Security Confidential S13 E3 Dave Sobel

Manoj (00:01.432)
Hello, everyone. This is your host, Manoj Tandon. Welcome to another episode of Dark Rhino Security Confidential. Today we have another really awesome guest for you. And he is a podcaster himself, so that’ll save my voice a little bit here and probably be more entertaining than me talking as it is. But Dave joins us. Dave Sobel is a great guy. He’s extremely well known in the industry. If any of you are into virtualization,

He has a long and illustrious history in the virtualization world. But on the business tech side, he’s the host of the Business of Tech podcast, which is a leading IT services focused news and analysis podcast. He does it six days a week. I don’t know how he does it. We’re going to ask him that here in a second. He also co-hosts the podcast Killing IT, or Killing IT, depending on which way you want to say it. And he’s the author of the book, Virtualization.

So Dave, thank you so much for taking time out of your busy schedule and joining us today. Appreciate you having us on the show.

Dave Sobel (01:08.078)
Oh well thanks for having me, this is gonna be great fun.

Manoj (01:10.716)
Oh, absolutely. So I got to start with business of tech. You know, you’re doing the six days a week. How do you, you must have an army of people that do a lot of research. How does this work, man? I mean, we do this.

Dave Sobel (01:27.018)
don’t, in fact, you’re talking to the whole company. So I always say that, well, this is the only thing I do. This is my full time job is producing content, focused on managed services providers, IT services companies, like that’s what I spend my time thinking about. And the basic what’s the problem you’re trying to solve. Most of these business owners do not have the time to keep up with the various trends and technology news, and they want somebody who’s done what they’ve done.

I was a managed service provider for a decade to come in with some insights and analysis to say, okay, here are every day, two to four stories that I think are important that you need to think about and be aware of in your business. And that’s the basic premise of the show. So it comes out every single day, it’s a new show, roughly two to four stories, try and keep it about eight minutes long. So just enough that you can get the insights and analysis you need every single day. And on the weekends, I explore longer episodes with

some interviews and editorials to kind of explore those topics a little bit more in depth.

Manoj (02:32.576)
That’s still a heck of a lot of work. As someone that does this and has the benefit of great talent like Emily, my hat’s off to you. That’s fantastic, and that’s a great mission to be on. And I think those kinds of shows and topics are very near and dear to people. And if they listen closely, there’s a lot of great information that you’re putting out there. So.

Dave Sobel (02:57.838)
That’s what I’m trying to do. So trying to leverage my experience both on the IT, you know, I’ve been an MSP, but I’ve also been a software vendor, I was a lead software vendors for eight years as well. So I can kind of combine the two level of insights. And it’s all about like, how can we help end customers? What’s important in customers? What do they think about? What are their needs? And how can we deliver?

Manoj (03:18.704)
All right, so having been a software vendor, having been an MSP, before that, how did you get into tech? Were you always a computer scientist or a technical person? What is your origin story, my friend?

Dave Sobel (03:35.806)
Oh, I had a computer when I was five. So my first computer was a Commodore 64 for video watchers. That’s the original childhood monitor that I grew up with. I learned a program on that thing. I then, you know, in high school was the computer geek. I took computer science in college. I have a degree in computer science. My first jobs were product development and consulting. And if you’d asked college Dave, I would have thought I’d still be building products all the time through, but.

Manoj (03:40.902)
I remember that!

Dave Sobel (04:04.498)
After some fun rides in the startup space in the late 90s, when they laid off the whole development team and kept the sales and management team, my lesson was, huh, the leaders are the ones that get to keep their jobs. Well, I’m smart as smart as those idiots. I can run a company into the wall just as easily as they can. And that’s when I launched my first MSP. And that was my first entrepreneurial endeavor. And I ran that business for a decade.

Manoj (04:24.887)
Yeah

Manoj (04:31.864)
That’s fantastic. So you went right from a job to entrepreneurship. That, did you have family at the time or significant others that you had to take care of?

Dave Sobel (04:42.414)
I was, I got engaged on the day I got laid off. So I know she loves me because I had nothing that day. But she always said, she goes, you work hard and always had a plan. And she said, I knew you’d figure something out so I had faith in you. But yeah, no, it was my then fiance and I and I launched the first business and you know.

Manoj (04:46.857)
Ha ha!

Manoj (04:52.242)
Wow!

Dave Sobel (05:09.97)
hard work and gumption gets you a long way plus the benefits of good connections and some wins at my back.

Manoj (05:16.952)
Well, you know, hard work and gumption, but just listening to your voice and looking at you on the screen here, you come across as someone with a very positive outlook. Was that always the case? And has that been a major driver in your success?

Dave Sobel (05:31.874)
You know, I’m naturally an optimistic kind of person and the life lesson, you know, is to be a little cheesy on this is the only thing I get to ultimately control is me. I don’t control anything else. I control me, how I feel, how I engage, and how I choose to process information. And I always sort of smile and go, you get up every single morning and you can choose how your day’s gonna go. I generally try and choose that my day’s gonna be awesome because the other option is kind of a bummer.

And I can control that. That’s a choice. And by the way, like, you know, that is, you know, there are exceptions to that, and everyone has bad days, and there are there, everyone has their own challenges. But it’s how you deal with that, that really matters. And you can cultivate good relationships that support you during the rougher times.

