Episode 39 - Ben Brooks - The Path To Security Consulting

In this episode I talk with Ben Brooks who is the CEO & Founder of Praevalidis LLC doing Security Policy Consulting for some very interesting customers.  I have known Ben for many years and I know he has an interesting path into Cyber Security that I think would benefit more people to hear about. Hope you enjoy the episode! Be sure to follow Ben at the links below. As always, if you enjoy this episode please like it, share it & leave a review. Thanks everyone!

Follow the Podcast on Social Media! Links Below 
Instagram: https://www.instagram.com/secunfpodcast/
Twitter: https://twitter.com/SecUnfPodcast
Patreon: Coming Soon!

https://www.praevalidis.com/
https://www.linkedin.com/in/benbrooksmba/

Transcript

00:00.00
Joe
Hey Ben thanks for coming on man.

00:03.30
Benjamin Brooks
I Yeah no worries. It's been a while since we've had ah a long sitdown.

00:07.77
Joe
Yeah, it's been quite a while I mean I think the last one was when I was in Minneapolis and we were drinking in the middle of a snowstorm outside by a fire because the bar wouldn't let us in. So.

00:22.34
Benjamin Brooks
And as you do in Minneapolis in the middle of covid countermeasures right.

00:27.60
Joe
That was insane. Why did we do that like.

00:31.78
Benjamin Brooks
Because we hadn't seen each other in a really long time and yeah it was. It was actually good though. It was good I Just remember it was freezing by the end.

00:38.72
Joe
It was oh yeah I mean I couldn't feel my hands for sure. Yeah, yeah, it was a good time. It was a good um short trip that I had you know.

00:45.51
Benjamin Brooks
Yeah, well we went to the range that day too didn't we that was good man that was real good.

00:55.57
Benjamin Brooks
Yeah.

00:57.44
Joe
It's not too far of a drive for me. Um, you get you get there. You know in a reasonable amount of time. So it's it's not terrible.

01:04.10
Benjamin Brooks
Yeah, exactly oh you have to come down to Texas where we can shoot and and we won't have to freeze our butts off and we can drink beer inside the bar if we want to novel things I know all right right.

01:14.10
Joe
Oh what? a what a privilege. Yeah, they're probably gonna be shutting all that stuff down here in Chicago with our luck and.

01:23.69
Benjamin Brooks
I I Hope not man for for years and everybody else's sake doesn't make a whole lot of sense quite Frankly, yeah yeah.

01:30.98
Joe
It's really dumb. Yeah, my ah my wife you know she's a cps teacher and um, she like just got done with a lockout right for they they miss like four days or something because. There's a lot of breakouts in cps schools and they they did a four day lockout for all of the teachers to get 1 k and 95 mask. It's like what like I got a. Bunch of them here like I give you some you know it's it's weird, but hey man. Ah, yeah, yeah.

02:09.75
Benjamin Brooks
Supply chain man. It's it's killing everybody. You can't the the listeners can't see my eye roll. So yeah.

02:19.18
Joe
Yeah, so I Ah, you know I actually wanted to bring you on because I think that you have a really interesting path in Cybersecurity Slash it t Overall um. It's definitely more unique than anyone that I've Met. Um, So why? why don't you know you tell the listeners a little bit about like how you got and I.

02:48.58
Benjamin Brooks
Oh my gosh? Well um, the big thing with with how I got in was actually my dad right? He used to work for Ge and he was an information technology instructor. So this was.

03:09.10
Joe
Oh wow.

03:08.27
Benjamin Brooks
Way back in like the 80 s when when personal computers were just getting big and so even though we lived way out in the country in the middle of nowhere we're sitting there with the you know the original Macintosh a Macintosh plus the macintosh 2 then we also had ah you know. Ah, 3 8 6 pc I can't even remember the rest of the specs but it was like it was like the best thing that money could buy. It was like a $1200 computer back then and that was all that was all on his budget for. Learning technologies and then instructing other people in ge on how to use them. So of course you know you can't keep a kid away from something like that I'm going to take a look at it and this was well before they had any login requirements for anything. There was no axis control. So I was just going to town and I wasn't obviously breaking anything you know he sat down. He taught me how to use the machine respectfully and and all the things to use it for and and so ah, yeah, we had all that and then of course with that. Maybe not of course. But with that. He had access to the Ge Information Services Master Network and that was through a 56 k dial up modem and long distance telephone call over you know, signaling system 7 copper wires. It's it's. Stuff that that you only learn about in college these days it still exists. But you know people aren't studying that stuff anymore. So you you would dial in and it would give you you know it give you it would ask for login credentials and and my dad gave me his credentials so that I could there were some games that were hosted on there. So they weren't massive multiplayer like we have nowadays but they were multiplayer online games which is like mind blowing right? So I would get on there and I play they had this one called air warrior and it was just these simulators. It was basically a flight simulator for all these.

05:07.25
Joe
Yeah, yeah.

05:19.70
Benjamin Brooks
World War one and World War Two Aircraft and you could get on there and you could you could do capture the flag or just dog fights and stuff like that. It was really cool and so that's what I That's how I started learning about computers and and learning a little bit about networking and it was It was really. Um, it was really getting getting to know everything and become ah a proficient user even at a young age and so my dad my dad passed early on I think I told you about that when I was when I was pretty young and you know he left all this. Technology Behind. Of course it's not like you take it with you. So um, he left all this stuff because it was you know it was. It was technically his that the the company gave it to him said hey this is what I need they're like cool you know and by the time.

06:01.75
Joe
F.

06:16.24
Benjamin Brooks
By the time. Ah he passed away. It was all old stuff. It was you know it wasn't It wasn't unusable by any stretch of the imagination but it certainly wasn't you know top of the line up to date. So so I started learning more about it and you know he was. He was no.

06:26.30
Joe
Right.

