Security Confidential S1 E4 Jordan Fulk

Tyler Smith: Welcome to Security Confidential by Dark Rhino Security, where we get together and talk about all things information security. Today we’re taking a little bit of a deviation. We’re going to be talking about bourbon, security, and talent. I’m Tyler, an information security practitioner with Dark Rhino Security.

Jordan Fulk: And I’m Jordan Fulk, enterprise account executive with Toptal.

Tyler Smith: Yeah, thanks for joining us today. We’re going to talk about security as far as talent is concerned and how bourbon fits in.

Jordan Fulk: Yeah, exactly. So stick with us, and I guess we’ll get this going.

Tyler Smith: Cheers! This is Johnny Drum. If you had to take a guess at how much that costs?

Jordan Fulk: 65 to 80? Something like that? I mean, is it?

Tyler Smith: You could buy three of those for that. Really, it’s like 25 to 32.

Jordan Fulk: I’m terrible with that, by the way.

Tyler Smith: Which is why I only have 20-dollar bags.

Jordan Fulk: A lot of times, bourbon can be hard to get into because a lot of it is so expensive. I think this one’s got a lot of flavor for a little bit of money.

Tyler Smith: Well, it’s a good one. The funny thing is, it’s not necessarily the really expensive bourbons that are really worth your time. It’s funny; they kind of take off, people snatch them up, and then all of a sudden, the 45-dollar bottle of bourbon is impossible to find. You go online, you look it up, and it’s like, “Yeah, you can get it, but it’s not $45 anymore. It’s $120.” It can get pretty aggressive when it comes to bourbon.

Jordan Fulk: Finding the right bourbon, in many ways to me, mirrors finding the right talent. Specifically security; that can be extremely difficult to do. You mentioned before that you had some kind of interesting statistics.

Tyler Smith: They say for every IT opening that a hiring manager releases, they receive 70-plus resumes. From that, you might have one or two percent of those actually be qualified individuals.

Jordan Fulk: Wow. I think that can be a drawback of some of the job posting websites. There’s not really a lot of filtering to it. What you see is a lot of people looking for jobs saying, “Hey, yeah, that looks interesting. I’d like to do that.” But what you’re not getting is, “Hey, I’m qualified to do that.” So, I think that’s pretty interesting.

Also, taking the average—at least on the enterprise side and through maybe some on a startup or mid-size scale—it can take anywhere from three to four months to fulfill a standard security position, which is a long time.

Tyler Smith: Okay, yeah. I mean, that sounds about right. I think for a regular IT position, the number of people who move through is amazing. 70 applications per open spot is quite a few. Couple that with one to two percent who were actually qualified for it.

You look for your dream job, but you have to quickly catch the attention of the person looking at it. That gets into the importance of resume writing and networking in the area, being part of groups and stuff like that. I think the statistic is actually less than a minute that the hiring manager takes to look at it. If you think about that—so many resumes, a minute per resume—that’s an hour just reading resumes that you’re just skimming. It can be extremely tough.

Jordan Fulk: Especially when you consider the fact that that’s probably not the only role that’s open. In your mind, what makes a resume stand out?

Tyler Smith: I always look for… if you aren’t typically labeling yourself as a consultant—which if you’re on the security side, I suggest maybe doing—I look at longevity in a role. I always think that if a company has you, they don’t usually let you go very easily.

I usually look for a duration column stating the role. I also look at career progression. Not only have they stayed somewhere for a couple of years, but have they advanced their career? Specifically with security, I think if you look at certifications as well, that’s huge. It shows someone who is going to take time outside of the eight to ten hours a day they’re working to actually invest back in themselves. I think that’s a huge indicator as well.

Jordan Fulk: I agree, because it’s not a static industry. We’re not cutting diamonds here. We’re dealing with technology that changes so quickly that if you don’t see that… I agree.

When I look at a resume, I’m looking for somebody who invests in their own personal development. Not even just in security; it doesn’t even necessarily have to be a certification. Maybe it’s training, maybe it’s a project they did on their own time. Certifications definitely have their place. It’s a measured affair, if you will. Being in the industry, you probably know what certifications actually mean something versus ones that are just hours-based, like “I spent this much time doing this.”

