Cybertraps Podcast

Welcome to the Cyber Shops Podcast.

I'm Jethro Jones, coming to you from
Washington, founder of the B Podcast

Network and author of the book School X
and how to be a Transformative Principal.

I'm a former principal at
all levels of K 12 education.

I.

Greetings, everyone.

I'm Frederick Lane, an author,
attorney and educational consultant

based in Brooklyn, New York.

I'm the author of 10 books, including most
recently, cyber Traps for Educators 2.0.

Raising cyber ethical kids and cyber
traps for expecting moms and dads.

Jethro and I have teamed up to bring
timely, entertaining and useful

information to teachers, parents, and
others about the risks arising from

the use and misuse of digital devices.

Over the coming weeks and months,
we'll be talking to some of the world's

leading experts from the fields of
education, parenting, sociology,

cyber safety, and cybersecurity.

Today.

Join us as we look at what it
takes to better navigate our

increasingly high tech world.

For more information or to
donate to our work, please visit

center for cyber ethics.org.

The Cyber Traps Podcast is a
production of the Center for Cyber

Ethics, a 5 0 1 3 independent
nonpartisan educational institute.

Dedicated to the study and promotion
of cyber ethics as a positive social

force through research, curricula
development, publishing and media,

professional training and public advocacy.

Greetings there, Jethro.

Fred.

Long time no see, so glad to be
doing the show with you once again.

We had a whole bunch of episodes
where I was solo and I missed

my partner, so welcome back.

It is good to be back.

The clouds are parting and I think
things will be a little smoother,

Oh,

excellent.

Well,

yes.

Excellent

we've got a great guest on today.

His name is John Spiegel.

He has , 25 years of experience
running global networks and

managing infrastructure.

He's an industry pioneer in
software-defined networking

and software-defined WANs.

John has spoken on the topic of
network transformation and industry

conferences such as Gartner Interop.

VMworld Palo Alto Networks Ignite, as
well as executive round table discussions.

He's also been a customer advisor
to companies like VMware, Palo

Alto Networks and Cisco systems.

Disruptive startups have also leveraged
John's knowledge to bring products to

market resulting in successful exits.

He hosts a podcast called The Edge,
where he discusses the role of CSO Zero

Trust and explores the emerging sass e
landscape when not helping companies on

their journey to modernize and secure
their networks, John can be found

cycling on the back roads of Oregon.

And if you're lucky enough to see a video
of one of his great answers in one of our

audiograms, you'll see he's got like six
bikes behind him, which which is awesome.

So John, welcome.

So glad to have you.

Thanks for having me on the show.

Yeah, this,

you're inspiring me.

I think I'm going to have to
hang up my old marathon shoes

yeah.

me from now on

Yeah.

A funny note about that in Kodiak, where
I was a principal for three years it's

an island in the Gulf of Alaska and
there was a running coach whose kid would

throw his shoes around the telephone
pole, they'd tie 'em together and then

throw 'em around the telephone wire.

And so there was this tree and
telephone pole that were just

covered in shoes from kids who had
finished the season or whatever.

Mostly his son's own shoes.

But you know, those, those traditions
do exist and they are real.

So that's not what we're
here to talk about though.

Even though exercising
is important and healthy.

John, why don't you start by explaining
what Zero Trust, s, SE and SSE is?

For our education, mostly
education focused listeners.

Yeah, this is an area that I
um, probably spend most of my

time working on now here at HPE.

Put simply zero trust flips your
traditional security strategy on its head.

In the past, our applications
the, the key data that we ran our

businesses, our educational groups
with even the government was hidden

behind what I call the four walls
of the corporate or a data center.

So, much like a castle.

So we had these.

Massive firewalls, security devices,
um, and everything behind it was deemed

to be trusted and everything outside
of it on the internet was untrusted.

It's, it's very similar if you look
at a firewall or an internet device

that you might have at your home.

Maybe it's a, a Comcast device or DSL
from a another vendor on one side.

It's your home.

Everything inside of
that home, you trust it.

It's it could be your tv, it could be your
kid's laptop, iPads, all of those things.

You just trust those items.

Everything outside of that.

That's the world of the barbarians.

It's where all the bad things happen.

Uh, and, and that's how we ran
cybersecurity for a very long time.

Then things changed.

The internet came around
and started roaming around.

