Leading Change

so uh welcome all the die Hearts who are up early this morning uh when I got the first slot I thought okay well we'll see people have to show up so hopefully the topic is of interest um the the topic leading change and what we're going to talk about today could really be considered an xor for all of the things that I've tried in my career that haven't worked so we're going to focus on things that are successful in leading change in security and um the approach here is to lead change in an organization without having or using positional Authority so the goal of our conversation is to talk about how we actually bring change about in

organizations without having you know some big heavy Hammer from somebody of the solution uh this kind of ties into what we were talking about yesterday in Aquino address about uh you know um our role as security practitioners is to help not to look at people and say you guys are a bunch of idiots that try to help them learn more about security and learn more about how to be secure in what they do and uh so we'll jump in I call this the double three plus one there's kind of a three aspects to the change Paradigm and then there are four aspects to patterns anyone who's familiar with Agile development knows the term patterns the

the book that this is based on the framework in the book is uh called Fearless change and I highly recommend this book it's a great book it talks about first the Paradigm of change in the areas where we would have success in change and then it has a series of patterns about 24 25 different patterns that can be used just like when we write code we have patterns that are best practices implementation we're going to tackle the first four patterns and foremost basic and most important patterns in leading thing so Fearless change is the book the authors are Mary Lynn mans and Linda rising and the book was published by um Pearson Education in 2005.

I'll give you a chance to write that down I see a lot of people writing email already so um and I would encourage you to ask questions or share if you've had experience with what we're talking about um share your experience throughout the presentation in the very informal presenter and perfectly happy to see a hand raised in the questions with that we'll jump in so the change Paradigm there's three aspects of the change Paradigm the first one is a change agent there needs to be someone who wants to enact a change a lot of times there'll be a kind of a corporate uh directive you know you go and make everyone do complex passwords that's not a change

agent agents that's just something that's difficult to do something a change agent is someone who's passionate about what they're doing they have a they believe that the change they're trying to enact is going to make a positive difference and they're really passionate about it then also it requires some skills and we'll talk in a moment about those skills but also there's just this drive this innate Drive of if I if I work on this change and if we make this change in our organization it's going to make it so that change for us the Security Professionals can be anything from introducing a secure development life cycle and bringing some of the processes tools and skills into the development

side of what we do um all the way over to uh improving the way we communicate with our clients about the security uh that we're putting into the application and the security that we expect them to maintain so the skills that it takes here are soft skills they're they're people skills most of us are have an engineering background and we think a lot about the hard skills you know and we interact and relate a lot better ones and zeros than we do with people but if you want to bring change about you need to develop new skills working well with others we tend to at times be kind of Lone wolves but what's interesting is

you know we can get together and build these conferences together and we work in a group well when it's the topic we're familiar with and we're comfortable with the idea is to kind of extend that and can I work with someone from say marketing in my organization and help get their help and get their advantage appreciating people is uh underused but very very powerful approach showing we don't especially in engineering we don't often we're not touching feelings we don't often show appreciation to people for how they help us and what they've done but this is like the grease that makes everything workable being able to you know put your arm around someone and say thanks a lot

it really appreciate uh makes a big difference to them and and it doesn't have to be a big thing there are a couple of different ways that people are motivated or that they feel appreciated one of them is money and it can be as little as just giving someone a five dollar gift card uh my boss have Pierce is here today and he knows you know there are a couple of times where we've done yes you are for a couple more days so Tav is the owner of caliber Security Department I work for tab and I'm kind of moving off on my own here and tab knows that you know when I'm in the middle of a big

project and there's a lot of deadlines I'm really stressed out you send me a Department so I'm one of those people others are motivated by public recognition as simple as printing a little you know certificate out of word and Gathering the group together and handling

them so uh appreciate the people and it's highly good communicator that's really a challenge for a lot of us in the engineering side of things we talked great with our computers and we live with each other but we don't communicate well with the people where we struggle to speak at a non-technical level for instance um if that's something that you struggle with I highly recommend that you find a public speaking course there's the Toastmasters organization that you can go to and learn how to speak there with people Dale Carnegie Institute offers a course that I took many years ago really really enjoyed if you want to improve your communication skills try some of those and then the other two things that

really really make a big difference are persistence and patience change takes a long time and here's my first xor um I was director of security at a company and uh there were just a thousand things that we needed to change and I was very impatient and eventually threw my arms up I just said I'm I'm patients

