Security Confidential S9 E2 Kenneth Ellington

Manoj Tandon: This is your host, Manoj Tandon. Welcome to another episode of Dark Rhino Security Confidential. Today we are honored to have Kenneth Ellington join us. He’s got a heck of a background.

Kenneth is a Senior Cybersecurity Consultant at EY, and he specializes in SIEM and SOAR. We’ll get into that a little bit later. He’s also the founder and owner of Ellington Cyber Academy, an e-learning platform that teaches and trains people on how to use various SIEM and SOAR technologies so that they can transition or upskill themselves in their careers, which is a very noble goal.

On top of that, Kenneth is also a part-time associate cybersecurity instructor at the University of Houston and a cybersecurity trainer at Blacks in Cybersecurity.

Welcome to the show. How are you doing today, Kenneth?

Kenneth Ellington: I’m doing pretty well. It’s kind of cold outside for Dallas, but other than that, everything’s been pretty good so far.

Manoj Tandon: Oh, so you’re down south in Dallas. Tell me what “cold” is.

Kenneth Ellington: I mean, I grew up in Tampa, Florida, so our winters were like—if it ever dropped to 50 degrees, people started freaking out and putting on winter coats and boots. For the past week, it’s been in the 50s and 40s, so to me, that’s cold.

Manoj Tandon: That’s a nice spring day in our neck of the woods. I’m up here in Pittsburgh in the Northeast. 50s? Man, that’s a good day. You can go out in a t-shirt. That’s not sweater or hoodie weather. That’s cool.

But you grew up in Tampa, so I can see how you could see Dallas being a little cold. It makes sense, especially if you’re not used to it.

Kenneth Ellington: It’s a work in progress.

Manoj Tandon: When did you get to Dallas, by the way?

Kenneth Ellington: I graduated in 2020 from USF, and I moved about nine months after, like late winter of 2021. So, I’ve been here for almost two years now.

Manoj Tandon: Florida seems like a nice place to live. A lot of people would say Tampa is a good town. Why move?

Kenneth Ellington: Well, I moved because they gave me a job offer for my old company. They paid me a good sum of money, so I moved.

Manoj Tandon: You know what? That’s motivation, I guess. That’s a good reason. I didn’t know if you had done that just because you thought Dallas would be a good place to be. Thanks for sharing.

Let’s talk about your background. We talked briefly about how you got started in Tampa, but I understand you were in the deli business at one time. Now you’re in cybersecurity, which is interesting in and of itself.

Since we are in the holiday season, I can’t resist asking: Do you have a sandwich recipe or an idea that you can share with our listeners that they can make themselves over the holidays? That would be great.

Kenneth Ellington: Well, my favorite sandwich—and this is probably true for most people that go to Publix in the South—is the Chicken Tender Sub. What I normally do is toss mine in Chipotle Gourmaise, which is like a spicy chipotle sauce. I add salt and pepper, lettuce, onions, and green peppers, and then we toast it with butter on top.

As long as you can fry the tenders, you can probably make the recipe at home.

Manoj Tandon: That’s pretty cool; that sounds good. When you’re making the spicy sauce, are you using jalapeños, habaneros, or how spicy is spicy?

Kenneth Ellington: It’s not too spicy, in my opinion, but I’m used to spicy food. We use the Boar’s Head Chipotle Gourmaise that comes from Boar’s Head. It’s not overbearing.

Manoj Tandon: As a follow-up—just more of a curiosity from someone who’s been in the business—how important are the ingredients? If you buy the ingredients at your local deli versus your local grocer, or going to a Whole Foods or Trader Joe’s, is there a difference?

Kenneth Ellington: Yes, there is. Quality is super important. One of the reasons why I hate shopping at Walmart, among other things. It does matter a lot where you go to shop, especially for actual whole foods.

Normally, I try to stick to Publix or Whole Foods for my ingredients because they’re normally pretty high quality. If you use crappy ingredients, you’re going to get a crappy product. Normally, the more you pay, the better it’ll taste. Not always, but in most cases.

Manoj Tandon: I guess that advice could apply to a lot of different things in life generally speaking, right? If you don’t have quality in, you’re going to get garbage out.

Among a number of things, you appear to be very interested in educating others. Where does that passion come from? Is there a story behind that striving?

Kenneth Ellington: It’s a lot of factors. One big influence is probably my father. My family’s from Jamaica originally, so they didn’t have much growing up. Seeing my dad work hard but always being happy when he came home was a big influence on me.

