Security Confidential S8 E9 Greg Tomchick

Manoj Tandon
This is your host, Manoj Tandon. Welcome to another episode of Dark Rhino Security Confidential. Today we have a fantastic guest, Greg Tomchick, with us. He is a first as well because he’s the first professional athlete that we’ve had on the show. We’ve had a laughter yoga coach, Greg, but you are the first professional athlete. Just so you guys know, he played ball for three seasons in the minor leagues with the St. Louis Cardinals. He is also the author of the book “Growing Into You.” He has a driven passion for cybersecurity that stems from a personal experience that he’s going to talk about here in a little bit with a former company of his. He’s currently a partner and CEO at Valor. Valor focuses on identifying and mitigating cyber threats up front and, when necessary, countering cyberattacks with a targeted and strategic set of responses. Welcome to the show, Greg.

Greg Tomchick
Thank you, Manoj. It’s great to be here with you. I’m looking forward to diving in here.

Manoj Tandon
Likewise, likewise. And there’s actually quite a bit to talk about. I don’t know if we’re going to get through everything, but hey, that leaves room for coming back and enlightening our audience a little bit more. So, I got to tell you, we all got to start with the story. You’re a professional ballplayer, right? And a professional ballplayer is a chasm apart from being a cybersecurity executive and entrepreneur. How? Why? What’s the origin here?

Greg Tomchick
Yeah, no, it’s been a long, windy road. I grew up in a military family, so I kind of had a defense mindset background, which really brings me into today. But I always looked at sports, and eventually baseball, as the potential opportunity to pave a different career. So, a long bloodline of military background—my dad’s dad, my mom’s dad—they all kind of joined the military throughout their journey, and I wanted to take a path that allowed me to be the person who could open eyes to different career paths.

Baseball became the passion. I played all kinds of sports. Really, baseball became my childhood dream, the goal I kept going after. I put school aside; I didn’t want to learn anything. It was baseball, and that was really it: watching it, playing it, practicing it, doing everything under the sun to be the best possible player that I could be. I also had an older brother who played in the Kansas City Royals system, so I always looked up to him from a young age. I had a great experience in professional baseball and met a lot of great people. I was able to run a software company while I was playing that I started out of college, and that kind of led me to the technology space. The origin of that is I was an economics major in college. I was able to look at the economy as a multi-dimensional ecosystem that, when things came together in the right order and fashion, they were able to create successful outcomes. I saw technology as a huge piece of that for the future, and that’s why we ended up creating a company called Incubation Technologies, which we’ll get into here shortly regarding the cyberattack.

Manoj Tandon
That’s a fantastic story. And you’re dispelling a lot of myths and telling us that—I mean, most people think professional athletes, economics, entrepreneurship, starting technology—those things are incongruent. But it’s really about applying yourself, and you’re able to do that consistently at a very high level, which is great. I hope it’s inspiring to some of the people listening.

Greg Tomchick
Absolutely. Yeah, that’s the goal. I think it’s about serving others and, you know, I want to use my experience to leave other people better off.

Manoj Tandon
So, tell us about this first company that you started, this Incubation Technologies. What did you guys do there? What was it?

Greg Tomchick
Yeah, so when I was a junior in college at Old Dominion University here in Norfolk, Virginia, they started an entrepreneurship program. I was very interested at that time in how businesses worked, how the economy worked, and I wanted to go out and help folks with the knowledge that I had. I recruited a bunch of folks from the computer science department at the college, and I wanted to help startup and growing companies develop and use technology to grow their business.

At that time in the ecosystem, there were very few software development companies in our area that weren’t focused on defense, but more on the private side. So we basically went out to the market and said, “If you have a business idea, we’ll develop the technology; we’ll get you on the right path to be an innovator in your space utilizing technologies.” And that was really the premise of it. We were able to serve quite a few clients. We grew to about 15 folks on the team. We had a financial person; we had the whole structure that you look for in a company. At least it was forming at that time. mBut, as we’ll talk about here shortly, we were very focused on developing technology and not securing the technology because we were so inundated with the benefits and all the good stuff that technology was doing that we never looked at the downside and what the risk could be of the technologies that we were developing.

Manoj Tandon
And you know what? That is a very common story. You were not alone in that approach. Experientially or anecdotally from being in the business, what we have seen are many companies with good intent—there’s no malice, no ill intent—but the pressures of bringing a product to market, the investments that have been made, and the expectations on the returns become the primary driving factors of the development process. And one of the first things that gets sacrificed is the look into security in a lot of these things, right?

Greg Tomchick
Absolutely. Yeah, it’s an afterthought for most until something happens and they can emotionally resonate with it, which we’ve seen time and time again.