Tyler Smith: That doesn’t necessarily mean that they’re a good worker, but that’s an interesting one. From a security perspective, it seems like there’s less of a logjam of applicants. I base that on the conversations I have with people who want to get into the industry.

There’s just this hesitant quality about people who are really serious. You can tell they take it seriously. They’re like, “I don’t know if I’ve got the skills required.”

Jordan Fulk: That’s where that conversation about what you are doing in your personal time comes in. How are you developing yourself? What are you studying? What projects are you working on? To me, that kind of stuff can be just as valuable as formal education or certifications, depending on what the project they’re working on is.

Tyler Smith: Maybe they set up enterprise-grade security on their home network. Something that is actually applicable to enterprise security. A lot of people leave that stuff off of their resume. They do the work, and they don’t put it on there. How would you say someone should put that kind of thing to you? If they’ve got a list of things they’ve worked on, where would that go on their resume?

Jordan Fulk: I always like to see it. I’ve been in the field for a while, but I’m not technical myself. Some things I’ve seen that are kind of unique is to have an accomplishment section underneath the position. Instead of just listing out a couple of bullet points of daily responsibilities, have an accomplishment section.

“During this role, I actually achieved X certification,” or from a security standpoint, maybe they got their vulnerability count down to a certain percent. Show not only what you did, but the outcome of what you did. I think that’s always a cool way.

Tyler Smith: Okay, so talking about those outcomes as opposed to just, “We did this,” or “This is what I did between the hours of 8:00 and 5:00.”

You actually brought up something earlier that I wanted to ask you about. This can get us sent down a rabbit hole, so I don’t want to go that far. Being someone who has hired people in the past, how much weight do you put on formal education?

I can preface this by saying I’ve been to a couple of meetup events recently, and the speakers talk about how education for the future is a very difficult task because technology is emerging so quickly. The stuff someone is going to learn their freshman year is going to be out of date by the time they actually graduate. How much weight do you put on a formal education?

Jordan Fulk: Formal education is important for those foundational items: “Can you communicate well? Do you have critical thinking skills?” Beyond that, I don’t put a lot of weight on formal education when it comes to those skills that are going to be the difference between a practitioner or a professional I’m going to hire who is going to excel versus somebody who is just going to follow the status quo.

The reason is that technology moves so quickly that traditional formal education, in my experience, has not kept up with it.

Tyler Smith: I agree. The degree to which that is the case has been almost alarming. I’ve seen a few places that do it well. Not plugging it or anything, but Western Governors University does a decent job of keeping their IT degrees up to date. Just because they don’t marry themselves to any one data source, so to speak, and they keep the courses up to date.

Another one that’s really good is Cybrary—it’s like “library” with a “C” on the front of it. It was started by security professionals, and the intention behind it was to give people access to quality, security-focused education. It kind of expanded into IT; they cover product management, IT security topics, and general IT topics.

It is created and curated, I guess would be the right word, by people who are security professionals working in the industry. I think that’s the thing traditional education misses when it comes to technology. You can go there and learn about technology in general, but it’s going to be more of a snapshot in time than a truly applicable, up-to-date version of what you can expect to see in real life.

Jordan Fulk: I completely agree. I ask that question because I’m always interested in the answer. College for kids now—I don’t have kids yet, but at some point I’ll probably have to have that conversation with them—I think college by that point is going to be more about teaching people how to learn so they can continue to learn and potentially change their career path in numerous ways in their lifetimes.

Tyler Smith: I agree. Saying that you want to be an information security professional is like declaring, “I want to become a lifelong learner and never stop.”

I don’t know if we’re… we’re probably totally screwing this up. There’s some expert watching us going, “Look at these morons.” Like you’re supposed to stand up and spin around three times and drink a glass of water while punching a stuffed chicken.

Jordan Fulk: Yeah, that’s interesting you bring that up because I’ve actually started something a while ago with my friends where we actually do tastings. Kind of how we started this conversation with how hard it can be to get into bourbon.