I want to give back to people, especially people that look like me. For historical reasons, we’ve been denied those opportunities, so I’m trying to bridge that gap as much as I can.

Also, in my opinion, from my experience, most teachers aren’t that good. I don’t remember the majority of my teachers throughout high school or middle school. They didn’t have a big influence on me, which could be for various reasons.

I want to be that one teacher that they’ll remember 20 years down the line. I try to do my best to make it as organized as possible. Leaving a big impact on their lives is super important to me.

Manoj Tandon: What characteristics do you bring into your style of teaching that allow you to leave that kind of impression where many in the field are not doing those things?

Kenneth Ellington: I would say you have to be empathetic, passionate, understanding, and patient. Patience is the biggest thing. If you’ve worked in cybersecurity, you know people who are good engineers, but they can’t explain anything to their client. They’ll freak out if the client doesn’t understand it.

Same thing with teaching. If your student doesn’t understand, you can’t just slap them across the face. You have to be understanding and put yourself in their shoes. You were once where they are years ago.

Understand that they may not get it the first time, the second time, or the tenth time. You have to keep at it, be understanding of the situation, and try explaining it in different ways until they understand. That may take a day, a month, or a year. It doesn’t matter; you just have to keep going with them.

Manoj Tandon: Conversely, Kenneth, what’s the role of the student? Is there a way to be a good student as well?

Kenneth Ellington: Yes, there are things I tell my students. I also tell them to be patient. Understand the material you’re studying. Make sure you actually look over it before you ask a question.

A lot of times, you may give them something, they skim over it, and they ask a question they could have answered themselves. Another big thing is, if you’re in a group setting like my students are, I tell them to work with their group first before coming to me.

If I give you the answer, you’re not going to learn anything. If you ask one of your peers, you’re more likely to gain knowledge from that. Their perspective is probably closer to yours than mine is, because I’m more advanced. Those are some of the things I tell my students to be on the lookout for.

Manoj Tandon: So, are you teaching to a test or to a concept?

Kenneth Ellington: More concepts and more hands-on. My training is not specifically designed verbatim for an exam, but it’s pretty similar. If you want to take an exam, you are able to, but I try to teach actual on-the-job stuff.

When they get a security job or tech job, they’re not freaking out because they don’t understand anything that’s going on. I try to make it as realistic as possible.

Sometimes there may be a little confusion, but I remind them: “This is stuff I’ve done in my career.” I try to bring that into the classroom.

Manoj Tandon: Can you give some examples of ideas you shared that they’re not going to get in college?

Kenneth Ellington: One thing I do is bring in a different hiring manager for my students’ Capstone assignments. That was one thing I never really got in my classes, even though I spent $30,000 to $40,000 at USF.

I give them real-world experience presenting in front of a board or a panel of managers. Most college classes don’t give you that experience, especially in cybersecurity.

Presentation and soft skills are things people often want to gloss over. Everyone wants to be like a hacker in a hoodie or get the launch codes for Russia. That’s not how it normally works for most security jobs.

I try to stress the importance of being able to explain your point, setting the stage, and explaining what you’re trying to get out of it. People don’t understand that unless you’re a consultant like me, cybersecurity normally costs your firm money.

Cybersecurity is like the fire department for a city. If you don’t have a fire department, the city burns down. It costs money, but it’s still important.

I try to stress that importance. You need to properly explain why a tool is going to cost the firm two million dollars. You can’t just say “to defend everything.” They’ll ask, “How does that help us?” If you can’t explain it, you’re not going to get the budget. Then something happens, you get blamed, and you lose your job.

Manoj Tandon: I’ve been critical of this in past episodes. Often, the disconnect in getting the right budgets or things done in a company lies with our own colleagues where they’re not able to explain in business terms why various aspects of the program are needed.

If you’re not able to put your thoughts in those terms, it’s very hard to get the necessary funding resources and whatnot to do whatever it is that you are wanting to do in the program.

Kenneth Ellington: Yeah. That’s something I’ve seen throughout my career, so I’ve been trying to push that.

Manoj Tandon: Those soft skills are immensely important. One thing that I would put out to our listeners is one soft skill that gets underrated is your ability to write. I think that ability to communicate with brevity in a format that people who are not in the business are going to be able to understand is going to have a factor on one’s success.

