Gordon Draper (00:02):
Hi, I am Gordon Draper, host of the Cyber Consulting Room podcast. Today we have the privilege of diving deep into the world of cybersecurity with a true industry veteran David Jorm. With an impressive 25 years in the software industry, including over a decade dedicated to security, David brings a wealth of experience to the table. Not only has he successfully managed teams of various sizes from small groups to global operations, but he also maintains a hands-on approach to his work, particularly in the realms of offensive security and DevSecOps. What truly sets David apart is his unwavering commitment to nurturing new talent in the field, a passion that's see him actively involved in numerous university, higher education and graduate employment programs. So without further ado, let's delve into this captivating conversation with David Jorm. 

Gordon Draper (00:55):
Welcome David.

David Jorm (00:55):
Great to be here. Thanks for having me. 

Gordon Draper (00:57):
So I just want to thank you for joining us today and just like to ask how did you get into cybersecurity slash information security?

David Jorm (1:04):
Yeah, so I started out in the late nineties, the online hacking computer security scene. Before it was really an industry. I remember there was some of the early businesses like the loft crew, people who were making a living out of it, but it was mostly just a hobby that people had. I dropped out of high school when I was 17, started writing code for a living. I was writing all kinds of shoddy PHP code. One night I was at a Drum n Bass gig actually in Canberra and I was out the front smoking a cigarette and this guy came up to me to scab one, and I got talking to him and I said, what do you do for a living?

(01:39):
And he said, I'm a penetration tester. And he was explaining it to me and I was like, that's a thing, you can do that for a living. Now that must've been one of the earliest people to have that job title in Australia, and he became a really close friend of mine. So ever since then, the seed was planted in my mind, but I went off and did all these other jobs. I was working for the Bureau of Meteorology writing Aviation meteorology code. I was in China building an online hotel booking system. And then finally when I got back from China in 2009, an old friend of mine called me up and he said, Hey, we're building a team in Brisbane. We're going to do all of the technical writing for Red Hat's core documentation. Do you want to join? And I'm like, yep, let's do it.

(02:18):
So I came up to Brisbane, got onto the team, and I was writing documentation for KVM, the kernel virtualization machine, and then I saw on the internal couriers site a job for product security and they wanted somebody who was a Java specialist. So that was my first gig in security and I've been at ever since then, all my jobs have been full-time security since then. 

Gordon Draper (02:38):
Java was one of your strengths back then?

David Jorm (02:41):
I got a lot of mileage out of Java, so the way it worked was they had this one guy called Mark and he was the Java security expert and he actually wrote a book on Java security. The book's called Java Security, and I was meant to be hired as his sidekick, so I got hired as his sidekick, but as soon as I joined, he was like, actually, I've got this new gig at Oracle.

(03:02):
I was just waiting for them to hire somebody so I could leave. Then I got left holding the bag and I was like, okay, it's sink or swim. I got to learn Java. And I did and I got dozens of CVEs. We found new categories of vulnerability in Java. Built one of the first Java software composition analysis tools. I got a lot of mileage out of it. Java was good to me.

Gordon Draper (03:22):
So did you always want to be in cybersecurity information security? 

David Jorm (03:26):
I think so. That was always my passion as a teenager. And I remember after I dropped out of high school, I was training to be a chef and I'd go into the TAFE restaurant and work in the evenings and then get home at midnight and get online and play around hacking stuff on the internet. And I remember one night my dad came out at midnight to get a glass of milk or something and he said, why don't you do the cooking for fun and you do the computer stuff for money?

(03:52):
And I was like, yeah, that's a good idea. That's a really good idea. And so I think ever since then, yeah, I always wanted to, I just didn't, in the late nineties, early two thousands, there weren't really dedicated jobs going, so it was only once I got that opportunity a bit later on. 

Gordon Draper (04:07):
I did a bit of help desk work with ozemail at the time, I know exactly what you're talking about, I'd be in IRC channels, but there weren't that many jobs in information security that I was looking for. Symantic had a few things going on with the virus taxonomy, et cetera, but not necessarily pen tester or binary exploitation expert. 

David Jorm (04:30):
Yeah, exactly. It wasn't until much later and then that whole ecosystem has grown. It's amazing to see what it's turned into these days. 

Gordon Draper (04:38):
What education qualifications do you have? Do you have any industry certifications?

