Security Confidential S9 E6 Dallas Baker

Rory Meikle: Welcome back to Security Confidential. I’m your host, Rory Meikle, filling in for Manoj Tandon this week. Today we have Dallas Baker joining us again. Dallas is a U.S. Army veteran and cybersecurity professional. He’s worked for many companies, including PerimeterX, Blue Shield, PayPal, and HUMAN, where he is currently a threat intelligence analyst. He is skilled in Python, SQL, information security, JavaScript, and networking, and recently obtained a new certification in cyber threat management. Dallas, welcome back to the show. It is good to have you.

Dallas Baker: It’s nice to be here. Nice to be here.

Rory Meikle: So, what have you been up to since we last spoke with you? Anything new? What has changed in your life?

Dallas Baker: Yeah, so from the last time, as you know, HUMAN merged with PerimeterX, or we were going through the merge, so things are kind of settling.

So, I’m out of the marketing team. To take a step back, I was on the marketing team not necessarily to do marketing, but I was there to help customers with POV reports or additional analysis. In addition, I would help the marketing team find actionable events to then create a blog post or video, or have the CEO go speak with NBC around sniper threats and things like that that we see. So, that was kind of the analyst that supported a lot of different teams. So, now I’ve moved into threat intelligence, and so we’re going to still keep a lot of the same responsibilities of helping marketing, or if the customer has additional insights that they need, we’ll still provide that. But we’re also doing more in-depth investigations, and some of those investigations will involve getting the Attorney General involved or the FBI or whatever to perform some type of takedown.

So, what I’m currently working on is getting a threat intelligence platform set up for the company and getting the team—since I worked at both companies, the only one in the company to work for both companies—I’m trying to merge the teams together and manage which teams are closely aligned so that they can work better together, and which technology stacks we should use, the pros and cons of each, and things like that. So, those are currently my projects at the moment.

Rory Meikle: Okay, and so what’s the end goal now of this new merged company?

Dallas Baker: So, the company was formerly called White Ops. In 2020, there was a lot going on, and so the company felt that the name should change. And so they already had t-shirts that said “HUMAN” because our company essentially is determining if someone on the other end is a human or a bot, and so they changed the name to HUMAN. PerimeterX had the same focus; they had the Human Challenge, and their goal was to tell you if there was a bot or if it was a human on the other side making the purchase or looking at the ad or whatever the case is. So, we just took—it’s a great merge because PerimeterX had a lot more modern technology and algorithms around the web application space, and HUMAN started off as more of an ad security company. And PerimeterX didn’t have anything that was really solid in the ad space.

So we’re just merging those two into a single product and service.

Rory Meikle: Yeah, that makes total sense then. No, it’s funny in the sense that I think a lot of people think that we know cyber as a whole is very secure in this day and age and kind of like the old Wild West days are over, but it’s kind of the opposite. Everything is very much unsecure right now, and if people have the know-how and the drive to do so, there isn’t much that you can really stop them from doing initially. Obviously, we’ve gotten a lot better now with tracing things down and tracking who’s doing what from a criminal standpoint, but that initial thrust to get in somewhere or to exploit something is very easily done if you have the knowledge, the technology, and the tools to get it done. I think a lot of people don’t understand that aspect of our security and of our cyber world right now.

Dallas Baker: Oh, most definitely. I guess one of the issues we face is depending on where the attack comes from, there might not be any jurisdiction that we can go to and say, “Hey, this is bad,” because they don’t have any laws around it. They’re like, “Well, it’s bad in your state or your country, but we don’t care.” There’s no—so it’s very new on what you’re allowed to do and what you’re not allowed to do, so a lot of people get away with it. And they can anonymize themselves very easily, especially if they’re running through Tor and VPNs. It’s hard to see who’s actually performing the attack. You can also make your attack look like someone else’s or tell someone different—you know, have like a fall guy. And I still think that for some reason, people are still clicking on phishing emails and trusting the internet for whatever reason when it’s really not a place to be trusted, not to scare people, but you know.

