Insider Threats, Critical Infrastructure and Evolving AI, Oh My! with Grant Schneider Halloween Series Part II

Carolyn Ford [: 00:00:00

Welcome to Tech Transforms, sponsored by Dynatrace. I'm Carolyn Ford. Each week, Mark Senell and I talk with top influencers to explore how the U.S. Government is harnessing the power of technology to solve complex challenges and improve our lives.

Hi, thanks for joining us on Tech Transforms. I am Carolyn Ford, here with Mark Senell. Good morning, Mark.

Mark Senell [: 00:00:33

Good morning, Carolyn.

Carolyn Ford [: 00:00:35

Okay, in the spirit of Halloween, today's episode is the second in a three part series, and we're exploring some of the creepier, spookier, crazier sides of technology in this series. If you haven't already, listeners, be sure to catch the first episode in the series focused on the spooky side of Generative AI with Mr. X. That's his villain name that I gave him. And just fair warning to our guests today, I'm going to come up with one for you, too. So today we have the honor. I'm a little amped up. I'm not going to lie.

Carolyn Ford [: 00:01:10

Like, we have a rock star today, and we're welcoming Grant Schneider. Grant has spent his entire 30 year career focused on the nation's security. He spent over 20 years at the Defense Intelligence Agency, seven of which he was the CIO. He then spent six years at the Executive Office of the President during the Obama and Trump administrations, I have questions about that. Focused on all aspects of federal and critical infrastructure security. During that time, he served as a Senior Director for Cybersecurity Policy on the National Security Council staff, and most recently as the Federal CISO. So for those of you guys like me, let's just say, like the White House CISO, like, it's cool. So for the past three years, he's served as Senior Director of Cybersecurity Services at Venable, helping organizations from across all sectors enhance their cybersecurity programs through the development and implementation of risk management programs, as well as assisting with the preparation, response and recovery from various cyber incidents, including ransomware.

Carolyn Ford [: 00:02:25

So I'm telling you guys, today's episode is a do not miss. We're going to talk to Grant. We're going to try to get him to tell us the scariest stories from his career, from ransomware to I want to know if a cyber fire sale is like, can it happen? Like in Die Hard. I want to know. And based on his background, you know, we're going to get some good stuff. So welcome to the show, Grant. Thanks for joining us.

Grant Schneider [: 00:02:54

Well, thanks for having me. Excited to be here.

Mark Senell:

Thanks for being here.

Grant Schneider:

Now I'm a little scared to be.

Carolyn Ford [: 00:03:00

So well, we want you to scare us with some really good stories, but we'll start with some easy stuff. I want to start off with your public service career. You were on the front lines and really still are on the front lines of the nation's cybersecurity posture. And looking back, even at your time at the DIA, your work has contributed to enhancing the security of the federal government. How has our nation's approach to cybersecurity matured or evolved over the course of your career? And were there any moves that were more impactful than others in your opinion.

Grant Schneider [: 00:03:43

I mean, we've evolved a ton, right? The government has evolved a lot. This industry has evolved a lot. And it's really been as technology has evolved. And I remember at DIA when I first got there, there were no connections to the Internet, the unclassified internet in our building. And when I left, every single person in the building had an unclassified computer under their desk, as well as a couple of classified computers because they needed to be on other networks. And so as we kind of expanded our threat surface by connecting more things to the network, we have increased the consequence of a cyber incident, of a technology incident, of our technology going down. And I think along those lines, cybersecurity was born and really moved from. When I was first at DIA, we operated on classified networks.

Grant Schneider [: 00:04:42

No one really talked about security because we were isolated and segregated from the rest of the world. And we just talked about information management or maybe information security. And that organization was a policy organization. They wrote policies and put policies out that the people doing It operations had to implement and were supposed to do upgrades and updates and patches and all the basics that you would expect today. But what we saw is as those consequences of an incident increased, the information security team eventually became cybersecurity, but became an operational entity inside of organizations and became where you had a security operations center that was looking at security on seven days a week, 24 hours a day basis. And it really became its own sets of skills and separate and apart from the IT operators that had always been there running twenty four, seven operations, but really became a distinct skill set and a distinct part of the organization over the years. And I think we've just seen that continue to grow both in public sector as well as in private sector as well.

