Security Confidential S4 E9 Hans Vargas Silva

Manoj Tandon: Welcome everyone to another episode of Dark Rhino Security: Security Confidential. I’m your host, Manoj Tandon, and today we are honored to have Hans Vargas Silva join us. Hans is a graduate of Purdue University with a master’s in information security. He has a lot of experience in the field of cybersecurity. That’s actually an understatement. He has worked at organizations like Sallie Mae and Marathon Petroleum as a cybersecurity architect and is currently with Marathon in the cybersecurity GRC and IT compliance space. Hans is passionate about giving back to the community with volunteering, and we’re going to get a chance to hear his thoughts on that. Welcome to the show, Hans. Thank you for joining us on this Friday afternoon.

Hans Vargas Silva: Thank you for the invitation. I appreciate you being here.

Manoj Tandon: So, I guess, you know, a great place to start: you’re from Peru, and when we think of Peru, cybersecurity is not the first item that comes to mind. How did you get into cybersecurity? What was that journey? How did that go?

Hans Vargas Silva: Well, I must say that I’m very fortunate and very blessed in some ways to be where I am. It wouldn’t be in my wildest dreams. When you asked me, “What are you going to do in your life after high school?” I wouldn’t have said this. I knew I liked computers, and I was a lab brat for a while. You know, I didn’t own a computer; my parents couldn’t afford it for the longest time. And actually, even when I was in college, I didn’t own one until my last year of college. But I was in the lab, you know, volunteering my time to reformat computers anyway.

So yes, I’m from Peru, South America. I’m from the jungle side of Peru, and I went to school to do a systems engineering degree, a bachelor’s. Through a series of fortunate events, I met my wife in Peru when she was visiting and teaching in a local school, and that’s how we got married and moved to the US. Through a series of jobs in the US, many of which were not initially IT, I would find my way back to IT. And I found an opportunity to be awarded a Scholarship for Service through Purdue University. So through the service, I went to school for my master’s for two years, and I gave back time, two years working for the State of Indiana.

And that was a great experience. I was able to put a lot of the things I learned into practice. My two years were up, and I wasn’t necessarily in a rush to leave, but I got an offer to join financial services as a cybersecurity architect, which was a great opportunity. And again, almost a year in, I was offered to join Marathon—another great opportunity. And I’ve been here for the last almost four years. I started as a cybersecurity architect and moved into an opportunity in Governance, Risk, and Compliance, and that’s where I’ve been learning a lot during these last two years. So that’s my journey.

Manoj Tandon: That’s quite a story there. And I’m sure you’re giving us the abridged version. There are probably a lot of very interesting details in there that could make for certainly at least a couple of chapters in a book.

Hans Vargas Silva: Probably, yeah.

Manoj Tandon: So you have, you know, one thing I noticed about you is that you have degrees and certificates from great schools: Purdue, MIT, Harvard. How do you think that education shaped your career? Has that had a huge play in it?

Hans Vargas Silva: The desire to learn, I guess, has always been there, and it’s always been an expectation from my parents. I am first—first everything. First graduate from high school in my family, in terms of my parents at least. My mom had me very young with my dad; she was 17. She couldn’t finish high school, and so she’s always put that into our minds: “Look what we couldn’t do.” I mean, she eventually finished night school, but she said, “There are opportunities I don’t have now, not because I regret having you, it’s just because this is what happened in our lives,” and the opportunities that she didn’t have to go to school. And the means, perhaps, from her family, right?

So they always had that: “Look at our example, do something better, and we’re going to try to give you the best that we can education-wise.” And the means were not necessarily there. You know, I am the first of three children, and for the longest time, I was the only one going to school that my parents could afford while my other brothers had to work and wait. I finished, and I was able to help them finish their careers, and we’re in a better place now.

Now, the opportunities that I’ve been taking advantage of, I guess I’m seeking those opportunities to learn something new, to get exposed to new knowledge. And I guess how to apply it is also important. And perhaps we’re going to talk more about giving back, which is part of my DNA in some ways, because I’ve received so much, I want to do something for somebody else. And if that means sharing, mentoring, or being part of this type of conversation, I’m very glad to be part of it.