Manoj (06:24.796)
So Dave, that leads to a question here on if you had a top 10 list for any of our listeners who are who’ve contemplated, I’ve been stuck in this job and I want to do my own thing. What would be your checklist of am I ready to make the jump or should I make the jump? What would you guide them through? What would be your advice having done it?

Dave Sobel (06:52.578)
it would be a lot of why. And I still almost start every single examination with why. So the first thing I would ask is, well, why are you thinking about this? Let’s talk about what are the things that are bothering you. Because let’s be honest, entrepreneurship is glorified, but it’s really hard and a lot of it doesn’t work. There’s a lot more failures than there are successes in entrepreneurship. I like to celebrate modest successes in entrepreneurship too. Like not everyone has to have a billion dollar company.

to be a successful entrepreneur. But I really want to ask the why, because navigating corporate America and being really good at large companies is a skill. And I admire the people that have it because I don’t have it. And it’s one of the best ways to build economic security for your family, right? Is to be really successful at a big company. So that’s why I would start with why, because I’d like to understand, is it just a mismatch in job? Like they’re good at.

navigating bigger companies, but just that isn’t the right one for them? Or is there you know, some bad boss situation, which is 80% of the time? Or is it, you know, sort of structural, and I’ll use myself as the examples, I’m kind of structurally not fit to be in big organizations, I don’t do really well with the structure in the environments and such. And as you get into that, then it’s understanding my next, you know, and I’m not sure I have 10 full questions, but it’s the

My next question beyond why is talking about risk tolerance. Because it’s my, for me, entrepreneurs who are really successful have a really high risk tolerance and are willing to accept that and they are able to navigate that and understanding the risk tolerance would be the next bit. And the third is the obvious is, let’s talk about your family. Let’s talk about the people that are reliant on you. It’s really important.

Manoj (08:25.59)
Yeah?

Dave Sobel (08:40.466)
very easy to take bigger risks when you’re younger and earlier in your career, when you don’t have a partner, kids, pets, a house, like your risk tolerance changes over time. And so I want to understand who’s depending on you and what do you need to do to be successful. And once I’ve asked those first three questions, we can then start guiding into the specific match about whether or not entrepreneurship makes sense.

because then it’s about like, well, what are you gonna do? What’s the value that you think you can deliver to the market that people are going to pay you for? It’s not as much about having a great idea. It’s also the like, and will people give you money for that idea? And then we work into the idea.

Manoj (09:23.504)
Yeah, that’s right. And you know, there’s a lot to unpack in what you said. But in that last one about the market, that one is brutal for a lot of people, right? Because in their mind, they have a great idea or they have a great product. But the market is telling them, we don’t care.

Dave Sobel (09:30.208)
Hahaha

Dave Sobel (09:52.022)
Yep. Yeah. And you really have the market is brutal. And by the way, incredibly fair, it will tell you will judge you quickly and brutally, but incredibly fairly. Although, you know, again, caveats, but really, your idea is great to you. What you have to do is you have to figure out is are there people willing to give you money for that?

Manoj (09:53.236)
Right? And the market is just brutal.

Manoj (10:03.433)
and

Dave Sobel (10:16.682)
May not be money, may be time, might be attention, might be resources, but whatever the value is, they have to perceive that what you’re delivering is of higher value than what you’re asking for in return. That’s really the key metric and the thing that we’ve got to focus on. And I push on entrepreneurs all the time when they ask me about something, it’s like, well, who’s the people that need money? Tell me what they look like. And in fact, oftentimes, the more they tell me everybody, the more skeptical I am, because

Manoj (10:19.905)
Right.

Manoj (10:45.078)
Yeah.

Dave Sobel (10:46.014)
You know, you actually want to be really specific. I’ll use myself as an example, right? I focus on owners, managers of businesses in the IT delivery space, generally in North America, generally who are running businesses between half a million dollars and 10 million dollars. Like the more specific I get, the more I can be tangible about the value I deliver to those people. If you’ve got some great idea and you’re like, everybody will want this thing.

Yeah, I’m not convinced that’s actually a thing. The more specific you can get, the better.

Manoj (11:20.891)
No, if it’s everybody wants it, it’s a commodity at that point.

Dave Sobel (11:24.242)
Yes. Yeah. Or not specific enough, right? And again, right. And back to the value. Are you delivering more in value than you’re asking for in return? And that’s the balance, the trick. You can be super valuable. And that’s how you command high prices, which, by the way, we like everybody. It’s okay to be super specific and go really deep.

Manoj (11:29.161)
or not specific enough, yeah.

Dave Sobel (11:51.346)
in a very small group of people because that specialization means it’s rare, it’s of high value, and you can deliver strategically, you know, that ninja who dives in there and gets it right, you know, that’s super valuable. I love stories that tell.

Manoj (12:09.868)
And those are rare. I mean, a lot of the firms that we’ve seen, and we’ll get into this here in a second, but are mostly fast followers, or it’s a me too play in the industry. The genuine innovator, that’s a, you see those, but they’re rare birds. They’re not.