I didn’t really know much about it when I started. I had some friends who were really into it along the way who helped tell me about certain bottles, but it can be pretty intimidating. What I started doing was starting a note on my phone every time I tried one. Like a little “yes” or “no,” whether I liked it.

What I’ve started doing is having friends over for blind tastings. I have enough of a collection that when people come over, I’ll try to mix and match different ones to really try to pinpoint what people like. In general, these Maker’s Mark Private Selects always get me because some of them are a little bit sweeter.

Personally, I like bourbons that are a little higher proof but have a sweeter finish too. Usually, the Maker’s ones that have a high mocha stave or something like that are a little bit sweeter.

Tyler Smith: Okay. You’ve got a website too, right?

Jordan Fulk: I’m going to be starting it. I don’t have anything on there yet, but we have a web hosting service. That can be episode two. Bourbonbookclub.com. I run Bourbon Book Club on Instagram and I have a Facebook group that’s a little bit smaller, just an intimate group of friends.

It kind of started as a joke, like a “book club” where guys don’t read. We get together with some friends and try to be a little bit more serious about learning about it.

How it started was we had some individuals I used to work with, and we would get together and everyone would bring a different bottle. We learned you have to keep it small or else you end up having to stay at your friend’s house. Everyone brought their own bottle, and we actually had printed-off tasting sheets.

We went through everything from the color to what you smell—what are the different notes you’re smelling, the taste you’re getting, the finish, and how you would rate it. Do you want to do this Maker’s? Go through it like that?

Tyler Smith: Real quick, yeah. I would say that’s probably like honey.

Jordan Fulk: Yeah, it’s kind of brown. I would say maybe like honey or a light copper.

Tyler Smith: Okay. It’s very creative of you. I would be really bad at this.

Jordan Fulk: See, that’s what the worksheet teaches you.

Tyler Smith: I need a coloring book.

Jordan Fulk: Smells like booze. I get vanilla. I think it’s a sweeter scent.

Tyler Smith: It’s real. It’s like a sharp kind of scent, but then again, that might just be me smelling the alcohol.

Jordan Fulk: I get it. I give it… maybe like… yeah, I think I do always get kind of a char.

And for the taste—this is how I’ve been told to drink bourbon, which is almost like a scotch—I think with scotch, you’re supposed to hold it in your mouth and breathe over it to get some of those notes. With bourbon, I kind of do the same thing. I let it sit on my tongue and work its way back.

I try to pick out the consistencies you’re feeling in your mouth. Is it an oily feel? Is it drying out right away? Is it tingling, like a burn? That’s what I try to pick out.

Tyler Smith: Okay.

Jordan Fulk: So, I get it. My tongue is on fire right now. That’s what it is. If you look at the stave selection, they have some toasted French spice. That’s what that note is, like a spice. But then there’s also pretty high French mocha as well.

Which, with the aftertaste, if you try to think like a Hershey bar, you start to kind of taste a little bit of chocolate.

Tyler Smith: You can work at Charlie’s Chocolate Factory.

Jordan Fulk: Yeah. This is all good stuff because I’m very basic in so many ways.

Tyler Smith: Like a pumpkin spice latte?

Jordan Fulk: I am, yeah. Just give me some booze. I just know that it’s good. I can taste spice, and it burns, but it just tastes good to me.

The hard thing for me is really remembering. So, I think that’s where your idea of writing stuff out comes into play.

Tyler Smith: Taking the notes, “yes” or “no.”

Jordan Fulk: I’ve done some searching, and maybe for you developers out there, I’ve actually looked for an app that’s like a classification. Can I go in and create my own bourbon list and rate it my own way? I haven’t really found a good one. There are a few out there, but I’ve never really found one I like that sticks with me.

Tyler Smith: Take note, you entrepreneurial people.

Jordan Fulk: I wanted this job opportunity, a real opportunity.

Tyler Smith: That’s how you can tell we haven’t drunk enough yet.

Jordan Fulk: I’d say that’s the entrepreneurial bug.

Tyler Smith: So, you work in the talent industry. What trends are you seeing as far as how people are doing things?

