Leaders and Their Stories

Richard Lowe: Hello. This is Richard Lowe. And this is the leaders and their stories. Podcast I'm the writing king and ghostwriting, Guru. And I'm here with

Richard Lowe: Matthew Matthew Walker. And we're gonna talk about how to get an it project, approved Matthew. Why don't you introduce yourself.

Matt Walker: Good morning, Richard. Thanks for having me. Yeah. I I've been in it seem seemingly, since dinosaurs have roamed the earth done virtually everything from teaching people how to put computers together and take them apart back in the days when 4, 86 Dx. Meant something to people.

Matt Walker: and done everything from that all the way up through cyber security, and just a a pleasure to be here.

Richard Lowe: Well, thank you for coming on the show.

Richard Lowe: so the subject is how to get an it project approved any kind of it project. I know I've had trouble with that in the past. I was the it director, Trader Joe's for 20 years.

Richard Lowe: and getting it is considered a cost center by most companies and

Richard Lowe: getting things approved can be a nightmare. Because, hey, that's an expense. That's something especially considered a big expense. And the it department was also looked on as

Richard Lowe: being somehow subhuman, and that always it always made it interesting. And of course we didn't talk the language.

Richard Lowe: so that was on us. So we were talking bits and bytes, and they were talking roi

Richard Lowe: in business terms, and we never! We really never burst through that barrier.

Richard Lowe: What have you found.

Matt Walker: Yeah. So you, you kind of hit on one of the major topics. There, we we did this to ourselves. over over. Not just a couple of years, but many, many decades. We we kind of assigned

Matt Walker: we kind of assigned this othering to technology. In the the it and cyber realms that you you had to be a super genius to do this stuff. When you when you mentioned when I mentioned the term cyber to people. They immediately have this image of this hooded guy sitting sitting in a darkened room. And there's matrix screens behind him, and you know, with a couple of keystrokes he's hacked past the firewall, and

Matt Walker: we did that to ourselves.

Matt Walker: Yes.

Matt Walker: and and kind of elevated in our own minds, you know. Hey? We're, you know, the stupid user syndrome snl had a skit about it for years. I can't remember the guy's name.

Matt Walker: No, but he was the It. Guy and he would come in move, and then he would fix their their problems.

Matt Walker: It it's our fault, and you can't fix a problem that's been created over decades in a matter of a few hours it takes time

Matt Walker: to fix that.

Richard Lowe: Yeah. I remember a time when I was in my boss and I went into

Richard Lowe: my boss's boss room and we we were. We were, we were fully prepped. We had

Richard Lowe: flip charts. We had

Richard Lowe: all the data you wanted about. We were trying to build a new disaster site, and

Richard Lowe: we went in there, presented it to the CEO, and the CEO listened to me for all of 3 min, and then he said, Stop.

Richard Lowe: leave!

Richard Lowe: And he's I said, What! What? And he said, You're you're you're speaking gibberish to me.

Matt Walker: Yep, and threw me out of the room.

Richard Lowe: And that's when I learned he he wanted business. Speak not

Richard Lowe: all the things that we use like. Okay, how long does it take to recover all that kind of stuff he didn't care.

Richard Lowe: and then he turned to my boss and he said.

Richard Lowe: Why are you even doing this?

Richard Lowe: Get out of here. So my boss even got reamed for putting a project of many millions of dollars in front of his boss

Richard Lowe: without any preparation.

Richard Lowe: So it's cold.

Richard Lowe: And even my boss failed at the business. Speak so. It was interesting, interesting lesson.

Matt Walker: Yeah. Yeah. Well, I I had a

Matt Walker: fairly similar story with a little bit of a little bit of a twist on it. I was. I was at

Matt Walker: Kennedy Space Center, and we were doing a presentation about the current state of security to the CIO there, who I eventually became really good friends with. But so he's sitting in the. He's sitting at the head of the big table, and it's exactly how you're picturing it in your mind, and I'm up in the front with the big screen, with the laser pointer and going through things. And

Matt Walker: and he he like raises hand. I'm like, I'm like, Yes, Sir Henry, what can I? What can I do for you? And he he says, Hey, so I'm I'm looking up there, and I'm just I just I don't notice any red. Everything is either green, teal, or blue.

Matt Walker: and I'm like, Yes, sir, it's because I know you don't like Red.

Matt Walker: and he he really, you know that. That made him laugh, and he kinda understood what I was talking about, so that then, later, when we got to the bad stuff

Matt Walker: it it's it's like we prepared him

Matt Walker: for the bad stuff it was like. See, it's it's not so bad. It's just blue.