Rory Meikle: I just read something this morning that was talking about how CISOs and head security guys are most worried about their employees clicking on phishing emails and spoofing emails. To me, that’s just such old news at this point. That’s just something that’s hammered away everywhere you go. Any large organization does training; they send out fake emails all the time. But yet this is still a problem; it’s still a major concern for a lot of organizations. So clearly, the fight is still out there, and we’re not winning it yet, to say the least.

Dallas Baker: Not at all. Email’s a big thing. I’m not a huge fan of email. I try to get people to just use Slack or some other form where we had to actually add that person to our enterprise. And so now if I do get an email, I’ll just do some due diligence to see if they’re part of the company and who they are, because we do have other companies within our Slack. So, just because it doesn’t come from a HUMAN email doesn’t mean that we’re not working with them. And then I also set up some rules so that if particular people send emails, they just go to my Slack, and then I can just ping them from Slack. Because with emails, I’m not a huge fan; there’s a lot of issues with it. One of the things that we had at Blue Shield is we had the technology to write really creative rules and heuristics to detect these emails. But then executives were like, “No, I don’t want to do that because if I miss an email…” and it’s like, if you missed one email, I mean, I guess it could be a big deal, but we don’t have the manpower for analysts to sit there and just look at email all day.

So we took more of a passive approach of allowing more emails in and then hoping that CrowdStrike or FireEye or whatever would detect the malware payload or the phishing link or whatever, and then we would go block it. But by the time that happens, someone could already click the link, put their username and password in, say okay, and went on about their day, and then realized, “Oh, I probably shouldn’t have done that,” and then they’re embarrassed, so they don’t say anything.

Rory Meikle: Exactly. Yeah, that whole “important email” thing with executives—we’ve dealt with that in the past at Dark Rhino, and it can be quite the hurdle to get over trying to convince people how the security of protecting you against these phishing emails, or bad emails, or malicious emails—whatever they may be—really outweighs you maybe not seeing an email right away or missing one email from a client. I know at the time, the business development guys think that’s a big deal, but at the end of the day, what’s a bigger deal: you missed one email, or you clicked on an email you shouldn’t have clicked on, and now you have ransomware going on at your organization?

Dallas Baker: I mean, yeah, it would be way easier to say, “Hey, I’m expecting this email and I didn’t get it. Can you make sure?” and we got an easy win, and the system said, “Yeah, we blocked the email; we’ll release it,” or whatever.

Rory Meikle: So, what human behaviors then, in your opinion, have led to the greatest number of breaches that you guys see or that you guys go in to investigate?

Dallas Baker: When I was at Blue Shield, we used to do these experiments where we would dress up as janitors or construction people, and we would just walk through. So many people would just open the door for us and say, “Oh yeah, come on in.” We had our little Blue Shield logo, so we looked official, but we should not—I mean, technically we had access to these buildings because we were security, but they didn’t know that. They didn’t know who we were; we didn’t have a badge, and no one asked. They would just open the door for us and let us in.

“Where do I find this server room?”

“Well, the server room is all the way down there to the left.”

They would literally walk us there, say, “Have a great day,” and from there, we had access to the server room and we could pretty much do whatever we want.

So, I think trusting stuff—everyone wants to be nice and they don’t want to—someone could just be having a bad day or they left their badge at home. But at the end of the day, we all have to take our initiative to say, even if we know that person, we still need to confirm that we can’t trust that person with the systems. There are processes in place for them to go get a temporary badge for the day. Other issues have been when the company is working with different clients, you have employees—the client might want a bunch of data, which is fine; it’s their data and they should have access to it. But instead of going the long way to make sure that it’s shared in a secure way and it’s encrypted, they’ll just bundle it all up, throw it in an email, and click send. Or they’ll host it on Dropbox or whatever, and it’s like, that’s not the approved process, but it is a lot easier.

A lot of the systems that we have to secure things are not as efficient, so people don’t use them or they don’t know how to use them. And so it brings some issues up. I know there are newer companies that are trying to automatically encrypt things and create shareable links like you would have with any other product. But I think those are the biggest ones: just trusting too easily and not using approved processes for sharing information across the wire.

Rory Meikle: Yeah, that makes sense. I think everybody wants to always be helpful. Why would you not want to help this guy out?

Dallas Baker: Exactly.