When you were in college, I guess let’s go back a little bit. Why cybersecurity? How did this happen? I understand you have a little bit of a background. You did a minor in business, and you were in computer science. Why cyber as opposed to going into coding or working at Google or Microsoft in a more development capacity?

Kenneth Ellington: Originally, my dad was a software engineer for the past 25 years. He didn’t force me, but he strongly pushed me to try programming throughout high school and college.

One summer, he asked me to do a Codecademy course. I did it and I thought it was the lamest thing ever. I told him, “Dad, so you type on the keyboard and you’re making numbers pop up, and people pay you thousands of dollars to do that?” I thought it was the dumbest thing ever. Why would anyone ever want to do that?

So I didn’t do programming; I did business when I graduated high school.

Fast forward two years, I got my associate’s from HCC and went to USF. I started in business management, but I wanted to specialize and do something a little more specific. My dad suggested IT, and I thought it was a great idea. That’s how I got back into it.

Then, in the summer of 2018, while working at Publix, I let everyone know I wanted to do cybersecurity. One of the big things I try to tell people is: let people know what your passions and desires are so they can speak on your behalf when you’re not in the room.

That’s what I did. My store manager, Lori, came to me and said, “Hey Kenneth, the Director of Cybersecurity at Publix is going to come into our store next week. Do you want to meet him?” I said, “Oh yes, please.”

She set up a meeting with him. His name was Rick Rampolla. He sat me down and asked what I wanted to do, and he said, “Hey Kenneth, have you thought about cybersecurity at Publix?” I said, “I thought we just sold groceries. I didn’t know we did cybersecurity.”

Rick gave me step-by-step instructions of what he expected from me. The internship team had filled up during that summer, but there was a spot on the team the next year. He told me, “If you can do all those things, I can almost guarantee a spot on my internship team next year.”

Fast forward nine months, I did everything he told me to do, and I got the job at Publix. So that’s kind of how I got into cybersecurity.

There were a bunch of peaks and valleys throughout the way. One of the really big turning points was when I did the ReliaQuest boot camp at USF. ReliaQuest is an MSSP provider based out of Tampa, Florida. They’re official partners with the Tampa Bay Buccaneers and the Boston Celtics. They service a bunch of Fortune 1000 companies.

The boot camp was the hardest thing I’d ever done before that point. Between work, school, and the boot camp, I was doing 100 hours a week. I was in the school library every day until midnight, even on Sunday when nobody was there. It was really creepy. The parking lot was empty. It was insanely hard.

I still have lifelong friends to this day because of that boot camp. Once you finished the boot camp, they could do an interview with you. I did, I think, five rounds of interviews for an internship, which I thought was super hard.

Then they told me the day after Thanksgiving that I didn’t get the position. I was super pissed. I was very upset because, for me, it was like they were taking away something I knew I’d earned. I could do the job. I was smart enough. I was passionate enough. I felt they were withholding something that I knew I earned and that I busted my tail for.

It ate at me for months because all my friends got in, and they were making double what I was making. They were talking about cybersecurity topics, and I was like, “Damn it, this should have been me.” It ate at me for months because I didn’t get that position.

But for me, it was like, “Okay, if you did everything you could do, you trust in God, and you know you can get in the right place.” So I just kept on working and working, and then Publix called me five months after that, and I got the job at Publix. That’s how I got into cybersecurity.

Manoj Tandon: That’s a very good story. There are a couple underlying themes there, Kenneth. One is perseverance. You weren’t one to give up in that entire journey. The other theme is that you’re very proactive. You saw an opportunity and you took advantage of it. You wanted to be a part of something and you let other people know.

Those are general life lessons that could apply to anyone that’s trying to do a career in anything. That’s a good model to follow, and you manufactured your own luck, in a sense. So hats off to you, man.

Kenneth Ellington: Thank you. Putting yourself out there is the biggest thing, honestly. At first, you’re going to probably feel stupid. You’ll feel awkward. That was a lot of the reason why I didn’t do a lot of things when I was younger, because I was afraid of what people were going to think about me.

But people don’t really care about you, right? They’re more focused on themselves. Once I figured that out, it was kind of like, “What’s the worst that happens? I fail. And the best thing that happens is I succeed.” And I’m here right now, so I think I’ve done pretty well.

