Security Confidential S12 E2 Robert Black

Manoj Tandon (00:04.359)
Hello everyone. Welcome to another episode of Dark Rhino Security’s Security Confidential. Today we are having an awesome guest and we’re honored he’s here, Robert Black. Rob is a lecturer in information activities at Cranfield University in the United Kingdom. And he’s there on behalf of the UK Defense Academy. We’re gonna get into a little bit more about his background in a minute. He is the former deputy director of the UK’s National Cyber Deception Laboratory.

And at the Defense Academy, he helps educate senior military leaders about warfare and the information age. He has several interests in cybersecurity, but one that particularly is of keen interest to me is the role of influence and deception in cyber. So we’re honored to have you, Rob. Thank you for joining the show.

Robert Black (00:52.51)
It’s great to be here and really looking forward to a good conversation. So hopefully I can offer some interesting thoughts and change some thinking as well.

Manoj Tandon (00:58.971)
Oh, I hope it’s as tangential as tangential gets, because no one listens to me. They frankly don’t care what I say, but when we get someone of your caliber on, then they might actually pay attention, so. Ha ha ha.

Robert Black (01:14.082)
Well, I’m sure we’ll have a good conversation. And if we listen to each other, then hopefully everyone else will find that useful as well.

Manoj Tandon (01:19.683)
Yeah. So, you know, let’s start this off with just a brief background on yourself, you know, and your journey into cyber. How did this come about?

Robert Black (01:31.87)
Okay, well, it’s what? I’m looking at the time, 2023 now. So I’ve pretty much been in cyber for just over a decade and I’m the biggest imposter out there. I cannot fix computers, I cannot code and I fundamentally question whether or not I should be in cyber because I don’t have any of the technical creditations that people celebrate on LinkedIn every day. But despite that, I feel like I’ve had a very significant contribution in all of the roles I’ve played and I’ve played several roles throughout my time in my cyber security career.

Manoj Tandon (01:41.695)
Really?

Robert Black (02:00.738)
but I take a very non-traditional approach. So my background is I studied a master’s in law and then law and international relations, looking at the use of force in the international community. So the whole role of the United Nations Security Council, measures we employed during the 90s, Somalia, Rwanda, up through to Iraq, even looking at Afghanistan, how the international community came together to use force for protective measures and the collective security approach. And I say that because it’s quite important, so I think what comes next.

Manoj Tandon (02:10.827)
Okay.

Robert Black (02:29.83)
Following that, I joined part of the Ministry of Defence in the UK, where I was a policy analyst, so I worked with the research and development community, and I looked at improving ways of fighting war, where we could influence our adversarial decision makers to adopt our courses of action more quickly, more succinctly, and at less attritional cost. So helping them be coerced or deterred into the courses of action that we wanted. And I worked across traditional kinetic campaigns.

I’m planning around that. So thinking like the shock and awe in Iraq, for example, I worked at some of the more traditional nuclear deterrent campaigns. We spent a lot of money investing in a nuclear deterrent capability. And we assessed it in terms of how big the bang was, how accurately we were, we’re confident that the bang would go off where we needed it to go off. But we never really thought about the fact that when we pushed that button, that had already failed in doing its original job. We hadn’t deterred the bad guy from doing what we didn’t want him to do.

So I spent a lot of time looking at what we could do to communicate effective deterrents, which again has overlap in cyberspace. I did a few other things involved working on the UK Olympics, be it in the security around that. Chased a few pirates off the Middle East, or sort of Africa, I was based in the Middle East with the US Fifth Fleet. And then in about, go 2011 I think, I realized that I could actually get paid for playing on the internet, and that seemed a good idea. But actually more fundamentally, the internet was shaping how society was interacting.

Manoj Tandon (03:36.392)
Wow.

Robert Black (03:54.326)
and it was going to have a significant impact on warfare in the future. And that really got me involved in this new age of warfare and state contest. And since then, it’s been fascinating. I spent a lot of time working with the research community, looking at how we can influence people online, how we can shape relationships online, how we can build more effective relationships. And a lot of the time I was told that wasn’t cyber because it wasn’t technical enough. It wasn’t all about the coding enough.

And then thankfully the Russians came along and they started doing things in social media with certain elections. I don’t need to mention any presidential elections, for example, the Brexit referendum and people went, Oh, that’s quite cybery. And they suddenly started realizing that cyber could be a little bit more broader than technical aspects of cyber. Um, I then moved to the defense Academy where I now lecture our military staff thinking about integrating cyber into military operations and the relationship between intelligence, war fighting, cyber operations and so on. And I spent a bit of time.

Manoj Tandon (04:28.789)
Yep. Yeah.

Robert Black (04:52.226)
doing a couple of other projects, focusing on the National Cyber Deception Lab. I’ve just left that, but that was really interesting, getting challenging thinking around the use of deception and proactively using it in our defense of our networks. And I also work running the UK Cyber 912 Strategies Challenge, which is a great initiative launched by the Atlantic Council over in the US. But now around the world, I run the UK perspective on it, where we just focus on building the next generation of cybersecurity leaders who are competent not just in technology, but strategy and policy thinking as well.

They take a much more holistic approach to the challenges that we’re dealing with. And alongside that, I run a few events and activities for the UK Foreign Office, our State Department, thinking about cyber, cyber policy, cyber considerations in today’s age. And there’s a few other bits, but I’ll stop there, perhaps then.

Manoj Tandon (05:35.484)
There’s no way with that background you’re an imposter. But

Robert Black (05:39.014)
Well, I’m technically not a cyber person. That’s the challenge. And that’s one of the assumptions I really want to challenge because I do believe I’ve made a contribution, but I don’t fit the traditional mold. I don’t have a hoodie that I’m wearing today. And I don’t have the appropriate technical accreditation. So.

Manoj Tandon (05:54.443)
You know what, if a hoodie is what you want, we’ll send you one gratis. But here’s the thing, Rob. There’s a lot to unpack in what you said. And there’s a whole bunch of things come to mind. First, the approach you’re taking is really about strategy and integrated response to a…

Robert Black (05:58.715)
Alright, you know who’s my influence play together, hoodie? Ah, they’re busted already.

Manoj Tandon (06:23.319)
enemy to drive their mode of thinking. Now, in the world of cybersecurity, that’s a rarity because most of when you read all the rags out there, most of this is about tech. It’s always about tech. Whatever analyst you like, and I won’t mention them because everybody knows them, you read their rags and it’s always about, oh, the latest Zero Trust framework, the latest technologies in Zero

XDR, the latest DLP gadgets out there and blah, blah. But to really be effective, all this stuff has to work together and do something that drives behavior on the enemy’s part. And that’s always missing the conversation.

