we represent such a huge market share, right? In terms of helping you know the the overall ecosystem, the the challenge is I don't think everybody feels that way.
Marc Laliberte 12:19
It's definitely not everyone.
Ryan Davis 12:20
Yeah, I think there's a lot that still very much see it as an upsell opportunity, and have the outlook that like, hey, that's another $10 that we can slap on per user per month, right? And I think that's the wrong way to look at it. I really do. I think if we if we contemplate where we need to be in the next couple of years as as security industry, we can't be thinking that security is is an upsell opportunity.
Corey Nachreiner 12:52
What I heard from you, which I love, and I think the MSPs that will have the best success in revenue growth is you're asking the user the business questions about what they do, finding where their data is, what type of data it is, and you're not upselling. You're catering the choices of security specifically to their needs, and I assume that's what that's how you build trust by getting to know their business, not just coming in as a products and will manage it, but coming in as the CISO, coming in as the CIO, understanding their business, and boutique kind of creating a service just for them and only giving them what they need at the time. Trust, I think, is everything probably in your business.
Ryan Davis 13:36
Yeah, I mean, when I when I interviewed with our our board, you know, that's the way I positioned it. As I said, we need to build a customer trust program, right? Like so, so often it's like the information security program. Well, yes, securing the information is important, but ultimately, what is it? Why are we doing that? Well, because we want to build trust from our board. We want to build trust, you know, internally with our own employees, but most importantly, we want our customers to trust that even even when they're not there, we're going to do the right thing on their behalf. And I'm a like adamant believer in the way that you go about doing that is through transparency. You have to you know say here's what we're doing. Here's how we're doing it. Here's the certifications that say we're doing it. And yeah, there might be you know times where there's more that we can offer them, and we will absolutely have those conversations. But I think from where we sit, it's like we want to lead with our best foot forward and say, "Here's what you're going to get out of the box. Here's what you can expect from us from a security perspective, and oh by the way, here's you know the sets of offerings that we can layer on top of that. Cool. Yeah.
Marc Laliberte 14:53
So you mentioned one of the pieces that's important to you is coming in with like education first as well too. And I think when you come into a new client, you try to get the lay of the land, figure out just how things are right now. I'm curious, as you and maybe in the last year, as you've spoken to potential new new clients to bring in under the space, like what typical gaps are you seeing right now commonly across maybe small and mid-sized businesses.
Ryan Davis 15:23
What gaps aren't we seeing, right? Like, you know, again, depending on the size, scale, and maturity of the organization, everything under the sun, right? You know, systems that are you know were end of life 15 years ago, and they're still operating on them, right? Kind of, if it ain't broke, don't fix it. Well, they very often have that mentality, like, oh well, you know, it still works, so we're just going to keep using it. And again, I don't think they historically they've never felt like they were a target, so they're just kind of riding it, and they've had no reason to believe up until maybe in the last couple of years that they were a target because it largely wasn't affecting them.
Marc Laliberte 16:14
I can see that. Yeah, I'm curious also. Like, so as a CISO, you're obviously plugged into the security space yourself, you've got to stay up to date on just what the latest trends are, so you can turn that back into guidance for the MSPs under new charter, and then also the clients you work with. From your view, are there any specific trends or techniques that you're seeing that maybe, if not keep you up at night, maybe something that you're focused on that, you think other people should be focused on.