Left the data center.

They became SaaS applications.

And if you're in the education industry
it's likely like Google Docs and all

the other Google items they have.

Or Seesaw is, is something
my daughter uses, which is

delivered as a SaaS service.

Many items like that.

They don't exist in the
educational data center.

They're outside hosted
by firms on the internet.

And how you secure those is gonna be very
different than what you did in the past.

On top of that, now people
they work from home.

Hybrid workforce.

We saw during COID the emergence of
the school of one, if you want to

call it that, or what we call the
branch of one in the corporate world.

Whereas, you know, these devices that
again, were behind the firewall wall

in the schools, were now at homes.

How do you secure those items?

What do you do with them that has
risen to this new strategy called Zero

Trust, whereby we look at relationships
between devices, applications, and

try to get them down to a point
where it's just the things that you

actually need to get your job done in
the education space, it may be those

applications or enablement tools like
Zoom or teams or, or things like that.

Instead of seeing All of the
applications that you might see in a

data center or a school network, it's
just those five or six applications,

nothing else, nothing more than that.

So you're constantly looking
at trust, relationships.

The simple way I put it is zero trust
is much like when you have a A ship,

call it, I don't know, the Titanic
whereby you have watertight compartments,

which the Titanic didn't have.

And that's why it hit the
iceberg and, and sunk.

But in a ship, if you're, if
you ever served in the Navy, my

father served in the Coast Guard.

He actually was stationed in
Kodiak for a little while.

ships are have watertight compartments.

When you go to an alert status,
you close everything up.

You, you, you, you sever off
you know, spots in the ship

from other spots in the ship.

So if they do get water in
them, it, that's the only

place that gets water in there.

And that's one of the main
differences with zero trust.

It's, it's looking at those trust
relationships and you only have access to

the things that you need and nothing more.

So if I could, John, I mean, it
seems to me like the bulkhead

metaphor is really good.

For intrusion, right?

If someone's trying to get into
your system and exfiltrate data

from places they shouldn't.

I think one of the issues that K 12
institutions run into though, is the

poor handling of data by some of the
vendors that you're dealing with.

So when you're talking about
providing that kind of security it.

Doesn't necessarily reach out
into the broader world and make

sure that it's protected if it's
sitting on a server somewhere else.

Yeah.

And that's, that's a really good point.

Which leads me to the other two.

Frameworks that, that we're asked
about, and that's Sass, e and SSE.

Um, SS SE is this framework basically
that brings together zero trust

with networking, with security.

It's two main pillars, is network
access in the form of what

we call software defined wan.

I won't get into it too deeply.

The other side is this other framework
called SSE, where I deal with a lot.

SSE has certain components.

Zero trust is at its foundation.

Um, but it also has protections
from the internet, which we call

a software secure web gateway.

Um, it has another pillar
called remote access.

Called zt, NA zero Trust, network
Access, and then the item that you're

talking about, how do we secure these
SaaS applications that is called

A-C-A-S-B, or a cloud Security Access
broker, which actually will go into

these SAS services and then start to
look at how do we treat that data?

Should that data be secured in a way?

Are the right settings available?

Um.

Even has mechanisms whereby we can
look at how that data is transferred.

If it's transferred through one of
these SSE systems we can apply data loss

prevention techniques in a very simple
way to understand, oh my gosh, this, you

know, data has social security numbers.

Or maybe it, you know, we know what
the nomenclature is for that school's.

ID system so we can say, oh, that has,
you know, 1000 school ID systems in

it and start to take action on that.

Should that data be
transferred to a Dropbox?

Probably not a good idea.

Um, or is it, you know, going
between a school administrator

to another school administrator?

That's an okay thing to do.

At the core of all of these systems is
and, and that is really where the focus

of security has to be going forward
because it's not enough to put it behind

a firewall in a data center, these massive
walls, we have to get down to the point

where identity is the mechanism that
we're leveraging to understand should you

have access, should you not have access?

I, I'm gonna come at this from a
slightly different angle, but one of

the projects I'm working on is a book
called The Rise of the Digital Mob,

and it really is examining the impact
of technology on our communications,

particularly our political communications.

And so one of the issues that gets
raised by that, I think is relevant

to what you're talking about, which
is the issue of online anonymity.