Robert Black (07:12.119)
It’s exactly the same as the defense space. We keep on talking about the effectiveness of the humor in cyber. The weakest link is our user because they click on the links. No, the weakest link is designing systems that don’t appreciate humans are integrated as part of the system. And it’s exactly true for offensive side as well. In this space, if I think of the definition of threat, if I use the military definitions, threat is capability by intent. Intent is what are their motivations? How are they gonna make those decisions? And why are they acting the way they are?

If we are only looking at capability, then we are missing half of the problem and half of the opportunity space. And for too long, I think we’ve been distracted by the shiny objects in cyber, the shiny technology solutions, and we’ve not thought about how does that technology get utilized effectively by us or by the adversary and that we need to shape their relationship with that technology. But ultimately, if I use a military term, effects-based thinking, we have to focus our campaigns about achieving an effect.

on the adversarial decision making, getting them to choose a different course of action than they otherwise would have done. There is no such better environment for that than the virtual man-made environment that we have created called cyberspace because we own the terrain.

Manoj Tandon (08:23.911)
very beautifully and succinctly said. And I hope people rewind that and replay that because there’s a lot of wisdom in that statement. And it’s, if you’re gonna build a proper cybersecurity program inside your organization, it’s paramount that you consider what Rob just said to him. This is for our listeners. Otherwise, you’re gonna end up with a lot of capability that has no real effect.

Robert Black (08:26.786)
Well, I tried.

Robert Black (08:52.467)
If you’re designing software, you think about the user experience of the client, the consumer. If you’re designing something, you’ll think about how they access it, engaging it. Why are we not doing that about our adversaries? What’s their user experience in our network? And then how can we mess with that so that it makes it more difficult for them?

Manoj Tandon (09:09.671)
Yeah, absolutely. Now, do you think in civilian space, given that I’m just gonna make a generalized statement, there’s always exceptions, but generally speaking, that line of thinking is not in place. Is that because of ignorance, or is it simply because people are too busy checking boxes and they’re really not interested in…

Robert Black (09:35.038)
I think the problem is that latter part, but I can understand why. So this isn’t a criticism. You have to take an assurance mindset. Otherwise you get hammered legally, fiscally, in front of your shareholders and so on. So actually the assurance mindset is how we tick that box here, how we tick that box over there. And then if we’ve gone through the list of ticking all the boxes, we might have a bit of R&D money to play and do other things. And that’s when you might consider deception. And actually that’s the conversations I regularly have with commercial organizations and some public sector organizations.

There’s lots of other things we’ve got to do first. It’s not our priority. Actually, I think we’ve got to turn the tables on this. We have to realize that cyber and tax through cyberspace are existential threats to our networks, our organizations, and our very existence. If we don’t see it like that, we have to think about defending it as if we’re dealing with an existential threat. That will flip the assurance model.

Manoj Tandon (10:28.093)
Yes, and is, I guess I’ll ask the question point blank, is the lock and key model that we’ve built for cyber of really any value in thwarting bad actors?

Robert Black (10:43.378)
Or I think it’s…

Robert Black (10:47.49)
Let me put it like this. I was just going to say something, I’ve changed my mind. I think the lock and key model only works if there’s repercussions, if a lock gets broken and people gain access to the material. What are the repercussions we can offer in cyberspace?

Manoj Tandon (10:51.542)
Go ahead!

Manoj Tandon (11:01.575)
None. And there’s a host of reasons for it.

Robert Black (11:02.69)
So, like before, a lock and key model is only half filled because there are no repercussions. If you know you access something you shouldn’t be accessing and a ton of bricks is gonna come down on you as a result, you’re not gonna access it. But the problem is we haven’t got an established balance where the repercussions are being felt. Now, I am in no way advocating hack back, but I’m just challenging the model that you suggested. So if that is lock and key model we’re adopting, what are the repercussions for violating the rules of that game? There are no repercussions.

Manoj Tandon (11:31.551)
See, the interesting thing is that, again, this is just in my personal humble, uneducated opinion, is that, you know, we build a defensive architecture, whether it be in the military or in cyberspace, to keep an enemy out. But the grounds in which we’re playing, the enemy is already infiltrated.

Robert Black (11:57.222)
Well, a little bit broader than that, I think. I think our understanding of our territory is we build the walls and stop them coming in. But chances are they’re already there anyway. Or there’s not much we can do if they’re inside. And if you think of castle designs from the medieval period or the Japanese castles, it’s layered security throughout. And it’s layered security to make it difficult for the adversary to traverse through the castle. So what is the same in cyberspace?

Manoj Tandon (12:05.961)
Right.

Robert Black (12:25.858)
thinking about ways we can manipulate the attacker’s experience as they are progressing towards our networks and inside our networks. And if we don’t have anything there, so once they know they’re inside our networks, they know they’ve got the amber nectar, they’ve got the gold, they can do whatever they want and they can relax, then we’re not even making them work hard up here. Why can’t we put things in to poison it in certain ways so they have to double check everything, they have to guess everything, they have to put more effort in to make sure what they’ve got is real. We’ve seen some great examples in the…

in the 80s with the FBI polluting some of the data that the Soviets stole, leading to an explosion that could be seen from space in an oil pipeline in the Soviet Republic. All because the Soviets gained access to our networks, started stealing the data, but they had no way of validating and verifying the data. So they just presumed it was real and legitimate. But when they started using it and things started going wrong, all of a sudden they had to cast doubt on every single piece of data they stole. Not just one piece.

Manoj Tandon (13:02.539)
Really?

Robert Black (13:23.126)
the entire operation because they didn’t know when the FBI started poisoning it. So at that point it undermines everything and they have to put a huge amount of effort in. And it led to an explosion that could be seen from space when they got it wrong with their pipeline. So why isn’t that standard in our networks? Why are we not putting layers in that would get the attackers to question everything? And there’s some great research by the NSA. How about this for a technical solution? I’ve already challenged the need as you have done as well that we’re too technology centrist.

The NSA have done some brilliant research looking at two pen testing groups. They told one group of pen testers that deception was being deployed on the network. And they told another group of pen testers absolutely nothing. And they told them they had to get onto the network and gain access. Guess what the results were? Those who knew nothing about the network progressed through the network entirely normally. Those who were told that deception was being deployed on network progressed more slowly through the network because they had to question everything.