06:35.62
Benjamin Brooks
No slouch when it came to understanding the workings of the computer and even programming and so he had a lot of his books laying around and so I started reading some of those because you know I was getting to be a teenager and what more can I do with this thing besides paint pictures and get online and play games. Holy Smokes. You know I can. Can do all sorts of crazy things. So you know by the time Junior high school rolled around I was I was developing I was developing computer programs in in visual basic and and C instead of actually Writing. Instead of actually writing reports for like history and stuff so it was pretty cool. The teachers would allow me to do it. They were just they're like super impressed and I'm like it's not that hard but okay, cool I'll take the a and run right? I mean any kid would do that? um.

07:24.44
Joe
Yeah, right.

07:31.10
Benjamin Brooks
So ah so fast forward. You know I learned a little bit of you know I learned a little bit of Html and stuff like that and then I joined the Navy and I had to learn a lot really fast and I started back with some of these 1970 s solid state computers and. You know we still had cathode grey tubes and some of these old beasts because they didn't break right? they were. They're really difficult to break in if they if they were treated well so they lasted a long time. They did what we needed them to and that was that was it.

07:58.24
Joe
And.

08:07.73
Benjamin Brooks
So I learned about I learned about some computer architecture there and started to learn about networks when I got in with more about you know modern networks when I got in with navy special warfare and it was really is really interesting learned about. You know all the satellite communications and national communication systems. You have fiber and big copper wires satellite all the ways that we transmit information. Um on the national level. You know, just just as people in general not necessarily the government. As well as you know how we transmit information around the world and I started getting into security there and we learned about physical security and how it integrates into information security and of course I had ah I had a clearance. And so I had to learn about information security on the whole, not just computers but paper and water access controls. Why do we have them in place and boy that's a pain in the butt. Oh but now I see why it's a pain in the butt that makes sense. Okay I can suffer with that and you know that. That kind of fast forward again that kind of leads me to you know when I got out of the Navy and we met up in college and you know you're an I and I'm like I don't really know what I'm going to do I didn't know what I what I knew right? I didn't understand what I knew so.

09:31.95
Joe
Ah, yeah.

09:36.43
Benjamin Brooks
You're like yeah you know information it T is really cool but information security. That's really cool I remember us having that conversation in the the transfer student lounge right? or was it No no, it was the it was the was it the commuter student lounge that was it? yeah.

09:45.93
Joe
Yeah, yeah.

09:51.48
Joe
Yeah.

09:54.53
Benjamin Brooks
Because you lived way outside the city you you lived way West and I lived way North and so we would hang out there as a place to just chill that didn't cost any money. Yeah, um, and then you know when I got out of college.

10:06.40
Joe
That's yeah, right.

10:13.12
Benjamin Brooks
I Got a real I got a real good break from a friend who said hey look if you can get you know if you know all this stuff. You can go get a certification I said. Okay so what do these certifications get me again, not knowing anything I'd been in.

10:28.68
Joe
No.

10:29.60
Benjamin Brooks
The Navy all my life nobody is telling me about job certifications or anything like that. So. It's like you get this certification and you can you know you can do information security and I'm sure you know a lot about it. But maybe you don't understand you know I'm like I I don't think I do and he's like okay well. Um, you know you want to start with like security plus and all that stuff and being the Knuckle head that I am I said all right? What's the best one I can get. He's like well cissp. But that's you know that's that's like way down the line right? I'm like I'm going to get it and so I.

10:59.43
Joe
Yeah, yeah.

11:06.45
Benjamin Brooks
I started studying and the guy made a recommendation to this cybersecurity company and they said do you have any certifications I'm like no, but here's my background. They're like well you got to get some certs and I'm like how about this I'll make you a deal. They were desperate for people because cyberurity professionals. Back then that was like in 2000 that was two Thousand Eleven twelve something like that and back then what could have been that. Yeah it could have been that light I guess it was a blur. But yeah i.

11:30.11
Joe
Um, might have been might have been 2014

11:39.21
Joe
But back then there was like no one that existed in security like yeah.

11:42.65
Benjamin Brooks
But while there were it's just they weren't very, they weren't they weren't advertising. It wasn't mainstream by any stretch of the imagination right? So and basically unless you were like Kpmg or or 1 of the other big audit firms cybersecurity. What's that.

11:47.76
Joe
Right.

12:00.46
Joe
Yeah.

12:01.69
Benjamin Brooks
Right? So anyway, the guy his name is John and he's a friend of a friend of a good friend and he's just like well you know, go go here and I applied and I said to the guy I said to the recruiter the hr guy he's like well I can't hire you if you don't have any searchs I said give me three months I'll get it done and he's like three months to get your cissp and I said yep, give me three months right I was just that confident sure enough I pulled it off though and they're like holy crap.

12:31.12
Joe
Um, yeah, that's insane. That's ah, that's insane.

12:35.68
Benjamin Brooks
Ah I didn't make I didn't make friends in the company by doing that though unfortunately because like all the guys who'd been there for like 13 years and didn't have theirs suddenly the pressure was on them because the boss was like.

12:50.52
Joe
Yeah.

12:53.47
Benjamin Brooks
Okay, so new guy could get it. What's what's taking you guys so long hu that was yeah.

12:56.87
Joe
Yeah I've been in that situation before where like for some dumb reason even the security manager like felt threatened by me or something um, just because I was going for. You know. Search that he should have had a decade ago basically um and he didn't want to put in the work or the time to get them and he's a manager like shouldn't really have to right? Um, it's not really a good situation. When you go into that sort of ah environment I found out later on because I mean he's just going to be resentful of you and hold you back at every stop like he made every day they're miserable for no reason.

13:45.20
Benjamin Brooks
Yeah, that's stinks man I mean not all managers are like that obviously and there are going to be some people out there but it's one of those things. Yeah those big certs are they're intimidating you know, like ah some of those Gx certs.

13:56.11
Joe
You know.

14:01.90
Benjamin Brooks
Some of those giat gold certs some of those ah you know the cissp. All those all those big certs are intimidating because there's just so much information that you have to know and the tests are long and daunting you know and you really don't know what's going to be on the test. It's.

14:10.59
Joe
Yeah, yeah.