Mark Senell [: 00:06:06

So you brought up something really interesting there, Grant, that I wanted to ask you about, because you said over time, as technology and organizations have expanded and you have access to external internets and stuff like that, do you see the threat vector more? Do you see it as increasing or that we've risen to the challenge of protecting that? I guess where I'm trying to go with this is how does insider threat play there? Is that more of like something that accidentally people could make mistakes or I guess it could be malicious.

Grant Schneider [: 00:06:59

Just a lot of different directions.

Mark Senell [: 00:07:02

Sorry, I didn't know how to go.

Grant Schneider [: 00:07:03

A, the threats continue to increase, and the threats, as we've shifted it and we've put more things and connected more things to our networks, well, we've created the opportunity for decades. Security was really about espionage, right? It was about nation states and about espionage and trying to steal information that didn't have much value beyond espionage, or maybe some industrial espionage as well. Right. But we've now shifted and we've seen over the last 20 plus years to where being a malicious actor in cyberspace, you can monetize your activity and the ability to talk about ransomware, whether it's ransomware, whether it's fraud, that you're going to go in and steal health data or steal credit card information. Right. A lot of this started as I was going to steal credit card information and sell pawn credit cards. So any way that an actor can monetize as we've interconnected the world and put more data and more information and more sensitive stuff, threat actors continue to look for ways to monetize that. And as long as they continue to be able to monetize it in a variety of fashions, ransomware being a big one, but in a variety of fashions, those threats are going to increase and we're going to need to take more protective measures.

Grant Schneider [: 00:08:35

And I can come back to insider threat if you want.

Carolyn Ford [: 00:08:38

Well, I was thinking like when you were first talking then, Mark, you made me even lean into it more. Was I'm wondering, Grant, you said, okay. At first we were never connected to the Internet. And then as time went on, everybody had an outside connection to the Internet. You were there when Snowden rocked the world. Did that connection to the Internet, how did that change things for you.

Grant Schneider [: 00:09:10

On Insider Threat? Right. What I've saw. The evolution of insider threat is early on in my career, the intelligence community. The screening was really about don't hire a bad guy. Screen them out in the hiring process with a little bit of the belief that there could be a malicious actor, their nation state that's trying to plant someone into the community in some way, shape, or form, or someone that just has issues that you don't want in the intelligence community. But insider threat and we saw this with Manning and with Snowden shifted to where when they came through the door, I don't know what was around them when they came through the door, but a lot of them became these ideological ideas right. That this whistleblower sort of approach to some degree, and I'm not saying bad things about whistleblowers, it's an important function, but people who had a different view on the lawful work that was being done by the community right. And Snowden just thought that work was bad and thought we were doing things as a country that we were doing legally were wrong and therefore "I'm personally going to do something about it."

Grant Schneider [: 00:10:37

Right. That seemed to be his approach. So did Snowden absolutely rock the community in a big way? In a big way. And Snowden was able to do things that Snowden shouldn't have been able to do from a policy standpoint. Right. Most incidents there's a policy in place that didn't get implemented in some way, shape, or form or a technical control that got bypassed in some way that allowed something to happen. With Snowden, he was in a very interesting position where his job was to gather data and pull data together. And in fact, he was downloading a whole bunch of the data that he ultimately released, and at one point got a phone call from someone that was like, hey, you're killing my servers.

Grant Schneider [: 00:11:23

My performance is bad because you're downloading all this data from us. You're scraping this data. And the response was, "oh, I'm sorry, I'll do that in the middle of the night from now on." "Okay, great."