Manoj Tandon (14:04.969)
Okay?

Robert Black (14:19.95)
That vulnerability over there that looks remarkably vulnerable and really open suddenly becomes, oh, is that really a vulnerability or is that the plant? Is that what we should be going after or should we be conscious of that? That principle over there, that looks a bit smelly, that looks a bit suspicious. Perhaps that’s the plant. Why aren’t we gaining access to this node over here? We should be able to do that. Why is this a lot harder than that? I’m questioning my own tools. So those who knew about deception, nothing more than that, just knowing that deception was being deployed,

question their own progress, question their own abilities, much more than the people who didn’t know. So a technical solution out there for all of your organizations is go and put a press release out saying you’re thinking about and have just acquired some deception technology. Don’t necessarily need to say who, just say you are deploying deception as part of your network. Because at that point, every red team or every bad guy who has started attacking your network and is researching your network will see that there’s some information out there to say you might be using deception. And at that point…

they have to double guess every step they take. And they have to question that every single time they make a step. And every piece of data they steal, they have to think about is this real or is it not? And automatically you’ve had a significant impact. And what have you done? Technical solution, you’ve got your comms team to release a press release.

Manoj Tandon (15:36.991)
That’s brilliant. I’ve always said, you know, take some old computers and load them up in a Cyrillic operating system, put Cyrillic keyboards on them, put them on the front line, make them easily accessible, because anybody coming through is going to be like, well, am I in Russia?

Robert Black (15:39.359)
Sit back.

Robert Black (15:57.198)
But we own the environment. We can tell them the sky is green rather than blue if we want. So why are we not making them question everything?

Manoj Tandon (16:05.715)
Well, this gets to legality, right? So, okay, so there is a, oftentimes my colleagues in the industry were often hampered by this thing called the law that you can only do so much in terms of offensive actions. Now, so one place to start off is if we’re on a war footing in cyberspace anyways, who cares about legality? Everything’s fair in love and war.

Robert Black (16:08.54)
Does it.

Manoj Tandon (16:35.151)
And what are your thoughts on that? Or what are your advice to, since you’ve been in the Ministry of Defense, what’s your advice to the governments of this world?

Robert Black (16:44.654)
So I think first of all, what I’m advocating is nothing illegal, and I really do believe that. So I think we have to fundamentally ask ourselves some really challenging questions here. Most of the conversations about the role of cyber in international relations will come down to whether or not it classes as an act of war. Can you retaliate in cyberspace against a physical action, or could you use physical violence in response to a cyber attack? And there are some big strategic discussions going on about that. If there’s the role of a NATO,

member state getting attacked in cyberspace, Estonia for example, or example of Estonia in 2007, could they claim that it was a Russian attack and therefore the rest of NATO’s partners had to respond under Article 5. You know, there’s some fascinating strategic discussions here and that fundamentally comes down to one thing. What does violence look like in cyberspace? What does damage and harm look like in cyberspace? And there’s some really necessary discussions that we need to have there because most of our approach to legalities in cyber.

Manoj Tandon (17:33.451)
Okay.

Robert Black (17:41.674)
is either taking a property-based approach, you’ve damaged my property, so we’re doing it that way, or they’ve taken a privacy-based approach, you’ve invaded my privacy and you’ve stolen that data. And then at the strategic level between nation states, we’re talking about violence and acts of war. So what we’ve got to realize is that the virtual artifacts, data, data moving through networks, wherever they might be positioned in the world, and there’s a physicality aspect to that as well, do not neatly fit into the traditional legal regimes that we’re used to in today’s world.

So it’s a headache for everyone. But what that means is, it’s easy to default to a risk averse mindset that by default, everything becomes illegal. Now, I am not advocating for hack back, I’m not advocating for doing anything offensive that is illegal, but I think there’s a worthwhile conversation to be had about where does that scope of what we can do to be proactive in a space and manipulate the adversary’s understanding of what’s going on without doing anything that would get to the point of raising legal concern.

Manoj Tandon (18:41.243)
Well, there’s a lot to unpack in that statement itself. It’s, if you look at what, our deterrence is primarily based on a kinetic response. People don’t wanna attack the United States or a NATO nation because of what can possibly happen from a kinetic side. Would.

Why wouldn’t that hold true on the cyber side? So if someone attacks a country, a NATO, let’s just pick on NATO for a second, a NATO nation state and kills their power, now all of a sudden people on dialysis are dead, people who need critical surgeries are dead because they can’t get them. There’s a lot of critical infrastructure that maintains and supports life. All those people will be…

could be affected in a very adverse way. Why would that not necessitate a kinetic response?

Robert Black (19:42.678)
You know what, I think it probably could be argued that, but then I would next come up with the WannaCry attack. So the WannaCry took out a lot of the British National Health Service. It attacked critical national infrastructure, our health service, it locked the computers, it meant surgery couldn’t be conducted. I’m not convinced that that’s a legitimate enough attack. There wasn’t the intent to do it that would justify a legally justified kinetic response. So I do think we get distracted by the strategic level discussion about responding with force.

And I think that comes about because of us relying on a deterrence model that is based on a Cold War version of deterrence, which is the nuclear deterrence, deterrence by punishment. The idea that I’ve got a big shiny nuclear missile that is sitting there waiting to be fired if you do something that caused me harm. And at any point I can launch that and we’ll have mutually assured destruction. So none of us would be worthwhile taking that step. And I think that has been a…

a mindset that has been applied to cyber security policy and cyber strategy in governments around the world for the last 10, 15 years. But I think more recently, we’ve seen some significant changes to that. And I draw your attention to the US strategy. The defend forward strategy is very much based on the concept of persistent engagement. Brilliant academics Richard Harknett and Fissa Keller have talked about persistent engagement with Emily Goldman. And they talk about the fact that the internet isn’t created like the globe.

Manoj Tandon (20:49.739)
Okay?

Robert Black (21:06.742)
where you’ve got two nations divided by a massive ocean, standing apart, firing missiles at each other. But actually the internet is much more interwoven and we’re constantly rubbing up against each other and connecting and engaging. And we have to think about deterrence in a different way. We have to think about engagement in a different way because we can’t stand apart. And at that point, deterrence by denial, deterrence by punishment doesn’t necessarily fit in the traditional models. And we’re in a new age of contest and confrontation in cyberspace and that opens up.

whole new set of thinking. I don’t think there’s a huge amount of deterrence by punishment that works in cyberspace. I’ll be honest with you, going to kinetic response doesn’t really seem to be something that I can see many of our cyber attackers as criminal groups and what have you are gonna have to worry about. But I think what’s really interesting is we can make them concerned about their effectiveness, concerned about their ability to perform, their ability to deliver what they need to do. And we can make them doubt that.

or make it much more harder for them to get the gold out of our networks that they think is this worth the squeeze? And if we can get them into that space, they’re going to be deterred from chasing after our networks in exactly the same way as a burglar might get deterred from our homes and attacking our house. And I think changing that model is much more effective.