Dave Sobel (12:27.198)
Yeah, and particularly if we’re dividing between product and services, right? Because the two are the two are different. And I’ll freely admit, I am much more focused on services, which are it’s almost easy, it’s easier to start up, it’s easier to deliver high value. It is much harder to scale and they have limitations on that. And it’s and it’s a choice, right? So like product easier to scale, easier to grow up, much harder to get started.

They are different approaches. They have different skill sets, but it’s important to think through that kind of stuff. I love services because I can go super niche really fast. And I always joke and tease people that the more boring it sounds, the probably the more profitable it is. Anybody know anything about medical transcription in highly regulated industries? I mean, I can throw a couple of buzzwords together and the more boring it sounds,

the more I can tell you like, yeah, I bet there aren’t a bunch of people that do that well. And you can really excel in the value particular as boring as it might sound.

Manoj (13:33.068)
That’s a very interesting take. I have not actually heard anybody articulate that. Because usually, you think of the polar opposite mentally, that you want excitement. You want the great offering, the one that generates a lot of buzz. I’ve never seen anybody say, well, that’s kind of boring. But I can make a lot of money at it.

Dave Sobel (13:58.058)
I, well, because the other thing about it is, is remember boring is all perception, right? It’s the, anybody that understands complexity knows that you can find really interesting things really fast in interesting complex problems. And interesting is simply defined by the person working on it. And I, again, my almost fantasy ideas, medical transcription in a highly regulated industries. Well, that means you gotta know a bunch of stuff.

You’ve got to know medical information. You’ve got to understand patient privacy. You’ve got to know data management. You’ve probably got to know finance management. It’s like and there are all kinds of subtleties to all of those little those disciplines and anybody who becomes an expert in something actually ultimately does become really passionate about it because the subtlety the complexity. It’s really interesting.

And that’s where the interest stuff lies is like, Oh, well, how do you make the determination between A and B when the criteria are super close and we get into these arguments and philosophical debates, right? Like all that kind of stuff. And well, that complexity can be really fascinating. Most people that are really deeply knowledgeable about something also know they don’t know a lot and keep loving learning.

Manoj (15:19.0)
That’s, well that was worth the price of admission to this show.

Dave Sobel (15:24.242)
I’m here. I love finding this cool stuff like ever. And by the way, like everything that is glitzy and glamour, tons of people are chasing. You know, why do you think everyone wants to be an actor? Right? Because it seems really exciting. And you know what there are? Too many actors. They don’t get paid very well. Most of them don’t get paid very well because there’s too many of them. And so you kind of have to know that sometimes glamorous, exciting

Manoj (15:44.301)
DUMB!

Dave Sobel (15:53.422)
that should be a consideration of a warning signal. There’s probably too many people trying to do that. And if I’m in the business of finding value and finding ways to build businesses and create ideas, I like areas that aren’t well explored.

Manoj (16:12.324)
And you know that that’s actually a foundational tenant of our entrepreneurship is that you have to be willing to do what others are not willing to do. So that means you’re going to go into unexplored regions or do something differently that someone else. Isn’t willing to do or hasn’t figured out on you yet.

Dave Sobel (16:32.554)
Right. And by the way, oftentimes they call it boring. Is those people, oh, that sounds boring. That doesn’t sound very interesting. That’s why they didn’t go there. But you know what? Maybe they had, maybe it’s the exploration and the learning. That’s, that’s a good portion of the fun.

Manoj (16:50.468)
Wow, no, that’s very good and very sage advice. I love it. That’s fantastic. And speaking of too many people, there’s too many podcasters out there too, right? But yeah.

Dave Sobel (17:02.01)
Well, except what we like, we like, I mean, again, we’re dissecting our own industry a little bit, but like, there aren’t actually that many that have created more than 10 episodes or that have been doing it for a consistent period of time. Apple talks about some numbers like four million podcasts out there.

Manoj (17:16.245)
Yeah, that’s what I’ve heard. It was like a crazy number. It’s in that

Dave Sobel (17:20.062)
Yeah, but if you actually, if you start putting some numbers on that, like, well, how many have actually produced more than 10 episodes and have actually, and are still active in the past 30 days? Well, the number comes down to like some 600 or 700,000, like right away by just putting those two metrics on it. And what if we, you know, and then we put into the ones that are actually like, you know, that have an audience larger than 50 or a hundred downloads. Well, then the number comes down even faster,

Again, it’s not easy to do those things to have a successful podcast because of the requirement to continually do it and deliver content on a regular basis, the consistency, the production of it. Like actually the numbers come down really fast. So you’re right, it feels like everybody’s got one, but if we start slicing it and saying, well, how many actually have ones that are a thing? The number gets smaller a lot faster.

Manoj (18:20.416)
Fair point. Now, I’m going to just pick on cybersecurity and tech. I can think of at least two dozen that would fit the criteria that you just outlined. Yet you went ahead and started business of tech. Is it IT or killing it? Which way do you say it?

Dave Sobel (18:41.078)
We say it, killing it, but the pun is intentional. Ha ha ha.

Manoj (18:45.088)
It’s intentional, okay. I didn’t know, and I’m glad I asked that question. So what business of tech you very briefly described at the beginning, what is in killing it? What was the impetus of that coming into?

Dave Sobel (19:02.526)
Yeah, if Business of Tech is sports center, then killing it is, pardon the interruption. It scratches a different itch. So for me, the flagship podcast for me, what I do is Business of Tech, and that is a focused news and analysis, but killing it, we do with my two co-hosts and it’s designed to sort of let us mix it up.