Carolyn Ford [: 00:11:34

My gosh.

Grant Schneider [: 00:11:35

Because he was in a position that that was his job, was to aggregate all this data. So insider threats super scary because of and in a post 9/11 world, the need to know was the focus of the intelligence community, that we need to share more information across the community. And it was kind of if you were inside the tents, you got access to everything inside the tent. And with things like zero trust, we've seen that certainly shift over the years, most recently with zero trust architectures. But insiders are still very much, I think, scary for all organizations.

Mark Senell [: 00:12:14

So, speaking of 9/11, having worked with government agencies and commercial organizations, I really feel like the government has progressed significantly across the front of cybersecurity and insider threat and all these things, more so than maybe the commercial side of the house. But when I think of, like, 9/11 or stuff like that, I think of how are we protecting critical infrastructure, commercial critical infrastructure? Because you hear about this in the news a lot. You hear about the Chinese being in our electric grid. You hear about all these kind of scary things that are out there. Have you had experience of working with commercial entities around that, or I guess even in government dealing with the critical infrastructure?

Grant Schneider [: 00:13:10

Yeah. So when we look at critical infrastructure, which is appropriately named right? It's critical infrastructure because it is the things whether it's transportation, energy, water, telecommunications, financial systems, the things that make our economy run, that make our daily lives run and operate, if something bad happens in one of those, it can be significantly disruptive. The Colonial Pipelines is a great example a couple of years ago where you had a ransomware event, Colonial Pipelines shut down and then back up right there.

Carolyn Ford [: 00:13:57

Just for our listeners and for me, remind us how that ransomware attack actually happened, because that is crazy to me that it happened. So can you walk us through the details just a little bit?

Grant Schneider [: 00:14:10

Now you're making me dig back into.

Carolyn Ford [: 00:14:12

I mean not too much but just refresh our memories.

Grant Schneider [: 00:14:18

Essentially, when the actors were able to get into their systems, and my understanding is that they got into the information technology side of the house. Right. And most critical infrastructure have an operational technology and an information technology environments, which historically much like an intelligence community. Those were separated. Those were air gapped and not interconnected. Well, like many things in our lives, my stove is now connected to my home network, the same one that we're doing this over. Things got interconnected for lots of good reasons around productivity, around the ability for your third party provider to not have to fly someone to your site to be able to repair your OT system. So my understanding on it is that they were able to get into the IT system and they were able to essentially lock up the IT system.

Grant Schneider [: 00:15:19

Right. They got access. Typically in an incident, you're going to get access or the adversary is looking to gain access. They're going to do some amount of reconnaissance to understand the environment they're operating in, understand where's the critical information they may steal some of that information before they do anything else. What are the critical operations? If you have a cyber insurance, they're going to go look for your cyber insurance policy so that if they are going to ask for a ransom, they know what your coverage is. They're going to understand your business before they let you know that they're there. And then ransomware is kind of the thing they do at the end, where they then lock up your systems. Once they've done all the work, the prep work that they need to do, they're going to encrypt systems.

Grant Schneider [: 00:16:08

They're going to deny the company the access to their systems. To the best of my knowledge, the adversary didn't get into the OT systems and that Colonial Pipelines shut down their OT systems as in an abundance of caution because they really didn't know the extent and they didn't want to have something happen on that delivery side. However, shutting it down for all of us on the East Coast had a significant impact, both from a real impact of places where you couldn't go get gas and then the fear that my gas station might be the next one to not have gas. So I need to go fill up all my cars crazy and keep a couple of hundred gallons of gas in my garage that I don't need to go anywhere for. Right. Everyone sort of took that approach, but that then drove this lack of confidence.

Carolyn Ford [: 00:17:03

You had 200 gallons of gas in your garage?

Grant Schneider [: 00:17:05

No, not me, I, but I think a lot of people went in hoarded. Right.

Carolyn Ford [: 00:17:11

I grew up in Utah.