And so it seems to, what I would infer
from what you're saying is that This

is another reason to take a hard look
at the concept of anonymity online.

You know, particularly from a
cybersecurity perspective, you

really do need to know who's
coming in and out of your data.

Absolutely.

I, I agree with you.

I mean, there is a, there is a,
a, a balance point between being

anonymous and, and not being anonymous.

Um, but we do see it
in the school setting.

My son, uh, who goes to school, he was,
was bullied online and it was not on

your regular, it was on social media
obviously, but you know, people take.

A, a, a bit different stance in how they
talk with you, how they interact with you.

If it's online and they're anonymous,
they will say things that they

would never say to you in person.

And,

uh, to your point, I think, you know,
identity has to play a role in that.

We have to get back to more of a civil
society where what you say has to be

very similar to saying it in person.

Because what I might say to you, In,
in, in a setting when we're in real

life, could be very different than on a
political format or in a school format.

And identity has to play a role in that.

,
That's

it's conscious in our human, human life.

I mean, we're just mechanisms of
what, 250,000 years of evolution.

and you can't just change that
in a, in a matter of two decades.

It's just

Yeah.

Give or take.

I think you're ex exactly right.

No, look, I, and, and this is a little
off, off topic, so I don't want to go

too deeply into it, but the the issue
of anonymity, You know, I am trying to

recognize that it's a power issue, right?

So there are times when anonymity
is a recourse, you know, to power.

But I think now the table is
flipped and anonymity has taken

on its own power that gets abused.

Absolutely.

I, I agree with you.

I think one of the things that I see
missing, and, and maybe we can touch

on this a little bit at least from my
experience in school, is this thought

of bringing them up as digital citizens.

I.

What are the responsibilities, uh,
that you must have in this environment?

I, it's very new let's just say that.

And what's coming at us is coming
at us super fast, but I think that's

a topic for education is what are
the rules of the road regarding

these new mechanisms and how do we
learn them and how do we teach them?

How do we teach 'em about privacy?

How do we teach 'em about, you know,
Phishing and, and some of these other

cyber attacks that are going on out
there and, and, you know, how do we treat

'em to be civil people , in a public
center that might be a social media.

That's a great question.

I Jethro, I mean, digital citizenship is
a topic we have touched on many times.

Yeah, I'm, it really is, and it's
something that the, the reason

why we're having you on talking
about these more advanced topics.

Topics is because we want people to
have a better understanding of what

something like Zero Trust is and why
you should pay attention to it and know

what it is and how it, it, the, the way
that I was thinking about this as you

were talking earlier, John, is that I.

It's like having a a badge swipe at each
individual classroom door in the school so

you know who's going into each classroom
rather than just saying, once you're

in the classroom, everything's fine.

And, and we know from bad things
that have happened in schools that

somebody can get into the school.

In, in a way that is not authorized and
be in the school when they shouldn't

be or where they shouldn't be.

And, and that can then make it
not safe for everybody else.

And I think that like having everybody
wear name badges is important and being

able to identify who people are and being
able to say something as simple as, Hey,

What's your name?

What are you doing here?

And, and being able to ask
those questions is good.

I, I want to talk a little bit about
the identity, because we're talking

about a virtual space and, and how
do you ensure that someone is the

right person when people can share
passwords and things like that.

What are the mechanisms in place to
prevent that kind of stuff from happening?

Yeah, that's a, that's
a really good question.

I mean, that comes back to how strong
is your identity program If it's based

clearly just on identity and passwords.

Um, to your point, sharing
passwords, sharing those

identities becomes very prevalent.

And as well, what is the complexity of the
password with zero trust in SSE Sass e.

You need to go beyond that.

You need to start to
interrogate other items.

What's the device that they're using to
leverage that application, that system?

Is it a school device?

Is it a home device?

Is it up to a certain standard?

Because that is another area that we
see lots of vulnerabilities around.

If, if those devices are not
maintained to a certain patch level or

revelation OSS level that's an item.

As well as where is it coming from?

So if a device You know, I, I'm in
the Beaverton school district here.

If the device is coming from this
Beaverton area, it's probably, you

know, reasonably certain to assume
that that's, that's legitimate.

But if it's coming from North
Korea or Texas may not be so much

we may want to, you know, ask some
other questions around that device.

So that's a whole nother
mechanism around it.