Jordan Fulk: I kind of hate using the phrase “war on talent.” People have used that for the last, oh my goodness, forever.

Tyler Smith: You can tell you’re not in the talent industry because of that, right? That’s how everyone talks: “Oh, there’s a war on talent, there’s a war on talent.”

Jordan Fulk: It’s been that way for so long, but I think what we’re seeing is a shift in the way companies are doing things. One of the biggest things is the future of work and the gig economy. Are you familiar with either of those terms?

Tyler Smith: I’m familiar with the gig economy.

Jordan Fulk: Future of work, at least the way I understand it, is more just like, “Hey, where is work going to be in the coming years?” What are companies doing now to fit people’s lifestyles that are changing? One of the big things I’m seeing is offering some sort of remote capability to workers.

I think in any field—whether it be IT, security, information technology in general, finance, or accounting—one of the big things that employees want most is work-life balance. We hear that all the time: “I want to take my kids to soccer practice,” or “I want to meet them on the bus.”

I think what companies are doing is being a little bit more flexible about that. I was listening to a podcast the other day where they said they polled a number of individuals and at least 70% of individuals have some sort of remote capability in their job, which I think is great.

Personally, I work fully remote right now and it’s changed my life. I’m much more focused, and I think I get a lot more done. Then again, I can take a break in the middle of the day if I need to and take my dog for a walk.

I think that’s a big thing that we’re seeing. I think a lot of the market is shifting that way. We were talking about it beforehand; it sounds like some of the stuff you guys are doing actually gives people the capability to even do that type of work.

Tyler Smith: That is interesting. One of the things that has really enabled this move toward remote work has been the move to the cloud. By and large, companies are headed that direction. They’re going to cloud SaaS applications and really decentralizing their infrastructure so they have less of a “dog in the fight,” so to speak, as far as maintaining that infrastructure is concerned.

I think it’s led to people wanting that. We don’t have these systems we have to babysit that live in that closet down the hall. It’s all off-prem. We don’t have to worry about maintaining the servers, the site, the temperature of the room that stuff is stored in. We can get by by just using the application and maintaining who can access it.

One of the things we’ve tried to do is focus on that as far as security solutions are concerned. We have gone toward technologies that allow companies to maintain control over their intellectual property and secure their employees’ devices wherever they are, regardless of whether it’s BYOD or a company-issued device.

We use technologies that allow us to provide identity and access management that can be tied into the various cloud applications that are out there and still work with legacy applications that might be on-premise. They wrap in such a degree of security as to ensure if someone has access to your application, it is someone you want to have access.

But it takes it a step further in enabling people to ask for things they need. If you needed an application, we have a way to give you a dashboard where your employees can say, “I need access to this.” It gets routed automatically to someone designated to approve that request. They click accept, they get the application they need, and it can take less than five minutes.

I have a question for you. Given that you live in this space every day, can you tell me if an organization wants to offer that capability to their employees but doesn’t take the necessary steps to make sure that things are secure, what can happen?

Jordan Fulk: That’s a great question. The downfall of any cloud application is it’s accessible from anywhere.

Tyler Smith: It’s a double-edged sword; it cuts both ways.

Jordan Fulk: It’s great because you can be in conference room B and access your application, but it’s not good because you can be in some other country trying to access the application in an unauthorized fashion.

A lot of applications lack the ability on their own to not only stop that but also let you know that it’s happening. An example I would give is an integration we did for a company. Once it was finished—it was an overnight integration, finished around 1:30 in the morning—we started getting all these alerts and complaints about accounts being locked out.

What was happening was the client’s O365 instance had been under constant brute-force attack.

Tyler Smith: For non-IT folks, that would mean someone just trying password after password, like “password123.”

Jordan Fulk: We call it a dictionary attack, where you’re throwing known passwords at accounts and waiting for something to open up. That was happening to their O365 instance, and they had not configured it to send any kind of alerts.

We freaked out because we just finished this thing and now all these accounts were locked out. The reason they were locked out was the security we added caused those accounts to lock out due to the number of failed login attempts, which we quickly rectified.