14:19.67
Benjamin Brooks
It can be really intimidating I think that I think the right attitude for anybody to have if you see somebody else getting this cert next to you and you feel like well gosh I'm I'm ah I'm at least as smart as they are I think the right attitude to take is well.

14:37.96
Joe
Um, yeah, that's what Ah, that's what ah a good friend of mine did actually he he was working with a guy that had his C ah ssp and he's like man this guy's dumb as hell like he's He's literally dumb as a box of rocks like he can't do anything.

14:37.65
Benjamin Brooks
Heck, if they can do it I can do it too. You know instead of being resentful. Just.

14:57.28
Joe
And he has his C I ssp I'm going to go get this thing like tomorrow. Let me go sign up I'm going to go do it. You know.

15:02.59
Benjamin Brooks
It? Ah yeah, yeah, exactly So it's It's really, it's really about that I think it should be like it should be a demystification you know hopefully I don't count as the dumb as a box of rocks. But you know what you know, not everybody's opinion counts. So.

15:19.71
Joe
Yeah, right? Yeah I mean you touched on something like the amount of information that you need just to go into these exams is insane and for comparison like the security plus study book or whatever it is.

15:29.21
Benjamin Brooks
And.

15:38.50
Joe
Think it's like 20250 pages um maybe you know around 150 pages of actual content because you know they have their appendixes and all that sort of stuff the ccsp cbk book that you absolutely have to.

15:45.43
Benjamin Brooks
Yeah.

15:58.50
Joe
Read and go through um I think that was somewhere around 1500 pages and I think the cissp book is even longer than that like.

16:07.48
Benjamin Brooks
It's it is. It's it's insane man I mean people use it as a doorstop you know people use it to after after you, you pass the exam I mean this thing takes up like half a foot.

16:22.24
Joe
Yeah I actually ah use mine to strain out my master's degree because they sent me my master's degree in like a rolled up tube thing and so it was like it was rolled forever. You know.

16:23.68
Benjamin Brooks
On your shelf width-wise it's It's enormous, right? It's huge.

16:35.65
Benjamin Brooks
I Ah yeah.

16:42.90
Joe
And so I used it to flatten out that that ah that degree like.

16:49.86
Benjamin Brooks
Yep, it's the new phone book. You can put your kids on it. The the common book and up for Cpssp yeah, put your kid on it. You know, make sure that they can reach the table and know it's good.

16:53.87
Joe
It's like 2 phone books.

17:01.47
Joe
It's like yeah you know the the phone book that used to have like every phone number like in the country like it's 2 of those. Yeah yeah Gavin well you know you also took like a really.

17:05.11
Benjamin Brooks
It. It's like Chicago's phone book right? or New York cities yeah Yeah exactly oh my gosh.

17:16.54
Joe
Interesting approach like you weren't working for the man so to speak like for very long um in terms of like overall career like you ended up going out and forming your own company and doing that whole thing. Um, which. In all honesty like it's a very um, tempting yet very scary thing for me to still like wrap my head around like to just stop working for someone to have that you know for sure like paycheck coming in.

17:52.95
Benjamin Brooks
And.

17:54.81
Joe
And then go and do your own thing and hopefully it works out like at the end of the day now. It's all on me to whether or not I put food on the table right? like it's all on me. There's nothing else in between it. Um, that's something that I'm trying to slowly.

18:07.72
Benjamin Brooks
Yep, okay.

18:13.23
Joe
You know, break myself out of um, but man it's hard and it's it's tempting too right? because the money is there like I was offered I didn't take the opportunity. Um, and it was actually.

18:21.15
Benjamin Brooks
Yeah.

18:29.62
Joe
Very good that I didn't take the opportunity because the pandemic happened and then the opportunity disappeared. Um, but it was like a it was like a half million dollar deal I was going to have to hire someone I already had the guy picked out that I was going to hire I was going to pay you know insurance benefits and all that. And I like worked it out so that like I was literally getting a pretty big pay bump and my partner would be getting a pretty big pay bump. Um for this project that was like six months long it was extremely tempting. You know, but at the same time.

18:54.29
Benjamin Brooks
And.

19:06.24
Joe
There there was something that happened at that time where I was like man. There's maybe a 10% chance or a 20% chance that this falls through am I willing to accept that risk because then I I'll be in a situation where I don't have a job and I have to find a job and in security it's pretty easy to find a job.

19:14.20
Benjamin Brooks
So.

19:26.20
Joe
But when you have no income coming in for the 3 to four weeks that you're finding the job getting hired starting. It's tough, especially when you're getting married. You know you can't like you're paying for your your wedding venue right? in cash.

19:31.60
Benjamin Brooks
Yeah, yeah, yeah, that is ah yeah.

19:44.19
Joe
And you're literally going paycheck to paycheck if you miss a savings period you're behind on your wedding venue and your future wife is not going to have a venue to host 150 guests you know like.

19:55.72
Benjamin Brooks
She Ah she she might have some ah exception to that? Yeah, so.

20:01.19
Joe
Yeah I mean I'm I'm pretty sure she would have killed me because Divorce wouldn't be on the table at that point.

20:09.40
Benjamin Brooks
Ah, yeah, or worse right? killed you or worse. Ah, so yeah, that's ah yeah, that being in um, yeah, being in business for yourself is is difficult. That's for sure. Um.

20:11.83
Joe
Yeah, yeah man. But.

20:27.82
Benjamin Brooks
I'm sorry I should caveat that you know being in business profitably for yourself is difficult. It's very easy to operate at a loss that that takes almost no effort whatsoever. Um, yeah, but being able to actually turn a profit.

20:33.23
Joe
Yeah, yeah, yeah.

20:45.78
Benjamin Brooks
Being able to actually make sure that you're in the green year after year that is the hard part you know and a lot of companies actually um, a lot of companies actually kind of porpoise that that profitability lost line um profitability deficit I should say.

21:04.69
Joe
Fish.

21:03.86
Benjamin Brooks
Ah, changing the vocabulary here changing over to the business vocabulary. But yeah, they porpoised that line for a long time and even businesses that have been in business for a while you wouldn't expect to to do that they do but as long as at the end of you know as long as at the end of the day. Um.

