BSidesNYC 2023 interview with Munish Walther-Puri.

hi Manish thank you so much for being here at Biz NYC and welcome here I heard you were here at bides NYC in 2018 as well so can you quickly give us a brief intro of who you are and what you did at Biz NYC 2018 and why you're here again sure um it's really wonderful to be back thank you for having me here uh my name is Manish Walther pory uh I am have been in the New York area for some time but my background is a weird wandering work on risk and security uh working in a couple different domains including cyber risk and cyber investigations but also geopolitical risk terrorism nuclear policy my career's been all over the

place um including a lot of periods of unemployment that's very important but that ranges a lot of it ranges a lot of things I think one of the things I've learned over time is that culture is really important for me okay so the places that I've worked more recently I'm very proud of where I've worked not just because of the work that I've been able to do but the oran organization that it was and the people and the people yeah know that's a big motivator for me so uh now I'm at an organization that I really love and was drawn to because of its culture called exer and uh I work on Cyber and supply chain risk

focused on critical infrastructure and we use data and Technology to uncover risk in business relationships different kinds of risks supply chain risk cyber environmental social governance Financial crime all kinds of different risk in different kinds of relationships so I'm very glad to be there again again not just because the work that I get to do but with the people and the culture prior to that for almost four years I was the director of cyber risk at New York City cyber command okay and that was incredible opportunity but a wonderful organization okay and that's what really drew me there so 2018 I absolutely remember being here because there were a few dynamics that were lined up I was working at a startup

at the time and trying to connect to the New York Community a little bit more more sort of the security research Community I was connected to the industry community and and other areas but the security research Community is what um I really wanted to connect to more and obviously a knew about bides and knew its reputation so that was one Dynamic the second was um the uh women's March was happening the same day okay and uh my family and I had organized a bunch of people to attend the women's March and we had a young child mhm um who was I think just uh um eight months old okay and my first thought was like is this a good idea like should I

should I even be doing this like we have the family like what and my partner who's always been incredibly supportive was like yeah go and we figured out uh all right well I'll go to some part of the conference then I'll meet you at Columbus Circle and then we'll March okay so I remember this I was it was okay to integrate the two but I was going to have this b forc day where I was going to go and think and talk and learn and connect and then go make my voice heard sure you know in in support so I get to this conference and I'm very focused because I know I have a limited

amount of time you know you're like oh I'll catch you later at lunch we're like that wasn't going to happen I was like I got to go in and do the thing um but in that and I I met a a b many wonderful people but in that there were three talks three conversations three people that I connected with and that I then uh became colleagues friends mentors co-workers with in the years after and learned and continue to learn so much from the three of them I will tell you about them but what's most important is that they all came here and presented with the ethos and the spirit of bides which is generosity okay and in their learning

and what they've experienced and what they know and I I know that people say that it happens in in lots of different Pockets but there's something unique about bsides and that something unique is that is the primary motivator that is the currency of bsides how much are you able to share right how much are you able to reveal and and connect and it and everyone knows this from the history the B side bides that it doesn't you know you don't have to be the top tier it's just like here I'm here so the three people the first was Runa sunvic who at the time had built the information security program at the New York Times okay and she talked about

some of her lessons and learning and I can still remember a lot of them one of them is she talked about a leader board for security awareness of who was opening the fishing emails okay and journalists would come find her in the hallways and say how do I get off the list how do I get off the leaderboard list right so it was an incredible lesson and not only the protection of journalists and media and was very pression around disinformation some of the challenges to those who are telling stories but also changing people's behavior and and in a way that's a little a little bit gamified but fun and effective and how do you make a name for

yourself without making enemies when you're new in an organization and I continue to learn from Runa about that community and her approach the second person was in a Sidetrack um actually there were two people who were there that I came to see because I knew of them but really wanted to hear from them one and both of them it was about um entrepreneurship I think um I believe that was the track okay um one uh had a startup that was focused on operational technology and IC and the other was talking I think about the startup landscape okay I think both of these people just to add um talking about operational technology um in 2018 I

think that's fairly ahead of the curve even then it absolutely the very good point is that at that time people were like H okay you know like there wasn't a there was an urgency around it in in the same way that there is today obviously so both of those people have continued on their amazing trajectories um but I'm I'm you know still connected with both of them one is Galina antova who is a co-founder of clarity okay and people know that name now because they're huge and massive and at the time she was so open and generous about what she was learning as an entrepreneur and as a leader the other was Kelly Shortridge um who I think many people

know and respect for her um nonlinear provocative thoughtful funny approach to think about security engineering and how to do what we do better okay and I contined to learn I learned from them up until that point but at that point forward I was like these are people I want to learn from and follow and connect with um and I continued to do that but I met them all here okay so I said there were three stories I left the most important one for last I in the keynote in the keynote room there was someone who was speaking about New York City cyber command and again I was here with the startup and different I thought