David Jorm (04:44):
After I dropped out of high school, I did wind up going to university. In Australia, you're considered a mature age student when you're the ripe old age of 21, and I was 21. I went and sat the stat exam, which is basically just an IQ test and if you get a high score then they let you into university. So for any young listeners, if you're really sick of high school, you can just go and do an IQ test when you're 21 and get straight into university if you get a really high score. But I don't know if you want to take that advice or not. Anyway, so I did that and I got into university and I wound up, I jumped around a few things, but I wound up graduating with a degree in geography and pure mathematics, which kind of has no bearing whatsoever on what I do.

(05:21):
It did enable me to do some of the aviation meteorology work at the bureau. Maths knowledge is always useful. It's not really core to anything that I actually do in terms of industry certifications. The only thing is the Crest CRT that I did in about I think 2017 because it was part of working as a pen test consultant. They wanted everybody to have some sort of crest cert, but that's it. I haven't done any other industry certs. 

Gordon Draper (05:44): 
What would be one of your advices with regards to industry certifications? Is it something that you would tell everyone to go and get as many as they can, or is it something that you'd look at a candidate with experience over an industry cert? 

David Jorm (05:58):
I think it depends what you want to do. So if you want to go into consulting, there is a lot of currency placed on it. Certain customers won't accept you on their gig if you don't have a particular certification, they probably can't charge as higher day rate for you, which means you won't get as high a salary. And then if you look at things like red teaming today and all of the legislative requirements there to do a compliant red team for a financial services institution in Australia, you have to have all of the qualifications that are specified. So if you want to be a red teamer for example, you kind of have no choice at this point of going and pursuing the certs for other, like say you're on blue team, it's not as strictly mandated, but I think these days I'm now in a senior management role and I'll probably never go back to anything other than a management role, so I can get away with it. But if you're trying to go through the ranks of being security consultant, senior security engineer, principal, security architect, these kind of roles, I don't think you can avoid it entirely. You're going to have to get a few. 

Gordon Draper (07:04):
What challenges do you come across when you are hiring the right consultant for the right position? Now this could be anything from your past experience as a leader in consulting firms or possibly where you are now and you need to bring on consultants to do some work for you 

David Jorm (07:21):
In the consulting industry, I had two stints in the consulting industry, one for about two years at Trustwave where I was the practise lead for Asia Pacific and one for six months where I was a managing security consultant at NCC. And at NCC I didn't have a lot to do with this. I was mostly an individual contributor, but at Trustwave I did have a bit to do with it. And this was pre covid, this was like 2016, 2017 pre covid. Everything was kind of on-premises. There were a lot of physical onsite tests going on and getting somebody in the right location was actually the hardest challenge.

(07:55):
You'd have this triangular constraint of like, I need a consultant who's physically in Sydney who I can pay X dollars per year so that I can actually turn a profit off them and who has these skills and certifications so that the customer will actually buy them. And trying to get all of those attributes in one person was actually really difficult. Get two out of the three, but trying to get all three of them was always a challenge. These days, I think some of that has been alleviated. What I've experienced more recently has been doing augmentation. When I was managing the pen test team for Commonwealth Bank and we'd use big four consultancies to augment a headcount and there the challenge was always you'd try and get consultant X from them and they'd present consultant X to you when you were signing the deal, but then as soon as you actually signed the deal and got into the execution phase, consultant X would quickly get redeployed, you'd never see them again, and you'd have consultants A, B and C come in and you had to kind of vet them because otherwise inevitably you just wind up with a bunch of grads and junior consultants on your gig while they roll all the senior people off to the next shiny thing.

(09:00):
So you always had to kind of actively manage it and write things into the contract. We have the right to vet these people and to reject people if they don't cut the mustard. And it wasn't so much to be elitist or exclude people, but just so that you didn't wind up with a team that consisted almost entirely of grads. 

Gordon Draper (09:19):
Everyone's got to get somewhere eventually, but you're right, if you're looking for a certain standard of quality in their technical skill, someone fresh out of university is not going to be able to compete with a five seven year veteran. 

David Jorm (09:33):
And I do wonder whether consultancy is actually the right gig for somebody fresh out of university. If you're charging these high day rates, it becomes quite difficult to actually justify them if the person doesn't have some experience under their belt. 

Gordon Draper(09:47):
That's a good point. Have you purely only been in Australia as a consultant or in the past?

David Jorm (09:53):
Only employed out of Australia, but I've done a fair few gigs overseas. Probably the most interesting ones were in Singapore. So when I was at Trustwave, we were owned by Temusec Holdings, which is the sovereign wealth fund of Singapore, and they own a whole spider web of companies around the world. Unsurprisingly try and get their child companies to do business with each other. So we would wind up doing pen testing consultancies for other temusec holding zone companies, most of whom are in Singapore. So I got that exposure there. I also had exposure to the market in Silicon Valley when I was working for a software-defined networking company, and we were split between Brisbane and Santa Clara, so that was an interesting kind of cultural perspective. 