Manoj Tandon (22:23.521)
But why not maybe put a little fear in them that their lives could be impacted a little bit here? I know you’re not for hack back, but…

Robert Black (22:30.334)
I’m saying I’m not saying I think we should be putting food I want to use one of the examples I want to use remember Liam Neeson in that film Taken where he’s on the phone saying I don’t know who you are but when I find you I’m gonna come after I’m getting you why are we not doing that in our networks we spend a long time observing and watching our attackers inside our networks the medium dwell times probably still about 80 days we do a lot of open source investigation on them and there are some good examples where the attackers have still been inside our networks

Manoj Tandon (22:39.185)
Yes.

Robert Black (22:58.678)
when we’ve identified them wearing hats in China. And I’ll think about the CrowdStrike report, or I can go back to Manjian APT-1, where we were watching and observing the attackers and doing our due diligence on them and finding out who they were. And if I think of most of you are kind of threat hunters, you’re chasing the threat, but you’re also doing open source research on them to identify who they are. So why not mess with their heads? They’re inside our networks running around, put a nice shiny token in our network, oh, that looks interesting, and they open that token up. And you know what?

Wouldn’t it be good if it showed them a photo of inside their office? Or if it showed them an ability that we knew who they were exactly the same way as Liam Neeson did in that film. And wouldn’t it be really interesting if we made it so they had to question whether they wanted to carry on doing what they were doing or think about protecting themselves. It’s exactly what happened to the U S military, the Syrian electronic army in the mid 2010s hacked into Ascentcom’s Twitter account. So not into Ascentcom files.

Manoj Tandon (23:52.523)
Okay.

Oh.

Robert Black (23:56.674)
They hacked into CENTCOM’s Twitter account and posted a spreadsheet of serving US military personnel in the Middle East with their home addresses, social security numbers and so on. And they said, Americans, we’re coming after you. Now you tell me if you’re a serving member of the US forces in the Middle East and your home address has been put up online, are you going to be focused on your day to day task in the Middle East or are you going to be making sure that your family is protected, whether they move into hiding? There was a good example, the shadow brokers.

stole some great capabilities from the CIA or the NSA, I can’t remember who, and then, yeah, and put them online. And then they called out a current cybersecurity expert and said, we know you’re involved in this when you’re inside. And you know what? He suddenly became scared to travel to different places because he didn’t know who the Chagno brokers were. And all of a sudden, he didn’t want to be in a country that might have extradition treaties with whoever it might be. So he started questioning his own freedom of mover.

Manoj Tandon (24:30.579)
Yeah, Zana say I think.

Robert Black (24:54.45)
I would be doing exactly the same. I’m not criticizing him, but that’s putting the fear into him. So what are we doing in terms of our adversaries and that? We’re putting legal notices out through the FBI, most wanted on these people, and that’s making them think, oh, I can’t travel here, I can’t travel there. So what are we doing inside our networks as private organizations, not as nation states? What are we doing inside our networks to make them think we know who they are? And even better than that, if you’re worried about the legalities of the fact that we might have their personal data, and there’s probably personal data issues here.

which just shows the irony of the whole situation. If you’re worried about that, why don’t we become fortune tellers? Why don’t we become the crazy old lady who sits at the end of the pier and tells you that she can contact your dead relative? And I’m sure there are some litigant people who can do that, but she can talk to me as if she’s in touch with my dead relative, and I can believe that, through a series of linguistic skills and concepts and that. Actually, so why can’t we use that kind of cold reading technique and put that in our document so we don’t actually know anything about the bad guys?

Manoj Tandon (25:24.021)
Yeah.

Robert Black (25:50.082)
but they’re already nervous, they’re already panicking because they’re inside our network and they know we’re going to come after them because we said we are. And we put this information there to make it look like we know who they are. So they have to second guess everything. And I bet you that will still have an effect even if we don’t know anything about them.

Manoj Tandon (26:05.519)
Oh, I’m certain it would, but it’d be even better if we could actually tell them, hey, you know what? By the way, this is what’s going on. This is where you live. It’s a nice neighborhood. I really like it. I might be coming for a walk Sunday afternoon. Whether I’m…

Robert Black (26:22.61)
I agree, but that’s what I mean. I don’t think there’s different scales there in terms of how risk averse you are. Your lawyers might be nervous about you publishing private details of your personal data of your attackers. Well, okay, so be it. Are we really that protective over it? But if you’re not, then let’s use the cold reading technique. But whatever we are doing, let’s mess with their heads. Let them do the heavy lifting. And at the moment, we’re not doing enough there. I think there’s so many cool things we could be doing. Think of Hollywood films. Everyone watches a Hollywood film. I’m conscious we’re recording this.

where we’ve got Barbie just released at the weekend and I’m queuing up to go and watch my Barbie film soon. Everyone has watched a Hollywood film. Everyone has felt sad, has felt excited, has felt scared, has hidden behind the sofa, and it’s a two-dimensional film. If we can use the Hollywood skills, the set designs, the movie experience that you can use in Hollywood inside our networks to give the attacker a user experience

Manoj Tandon (26:56.999)
My kids just went inside.

Robert Black (27:21.378)
that makes them sad, gets them upset, gets them scared, gets them questioning their life choices in exactly the same way everyone does when they watch a Hollywood film, wouldn’t that give us a much better level of engagement with our attackers? And you know what? I think that would be a much more exciting space for our operators to be working in, our cyber analysts to be working in, because they’re not just doing the handle turning with the alerts and trying to catch that alert over there. That’s not very exciting. Let’s empower them to be cyber ninjas. Let’s empower them with all the tools they can to face our attackers.

Manoj Tandon (27:32.785)
It would.

Robert Black (27:50.634)
and engage them and that would be a much more appealing project for them.

Manoj Tandon (27:54.195)
Wouldn’t that take a little bit of pressure off the sock teams as well? It would make it a lot more interesting, I would think.