Matt Walker: So.

Richard Lowe: Interesting concept there. Interesting concept.

Richard Lowe: Yeah. Now, now, I've learned. You know, I'm learning marketing, and it's what's in it for them is the important thing.

Richard Lowe: That's that's the number one thing, when you're talking to somebody else and trying to pitch them something which you're doing in this case, what's in it for them, actually, what's in it for them personally, sometimes. In the case of it, what's in it for them as as a as their title what's in it for them as their department in the company?

Richard Lowe: If you don't have what's in it for them first, st you've already lost them.

Matt Walker: Right one of the

Matt Walker: I read a lot of books on this kind of stuff. It's it's really interesting to me, the psychology of why people do the things they do and what they want. And and I was was reading this this one book, and the the guy said I could take a picture of you and one other person.

Matt Walker: Then I can take a picture of you. With your high school graduation group at your

Matt Walker: 25, th 30th reunion whatever.

Matt Walker: And then I could take a picture of you at a Bon Jovi concert.

Matt Walker: and I can put all 3 pictures in front of you.

Matt Walker: and you know what you're gonna look at you.

Matt Walker: you're you're not gonna look at, you know all of these people and all of their stories and the background. And what's going on. We are focused on us. It's built into us. It's it's part of our DNA. It's just the way the way that we are, and and people who can.

Matt Walker: I hate to use the term exploit. But that's kind of my realm

Matt Walker: people who can exploit that can get things done a lot faster than those who only focus inward. You know.

Richard Lowe: Right

Richard Lowe: right now, cybersecurity projects are even a bigger challenge, because that's really considered a cost center and unnecessary by most, although that's changing as things happen.

Matt Walker: Yeah.

Richard Lowe: And it's not really very well understood outside of it, or even inside of it.

Richard Lowe: we tend to alarm, make it alarming.

Richard Lowe: And again, our fault, our fault, and then our

Richard Lowe: bosses. They don't want to be alarmed. They don't want the stockholders going. Oh, my God! Oh, my God! You know they, don't they? So they want to tone it down. We had a culture where the stores were the important thing. So

Richard Lowe: sending notes to the stores about security was not something you did.

Richard Lowe: because we didn't want to burden them with that. Well, how do you train them on security? If you can't talk to them about security.

Richard Lowe: And it became an interesting conundrum for us.

Richard Lowe: We worked around it somehow.

Richard Lowe: usually through in person meetings and stuff like that rather than email blast. And but it was interesting.

Matt Walker: It's 1 of my kind of a sidebar to what we're talking about here because you mentioned it. It's it's 1 of my one of my favorite things to talk about when I'm asked to go. Talk is is my position is you? Should

Matt Walker: we? We spend a lot of we spend a lot of time and money trying to train our users, you know. Hey, this is our security posture. This is what you need to do to protect our data. Don't do this. Don't do this. Don't do this. And we usually put this together in either a video or a Powerpoint slide that they click through with a test at the end. And then, for some inane, ridiculous, crazy reason, we send it to them in an email with a link to click

Matt Walker: it. It just it's it just aggravates me to no end. But in all of that no, no! Think back to what we just talked about over the last couple of minutes.

Matt Walker: Everything I just said was ours.

Matt Walker: Our stuff we don't.

Richard Lowe: Right.

Matt Walker: We we spend, we spend all of our training talking about our data, our protection, our.

Richard Lowe: Right.

Matt Walker: We never once mentioning the user.

Matt Walker: I think we we.

Matt Walker: In my opinion.

Matt Walker: I think we would be better served by radically changing the user training environment to more of a making security personal.

Matt Walker: If I teach Bob how to protect himself and his family and mom, and what to do if something happens at his house, Bob will protect my data

Matt Walker: because he's used to it. It's part of who Bob is. That's where our focus needs to be. There's a whole train of stuff on that that we don't need to get into. But because you mentioned it's it's really kind of a passionate plea of mine is. Get away from talking about our stuff and start talking about Bob, and you'll be better off.

Richard Lowe: Right.

Richard Lowe: I just had to go through one of those security thing training courses from one of the training companies that it was an hour long

Richard Lowe: if you were fast.

Richard Lowe: which I am because I am a cybersecurity person, and it goes through all these games that they put together, you know.

Richard Lowe: and I was just going through and saying.

Richard Lowe: these things are ridiculously stupid. They they fulfill the letter of the law

Richard Lowe: or the rule that yeah, these users have been through this, but

Richard Lowe: I don't see very many users, if any getting anything from it. That lasts they're just stupid.