Rory Meikle: I was looking at something the other day and it was talking about how a big area of threat vectors that they think is going to come in 2023 and onward is attacking the API work between your modern systems up front and then when you have these back-end legacy systems running. That channel in between them is extremely vulnerable because the legacy systems can’t support the same security that your modern systems can, yet you’re still flowing all this information to and fro.

Dallas Baker: Oh, yes, certainly. It’s like the middleman; the API is just the middleman. You’ve got the old legacy system; you think it’s secure because it’s not internet-facing, but you have this internet-facing application and that’s directly communicating with it. I’m definitely aware of that.

At PayPal, when I worked at PayPal, those were definitely some issues. Especially when they acquire new companies, they may not change anything, but they need to work with the PayPal system, so they’ll just spin up an API service and put it in the middle so that it all communicates. But I think they do a good job in that they highly leverage HackerOne, and they’re paying people to actually hack the system so that they’re able to identify the holes and then they can plug them up.

Rory Meikle: As far as analyst fatigue goes, how do you combat that personally, or maybe for your team at your company right now, to keep your guys sharp and on point when they’re doing their job? I know it can get kind of boring and easy to fade off if you’re just staring at a screen all day in a back dark room, but what do you use personally, and what do you push to your team to keep them sharp and on point as they’re doing their day-to-day work?

Dallas Baker: Yeah, so analyst fatigue is definitely real. I’ve had incidents. At Blue Shield, we were 24/7, and everyone had to be in California.

So you have people working late nights, and they’re always small teams. We probably need 20 people, but budget says we can only have 10, so people have to work longer than is always expected even though we’re on a shift. But one thing is people get bored. They look at the same thing every day, and they’re like, “Oh, this is just the same BS alert.” And so they ignore it, or they get calls from people who say, “My password changed and I didn’t change my password.” We’ve all gone through the same scenario again where they did change their password, they just can’t remember it, and now they’re telling us that their account’s compromised. We look in the logs and they literally changed their password yesterday. But with that, I think to combat it—at Blue Shield, what ended up happening with this whole password thing—someone actually had called the service desk at like two in the morning to request a password change for this client who would log into our Blue Shield system to process claims. Once they were able to change the password—and they were doing this all the time, because then the client would call us and we’d reset their password, but then the next day the password’s changed again—and no one went and checked the phone logs to see who was calling in.

We just saw like an admin service change the password. So for us, it wasn’t like a security threat; it wasn’t like another user had changed someone else’s password, and we didn’t have any alerts from our other detection system saying someone breached the AD server and changed it. So it was like, “Well, our systems changed the password.” And so that led into a big deal of people stealing information and claims and processing them to new bank accounts. But I guess the biggest thing is automation. There are too many false positives in the systems and there’s no automation there to run through to remove those false positives. So analysts come in and they get 10 alerts, and all the alerts are trash—no one cares. But there’s going to be one day where out of those 10, there’s one that’s actually a real thing, but the analyst is just going to dismiss it, because why would you go through 10 alerts when you see this every single day? So one thing that we do at HUMAN is false positives are a huge deal. If we have a false positive, we have to deal with it immediately because we have hundreds of customers.

I don’t know how many alerts—it’s a lot—but our analysts don’t look at these alerts. We’ve built a system that will go analyze the alert for them and then say, “Hey, was this accurate?” Even from a business standpoint, when you think about how to scale your business appropriately, if you don’t have automation in there, you’re never going to be able to have the manpower to scale proportionately to the growth that you want to have. It’s just not feasible. So the more you can automate anything in general is going to work exponentially better.

Rory Meikle: Yeah, no analyst wants to sit there and do it. So it’s really counterintuitive to tell an analyst to go do all this stuff when they’re probably not even doing a good job at it. They’re like, “Yeah, yeah, yeah,” and even in the event that something bad was there, they just skipped over it and kept going.

So just because you have an automation platform and just because you have the automation, if you’re not actually doing anything with it and you’re not actually trusting your analyst to provide the automation with valid feedback, then you don’t have automation in my opinion.