Manoj Tandon: So if there is someone listening in Peru right now who is of lesser means or lesser opportunity than what you had, and they want to get into cybersecurity, what would you suggest for them? Do you have any thoughts?

Hans Vargas Silva: Yes. I think one of those things that I was told once before, and it’s very true, is somebody cannot take away something you learn.

Manoj Tandon: That’s very true.

Hans Vargas Silva: And if you do something greater with what you learn, you’re going to grow. Is that through a small business? Is it through school? Yeah, I believe there is, at least in Peru, it’s true: education is just a mechanism to get out of poverty. And so you see a lot of people excelling in math and trying to get to school. If you cannot afford a private school, you have to apply to a public school. So it takes sometimes three years to get in because it’s free, but only the best can make it. And so I guess my advice would be to have a goal, understand what you really want to do, and then pursue it. It might take you longer than it has in my case—I mean, I’m not a youngster—and in my life, it has taken a while to get where I am, but it’s always to be optimistic of the future. That’s something I can relate to. And the US is the perfect place to be and to take advantage of those opportunities. But in Peru itself, a growing economy, at least prior to COVID, I should say, and we’ve been in war situations, so I think the future could be brighter.

Manoj Tandon: And we see the same thing. You know, I’ve spent some time over in India; in that society as well, education is primarily viewed as a way to get out of poverty. It’s the same kind of situation. But the one thing is that if there is a child who has a sense of wonder and is absolutely hell-bent on pursuing it, somehow a lot of those opportunities open up for them. And I’ve always said, you know, if you’re in an unfortunate predicament but you have that sense of wonder, as long as you hold on to that and push through, success will come. It has to. Because attitude is also important, and also the sense of work ethic. People see that, and people notice that. Yes, there could be somebody who’s very charismatic and, you know, can make his way through life, but usually hard work pays off. At least that’s my experience.

Hans Vargas Silva: Oh, absolutely.

Manoj Tandon: So let’s switch over to a little bit more of a serious topic: critical infrastructure. While we were talking about this, you had actually brought up a Netflix episode. So, why don’t you tell the story?

Hans Vargas Silva: Well, let me preface it by saying I’m not necessarily advocating for Netflix; they’re not paying me or sponsoring me. This is just my personal comment. There is a series called Spycraft, and I was interested. Actually, in the last episode, they do a quick interview around minute 30 of the documentary. His name is James Gosler. He is a retired CIA officer, and he makes an assessment. He just says, like it’s not a big deal, that a lot of the questions he gets are how bad it is going to get. He says, and I’m going to quote him, “I use the words ‘catastrophic’ and ‘existential’ related to the loss of everything: electricity, computer power, etc.” Communication is gone; cars are not working; no power to the houses; refrigeration is not working. He says most people can survive a day or two, maybe a week, without supplies at home, but once you start getting to weeks, it’s going to be difficult. Just think about water and electricity. There is very little likelihood that this would happen, but low likelihood with catastrophic impact is worth thinking about, he says. So I highly recommend that everybody think about it.

And he says that in a tone like it’s not a big deal. It’s not like there is a certain urgency; he just says, “Think about it.” I had to listen to that three times. How I think in my mind, as I relate it to critical infrastructure, is it is absolutely true. The US is very dependent; our way of life is dependent on gas, electricity, and water being readily available. Being in India, or me from Peru, blackouts and water shortages are not necessarily unheard of. So people prepare: gallons of water, maybe a tank of water somewhere in the ground or above. Electricity? Well, candles, or some other type of means to illuminate your home. And people have a way to preserve food, like smoking them or salt. They eat a lot of fresh fruit; it’s not going to go to waste.

Manoj Tandon: Right, you eat it fresh, so you have a chicken, right?