Grant Schneider [: 00:17:12

We saw it with toilet paper during COVID too. It seems to be human nature.

Carolyn Ford [: 00:17:17

I grew up in Utah. Father very much. I mean, I guess we could fall into the prepper camp. We actually had a tank in our backyard. I don't know how many gallons it held, but we had that kind of stuff.

Grant Schneider [: 00:17:32

You were prepared?

Carolyn Ford [: 00:17:33

Oh, yeah. We were very prepared.

Mark Senell [: 00:17:35

Survivalist.

Carolyn Ford [: 00:17:36

Yes. Okay. So we're starting to dabble into this is the good stuff. Live Free, Die Hard. So Die Hard 4. For those of you who guys aren't a fan, you should watch this because it's scary as it's very scary. The idea, this cyber fire sale idea where everything could be shut down by these hackers and what you're telling me, Grant, just based on the pipeline incident that it's possible, right?

Grant Schneider [: 00:18:14

Well, I think there's a couple of aspects. I mean something being possible. There's a lot of things that are possible, right. If you put all the parts of a watch in a bag and shake it forever, eventually the watch will come together. I don't recommend trying that at home.

Mark Senell [: 00:18:32

Because I think you'll that's a good analogy.

Grant Schneider [: 00:18:36

But in theory that's possible. I think though, to me what's almost as scary is what threshold does an adversary need to get to to have a significant impact on our economy, on our trust in the economy, on our trust, in the ability that we're going to have these goods, these critical infrastructure items delivered to us. And so I think the way our critical infrastructure, a, it's mostly owned and operated by private companies, right? Some of it's owned and operated by the government, but it's very much in a decentralized right, it's very decentralized across the country. And so there is an amount of air quotes, maybe security, it's not really real security, but there is an amount of resiliency, that's a better word by having the amount of distributedness. But it also means you end up with a whole bunch of different levels of readiness. You've got some organizations that have the understanding, the budgets, the ability to actually invest in these areas, think financial services, and then you've got other organizations that are small, maybe a municipal water department in a county or a small town who is rate limited, right. They can't charge more money. They can't necessarily raise their rates without getting some approval through a political process.

Grant Schneider [: 00:20:14

So they can't even invest if they want to, if they have the awareness and they want to be able to do it. So you end up with a lot of different levels out there. But I think the ability to start that type of disruption is super scary to me because you don't have to be able to actually disrupt all of it. If you can create enough concern and a lack of confidence in the delivery of the critical infrastructure, you're going to see these fall on kind of human nature results.

Mark Senell [: 00:20:49

That's a great example.

Grant Schneider [: 00:20:51

Negative.

Mark Senell [: 00:20:51

So I've always looked at our decentralization or our openness as a potential weakness in area that our adversaries would attack. But am I hearing they're saying the decentralization actually could make it harder because.

Carolyn Ford [: 00:21:07

We're kind of air gapped by default, right?

Mark Senell [: 00:21:12

Potentially.

Carolyn Ford [: 00:21:13

Right. But that security by default makes me think there's not a lot of efficiency. It also brings a lot of problems with it to not be yeah, to.

Grant Schneider [: 00:21:30

Be clear, I think you get an amount of resiliency, not security by that distributed. Right. Because an adversary has to get into multiple systems or multiple items. On the flip side, the adversaries don't have to work really hard to get into multiple systems. Right. It's not like breaking into a bank physically, where you have to go to every single one. The nature of it is that you can scan lots of these organizations from anywhere in the world and you can do it all night long. You just need compute power and you can identify vulnerabilities and you can have automated scripts so you're still able to attack on scale or the adversaries are able to attack on scale.

Mark Senell [: 00:22:21

So now we're more scary. This is definitely more scary.

Carolyn Ford [: 00:22:23

Right? Well, and to your point, just inciting the fear was enough. Like, Colonial Pipeline is a really good example. They scared the hell out of us as a nation. They shut you guys down. And when we say maybe, I don't know if misnomer is the right word because sure, I still had gas in Utah. There was no resiliency for you guys on the East Coast. Right, right.