Manoj (19:20.228)
Okay.

Dave Sobel (19:28.618)
and be a little bit more freeform and have a little bit more fun with a slightly longer format. And we do that kind of, you know, on a semi-regular basis, either quarterly or special events in order to sort of throw out ideas and topics that we wanna analyze and talk about a little differently. And there’s a very different feel from my newscaster style on Business of Tech to what I can do in a bit of a freeform discussion over on Killing It.

Manoj (19:55.156)
Yeah, and that’s not six days a week then, as you mentioned.

Dave Sobel (19:58.278)
No, that’s a that’s a it’s a lighter load on that in terms of what we’re doing.

Manoj (20:01.232)
life. So then you’re familiar with a bunch of the news and the trends out there. Give us some trends that you’re seeing in the business and from the business of tech. What are some big idea things that you’ve seen come across your desk in the last year?

Dave Sobel (20:18.374)
Well, I mean, I would be remiss if I didn’t lead off with AI. Like that’s just the, the absolutely, I mean, I, I mean, come on. That’s the whole bit. Now I will tell you, my, my approach on it is the, I think there’s a fascinating space for service providers around helping with frameworks and ethical considerations of implementation for customers.

Manoj (20:23.459)
Ha ha!

Dave Sobel (20:41.174)
This is a fascinating technology. The reason it’s interesting was the adoption was so fast, the integration into product lines, so obvious in many places. And a solid C-level writer for every single deployment that we’re seeing can actually be very useful. But there’s a lot of open questions around what’s appropriate use, what are the right ways to do it, how do we handle issues of

copyright management, data privacy management, bias, you know, all of those kinds of issues. And every organization is going to need to take on those questions themselves. And I love spaces like that, because that is exactly the kind of consulting and guidance that IT services companies, managed services providers should be delivering to their customers. Because it’s not just what technology to use, but why and how.

And the why and how is the interesting bit.

Manoj (21:41.924)
So here’s the thing with this, and I’d love to get your take on this, so I’m going to ask it. Why does common sense not prevail? Now let me also give some color to that question. So when you look at AI, it is, as someone in the engineering field to me, it’s very fancy matrix multiplication, linear algebra. It’s pattern recognition. You’re finding.

things that already existed and were hiding in plain sight or were always available. It’s not like these things were discovered. These patterns have always been there. Also, the data that enables those patterns to come to life was freely given by us or by whatever sources that they were gathered, but it was not like someone put a gun to someone’s head to get that, it was given to them.

So why is there such an ethical issue or guidance needed where simple common sense, why doesn’t that just prevail in driving the adoption and deployment of the technology?

Dave Sobel (22:55.854)
No, well, because why doesn’t that apply in almost every area? Why doesn’t common sense apply in legal jeopardy, for example? Because that’s, I mean, like literally our system of laws is not just, hey judge, have an idea of common sense. It’s the subtlety around it that’s the interesting bit. So let’s give sort of a practical example of which I will say I am not a lawyer and I am not.

Manoj (23:04.668)
Ah! What?

Manoj (23:19.172)
Please.

Dave Sobel (23:22.634)
You know, I’m not such a deep scholar on this, but I can at least outline some of the basic problems. Is the ingestion of all of the information that large language models done, is that fair use under copyright and creating derivative works when used in a way to say, I’d like to, it ingests, say my writing.

And a user then comes back and says, which by the way, is copyrighted. I own the copyright to my own material, but if a large language model ingests it and then someone else comes back and says, write blog posts in the style of Dave Sobel. Is that a derivative work? Does it fit under fair use? It’s generated by a machine versus a person, so it loses some of the obvious protections.

It’s not necessarily clear that it’s exactly the same thing. And yes, so you might say, well, let’s apply some common sense. Oh.

Manoj (24:30.424)
Yes. And I would say what’s the difference if I copy your work, if I did what you’re just saying and I wrote a blog post in the style of you, I think that would be considered plagiarism to some degree.

Dave Sobel (24:45.91)
Right, but it’s also hard to do because it’s just you, but throwing the AI admins now we have infinite capacity. So it’s probably not worth your time to plagiarize me directly because it’s a little hard to do and it takes time for you to do it. And by the way, me worrying about it is not as high because of the scale. But if there’s an, but if there’s an infinite capacity,

Manoj (25:08.009)
Yeah, especially with regards to me, you don’t have to worry at all.

Dave Sobel (25:14.786)
to do that by every person, every potential content writer with a click of the button. You know, by the way, I don’t have such a big ego to think anyone’s gonna actually use me, but I can talk about myself in the example. Then the scale’s different, right? Now we’ve got an army of content generators out there for every business out there that says, you know what, I’m just gonna steal Dave’s stuff. And I’m just me and I can’t fight back against an infinite army of bots.

necessarily. So you ask what’s different. It’s like, well, the scale of this and the computer, because the compute is now cheap enough and robust enough that anybody can do it at any scale at any level. That’s some of the that’s the area where I say like, well, that now the dynamics of the market have changed in terms of the value of that stuff. My unique voice does actually have some value.

Manoj (26:13.869)
Yes.