Hans Vargas Silva: Exactly. So you don’t need refrigeration. But I am speaking as a person who’s been in the US for so long. If this were to happen—and we see it potentially happening. We’ve seen threat actors testing, trying to poison a water supply just by altering the chemistry and or the flow. There was an attempt in Florida recently to do that exact thing. So it could potentially happen in our home, meaning to our communities. Small critical infrastructure is privately owned, and they are not necessarily cyber protected. That was one of the things that I was working on in the State of Indiana before coming here. There is a certain urgency, but there is no funding, or there are not necessarily the incentives or the mandate from the government to do something about it with private entities. In this case, most owned critical infrastructure is private.

Manoj Tandon: Right. So it’s not until something catastrophic happens that we’re going to realize that we are highly dependent on those things. But it shouldn’t take a catastrophic incident. If you remember, way back in the 1800s, there was a solar event that sent a surge through all the telegraph lines in the United States and had caused major issues. If that same event took place today, it would likely severely damage the grid, and we would have to think about exactly what you’re talking about.

Hans Vargas Silva: Right. Just think about it. Don’t make it a cyberattack, but think about a fluke on the cloud services. Just think about that. We depend so much on our communication; our email, everything is moving to the cloud. If we have an interruption—if just my local internet provider had an issue, I’d lose productivity. I cannot connect to my company. I’m working from home. So, you know, what do we do? It’s going to be affecting our business, our employers, our way of life in some ways. We depend on it. We don’t write letters anymore.

Manoj Tandon: That’s right. We just expect to dial a number and get a video call. I don’t think I remember phone numbers anymore.

Hans Vargas Silva: I don’t think anybody does. Honestly, do you even have a phone diary with everyone’s phone number in it anymore? It’s probably in your phone.

Manoj Tandon: Speaking of which, think about incident response, right? You’re supposed to have that in your teams. What happens if you cannot depend on your systems?

Hans Vargas Silva: I guess what I’m trying to say is our critical infrastructure is fragile. I’m not an expert, but I can see how the impact could be catastrophic in some ways.

Manoj Tandon: Yeah. Ted Koppel actually wrote a book on this topic, a book titled Lights Out. So if the listeners out there want to take a quick peek into that, I would highly recommend taking a look at that. I’d also recommend another book, The Perfect Weapon. These are all great reads. And you know, Ted Koppel, a very credible journalist, talks extensively about if the lights go out, what’s going to happen. If you think about major cities like New York where people are living in high rises, or Chicago, one of the biggest problems that is going to happen is sanitation, because they’re not going to get water. You’re not going to have water being able to be pumped up. People live and depend on the way things are, and as we have seen with what the Russians did with the Ukraine, there is a vulnerability. I think maybe the only deterrence still is that we would consider it an act of war. I mean, if somebody shut down the grid, that is an act of war.

Hans Vargas Silva: Sure, you can respond, but it doesn’t do anything to help the people who would…

Manoj Tandon: Yeah. I’ve heard that’s more a conversation in the kind of military realm, I guess. But the ability—what is enough, right? We know some actors have been stealing IP, intellectual property, and they are monitoring somebody’s network. But disrupting that is going to be very aggressive. So what’s the response from a country perspective, right? We’ve seen examples, and I don’t think the US has done anything about it, but also the US has been infiltrating somebody else’s networks and doing the exact same, probably. So it’s a hard problem or a very hard subject to argue. You can argue both ends of the spectrum.

Hans Vargas Silva: Exactly. And I think that this is a weapon that’s likely to get used because cyber weapons don’t require you to have tanks and submarines and all this military infrastructure. You can cause a great deal of damage by being a small, intelligent country that has some reason or axe to grind with someone.

Manoj Tandon: Right. It’s asymmetrical warfare at its best.

Hans Vargas Silva: Yeah, at its best.

Manoj Tandon: Yeah, and that’s very true. And with the readily available tools now on the darknet and the exposure from some of these tools from DNS, it’s a pretty level field. I mean, you have leveled the field of access to these highly sophisticated tools. And the weaponization of those has been very interesting to see in the last 10 years.

Well, I mean, if you look at petroleum—not to pick on you, but I think Saudi Aramco got hit by the Triton worm, and that nearly shut them down. That was an attack on the safety and control systems in a refinery. So you would think that if Saudi Aramco is vulnerable to that, probably a lot of other folks are as well.