patients now so just stick with it and be patient I want to take a minute to talk about the change agent and I think if if you think through all of the people throughout time who kind of cause change to happen Gandhi uh to me is a very good illustration of successful change um he had a very uh low uh class upbringing he was you know born into a merchant classes store from that somehow everything worked together for him to go to England and study law um and then uh really this one man changed the world for what's now 1.25 billion people and he did it relatively peacefully and he started small he just didn't have to

change in a small village he lived in South Africa and that eventually spread to change throughout all of India and really the British Empire and the thing about him was he was pacifist meaning he didn't try to use positional authority to enact change he had personal authorities people respected him respected what he said and respected his dedication but he also was very patient and very very persistent he you have have the opportunity to read his biography or autobiography so he's a great example to change agent and if you take that and put it into your organization if there's a change you want to enact one thing you can start with is just become the expert in

the area you want to not change if it's secure development learn everything you can about future development it's uh you know we want wax I want to put laughs in front of our web application service learn all about the web a known expert in that field so you'll develop that respecter okay so the other another aspect of change that's really important is the culture of your organization and there are certain cultures where change is more difficult than others but it's possible in every culture it's just a matter of how long it takes in order to have a culture of change in country things the foundation is a nurturing environment so that's an environment that's open to change into

the idea of bringing change in we also need the flexibility to experiment and fail and we'll talk about that shortly a little bit more but having some support from your manager and having the ability to try new things doesn't happen with us alone we may have a little bit of an idea and that's a good spark but we need some Tinder to help that spark grow if we're so if you don't have these things it's just going to take longer for it to get done and but there are some organizations where it just fails overall and that's a good sign of an unhealthy organization so far

all right so failure um one of the concepts of agile is the idea of failing past right the faster we can fail the faster we can find out that our product is a bad idea the less time and money we waste so failure is really it's a freeing thing it gives us the freedom to explore gives us the freedom to experiment and succeed in Uncharted Territory there are a lot of organizations that kind of say well this is how we've done it all along this is how we're going to do it we're not going to try anything new and those are the organizations that are disappearing I used to work for one I uh left a 12-year career at Microsoft to go

to work for Circuit City that was a big mistake where it was funny they were written up in good to Great you know they were like the model company when I got there they're not the model company that's the kind of thing that's kind of the death note so failure is a great opportunity to learn and it's and it's the thing is that you know there's a hundred things we might want to try as an organization to build software better or to deliver our services to our clients better and it's great to try those hundred things because somewhere in one or two things that are unique that if they were they'll set us apart from our competitors and the only way we

can discover those is to find things so the concept here is fail fail fast um and uh and get moving on to the things that really works the last aspect of the change Paradigm are the people so um the the kind of people that we want to work with and this is nothing new through data's pie chart though of the the type of people involved in change okay so you have a very very small sliver of innovators those are The Visionaries they're the how did how did the apple ads say they're the fools the foolish ones right those are the guys that are they they show up every week with a new device and you know the they

they're the ones that spend what's it ten thousand dollars on an Apple watch that's a good group to be involved in if you want to bring change if you can commit some of them to get involved they'll help Market that change for you internally next group of course are the early adopters so those are your best people they're a larger chunk and then of course it goes from there and there's always in the very end there's always laggers there's always people who resist that change to The Bitter End and even those people have some value because once they accept your idea you know that it's going to survive so being aware of that type of people is

really really important because it allows you to know who to reach out to and what the point in your change process and find yourself um you know if you're very very early and you want to go look for the innovators you literally look around for the people who are if they're developers you know are they the ones that are running the latest Leading Edge of new development Frameworks and they're the ones that are trying to get those Frameworks accepted and used in the organization even though they're not even good yet um they're great people to start with and get on your on your page you want to spend a lot of time with early adopters

in the early majority because that's where you're going to get your real momentum from change so um how do you how do you find these people you just observe you just have to look and ask yourself you know who they are and what they're doing and just try to figure out what group they fall into there's some other kinds of people that you want to involve in your changing process mavens are information Specialists these are people who just know everything and if you can get and they have a lot of respect because of their knowledge and David to work with you on a project or if you can just convince the name and advertise your project for you you'll

have a lot of success because you you almost have another Advantage for your idea once you find them sales people are good um sales people are helpful in this case I don't mean people that are necessarily on the sales team there are people who just very naturally adopt ideas and when they adopt an idea the first thing they want to do is share that idea with others so that's the phrase sales sales person and those are the kind of people that you want to have working for you at a certain phase in your project there are the condensers once the project has panned out it shows some success we've got maidens uh supporting you and stuff and sales