Grant Schneider [: 00:22:57

And we do know in some sectors and energy is probably a big one where it's very interconnected, right. Where there are interdependencies on the way that pipelines work and natural gas is delivered and energy is produced.

Mark Senell [: 00:23:20

Distribution.

Grant Schneider [: 00:23:21

Yeah, exactly.

Mark Senell [: 00:23:25

Are you involved in any of the efforts kind of that brings government together with industry around this concept?

Grant Schneider [: 00:23:36

Yes. So one of the things that we do or I do in my role at Venable is we help clients of the firm and then we have our individual clients that we work with on a variety of of kind cybersecurity matters. We also work with a number of industry coalitions and working with those industry coalitions, such as the Alliance for Digital Innovation is one where we bring together private sector organizations that are very interested and focused on delivery of capabilities into the public sector. And really, we then facilitate some of those conversations, policy conversations. Where do we need policies to go to add security to the public sector but also that will add security to the private sector? And we've seen this administration particularly very focused on second and third order impacts from a security standpoint, using the Federal Acquisition regulations to drive security behavior in an organization in order to sell something to the government that will also impact the services that they sell commercially as well.

Mark Senell [: 00:25:00

Having worked across multiple political administrations, does it vary from administration to administration or are there civil servants that kind of keep driving that effort forward or is it really kind of more politicized?

Grant Schneider [: 00:25:18

So fortunately, in my opinion, technology and cybersecurity has not been very politized, really going back, know, Bush to Obama to Trump and to Biden, in my opinion. We've seen a good bit of consistency around the directions that people have been was there at the end of the Obama administration. I was there for most of the Trump administration, and I would say the Obama administration looked at cybersecurity and technology very much through the cyber lens. Right. It was a post OPM hack environment very focused on cybersecurity and moving that forward. The Trump administration came in and looked at it through a little different lens. They looked at it largely through technology modernization, how do we modernize the government, modernize solutions both for delivery, know, citizen services and cybersecurity was a part of that. But when we sat down and literally sat down and briefed Jared Kushner when he came in on what we were doing from a technology and cybersecurity standpoint, his response to us, know, that all seems like the right stuff.

Grant Schneider [: 00:26:38

You should keep doing that. It's a shame you didn't have very good leadership to help you actually be able to deliver that, but it seems like the right thing, so keep doing it. And so Mark, it's a little it was an interesting moment and when we were like "yay, we're okay, thank you very much."

Carolyn Ford [: 00:26:58

We'll continue really changed with what you guys were doing, I mean, how it.

Grant Schneider [: 00:27:04

Was being reported, who we were working with. If you're in the White House, there's a political aspect. Even though many of the people working in the White House are career civil servants, as I was, it's still going to be politicized and you're working within a political environment. But yes, we were able to continue working in that direction and changing some of the language and focusing more on technology modernization at the same time continuing a lot of the cybersecurity work.

Carolyn Ford [: 00:27:39

Okay, well, that's nice, but it's not very scary. So let's get to the scary stuff.

Mark Senell [: 00:27:42

Scary, scary. I have a scary thing to Grant.

Carolyn Ford [: 00:27:47

Go, Mark.

Mark Senell [: 00:27:48

So, Grant, I hear about a lot in the news out there about and this may not be a cyber thing at all, but I'm curious, if you think about this, what about like EMP attacks on that's a good or electrical grids and stuff like that? I mean, is that more warfare as opposed to cyber?