Hans Vargas Silva: That’s right. Yeah, we’ve seen also the effects that has taken on companies that are not necessarily the target but get affected. And then they cannot recover; their means to restore have been compromised. I forgot the name of the company, but it was a shipping company.

Manoj Tandon: Yeah, I want to say there were two. If it’s the same incident I’m thinking of, it was actually the Russian cyberattack on the Ukraine, and FedEx and Merck were both innocent collateral damage in that. And you know what happened in that? I think that court case is actually still pending because their cyber insurance policy came along, and their policy carrier said, “We’re not paying it because an act of war is excluded from the policy.” And the fact that the Russians did this to Ukraine, that’s an act of war, and you guys were collateral damage. Well, tough. Some lawyer over there got a really good bonus for denying that.

Hans Vargas Silva: Well, they took him to court.

Manoj Tandon: That’s right. So now it’s pending, and it’ll be interesting to see how that shapes up, which brings us actually to government regulation.

Hans Vargas Silva: Right. Well, there’s so much that the government can regulate. In some cases, I agree; there are some very outrageous mishandlings of security controls or security in general, or people’s privacy and information. And I think the government’s role is to say something about it to protect the consumer. But in some areas, I find that the government—and this is a criticism of our government here—is not necessarily doing a better job of showing us a way. Regulations sometimes could be very burdensome for companies. Just think about SOX and other types of regulations that states and countries enact, and the extent companies have to go to comply with that. If you just were to quantify the amount of money, effort, and resources spent, I wonder if sometimes it’s not necessarily addressing the issue or the risk. I don’t know.

Manoj Tandon: No, you know what, I would agree with you. And if you look at what’s happened even in our own federal government, our federal government has lost a lot of data. I think China took all the forms for security clearance out of the OPM; they had access to all of that. And I’m sure that those guys were supposed to be compliant with everything. One thing you know about government bureaucracies is they love compliance, and they love audits and frameworks. But compliance for the sake of compliance is just a low bar, if you think about it. Compliance is: you need to meet these minimal criteria. And then some people think that because I meet this criteria, I’m secure. Most people think that.

Hans Vargas Silva: I’m so glad you said that. Most people think that. We have such a hard time convincing people that being compliant doesn’t mean that you are secure. In fact, I think we’ve had four or five guests where I’ve brought that subject up, because we do feel strongly about it: compliance does not equal security.

Hans Vargas Silva: Yes, I agree with that. And I am right now in the area of compliance. And yes, we are to comply, but if we do it just to meet a specific requirement and we don’t see the context of the risk… if you’re just complying because somebody told you you need to be compliant with this article, A.B, and you don’t have the context of why you are doing it or how this is addressing risk, you might be leaving a big gap and the risk open just because you are too busy looking at the specific article or the specific section of a standard that you ought to just checkmark.

Manoj Tandon: How do you get decision-makers to see that compliance does not necessarily equal great cybersecurity?

Hans Vargas Silva: That’s a tough question because I will have to give our leaders the benefit of the doubt. There are so many priorities, depending on the day or whoever is dictating how we should go. Some things could be on the back burner, and it doesn’t mean that they aren’t very important, but sometimes there’s an initiative to do this, and there’s an initiative to focus on upgrading something or moving to a different system.

Or often, sometimes we ignore culture: awareness of security in organizations. We punish people sometimes for phishing, and we don’t tell them why it’s important for them to identify that something is suspicious. We force people to start doing two-factor authentication, but we don’t tell them why it is important. We sometimes deploy technologies and solutions halfway to the capacity that they should be. And I’m not specifically saying anything about… just in my career, I’ve seen that where you buy the top-of-the-line product—think about the Gartner Quadrant, right?—so you go and get the best of the best, but you implemented that at 30%. Maybe you should have bought the not-so-expensive flashy product, and if you were to use it at 80%, that would be more effective.

Manoj Tandon: There are so many questions in all the things you just stated that I think we could easily take two more hours to talk about it, but I will just try and scratch the surface here. So when you talk about risk, which you mentioned very appropriately, sometimes if it’s not done in the context of risk, then what’s the point? How do you communicate risk? How do you frame it in the context of the business? Are there some tips and guidance for our listeners that you can provide that could make cybersecurity more tangible of a problem when stated in terms of risk?