Ryan Davis 16:43
I really thought you were going to ask me where I get my security news. I was asking, be like, "What's the 443 podcast? Thank you. Although I I heard earlier today that that that might rebrand
Marc Laliberte 16:57
coming soon have a new
Ryan Davis 16:58
name, and I by the way I really like the new name. Cool. Oh yeah, I can't wait to come back and join you guys for the brand relaunch. So things that keep me up at night, man. There's all kinds of things. For me, the the conversation of security always starts with this: What don't I know, right? Like, where don't I have visibility? And again, going back to you know how we try to frame those conversations with customers, it's we we want to help them discover what they don't know about their own environment, right? Like, where do they have shadow IT? Where do they have shadow AI? Where do they have you know ports and things that are open or old marketing sites or all of those things that by any one of those things by themselves is a big enough problem. But when you layer them on top of each other is is a pretty bad day, right? Waiting to happen. So I think about that for me personally, for New Charter, right? You know, coming into a new organization, you know, one of the biggest things is I just wanted to get visibility. I wanted to understand what our landscape looked like, and with you know an MSP platform like New Charter, where we've grown through acquisition. It's it's we have a little bit of everything internally, right? You know which security tools do we have? All of them, or mostly all of them? You know which you know platforms, you know operating systems. We got everything, right? You know obviously in the SMB market, there's a heavy Microsoft presence, but we support all kinds of unique implementations for customers. And so, what that means is we have to have one of those ourselves to make sure that we can support the customer in that. So, we have a lot of one-offs all over the place, and it's like, okay, well, if we need it, still you know, maintain that customer environment understood. But how are we at least segmenting it, you know, so that it's not exposing the rest of the? Sounds
Marc Laliberte 19:10
like my nightmare, honestly, having to maintain that many different things.
Corey Nachreiner 19:13
But I think it's a common like I want to double click in that because you and I, just based on your hacker story, we've been around for a while, and this is not a new problem. Like it used to be a very simple problem when we had our own on-premise LANs. Yeah, but you would have a network map that you, as an IT person, built from your assets. Maybe you scanned it occasionally, but even back then, there'd always be a FTP server someone put up for a temporary thing forgot to put down. I've even heard of people drywalling around a server that they forgot about, or it would be the CEO deciding he wanted some new internet-connected thing and would bring it in. So the classic issue, even 15 years ago, was physically bringing. Mean something new in the network and having to watch that. Back then, it felt solvable by IT because you could nmap or something. Yeah. Now my question is, how do you deal with the complexity of the modern world where it's not just that land, but now we have tons of stuff in SaaS services. We don't have control of that unless we have tools that do API calls. Those SaaS services, the big ones, have tons of connections to extension and plugin environments and integrations. We have AWS and Azure, which is tons of clouds. Then you have browser extensions. You know, it's not just monitoring the operating system. What browsers are out there. How many extensions that they? So I feel like it's the same issue, but we've added this complexity and huge supply chain of interconnectedness. And when we add AI, it's the same thing. Now we have agents that are connecting to all of these in different ways. So obviously, I know my product way of solving this, but how do you like how how do you express that to an SMB who they're probably the earliest adopters of SaaS because for them with low capital managing servers is hard, so they love SaaS, but I don't think they realize the complexity of interconnectedness they're they're accepting. I mean, everyone is accepting in our modern hybrid world.
Ryan Davis 21:24
Yeah, it's a it is a difficult thing to articulate and educate folks, especially when you know it's technology is not their first language.
Corey Nachreiner 21:38
Yeah, absolutely.
Ryan Davis 21:39
And so you know, coming back to you know, 1015 minutes ago, we we really try to start with the business conversation. Like, what drives your business? What are your three most critical systems? Where's the you know where's your customer data? And then we start pulling on those threads and understand. You know, we build we build a map, right? We seek to understand how their business operates. Right, and you know, commonly, right, like we start to find patterns. Right, you know, in law firms, they very often look like this. Right, and it's all about their case data. Okay, where do you store your case data? Oh, well, we have the centralized management system for that. Okay, let's appeal that back. Right, like how do people get data in and out of that? Okay, and so we start to build a layer, a set of layers, right, to understand. Okay, here's here's the most critical pieces. Then we have all of these peripheral things that they want to be able to you know have access to that. Okay, what's what's the simplest way that we can actually you know create choke points in between the right? Okay, it's API data, and again, right, it's not a universal answer. But when you start to find that, like after you've looked at so many organizations, you can really start to see the patterns emerge, and so when we go in, we say, okay, which of these three, you know, case management systems are you using? Oh, we use X, right? Like, and okay, then you have
Corey Nachreiner 23:15
a playbook maybe for that
Ryan Davis 23:16
one, and and so that's exactly right. As you start to build kind of that muscle memory of like, okay, they're using this one. We know that these commonly have these two or three integrations tied to it. How are you guys, you know, doing that? So that's the benefit of of a platform, right? Is it's not just one MSP against the world, right? We have 35 MSPs knowledge and you know 8000 customers across the United States and a part of Canada, and we're able to start extract extracting some of those patterns, and then we create some repeatable framework for it. That's
Corey Nachreiner 23:56
awesome. You made me think of I don't know how this if if you relate to this, but I did have another podcast where we interviewed Andrew Morgan of Write a Boom, and he said, like, when I start to get into this complex problem, he he pointed out that don't try to solve it all at the right place. So you started with asking them what are your needs, and you found the three critical business, or like not everything. Here are the three critical things, and you you eat away a one bite at a time. You pick one, you prove your trust with them by solving that in a way based on your experience and knowledge of playbooks. And if you can solve those three highest risk things, the risk management is you can maybe take more time for the rest. But you've also established that trust with them by solving those problems. That maybe later on they might be more willing to do extra security controls as you educate them about new problems that affect them. Is that?