Grant Schneider [: 00:28:09

So I think of it a little I think of it as warfare or terrorism, however, because I feel like that's where it would start, and that would be the motivating factors. Because if we look at cybersecurity in general and we look at malicious cyber actors, we've got nation states, we've got terrorists that are just looking to disrupt and do bad things, and nation states are looking to steal and be able to spy and all of those things. And then we've got a whole bunch of what I would call criminals, people that are trying to make money. And I don't know how you make money off an EMP that is just destructive in nature. Certainly if there was an EMP and we took down big chunks of the infrastructure, that would be detrimental on so many levels. It would be super, super scary. I would be very scared of that. I don't see it as something that a criminal actor is going to go after.

Mark Senell [: 00:29:15

More of a nation state type thing.

Grant Schneider [: 00:29:18

A nation state is going to want to have that capability for a time of war where they might want to do it. However, nation states also, even in a time of war, sometimes don't want to be that destructive. If that's an infrastructure, they want to come take over in the future. And we've even seen some of that in Ukraine or certainly at the beginning of Ukraine. You know, terrorism is where I think it's most scary, because terrorists really don't care about the so from a longer term or even near term policy. Yeah.

Carolyn Ford [: 00:29:52

They just want to burn exactly down. They don't care. Yeah. So what does the future look like? What's the scariest thing that we should be? Oh, I have another one, too. How does AI play into all of this? How does it make it scarier? All this stuff that we've been talking about?

Grant Schneider [: 00:30:13

I think where AI potentially makes it scarier is AI allows for acceleration, I think is one of the things, and it's a force multiplier. You can get lots of things done a lot quicker, both in a good way and in a bad way, using AI. And AI is I mean, we've had machine learning for a long time. AI tools and capabilities have been here. ChatGPT really put it on the map and made it kind of a mainstream by making a super easy interface right, where now anyone can interface with this AI capability. And so I'm confident AI is being leveraged by malicious actors. It allows them to be better. Right.

Grant Schneider [: 00:31:05

Phishing emails ten years ago were pretty bad and obvious. AI makes it a lot and they've gotten much better. AI makes it a lot easier, allows you to scale if you're a bad guy, allows bad guys to scale much quicker and can have more impacts. And then in the future, when AI is doing more things for us and we don't really understand how it's working well, we won't understand when it's not working well or right. And as we interconnect things and we don't understand the algorithms and the models, quite frankly, many people my age, and certainly older than me, used to really understand how our cars worked. You did lots of your maintenance. You understood when I was in high school, we were pulling engines out of cars and pulling them apart and putting them back together. And now you look in and it's a whole bunch of computers in the car.

Grant Schneider [: 00:32:01

There's an average like 13 or 20 computers in every single car today. So it's just become more opaque to the user of how these things are operating. And I think that's a scary aspect, potentially, of AI.

Carolyn Ford [: 00:32:17

Yeah, well, and even before we get to how it works, just the ability we're seeing, even with ChatGPT right now to spread wrong information, and people are taking it as fact and passing it on because it sounds so credible. I guess it's not really social engineering, but just that social side of it is already causing some havoc.

Grant Schneider [: 00:32:51

Well, and I think the more data that's out there and the AI tools and the ability to understand the right we're seeing, not only are people taking information because it's believable, but there are tools out there that allow someone to understand what's believable to Carolyn versus where am I already leaning? Towards where's Mark leaning? Where are you leaning? And then delivering messages that are going to resonate. Whether they're true or they're not, they're going to resonate. And when something resonates with us, we ask fewer questions about it, it seems right. It sounds plausible. It's what I wanted to hear. And so I see these technology capabilities coming at the same time, from a society standpoint, it's become more accepted is the word I'll use. Not okay, but accepted to be very divisive and to be blunt and to state your opinion, things that I was brought up by my mom. You don't say a whole bunch of this stuff out loud that seems to have gone by the wayside for a lot of folks, including public figures.

Grant Schneider [: 00:34:11

We've got this societal time that we're in, combined with this technology capabilities that can feed on, literally and do feed on each other.

Mark Senell [: 00:34:22

October is National Cybersecurity Awareness Month, and so a lot of people are talking about it during this time. Are there certain things that you're seeing organizations do or best practices that they're talking about to defend against things like we mentioned ransomware before?