Dave Sobel (26:14.602)
If we’re doing about a security thing, there’s no actual law right now that says I own my voice. So if it gets cloned, right, and reused in a deep fake scenario, there’s no law about using my voice. Common sense says it’s Dave’s, it’s unique. The sound and timber and the way that I speak, common sense says that’s mine.

Manoj (26:41.003)
Sure.

Dave Sobel (26:43.49)
but the legal protections aren’t there for it. Do I own my digital twin? What happens when someone else creates one, uses it? If they break the law, that’s one thing, but if they just start generating content in my voice, what’s that?

Manoj (27:03.096)
But comedians do it all the time, right? Look at the impersonators out there. There’s people who’ve built fantastic careers impersonating celebrity personalities and politicians.

Dave Sobel (27:12.706)
But they aren’t passing them as soft as me. They don’t passing them. So they are not they are not that they are not saying they are that person right and parody is allowed and satire is allowed and I’m not talking necessarily about that scenario. I’m saying about what if somebody starts doing a podcast doing news in and out, right?

Manoj (27:29.492)
Yeah, well, I would say that’s just blatant. That to me is just theft then at that point because

Dave Sobel (27:34.67)
But I’m not protected, but you say it’s theft, I’m not actually protected under any actual law.

Manoj (27:40.556)
But again, common sense. It’s like…

Dave Sobel (27:42.85)
But the moment you say common sense, we have to write it down in order to make it something that we can manage, right? Because we’re gonna have every derivation of this. And if we leave it to common sense every single time, then people are gonna interpret wrong. And I like to tie this back to implement it in a company. If you let common sense drive the decision of a 500 person organization, you don’t give everyone guidance, their own common sense may be slightly different.

Manoj (27:48.683)
Ruh.

Manoj (28:13.124)
Sure, because…

Dave Sobel (28:13.174)
I, right. And so you’re going to end up with 5,000 different outcomes when the business is trying to get to a consistent set of outcomes in order to have predictable behavior. And I don’t know, make some money, right? And we all like predictable behavior. And in order to get to that, we have to define some of this stuff and we have to define the outcomes. And that’s where, and that’s why any of us that are into people process and management.

which is I know a big thing in security, right? Is we’ve got to make sure that we’re doing things in a process perspective. We can’t simply leave it to common sense. And by the way, let’s smile all those people where I’m on a security podcast. How’s that common sense working on password management, everybody? We’re going to leave it to users to pick that. How’s that going?

Manoj (29:03.524)
You know, you look at, I mean, this is, you’re talking about user behavior. To me, that’s one of the biggest, if not the biggest problem in cybersecurity, right?

Dave Sobel (29:15.755)
And you have now made my point of why we don’t necessarily leave that to common sense, because user behavior is not always predictable and reliable in a way that necessarily makes sense to the outcomes that you’re looking for.

Manoj (29:30.032)
Right, but you know what it is because at least I’ll just speak for cyber security. I think in our field, in the cyber tech field, infosec I should say, users, the average user, there’s one a perception issue and perception is reality that cyber security belongs to a group of people that hide in a back room somewhere and do whatever it is that they do. Two,

The average person doesn’t believe that they can actually impact their own security profile. And I think both of those stem from the fact that they don’t understand the whys of behavior, why certain behavior can become a problem. It hasn’t become tangible to them. Like it is tangible. Don’t touch a electrical wire.

Period. You know, don’t play with fire. You know, those are tangible things where people, everybody understands what the outcomes of those things can be. But when you look at cybersecurity, which is a behavioral problem primarily, we haven’t been able to make it tangible for the average person for common sense to actually prevail. Because they just, it’s not something that they are intimate with.

Dave Sobel (30:57.458)
Well, we’ve wandered into, you asked what my top topics were that we’ve wandered into one of the second areas, right? Which is all of this stuff. So this is where I like poking at this. So I never positioned myself as a cybersecurity person, right? I’m a generalist IT person, and I’m much more a business person than I am a, frankly, I don’t like spending money on security. It doesn’t make me profit. It doesn’t make me more revenue generally. Like as a general rule, when I spend money on cybersecurity, it is a cost center, not a revenue generating center.

Manoj (31:01.218)
Yeah.

Dave Sobel (31:27.33)
So as a business person, I’ll go, I only have a dollar to spend. Cybersecurity gets, I don’t know what, 10 cents of that? Maybe a quarter and a really, right. So, and by the way, I don’t like spending it. The other 75 cents, I’m trying to get another buck back. The 25 cents I lose on security, right? I like poking a little bit at the consequences. So…

Manoj (31:38.062)
Yeah.

Manoj (31:41.853)
Yeah, dad

Dave Sobel (31:55.786)
Well, what are the consequences we’re looking at for a user? How many people lose their jobs over being the breach vector? Probably not that many, really. Not that many. How many, there’s business. Well,

Manoj (32:08.864)
Not that many.

Manoj (32:12.984)
Well, the sizzle does depending on the size of the breach. They usually, that’s the fall guy.

Dave Sobel (32:18.226)
Maybe, I mean maybe, you know, like, so I’m gonna poke, you know, I’m gonna laugh and go like, so disclosure, I worked there, but before the breach, SolarWinds, right? One of the biggest hacks we all love to talk about. Nobody actually like went to jail or got like, like over any of that stuff. Tim Brown’s now under scrutiny from the SEC, yeah, but by the way, the company itself deflected lawsuit after lawsuit. Nothing happened over.