The other area that to be aware of,
and, and I, I don't know how well

this plays into a school system
is MFA being able to have multiple

factors for that authentication.

Certainly you know, a student.

May not be possible, but for an
administrator, a principal, somebody who

you know, has that access to the, to the,
the crown jewels of the school system

MFA is is another area to play into it.

So, going beyond just the
username and password is critical.

Having a good identity system.

Being able to then to, you know,
interrogate further depending on

the type of access you're granting
that person that, that to that

whatever resource or application.

Another point I wanna you know,
the card swipe analogy that you

put out there zero trust looks to
go a little bit further than that.

So instead of having a school where
you have the ability to do card

swipes on e every door zero trust
really looks to eliminate You even

seen the possibility of those doors.

So if you have a school of a hundred
doors, um, and that person only needs

access to 10 of 'em what zero trust looks
to do is, is eliminate those other 90.

So, all they see are are the 10 doors,
and those are the only ones they get into.

The reason for that is what happens is
when an attacker, a si bad cyber actor

breaks into a system, they start to
leverage what we call lateral movement,

which means they start to move around.

Or if we're using the school analogy,
they can move around the school to

see where the doors are available.

And even if you might have
a card swipe on there.

They might be smart enough to break
into that card swipe mechanism and start

to open those doors so those nother
other 90 doors become vulnerabilities.

Yeah, I appreciate you bringing that up.

'cause I think that that's the other
piece of this that people who aren't

in the know may not even be thinking
about that there's, you know, if, if I

could make it so you could only see that
there are 10 classrooms in my school

and you can't access anything else
because you don't know that it exists

that's a much different approach than

You could only go in the
a wing of the high school.

And, and so I, I'm glad
that you brought that up.

I think Fred was gonna ask a
question, but Fred, I do want to

talk about student privacy and them
using VPNs and things like that.

So if, if you're, if you wanna stay on
this topic, let's stay on it, but if you

want to move on, we can move on to that.

I think we can do both.

Oh,

So

let's stick with Let's stick
with this topic for a second.

So, yeah, absolutely.

I, I think John Jethro raises a
great point, which is that, you know,

schools are a perpetual testing ground.

For cybersecurity because of students.

I mean, this is not a static situation.

You've got x hundreds of people
who are constantly testing what

the parameters of your system are.

Are at the heart of that, so, you
know, to how, how do you suggest

that school districts cope with that?

What are the best tools for kind
of keeping the little rugrats

from running amuck in your system?

Yeah.

Uh, that's a technology I personally,
uh, would like to see go away.

'cause what VPNs essentially do is they,
they put your device on the network.

I mean, it, it is clearly on the network.

It's an extension of the network.

There's nothing in between.

It.

And that's one of the challenges that
we're dealing with now, that applications

have moved outside of the data center.

In the past, that was okay
because you had a device.

Most likely it was a firewall that
was doing inspection of that traffic.

Um, but with VPNs, that's no longer the
case, uh, because maybe some of that

traffic is routed back to the data center.

Some of that traffic's inspected,
but the majority of it, if it's going

to Google, you know, pick your SaaS
provider in the education space.

Is not being inspected.

So, that's where tools like SSE or
frameworks like SSE come into play

primarily with this technology called
Zero Trust Network Access or ZTNA.

Essentially what it does is it routes
the traffic to a central that is local.

Uh, to the area to eliminate
or reduce penalty of latency.

And that traffic can be
inspected even if it's SSL based.

We can break that tr that.

And, and approximately 80, 85%
of traffic on the internet today.

Is encrypted.

So, that's one of the me one of the,
the advantages of an SSE system is

it can be that man in the middle,
that sanctioned man in the middle and

start to break down that traffic so
you can start to see really what's

going on and then apply policy.

And that policy can be,
uh, based on you, you.

You get access to these applications,
or it can even be inspecting the traffic

that's destined for the internet.

So, what categories are you
going to allow people to access?

And that's very critical in
a, in a school environment.

And yes I've got a 16-year-old I don't
know how many security mechanisms

I've gone through to make sure that
he can only access what he accesses.

And I, I'll tell you, it's,
it's really hard because.

He's gotten down to the point where
he figured out that he could change

his Mac address on his device and
rotate it to, to get around some

of the security protections that I
was putting in, in place to prevent

him from getting to certain sites
a teenager would want to go to.