Grant Schneider [: 00:34:52

I think one of the great things about National Cybersecurity Awareness Month is exactly raising awareness, giving an opportunity for people to hopefully spend a little bit of time and think about cybersecurity and what they're doing from a cybersecurity standpoint. And I think that for some organizations that are focused on this all day long, day in, day out, maybe they're not going to raise their awareness that much more during October. But I think a lot of organizations that aren't thinking about this all the time for a lot of business leaders and C-suite entities that understand now, I think most people recognize I should be scared that a cyber incident could make my whole business model go away. It could make my whole business go away. You're only one bad kind of cyber incident away from your organization not existing anymore. And hopefully Cybersecurity Awareness Month is an opportunity to go sit down and have those conversations that a leader that doesn't understand this space might be personally scared to have and say, what do we need to do about it? What should we be doing about it? What are the things? I read an article the other day because there's so much out this month, and a lot of it's going to. Be back to basics. I often talk about cybersecurity.

Grant Schneider [: 00:36:21

Sounds cool and sexy, but it's kind of like working at a brewery. If you've ever brewed beer in your house, working in a brewery sounds exciting. But if you've ever actually brewed beer, it's all about sanitization. It's about cleaning stuff all day long, and cybersecurity is that way. It's about doing the basics. It's about implementing multifactor authentication. It's about updating and patching and doing the things because most incidents come from a known vulnerability that didn't get dealt with in the infrastructure that got exploited.

Carolyn Ford [: 00:36:55

I like it. So your words of advice for our listeners, like best practices here is first awareness, and then back to those basics that we've been talking about for years. Multifactor authentication, patches, updates, and remember, it's the same as brewing beer. So there you go. All right, let's go to our Tech Talk questions before we completely run out of time, because do you know what else is cool about October? Halloween? So if you celebrate, Grant, do you have a favorite Halloween tradition or a favorite past costume or coming costume?

Grant Schneider [: 00:37:41

I'm going to go with tradition. I'm less a costume person. It's funny. I live in a neighborhood where the houses are fairly spread out, and I have a steep driveway, so it's typically a disincentive. And we don't have a ton of kids in the neighborhood. You could pretty much tell when the neighbors kids were coming and when they were young, their parents would come as well. And I would always come to the door with a bowl of candy and a platter with a few beers on it as well, or some other adult beverage. For the parents.

Mark Senell:

For the parents.

Grant Schneider [: 00:38:18

But now the parents don't come up the hill. They just throw a party in someone's house and send the kids off. So it's very much just getting to see the kids as they come by and enjoy the costumes and get them to take as much of the candy as possible so I don't have to deal with it later.

Mark Senell [: 00:38:37

Grant, Carolyn is a costume girl. I'm surprised you didn't actually wear a costume today.

Carolyn Ford [: 00:38:43

I kind of wanted to. Like, for all these Halloween episodes, I was going to ask our guests to dress up. Then I thought that might be a bit of a stretch. And now that I know know you're.

Grant Schneider [: 00:38:54

Not dressed up for you, Carolyn, I definitely would have dressed up for you.

Carolyn Ford [: 00:38:59

I'm trying to think who you dressed up as. Grant, you'd dressed up as yourself.

Grant Schneider [: 00:39:10

I'll dress up as all right.

Carolyn Ford [: 00:39:13

All right. Mark, you get to ask the next Tech Talk.

Mark Senell [: 00:39:18

What about Halloween candy? So if you go back to maybe your childhood, did you have a go to candy, your favorite candy?

Grant Schneider [: 00:39:28

So I was always like a Snickers bar, right? Chocolate. When I was growing up, it was all about chocolate. And then I grew up and became an adult. And so what do you do when it was all about chocolate for you as a kid? You buy chocolate. And my kids could care less when they were little, they wanted sour stuff, Sour Patch this, Sour Patch that. And I would see kids at my door, dig, move all the chocolate out of the way, trying to find those couple sour patch things. So seems like it's evolved over the years.