Manoj Tandon: Yeah, no, that’s great. So let’s talk about another—we know how you got into cyber now—but why be an analyst and not a threat hunter? A lot of people want to be ethical hackers or threat hunters when they first think about cybersecurity. Shed some light on this.

Kenneth Ellington: I actually did some threat hunting back at Publix as an intern. I did one of my things with admin tools for Windows, so I worked with our penetration testing team to build some detection rules for that. That was super cool. It was incredibly hard, but it was a lot of fun.

I would probably say that normally those require more advanced skills, so it’s very hard to get those jobs straight out of college. It’s definitely possible, it’s doable, but if you don’t get that position, you’re not stupid. You’re still a good cybersecurity person; you just may need to take another position.

Everyone wants to do those roles because everything is glamorized in society. The bar to entry is super high, so take on a role like either a blue team analyst or a GRC analyst or something like that. Your entry level will probably be a little bit lower. It may be easier to get your foot in the door, which is all you really want.

Once you’re inside that door, you can easily pivot to whatever you want to do. That’s one piece of advice I try to give my students as well.

Manoj Tandon: That is a critical piece of advice. You have to land somewhere and then look at pivoting. If you’re aiming for something and you just don’t get it right away, you shouldn’t be discouraged. Find a path or carve your own path to it. You’re exactly right. That’s a lesson that’s really not taught a lot of times, but it’s a very valuable one.

Now, you’ve become an expert in SIEM and SOAR platforms. You know them inside out. One thing that I’d like you to enlighten us about is a SIEM versus a log management system. Are they the same things?

Kenneth Ellington: No, they’re not. Specifically, a SIEM is a Security Information and Event Management system. It is meant for security events only. If you try to use a SIEM as a log management platform, you’re going to have a lot of issues.

Splunk Enterprise is a log management platform. It does data aggregation, log management, and data management. Then there’s Splunk Enterprise Security. That is a SIEM platform specifically made for security events. There are correlation rules and detection rules you can build specifically for that.

One you can use for BI, observability, DevOps—that’s fine. A SIEM is specifically set up for security tools. Think of QRadar, Splunk Enterprise Security, and Elastic as well. I think they have the SIEM component.

Manoj Tandon: But Elastic can also be an analytics engine. Tableau is, too. Is there a reason why we couldn’t use Tableau to accomplish some of these things?

Kenneth Ellington: I would say that’s like if you’re trying to use your Honda Civic to tow a tractor-trailer. I guess technically you can do it, but it’s not probably going to be the best or more comfortable ride. I guess technically you can get the job done, but I wouldn’t advise it.

You can use Tableau to do that; it’s just going to be a whole mess. I would highly suggest, if your organization has the money, investing in an actual SIEM solution. There are open-source ones as well, if you’re not a company like Apple or Google. But trying to use a data lake, Tableau, a BI tool, or Power BI as a SIEM platform is a big mistake, in my opinion.

Manoj Tandon: Well, it’s been tried multiple times, and I’m sure it’ll be tried again, unless someone listens. But you’re absolutely right. They are two different animals altogether.

Now, do you have to have a log management platform to have a real good SIEM operation going in the SOC?

Kenneth Ellington: It depends on what platform you use. For example, if you want to have Splunk Enterprise Security, you have to have Splunk Enterprise because Splunk Enterprise Security sits on top of Splunk Enterprise. It’s a premium app.

I think QRadar you can get straight out of the box, if I’m correct. And Elastic, I think you have to have the base Elastic/Kibana stack to get the security tools integrated inside of it.

Normally, I would say you want to get a baseline of your environment before you try to take the security tool to that next level. One of the things I’ve always tried to tell my different clients is that you need a baseline of what you’re doing. If you don’t know where you’re at, how can you know where you’re going?

They try to ingest everything under the sun, and then they ask why it’s not working. I’m like, you’re ingesting terabytes of data. Your system isn’t designed for that.

Manoj Tandon: But the vendors are telling them to ingest everything. I can’t tell you the number of sales reps out there that are saying, “We’ll take in all your logs.” I wonder why. I mean, they’re not like Santa buys you more money with the more they ingest, right? Of course not. That wouldn’t be the case, would it? I don’t know.

Kenneth Ellington: It gets really expensive if you start doing that. Compute costs get expensive, storage gets exponentially expensive. When you’re not storing Grandma’s pictures and you’re putting terabytes and terabytes of data in hot storage, that’s going to cost money. It’s going to cost a lot of money.