Hans Vargas Silva: I think there are many ways to do that. One of them could be: understand your data. What type of data are you handling? If you’re handling scheduling for products to be transported or transformed through your processes, would somebody disrupting that information—instead of 20, it’s 400—would that make an impact in your financials?

Correlating it always to money is a good way to quantify the loss of productivity. If I were to say in my industry, if I were to lose email for a week, would that just be equivalent to the risk of having my refinery shut down for a week? Can I still invoice by hand or communicate by picking up the phone to call somebody? I’m still able to communicate, or just drive to my customer to have a meeting instead of, “I don’t have email, I cannot talk to you.” But if I’m not able to process my product from A to B and take it to my customer, then that might be more of a risk.

So, going back to risk: what’s the risk? Is the data I’m exposing going to affect my reputation or my ability to do business? Painting it in those terms for the business could drive the point you’re trying to make. Sometimes cybersecurity or compliance is seen as consuming resources—budget, budget, budget—because we need to get this and that. But it’s not until we frame that in a way that we can say, “We are supporting your business.” Without these measures of protection or controls in place to address this risk—obviously we have to identify risk first—we’re not going to be the enablers of the business function.

And IT is so integrated now into everything, from communications to processes. There is machinery that is connected to SCADA systems or sensors that are being connected to pipelines. Anything that you can manage now from your phone—access or see—those are things that IT and cybersecurity enable. So how do we securely give you access to an application that is connected to a SCADA system from your iPad?

Manoj Tandon: I would say don’t do it. That would be my advice.

Hans Vargas Silva: There is a business case, right? The business is always going to want something. Sometimes cybersecurity’s role is seen as saying no, but it has to be explained why not.

Manoj Tandon: I mean, I don’t know if I shared this with you prior to this, but I was involved heavily in the chemicals business with an engineering conglomerate and spent a lot of time in the oil and gas sector. So my professional advice is: don’t do it. I’d say something should be air-gapped, and they should really be air-gapped. Just because you can doesn’t mean you should.

Hans Vargas Silva: That’s right. I’d say some things are not meant to be connected.

Manoj Tandon: Don’t be lazy. Get up, walk to the control room, take a look at the needle. Walk over to the piece of equipment, put an instrument on it, check it. Don’t rely on web-based analytics, because as soon as I give someone the ability to extract data, these systems are so complex there could be a gap in there that allows somebody to go the other way as well. Stuxnet is exactly right. You were relying on what you’re reading on your screen compared to something that is spinning faster.

Yeah, we can go into that. But that’s exactly what we did to the Iranians on their centrifuges. Right, that was Operation Olympic Games. Very interesting on that. But when you look at regulation, then, I often think… I want to be careful because they are very good people, but I think oftentimes they don’t have enough information, and it’s a knee-jerk reaction when regulations are being framed. Let me give you an example of where I’m coming from here: the SolarWinds hack recently that now everybody knows about. When you saw members of Congress talk about it, they were talking in terms of, “We shouldn’t allow unauthorized software or untested software to be put on government systems.” None of those statements are true. That software was authorized. SolarWinds is a very well-tested, highly reputable organization. It had nothing to do with that. And then if there’s a knee-jerk regulation that comes out of it that says “thou shall not do XXX,” it’s going to be grossly ineffective.

Hans Vargas Silva: Yeah, they might have good intentions behind it, but then it becomes a bill that is five reams of paper long, and nobody understands what it’s supposed to be doing. Everybody interprets it differently, and at the end, you don’t get to the core of what you’re trying to do. So regulation sometimes is burdensome; sometimes it’s misinterpreted. People who are building those regulations don’t understand the context. That may be an area where I’ve been very fortunate to be learning. I’m interacting sometimes as a mediator between the business or IT and the auditor, you know, internal or external auditor. Context is key because sometimes the more I understand what IT’s function is or what the business has done, the better I perhaps can just have a conversation with the auditor saying, “Well, I think you did not understand. I know what your requirement to test or to have evidence is, but this evidence means this,” and try to walk them through it. Something that could be an issue is not necessarily an issue. Yeah, there might be something that was not necessarily caught right there, but it’s not necessarily a critical issue if we explain it right, the context. And there are other cases where it’s clear that it was not well done and it has to be an issue.