Ryan Davis 24:53
Yeah, I mean, building that trust is the most critical component, right? If you can. And go and solve a business problem first. They are way more likely to say, "Oh, okay, yeah, that that wasn't so bad.
Corey Nachreiner 25:07
Yeah, and these guys know my business and took the time to help me with a real problem.
Ryan Davis 25:13
And then when you come to them and say, "All right, you know, let's talk about security, they're way more likely to take your recommendation after you've already helped them solve, you know some of those business challenges, and sometimes it's just you know building that rapport so that they they feel like they they're being heard and understood. And then I think the other part of it is it's it's like, well, you're not a lawyer, so you don't understand our law firm. Well, we don't necessarily need to under you know we don't need to be lawyers ourselves, but we can understand how a law firm operates, and we can, you know, apply our past learnings to to help you.
Corey Nachreiner 25:53
Yeah,
Marc Laliberte 25:54
makes sense. So because Corey said the AI buzzword, it's not my fault. I thought
Ryan Davis 26:00
we weren't going to talk about AI.
Marc Laliberte 26:01
I feel like if we don't, if we go longer than like 30 minutes without talking about AI, we probably get canceled.
Corey Nachreiner 26:07
I think AI will kill us in the future. It's listening right now, so we better give it a shout out. So we're among the the humans that keeps as pets.
Marc Laliberte 26:15
Make sure you thank your Claude after every session. Yeah. But so we, I what got to ask, like, all jokes aside, are you feeling AI right now as a buzzword, or are you actually seeing real productivity gains from it? Maybe inside New Charter itself, is there anywhere where you've been surprised where AI has been a pretty great benefit, or maybe somewhere where you think, where you thought it would be very helpful but it wasn't?
Ryan Davis 26:41
I mean, it's a significant improvement over Outlook reminders. I mean, in terms of you know being my personal productivity assistant, it's done pretty good there. Very, very, you know, candidly, we as New Charter have leaned very heavily into AI. You know, we talked a little bit about this, you know, the last couple of days, but we have looked at, you know, kind of all of the different permutations of how we can go and solve problems ourselves, problems for our customers, or problems for the industry, and those those buckets, you know, of problems are kind of the most basic categorizations that we use, you know, when we're discussing these things internally. And what we found is they're not actually that uniquely distinct, right? We there's things that we can solve for ourselves that actually benefit our customers, and if we can take some of the things that we've built for ourselves and actually you know share those with customers, they can benefit from it. So I think that's been you know kind of a discovery that we continue to discover right over and over, and it's like okay, how can we rinse and repeat that model you know, but with new challenges and problems that we we uncover, in terms of things that you know I've really been impressed with, you know as as we you know talked about here at the conference, right? We're we're trying really hard to think about how AI can can enable you know folks to work faster, right? Be more productive. Give them context at the time that they're going and doing that job, right? You know, loved you know all the the conversation about Ray over the last couple of days, and I think in many ways we're trying to do a similar thing with AI, but for the IT help desk, right? How can we take all of the you know knowledge that we have, you know, both about that specific customer in their environment, but also you know broader you know knowledge sets that we've gained through working with 8000 customers, and be able to deliver that at the time that the you know help desk technician is trying to solve the problem for the customer, and context is a hugely powerful tool when applied in the right way. And then when you apply a feedback loop where you can say, "Oh yeah, that was the right context. It's incredible how fast you can can really start to innovate and build on top of that.