Then you have to talk about it from the compliance perspective. The more data you store and the more types of data you store, the more different types of compliance rules you’re going to have to comply with. Maybe putting it in one country, storing it there, putting it in a certain bucket—that’s even more dollars as well.

Going back to this: what do you actually consider security data? You need to have some type of documentation inside your organization that says, “If these types of logs meet these criteria, this is security data. If it doesn’t, then this is operations, DevOps, observability, whatever it is.” That needs to go either into a data lake or some type of log management solution where we don’t have to search it in real time or put it in a hot bucket.

That’s why getting a baseline of what’s happening in your environment is very important. Otherwise, you’re just going to try to ingest everything, and then when you get the bill, it’s tens of millions of dollars. Then you’re asking, “Well, what happened?” And they say, “The lead engineer said to do this.” Okay, is it written down somewhere? What happens if he leaves and gets a better job at Google or something? All that knowledge is going to go with him if it’s not documented.

That’s why I try to tell people—students, clients, random people, my parents, whoever will listen, and half of the time they won’t.

Manoj Tandon: The thought that you should have a good strategy before you deploy a technology shouldn’t be foreign to anyone, but it sure sounds like it may be based on some of the things that you’re seeing. I’m being a little sarcastic there, but it is what it is.

Where does SOAR fit into the SIEM picture?

Kenneth Ellington: SOAR normally will sit on top of a certain platform. Think of Splunk Enterprise Security, the SIEM, and then you have Splunk Phantom, or now they call it Splunk SOAR because security people are very uncreative people.

Everyone is renaming something to SOAR now. Now it’s Palo Alto SOAR, IBM SOAR. I’m like, wow, really creative.

Anyways, a SOAR platform is designed for more of the response process, the incident response process. SOAR stands for Security Orchestration, Automation, and Response.

Normally you will have an event, an alert, and an incident. An event is something that happens. A log gets generated. It could be good; it could be bad. You don’t know. It’s just an event.

An alert is something that may potentially be bad. More work needs to be done to look at it. An incident is, “Oh, something is actually going wrong. Something is actually bad.”

Once that rises toward an incident, you should have a SOAR platform. That gets sent to the SOAR platform, which can automate that response. You’ll have workflow actions and playbooks that you can run to automate that response. You can have human eyes put in on different processes depending on what it is.

You can customize it as much as you want, or you can keep it generic if it’s things right out of the box or things that are common throughout all industries. If you want the analyst to take a look at it at the last step before it gets solved, then you can do that. Or you can have it completely automated. It’s up to you.

Think of it as your enterprise. An event gets triggered, then it goes to Splunk Enterprise Security. That’s an alert. If something is triggered again as an incident, then it gets fired to Splunk Phantom, in this case. That turns into an incident, and then your incident response team will take a look at it through the SOAR platform.

Manoj Tandon: Where do you see AI evolving in this SIEM/SOAR junction?

Kenneth Ellington: I think AI can take a lot of the repetitive tasks, which is good. Human beings—if you make them do something over and over again that’s really repetitive and boring, they’re going to make mistakes. That’s just how humans are.

Manoj Tandon: You know what? It’s interesting you bring that up. There have actually been several studies done. There is a real thing as fatigue in the SOC. Analyst fatigue is real, and it’s for all the reasons you just mentioned.

Do you advise your clients on how to deal with that? Because you’re right: if it’s repetitive, it’s going to be boring, and at some point you’re going to make a mistake.

Kenneth Ellington: At my old firm, they put me on a SOAR platform. That was my first time ever touching it, really, because when I was at Publix, SOAR wasn’t a real thing. It was kind of this product set of tools, but around 2019 or 2020, it became an official thing.

When I first started touching SOAR tools back at DTCC, I had no idea what the hell I was doing, so I had to go figure this out. That’s where I met IBM. God have mercy on me.

That was an interesting process. We were trying to automate some processes that took a couple of hours, and it took five months to get figured out.

With automating things and using AI, trying to take the repetitive tasks is super important. I always think there’s going to be the human element because AI is built by flawed people like us, so the algorithms aren’t always perfect. There’s always going to be some type of vulnerability. It’s not magic.

People think it’s the same thing as crypto, blockchain, or the cloud. Everyone thinks it’s like Thanos—he has the Infinity Gauntlet, he snaps his fingers, and everything gets fixed. That’s not how it works. There are always going to be vulnerabilities because it’s a human tool that humans have made.