Carolyn Ford [: 00:40:02

Is your go to now beer?

Grant Schneider [: 00:40:07

I'm not really a sweet tooth. I'm more of a savory person. I'll leave it at that.

Carolyn Ford [: 00:40:12

All right, fair enough. All right, last question. Less about Halloween, actually. Do you have, like, a favorite Halloween time, fall time movie or book or story that you like to revisit?

Grant Schneider [: 00:40:30

I don't I've never been a big scary movie fan.

Carolyn Ford [: 00:40:34

Yeah, me either.

Grant Schneider [: 00:40:38

They've never appealed to me that much. Movies around Halloween, that's what I think of. Are all the Halloween movies, literally and other things. So, yeah, I don't think about movies so much.

Mark Senell [: 00:40:57

Let me hit with one.

Grant Schneider [: 00:40:59

I haven't seen Oppenheimer, but it could be the scary Halloween movie this year.

Mark Senell [: 00:41:04

Oh, it's excellent. Is it excellent?

Carolyn Ford [: 00:41:06

Okay. So is Barbie. Go with Barbie. It's also funny. It's so funny. You just don't like

Mark Senell [: 00:41:16

Oppenheimer was really good. Yeah, acting was great. Great cast. I mean, this is very historical. So you know the story, you know how it ends, but it was neat how they kind of portrayed it.

Carolyn Ford [: 00:41:28

All right, do you have one last question for Grant?

Mark Senell [: 00:41:31

Oh, I was just going to say for Grant, yeah, not Halloween related, but for young people who are going to listen to the podcast. Any advice, career advice on folks coming into this arena where they should start, what they should do?

Grant Schneider [: 00:41:54

Diversity of experiences, I think get as many different experiences, and that doesn't mean get a new job every year. I don't think that looks good on a resume, but diversity of experiences and whatever it is you're working on, when your boss or your coworkers say, hey, we're looking for someone to work on this, always say, yes. Yes, I want to go work on that as well. Even if you don't know what it is, even if you're not interested in it, you're going to learn more and you're going to become a more well rounded employee, a more well rounded leader at some point. And really, just what are the different skills that you want to put in your personal professional toolbox and view it as work and life, as a bit of a scavenger hunt for those skills. So seeking out the places where you can go get the right skills, put them together so that your resume is unique and you're able to fit in well with lots of different teams, work on different projects, and be viewed as a value add from your coworkers, your leaders, your customers. Kind of that whole 360, I think is super important. Super important.

Grant Schneider [: 00:43:12

For people to consider.

Carolyn Ford [: 00:43:14

Yeah, that's great advice. And it shows that you're adaptive, you're willing to learn. You're able to learn, which really when I'm looking for somebody to work with or to hire, that's what I want. I want to know, can they learn they may not know the specific skill, but what kind of a learner are they?

Grant Schneider [: 00:43:35

Right. Can they learn what they need to to be successful here? And do they play well with others?

Carolyn Ford [: 00:43:40

Yes.

Mark Senell [: 00:43:41

That's a good one.

Carolyn Ford [: 00:43:43

That's actually really important. I'm still trying to figure that one, so all right, well, Grant, thank you so much for being part of the show today.

Grant Schneider [: 00:43:54

Well, thank you for having me. I really appreciate it. And everyone take some time during October to think about Halloween and scary things and cybersecurity, so they go well together.

Mark Senell [: 00:44:06

No, this was great. Thanks for joining us, Grant. Good to talk to you again.

Carolyn Ford [: 00:44:12

Yeah, and thanks to our listeners. Share this episode, smash that like button, and we will talk to you next time on Tech Transforms. Thanks for joining Tech Transforms, sponsored by Dynatrace. For more Tech Transforms, follow us on LinkedIn, Twitter and Instagram.