Marc Laliberte 29:28
I really like that as a use case, that specific one you described. Both Corey and I came up through the tech support world, and so we understand like some of the biggest challenges is just finding the right information. But that's one of the things AI is the best at doing. It knows everything, and it can at least point you in the right direction. So that seems like a no-brainer to me.
Ryan Davis 29:49
Yeah, and and it's what we do. I mean, like that's the biggest segment of our entire business, right? Is is you know break fix you know IT support for our customers and. So, you know, we're seeing we're seeing some tremendous results there, and it's something we're iterating very rapidly on, right? Okay, we we did this. Can what else can we do? How how can we take it to the next level? And we have lots of ideas on on kind of how that might look.
Corey Nachreiner 30:18
Cool.
Marc Laliberte 30:19
So I guess to round us out, then just one last question for you. Oh, I have
Corey Nachreiner 30:25
some speed questions after, but that'll be fun. Okay,
Marc Laliberte 30:29
almost last question for you, at least for me here. We just finished up at the conference with hundreds of other MSPs. You, I, Corey, were all up on a panel to discuss some of the some of our view on the security landscape. So we already gave some advice to folks in the room, but I guess to people listening to this right now, if you had to give a piece of advice right now on maybe how to tackle just the world we're in right now with AI moving everything so fast, technology barely keeping pace sometimes, what bit of advice would you maybe give others in your shoes?
Ryan Davis 31:05
Others in my shoes. Well, what I would say to all of the security folks listening is, if you're not utilizing AI in your daily life, you need to be right. This is a technology that is that is changing so rapidly that if you were you know playing with it three months ago, it probably looks nothing like it does today. So, for me, as a security practitioner, the way I get better at helping articulate and solve problems around you know new and emerging technologies is. I need to go and immerse myself in them, understand how they operate. What are the limitations? Where does it do well? Where doesn't it do well? What are the you know upsides? Right. You know, I want to be able to articulate the benefits, but also what are the things that you know where you need to to be cautious. Right. And you know one of the things that we talked about yesterday is you know making sure that you're also asking your vendors how they're incorporating AI into their their products. But more than that is like what happens when Ray doesn't get the answer right? What happens, right? You you know, did somebody get owned, and you didn't tell me about it? Was
Corey Nachreiner 32:28
is there audit trail that we can follow to see what happened, right?
Ryan Davis 32:33
And so I think that's a a really key piece that I would you know encourage all security practitioners, all MSPs out there, is you know challenge your vendors. Yep. Seek to understand how they're incorporating this technology. Right. It's not just like oh you take a box and it's now AI enabled. Right. Where does your data go? What are the backend systems? Are you training off my data? Do you absolutely do you have you know fail safes in place that if if the model starts to behavior, you know, erratically, how do we stop that? You know, what is your what is your incident response plan look like with the AI that you've now baked into all of the products that are now you know completely spidered throughout all of my 8000 customers? Get that.
Marc Laliberte 33:18
Pull the plug and hide from all the Waymos that are now coming to my house.
Corey Nachreiner 33:23
Joking aside, though, by the way, I mentioned the audit trail. We did have an AI competition where we invited MSPs to say we have Ray give us use cases you want. Yeah. One of the use cases that has already been enacted was basically a hashed audit trail of things that happen with the agents. So, love those questions. Me and our our department is the one that's going to help you understand the trust. And we, the questions hopefully usually will give you a good answer now. And if it's we don't know, we'll go find the answer and fix it. So I love that.
Ryan Davis 33:59
Yeah.
Marc Laliberte 34:00
Awesome, Corey. You want to round us out with your rapid fire? Yeah, yeah. These are
Corey Nachreiner 34:03
just so for fun. It's been awesome talking about the industry, but just because we're geeks, what's your favorite hacker or security-related movie, media, TV show?