There are a lot of companies that have it; they have a SOAR platform. “Oh, we’ve got the SOAR,” and it’s ingesting all this and it’s determining what alert is there, but if an analyst has to go in and manually analyze it, then it’s not automation. You’re just creating a new ticketing system that may have fewer tickets, but the analyst isn’t able to verify the automation and say, “No, this is totally incorrect; this is how it needs to work.” And I think as an organization, as an institute here for all of security, every company should strive to get automation in place where the analyst isn’t just sitting there going through Splunk all day, but they’re actually thinking about the logic behind that alert and how the automation platform analyzed it, and verifying that the system analyzed it correctly and was able to detect the correct thing. The analyst’s job should be to provide feedback to that, not just take the ticket and then go work it. To me, that’s not automation. So I just want to make that real clear.

Rory Meikle: That’s awesome. I think that’s a great definition of automation that you gave us. A lot of people, like you said, might think they have automation, but if you’re having humans do the work again or double-check it, it’s not really automated. You’re just creating more work, or maybe you’re creating simpler work or busy work, but it’s not automated. And I think you’re spot on with that 100 percent.

Dallas Baker: Sure, yeah. I always have this thing: if I have to do it more than once, it can be automated. If I have to do it more than once, I don’t want to do it. And I guess that’s just my personality. I like new things and new challenges, but if I have to do something over and over, it’s just like, I don’t want this anymore because it’s not challenging. I’m just a drone at this point going through the steps.

Rory Meikle: Yeah, and I don’t feel useful; I don’t feel creative. So, yeah, absolutely. We’re in that automation grind right now at Dark Rhino, too. We’re really hustling. Everything that can be automated is being automated, trying to take the human element of repeating yourself out of it, like you said, and focusing more on big-picture stuff.

Dallas Baker: That’s good; that’s awesome.

Rory Meikle: What other things are new in your life that you can fill us in on? I know on your LinkedIn you have analyst, realtor, and the last one’s investor, right?

Dallas Baker: Yeah, so back in September, I kind of went through—I don’t know, I looked at my life and was like, “What could change?” I do want to be an angel investor, so that’s my goal. Step one is becoming accredited. So that’s my thing. I also like real estate now. I don’t like residential real estate; I think it’s way too emotional. I would never—I’ve seen people do it and make money from it, but it seems like a very stressful time to sell someone’s house. They want to sell it to the right people; they don’t really want to sell it. Or people want to buy, but they don’t know what they want to buy, and there’s all this emotion involved around this house. So I’m trying to do more commercial where it’s strictly business, make the commission, and move on. I want to get into apartments and buy prime real estate where I can have 300 doors, so I have checks coming in. I have some friends and we’re looking at creating our own little startup focused around security, but more so physical security. There are lots of break-ins and things like that.

I don’t want to say that we’re going to create “Big Brother.” We’re trying to make this local so that local communities have jurisdiction. It’s not like the big federal government has access to this, but it would be very local—like we could even make it to the neighborhood level, so the neighborhood has access to this.

I’m sure you heard about the college case where those three college students got stabbed and no one knows who did it or where. So we came up with an idea—it’s so easy to just read license plates and to identify certain things.

So we want to create something—you could call them CCTVs, but they’re smart, so they’re able to identify things without necessarily spying on all of America. We were looking at this new AI system that was able to read human expressions and tell you feelings based on how they were walking, or if they were smiling, or their facial expressions. So we wanted to create something similar so that if someone walks into a building, for example, based on that algorithm, we would be able to determine, “Well, this person might be a potential threat,” and alert whoever’s there at the building or the neighborhood or whatever: “Hey, there’s some weird stuff going on,” essentially to prevent the crime from taking place before it does. I know there’s going to be a lot of people like, “Oh, my rights,” and stuff like that, and I totally understand because I don’t want Big Brother. I mean, I think we’ve already read like 1984, and I don’t want the federal government having access to it because I think they would totally abuse it.

But if we could make it where it’s just at the local level—or if Walmart just wants it, right? If we could detect like someone’s going to come in here—there was a thing where someone held a Walmart employee hostage.

If we were able to determine from the parking lot that this person is angry out of their mind, going to come in here and do something, maybe somebody could have done something to prevent that from happening. And so that’s kind of our goal. The real estate stuff is to just get funding, plus it helps with my life goals to—because I came from a single mom, and my mom’s on like Section 8 and stuff. No one in my family has ever owned anything or had any type of wealth. For me, it’s important to create that wealth for the next generation.