Gordon Draper (10:33):
I haven't had any experience directly in the valley, but I hear pre covid it was very unique in its bubbling over of ideas.

David Jorm (10:43):
Yeah, yeah, it really was. It was this place where everyone was working on the next generation of something. Everyone was trying to break down a new frontier. There's a real energy to the place, but there's also such hype and over hype and overvaluation and so on. It was, yeah, it's hard not to be a bit cynical about it. 

Gordon Draper (11:02):
I'm really interested to hear from you on this one. What is one of your most memorable experiences consulting on cybersecurity? 

David Jorm (11:09):
I've had two. One of them was pen testing a plane in Singapore. We got it through that kind of teec holdings thing, and then when it came up, I was salivating over it and I was like, I built the aviation meteorology system. I know how it works. I'm a pilot, I'm a recreational pilot, and I was trying to spruce all my credentials and my boss was like, yeah, okay, you can do it.

(11:30):
So I had all these fancy ideas about how we were going to pen test the plane using radio frequency attacks. I've got this theory, there's a thing called a meta, which is a meteorological ideation record, and it's a message that's sent periodically to every plane from airport where the station's telling them what the conditions are, and if those conditions change drastically, it sends a special message. And the speci usually says things like the thunderstorms, there's wind shear, there's drastic changes in the conditions, and if those conditions are drastic enough, the operational manual for the pilot will say to put the plane down at the closest airport. So my theory was they transmit these things on two frequencies, a primary and a secondary, so to take the frequency where the airport was actually transmitting the primary, jam it locally and then transmit on the secondary frequency and tell the plane catastrophic wind shear and you've got to land.

(12:21):
But they wouldn't let me take the RF equipment through the secure zone at the airport, so I never got to actually test my theory. That was a really interesting gig. And nonetheless, even though we were really constrained in the scope, they wouldn't let us touch anything. We still actually found some interesting findings, which was cool. And then the second one that I got was for a telco, and I'm pretty damn sure that it was the government's metadata retention system. I never actually said federal government metadata retention system on it, but I'm pretty damn sure that's what it was. It was plug into the switch, have a route on every server in two hours, fastest complete takeovers of any system I've ever done. Those are probably the two most memorable ones. And that's the Australian government. Could be the Australian I think it is, but I can't say that with any certainty. 

Gordon Draper (13:15):
On the plane, Did you basically just get given a, they don't have network ports necessarily that you can just plug into or 

David Jorm (13:20):
No, that's what we were asking. We're trying to negotiate the scope because once you start looking around a plane on the ground, I think when you go on a plane, if you're not a hardcore criminal plane hijacker, which I'm not, you kind of mentally constrain yourself. There's all this stuff for the crew and you don't really pay attention to it because you're not the crew. You just want to get on there and start binge watching deadwood or whatever you're going to watch on the back of the screen. You're not really thinking about it. But once you actually start to look around a plane, there's all this stuff that is physically accessible to the passengers that's intended for the crew, as simple as they'll have panels that show the seat map of the plane, and then if somebody's pressing their call attendant button, that seat will light up.

(14:06):
And the scope constraint that we got given was if you reasonably believe that the onboard staff would prevent you from trying to use this system in flight, then you can't use it. So really all we were allowed to use was what you could access physically sitting at the seat. Again, I'm not convinced that if you weren't a little bit sneaky, there's other systems that you couldn't get away with using for some period of time. If you sweet talk the crew and didn't act too suspicious, I'm sure you could get at least a few minutes in on one of these things. 

Gordon Draper (14:39):
Would you ever consult again, but at a higher level, for example, as a CISO or run your own consultancy? 

David Jorm (14:44):
I've thought about running my own consultancy and it's a running joke every time you read the IT news and it's like, so-and-so sold their security consultancy for $3 million.

(14:56):
I'm like, I know that person. I've known that person for the last decade and I've seen it happen to so many people that I know that I'm kind of like, how come I haven't done this yet? Am I just stupid? But every time I actually think about, it's great when you read the article and the person cashed out for three mil or whatever, it's good for them, but there was this five years of absolute hell that went into it before they got there. So I think I'm just not sufficiently motivated by money to actually do it. I'm pretty open that that is my career goal at this point, to be the CISO of some kind of company. So being able to consult at that level would definitely be interesting to me. And in the sense my current role allows me to do that because we have a range of financial technology ventures that are in the X15 umbrella, and I kind of act as the CISO in a sense for each of those in a consultancy fashion.