21:17.41
Joe
Yeah, yeah.

21:23.00
Benjamin Brooks
Nobody is nobody's threatening to shut you down because of unpaid debts and you have enough food on the table and you know heat to heat your house in Chicago hello um, you'll be You'll be okay so it's not one of those things where again, it's the intimidation factor. But you definitely have to have a plan I would say if anybody out there is listening and and looking to start their own business. You got to have first you got to have a plan for what you're going to do and how much. Money you think you can make doing it and don't just be like I'm going to swag it just take a ah scientific wildass guess you got to you got to sit down and say this is the going rate for what I think you know for for what I'm going to do what I think I'm going to do. Who do I know that's going to be able to pay me immediately to do this. Who's gonna hire me immediately and then am I going to be able to actually realize this am I going to be able to turn this into reality. Not just me sitting here on the back of a napkin at my kitchen table just kind of sketching things out. Um. And of course there's always the the debt factor like you mentioned if you've got any debt. Um, that makes things even more intimidating right? because they can levy lawsuits and you might have to if something goes wrong, you might have to file bankruptcy which isn't the end of the world. Don't get me wrong people. Do it all the time. Ah, you just don't want to do it if you don't have to because it's a world of it's a world of pain and and long repayment of whatever you can. You know? So I guess at the end of a day what it comes down to if you're going to be an entrepreneur.

22:51.72
Joe
Right.

23:07.42
Benjamin Brooks
You've got to you you really have to sit down and think about think about your your cost versus your benefit and and it's not It's not it sounds appealing but I mean it's the risk worse versus reward. Let's bring it back to our world security right. Ah, how much how much am I risking by trying to walk this route and you know what is the real. What is the actual reward that I might achieve might achieve not will achieve because there's no guarantees ever. But what are the what are the things that I might achieve here and yeah, again, you have to be as realistic as possible and you know if you can sit down and say that you have an extremely high likelihood of of succeeding. In this regard of of making a profit of you know, getting your business up and running and again a lot of small businesses fail within the first two years almost 60% the last time I checked on that number so you you really have to be able to get yourself together and think about what you want to do.

24:11.29
Joe
Oh.

24:19.10
Benjamin Brooks
And then you have to think about what you as the individual want to do are you going to be the owner operator. Are you going to be the owner manager are you not going to own it at all, but just be the guy who runs everything and you have to hire somebody else to do the business aspect of it. These are all things that you got to consider when you're starting a business because at the end of the day. Um I've seen a lot of entrepreneurs just burn themselves out because they're trying to do everything at once and it's just not Realistic. You've got to take a rest you've got to know you've got to know what your limits are um. And if you're one of those people who if you're one of those people who who gives their all to everything that they do entrepreneurialism actually is a bad idea because you don't have enough time. You don't have enough time to give your all in everything that you do when I Say. You're all I mean you just can't leave it Alone. It bugs the snot out of you to leave something alone at the at the good enough level and I'm not saying that you do a bad job but at the end of the day you know do you have to have everything finished and buttoned up. Each and every day each and every week if that's your mindset if that's your mindset and and you can't um you know you you can't just let some things go for later.. It's not that you're not going to get them taken care of sometimes you just have to push things off sometimes you have to. Reprioritze But if you're that person who can't just let it go.. You're gonna have a miserable time as an entrepreneur because you're just going to be like there's so much to do I Can't do it all and you're right there is and you can't and you'll just lose your mind right? so.

26:03.96
Joe
Yeah, so what? what drove you to kind of going down that path. Um because you you were you know, employed by an employer at one point and then you know what? what was the thing.

26:13.41
Benjamin Brooks
Oh man.

26:23.18
Joe
That made that like mental shift was like you know what screw this I'm going to go find my own my own path. Basically.

26:29.50
Benjamin Brooks
Yeah, so you know like you um I've had I've I've encountered my fair share of bad managers and when I say bad managers I should really say it was bad at the time. Because they might not be bad people and they might not be really bad at their job but the situations that I ended up in were bad situations and I can't say that I'm not entirely to blame because I hold managers and leadership to an exceedingly high standard probably probably ah probably ah.

26:56.90
Joe
Now.

27:07.60
Benjamin Brooks
Unrealistic standards at at least I used to I've gotten better right? Um, but you know when when people cast blame on other people when they're clearly at fault. Um, when we're we're doing things because you know the contract says. You know we're going to do. We're going to do x y and z and then the the customer interprets that as a one two and 3 and you know it might not be ethically sound but we're like we're going to get paid so we'll do what the customer wants I'm not okay with that stuff I'm not okay with that.

27:38.33
Joe
Right.

27:44.47
Benjamin Brooks
And so I ran into a couple of situations like that I ran into some some fellow entrepreneurs who were just in it for the money they really didn't care nor did they understand nor seek to understand the business aspects of it in regard to hey look. People are putting their livelihoods in our hands when we're doing this if we don't do this right for them. You know and it's not It's not a black and white. It's not fifty fifty right there's all sorts of shades of of grace in there. But if we don't do it right? Right. We can not only lose our shirts but they're definitely going to lose theirs if there's a bad cybersecurity breach and so I know I just talked about the entrepreneur that can't let things go well, there's certain things you know you got to pick and choose your battles when it comes to making sure that the.

28:25.37
Joe
Yeah, yeah.

28:40.14
Benjamin Brooks
That your client has the right level of security for what they need right? based upon what they've told you then you know there's There's very little compromise in that area. But when the customer says Well we don't know what we need and. And your boss says just sling them something I'm not okay with that right? Not okay with that kind of thing So That's why I ended up going out on my own and um I failed a couple of times I don't know if and and you knew that? um well.

29:01.96
Joe
Yeah.

29:11.37
Joe
Um, yeah.

29:14.21
Benjamin Brooks
Yeah I I didn't I'm not like some overnight success by any stretch of the imagination I Found some guys who were kind of who were kind of like that and I'm just like no I'm not dealing with this I left I left other jobs because I don't want to deal with this crap right.