Robert Black (28:00.122)
I think it would sex it up for them. I think they’d be loving it. At the moment, the sock team has to, let’s be crude about this. You make a decision about a job in the sock role based on how much money you’re gonna get, and you realize you’re gonna get flogged for a few months. If an incident comes in, you’re gonna get flogged even harder, you might get a free bit of ice cream because you’re doing 24 hour shifts. But you know what, most of your friends are working remotely, so are you, you’re doing what you need to do. And in a few months time, when you’re a bit burnt out, one of your other friends from another organization says, come and work for us, it’s better pay, it’s better rates.

Yeah, you do the same job for more money and then you go, okay then I’ve done my time here and I move on Now we got to talk about investing in our staff. We talk about diversity of thinking we talk about that But let’s give them the skills to fight. I put a post up the other week or a few what months ago How do we how do we have the end of that? How do we make our sock operators the end of level bad guys in computer games? So if you think about computer games, there’s a bad guy Mario takes on Wario and fights him to get to the next level What you know?

Manoj Tandon (28:54.662)
Yeah.

Robert Black (28:57.43)
Defense in depth, layered security, who are our end of level bad guys? What are we doing to make the attackers rage quit from our networks? Because it works in a computer game, and you see people throwing their laptops out the window or keyboards into monitors because they’re so frustrated with this evil bad guy at the end of the level. Why aren’t we doing that? Why aren’t we empowering our operators to have the tools and the techniques, to throw deceptive devices over there, to throw tools over there?

How can we get them to manipulate the experience of the attacker so they don’t know what they’re doing? We could have so much fun, that would be so engaging. It would reduce burnout and stress, I’m pretty sure, because these guys would be enjoying the fight. And I’m using that word carefully, but I mean it.

Manoj Tandon (29:39.823)
Yeah, you know, but we get thwarted by the attorneys who often tell us, look, we don’t know how much of this is going to, is legal and how much of this can, will the government support it? And if you look at all the governmental policies, they’re based on some antiquated concepts. They’re not based on what’s happening in cybersecurity.

Robert Black (30:00.814)
But I think this is when we have to be really specific in our language. We have to take away language such as deception, and we have to talk about what we’re actually doing. And at that point, oh, I’m gonna deploy a Microsoft Word document in our network that might use some language that doesn’t say anything about our attacker, but might imply the attacker might know, we might know who the attacker is. And the lawyer will go, sorry, let me get this right, you’re just deploying a Word document. Yeah. You’re deploying it outside of your network in the attacker’s own network? Nope.

We are just putting it in your network. Yep. And who’s gonna have access to it? Whoever should not be allowed to have access to it, it should be a hidden area, okay? So it’s not gonna get access by anyone else, unadvertis, probably not, okay? So we’re just going back to the fact we’re just talking about deploying a Word document. Yeah. What’s the legality there? What’s the legal issue there? There is a one.

Manoj Tandon (30:49.867)
They’re going to come back and say, well, how do you know who this hacker is? Do you have their IP address? Did you reveal it? Did you?

Robert Black (30:53.474)
Well, exactly. So we don’t even need to do that. We can just make them nervous that we know who they are. So let’s use the cold reading techniques. Let’s take that legal issue away for the time being, get them comfortable with that, and then bring it in and go, okay, now we’ve done some research on them. We are confident it’s them, it’s here. They’re attacking our network. Do we really want to have this issue? And you know what? At that point, most of the conversation comes around attribution and the geopolitical aspects of attribution. We’ll get…

Manoj Tandon (31:03.976)
Oh.

Robert Black (31:23.134)
internet security companies who will give them, and slightly cynical apologies, they will give them a character name and do a cartoon of them. I’ve never known another area of warfare where we characterize our enemy apart from when we’re doing parody and propaganda. But you know what? I can list a series of animals with the barest degrees of weird characteristics and that’s all of our bad guys because the internet securities do not want to be part of the geopolitical attribution problem and I get that.

but at the same time, let’s move it into another operational warfare. Let’s take operations in Ukraine at the moment, and it’s probably a central topic, yeah? But if you are an Ukrainian defender, operating an operating, or based on an operating best, close to the Russian lines, and you’re standing there and a car approaches you, you tell the car to stop, you might put roadblocks in the way, and you can think of this in Iraq or Afghanistan, wherever, any conflict zone.

Manoj Tandon (32:00.459)
Okay.

Robert Black (32:21.43)
and the car carries on, it starts accelerating through the roadblocks, what’s your first response? It’s probably to shoot to kill. You’re not asking, oh, I wonder if it’s Russian, I wonder if it’s Chinese, I wonder if it’s Iranian, I wonder if it’s Vietnamese. You’re taking the necessary defensive measures to protect your operating post, and then you’re doing the investigation. And at the moment in cyberspace, we get distracted by a very important geopolitical concern of attribution, but actually for the organization, the measure should be

Manoj Tandon (32:29.255)
Yeah. Make it stop.

Robert Black (32:51.338)
What do we need to do to stop this threat from crossing into our networks? And it doesn’t mean that we need to shoot to kill in cyber, but the same philosophy should apply. What measures are we doing without necessarily holding ourselves to account to the attribution concerns that the FBI or the National Cyber Security Centre in the UK might have? What measures do we need to stop this attacker getting in? And I don’t think we see it like that, and we need to see it more like that.

Manoj Tandon (33:14.604)
Have you seen public officials be open to the concepts that you’re talking about?

Robert Black (33:21.03)
So I think it’s really interesting. I’m not going to allude to any specific organization or Or investment or project but I’ve already mentioned one There are other organizations both sides of the Atlantic that are investigating the use of deception. I can put it as bluntly as that And you know what? I think it’s really interesting I’m arguing for deception for the proactive use of deception cyber defense to change the behavior of the adversaries If you look at most of the deception tech market

and I’ve used that word tech deliberately, the deception tech market is on focusing on using deception to remain covert to monitor our attackers or send an alert to our attackers. And some of those tools are brilliant. And I think of Think Canary, for example, Think’s great product, put it in your network, get an alert, find out where they are. Fantastically simple. I do not know why as many organizations as possible are not scattering them around their networks to get this kind of tailored feedback system as where people might be and shouldn’t be.

That is a very specific use of deception for Intel gathering to understand where they are when they might be moving around the network. Very effective, brilliant. But that is one-tenth of the potential for deception tech in shaping the behavioral adversaries. Rather than step on a landmine or step on a pressure pad that sends the alert to me via email, why don’t we do something that gives them the equivalent of the landmine effect in warfare? What does that look like in cyberspace? How do we get them to tread on something and the alert goes up, we know you’re here?