people the ones and uh you know how do you find them they're the ones who describe gossip they're the ones that talk about you know all the latest things um I I know a guy I worked with at Microsoft who was a uh all of the dirt through everything do you mean what GM was going to get fired next month and how we got all this information I don't know but that yourself and then finally the connectors he was also a connector he just knows people everywhere and that's the next thing you want prospective you're working a very large organization um one of the challenges I had trying to lead changing Microsoft was Florida and had I known then to look for

connectors I would have built this good Network it's funny even to this day um people use LinkedIn at Microsoft to find each other right when you're in a company 90 000 people you've got to have tools to figure out who knew it and Linkedin is a great tool for that and you find connectors through something like that so if you're a smaller company identify the connectors they're just the people that are about they have friends all over the companies they're great to go to and just ask people those are some great ideas hey so those are the people so that's your Paradigm um one other thing to talk about people okay there are three kinds of people in

this world those who make things happen those who watch things happen and those who wonder what happened you need to find the right people at the phase you're in the project you need to embrace this truth okay there you don't spend time early in your project trying to come into laggers to help you move on and accept the fact that they may be your best friend but they're just not going to step up uh and then also be kind to them to the slower doctors they do they need to slow but once they adopt you know that your idea is really there it's really sick so that goes back again to the patients right A lot of times we're just like

this is so obvious why can't you pick up on this well that's fine to have that idea in your head just there's so it's okay to think some things but don't express it at least to the people that you're so last last kind of known on people and less known on the Paradigm so to kind of summarize that you have this Paradigm that you need to keep in mind when you're trying to enact your change because you've got to pick the right people be in an environment that naturally nurtures change or you need to to work with your manager to get permission to try to and the whole idea there around changes would fail fast

try something small we'll see if it works if it doesn't then that's fine

so now we're going to talk about patterns and I really am hoping that there'll be some interaction here with us because so um we're going to talk about four patterns that are kind of the basic introductory patterns to change in the book leading change or I'm sorry in the book careless change there are about I think 25 or 26 patterns for change but these are kind of the first four I mean we'll start with the the test of water and you'll see this pattern is very very similar to the pattern for Agile development it was kind of the goal here in this case you have a new idea and you just wonder is this idea

would this idea work well um in my organization in what I do day-to-day right that may be um you know we've been buildingapplications.net rails rails seems to accelerate development I wonder if that's a good thing for our organization okay so the first thing is testing the waters the idea really is you're dipping your toes in water how well it's going to be accepted you're not making a whole hearted complete organizational shift okay today we write in Java tomorrow we're all going to write in rails we just want to try it out a little bit so small things need to reaction so not a lot of not all of our ideas will take even if they're good ideas

what are some of the things that you could do to test the waters well we'll just start talking with people ask people I read about this new thing um what do you think about it and you know be an expert so be able to explain it have have an elevator pitch so you can explain it very quickly but also have all the details you need behind it so you can answer questions uh another one is to just just do it and give a demo so you know we're working on this new implementation of this application and what I'm going to do is take a couple hours some evening and do a prototype I'm going to pick one or two features

out of the application time how long it takes to build it in your food platform and then I'm going to give a demo to my manager just say hey we might want to consider this group uh and then Brown back so one of the patterns in the book is green food and you know having a brown bag you're not necessarily bringing the food but everybody's got to eat you might as well have an engaging conversation instead in front of them uh and then you know a couple of other things here you can do is take take those conversations in and kind of ask your boss for time in a meeting it's funny have you ever seen a meeting go 43

minutes long if it's scheduled for an hour how long does it take yeah meetings will expand and contract and fit the time you give it so if you talk to your boss and say you know what I'd like I'd like the last 15 minutes of meeting down to 45 minutes to talk about what it is we want to do and get people's feedback so you know that's a great way to get a bunch of people together they're already in a room they're already together and they are going to have a lot of opinions so it's a great way to and then you know the last one has been unseen I have a little story to tell you

that will illustrate that um I grew up in Upstate New York um a lot of people think when I say New York with the big buildings and cities and stuff I grew up in 250 Acres uh and my nearest neighbor was a quarter mile away and my little sister was really smart um one day she was in the kitchen with my mom I think we were in Washington and she said Mommy when you were a little girl my mom said oh yes I did and you know and there's a family story about her she had a