29:27.26
Joe
Yeah, yeah.

29:30.16
Benjamin Brooks
Just sling them what they what? whatever and it's like that's not how this works you know we should not. We shouldn't take their money if we're not going to provide them a service that is worth our reputation right? is the end of the day What is security. It's.

29:32.77
Joe
Brave.

29:42.49
Joe
Right? right.

29:48.73
Benjamin Brooks
I Trust you you trust me, this is how we're going to do business. This is how we're going to operate our systems and we're going to do the right thing because we shook hands and we passed bucks. We passed money right.

30:00.30
Joe
Right.

30:05.45
Benjamin Brooks
At the end of the day. That's what security really boils down to and you betray that trust you lose your reputation I can't sleep at night when stuff like that if somebody you know if somebody says oh you know you you screwed me over. It's like well you know I would never do that to somebody and you know if that's the way somebody feels.

30:25.63
Joe
Um, yeah I Um I really hear you on that because like at the end of the day all that we have is our reputation like that's all we have you know there's There's really no in-between with that. Um you have a reputation you know.

30:24.76
Benjamin Brooks
Um, not okay with that. So.

30:35.92
Benjamin Brooks
Right.

30:44.30
Joe
Internally with your company if you're working for another company. You have a reputation you know, Externally you have a reputation amongst your friends and family. You know, um and they should all be the same I'm not saying to be different people for all those different environments right.

30:59.70
Benjamin Brooks
Right.

31:01.31
Joe
Um, but it should all align and far far too often. Um, you know I come across someone that would be like oh yeah, I'll help you I'll do this I'll provide this service or whatever. Then. You know you you email them to take them up on that service and they disappear is like what what are you doing you know like even people that want to come on the podcast right? like there's people that have wanted to come on the podcast before um, that you know.

31:21.17
Benjamin Brooks
So yeah.

31:35.37
Joe
I accepted I have them on and everything and then something happens. Um, that is very obscure to me that I don't know you know what actually happens and they disappear like it's just ah, it's Crazy. You know reputation is. Hard to find it seems.

31:54.52
Benjamin Brooks
It's it takes a lifetime to build and it takes one moment to destroy.

31:57.90
Joe
Right? Like I have a this is a good example I have ah I have a vendor that I work with exclusively because I trust him I trust the work that he does and I trust all of his recommendations because he's never seared me wrong. Not once.

32:13.43
Benjamin Brooks
I now. Yeah.

32:15.87
Joe
And he's actually cursed out so he's ah he's a reseller so he is actually straight up cursed out vendors for mistreating me for selling me something that doesn't exist in their product like he will call it out on the phone call with them. In front of like me my manager my seeso everyone and be like you are blatantly lying to them right now we are going to stop doing Business. We're ending this call and like he has he has no room for any of that and so you know literally that earned my trust.

32:35.35
Benjamin Brooks
I Wow Wow I.

32:52.90
Joe
Right? from the beginning so I will always bend over backwards for this guy I will always just basically go with him no matter what you know because I I know for a fact and 1 really funny example I guess is when I was at a totally different company.

32:59.41
Benjamin Brooks
I yeah.

33:11.56
Joe
This guy from a vendor that we didn't have at all the company did not purchase any product from this vendor he was cold calling the company trying to get someone that would forward the phone to me while in our security training.

33:26.43
Benjamin Brooks
Oh by sales guys come on.

33:30.24
Joe
You know if someone is yeah if someone's more forceful if someone's trying to you know, be forwarded around in the company you are supposed to message that person in the company, get their authority first or authorization first and then you forward the call and so this vendor reached out.

33:43.88
Benjamin Brooks
Yeah.

33:50.13
Joe
Someone that I didn't even know at the company. There's some admin assistant I had no clue how he even got that person's phone number and ah he was like demanding that he was to speak to me. We had a call scheduled Um, just everything like he was being very rude to her.

34:07.44
Benjamin Brooks
That wow.

34:09.92
Joe
And and I was like get his name and number and tell him like literally to fuck off and she's like you want me to say that I was like tell him to fuck off and and she she like you know, did that and then he kept doing it for at least another.

34:18.36
Benjamin Brooks
Yes, please.

34:29.88
Joe
Six weeks he kept calling and so I reached out. Yeah so I I reached out to my buddy who's the reseller and I said hey do you work with this company and he said yeah we've done business together in the past I know some people over there.

34:31.21
Benjamin Brooks
Looks like borderline harassment right? there come on.

34:48.34
Joe
I was like do you know who this person is and he's like no but I can find out I was like you find out and you tell him I am never doing business with him and if I ever go to a company and hear that he's running the account that account will be canceled by the end of the week of like he can fuck off like.

35:02.63
Benjamin Brooks
So dang.

35:07.60
Joe
Do not cold call some random person in my company yelling at her telling her that she has to forward a phone call to me because if she would' have afforded it to me like I would have just gone off on him I would have completely laid into them because like look you're a vendor you're not like my boss. Right? And if my boss has a problem with how I'm speaking to you. It's like well we don't give them Money. We've done no work with them so they can fuck off as far as I'm concerned like just it really it really bothered me.

35:36.31
Benjamin Brooks
You're a pretty metal guy so this has got you really riled up man. Yeah.

35:43.20
Joe
Really bother me because I've never had someone do that before where they're harassing someone else at my company to get to me.

35:47.55
Benjamin Brooks
Yeah, that's I mean that's not good tactics. How are you building? Trust there. How are you building any sort of relationship makes no sense.

35:53.84
Joe
Yeah, and I've never talked to the guy I've never heard the guy's name before I've never worked with that company like it's like dude I understand that you're trying to make a sale right now but that is not how you do it? no.

36:04.49
Benjamin Brooks
Did did he even try to like use I don't know Linkedin or something like that where he can like fire off ah a message in the blind I mean probably.

36:13.50
Joe
No, that would have been way more successful if he would have sent me an email I would have responded to the email if he would have sent me a message on Linkedin I would have responded to the message right right. right

36:24.40
Benjamin Brooks
Just as a common courtesy right? goodness.