What we did was block the source of those brute-force attacks. Before that, they had no idea those were happening continuously. They didn’t have a clue. That’s just one example of how it’s great you can access it anywhere, but it’s also terrible because so can everyone else.

They can knock on the door just like you can, and unless you’ve taken steps to ensure the door is inaccessible to people who shouldn’t be knocking on it, it’s scary stuff.

Tyler Smith: Yeah, definitely. Let’s go on to the next bourbon. This one is Stagg Jr. I believe this is the 13th one they put out, batch 13. It’s 128.4 proof, which for those of you who are mathematically inclined, unlike myself, is 64.2% alcohol by volume.

Jordan Fulk: This is Buffalo Trace, right?

Tyler Smith: I am a big fan of Buffalo Trace.

Jordan Fulk: You like the smell?

Tyler Smith: Leather and cherries.

Jordan Fulk: Yeah, I get the cherries and the leather too. This one has that oily taste in your mouth. This one coats the entire palate.

Tyler Smith: That one went right up. It is really, really good. If you look at the glass when you see that… oh, it has legs. I like that. I believe they say it’s got “good legs.”

You brought up an interesting topic: do you have a top three or a top five?

Jordan Fulk: That’s a list I keep running in my phone as well. I would say Stagg is in my top five for sure. We just got this a few weeks ago, I gave it a try, and instantly fell in love.

Tyler Smith: I.W. Harper is another one. I really like that one; the finish on it is really smooth. Blanton’s… because it is just so consistently good. I’ve never had anybody hand me a Blanton’s and I go, “There’s something not right about that.” Not once. It’s very consistent.

They had that fire a while ago. I think that might have been… well, they had a brick house collapse.

Jordan Fulk: I’m waiting for like a “Survivor Series” for bottles that are two years older than that.

Tyler Smith: Jefferson’s Ocean Sea Cask… yeah, I like that one a lot.

Jordan Fulk: It’s Basically, the cask is put on a ship. It’s not just “at sea,” it’s in a harbor.

Tyler Smith: Honestly, it may just be a gimmick, but whatever it is, it works.

Jordan Fulk: It’s marketing at its finest.

Tyler Smith: I do like it; it’s a great bourbon. Trying to think of what else… there are so many good bourbons out there. Maker’s Mark, honestly, just rounds out your top five.

Jordan Fulk: I like consistency, and Maker’s is always consistently good.

Tyler Smith: Coming from a security guy, that says something.

Jordan Fulk: I also have Stagg Jr. in my top five. I’ve tried maybe four or five of their batches, and everyone… I haven’t done a blind taste, but I’ve loved each one. I also love Elijah Craig Barrel Proof.

Tyler Smith: When you open that up, it’s big. I opened one up and they walked past with it and I was like, “Man, it’s pungent.” It’s really good.

Jordan Fulk: For anyone out there who is into security but not bourbon and doesn’t care what we’re talking about, if you’re trying to get into it, even Elijah Craig Small Batch is awesome. I think it’s 35 bucks. Elijah Craig Barrel Proof, E.H. Taylor Barrel Proof—if you can find it—is really hard to find. My brother-in-law was able to hook me up with a bottle, but that stuff might actually be better than Elijah Craig.

But I meant to round mine off with Willett 4-Year Rye. I actually love everything Willett does. I’m still a sucker for Weller Antique. It had a bit of a boom here in Columbus; everyone was buying it off the shelves. I was fortunate to have some, but it’s still one of the best. I like higher proof, sweeter stuff.

So, with it being a wheated bourbon, I think that lends to it being in my top five.

It’s frustrated… like a link to a top five whenever I talk to people who are novices just trying to get into bourbon. I always ask them, “What do you like?” and they’re like, “Oh, I hate ryes.”

I was actually looking into it today because I was one of those people. Years ago, I was like, “Rye is not for me.” The definition between bourbon and rye: bourbon has to be 51% corn, and rye has to be at least 51% rye.

Looking back, I like a lot of different tastes. I think everyone’s introduction to rye is probably Bulleit Rye. They were really the first big one that hit the market well.