The U.S. government paid the bill. And so I look at it and I go like, I get it, but at the same time, what’s the actual consequences of like really doing that stuff? It’s financial for the business, but beyond that? It’s…

Manoj (33:06.12)
Yeah, there isn’t much. And I guess I would poke at that the other way and say, should there really be? I mean, if the person, if the solar winds won, I mean, it was extremely well engineered. I mean, when I look at how the bad guys did it, that was good. It was a good.

Dave Sobel (33:27.078)
And by the way, I’m on board with you. But what’s the realm of, what’s the realm where we actually wanna have some, you know, like some accountability? If we played a game and if we went out and we interviewed Americans on the street, a majority of them think there are laws to protect their data and create privacy. And those of us in the industry know they’re wrong.

Manoj (33:30.354)
I could…

Manoj (33:52.376)
Dave, we gotta do that. That is actually a podcast episode. I think that you should do it.

Dave Sobel (33:59.095)
100%.

Dave Sobel (34:02.474)
Well, I don’t even have to, the research is done. I covered it on my own show. Like I’m saying that from actual research. Research firms went out on the street and interviewed Americans and asked them if they thought their data was protected under regulation, under federal law, and the majority of Americans believe that. And they’re wrong. We know that, right? Any of us, they’re totally wrong, but they believe it because by the way, common sense.

Manoj (34:24.868)
They’re totally wrong!

Manoj (34:31.7)
perception is reality. Yeah.

Dave Sobel (34:33.405)
Common sense says that there should be laws to protect it. Your data should be yours. Common sense says it should be protected, but it actually isn’t. It’s a fascinating space.

Manoj (34:42.736)
Yeah, but the flip side of that, Dave, is how are you getting these services for free? So there is nothing that is free. So when you sign up for Facebook, or you sign up for Gmail, whatever, and it pops up that, do you read the end user license agreement and what they can do with the data? It’s not like these companies are hiding what’s happening with it. If you read the agreements,

A lot of, most of it is all in there. Just read it, right?

Dave Sobel (35:13.034)
Yeah, sure. By the way, I’m on board. But again, this is also like this is the fun of regulation, right? Is that if I ran a chemical plant, the cheapest way to get rid of my waste is dumping into the river. So I’ll put my plant next to the river, right? But society has decided that it doesn’t want three headed fish, like on the Simpsons. And so we have regulations to say you’re not allowed to just throw your race into the river.

Politics is the debate over what clean is defined as and all of that kind of stuff But as common sense says we don’t actually allow We want to have clean water. We don’t want the chemical plant to put glowing green waste into the river And so that’s the fun of the of the discussion here Is is that we actually do need to get to a realm and I cover a ton of regulation and the discussion around it on the show because I think

our communities, both of generalist IT and of security professionals, need to be involved in these conversations in order to get us to something that documents what we think makes sense and puts in place some framework to make this real and make this a thing that actually happens. I’ll give you another one that I think about all the time when I think about a cybersecurity thing. We talk about phishing and spam all the time.

Manoj (36:30.98)
Please.

Manoj (36:34.946)
Right?

Dave Sobel (36:35.626)
Why are we running on SMTP? It’s a 40 plus year old technology that has no authentication running in it, yet the backbone of communication still is an unauthenticated protocol that none of us have gotten rid of. And we keep bolting stuff onto the side of it, but in its core, it is not designed to do that. And you know what, if Google and Microsoft decided…

to get rid of it and went from SD television to HD television, because by the way, we did that move and we all decided it was a good thing. You know what I do? I would give them money for secure email. I would give them money to actually know that the person I’m getting the email from is who they said they are. I would pay for that service. And I know most businesses would, because by the way, they pay for email now.

Manoj (37:06.849)
You’re right.

Dave Sobel (37:25.398)
They pay for email now. They just want, wouldn’t it be great? And we could wipe out a good portion of phishing which works, by the way, we know it works. If I actually knew I could validate who that user was on the other side.

Manoj (37:43.586)
out.

Dave Sobel (37:46.794)
Yeah. And, and what I say to that, those portion is tough. S like, well, seriously, what, what do we want? Do we want to have a world where we can actually build some level of trust? And do we want to build security into this where business owners can operate their business and get, and know it’s who they set, who they got back. We have other systems for validating. We know we have to do that in, in analog. I’m not in the business of protecting bad ideas.

That’s those older industries. I mean, the end of creating value for business owners, and you know how we can do that? Wipe out a whole bunch of those other industries. That is actually the way to get into that. I’m not in the business of protecting email protection software. I’m in the business of delivering value in IT to business owners.

Manoj (38:37.088)
And see, you know, the other side, I love this conversation. Playing the devil’s advocate here, I’d say most people, most companies give cybersecurity lip service at best. It’s a checklist item. They’re really not interested in solving the problem per se, but they wanna say, look, I met my compliance standard. Check, check, check. I have implemented A, B, C, and D.

Dave Sobel (38:51.382)
Right.

Manoj (39:05.868)
And that’s per our industry norms. Check, check, check. None of that good compliance doesn’t mean good cybersecurity. That’s a totally different ball game. So it’s.