I don’t have much of the influence in terms of what is going on in Congress. I should say that.

Manoj Tandon: But you have a lot of state experience, right? You worked with the State of Indiana for a degree of time, which is why I’m very interested in this topic in here.

Hans Vargas Silva: My interaction with the State of Indiana was more as part of my thesis and also developing what we call the IN-ISAC, which was the concept of information sharing. Just like we have the MS-ISAC, which is federal to states, we have the best one in my opinion, FS-ISAC, which is the Financial Services ISAC. The threat intelligence is shared across financial institutions across the world, and it’s very dynamic and well developed.

The IN-ISAC was the attempt to have the State of Indiana sharing some curated threat intelligence throughout the state through other local municipalities or businesses, local critical infrastructure, to say, “Here are the things you must be aware of.” Or maybe, looking at you, if you have a small IT shop, maybe you should tune your firewall and think about it. It’s growing, this… keeping or holding hostage educational institutions that perhaps don’t have the budget to protect themselves, and then you have HIPAA and PII information being ransomed until either they pay or they have to recover. So there are a lot of vulnerabilities that we see. You think, who would want to attack a hospital or school? But it happens all the time. Police stations, you know, and they don’t have insurance or they don’t have coverage; they don’t have the IT resources to recover.

And so that was the idea in the project I worked on in the State of Indiana. It’s still ongoing, by the way, and I hope it continues. But it brings me to, I guess, the information sharing portion, right? We are mandated to share back to the federal government many times, and we don’t see the way back. So it’s all “give, give, give” and nothing to receive. Maybe I shouldn’t say nothing, but we are not built to collaborate in some cases. There are not many incentives for us to collaborate. Financial services do because there is a financial incentive. “I’m gonna lose money. My customers think that their money is not safe. I am going to lose reputation and eventually customers.” So they built it and they’re very serious about it. And that is not necessarily the case for all the ISACs.

Manoj Tandon: You know, that’s a very good point. Is there something, like you just mentioned, that the government should be sharing back? But are there other government policy positions or things that they should be doing or taking up to help the private sector? Is there something that you would say, “Hey guys, if you’re going to do anything in Congress or at the state level or the local level, think of it this way”?

Hans Vargas Silva: I don’t know. That’s a tough question. I guess I would say… let me… now, I’m not trying to be very controversial here, but deregulate sometimes. Make it easier to open a business. Make it easier to form consortiums. We don’t have consortiums to acquire technology and security technology. I’ve seen cases where small school corporations get together and say, “We’re going to buy in bulk and we’re going to acquire services to protect our network as a conglomerate.” We don’t see that much. Maybe competing hospitals can get together and say, “Let’s start sharing some of these things or best practices.”

You know, I don’t know if you heard the concept—I think Google is using this or even Microsoft is saying security is not… let’s not think about shared security because you’re using our services; we have a shared fate in lack of security.

Manoj Tandon: That’s correct.

Hans Vargas Silva: So it’s almost like a fiduciary approach to security, which is very interesting. It’s like if we are insecure and you are—or if you insecure or misconfigure our services—you are as insecure as us. So the shared fate type of mentality, it’s something new that I’ve started seeing. And like I said, almost like a fiduciary type of example, right? So if you think about fiduciary investing companies, they would not be investing on something that is—or betting against—your investments on the side to make money. They will do what is right for them because it is right for you. The same for security. I haven’t seen much of that. I don’t know if that could be regulated, but it could be incentivized. But how do you incentivize without regulation? That’s the question.

Manoj Tandon: The government doesn’t know how to do that, unless you can point to a good example. I would love to learn.