funeral and that was it she dropped it so then a few days later um she came up to my mom and said mommy don't we ever enough land to keep a horse

and that was it she dropped it so then um eventually she said Mommy we really need to get a horse and at that point my mom was totally convinced as well so then when it came time for dinner and they sat down at dinner and my dad was there um my little sister said Daddy I really love horse and my dad lived in my mom to say no and instead what did she say s she said yes and that turned into like 45 years of my mom getting involved in swimming club and my little sister rode rode horses all the way through college so as soon as you know so planting the seed really really

effective plant the seed and walk away from it didn't grow questions on the Tesla Waters does anyone have an example of something that's worked for them

um because you know in the I.T World we're known for how much time we have okay uh so the idea of time for reflection is we're an evangelist dedicated Champion we're using Tesla Waters to try to influence change to happen um and we you know so we're doing all these different things which brings things about but we know if it's working the core idea is to just stop and think about okay what what's going well and what's not going well and ponder over those things and it may not necessarily be about the idea it may be about how we're approaching the change for the idea right so maybe we held a brown bag and at the brown bag

we did a little demo if that's something okay okay this could have been done differently I'm gonna go home I'm going to practice this demo four or five times I'm going to make sure it's just it's rock solid and then I'm going to try the battle again right it's important that we stop and really think about think about I know when I was trying to and have changed in a couple of the organizations are working I'm so busy go go go go go go this side didn't work I'm going to try this idea if I had stepped back and consider Paradigm of change I wasn't using the paradigm all of the ideas that I tried to enact

change they were probably all very good ideas and you wouldn't get effective had I used the parity so a lot of times our Reflections basically more about our style and for engineers I know about all y'all but for me stop being thinking about the soft skills right and I'm like look this is just as plain as the nose of my face like like this but you have to stop and talk to skills in order to be effective he's actually failures by reflection and at some point reflection May indicate hey you know what the idea the overall idea um

how effectively am I using to change paranoid how effectively am I implementing so another thing to do is to reflect as a group so we use retrospectives in agile right we sit down we plan out our releases we do a Sprint a couple of Sprints or release and then we have a retrospective where we talk about how does these go early on in migrating to Agile retrospectives are really important because we start to learn about our estimations right so the whole bowl of agile is I work 40 hours and I go home that's really for me that's what the goal of agile uh and so the first couple of spreads inevitably and the problem is if you're really

agile if you took that work on you're committed to doing it even if you have to spend all this Saturday so it's sort of this really great negative feedback loop where like I'm never going to do that again let's talk about the way that's the retrospective same thing if you're trying to be changed if you have a group of maybe you've got a name

always good to step back and say all right I've been reflecting the internally of my own but what about in the group figure it out um and then ask you know what why how why not and what if I had a great manager I used to work uh for the LDS church in the IT department um where I actually tried to introduce secure development and it's funny because I've spent several months talking about um and then when we were doing a new release of the new product it had a lot of privacy you know actually I actually just said hey you know what let's just sit down for a day and talk about Security in the morning and then

maybe we're thinking after an afternoon activities and boy that took off my manager at the time and when we were in one-on-ones and other conversations who would ask why there's an answer if we asked okay but why do you compare each answer part going down five Watts so if you're looking at change and it's not going well for you and you want to have the retrospective either with yourself or with a group not if I was okay well I tried to implement um the idea of threat modeling and failed why did it fail uh well um people didn't people wouldn't let me have a threat well why wouldn't they let him in a certain way well they thought it took

time away from the organization building software well why did they think it would take time away from the organizations oh maybe they're not educated so why don't I take a brown bag on and not do it for a model to talk about it show them how down the road okay so rule 5y small successes is in the next pattern um look change in a lot of it organizations is we work in in some cases we work in very bureaucratic organizations that are very very resistant and um honestly like I don't know about you but I don't like a mouse they need a piece of cheese every now and again and uh small successes the idea here is just

celebrate whatever you can celebrate the very little things are helpful so um the pattern the the background the pattern is the five patterns between some of them words some of the inhabits and um you have to keep in mind that you can have good days and bad days and the bad day is seen to accentuate themselves quite effectively we know when we've had a bad day when we know it's the good things that are a little bit more um I have a good friend who works as director of security at rally software and he's been trying he's the first director of security of the organization and they're they're they fit kind of resistance to each other and he was