Richard Lowe: I don't know what else you could do.

Richard Lowe: But you, you know, take, they have a little aquarium with fish, and take take the message that you shouldn't read and put it in the trash. Can you know?

Richard Lowe: Okay, this is kind of dumb.

Matt Walker: Yeah, see, Matt, Matt Walker's training program would be more. Something like this. It's like, Hey, hey, Bob, here's you know your your 1st your 1st training program. It's not a not an annual thing. It's just a bit. Let's let's just talk about fishing for a second. Okay, typical training. Right. Now I'm gonna send Bob a 30 slide deck on. Let's define fishing. Let's show you how to look through things, so you can figure out what the which one's bad and which ones

Matt Walker: trust me, I don't care how intelligent Bob is, or you or me, or anyone. If someone wants to effectively trick you by using an email. They're gonna do it.

Matt Walker: Anyone who has spent any time reading about deepfakes over the last forget 10 years year.

Matt Walker: There's no way to tell anymore. There's no way. So the training program shouldn't be all of this fishing stuff. And blah! Blah! That's great stuff for Bob to know what you need to tell Bob, is, don't

Matt Walker: click links that'll protect you, Bob, when you're at home. And you're looking through email. Don't click links.

Matt Walker: And you're you're protected from a whole bunch of stuff. By the way, don't do that at work either.

Richard Lowe: Yep, Yup, I would. I would modify that slightly. Don't click links unless it's something you just asked for.

Richard Lowe: like I go to my account. And I say, Okay, I want my report.

Richard Lowe: You get an email right after that, although that screwed me once over because I had just sent a package from ups. And 2 min later an email comes in that said, it's here.

Richard Lowe: It was a scam email.

Richard Lowe: It was just coincidence. I clicked it. Of course, you know, I got all kinds of software that protected me and I didn't. It's fine.

Richard Lowe: I actually think we've got it reversed.

Richard Lowe: The user is never gonna do this? 100 right? Why don't we make computers good enough to not have this problem.

Matt Walker: Yeah, so I I have a a slight philosophical difference in that. Because I I don't believe you can fully secure either side of that equation. I.

Richard Lowe: Of course.

Matt Walker: No, the only really secured system is one that's turned off, poured into a vat of concrete, and buried under 50,000 pounds of lava.

Richard Lowe: And the and in Stuxnet the Iranians proved even air gapping doesn't protect you. Remember that.

Matt Walker: Exactly so. So my my perspective over over

Matt Walker: I had a job at Kennedy Space Center.

Matt Walker: We were. We were working a desktop support contract, and one of the things that we did was we would we would monitor these these little screens, and it would pop up and tell us, when a system started beaconing a 1 of the many, many symptoms that something had gotten on the system that it didn't want to. But if it was beaconing to specific areas. We would want to go. Take a look at that system.

Matt Walker: And this this was in the days where you actually had to go get it. You you couldn't just centrally, you know, and I cannot tell you the number of times that I would go to somebody's office. Intelligent people, some of the smartest people in the world, people trained in security. They know how to use their systems and all of it, and I would show up to pick up their system. And they would say.

Matt Walker: Didn't you guys install antivirus on here?

Matt Walker: I should have been protected?

Matt Walker: So the the total reliance on a system or a tool to protect you is worse.

Matt Walker: in my opinion, than having none of that.

Matt Walker: because if you think you have security, you don't.

Matt Walker: If you think you have security, you're more than likely you're more likely to take risk that you otherwise would not do.

Matt Walker: You know, people with a

Matt Walker: people with a security contingent around them, don't care about offending their waiter.

Richard Lowe: It's true.

Richard Lowe: it's true. And then then you've got emails like, CEO. This, the what's it called whale.

Richard Lowe: the the spearing, spearfishing.

Richard Lowe: and the one that's targeted. And they don't have links in there. Typically, they will say things like, Oh, I'm a CEO. And I just approved this 1 million dollar transfer

Richard Lowe: and have a voicemail or something. That's that's the CEO's voice that says, Do this, and that

Richard Lowe: doesn't have a link. It has a something that seems real a deep fake, maybe even a video

Richard Lowe: of the CEO saying, Can you ship this over there?

Richard Lowe: And I've seen companies lose millions and millions of dollars, because who's gonna say no to the CEO.

Matt Walker: Are you familiar with the Hong Kong thing that happened couple of years ago?

Richard Lowe: I think so. Yeah.