We don’t need to tell them anything about them. We know you’re here and you’re not supposed to be here. At that point, they start making different decisions. It’s very similar to a burger alarm on a house. The burger alarm on a house has two purposes. One, to deter the person from going into that house in the first place, and two, for when that person goes inside the house, they’re now questioning, has the alarm gone off? Is it a silent alarm? Is someone coming to get me? So on average, they spend less time inside the house than a house that doesn’t have a burger alarm because they’re scared. What are we doing on our networks?

Manoj Tandon (35:01.641)
Right.

Robert Black (35:17.422)
to do exactly that. It doesn’t have to be that technical, it doesn’t have to be super clever, it just has to be focused on their thinking and their decision making at every stage of the journey.

Manoj Tandon (35:27.427)
You know, that’s something that’s not written about much is what is the psychology of the adversary? What’s going on in their mind?

Robert Black (35:35.746)
Sure. And I think, again, comes back to definition of threat, capability and intent. I’ve mentioned this to some psychologists. In the past, warfare has been very much about kinetic operations, fighting the fight, you know, one tank fighting the other one, one tank falls over and then we have a winner. As we move into this effects-based world, this idea of shaping behavior, this has to be a holistic team fight. This has to be teams of different backgrounds. It means psychologists, anthropologists, social scientists, as well as technologists.

have to come together and think about how we’re gonna engage this attacker and how we’re gonna engage and have this fight. This fight and cyberspace, the thing I find brilliant about cyberspace is that it rewrites every single rule that we are used to in society. It rewrites rules of geography. I can now reach out to people in China and talk to them without having to worry about my geographical footprint. It rewrites the rules of physics quite literally. It rewrites the rules of psychology.

Every psychological experiment you can think of is about human to human interaction. If you think of the Chaudhini’s principles of influence, weapons of influence, I wear a high vis jacket and I walk through the door, someone holds the door open for me because I look like I’ve got authority and then they let me in. I’m now in a virtual domain. What does that look like? What do the principles of authority look like in the virtual domain? How do they play out? What are we seeing here? What do the concepts of conformity look like? Trust.

Me and you having this conversation, we are going through a computer to have this conversation. Computer mediated communication, the traditional research of cyber security, computer sciences back in the day before we had everything was called computer mediated communication. We have to think about that relationship with tech. This is human augmented interaction. Technology enables us to revisit everything. I’ve been having conversations with a team of digital forensics who do a lot of work supporting peace investigations.

Manoj Tandon (37:07.487)
Yes.

Robert Black (37:32.358)
I really want to set up a crime scene room where we have everything digital and smart technology and I want to put someone in that room and I want to see how easy it is for us to use the smart technology wrongly so we convince them the time is different. Because if I’m using digital devices to tell the time and I’ve got a smart watch over here or smart watch over here, I’ve got my computer telling me the time, I’ve got another Alexa telling me the time.

Can I manipulate that so all of those sensors tell me the wrong time? And do I need to do that so all of the sensors tell me the wrong time consistently in order for me to go, oh, hang on, it feels like two o’clock, but everything else says it’s three o’clock. Perhaps I’ve just been thinking about work too much and I’ve not noticed another hour. Well, what happens if one clock says one time and another clock says another time and another clock says it’s her time? What clock do I have confidence in then? How does that shape my decision making? How does that make me question the existence I’m in?

There is so much we can do rewriting all of our theories of psychology, all aspects of science because of this virtual manmade environment. It’s really exciting. And that’s before we even talk about artificial intelligence, virtual reality, integrated reality. There’s so much potential here to really manipulate the person’s, the user’s experience.

Manoj Tandon (38:48.587)
You know what, Rob, some of this, what you just talked about, the time signals, is a brilliant example because it’s akin to, if you go to the aircraft industry and you look at all the human factors work that’s been done in air crash investigations and outcomes, where false instrumentation readings were the genuine root cause of the accident, where the pilot was getting the wrong data.

You get to see what behaviors human beings and decisions they make when they’re completely thrown off their balance. All right.

Robert Black (39:21.764)
And why not use that to your advantage?

Manoj Tandon (39:24.087)
we can actually use that to our advantage. I had not thought of it in that way until you just mentioned this, but it.

Robert Black (39:29.306)
Look at Stuxnet, the original weapon of cyber. Did exactly that, relayed the wrong information in the control panel to the scientists. So they thought the centrifuges were spinning at the correct speed because the panel said so. And meanwhile, the virus was spinning them at their incorrect speed, faster and slower and breaking them. But to the panel, to the scientists, why would they not trust what the panel was saying? Because the computer never lies. The computer’s always right. So there’s something else that must be going on.

So that’s exactly that example. You know, look at the air traffic controllers, or look at the airport security. And this goes back to the defensive side. You know, you scan your bags at airport security, the poor person having to watch the monitor is looking for a bomb or whatever the image of a bomb might looks like. They get regularly inserted dummy images to see if they’re alert. There’s no penalty for them if they miss it, but it gives them alert that they’re not paying attention and they’ll be swapped out and have a break or someone else will come and take over.

Manoj Tandon (39:55.431)
Yeah.

Robert Black (40:23.426)
What’s the equivalent in missing an alert in cyberspace? The SOC operator. We’ve got air traffic controllers who are monitoring screens with large amount of flight data and they have techniques and devices to allow them to monitor how effective their eyes are looking at the screen and whether they’re looking at the most congested space properly or whether they need a break. What is the equivalent of bringing that through in cyberspace to help our defenders defend more effectively and at the same time using it offensively to disrupt the attackers experience of our networks?

Because if we can use it to defend ourselves better and improve the effectiveness of our teams there, we can also degrade the effectiveness of the opposition. And we’re not thinking like that at all.

Manoj Tandon (41:00.975)
No, and I have a feeling there’s a ginormous, if that’s a word, room for improvement that’s probably there when you frame the conversation and the terms you’ve just put in. Because I think a lot of the data doesn’t even exist. You know?

Robert Black (41:15.922)
And that’s why I’m genuinely not worried about the legality concern because if we are having those legal discussions It means we’ve got the benefit of this and we’re being more comfortable pushing ourselves to the limit of what we can do But there’s so much more we can do before that before we get even into that dicey area of is this legal or not?

Manoj Tandon (41:32.947)
So, you know, one question that’ll come up and this gets back to the airline model is who’s really responsible for cybersecurity? You know, the airlines kind of threw up their hands and said, look, we can’t really, in the U.S. it used to be pre-9-11, it was all private contractors that did the work. And the federal government took it over post-9-11. So we’ve heard it said.