really frustrated by it as with his previous job until he said you know am I more secure today than I was yesterday and if so let's celebrate that and it's the incremental little steps and celebrating success may seem kind of silly but you know what just getting a group together and going out for a for a you know whatever you want the sparkling water or beer or whatever and just kind of celebrating hey you know what we get our first draft model ever let's let's have a little party it's a great idea so recognize those little successes especially the small ones and the early ones long change can take forever so the idea is we have this goal that's way way

out there but let's make sure that we're focusing on what we're doing day to day um and step by step which we'll get to in a second and you know the celebrations don't have to be big they can be sometimes a celebration is just healing away from work for half an hour hanging around and shooting the breeze we used to do um in one group I worked in Microsoft they did here Friday uh and we would go down to the store and we'd buy junk food and we would buy tabloids and from three to about five o'clock on a Friday afternoon you just sit around and talk about the project and we also you know just have a good time just

after pressure on you know I'm a developer I'm a program manager trying to get this stuff done we're you know at odds and all that stuff back the early victories are really important even if they're small because they they're a feedback loop right if I have this idea I throw it out there and we'll be home I did a couple early victories and now I'm on the right track and that gives me the energy to stay dedicated and committed

so um the last pattern here is step by step the idea here is you realize now that there's actually interest in your idea and the the important thing is to so you want to know um how to introduce you've got some early feedback that is good what do I do now to go forward okay and the idea is to use that incremental approach I was just talking about where you've got this Vision out here and that's fine that's where you want to be but focus on the next step don't

it's funny I I mountain bike a lot I had the opportunity to fly through the professional racer who's really interesting right it's a very interesting story I'd say all vibrations we have plenty of time uh she had Mono and had to cancel one of her seasons she came back the next season and won her first race and then she got hit by a car and broke her pelvis and then she'd walk again and the last I saw on Facebook last night she's wearing the yellow Jersey in Vietnam there's an international mountain bike the kind of person that really sticks to it right and she taught us when we were riding she's like look you can't look at

the bottom of the hill the bottom will come and you can't look right in front of your tire you look about 15 to 20 feet ahead of your bike your parental division will pick up everything and you'll have enough and change is kind of the same idea you have an idea of where you're going and that's coming at you no matter what so and then you've got the things you're doing day to day right I want to know your next step it's the next one or two steps into the darkness and every once in a while when they do your positive reflection you can make sure it will pay am I still in the right

path or are these things the wrong way is it actually the right way is

it so it's the same idea as climbing a ladder right we do it one rung at a time so the other thing to keep in mind is that a plan changes right it was the Patna said you know battle plans are great and they're uh but they get thrown out the window at the moment the engagements so um the idea here is also with the step-by-step thing look through the things that you can use the little things that you can have that will gain confidence for you for the team that's trying to inactive the more importantly for the organization that's taking the risk in the time that it's sort of Divergence any questions those are the four

patterns any questions or comments in the patterns so far so we're on to our last slide we've got about 20 minutes left so actually so some of the Lessons Learned From The Trenches this is kind of the rest of my xor um people and companies are are better with change it's the frog and the water approach right if you stick a fog in the car water and turn the heat on the fog will stay there and avoid you drop a frog in boiling water they'll jump out of it so bring your change in slowly I have a a former manager who had a fantastic mindset I was very enthusiastic about my job I wanted to come in and just change

the world in this organization where I was and she would always be focusing and say John you can't boil the engine you've got to pick one or two things to focus on and focus on those and then welcome vision um you you should give a general idea of the direction you're going but the last thing you want to do is walk into the office I do a lot of work in Secure development so that's why the last thing you want to do is to walk in with VP of engineering's office and say a year from now your developers will will all write code and before they check their code in they're going to run it through static code analysis but

we're also going to have unit tests that cover both use cases as well as of use cases in security what VP in the world would hear that and be comfortable none of them because that means a complete up how they do their work what you can do is walk in and say you know what I've got a goal the goal is that a year from now we're going to be writing significantly more secure code we've got a number of ideas to work on it I like one of that want to get some static code analysis tools and start running our code through that just to see where our vulnerabilities are and what type of things

that has value and that didn't ask for a year-long commitment that asked for okay I'm going to spend some money and I'm going to spend a little time and so long-term Vision keep it to yourself gazelle-like intensity so my wife is fantastic about finding and she's a big fan of uh Dave Ramsay yeah and he talks about gazelle like intensity right what's the idea of gazelle like intensity well if I'm a gazelle and there's a lion chasing me I am very very involved in that moment and I'm super intensely focused on escaping with my life pattern in the Paradigm is what will yield results it's funny I I've always or had historically approached change from a ad hoc perspective