Hans Vargas Silva: Yeah, now you’re putting me on the spot. There are some ways that we’ve seen that, right? Through grants. There have been some national labs doing a lot of good research and publishing enough for the benefit of the private sector. Universities have been doing something interesting, a little questionable, where they hold the patent of professors or ideas and then they commercialize it until it becomes something that the public can consume. I don’t know—attracting investment in technology. We see collaboration with other countries where cybersecurity is blooming and good ideas are happening. I don’t know if there is enough research and development in colleges. Not yet, I think there is, but I think there’s a lot of advancements that are being made there.

Manoj Tandon: I see the number of schools now that are offering an information security degree out of their computer science departments has gone up, and those institutions are actually engaging with the private sector to get opinions and shape the curriculum, which is really very cool. You know, I sit on the advisory board of the computer science department at Slippery Rock University, and they’ve been doing a lot of things in terms of shaping their cybersecurity program to match the evolving threat landscape and to have people coming out that are much more in tune with what’s happening. And that’s kind of cool.

Hans Vargas Silva: It is. That’s great. That’s great to hear. It’s very encouraging because I can share a quick story that I’ve seen very bright kids coming from college to do their internships, and they’re brilliant. They’re so eager to do so many things and so prepared in some instances—things I didn’t know when I left college or were not necessarily ready for it. But there are some other things that schools are not teaching our kids. They’re spending four years of their life taking classes, and I can relate to that. I spent two years in grad school; there are things I’m never going to use.

Maybe some of these schools… I’ve seen requiring students to have what they call it—a built-in internship built into their four years or four years and a half. So you take a semester and go to actually do some of the work. And some things that, for example, I never heard of is change management. We introduced them the idea of what change management is into the life cycle of an application and support, and it’s like, “Nobody told me, you know, how do I move something to production or what are the steps?” Compliance is a foreign concept, you know. And it was in some ways for me too because I was very concentrated on cybersecurity, so I was oblivious to some of these things. And it happens everywhere. If you’re looking about—if you’re talking about it in the IT lifecycle, right—you’re not only supporting an application, you might be interacting with the business, understanding requirements. Procurement is another one.

Manoj Tandon: Yeah.

Hans Vargas Silva: Kids don’t know how to write requirements, how to evaluate vendors, how to look at pricing. If I were to grab somebody and say, “Okay, I need your help to gather requirements and to evaluate vendors,” you know, “what do I do?” So there are great opportunities for kids to learn, but also they need to realize that the four years of school is not necessarily preparing them for their real life. They need to get out, they need to be doing a side job or volunteering if nothing else in the local university and the local community.

Manoj Tandon: Which is a great segue to a topic you’re super passionate about, and that’s volunteering, right? And yes, you know, a little background on that: I read that you were actually in a major earthquake at one point in time in your life.

Hans Vargas Silva: Right. I was. Yes. I was, what, nine years old, I think. My hometown in the jungle of Peru got hit with a 7.2. It was a very, very, very big earthquake. A lot of people died because of the type of construction we had in that time in my hometown. And think about all the pipes getting, you know, messed up. Not good reliable water back then. Also, we got hit with a cholera outbreak throughout South America. So earthquake, think about cholera, you know, and the sanitary conditions. My family was living in the back of our house in a yard with a tent for like nine months while rebuilding. I got sick with cholera. I almost died.

But I also saw people coming, you know—people outside our community, international organizations, just neighbor helping neighbor. And that impacted in some ways my life because I was asking my mom, “Where is this people coming from? Why are they doing this? Why do we have somebody from the US coming and helping, you know, to do something to help or rescue?” Or maybe after, right, many years later, coming and doing clinics. And she said, “They do it because they feel they’re giving back. They feel that they are doing something for their fellow human beings.” Because if you think about it, why would somebody leave their country and go somewhere they don’t know anything about, and obviously in difficult situations, right? You know, you don’t drive yourselves, you don’t cook your food, you don’t know the water is safe to drink, and come work and volunteer your time. That was a concept in my mind that was not necessarily very popular.

So I learned something there. And obviously throughout my life and some of the things that people have helped me out, all throughout my life until now, especially coming to the US where I believe volunteering is part of the culture and I’ve learned that as well—volunteering in your local community. I did that. I started volunteering at my local resource center. I was starting to teach GED in Spanish, completely outside IT. But I got to know people in my community, and they got to know me. It led me to opportunities of employment, improved my English when I first came to the US.

