George Kamide
speaker
99 appearances
1 recordings
1 series
first heard Sep 2024
last heard Sep 2024
George Kamide’s voice in public audio — every appearance, attributed to the second.
Trend
recordings per month · last 12 monthsNo recordings in the last 12 months.Older appearances are listed below; set an alert to hear about the next one.
Appearances
is there to enable the farm also makes it vulnerable to the food supply stuff. And that was even before I was in cyber. But I understood that software dependency and that vulnerability. And also, yeah, I think just the I don't know if transparency is the right word, but like There's so many layers in it. And I think many of people who occupy different layers can't see through to the other one.
Right. So they're operating kind of in an information vacuum and like, I'm just going to look my thing over here and really not consider the implications downstream. But I think if we can get to models where there's more information sharing, you may not have. something to do with it today, but there's maybe information in the system that can be used later.
So, for example, you know, NASA maintains a third party database where pilots and airlines can anonymously report errors and misconfigurations and problems and accidents. And others can learn from that. And every year that data is collated into like updated guidance for pilots. Right. So I just think that is a very powerful idea. The ability to basically show your work and your mistakes.
Because in Cyberland, a breach is going to hit a headline. So and so lost all this stuff. Turns out an S3 bucket was left open to the Internet. Or so-and-so taken for a ride because of the move at file transfer exploit. Okay. And then like maybe two weeks later, we see in the popular media another thing hit by ransomware.
If we dig in, as people who work in cyber will see, it was the same vulnerability or the same exploit. But I feel like if people could catch something, because they're always near misses in cyber. For every headline, there are probably 10 instances where there was an oh shit moment and they caught it before it was a problem. Either it was a vulnerability or a misconfiguration.
But there's so much shame in cyber and people are so afraid to talk about those mistakes that withholding that I think is keeping us less safe overall.
Whereas if somebody could feel comfortable enough to report like this happened and we kind of have intelligence sharing through the ISACs, but I don't know of a mechanism where people are publicly sharing, and it should be anonymous, problematic settings, configurations, mistakes.
overlapping tool sets, whatever was the problem so that other people can learn from that and that we don't have multiple casualties because of the same issue. And I think, for example, if we had that in the food supply, it would actually not only be a breadth issue, it would be a depth issue, right? You could have people talking about software issues in processing like OT, ICS instances.
It could also be, who knows, like just the billing software, right? That's what a lot of ransomware just hits that operational part of the business. Anyway, I just think because we're operating in opaque layers, it gets harder and harder for us to understand like where we could do better, essentially.
You had pointed out to me, or I think you'd said it to me, that we have more traceability and information in a barcode, like on the back of a pack of Oreos, than we do in our standard supply chain of software.
You know, those kind of moments. My co-host is very clear on from his military days, like the way it worked is if there's a sit rep situation, it's not rank. If you're like the junior analyst who is writing the report, you got to be able to stand and in 30 seconds deliver the news to the commanding officer. And I don't think that we invest as much in those communication skills, which is a miss.
Many companies are willing to sponsor their cybersecurity employees for technical training certificates and the technology stack that they're using.
And we just sort of rely on the communication skills like you either have it or you don't, which I think is unfair because it means if they're not nurtured and you're highly technical, you can kind of get railroaded into like you'll always be the technical lead, but they're never really going to let you into management because you can't interface between the layers.
yeah and so if you do nurture those i think you get instead of having that skill set concentrated in to the management level i think broadly we might be able to have better communication sort of through organizations security maybe is not viewed askance as it often is like oh those are the it weirdos
Um, and then also dealing with these situations, like being able to maintain a calm head during an incident and calmly report on like, this is how we are responding to it. We remember we had this plan that we walked you through and we are at this stage of the plan and this is how we're adept. I don't know.
It takes a very cool head because reacting emotionally or in a highly fatigued state also often leads to worse decision-making.
Yeah, I mean, look no further than the recent CrowdStrike and Windows outages for the impact on millions of people who have no idea what those companies, like what CrowdStrike is. Household name and cyber. My mom knows what CrowdStrike is, what they do. And just the ability to clearly communicate why can you not get home today? Yeah. Right.
And you can't just say like supply chain, SDLC, kernel level update. Like what is that going to do for the person who is now stranded in the airport?
We don't do ourselves any favors by making it harder to communicate the complexity of our systems or our event. I think a lot of it starts with that awareness and then trying to empathize with where other people are coming from.
everything from this is why the food system is fragile because this and then this is connected to that and then this to even doing it within orgs right usually the front office of like a big whether it's a food processing plant or food processing conglomerate you know like a tyson's or a conagra like they are operating in a different mode in front of computers than the folks on the floor than the people who actually have hands-on materials getting the stuff off the truck and
Showing 41–60 of 99 · page 3 of 5
← Previous
Next →