Ryan Davis 34:14
I mean, I love The Matrix. Awesome. I just that one resonated with me so much. I remember going to the public library, and my mom had said I couldn't watch it, but my library card allowed me to check out
Marc Laliberte 34:37
R-rated movies, VHS tapes. Remember those? And
Ryan Davis 34:40
so, yeah, that man. I I like after I got done watching it the first time. I was like, wait, could that like could that be right? Like I was just so excited about the possibility. I was like, I immediately rewatched it again. So yeah, that was awesome. Cool. I'll
Corey Nachreiner 35:02
do a weird follow up, but since we're living there, there's an internet subculture that believes the Matrix is a a follow up to the prequel Terminator. Since we're talking about AI and Skynet, which will make us batteries or pets one day. Red pill or if if AI goes rogue, red pill or blue pill?
Ryan Davis 35:24
That's tough. I think I would very much want to be a part of the resistance.
Corey Nachreiner 35:30
Cool, me too. Love it. That's why we're in security, right? Yeah. Do you have a favorite like hacker security related conference you go to that you'd recommend people check out?
Ryan Davis 35:40
I mean. Black Hat Def Con, you know, Def Con is is absolutely like nothing else. You know, honestly, I love attending some of the small regional conferences. I really do. B
Corey Nachreiner 35:57
sides can be good too. There, yeah.
Marc Laliberte 35:59
B sides down in Austin's been one of my favorite ones lately.
Ryan Davis 36:03
Honestly, it's whatever the conference you can get to, right? I think once once you attend one or two, like you'll start to realize like these are my people. These are these are folks that I can have a conversation about phone freaking with. Phone
Corey Nachreiner 36:19
freaking, love it, 80s. Yeah, fellow 80s guy.
Ryan Davis 36:23
Yeah. So for me, you know, figure out what you can get to, and there's plenty of you know online virtual you know conferences as well where you can participate remotely. If you can't get to one of those, I think it's a great way to you know, kind of at least kind of keep up with what's going on, even if you can't be there in person.
Corey Nachreiner 36:46
Cool. Another question that might be going on: a lot of us security folks, we're here to fight the good fight against malware people, but sometimes it's hard not to respect a good hack, whether it's social engineering or some big, crazy, sophisticated tech hack. Do you have a favorite hack or something that you just remember was wow that was crazy?
Ryan Davis 37:08
Yeah, I do have a favorite one, and I have to be very careful about how I talk about it because much earlier in my career, I worked in the DoD space, but I remember sitting in a briefing, listening to somebody worked at a three-letter agency, and they were talking about some red team exercises that they had done. And the long story short was they compromised a VoIP phone sitting in the conference room of a you know general in theater.
Corey Nachreiner 37:42
Wow, theater. And
Ryan Davis 37:45
by compromising that phone, they were able to, you know, listen to all the conversations that were happening inside of that, you know, strategic office, and they actually learned enough to redirect physically redirect a bunch of military assets.
Corey Nachreiner 38:09
Wow, that's cool. To to a
Ryan Davis 38:12
different warehouse, and so when it got time to this A level, when it got time to go and do like the you know the reveal, right? It was like you know you guys might want to go check this warehouse, and there was all of the assets that had been re
Corey Nachreiner 38:32
cool
Ryan Davis 38:33
redistributed or re re assigned to a different location. That's crazy. Yeah, that was one of the cool favorite. Okay, one
Corey Nachreiner 38:43
last simple one. This is personal adult beverages. If you're if you're late at a con, what is your favorite adult beverage? If or if you don't drink or consume your favorite.
Ryan Davis 38:52
Yeah, no, I do. I do love a good old fashioned.
Corey Nachreiner 38:55
Fantastic, love
Marc Laliberte 38:57
it. A man of style.
Corey Nachreiner 38:58
Yes. All
Marc Laliberte 38:59
right. Well, Ryan, thank you. This has been awesome. I appreciate you taking the time to to join us on here and safe travels to your next adventure. And
Corey Nachreiner 39:07
we'll see you again on on Inside the Red Cell one day. Wink, wink. All right, sounds
Ryan Davis 39:12
good. Thank you both.
Marc Laliberte 39:13
Well, hey everyone, thanks again for listening. As always, if you enjoyed today's episode, don't forget to rate, review, and subscribe. If you have any questions on today's topics, or if you want to suggest a future episode topic, can reach out to us on Blue Sky. I'm at Intsmark.me. Corey's at Second Ept. Both of us are at WatchGuard underscore Technologies. Thanks again for listening, and you will hear from us next week. Ciao.