Manoj Tandon: Oh man, I love that.

Kenneth Ellington: So the human element will always be there, in my opinion. A lot of the boring stuff that people shouldn’t be doing in the first place will probably be removed. A lot of the spam monitoring, which is something I did back at Publix—even though it was my first security thing, so I thought it was the most amazing thing ever—I can see how analysts would get bored with that.

He misses a couple emails, an executive gets phished, then it’s all over the news. Then everyone’s sad, everyone gets fired, or both.

Automating that and fixing those processes is where AI will help a lot.

Manoj Tandon: There are some companies out there offering a managed service—and their names I’m not going to mention, but they’re names that you know for sure, Kenneth—big organizations where they’re saying, “At a much cheaper cost, we’ll offer you SIEM with an AI analyst on top, so no human’s going to look at it.”

Now the perception, and I’ve seen it, is that we really don’t need the human. The technologies are writing correlation rules, doing that algorithmically, and then you have pattern recognition going on with AI. We have it connected to playbooks and SOAR. The entire chain can be automated, and it’s cheaper, so we think that’s 100% secure.

Kenneth Ellington: It depends on what your environment is like and how large the organization is. If you’re Google, Apple, or Amazon, you’re going to have to have some type of human element inside of it because automating all of your logs and endpoints across the other company isn’t realistic.

A lot of the time, whatever tool that is, I don’t know if that’s realistic in any case, shape, or fashion. They automate the very basic stuff. All the new advanced stuff that hasn’t been found yet in anybody’s environment—that tool is not going to recognize that.

It’s going to go under the radar, and since there’s no human there, no one is going to notice inside the environment. It’s just going to keep running and running. That’s why they’re called zero-days: unknown unknowns.

Nine months later, when you’re wondering, “Hey, what’s wrong with our systems? Why is it not working properly? It’s Black Friday, we’re losing millions of dollars, what’s going on?” Oh, wait, I can’t ask anybody because everyone’s just a robot.

Manoj Tandon: I’m glad that you’re offering some common sense commentary on that. We’re being a little sarcastic here, but at the same time, there’s a seriousness to it.

Buyer beware. Always investigate something before committing to it, and understand, if not in depth, at least at the fundamental level, what you’re buying and what some of the consequences can potentially be. It might work for your environment. I’m not going to be one to argue that, but one should be cognizant.

You touched a little bit about open source. Splunk is very expensive, QRadar can be very expensive, and it sounds like you probably didn’t have such a good experience with it. What about open source? Is it legit for the application?

Kenneth Ellington: The way I look at it, nothing’s ever free. There’s always some type of cost associated with it, either upfront or later.

With anything in life, with open source, the upfront cost is normally a lot cheaper. One of the big things you pay with a lot of these vendors is the actual help, the support. When you have open source, like open-source Ubuntu, you manage all that. When something goes wrong, it’s very expensive to get help from them.

It may be significantly cheaper upfront, but when something goes wrong—and something will always go wrong, this is tech, that’s just how it’s been—you’re going to have to pay a lot of money to get it fixed.

You need to figure out as an organization: are we willing to hire our own support staff, basically, and have a super large one, or do we want to pay Splunk, Elastic, whoever, the upfront costs to manage that? It’s a give-and-take and what your preference is as an organization.

Manoj Tandon: What are some common mistakes that people are making when they implement SIEMs that you have seen over and over again?

Kenneth Ellington: They buy it and they don’t know what they bought or understand what they bought, or they already have another tool that’s the exact same thing.

They buy a Lamborghini and they’re like, “Oh wait, I had a Ferrari inside the garage. I didn’t realize that. Who cares? We got money.” It amazes me that no one scrutinizes that or no one checked it.

I’ve seen organizations that have bought a SIEM platform, and it’s like in the box on the ground. They’re like, “When did we buy this?” “Why is it not installed?” “Because we don’t know how to do it. We’ll start later.” And they spent tens of millions of dollars on it.

Again, having a strategy, having a plan before you do something—you don’t build a house off of a whim. Having a plan of what you want to do, why you want to do it, the cost for it, and making sure you have the right people to do it is very important.

Once it’s installed, if you get toward that point, hopefully being able to actually properly run and manage it and tune it when needed.

Manoj Tandon: Let’s go down that path of tuning. Can you ever be done tuning a SIEM?