I was trying to think to myself why I didn’t like it. I researched it, and Bulleit Rye is a 95% mash bill. It’s 95% rye. That’s like going off the high dive first thing. You have to take baby steps. You have to go into the shallow end, then the deep end, then the high dive. I think that might be what scares people away.

Tyler Smith: That was my introduction to it.

Jordan Fulk: Does that mean it has a rougher taste?

Tyler Smith: It’s spicy, not as easy and smooth as more traditional bourbon. So if that’s what you’re into and you go to Bulleit Rye expecting that, it’s going to dry your tongue out.

Jordan Fulk: If you wanted to try a rye that might suit your palate a little more, have you tried Old Forester Rye? It’s 100 proof. I think the mash bill is like 65%, so it’s a lot less. I think it’s like 23 dollars right now. How it’s that cheap, I have no idea.

It’s delicious. It is so good. To your listeners out there: you’re welcome.

Tyler Smith: We can blame you for the price hike when it’s 50 bucks.

Jordan Fulk: You owe me 20 bucks.

Tyler Smith: This is the Clyde May’s Cask Strength Limited Release. It’s a 10-year, distilled and aged in Kentucky. It’s a straight bourbon, 117 proof. There were only 3,500 bottles released. The MSRP on this is $250. Believe me, I had to get this one on the secondary market.

Jordan Fulk: So it was only 200 dollars more than that?

Tyler Smith: The secondary market is a little foreign to me. I don’t really follow it too much. I think Pappy Van Winkle 23-Year is also $250 MSRP, but you can’t find it now for under $2,500 or $3,000.

Jordan Fulk: If you’re lucky to even find it. That’s why they have libraries.

Tyler Smith: This is kind of a unique thing. I just walked into a flower garden.

Jordan Fulk: Oh wow. Like in the spring, we just fast-forwarded two months.

Tyler Smith: It’s like walking through and breathing deeply at Macy’s or your department store of choice.

Jordan Fulk: Some spice, but super-duper smooth.

Tyler Smith: Wow. The whole way through. I guess that’s why it’s so hard to find.

Jordan Fulk: I think that may have a lot to do with it.

Tyler Smith: I think we all need to get acquainted with the culture of the Clyde May’s. If you’re listening, make it happen. We’ll get you in touch with the Clyde May’s people. I mean, we won’t, but we’ll probably tell somebody they can do this.

Jordan Fulk: That’s humanity.

Tyler Smith: Like an oaky, charred taste that’s just sweet and nice and easy to drink.

Jordan Fulk: The finish is a little rough to me, just a smidge. But then again, I drink like a freakin’ man.

Tyler Smith: That was some good stuff. You could really taste multiple different flavors.

So, you work for Toptal. If somebody wanted to become one of the “Top Tallers,” what does that entail? How is that different?

Jordan Fulk: We’re a little unique, actually. We are a private network of pre-vetted professionals that span multiple industries between software engineering, design, product management, project management, and finance. To get into our curated network of top talent, you actually have to go through a pretty rigorous screening process. It takes a little while to get into it, but it’s really worth it.

Our big selling point is the quality talent that we can provide immediate access to. We really hang our hat on the quality of talent we can offer as well as the speed at which we can do it. The delivery piece is almost instant; within 24 to 48 hours, we could usually get profiles to review.

From a security standpoint and anything we’ve talked about, that’s top-of-the-line. You can look me up on LinkedIn: Jordan Bulk (B-U-L-K). My parents forgot the ‘A’ when I was born. You can look me up on LinkedIn or shoot me an email: jordan.bulk@toptal.com.

If you want to talk about bourbon, I’m always up for that. As I mentioned, I run the Bourbon Book Club. You can look me up on Instagram: @bourbon_book_club. And if you want to join the Facebook group, just search for “Bourbon Book Club.”

Tyler Smith: Subscribe to our podcast and rate it five stars, if you wouldn’t mind. Share it with your friends. We do plan on doing a lot more of these in the future. Thank you very much, Jordan. I really enjoyed it.

Jordan Fulk: Thank you for watching.