36:31.13
Joe
But like now I'm like cursing out this guy through a third party you know.

36:34.24
Benjamin Brooks
It except trying to get a sale. There's There's definitely something not okay with this individual.

36:40.15
Joe
Yeah, yeah, well as soon as you know my buddy at the retailer as soon as I told him like he handled it that day. He's like no one from that company will ever message you again and they haven't.

36:53.78
Benjamin Brooks
I Got you got to tell me about this resaler later on who who is this guy I need to I need to pick his brain a little bit that's cool.

36:56.98
Joe
Yeah, yeah. Yeah I'll I'll put you into contact with him is really cool I mean when he started calling out vendors on the call for selling things that they weren't able to do right then and there he had me I was like man because vendors do this a lot.

37:15.90
Benjamin Brooks
You know I've actually they do and you know I've done that I've done that as ah as part of a Cto duty to to my own companies and they're just and and the people I was working with they're like well you're being a little harsh I'm like ah no.

37:35.30
Joe
Yeah, yeah, yeah, ah well they weren't harassing you. This guy was straight out.

37:34.82
Benjamin Brooks
This person is blatantly like I don't want to have anything to do with them. Thanks you know I didn't tell him to fuck off just you know saying I and they were hurting me This is true. It was a standard sales call that that we agreed to so.

37:51.49
Joe
Yeah.

37:53.35
Benjamin Brooks
But when they lie to your face. That's not okay. So.

37:55.99
Joe
And yeah I mean I've had a vendor that basically lied about every facet of their product. Everything and it's crazy because after spending like $7000000 on the product.

38:04.51
Benjamin Brooks
And what do they hope to achieve with that honest, it makes no sense that.

38:14.47
Joe
Um, they still couldn't get it right? They still couldn't get it working I actually know for a fact for that company. It is still broken after spending $12000000 on it. Yeah no, no.

38:22.57
Benjamin Brooks
Oh my gosh that is not okay, was it a custom. It's supposed to be off the shelf and they're just like yeah yeah, we could do that.

38:32.78
Joe
Yeah, there was no, there was no custom with it at all because you know what what happened was they were designing out the product and the manager was very ambitious and so he was being like hey and.

38:36.94
Benjamin Brooks
Oh man.

38:46.26
Benjamin Brooks
Obviously.

38:50.10
Joe
He was saying hey like can you guys do this? Can you guys do that and so the vendor was trying to you know accommodate that stuff when they couldn't like really fully accommodate it at that time and so we were running with it right. We were trying to deploy it How the vendor wanted us to deploy it and everything and we we were doing exactly what they told us and the product still wasn't working and so I was just like you know what? let's cut out all the bullshit and just deploy this product vanilla. You know like let's just see if we can get the tool working.

39:20.60
Benjamin Brooks
And.

39:25.37
Joe
And then we can do this customization stuff later when they actually build it into the product and so we did that and I mean it's still like weekly outages monthly outages at a minimum. You know hard.

39:29.11
Benjamin Brooks
That makes sense. Yep.

39:42.90
Joe
Down and this is a critical security system for the company like extremely critical why they have they have other mitigating controls of course, but this is.

39:45.17
Benjamin Brooks
Maybe you shouldn't be talking about this on the podcast Dude I don't know we don't know what function it does right? So of course yes.

39:59.23
Joe
But yeah, you know like that's the stuff that we run into and as security professionals we're supposed to be the guys in the room that pull holes and these vendors lies and it's really difficult to do sometimes when you don't have inside knowledge.

40:02.52
Benjamin Brooks
Yeah.

40:18.50
Joe
Of that company or that product you know I I don't know if this vendor you know can actually do what they're telling me to do like they can remote into you know, different servers and whatnot and it's reliable that it never goes down.

40:18.47
Benjamin Brooks
Yeah.

40:33.90
Joe
I don't know Aws says that they never go down and then they went down 3 times in a month like.

40:35.99
Benjamin Brooks
Yeah, anybody who's claiming like you know a lean 6 Sigma Ninety Nine Point Nine Nine Nine Nine Nine You know uptime, that's ah, that's a really big claim that is some that is some. Bravado that is otherworldly right there and it's just not realistic I don't care if you've got you know all the servers in the world. The bad guy hits you hard where it Counts. You're not coming up quick. Sorry so.

41:07.86
Joe
Yeah I mean they probably lost a nine that month you know they probably lost a nine. We're five five nines oh man that's so crazy.

41:13.62
Benjamin Brooks
Um, we're 5 super moment 5 yeah exactly oh man. Yeah I hear you but you know back to your point with the whole with the whole we're supposed to be that that voice of sanity. I mean again that comes with that trust relationship the security person should be 1 of the most honest people in the entire organization and quite frankly I t folks should be too because let's face it most companies these days.

41:40.20
Joe
Yeah.

41:50.32
Benjamin Brooks
There are technology companies that happen to sell a product because information the flow of information the sharing of information is how we make money and so we're the stewards of those tools and those systems and the security surrounding those systems we have to be as honest as the day as long.

41:59.68
Joe
Yep.

42:09.30
Benjamin Brooks
And we should be able to establish some of the highest level trust relationships within the entire organization. But if we don't have that our jobs become almost impossible. For instance, if you had been sitting in there and they hadn't listened to you when you said this is some garbage It doesn't work. Um.

42:18.14
Joe
Yeah.

42:27.85
Benjamin Brooks
And they said hey we're going with it anyway, right? You'd be out $12000000

42:33.23
Joe
Yeah, you know it's funny after after I was at that company. You know with that vendor I went to another company and literally like my first day I'm in a meeting with a reseller. You know my manager's like I want to do these 7 things. It would be really cool if a product has all of these 7 things and he listed out all the core functionality of the tool I just struggled with at the previous company and I was like oh no I know this reseller is going to say this vendor and they did.

43:00.13
Benjamin Brooks
And.