Kenneth Ellington: Can you ever be done tuning your car? No. Same thing.

There’s always maintenance, always something that needs to be fixed, tuned, modified, upgraded. Just like anything in life, like your body. You don’t work out one day and say, “Oh, never again, I’m done for the rest of my life.”

It’s a constant process. Constant updates. Making sure it runs properly. Making sure people are trained with it. Making sure it has the right updates. Updates and people being trained—those are some of the things.

Manoj Tandon: I specifically focused on that because there’s a notion that we’ve got it implemented and we’re done. At the higher levels, I know the practitioners don’t believe that. But people need to understand exactly what they bought, as you alluded to earlier, and there is an expense. There is ongoing maintenance with that.

It’s not something that you can just brush off and say, “Ah, we’ll get it implemented, and then I’ve got one guy that’s going to be the analyst, the tuner, and the grand poobah, the SOAR administrator of it all.” It doesn’t work that way.

Kenneth Ellington: No, it really doesn’t. Then they wonder why people quit. “I don’t understand. Why did Johnny quit? We only made him do 10 people’s jobs. I don’t get it.”

Manoj Tandon: Well, because you made him do ten different jobs, and he’s probably not getting paid for it, so he’s not probably happy with that scenario.

Let’s switch gears a little bit and get to your academy. When we look at the Ellington Cyber Academy, what is your core mission there? What are you guys about?

Kenneth Ellington: The biggest thing ECA likes to do is try to get people of color into cybersecurity, specifically for SIEM and SOAR.

People often ask me, “Hey Kenneth, why don’t you teach ethical hacking and penetration testing?” Because I don’t like those things. I don’t want to do a job for one week and write a dissertation on it. That doesn’t interest me. So that’s why I don’t teach ethical hacking or penetration testing. I don’t like it myself, and I don’t teach something that I’m not passionate about. You’re going to be able to tell from that.

SIEM and SOAR are the two specific things our academy focuses on. One of the reasons is I personally have not seen a lot of people that look like me in this field, so I’m trying to bridge that gap. I haven’t seen a lot of people, when I was learning, talking about this or working with this, so I thought that was an area that I could excel in.

Going back to earlier in the show, I don’t think a lot of people are good teachers. People have bad experiences with teaching, which may affect them getting into cybersecurity. So we try to make the complicated simple. We try to have good material, be honest, be empathetic with students, and be there if they need us. Just those simple things.

Manoj Tandon: Playing devil’s advocate, when we look at other online learning platforms—and I won’t mention them here, but there’s a whole plethora of them out there—how does ECA differentiate from that? Because those guys are going to make the same claim. They’re going to say, “We’ve got a good platform, we’ve got a lot of structure, it’s self-paced, a student can learn, and we’re not uber expensive.”

Kenneth Ellington: For me, I’m a big proponent of believing you get what you pay for. Where I think we try to differentiate ourselves is we try to bring in hiring managers and recruiters from actual companies.

We’re not a college where I’m going to charge you $20,000. It’s pretty affordable. Going back to presenting, you’re presenting in front of actual people who want to hire. If you do well with these assignments and these Capstones, that matters.

I don’t work for Elastic. I don’t work for Splunk. I don’t work for IBM, so I’m not a salesperson. If I think this platform is crap, I’m going to let you know and be very honest with you. If I think it’s good, then we’ll put it inside our program and use it. That transparency is incredibly important.

We’ve gotten three people hired this past six months. One works at VMware, one works with Samsung, and one works with GM Motors now. I’m very proud of them. They busted their behinds to get to where they are, so we’re just proud to be a small part of their success stories.

Manoj Tandon: How many students have you put through the program, or are currently enrolled right now?

Kenneth Ellington: Currently enrolled, we’re on our second cohort. We have about five students. Some are repeaters because they love this so much, they want to take it again. We have about four new students.

We’re in the process of their last Capstone. It’s in about two weeks. Then we will be starting their interview and resume prep process this winter so we can try to get them hired in the next couple months.

Our next cohort will be in January, and my apprentice, who I brought on, is an awesome young lady. She’s been killing it for the past four months with me, so she can actually be leading the next cohort. I’m a very big proponent of putting people in positions where they can be successful. I’ve taught her everything I know about Splunk and SIEM, and now I want her to teach it and give back to the community.

Manoj Tandon: That’s fantastic. Is she doing this full-time?