Matt Walker: Yeah, so so real real quick, because it's apropos to what we're talking about. So quick story. So so I I use Bob a lot in my allegory. So so Bob goes to work. He works in the finance department of this business. He works every day with the Cfo. And all of these people in finance. He sees them every single day. He walks into their offices, shakes their hands, knows them.

Matt Walker: So. It's late on a Friday, and it it was on a Friday. It's late on a Friday. He gets a message. Pop up. Hey? Can you join this call? He pops on the call. It's the Cfo. He's at home. There's a couple of other people on the call. They're talking about all this stuff, all of them talking about things they've been talking about in the office.

Matt Walker: Everything's fine.

Matt Walker: Well, during the call they talk about this business venture that the company is going to get into, and he needs to transfer. I don't know how many millions of dollars to this account to get it done.

Matt Walker: He does it because the Cfo is on the call he goes home, doesn't think a thing about it. Comes back on Monday, walks into the Cfo's office, says, Hey, what about that deal on Friday? Is things looking good, and the Cfo was like, what are you talking about?

Matt Walker: The entire thing was completely deep faked.

Richard Lowe: Yep.

Matt Walker: And I. I bring that story up because it it goes back to what I was talking about in making security personal.

Matt Walker: It leaders really in in this, in this age of AI, if it's if it's changed anything.

Matt Walker: we radically need to change the way we interact with the folks that that work for and with us.

Matt Walker: I would not want Bob to transfer anything to anyone without seeing my face

Matt Walker: and saying, Hey, you know I should be okay, as as the Cfo.

Matt Walker: For somebody to walk into my office. Sam, I I just want to make sure. Is this is this real.

Richard Lowe: Right.

Richard Lowe: right? Or some kind of counter signature, or something that's not over that same communication or something to to make sure that it's okay, like, maybe even pick up your smartphone and call him on a golf course. This is this is 10 million dollars we're transferring. Is that okay with you.

Richard Lowe: Not a

Richard Lowe: most likely isn't gonna complain if if you call him about that, and if he does, he's an idiot.

Richard Lowe: Yeah, interesting stuff.

Richard Lowe: yeah. And and of course AI is changing things on both sides, and the Ukraine war is changing a lot of things because it's causing a lot of things to

Richard Lowe: very rapidly grow and change and evolve. That's the word I wanted where

Richard Lowe: I mean, they're making a million drones a year now, Ukraine, out of plywood.

Richard Lowe: Right? Yeah.

Richard Lowe: And used it. You use parts

Richard Lowe: that are having an effect. I mean, who? Wow, okay.

Matt Walker: It wouldn't surprise me if somewhere in a darkened bunker in the Ukraine somebody has a computer up with a co-pilot on it. How do I wage war against us?

Richard Lowe: Yes, yes. And how do I? Cyber security? Yeah. I'm sure that they're hitting with every cyber weapon they got.

Matt Walker: Yes.

Richard Lowe: And Russia's not known for having real good security on their stuff.

Richard Lowe: Yeah, as. And Hezbollah certainly didn't have good security. That was a brilliant move.

Matt Walker: Yeah.

Richard Lowe: Let's not get into that. But that was just. Wow.

Matt Walker: I was gonna say, that's a that's a different podcast. That we can definitely get into. If you would like to.

Richard Lowe: Yeah.

Matt Walker: More than an hour.

Richard Lowe: That would be fun. That would be interesting. I just watched a video on it, and it's like Whoa.

Richard Lowe: masterstroke.

Matt Walker: Right.

Richard Lowe: Probably the best masterstroke since that World War 2 at least

Richard Lowe: some of the things the rush the British did. But let's not get off topic.

Richard Lowe: yeah, security is getting weird. And AI is getting weird because everybody thinks what's going to change the world. The world's going to be totally different. Everybody's out of a job.

Richard Lowe: No.

Richard Lowe: there's a point at which it just becomes. It's like the harsh hype cycle takes over, and it becomes unsustainable.

Richard Lowe: People find out what it really is and stop investing and crashes. It's the investors who will determine that.

Matt Walker: I I think the the biggest you know. Not that you asked me, but the biggest problem that I have with with AI at this point is not, you know,

Matt Walker: the whole. We've all seen Terminator, and it's not. It's not any of that, although that that is a concern long term.

Matt Walker: My, my biggest issue with it was we we created this gigantic engine that provides so much

Matt Walker: information and and ways to to do things, and we dumped it on. We dumped it on a populace without preparing them for it. We just made it available.