Gordon Draper (15:52):
So you're the head of information security at the X 15 ventures, and so there's the company for X 15 ventures. And then do you have some people that help you that then provide a consulting service to other ventures or is that you? 

David Jorm (16:08):
No, no. So we have a whole team of people that report up to me and we provide a end-to-end cybersecurity capability in the same way as any organisation would except instead of just providing it to one organisation, we have all of these subsidiaries that we provide it to in the sense we're like an internal consultancy, but we're also structured more just like an internal cybersecurity team. 

Gordon Draper (16:31):
What have you seen or heard at the conferences recently that really stands out? Have you been to many conferences? 

David Jorm (16:38):
I haven't been to many conferences recently. I think since covid, I didn't really go to many. The only ones I've been to recently are AusCERT and Tuskcon. I think the thing that stands out from the last two years of going to AusCERT is going back 10 years ago when it was conferences like Ruxcon, you'd go there and you'd know fully 50% of the people in the room. Now you can go to a big conference like BSides or AusCERT and 90% of the people there, You don't know, the industry has just become so big. It's kind of astounding. And that's in a small country like Australia. I can't imagine what it's like overseas now. 

Gordon Draper (17:14):
So that's the impression I get from the US and the UK. A ridiculous amount of people just searching up and saying, Hey, I want to start out in cybersecurity. What do I need to do? Do I need to do a degree? Do I need to do 10 SANS courses? They're all looking for advice. So do you have mentees that you mentor in this sort of space or is this effectively these ventures as well?

David Jorm (17:40):
So I'm involved. I work as a casual academic for University of New South Wales and I'm the course convener for several post-grad courses there, advanced pen testing and cloud security. I'm also a tutor for the pen testing course, so that gives me a lot of opportunity to interface with people who are new to the industry. What's interesting about that cohort, the UNSW Masters students is they are exclusively so far, as far as I can tell, people who are well into their thirties or forties and have existing established careers. Generally in some technology field that's starting to get a bit faded, like you're a windows sysadmin or you run VMware clusters or something and you can see the writings on the wall.

(18:28):
That's not going to be much of a viable career in five years time. And so those people are pivoting into these cybersecurity careers. And then I've got the graduate program, so X 15 is part of Commonwealth Bank and we have grads through the CBA grad program, so I get to get involved there. The CBA grad program is really good because they get 18 months and they do three six month rotations in different areas, so you get the opportunity to expose people to a bunch of different areas before they really commit to what they're going to do. So that's a fantastic program if you can get into it, but it's extremely competitive to get into. 

Gordon Draper (19:05):
The master's degrees. That's a similar path I actually took. I went through electrical engineering in power engineering and data networking and then jumped over to cyber because I was spending most of my time in the cyber information security space as a hobby. I'm like, well, let's just turn that into a job. And I went to a meetup in Sydney called SECTalks. They're having a 10 year reunion soon. SECtalks effectively... I was chatting to different people at different consultancies and they're like, yes, you can do pen testing as a real job. You can earn an income by being a pen tester. That's cool. You can be a hired hacker for at least the idea at the time felt like that - good overlap between critical infrastructure and cybersecurity these days. 

David Jorm (19:54):
There's a lot of overlap there and I think a lot of these people are going to successfully make that transition. I'll be really interested to see where they wind up in five, 10 years, those who are making that career transition. Now, 

Gordon Draper (20:05):
What's one thing in your consulting history that the consultancy did that you didn't expect and what did you learn from it?

David Jorm (20:13):
I got two good examples here. The first one was a gig that I had as a consultant working for a North American financial services organisation. It was kind of like a pension or superannuation fund. It was actually the very first gig that I did as a third party consultant for a paying client. I knew what I was doing. I'd done a bunch of security testing work, I had dozens of CVEs to my name, but I was kind of green to the structure of operating as a third party consultant, and they gave me prod as the target and I didn't realise how strange that was to begin with. They've given me access to admin accounts so I can see all of these people's real pension fund accounts. I found a direct object reference that allowed you to move funds from one account to another in order to produce evidence for it.

(21:06):
I just moved a dollar from somebody's account to another account thinking, oh, it's a dollar, they can just refund it, it doesn't matter. And wrote up my pen test report, threw it over the fence and never heard anything from them. They were like, thank you for the report, no further questions. And it wasn't until months later that I was like, oh, that could have been really bad. I could have gotten in a lot of trouble over that and I just did not realise and they never contacted us about it. The other one that surprised me was when I shifted from being an external consultant, third party consultant to running the internal pen test team for the bank. And I saw the attitude of the clients changed from We want you to find security bugs, what we're paying you to do to, we want you to give us pen test reports that have nothing in them because then we can just proceed with our project and we don't have to do any work.