this is interesting I didn't know about this organization and I had been really focused on learning about the New York City cyber security Community okay I didn't know about New York City cyber command I was like what is this thing okay and this was despite you being here for like how many years uh at that point three years okay um and I wasn't deep in the community but I was like I guess I missed this like the city of New York has a okay what I learned is it was relatively young at that point um uh just a little bit older than my first child just a little bit older than my first child so I was like okay it's

all right that I maybe haven't heard about it but afterward I and and I was compelled by what uh the presenter was talking about and I went up afterward introduced myself got their business card um I wouldn't say it didn't think more about it but it just sort of was there and the then less than a year later I found myself looking for a job okay and I found a at New York City cyber command and I had followed up with this person and then and at that point back to what we were talking about in the beginning I knew that culture was crucial for me yes just for me I'm not saying you know other people like

culture is important it's like hey look you you do what's important for you but for me culture was going to be it and I would not apply for a job unless I knew somebody there who could connect me to other people and I could find other people there who could talk about the culture in a very real way got it so you were looking for um similar-minded people who can add value to your career and help you grow actually for me it was about um empathy compassion transparency trust kindness which is very much needed in the C very much needed and felt like I don't even know if I'm going to find that uh so I reach out to this person

and and they said yeah I think this is maybe a role let me talk connect you with the people and then fast forward I got that role and I didn't meet when I when I got there I thought okay I've got to know some people here this community small I got to know some people and there was like one connection maybe that I might have had okay but I had no other way into that organization I'm not saying oh I got a job I'm saying that I learned and connected with people in a way that I would not have otherwise and that person her name is k Ence Phillips okay and she goes by q and

Q became was someone who I admired wanted to learn from learned so much from uh and when I was at the organization people would say like what is what is the point of this City going to this conference like why are you going out into the community I would tell them this story I would tell them about bides say there is this conference right that happened and Q was there and she was out there talking about it and it didn't happen immediately and so I tried to emulate that and model that and stories that I can talk about that but I I think and I'd like to think that I helped do that and not just evangelize

the mission but stay oriented to the community and at the time that I joined the first I'll leave it hear the first All Hands call that I joined the then ciso leader spent the first two minutes of the All Hands call talking about the importance of kindness okay that's very that's very important well I thought I'm at the right place Y and I think with besides what you're saying is you found talks that were very interesting that made you think further and establish a good network of the kind of people that you wanted to learn from that you looked up to that you aspired to learn from and all of this was possible because of this community and

the way they come forward in terms of sharing their knowledge with everybody else absolutely and every bides has this but it takes on the local flavor and New York is a bit aggressive and iny face and that's okay like that's New York right and so that's what was here is that people were really proactively engaged and talking to each other finding each other and and seeking each other out and actively debating and sure that happens to of the industry conferences but it happened here in a way with organizations and representation from people that you would not otherwise find together in a room and that it was hosted at John J was also really wonderful there's a lot

of stored academic institutions there's something special about it being at John J cool thank you for that as well and before we head into the fun segment that I planned for this session what would you say is the thing that you love the most about your current Ro oh that's a very great question uh we talked about the culture in people what I will say is there's at my organization there is an equal balance of desire for execution Innovation um and and do and doing the right thing okay so that that balance which is hard for organizations particularly for-profit organizations to struggle to to to balance that it's in a trilemma MH but making the world a safer place to do

business doing that through you know execution and balance of innovation thinking differently doing differently and then getting things done that balance um in terms of how they operate at the core I mean if I were to the thing that really drew me and that I'm still incredibly proud of that I love and share is the culture it's transparent there's people with Integrity they're principled they're kind um they're engaged they're collaborative and they they model the things that we want to be we talk a lot about trust in in the supply chain like let's make it abstract for a second intellectual it's trust in the supply chain this organization has trust at its core trust in the way that people

operate trust in the way we work with our clients trust in the way we build our technology like it's at the core okay and so I I think that's what love most about it I feel very fortunate I say this with humility I can do what I do a lot of us can do what we do at a lot of different places yep great but to me the difference is the how and the who got it and that's why I'm at exer nice very cool um the other question for you is what is the most uh exciting talk for you today or the most exciting part of the besides NYC conference today that's a very good question there is a bunch of

great talks that I'm excited to see from some colleagues John czecho is talking very soon about uh cyber security and in automobiles um there's a talk on log 4J and resilience and supply chain um Lance James gave a very thoughtful as he always does fun and funny opening keynote uh I ended up speaking with his wife as a neuroscience PhD we talked about decision science and risk taking and and um and rewards so uh and then to bring It full circle I didn't know but ended up sitting next to one of my former colleagues from New York City cyber command at the KE and that was really nice it all comes for a circle and we both teach at universities around