43:09.55
Joe
And I was I cut him off right? there I was like look I'm just going to cut you off right? there they claim they do all of this. It is not proven out in any facet. He's like well we have it running in our environment I'm like does your environment have 40000 accounts in it I doubt it. Moving on and my manager was like oh well I want to hear him out I was like I will not work at a company that owns this technology and he was like okay we're going to pass on it. Fuck.

43:29.81
Benjamin Brooks
Yep.

43:41.49
Benjamin Brooks
That's um I mean that's a strong statement. That's putting your money where your mouth is man. That's good. That's good I am I am not doing this again. Yeah.

43:44.75
Joe
Um I would have put in my notice that day if they were going to go down that path like I I will not go through that stress again I lost my hair all right? like yeah.

43:56.14
Benjamin Brooks
Ah, oh do me both brother. Oh my gosh. So what else he got.

44:04.36
Joe
Man so you know me man I always got a lot of lot of irons on the stove or whatever the analogy is I don't know yeah that thing. Um.

44:17.70
Benjamin Brooks
Iron's in the fire. Yes, sir.

44:21.69
Joe
So You know I was wondering how you know what's the best way that you have found to get work because you're you're self-employed. So You know you getting customers is pivotal to to you putting food on the table right? and you got. You got little kids so it's more Important. So How do you do that because that's that's where I personally always get stuck. It's like yeah I have the skills. Yeah I have the knowledge I can like actually do this work. But how do I find it.

44:42.31
Benjamin Brooks
Yep.

44:51.32
Benjamin Brooks
They right? So ah, you know a lot of people want to they get into security. They get an I t they want to do like government contracting and I'll just be honest with you that is not the way to go all right? Um, government contracting is all very well and good. But it's it's. Almost random it's not random I mean obviously there are criteria in place to help with the selection process of those contracts I know I was there I was on the selection I was on the selection board for some contracts back in the day. Ah so I know how the process works but there's just no guarantees that. Even if you are the right company flat out that you're going to get the contract because of lobbying interests and you know, just whatever some person is feeling who's signing who's signing their their John Hancock on the the line that day. It's just not the way to go. So um. I put that out there because there are a ton of government contracts. It seems like it's it seems like it's just this giant ocean of money floating out there ready for somebody to pick up. That's not the case. Um, yes, you can do them. It. It would you're hard pressed to make that a primary business going on your own.

45:57.70
Joe
Right.

46:08.64
Benjamin Brooks
Um, so the easiest way to find work is to have a really good sales team and the sales team has to be knowledgeable and understanding of what you do and how you've done it for. Ah, how you've done it for other clients in the past they have to be able to answer questions for new clients. They have to be able to um they have to or prospective clients I should say and they also have to be able to identify those opportunities really well and so when I say that.

46:28.13
Joe
E.

46:46.10
Benjamin Brooks
Um, my best sales team are my existing clients and they have helped me tremendously find more work when I said and it's and it's it's me so it's me telling them hey look.

46:49.55
Joe
So.

47:02.13
Benjamin Brooks
Glad you enjoy what I do for you. Glad we have this good relationship. It's been just a blessing to me and my family and I you know I appreciate the time that that we get to spend together. But you know there's just one thing I I want to ask from you. Do you know who could use the same thing I know you go to conferences and I know you have a professional group that you work with who do you know who could use these services and inevitably somebody will come up with at least 1 other person and because it's a referral from that person that I've worked so well with. It's almost ah, it's almost a a done deal. So that's how that's how we find enough work and again I keep hammering on this because it is the most important thing guess what? That's a trust relationship. You have to preserve that at all cost.

47:42.87
Joe
Rape.

47:55.50
Joe
Yep.

47:57.69
Benjamin Brooks
You have to you have to honor that in every aspect of your relationship with that person. So.

48:04.58
Joe
Yeah I mean that's a big thing because you know the person referring you to this other customer right? like he's putting his reputation on the line and if you don't do good work or you overcharge or whatever right? like that. Really taints his reputation. So It's ah it's like a 3 way.. Trust you know handshake right? like I Trust you are going to do great work for Him. So I Trust I'll put my trust you know into doing this this ah connection.

48:29.20
Benjamin Brooks
Yep.

48:37.66
Benjamin Brooks
That's that's exactly right? Yeah and you know it's ah it's funny because unless that's that's just the way it's it works in this industry I mean just like that 1 vendor.

48:49.95
Joe
Um, yeah.

48:54.11
Benjamin Brooks
He's sitting there saying oh my gosh It could do everything under the sun. You know it'll even it'll even bring you a beer at night right? And if it doesn't do any of those things you're automatically eroding that relationship and you don't trust that guy anymore. Everything that he says is now everything that he says is now tainted like you said everything that.

49:06.38
Joe
Right? right. Right.

49:13.83
Benjamin Brooks
That he says now is brought into question. So when I say you know you've got ah you've got to really defend and honor that trust relationship if you're wrong in any aspect of your service delivery you better own up if you make a mistake you better own up and say oh man I'm sorry I made a mistake there I'll get it fixed. Don't worry.

49:27.64
Joe
Yeah, yeah.

49:34.26
Joe
Um, it's like yes, right.

49:33.63
Benjamin Brooks
I got that sorry about that and people are usually fine with that right? unless you just cost them. Ah, you know a metric boatload of money. Um, but you know if if you do you just you just got to be honest, there's a pervasive culture here in America that is like a 0 tolerance. Not to use the security term zero fault tolerance. But if ah we we do. We have we have this pervasive culture or mindset that you just you can't be wrong. You can't do anything. You can't make any mistakes. That's not realistic right.

50:04.28
Joe
Yeah, yeah.

50:10.74
Joe
Yep, right.

50:10.10
Benjamin Brooks
And if you're working for somebody with that mindset stop. Don't work for that person because your life is going to be freaking miserable and there's no way on Earth that you'll ever not be able to make a mistake and the last thing that you want to do is cover up a mistake that is that is the worst.

50:24.65
Joe
Becomes illegal. Yeah.

50:28.46
Benjamin Brooks
Ah, yeah, first, you've got legal issues. Especially if you're providing this service to people. But second again, where's that trust relationship. So yeah, you definitely want to preserve that.