Rory Meikle: Yeah, absolutely. Oh, that’s super cool. Can you tell us about the HBO documentary at all that’s going down?

Dallas Baker: Yeah, so I don’t think it’s going to be—it’s kind of secret, but it’s not really. But yeah, HBO, they do tons of documentaries about everything. One of the concerns was data privacy, consumer data, and privacy, and how it’s being collected and used, how it could be used, and who has access to buy it. Where do you buy this stuff? I think Apple’s made a good case of “there’s a privacy issue,” and all the other companies are like, “there’s no privacy issue.” So we’re really just trying to determine how much of your data is being bought and sold on the market and what you could do with it. We’re just going to get some people together—this is all volunteers, so no one’s paid to do this—and we’re just going to take their data, and then we’re going to go buy it, and then we’re going to analyze it.

What we hope to do is create profiles. This could change because we’re still in the planning phases.

But we’re going to build these profiles out and hopefully have these individuals, these volunteers that come in, say, “Could you identify yourself on this board?”

It’s all anonymized, so it’s not like they’re going to see their name, but they could see maybe their likes, their interests, something they’ve talked about recently, and say, “Yeah, that probably looks like me.” So that’s our intent, and what we hope happens is they’re able to identify. So even though this data is anonymized, it’s not really; it can still be tied back to a person, and people could identify that. So we’re just trying to—not scare people—but just bring awareness of, “Be careful what data or what apps you download; make sure you’re reading what they’re actually collecting.” Because a lot of times, people don’t. It’s the same thing with license agreements—you’re installing software and you just click next; no one reads those things. It’s important to highlight it. If Apple and Microsoft could, before something installs, say, “Hey, this is literally what they’re going to collect from you. Do you want to allow this?” So we’re just bringing awareness. Maybe we don’t find anything and all this data is real secure and it’s so anonymized that it’s impossible for us to identify individual people, but we’re going to let the people decide if that’s the case.

We’re just going to take their data, create profiles, and let them decide if they can say, “Oh yeah, that’s me for sure.”

Rory Meikle: What’s your hunch? What do you think is going to happen?

Dallas Baker: I think we’re going to be able to create those profiles. We’re going to have them download multiple apps, some that are going to be kind of iffy, like these are weird apps—we want to see how much they’re collecting. But then we’re also going to have them use Facebook, for example. So my thing is, I think we’re going to be able to create those profiles. It might not be as easy as we’re hoping it’s going to be, but I’m sure that we’re able to identify people and what their interests are, because that’s the market: to sell ads to people.

But hopefully, we could even find location—you know, where they actually live or where they spend a lot of their time. If you think about it, let’s say they’re always looking at hiking gear or whatever; we could maybe say that they live in the Rockies, and that’s just a hobby that people do. Or if they’re into jet skis and boats and things like that, maybe we can infer that they live near the beach or the water. We don’t know yet because we don’t know what data we’re going to be able to get back, but I’m thinking it’s going to be pretty easy to create these profiles and people will come in and go like, “Whoa, you knew all this about me and I didn’t even know that about me.” That’s what we’re hoping for, anyway.

Rory Meikle: Yeah, I have a feeling you’re probably right on that. I think you’re going to be able to easily create these profiles. Maybe the work might be a little bit more, like you said, but I think the data will for sure be there to piece together who someone is based on what they put out there online.

Dallas Baker: Yeah, and another thing that we’re going to do, too, is see if we can determine—because once the data is sold, like let’s say Facebook sells your data to the marketplace for ads, someone else could buy that, but then what do they do with it? So we’re going to see if we can identify any chain of abuse where data’s getting bought and sold to nefarious actors, where they may target you for malicious ads.

So you think you’re downloading a really cool app, and maybe it is. Or maybe it’s like what we’ve seen on Instagram or whatever, where it says, “Download this new game,” and the game looks cool, but you download it and it’s nothing like the game at all or the app that you saw; it’s just a bunch of baloney. They’re just hoping you download it, not so you buy or play the game, but just wanting to collect information off your device so they can sell it back or use it for whatever. And so I think what we’re seeing is they’re able to target people, but how are they targeting people? Well, they have to go buy some data so that they can actually put it on the marketplace and hope that that ad lands on that person’s page that’s interested in that.