So volunteering for me is a way to say thank you, you know, because I’ve been blessed in many ways. I’ve been given opportunities. The US has been a country that has opened their arms for me, for my family. And it is a way for me to say, “I’m here and I want to give back. I want to give back to somebody from the little knowledge I have. Maybe somebody can learn from it.” Because I did, throughout the mentorship I had received so far, I’ve learned quite a few things and people have invested time and effort to show me the way. Maybe I can do some of that too. And it doesn’t have to be in IT. Although I do some IT volunteering, it could be serving soup at your local kitchen or mission place. It could be just being aware of where our opportunities to serve and aboard or participate in an activity in your community, especially now as we’re trying to get out of COVID, right? Getting back in interacting with our community, our fellow citizens.

Manoj Tandon: What have been some of your favorite volunteering activities?

Hans Vargas Silva: Well, I will have to rate it in some ways. The last one was through Team Rubicon. I was deployed to West Virginia to work on a flood survey and recovery. That was great because it’s been so long. The last one perhaps is… it was a trip to Liberia, Africa, to install a computer lab for a local community college. I had some friends there that were helping with building agriculture to this war-torn country, and I got the opportunity to go and do something I know how to do, you know, to re-image computers, to set up a network, because they are learning how to use Microsoft Office on these old computers. And that was very rewarding because not only was I able to help, but also it was something that I was comfortable doing, which is networking and setting up computers.

Manoj Tandon: That sounds very cool. I can’t imagine the environment over there. I’m sure it’s not at all similar to what we are fortunate to have here, but it’s a skill that hopefully those people can put to use and can materially affect their life.

Hans Vargas Silva: Yeah. And I guess my point to anybody who is listening: it doesn’t have to be leaving the country. It could be your local resource center and they need some help. Or it could be helping, I don’t know, the elderly in our community to learn about not being victims of scams. You know, somebody shouldn’t be remoting into your computer to ask you for refunds or refunding your bank account. Yeah, you know, things like that. Learning about phishing or being careful with things you put online or things you share online. Could be as simple as that. It could be just digging a hole or framing a wall. Basically, no man is an island. And if you give, you shall get kind of a thing. You should give with the expectation not to receive.

Manoj Tandon: That’s very apropos.

Hans Vargas Silva: That’s correct. And I think, again, these things all enrich the community and enrich people, and it’s a very noble act.

Manoj Tandon: So for all our listeners, I would say listen to Hans here and, you know, if you have that opportunity, absolutely volunteer. And Hans, I know we’re right at the hour here. Is there anything that you’d like to plug? Do you have any appearances, talks, books, anything at all, any organizations that you would like to mention that we can put in the show notes that you would like to guide people to?

Hans Vargas Silva: Ah, you didn’t tell me, you didn’t give me a fair warning. I don’t know. I’m not writing a book right now. Like I told you before, I am a general—I mean a normal guy, you know, doing his job. I believe in a small community. I’m not a famous person. I have been very fortunate to grow a network of like-minded people from which I learn a lot, and also when I had some time I shared some stuff on LinkedIn. I have lots of interest in learning. I know that I’m still in this path of learning. I don’t claim to be an expert on anything. I have some areas of concentration, I will call it, and then over the years of my experience has allowed me to have some, I guess let’s put it this way, have some strong opinions about my experience and some things that I’ve seen that work. But I’m still in this journey to learn, and I think that everybody should just not stop learning. I guess that’s pretty much it. The organization I support, I mentioned Team Rubicon. I think that’s the last one I would like to mention at this point.

Manoj Tandon: We’ll put a link to them in the show notes. And we’re at the time, but thank you so much, Hans. This has been wonderful. Really appreciate you taking an hour out of your time to be with us today. I’m sure it’s inspiring and it’s going to help some folks.

Hans Vargas Silva: Thank you for inviting me, and I hope everybody finds a little bit of information that is helpful.

Manoj Tandon: Fantastic. Take care.

Hans Vargas Silva: Thank you.