Kenneth Ellington: She’s doing this part-time. She is a service technician at Apex. We’ve been trying to get her a cybersecurity position over the past month because she finishes up her bachelor’s degree this semester, I believe—this month, if I’m correct.

Manoj Tandon: Oh wow. That’s admirable work. Kenneth, did you put together the curriculum for ECA? Is that all you doing?

Kenneth Ellington: Yes. There are free links and free documents, but the scenarios and videos are all mine. I built that from scratch.

Manoj Tandon: Just so our listeners understand, in terms of cost, is this something where they’re going to have to take out a car loan type of situation?

Kenneth Ellington: No. The most expensive one we have right now is about $1,650 for eight weeks. You get interview prep, resume prep, resume revamp, LinkedIn revamp, you get put in front of a hiring manager, you get lifetime access to our Slack channel, and you get put inside of our recruitment portal as well.

I think that’s a pretty fair price compared to other vendors. I won’t name them, but you know who they are. There are vendors out there where you’ll be paying $5,000 or $8,000 for your introductory classes. I’m trying to keep it pretty affordable.

I’m probably not ever going to put it above $5,000, honestly, and that would be down the line. For now, I’m trying to keep it as affordable as possible so people can get inside cybersecurity.

Manoj Tandon: How do you see ECA evolving in the future? What’s your vision for it? Five years out? Three years out? How about that—five is too long.

Kenneth Ellington: Three might be long, but I’ll say this. Over the next year, I’m trying to build more business-to-business partnerships so our students can have a direct pipeline to companies.

Then, starting to do more training for companies—taking over their training programs and offering what we have for them to replace that. I know it can be kind of expensive for companies, and it takes a lot of time and effort.

Manoj Tandon: Yeah, I was going to ask: what’s the response been like from the corporate side toward that?

Kenneth Ellington: It’s been a mixed bag so far. I think a lot of companies still want to see what we can do and get more students hired. I’ve been chugging away as much as I can to try to help my students out and prove the concept that we can actually train good cybersecurity professionals here.

Once that process keeps growing, which it will—I have faith in that—it’ll be a lot easier to push that toward businesses. I’ve gotten three students hired at Fortune 100 companies in the last couple months, so I have faith in what I’m doing.

Manoj Tandon: Have you considered maybe looking at federal grants where you could do training like this for even high school students who are deeply interested in this topic, and they could learn this as a vocation getting out?

Kenneth Ellington: That has been one of my ideas as well. I’ve worked with the VA to see if I can get a government grant for that, so I’m in the process of trying to do my research for that.

Manoj Tandon: I think the Department of Education or HUD even has some things out there for these types of programs that would help people advance out of their current station in life, if you will, to a much better role. I think that would be a huge benefit.

Where there’s a structured program that is taught in a way that people will grasp, they’ll be able to complete, and they’ll get the soft skills—that’s what makes people hirable.

Kenneth Ellington: I agree. I know a four-year college degree isn’t for everyone, for numerous reasons, the biggest probably being cost. To me, it doesn’t make sense to spend $80,000 to get a job that pays you like $35,000. If I can be a more affordable way for people to get toward their end goals, I’ll be happy to take that place.

Manoj Tandon: That’s great work that you’re doing, Kenneth. I’m sure everybody appreciates that, and we’re hoping you have great success with that. That’s good stuff.

We’re at the hour here. I wanted to ask you: is there anything that you’d like to plug? Anything that you’re going to be doing, any appearances you’re going to be having, anything you’re involved with that you’d like to plug? It’s your floor. What would you like our audience to know about?

Kenneth Ellington: I would say be on the lookout over the next couple months. We’re going to be doing a couple free workshops. Going back to some of the things we talked about in the show, like understanding what the logs inside your environment are, why they’re important, and how to do it.

I would say that is probably one of the things we’re going to be stressing, using the MITRE ATT&CK framework, because that’s one of the popular frameworks out there, especially for IT-type security. We’ll be doing a couple free workshops over the next couple months with that.

Manoj Tandon: When that happens, let us know about it, and we’ll let people know on social media. We’ll get the word out.

Kenneth, we really appreciate you taking the time. It was an honor to have you here. I appreciate the work that you’re doing. Keep us updated on what’s going on.

Kenneth Ellington: Definitely will. It’s been such a pleasure to get to speak to you guys.

Manoj Tandon: With that, have a good holiday season and take care. Look forward to talking next time.