There are some other stuff, too, where people created fake websites for hunting gear, and people are like, “Oh, that looks like really good hunting gear. Name brands for cheap.” People click on it, and then they put their credit card information in. They never get the product, or if they do, it’s not actually what they bought; it’s some knockoff version. And they don’t care because they’re just there to get your credit card information and your PII, your address, and move on. So we’re seeing that. We’re hoping that maybe we could even go a step further and see if we can identify chains where these publishers are allowing anyone to buy this information instead of reputable businesses that have policies in place to follow the rules and regulations the government set out.

Rory Meikle: So when can we expect this documentary to be out?

Dallas Baker: Well, it should be out in 2023, probably near the end. I’d have to get more—I know that we’re trying to start filming in January through March. Then there’s post-production. It’s not just going to be us; there’s going to be another part to this documentary, too. And so I’m thinking by the end of the year. Latest would be 2024. These things just take time; people have to edit. We’re doing a ton of editing because we want it to be as raw as possible, so it doesn’t look like a movie. It’s a real documentary; this is literally what happened. You’ve got to create the timeline so that, even though we record and do all this stuff, it tells a story that we’re trying to tell through this. There are going to be some other people.

The director lives in the UK, so it’s a ton of travel for him to keep coming back and forth. They have other stuff that they’re working on in addition to ours. So I can’t say that it’ll be out in, you know, September of 2023, but we’re hoping that it gets done this year. The worst case would be beginning of 2024 it would be done.

Rory Meikle: Okay, very cool. I think that’s honestly going to be an interesting topic that a lot of people would definitely check out. Off the top of my head, I really can’t say that there are that many documentaries on cyber in general, let alone cybersecurity and privacy and what happens to your data. I think you guys are kind of paving the way there with a new interest and shedding some light on something that I really think nobody knows anything about. I mean, I’m even one of those people—when the licensing agreement comes up or the terms and conditions, I just click “yes.”

Dallas Baker: Yeah, because if you don’t, I mean, you can’t install it, so you’re like, “well…” No one reads it. “Do I want this thing or not? Okay, yeah, I want it.”

Rory Meikle: Well, what’s the point then? They’re going to take what they want regardless of whether I know about it or not.

You know, but I think we—cyber as a whole, the community—definitely needs to get better at that sort of thing and maybe be a little more transparent or upfront about, like you said, what we are taking and what we’re going to do with it.

Dallas Baker: Most definitely. I know the industry is trying to do some stuff. I’m sure you heard of Apple’s IP relay. Google’s going to be doing the same thing. Google’s also—so in my space, one of the ways you can really identify a user is through their user agent and IP address.And their device. Even though two people are running Chrome, one’s running a MacBook and one’s on Windows, and they have the same IP, we can still target that one device. So Google’s actually removing the user agent.I think it’s next year or the end of this year, they’re removing the user agent and they’re going to go with a user hint. They’ll tell you it’s Chrome, but they won’t tell you what version of Chrome it’s on or any other additional information. Which for us is going to be a little bit of a headache, since we rely on the user agent for some detections, but I think it’s good overall because it removes—It’s good and bad. Bots have a user agent; we rely on that. Or if we see a user agent that is too new or too old, or the weight’s not evenly distributed, we’re like, “Yeah, this is just a really odd user agent that’s just creating tons of traffic for no reason,” and all the other user agents are pretty uniform. So now that they’re going to get rid of that, it’s just going to be a user hint.

We’ll just see “Chrome.”

And it’s like, well, that’s Chrome, but we don’t have any more granular information or detail.

So it’s bad for us, but I think it’s good overall because if you’re concerned with privacy, bad brokers and publishers and sellers aren’t able to determine what browser you’re actually—they know what browser you’re using so they know how to display the information because they use different engines (Safari and Chrome are different engines), but they won’t know which version you’re on, so they can’t use it to necessarily track you. It’s no longer really—everyone is going to be on Safari, Chrome, or Firefox, or some other little version. But for the most part, it’s going to be Safari and Chrome, and that doesn’t tell you anything. So you can no longer use it to track people, which I think is a great thing for the privacy community. For security, we always want as much information as we can, so what we’ll probably end up doing is creating our own version of a user agent string based on the data that our sensor is able to collect on the page. So that’s probably going to be our workaround.