So,

um,

You, you sound like a, you sound
like a proud, frustrated father

I, I think I think at the end of the
day I've raised a hacker and, and uh,

and I wasn't attempting to do that.

He just is naturally curious and
if there's something out there that

he wants to go after he'll spend
a lot of time on going after that.

it.

It has been an observation of mine since
I've been writing in this area for a

while, that there are a few people on
Earth more dedicated than a teenage boy

who wants to get at something on the end.

Yeah.

That

really, really impressive.

So, John, if I can beg
Jethro's, forbearances here.

Let's, let's pivot a little bit and let
me, um, let me just ask you this, the It's

clear from the recent invitations I've
gotten for school districts and so forth

that concerns about AI are exploding.

This has just become such a hot
topic and people are grappling with

understanding what it is to begin with
and then what the implications are.

I would think that someone who's
dealing with cybersecurity would

have some thoughts on that.

So, let me ask you a
couple of different angles.

So number one.

What do you see as the biggest
potential threats of AI to a

security professional like yourself?

And then the flip side, obviously, are
there ways in which you might be utilizing

it to strengthen the work that you do

Oh gosh.

Let me, let me start with the first one.

Or the, the, the latter part
of your, your question there.

Um,

Sure.

are there, are there benefits
to AI for cybersecurity?

Absolutely.

Cybersecurity is a very complex field
and we have multiple tools that we're

dealing with, and we're trying to
basically fight the bad guy in real time.

That's a hard thing for a human to do.

So if there is a mechanism that can
bring to light insights start to, to comb

through the data in real time and start
to understand patterns that is a benefit.

So how will, how will AI
be used in cybersecurity?

It's gonna be very much like a chat
bot that you will encounter on a

website when you're trying to buy
something or if you're trying to,

you know, change airline tickets.

I recently did this with Alaska Airlines
where I knew I was sitting on the runway.

I knew I wasn't gonna make
that next flight, so I.

Opened up the chat bot and we had a
conversation at the end of the day.

It, it, it changed my flights.

I was happy.

But how is it gonna be
used in cybersecurity?

It's going to essentially take away a lot
of the complexity of the past where I had

to know how to work with device A, B, and
C and being an expert at all of these.

What it's going to do is present
the relevant information to me.

And then give me a list of, of decisions
that I can make based on you know,

one, two, or three high priority,
low priority or, or just ignore it.

But those insights are gonna pop up
and it's gonna make me it's gonna

give me the decision making process,
how that decision is executed.

I might be able to leave that
up to the ai, or I can, I'll

send that off to a human.

So yeah, AI is gonna definitely, um, make
a difference in, in this, this battle.

But how, how can it be abused?

AI's only as good as the
data that it's trained on.

So if I'm nefarious what I'm looking
to do is get into that data train it

in a, in a, in a way that benefits me.

So, security around the data that AI
is leveraging is absolutely critical.

Um, the second area is if I want
to create an attack it's going to

be a lot easier using a, a format
like a chat GTP, uh, to start to

understand, okay, I'm going against a.

You know, A-A-A-A-V-P-N from Vendor
X, what are the major vulnerabilities

based on its operating system that I can
leverage, and how do I bring together,

you know, the attack in multiple ways?

I.

In the past that was hard to do.

You, you, you had to do a lot of research
and bring it all together and code it.

What's difficult with tools like
chat, GTP or whatever the follow

on is, I can just ask it, query
it, it will spit out probably 80%

you know, the framework there.

And then I'm, I'm left to
do the 20% and customize it.

That's a pretty easy thing to do.

So, it it, it's gonna go both ways, but
we are definitely in interesting times.

Well, I think the thing that was
fascinating for me is the implications for

things like phishing and spear phishing

attacks where .You know, traditionally
we've relied on bad English, bad grammar,

inaccuracies in spelling things like that.

And of course, the large language
models are going to take that away and

everything will look smooth and perfect.

And the background research
to make the underlying pitch

more credible is easier to do.

Yeah.

Now it'll say, let's dive in
and that'll be our key word.

And anytime I read that, I
know it was written by AI

Well, we need some kind of
linguistic watermark, do we not?

We have to.

That's one

thing.

We've never really, never
really, in the 14 months that

chat, GPT has really been active.

Nobody's really sat down
and talked about that, so.