Manoj Tandon
And why is that, though? I mean, intuitively we all know, if you look at the amount of marketing that’s done on cyber just by the regular everyday media—every day there’s a story in the Washington Post, or on CNN or Fox News, whatever your flavor of news is—about something that went wrong, yet we still have that mindset. Why is that? What do you think?

Greg Tomchick
Yeah, I think there’s a couple of different dynamics at play. I think a lot of times cybersecurity is looked at as a very confusing topic, as opposed to the way we look at an industry that is pretty simple: you have these areas, you have critical assets, and these need to be secured. Like you said, Manoj, it all comes down to the mindset. If we don’t train our executives and our leaders to have the right mindset on when they’re going out and innovating and incorporating new projects into their organization, what are the potential risks of us doing this for the business? Not just from a financial standpoint, but from an enterprise standpoint. A lot of times it’s a point solution; maybe they plug in an EDR to one section of their company and they don’t span it throughout the whole organization. So it comes down to culture; it comes down to us as practitioners being able to translate and be put in those situations by those leaders, and then building trust throughout that relationship is key as well.

Manoj Tandon
And coming to mindset: you were a professional athlete. How did that mindset help in your efforts as an entrepreneur?

Greg Tomchick
Yeah, it’s interesting. When I first got into cybersecurity, a lot of the questions I would be asked were exactly that. You were a professional athlete; it was a connector point. It was, “What could we use as an organization that you used to excel at athletics in our business?” Most of the time those conversations were either around technology improvements or cybersecurity. So a lot of them are accountability and the team mentality. It’s all about the people at the end of the day. You can’t do anything great alone. I learned that in baseball. I was a pitcher, so I would stand in the middle of the field with the ball and think about throwing it to the catcher. If the catcher wasn’t there, the people are running all over the bases. So it just instilled that you need somebody there to support you and you can’t do it alone. And when you think you can do it alone, you’re probably going to get stuck in the wrong corner at some point in time. Then there is the continual learning piece. Baseball, just like cybersecurity, is evolving so rapidly with information, data, and technology that you have to be able to be adaptable and to learn and see patterns along the journey from that standpoint. So that’s a couple lessons, but when it all comes down to it, we’re all looking to execute and take action. If we can do that in an informed way—like you guys do for your clients and like we do here at Valor—you put them in a better position at the end of the day.

Manoj Tandon
I couldn’t have said it any better. For those listening, the team approach in cyber is very, very critical. We can tell you that there’s not—at least in our experience—one role or one function that rules the day. It is the combination of all of them that brings to bear your ability to prevent, detect, respond, and recover, as the case may be.

Greg Tomchick
Absolutely.

Manoj Tandon
And being able to find those patterns—oh man, we could do an entire episode on that. That is a deep, deep topic. But you kind of went into this firsthand. So, you guys got a cyberattack on you at Incubation Technologies. What happened?

Greg Tomchick
Yeah, so we had a cyberattack before I knew what a cyberattack actually was, which is kind of a fire under you to be able to drive you toward action. It started in 2014. We were about two years into the business. As I mentioned, we had a couple good clients, we had folks on our team, and we had individuals supporting the operation. We had a SQL injection attack, which is basically where somebody is able to destruct or impact a database that data is stored within.

We put a lot of our critical data in a database that ran a lot of the websites and software that we were developing, and a threat actor was able to find that database and basically corrupt it, which pushed bad content to those applications and the database. In the moment, the fire has started; we don’t know how to put it out. Where do we look? Basically, I tried all different angles throughout the community to try to find somebody to put out the fire in a timely manner. I couldn’t find any organizations in our area that specialized in incident response. That was kind of my lightbulb moment—that leaders need somebody to be an advisor to them before, during, and after a cyberattack.

Obviously you had the big four companies that would help, but we really wanted somebody who could deploy immediately. We didn’t have cyber insurance; we didn’t have the right things in place. So, as I went out to the market and said I want to solve this problem with other great folks, I wanted to make sure that if it happens to somebody else, they know they can call somebody, whether it’s us or organizations that we partner with, or to call their cyber insurance. That’s huge for us these days.

So, I want to make sure that I put people in a better position and organizations in a better position to not be where I was at that time.

Manoj Tandon
That’s fantastic. I’ll tell you what, Greg, this has been fantastic. Thank you for providing some real knowledgeable gems here that are actionable and usable. Don’t be a stranger here. If you put another book out or you got something new happening, drop in for five minutes, say hello, and let everybody know what’s going on. We would always be happy to get your advice and guidance.

Greg Tomchick
Yeah, it’s my pleasure, Manoj. Thanks for having me on, and hopefully this has a great impact on your listeners.

Manoj Tandon
Thank you so much, Greg.