Dave Sobel (39:19.087)
Yeah, right. But the first time a CISO takes a perp walk, this industry changes.

I’m just saying, and I in a way, I’m advocating as larger society outside the security industry. I’m advocating for business owners. And you know the quickest way for me to, I mean, if I was getting into politics, the way I would do it is I would say, I’m gonna run for secretary of state in states, and I’m gonna protect small businesses. And the way I’m gonna do that is I’m gonna put actual consequences around breaches and violations

Manoj (39:31.969)
Well.

Dave Sobel (39:59.798)
and I’m gonna hold accountable. I’m gonna start finding in serious ways the implementers of this if you are not doing those protections. And you know what? It’ll end up with somebody in jail. And you know who’ll vote for me? The business community on both sides will happily do that because then they have accountability against losses on phishing attacks and breaches. Because we know it costs everybody money.

And if I could pin responsibility on it, they would absolutely vote for me. Now, by the way, I’m not, for all you security people that are cringing right now, I know what I’m doing is pandering to people that don’t necessarily understand the role, but you can completely see how I get people to vote for me on that, wouldn’t you?

Manoj (40:46.732)
Oh yeah, it’s a great platform. You probably would get elected to office.

Dave Sobel (40:52.35)
Right, and then if I start doing it, like, so, and I just want, I just want the.

Manoj (40:56.209)
then you would have nobody be in the cyber security business. It’d be like, you know what? Forget it.

Dave Sobel (41:02.902)
But actually, think about that for a quick moment. No one would be in it, but then there’d be a void and new solutions would flow in. And it would become really interesting for us to re-examine the space, not wanting to do it the way we’re doing it now, under a different landscape. Entrepreneurs always figure out ways to deliver value in spaces like that. And I would change the dynamics of the game.

Manoj (41:29.835)
So here’s the thing.

Manoj (41:34.196)
I love it because if you don’t like the way the chessboard is arranged, rearrange the chessboard, right? Which is essentially what you’re advocating for here. And one area, one example, like the Biden administration wants to hold software developers accountable for security flaws. I’m oversimplifying, but…

Dave Sobel (41:40.313)
Rearrange the chessboard.

Dave Sobel (41:56.766)
Yeah, but we get the idea and I’m right on board with you.

Manoj (41:59.848)
Right? What about the concept of why is it and I saw the Secretary of State, ironically, for the State of Ohio, I believe is the one that’s implemented this. They welcome hackers. They’re like, look, if you can hack into our systems or hack into our website, if you tell us about it, there is no consequence to this. And you tell us what you found is the flaw so that we can go fix it. Right?

If you, why don’t other companies or agencies take that approach where it’s like, look, we’re not going to catch everything. System design is going to be flawed always. But right now, the laws are structured in a way for you and the good guys. You can’t really go in and point out obvious gaps because technically it’s illegal.

Dave Sobel (42:58.002)
By the way, 100% on board with you. We should change the rules of the game here. This is where like I think, but I will also say like we do have rules that do allow this kind of stuff in other industries, by the way, particularly if we look at whistleblower style laws to reveal probably like, we have structures that work, we have simply not necessarily applied them in software. But with the way you can do, we have protections for whistleblowers, we have processes that are managed for product recalls.

Manoj (43:13.141)
Right!

Dave Sobel (43:27.402)
for notifications, for the differences in liability, in children’s toys, or in car manufacturing. We have structures that allow us, we’re just not applying those same rules in software. And in fact, we’ve sort of let software do whatever the hell it wants, right? Because the ELA, if you put all the, this is all in the license agreement, and you can do whatever you want, you’re completely at risk, and all of those things, we kind of let software companies get away with.

whatever they want. So, you know, I think that the it’s a matter of changing the rules of the game to apply them. And by the way, this is never perfect. And anybody who always says, Oh, we need to get a perfect regulation. Well, that’s not how regulation works, everybody. And actually, they pass the regulation and then it gets tested and vetted through case law and precedent and actual implementations like it’s an ever evolving field.

Manoj (44:12.696)
Mmm.

Dave Sobel (44:24.65)
And anybody in compliance, that’s by the way, how you all make money, because you’re tracking all of the various ways that this works. So in a way, we’re creating a different version of the industry to apply these new rules and the way the new structures would work in software. We just create a new set of industries and compliance rules and value consulting and cha-ching, cha-ching. Like I like all of this kind of discussion, but we’re changing the rules of the game.

Manoj (44:55.408)
Which is at the heart of this, right? And that’s the heart of a lot of things that you’ve said here, is that change the way you look at things and change the rules of it. And that is all because the existing, you know, at some point you reach a point of diminishing returns with incremental changes. You can only incrementally change so much before, you know, it’s…

Dave Sobel (45:15.466)
Right.

Manoj (45:20.8)
You never get to your final destination because you’re incrementally just getting closer and closer and closer, but you never really get there.

Dave Sobel (45:26.114)
Well, and it’s the sunk cost fallacy, right? The, you know, is everyone always talks about the sunk cost, the investments, the investments. Those are all in the past. Those have all been spent. You got your money back on all that. That is a fallacy to re-examine the previous investment. You simply have to look at the investments of the future and what the returns on those are. And that is the game. That is the way that you look at it. And you’ve got to look, yes, you have assets and stuff you’ve done, but at the same time,

The world changes and you need to invest in the in the new in order to create new opportunities and that disruption is generally very good for most businesses to find new interesting ways. And anybody that’s holding on to the old ways. Well they’re just protecting a previous you know a previous position in the market. I’m in the.