That's good.

Yeah.

Any, any thoughts from you on that, John?

Yeah, it's, it's, again, it's early days.

It's very early days in our journey
to ai and we're gonna learn a lot.

But is moving fast.

It's, it's, yeah, it's,
and it's everywhere.

it, every concept, every conference
I've been to in the past, uh,

three months, AI has been.

Top of the charts for
anyone talking about it.

To the point even where Forrester, which
is a analyst firm that tends to be very

conservative about making predictions
around new technologies came out day one

starting their security risk conference
in Washington, DC and it was all about ai.

So, we're at a watershed moment for sure.

I absolutely agree.

Yeah.

I think for, for me, the, the other
piece of the student privacy that I

want to go back to is, . Students have a
right to privacy as well, and employees

have a right to privacy as well.

And so how do you balance the
need for privacy and the need for

security in a virtual environment,
both for the employee perspective

and for the student perspective?

I think it goes back to, always gonna
have access to all of these things, and

that's most likely the IT administrator.

So, they have to be well-trained
and understood that thou shalt

not look at certain things.

Um, and that's a, that's a critical piece.

I, I.

You know, previously my, I worked
in a company where that, that,

that was violated and it was the
one time that I met with the FBI

Uh, it was, I was the victim of it,
it, but the one time I met with the

FBI and I, I never have to hope to have
that thing ever happened to me again.

But That's insider threat
is, is always prevalent.

Especially in an environment like
an education system where you're

probably going to be leveraging
some of the students for, um, it, it

just the way it is and that's a good
thing in, in, in a lot of respects

because it gives them a leg up on.

Their journey, their career, their future.

They get access to some systems that
hopefully they can, you know, go on

and, and have a, a strong career in.

So there's, there's definitely a balance
point between how you, how you treat that.

And it's something where I don't think
we, we have all the answers and there's

still a lot of of questions about that
and you know, . A couple of thoughts from

me on that is, you know, employees do
have a right to privacy, but also they

shouldn't be doing stuff that that is not
pertinent to their work on work devices.

I had a friend reach out to me the
other day and he said, Hey, I think

I'm gonna get my own . Personal device.

'cause I've always used my work
computer for all my personal stuff.

And I'm like, dude, that's crazy.

Like, I couldn't even fathom it because
I, I haven't done that until I became

my, I I'm doing my own business.

And so that's, now I do, but before
that, I always had my own computer

because I didn't want my . You know,
shopping history, my personal stuff on

the district computers, because I thought
there needed to be that, that separation.

But a lot of people don't
believe that that is the case.

And I, I think more people should
believe that that's the case.

But you know, you shouldn't
be bringing that stuff in.

But then it gets a little more tricky
with students because they don't have

they may not have access to these things.

Except through their school devices.

And so those are, those
can be tricky situations.

And you know, if we
just dive into something

Specific if a student is struggling from
a mental health crisis or something like

that, and they're trying to find support
for that in a way that is, is working

for them, that they're, you know, trying
to research and learn what they need

to do to deal with the, the challenges
they're facing they, that information

I think should still be private.

But . You know, if, if we can track
everything they're doing and see

everything they're doing and everywhere
they're going, then we're gonna,

we're gonna be able to see that.

And so then does that mean that we
intervene or should we not intervene?

Or, or how, how do we, how do
we know what the right thing

to do is in those situations?

Is, is kind of where I'm going with that.

Any thoughts, John?

Yeah.

a, I mean, that comes down, that's
a hard, hard, hard question.

In terms of the devices think there's.

Probably a generational issue here.

Whereas some of us who are more
seasoned understand that, you

know, thou shalt not mix devices.

So what I do in my home world, I mean,
I have two, two computers that I use a

laptop for, you know, on the weekends
and after hours and a laptop for work.

Um, and I try not to mix 'em.

But my kids on the other hand you
know, they're leveraging their iPads.

For schoolwork.

It, it's just the way they do it.

And you know, where it, where my
challenges come is, is the mobile devices

like the, the, the, the smartphone.

That definitely is hard to mix.

I'm not gonna carry two smartphones
everywhere I go, uh, and try

not to mix and match 'em.

So, I think where that needs to
be looked at is you know, and this

is something still, uh, out there
in, in terms of it is How do we

deliver an an agentless solution?