Matt Walker: Here it is.

Matt Walker: and this is the same populace who, you know, the most popular password in the world, is password with a 0.

Richard Lowe: And if if we just dumped artificial intelligence.

Matt Walker: On the world, and.

Matt Walker: That I think maybe we should have.

Matt Walker: We collectively, like the the community should have said, you know, to the open AI folks, you know, hey? Can can you slow? Roll this just a little bit, you know. Let's let's take it easy and introduce it in. And instead, you know, Microsoft is like, Oh, we'll just introduce things like recall where we'll get to, you know. Capture everything you're doing on your screen. But don't worry about it. It's for you.

Richard Lowe: Yeah, right?

Richard Lowe: Let's let's slow down just a tad

Richard Lowe: that I'm glad they took that back. Don't do that.

Matt Walker: Took it back.

Matt Walker: Yeah.

Richard Lowe: Yeah, shades of China right there and their social engineering.

Richard Lowe: They're serious social engineering.

Richard Lowe: But that's another podcast.

Matt Walker: Yeah, again, I'm I'm loading you up. Richard. I'm giving you. I'm giving you gold here for future podcasts, yeah.

Richard Lowe: Just have a.

Matt Walker: Buddy.

Richard Lowe: Could have a regular show.

Matt Walker: Sure. Yeah, let's do it.

Richard Lowe: I'm I'm not opposed, actually,

Richard Lowe: seriously. But we can talk about that later. But all right. Well, let's let's wrap it up. So you got any final conclusions for our listeners, something that will help them.

Matt Walker: So we we kind of we. We have kind of strayed a little bit through a lot of cyber sec here, but to to get back to your original the original topic you wanted me to talk about. And and that was getting an it project or a Cyber Project

Matt Walker: bringing it to fruition with a a management group that is either unwilling or not knowledgeable on the subject enough to to make the decision

Matt Walker: in in my, there's a lot of different things you can do. You guys can go to. You guys can go type that into Google right now. And it'll pop up an AI overview of steps you can take, and you know, show them the business impact and the cost. And blah blah! All that stuff is fine. I'm not even gonna bother to get into it.

Matt Walker: What? My what my advice or or my

Matt Walker: what I kind of see in it is

Matt Walker: the pitch, for something like that doesn't start at the pitch.

Matt Walker: It it starts way before that. There's a there's an old, an old saying that trust is built in raindrops and lost in buckets. Raindrops take a long time to fill up that bucket, so you need to start way in advance

Matt Walker: and build up that rapport with the the management group and those who are in positions above you, so that they know they can trust you that way when something happens and you come to them

Matt Walker: that element of trust. I'm not saying that that just automatically says, Yeah, Matt, go spend 5 million dollars. Don't worry about it.

Matt Walker: They still have things to consider, but because they trust you already.

Matt Walker: it helps a lot. And there's there's 2 books. There's 2 books that I would advise everyone to read, and they're both by the same author. It's a guy named Robert Cialdini, and the 2 books. One of them is called Persuasion, and one of them is called the Art of influence.

Matt Walker: And I'm not saying that you know you need to go through your entire work career, or your personal life.

Matt Walker: preparing people, and socially manipulating them to do your will. What I am saying is, if you read these, if you read these books and apply them with the heart that God intended you to have.

Matt Walker: You can build rapport and get things done

Matt Walker: much, much easier, especially the persuasion book. It's it's just gold for getting people prepared to at least consider what you're gonna say.

Richard Lowe: Yeah, books are gold, and those those sound like really good ones to get.

Matt Walker: I cannot recommend them enough. You'll you'll love them.

Richard Lowe: Okay, okay, well, thank you for coming.

Richard Lowe: How can people get hold of you?

Matt Walker: Well, I don't have a I don't have any kind of social media or excuse me, any kind of podcast or anything like that. I do have my my book coming out with O'reilly, certified ethical Hacker Study Guide is about to hit, and there's contact information. If you go out to O'reilly dot com library. Right now you can see the book, and there's contact info in there for

Matt Walker: for me, and I'm sure if anybody really wants to talk to me. They can contact you, and you know how to get a hold of me, and I'm on Linkedin. So.

Richard Lowe: Yeah, okay sounds good. Well, this is Richard Lowe. This has been the leaders in their stories. Podcast I'm, the writing king and ghostwriting. Guru. You can reach me@thewritingking.com and ghostwriting. Dot Guru appreciate you all listening and stay tuned for the next one. Thank you.

Matt Walker: Thanks, Richard.