here now okay so um okay from the talks perspective I would say it's actually the workforce job track there's a lot of great conversations in there not just like here's how you get started in cyber security but like here's the state of play if you're a season person this is what you need to be thinking about this job market is really wonky MH right now it's very strange yes in in all kinds of Industries but particularly insecurity um so I think giving that and usually there's like one or two talks about it but the fact that there's a whole track I think is what's really fantastic that's that's genuinely I'm excited about for people here and people

have come and talked to me and said hey I'm looking for a job and I said which are the talks are you going to you know I think that's that's the driver is to be aggressively curious about how to do things differently because you cannot take for granted like what worked before is not going to continue to work in terms of looking for a job um and that is both because of the market and dynamics that are out there chat GPT you name it you know that are that are driving things differently so I wouldn't say there's one talk it's more the the comprehensive and kind of the amalgamation of things yeah great and I

think that also appeals to The Wider breadth of experience that you've had that you know these amalgamation of talks really appeals to you yeah yes the balance totally there's some good technical there's some strategic there's some behavioral um Dr Jameson is talking about yeah resilience but also is talking about decision making I think it'll be great yeah very cool thank you for sharing your perspective yeah and the fun segment is a question that I had asked you um to prompt uh to chat gbd something that you're really familiar with and we really want you to look at chat gb's answer and tell um what it did well what it could perhaps improve upon and what something like person who truly

understands cyber security can discern from what chat gbd gave us a response MH so the question that you gave was or the prompt that you gave was you are an expert in security risk and strategy you're talking to five-year-olds give them a brief compelling story on the risks of Technology on society and speak at their level use humor and consider the attention span of a 5-year-old which meant it has to be succinct um so do you want to read the answer the chat to be sure sure sure yep go for it okay so do you want me to read out loud yes yes all right I don't know what the chat GPT voice is so I won't uh I won't do that

I'll just read it my voice uh but now my voice is going to be used to other things all right once upon a time there were some friendly little robots who love to play and make friends they were smart and knew how to do all sorts of cool things like play games talk to each other and even help people with their work but one day something went wrong some bad guys who wanted to use the robots to do mean things got a hold of them and made them do bad things like steal things from people and break things the robots didn't know any better because they were just following orders but people got really upset because they

lost their stuff and didn't feel safe anymore that's why it's really important to be careful with technology and make sure we only use it for good things we should always ask grown-ups for help and only use technology in ways that are safe and kind to others remember just like with any toy we need to play with technology in a way that is fun and respectful to everyone around us okay and what are your thoughts on that um I give it a B minus maybe a C+ okay um I'm a harsh grader but it's the truth I think the most important thing here is the values that you're giving to them of um to be careful with technology make

sure we only use it for good things 5-year-olds at a place where they're still figuring out what is good and bad okay right so empowering them to figure that out and we should always ask grownups for help and only use technology in ways that are safe and kind to others I don't know that grown-ups know how to do that yeah the chat GPT is a great example of not knowing how to use it in ways that are safe and kind to others yeah the whole point about like the good and bad right it's it's defined differently for different people and especially to your point five-year-olds that's actually the job of teachers Educators parents to actually help them Define that value for

them right and let's take the morality out of it for a second I think the thing that um I struggle with with this is that it's great that they're using their imagination um I would almost ground it in something that they know okay um you know having robots to play with sounds like a lot of fun you know and that that's very imaginative but also not entirely relatable okay right in terms of like what the risk is and something that they've already experienced maybe perhaps a phone would have been a better example a phone could be an example or you don't even have to talk about technology I think this is one of the challenges so the things that I think

did well I'll give Chachi a little bit of credit um you know speaking on their level starting with the queue Once Upon a Time um and I gave this queue for two reasons one I think if you understand something at its core you can explain it to 5-year-olds in a way that is not pejorative but gets the basic components and two you could replace 5-year-olds here with Executives at your company that aren't working in security yes yep right and then the prompt is still pretty valuable so I think about this a lot you know speak at their level use humor consider their attention span okay and what is is valuable to them um so some ways to go I think the important

things about stories is that they um they stay with people correct and and thank you for ending on that because um in the end the message is really about connecting with the people and that's what these conferences are all about yes well I would like to close by saying thank you to the team of volunteers that are here that includes you thanks um and a special thanks to Huxley Barbie um who did did two things one um at some point he went I'm going to restart this I'm going to reboot this and I don't know if he knew what he was in for when he did it but he took on that challenge fully he did it collaboratively he did it and

brought back the full Spirit of bides um and I'm also grateful to him he came and found me during one of the side conversations like do you want to talk and I was like absolutely I want to share the story so I'm very grateful to to Huxley but also the community of volunteers and I gave him my word and now I'm going to say it here that for the next bsides like I'm in I'm here to help great thank you so much for coming here and for being a part of this wonderful community and sharing your experiences with all of us really appreciate your time Manish thanks for uh coming here thank you all right take

care