Robert Black (41:56.619)
I think we need to ask ourselves some really fundamentally challenging philosophical questions, not psychological philosophical questions, another community of people who can bring valuable contribution to the cyber fight that we don’t often think about. What is our theory of government here? What is the relationship between the individual member of the population and the government? What is their expectation with regards to security and cyberspace? Because I tell you what, in the physical world,

We have some expectations. We have the expectations that we pay our taxes and the government will protect us, enable us to do business, and secure us from foreign and hostile threats. In cyberspace, how does that work? And actually, it’s more complicated than just worrying about the individual because we’ve got multinational organizations who straddle different nations. So do I, as a government, am I responsible for a multinational organization? Well, what happens when the multinational organization is more powerful or more effective than government, but we won’t even go there for the moment.

Let’s just look at the relationship between the government and the individual. So here I am in cyberspace, operating away, working in my business and so on. Now I don’t know quite how it is in the U S but I’m pretty sure it’s the same as the UK. You might get a tip up that there’s a hostile threat actor coming towards you. Let’s just pick one. There’s a hostile Russian state threat actor coming towards you in cyberspace. In any other domain, what would happen in the terrorist world, in the warfare world, what would happen?

Manoj Tandon (42:50.385)
Yeah.

Manoj Tandon (43:11.627)
Okay.

Robert Black (43:18.55)
you would have police deployed on the streets with machine guns, and you would have tanks parked at the airport just in case there’s a threat. We’ve seen evidence of that in the UK with terrorist threats. We’ve talked about 9-11 and the measures put in place to deal with hostile takeovers of a plane. So we know that the government felt responsibility to protecting that space. And by no means am I with this argument suggesting our government is failing us at an individual level from individual representatives. They’re all working really hard. But I think there’s some fundamental questions of what is the level of protection we should be expecting?

Manoj Tandon (43:22.004)
Yeah.

Robert Black (43:48.202)
and who should be doing it? Is it the National Cyber Security Center? No, I think they’re the technical authority in this space. They might share tippers and pass information around, and they might help us with our threat investigations. Is it the military, the Ministry of Defense? Well, you know what? They’re kind of responsible for physical and kinetic warfare. I’m not sure their best place to do cyber warfare in protecting us here. What is it? Law enforcement. And yeah, we’ve seen measures, if we think about the FBI and the…

Hafnian attack, they’ve taken measures to protect organizations. Interesting step for them to do that. But is that their role? What should their role be? Are they designed to do that? What is our expectations of government to protect us? In the UK I actually feel sorry for the private sector. The reason is you get attacked by hostile state actor in any other domain it would be you’d be protected by government. In this space you’d probably get a tipper from government to say watch out they’re coming. Oh and by the way

Can you share their TTPs when you’ve done your investigation so we can let everyone else know and let your competitors know that this is what the threat looks like so they can build their walls up and stop them coming in? Well, you’ve lost out your competitive advantage there. You really sure you want to do that? And I do agree the whole model of information sharing that everyone, you’re rising tide and all that, but you shared the information about your attackers. You’ve suffered corporately. You’ve suffered with your share prices. Oh, and actually you’ve also had a breach, which means your data has been stolen, which means there’s a huge GDPR issue in the UK.

Manoj Tandon (44:56.405)
Yeah.

Robert Black (45:10.21)
which means you’re probably gonna get punished by the rest of the government and get a huge fine. So you’ve been caught with your trousers down, quite literally, the bad guys have come and got you, and then the UK have gone, oh yeah, tipper, here they come, oh, by the way, can we share the data? And also, you’re gonna get fined for it as well. You should have done better. It doesn’t feel like a constructive model, and by no ways am I criticizing the kind of collective approach of any part of that system in dealing with the cyber threat.

but I don’t think we’ve got the model right for the theory of government and the relationship between state and population.

Manoj Tandon (45:41.686)
And what you just said explains, I mean, there was a major contractor that had a breach in the UK recently, right? They didn’t report it.

Robert Black (45:47.858)
Yeah, well, you know, I’m a relatively informed individual. I’m not technical, as I’ve said. But you know what? I have no idea where my data is and who has my data. And I don’t know how many times my data has been compromised. So realistically, why should I bother? And that is completely the wrong attitude that we have in cybersecurity at the moment. It should not be at the point where I’ve been compromised so many times because supply chain attacks have happened in this organization, in that organization.

Recently, I’ve been having emails, oh, by the way, your data’s been breached by this supply chain attack. Here, have 12 months free identity protection on the internet. Three weeks later, oh, it’s been breached somewhere else. Here, have 12 months free identity protection. Well, that’s great, but I have no way of legitimately knowing where my data is being held by these organizations and where it’s being compromised. So, what point does my data become meaningless? And actually, what should I be worrying about now? I should be worrying about people exploiting that data and that information.

making attacks on me, social engineering and so on. We are not protecting ourselves in the way that we need to. I’m not saying it’s easy, I’m not saying that there’s a solution out there that is instant, but I think we really have to challenge our assumptions here and our philosophy.

Manoj Tandon (46:59.499)
I couldn’t agree with you more. There’s some foundational things that have to change, that have to be done for us to become much more effective as a deterrence and defensive mechanism in cyberspace.

Robert Black (47:16.21)
And I think it’s, I’m going to say, I think that’s a philosophical approach and a theoretical consideration of how does this work. This is why I really like the persistent engagement model because it gets us to think about the internet differently and operating an internet compared to the Cold War age of stalemate, a detente situation where we’re not actually fighting with each other because we stand apart and we don’t want mutually assured destruction. We’re not in that space anymore. We need to think about what this space looks like.

And this means we’re persistently rubbing up against each other in cyberspace, interacting, engaging, interfacing. We’re in a globalized age. We cannot disconnect.

Manoj Tandon (47:52.891)
No, we can’t. And we have foundationally traded, you know, convenience for security. That’s, and that’s not gonna change. That genie’s out of the bottle.

Robert Black (48:03.694)
And it’s appreciating that benefit and recognizing how we can take measures against that. Another example, and I’ll go back to defensive space. I have a password manager, but I have a couple of laptops because I work for different organizations. One of the organizations doesn’t allow me to have a password manager on their laptop, which is fair enough, but they won’t need me to have an updated password, and then I have to use a VPN when I’m on that laptop. So I have to type my password in three times to make it secure and access everything. But you know what? I can’t use my password manager.