So, how do we deliver applications
without and with security?

With the visibility on a device
you know, may not be ours, it

may not be controlled by us.

And how do we containerize that?

So.

It's leveraged in a way that doesn't
leave a footprint on the, on that device.

There's no data on it, but
yet they can get the work done

that they, they need to do.

You know, in terms of, of looking at
data and understanding are, are, you

know, is, is there a crisis within a,
a person, uh, mentally and based on

the websites they're looking at, I'm
gonna, I'm gonna kind of avoid that.

Well, yeah, look, this is a hugely
complicated area, obviously, and it's,

it's difficult for schools in particular
because they're in loco parentis.

They have their own security needs.

So you do want to have student privacy.

But if that student is then trying
to, you know, figure out how to

pose a threat to the school, the
school obviously wants to know that.

Um, .A possible solution down the road
and maybe not that far down the road,

will be the ability of AI systems to
evaluate these things without a human

intervention and only reporting out
if certain criteria are met that rise

to a level of human intervention.

I'll be curious to see if that's the
direction in which things start to move.

Yeah, I mean, certainly I think
you're onto something there.

You know, given the level of
data that's produced AI systems

eventually will be going there and,
and you know, there is gonna be.

A moment where we have a coach, right?

And, and that coach is based on
what your needs are, what your

goals are, what your objectives are.

And it's gonna kind of give you I
think Microsoft calls it a co-pilot.

They're, that's kind of their,
the term they're using in, in

marketing for all their applications.

But I think it's a, it's a good
term because we're going to have

a copilot and, copilot is probably
gonna take it a little bit further.

When you're using that device,
they're gonna be scraping

the data and and analyzing.

Um.

Based on, you know, what websites
you're going to, what applications

you're leveraging, what social media,
uh, you're viewing and get down to

the point where even on your body,
you know, I wear an iWatch and it

measures Yep, it measures my heart rate.

It can measure, you know,
my blood oxidation levels.

The, it, the technology there
is gonna get to the point where

it can really understand it.

And then on top of that as
well there's a lot of emerging

technology around the brain.

And so I to your point, I think
we're, we're at a moment where what is

personal and what is not personable.

It's very possible there's a
scenario within 10 to 15 years where

if I'm at work I'm required or.

Incented to wear a device that kind of
measures my brainwaves to know whether

or not I'm focused on work or not.

And that may be enhancing me as
well to, to do, to do a better

job and to provide me focus.

But again, it goes back to the point
is, you know, what is really me and, and

personal to me and what should my employer
or even school be able to see or not see?

So, interesting times.

Hmm.

Oh yeah, for sure.

Yeah.

Hey, this was a, a great interview, John.

Where would you like people to go to learn
more about you and the work that you do?

Yeah, so really the best is,
is to reach out on LinkedIn.

I do a lot of posting there.

Um, I have some contrarian
opinions on technology, so I

call it stirred, not shaken.

I.

Opinions as well.

I do run a group called the SSE Forum
where we bring together practitioners

of this zero Trust, SS, SE and SSE
frameworks together and have conversations

around how to apply that technology.

And then finally my
podcast called The Edge.

Where we interview a lot of CISOs
or influencers or even technology

evangelists within the industry.

So those are the three places.

Great.

We'll have links to those in
the show notes, so make sure you

check those out@cybertraps.com.

And thanks again, John, for being here.

We appreciate it.

Thank you.

It's been a real pleasure, John.

That wraps up this episode
of the Cyber Traps Podcast.

In the coming weeks, we'll continue our
coverage of emerging trends in a variety

of areas, including digital misconduct,
cyber safety, cybersecurity, privacy, the

challenges of high tech parenting, and
now of course artificial intelligence.

Along the way, we'll talk to a growing
collection of international experts who

are helping us to understand the risks
and the rewards of digital technology.

You can find the Cyber Traps Podcast
on all of your favorite podcast apps.

We hope that you will share the show
with your friends and colleagues and

reach out to us if you have guests.

Tech questions or topic suggestions.

If you'd like to follow us on Twitter
or x, I'm at Jethro Jones and Fred is

at Cyber Traps, and if you're still
listening, you must have loved this show.

If that's the case, please
leave us a five star rating and

review in your podcast service.

We appreciate you having you with
us and look forward to having

you join us for our next episode.