50:31.60
Joe
Right? Yeah, it's ah it's it's like a Jocko wheel it willings book extreme ownership right? like ah.

50:45.49
Benjamin Brooks
I that's right I didn't get this from Jocko by the way but he's a nice dude.

50:50.70
Joe
Right? Like I'll you know I've made mistakes a lot earlier in my career and I'm sure I'll make a million more? Um, but the 1 thing that I will always do is I'll own up to it I will always own that mistake I will always take notes.

51:05.63
Benjamin Brooks
Yep.

51:10.60
Joe
Like literal notes of how I messed up where I went wrong and what not to do again right? And what's the correct path forward. So I never make that same mistake. Um, and I think what I'm finding at least through different Mentorship. You know. Opportunities or whatnot. It seems like the the kids that are coming out of college. It sounds weird for me to call them kids. But yeah because I'm older now you know, but but you know the.

51:38.45
Benjamin Brooks
Doesn't it. Oh you're all like 30 something right? so.

51:46.18
Joe
I turned 31 next week. So you know the the the people coming out of college now are like really afraid to fail like I got someone that has been studying for a cert for I don't know 8

51:56.37
Benjamin Brooks
Yeah.

52:05.44
Joe
Eight ish months now and he's probably been ready for two to three months and he's just so afraid to fail that he like can't bring himself to take the exam. He keeps delaying. He's delayed it dozens of times and I'm like.

52:09.59
Benjamin Brooks
I.

52:24.23
Joe
Look you know I failed several certifications I failed the ccsp the first time I took it that didn't stop me I took it again in ninety days and I passed it right? like I learned from my mistake I made the adjustments and I prevailed and if I would have failed it again. I would have taken it again after the wait period is up right? like I would have adjusted I would have learned um and I mean I've I've caused outages myself at work it you know it does.

52:54.32
Benjamin Brooks
It it happens I mean it does. It's going to happen but you fix them you own up to them you learn from just like you said.

53:00.45
Joe
Yeah, right? Yeah I mean I think you grow the most when you make those mistakes. Yeah, you know you have to.

53:11.00
Benjamin Brooks
Yeah, you absolutely do you? Absolutely do.

53:16.53
Joe
Especially when you're in front of your Vp and you have to explain why you brought down this network and like yeah I did this is stupid I didn't know it would do this. Let me fix it. You know.

53:25.90
Benjamin Brooks
You You see you have to learn but I've I've met quite a few people who who refuse to learn from some of the mistakes they've made if you're going to be successful for sure.

53:34.67
Joe
Um, well do are do those people ever like graduate or progress in their career or do do you see them getting to a certain level and just basically stopping there. Because they can never get around these things. Yeah yeah I mean mistakes force you to grow. You know like you learn to own up to it. You learn. You know your you're fallible, right? you're.

53:51.87
Benjamin Brooks
So that's exactly right? Yep, you nailed it.

54:11.60
Joe
You're just a human you're going to make a mistake you learn that the only way to do It is to you know, Actually do it right.

54:19.76
Benjamin Brooks
That's right, You know we've got ah we've got an expression in the Navy Navy Special Warfare Fail forward if you're going to Fail. You know it's going to have consequences. It doesn't mean there are not consequences but you want to fail. Forward and it's just like you said it's okay I failed I made a mistake where did I go wrong and you really want to pick it apart and it sucks it hurts right? It hurts mentally sometimes it can hurt physically um but it you know it stinks having a to.

54:47.21
Joe
Yeah.

54:56.70
Benjamin Brooks
Pull apart you know where you were in post-mortem or afterwards. It's blatantly obvious what you should have done but in the moment you just either disregarded it or you weren't sure what to do and you made the wrong choice. But failing forward means that you pick up all those pieces you look through them and you say this is how we're going to do it next time and we're going to test this and try this and figure out what? Ah what we're going to do instead of what we. Did and we shall be stronger because of it and you're 100% right? It's it's the opportunity. It's the opportunity to grow. It doesn't force you both but it's the opportunity. So.

55:39.14
Joe
Yeah, yeah, yeah, it makes sense I mean I think ah you know I think we went over a lot of really good material right? like for my listeners because my listeners. They vary right? like they're all in different stages of their careers. A lot of them are trying to get into security. Um, some of them have contemplated you know going out on their own and doing things right? like I think this is a very helpful episode for my audience honestly and.

55:59.98
Benjamin Brooks
Right.

56:17.63
Joe
I'm going to need to have you back ben.

56:18.29
Benjamin Brooks
That it's a pleasure man I always love taking time to sit down and chat with you about anything. So yeah, security's just 1 aspect of it. You know? yeah.

56:28.14
Joe
Yeah, definitely. So um, you know where can my listeners find. You do you have a blog. Do you you know are you on Linkedin. What's your company website. All that fun stuff.

56:40.94
Benjamin Brooks
So well. Thanks for the thanks for the opportunity to to shamelessly plug my website my company. Ah, it's not easy to find but it's http://provalladis.com and maybe you can drop the link in there. It's actually a really geeky name. It's it's a it's a geek.

56:46.92
Joe
Ah.

57:00.90
Benjamin Brooks
Joke if you know any latin it's like that's not how that's spelled and it's like oh yes, but it's information security at the end and it's how to overcome your problems. So anyway, um, yeah, http://praveladus.com I I don't have any blogs and I'm not really posting a lot on Linkedin these days I'm so engrossed with. So much of what I have going on right now. Um, but I'm going to get back up on it and anybody can reach out to me anytime I'm never going to say no to somebody who asks for advice or something like that. So if anybody wants to reach out. Yeah I can be found on Linkedin. Um, you can schedule a time on my website if you are interested in learning more about privallatis and what we do and yeah, that's that's the gist of it.

57:47.51
Joe
Awesome! Well hey, thanks for coming on man it was a great one. We'll definitely have you back for sure. Thanks everyone take Thanks everyone. Hope you enjoyed the episode.

57:54.85
Benjamin Brooks
Thanks for having me Joe.