Rory Meikle: Okay.I don’t think a lot of people know—it’s not been a huge announcement—that the user agent is going away, but it is.Anything else you want to share?Important information our listeners should know?Anything about you as we kind of wrap it up here?

Dallas Baker: I would say for our listeners, the big takeaway—and why I still like HUMAN and find it pretty fascinating—is because it’s like an overlooked part of security; it’s like a blind spot. Even at other organizations I worked at, the concern is DDoS, but these bots aren’t trying to take down the server; they’re just trying to abuse your users. So if you’re really looking at that information and you’re looking to have a better way to protect them even post-login, or looking for—let’s say someone else built your website for you—we’re also able to determine if there are any malicious scripts running and what the callbacks are. We have tons of technology. I come from being a web application developer; I developed applications but I never really thought about the security until I was at PerimeterX. So for anyone who is looking, I think it’s super important.

Not that you have to go with us, but just do something about it, because it’s a big issue. Even though you might not think it is, it’s there. Every single customer that we get, there’s always an issue. Even the ones that say, “Oh, we don’t have a bot problem,” we always find one. And so I think it’s just super important for the community. If you have any type of internet-facing application where people can log in, check out, or whatever, you’d be really surprised at what information you’re not aware of. Because your CDNs and stuff like that have bot protection—you click bot protection—but it’s really inaccurate. It’s not collecting enough information to make that decision. So just take a look at some of the other products. Obviously, I think HUMAN is the best. I worked at both companies; tons of great people over here. Yeah, and I really hope everyone has a really good, cool New Year’s goal that they get and accomplish, and that 2023 is the best year yet.

Rory Meikle: Yeah, absolutely. Are there any goals for you that you want to share with us?

Dallas Baker: Yeah, so my goal for the year is to meet two people a week.

Rory Meikle: Two people a week? Okay.

Dallas Baker: And like, befriend those two people and get their contact information. So I’m trying—I’m shooting for 100 people, 100 new friends. I know this is crazy—everyone’s like, “Oh, that’s crazy”—but it’s only two if you break it down. It’s like two people a week, so I can easily go out and find two people to make those connections.

Rory Meikle: Very cool. That’s a personal goal of mine. So what if all listeners want to get in touch with you? Is LinkedIn the best place to do so, or Twitter, or…?

Dallas Baker: I’m on Twitter; I don’t have a lot going on Twitter. Maybe one day. I feel like it’s for celebrities. But LinkedIn or Instagram.

Rory Meikle: Okay. There we go. And we’ll make sure to put those links in the description when we air this baby. Everyone, if you want to get in touch with Dallas, there it is: LinkedIn or Instagram.

All right, awesome. It was good talking to you and hopefully—I’m sure we’ll have you back on again sometime in the near future. Let us know when the documentary comes out if we don’t see anything about it. I think that’s actually going to be something really, really interesting and worth viewing.

Dallas Baker: Yeah, I’ll definitely keep you in the loop of the progress we’re making on that.

Rory Meikle: Awesome. I think it’s going to be exciting; I think everyone should watch it, too.

Dallas Baker: The director—he’s such a cool guy. The whole team, they’re just really amped up and they’ve made some really good stuff. If you go to Almost Pictures— Okay, so they did the documentary on the January 6th thing. That’s like their newest one that they’ve done. If you just go to Almost Pictures, you’ll see it comes up as HBO, but that’s the studio name that’s doing it. Very cool. Look at some similar stuff that they’ve done in the past. If you like any of that stuff—not that you have to agree with what that is—but if you like the content or how they’re telling the story, then I think you’ll like what we’re working on currently with consumer data privacy.

Rory Meikle: Awesome, awesome. Well, we’ll throw that link in the description as well for people to be able to check out. I look forward to talking with you again.

Dallas Baker: Yeah, same here, Rory.

Rory Meikle: All right, awesome. Have a good New Year and best in 2023.

Dallas Baker: All right, see ya.