I'm a Visionary in my life you know today I'm like oh we should totally redo the backyard this way and then tomorrow I'm off thinking about the garage backyard it does um the idea is to uh you know be that Visionary but also uh pick one thing and work on it and then the next thing you're working on it and the next thing so be organized in your approach um and then change is best accepted when it's couch and self-interested terms and the self-interested term change depending on who you talk to right so if you're talking to CIO they really don't care too much about um new things okay we're going to do this and your developers are going to know

how to write code that's free of SQL injection vulnerabilities great I'm excited about that what I really care about is getting my product out the door so with the CIO we talk about change in terms of well you know if we can work to teach the development team how to write code that's free of SQL injection vulnerabilities that's going to help you because number one your code is going to pass the security review the first time instead of getting kicked back number two when it goes out the door it's not going to happen when you talk to the CFO they love return on investment and they love risk reward right so I can go to a CIO and I

can say look we've got X number of PHI records in our database if we were to breach every single one of those records that would cost us three hundred and thousand dollars a record times however many would have so we're looking at a three million dollar risk and you know I think one of the ways we can significantly reduce that risk is if you're blah blah help mitigate the three million dollars and then uh CEO let me talk about filling the board expectations accountable for security and so it's a great opportunity to say look I know the board is looking for this Engineers are about learning these things it's about getting things done in most cases and so you speak there this

year really doesn't care about their internal investment as a lab they just care you know oh

so speak in the language of self-interest and think about your your audience and what they may need so in the end really the whole idea here about change is it's it's a conscious thing there's there's a paradigm there's some patterns to put in place the real key is to recognize oh I want change to return my organization first recognition second one there are ways to do it successfully let's stop and think about them what's my Paradigm who are the people that are going to help me with my team how am I going to do it what are the patterns I want to apply and then really very consciously go through the process and you'll be

amazed at how much more effective you are and to bring this all back to what we do in this room we have a finally I guess is one way to look at it there's a culture of conversation in the country today about security and privacy we have the opportunity and the responsibility of Security leaders and even if we aren't managers we are security we are the thought leaders we have the opportunity now to push that change in our organizations which is we need the right skills we need the right tools and this is one very effective so with that I'll open up the questions

thank you foreign

security pain is the number one reason to change right I mean look at look at Target look at all the people that breach what do they do after they agree they turn around and they fix it yeah wait how many oh I just heard okay all right they yeah that's fine so yeah it's pain is a key uh change now it's very reactive and I think everyone in this room would agree that right now security and security change is an incredibly reactive industry in other words we don't do anything until it's broken the real key here is to be able to drive risk conversations in your organization based on the pain that other people have experienced

and say okay you know Anthem breached recently and look how much this is going to cost them take the couple hundred thousand records multiply by one of them is bigger 360 that's a lot of money are we prepared and so the best thing is to try to use other people's pain foreign

vision is Best Kept yourself so if you say boss man we are going to implement all new Cisco firewalls we're going to rewrite we're going to take our flat Network and segment it we're going to put access between networks and and this is going to be fantastic what is your Boston too much work downtime people are going to complain so there's there's a better way to approach a smaller

so I'll give you a indirect form of answer that um I had a a friend who knew a man who did the passion in the course of his lifetime he discovered you know the records of 145 000. that's a lot of people uh and so my friend asked him how do you do this and the guy's Mantra is great do as little as you can every day without doing nothing so if you're working with a client who's who's default the first right now is do nothing you know we could sit down and I don't know there's I mean a potential a lead there isn't a lead in the world that I've spoken would like to be more Secret

but they'll all say I'm constrained by what money time and resources people right so so we say look it would be great if we had a complete secure development life cycle in this organization we are constrained by money finding people what's one step is it is it a day-long training on on oauth's top 10 defenses in.net okay well then let's do that training um you know is it I would love to buy all the Cisco firewalls we can't afford that okay well have you done a review of your apples and just to talk about that for the little things just pick a little thing and you know what happens is sometimes those little things will snowball and

you have those successes the little successes that lead to more and more sales because and they know when I engage with this person I become more secure day after day after day and when the wallet

okay all right okay we got time for a couple more questions or comments but that yeah this everything will be available

other questions call me hey it's been a great audience