I can’t use it three times. So you know, the first time it gave me the chance to update my password, I used a complicated 15 character password with all the bells and whistles on. Second time, I was a little bit frustrated. Third time, I was like, just give me the easiest password I can remember, because every time I have to type it in three times just to get onto the VPN. That is not good data security and computer security at all. And it’s because we’re not taking a holistic approach to this. We’re not thinking about the user experience again. We’re not exploiting that for offense, and we’re not thinking about it for our defense as well.

Manoj Tandon (49:02.995)
that you’re spot on. Getting people past that assurance mindset is the challenge that we’ve seen to actually tackle the problem you just described. It’s very, very difficult to cross the chasm. They’re like, look, I got PCI compliance, I got HIPAA, I got high trust issues. I’m checking these box, the auditors say I’m great.

And privately, I’ve even had some CISOs say, look, the longevity of a CISO in an organization is two to three years. Why do you think that is? And…

Robert Black (49:42.326)
Yeah, don’t want to be on the receiving end of pain.

Manoj Tandon (49:45.935)
Yeah, you know, shit’s gonna hit the fan. There’s gonna be a fall guy. That fall guy is me, or fall gal, whatever the case may be.

Robert Black (49:53.934)
and that’s why they get paid really well. Let’s be honest about it, you know you’re riding that wave for as long as you can, taking the paycheck, and you’re hoping you’re not gonna get hit.

Manoj Tandon (50:00.807)
That’s, yeah, but that’s not how you build a great security. That’s not how you build a great defensive architecture and deceptive architecture and actually affect security with a positive change.

Robert Black (50:12.158)
I think there are positive communities out there. I think that the insurance industry is gonna lead the way here, I really do. So in the same way that with car insurance, house insurance, the questions are, are you taking these measures? Have you put these measures in place? I think we’re gonna see that with aggressive defense, or sorry, proactive defense measures. So they’re gonna be asking us.

Manoj Tandon (50:28.095)
But do you think, how will that be different than PCI compliance or GDPR or?

Robert Black (50:33.902)
Because I think we’re going to get literally burnout and boredom from it. And I mean that honestly, we are losing this war. The war on the drugs has nothing compared to this war. Look at the number of attacks that are going on every day now. We are fighting a fight that we are horrendously losing. As an individual, I can’t remember how many times my data has been compromised by networks nothing to do with me. So how is this a secure space to operate? We need to be in a space where we need to be in that competitive environment and the competitive advantage we can gain.

by using these techniques means that we outrun the competitor against us. It’s the old adage of, you know, I only need to run faster than my colleague to make sure the lion doesn’t chase me and chases him instead. That’s where we are. We’re in that dog eat dog world. We have to think about it like that. And I think that along with measures to recognize that there’s so much more we can do to proactively engage, proactively fight where the insurance might be driving it. I think we’re seeing USDID.

introducing requirements for suppliers to use deception now as a way of protecting some of their supply chain, it’s going to be encouraged through that model which is a flip from the assurance model or at least it should be a flip from the assurance model unless we just don’t default to tick the box process. But this is where there’s some really exciting research and development that needs to be done. We’re not in a place where it’s mature. I’m not arguing it’s mature yet but this is where we need to be exploring and there’s some fascinating research being done around there that is just showing what could be possible here.

Manoj Tandon (51:59.563)
We’re gonna have to get you back for part two on this. There, you just, with the whole insurance model, you opened a can of worms and I’d love to talk about it. We’ve had several discussions on the show about it, but you’ve taken a very different approach and we’d love to get you back and have a in-depth conversation on that because that one might have legs because it’s money and money talks. Ha ha ha.

Robert Black (52:18.141)
I think like.

I’ve seen. And if we’re not seeing the existential threat of cyber attacks as money-driven discussions, then we’re out of the game. If we’re seeing it as technology-related discussions, we might as well give up now.

Manoj Tandon (52:32.535)
Yeah, I can’t agree with you more, but I do want to give you a minute or two here to plug anything you’d like to and let our audience know about.

Robert Black (52:41.866)
Well, thank you. I guess one of the things I’m passionate in, as you can probably hear, is deception. And I’m also passionate in bringing different perspectives to cyber security and the cyber world we’re operating. We need a holistic, whole-of-society approach to this. I would be remiss not to highlight the Cyber 912 Strategy Challenge. I believe it’s a fantastic initiative around the world. Check the Atlantic Council out. Particularly those who might be interested in supporting the UK initiative that we’re driving. Please do get in touch.

This is about encouraging students to have the experience, to bring through those complementary skills that are so desperately lacking in society with regards to cybersecurity, that it’s not just about the technological skills that are missing, it’s about those ability to make critical decisions, to critically analyze data, and make informed judgments, to brief effectively at the board level, to communicate about the concerns, communicate about the risks in such a way that better decisions can be made. So it’s a great initiative, it brings a diverse student body,

to fight in cyberspace and we’re seeing some great transitions from university students who had never even thought about cyber before to come and participate on this initiative where they play the role of advisors to government in a time of a cyber crisis. And then before you know it, we’re pairing them up with sponsors and government representatives and they’re finding themselves having fascinating careers, working with a sponsor, joining their graduate scheme, applying for future jobs, working in government. And it’s a really cool and interesting initiative. So.

I’m taking the opportunity to promote it if anyone is interested in it. I can put you in touch wherever you are in the world with a relevant scheme. And if you’re particularly in the UK, this is just me talking to UK folk, do get in touch because I need you guys to come along, meet the students, engage with the students, potentially even sponsor us or give us some prizes to give to students and we’d be delighted to have you involved. It’s a really great initiative. I’ve got a great team behind me and we’re only going from strength to strength over here. And I’d love to get more people involved and aware of this initiative around the world because I’m a massive Blue Runner.

Manoj Tandon (54:33.668)
And you know what? Send us a link, Rob, and we’ll put it in the show notes as well when we push this out to everybody.

Robert Black (54:38.39)
I certainly will do. Brilliant, and I very much appreciate the window to allow me to do that, so thank you very much.

Manoj Tandon (54:43.627)
Oh, thank you for being here. You’ve been fantastic. And I’m looking forward to part two here. There’s so much to unpack. You’re brilliant, Rob. And please continue to do the work that you’re doing.

Robert Black (54:51.96)
Sounds good.

Robert Black (54:56.106)
Well, I say I’m a massive imposter in cyber, so I can only apologize for being an imposter, but I’m having fun and I believe I’m adding value and that’s the key thing for me.

Manoj Tandon (55:05.119)
Thank you so much, Rob. Take care.

Robert Black (55:06.734)
I look forward to our next chat. Take care, bye.