I’m in the small disruptive business. So that’s not my job to protect those people. My job is to look out again for those small to mid-size entrepreneurs and smaller and mid-size businesses that have the ability to be flexible and find new ways.

Manoj (46:32.108)
Absolutely. But, and as you’ve seen in the real world, there’s so many examples of heavy resistance to that. But in the end, it’s really impossible to stop change. I mean, if you look at it, in the end, it’s just a tide. So you can slow it down, but you’re really not gonna stop it.

Dave Sobel (46:49.294)
Right, and by the way, I look at this and say, I don’t necessarily have to change everything in order to find a cool opportunity. The opportunity actually can be in a much smaller scale with a much smaller group to make a difference. And I can build great businesses in those spaces that are doing great work for customers. I don’t have to change the whole system. I just have to think differently for enough of them.

that I build out a business and do something really interesting. And that’s the key thing for me is that we think in the big terms and then find small ways to make changes in the way we do things that create a competitive advantage.

Manoj (47:31.076)
So there was one item that I wanted to get your opinion on since you hear so much in the news. Now, I love it. You’re fantastic. You know, again, getting back to our friends in the Biden administration talking about hack back, offensive cybersecurity. What are your thoughts on?

Dave Sobel (47:37.822)
Because I’m very opinionated. It’s… Well, thank you.

Dave Sobel (47:55.358)
Absolutely. We’re already doing it. Why don’t we just talk about it? Like, like, does anybody actually believe that the US government does not have an offensive cyber capability? Like. Right.

Manoj (48:05.764)
Well, of course, the government does. So now he’s talking about private businesses. So as a private business, I see challenges with that.

Dave Sobel (48:18.638)
So I think it’s an interesting intellectual exercise. By the way, we do have physical competition and offensive capabilities within business, right? There are tactics and implementations that could be called, you know, that are offensive, not in the I’m making fun of you kind of way, but in the I am going out and being proactive about being a proactive aggression.

Manoj (48:39.965)
Yeah, I didn’t know…

Dave Sobel (48:47.614)
against competitors is a thing. Anybody actually want to dispute that corporate spying doesn’t happen? Because by the way, I’ve had a corporate spy on my show. Like he’s talked about the, right? So this is a version of that, right? The private offensive version of that is a thing. So I’m not necessarily interested in that space as much.

Manoj (48:57.866)
Oh yeah.

Dave Sobel (49:16.406)
I tend to skew a little bit more toward the like, this is a reason why I don’t like private militaries because that’s a service that the government delivers for us. So I’m inclined to believe that the right place for that offensive capability is with the government because it fits the same parallel. But at the same time, I’m gonna acknowledge that I live in the real world and I know that there are offensive.

capabilities within large organizations, I would not be surprised if cyber is one of those. And so I’ll look at it and sort of say, I think it’s worth experimenting and understanding that, and then having a good feedback loop with government to make sure that we define the rules of the road. I always look and say, the government defines the rules of the game, and let’s-

have a good feedback loop there to make sure that we’re not getting into bad areas. We’ve decided as society to not use certain kinds of weapons. The classic example is both chemical weapons, but also there’s offensive laser weapons that can blind all attackers on a battlefield. You can shoot a laser out and blind everyone. And governments have come together and decided that that’s not a technology we want to deploy in warfare because we’ve decided that that’s what we want to do.

not something that we’re comfortable with. That’s a feedback loop that creates those kinds of good decisions and decides what the rules of the road are. I’m looking for that feedback loop. So in a way I’ll sort of circle back around and say, the fact that the Biden administration is talking about it means that they’re injecting themselves into the feedback loop, which allows us to have open conversations about what that means.

Manoj (51:04.444)
And that’s fantastic. And with that, we’re already at the hour here, Dave. So I wanted to give you a minute, if there’s anything you would like to advise our listeners of, you can plug anything you’d like if you want to take a moment.

Dave Sobel (51:19.27)
I appreciate that. I hope everyone takes a chance to listen to my show, the Business of Tech. It’s on all your favorite podcast platforms. You can find all the links at businessof.tech. You get the sense of the way that I think about the world. I’m looking for ways that we can find interesting opportunities out of the things that are happening around us. And what are the challenges that we can help business owners with and build good businesses around doing that?

So I’d love to have a heavy reach out. I’m easy to find. I’m on LinkedIn all the time. That’s the easiest platform to find me on and all the links again at business of dot.

Manoj (51:56.172)
Dave, you’ve been fantastic. And don’t be a stranger around here. Drop in every once in a while. Say hello. And

Dave Sobel (52:04.475)
I’ll come on in and be disruptive anytime you need me to be. I’m always happy to show up

Manoj (52:08.296)
Yeah, this was fantastic and we really appreciate your time. And we’ll put links to your show in our show notes. So.

Dave Sobel (52:16.346)
Awesome. Well, thanks for having me. This is really great fun.

Manoj (52:19.416)
Thank you so much.