(21:59):
And that really surprised and confused me that we would go and do all this hard work, find all of these really good findings, and then when we'd present them to the project, they'd be like, oh, no, no, no, that's a low risk. Don't worry about it. Risk accept. I understand now why they're doing it at the time. It kind of took me by surprise. 

Gordon Draper (22:17):
And one of those things that you referencing is I've seen in some financial services institutions is that when you're dealing with a vulnerability, it becomes a risk. And from there, once it's been labelled as a risk, you need to manage it appropriately. And so if it's a low finding in a pen test, it's easier to manage by saying that we don't need to do anything about it or we'll accept it as a low risk, but if it's a medium or a high, that starts getting to the point where they actually have to do something about it.

David Jorm (22:49):
Yeah. And now all of a sudden you've got some senior management person who's got a risk against their name. I'm now a senior management person who has risk against my name and I totally understand. So yeah, it kind of gone full circle on that one. 

Gordon Draper (23:00):
What is a common myth about the consulting industry? 

David Jorm (23:05):
The money, when I first started doing it as a third party consultant, I'd look at the day rates that we were billing customers and be like, hang on, I'm billing this company. Triple what I get paid. I'm getting completely ripped off here. And it was only once I come to understand all of the overhead associated with having sales infrastructure, having an office, giving everybody laptops, giving everybody training, having somebody to create report templates and all this stuff. And I was like, oh, you actually have to build a company three times what you get paid for the company to make any money.

(23:40):
And I think everyone could see it the same way. If you were to look at a salesperson in a consulting organisation, while the consultant themselves bills, let's say three times what they earn, the salesperson probably brings in 10 or 20 times as much revenue as they actually earn. They're selling millions and millions of dollars a year worth of stuff and just pulling a salary for it. And I'm sure there'd be other mirrors across industries at the bank, we have all these people who are home loan consultants and they probably turn over millions and millions a year, maybe even millions a month in the home loans that they help people go through. But of course the actual profit margin on that, it'd be easy to think, oh, I'm making the bank so much money. 

Gordon Draper (24:25):
What is the most important lesson you've learned over your career? 

David Jorm (24:29):
I think it's not to burn people. You can particularly over the long term, and I've seen that people can have short-term disagreements over things and make up over them. I've had disagreements with people in the security industry and had people who I don't talk to for a while, and then if you're mature about it, you're like, Hey, sorry about that. I was being a bit of an idiot. And most people are like, yeah, it's cool. We're fine. If you start to burn your bridges, you'll be out of any career options real fast. And I've seen that happen to people. I've seen people who came in and burned all of their chances and all of their goodwill with people. It's likely that the people you deal with in one context now you're going to deal with in other contexts in the future. And I've had people where I've been their boss and then we've been peers and then they've been my boss and all sorts of scenarios like that. Yeah, I think it's really important that you maintain those relationships over the long term. Otherwise you're going to paint yourself into a corner. 

Gordon Draper (25:35):
You don't want to burn bridges with people, especially when you're going to see them throughout the industry. You were just saying that you had peers that have turned into your managers. Likewise, you've become a manager over your peers. It's a small pool of cybersecurity experts within Australia as recruiters are finding out that can't find people at a certain level because the pool's just not big enough for the demand right now. So would you say there's a skill shortage then?

David Jorm (26:04):
If you'd asked me that question like nine months ago, I would've said there absolutely is. But the last couple of positions that I've advertised, I've had a vastly different experience to the past. The last few positions I've advertised, I've had a real plethora of strong candidates for them, and that's kind of unusual.

(26:28):
The other thing that I've observed recently is putting up positions that are targeted at a relatively junior person and then getting a bunch of candidates who are very senior applying for it and I've never seen before. So I think the market is tight at the moment for employees. Not that it's bad, not that people are sitting around long-term unemployed or anything like that, but it's not what it once was where if you had the skills you could just go to market and kind of take your pick from three or four offers. I don't see that being the reality so much at the moment. So if you are someone that's just starting out in cybersecurity, what kind of advice would you have for them? Yeah, I think you need to be adaptable. And if you look over time, if I go back to say 2015, 2016, probably the hot skill in the industry was pen testing.

(27:24):
That was the quickest way in and what everybody was looking for. Nowadays, I think blue team DevSecOps are probably hotter skills and that comes out in salary data and number of jobs on the market, and that will always shift over time. I can see that something like pentest will eventually just get largely automated and replaced with things like DevSecOps and product security and become a lot smaller than it is, but that doesn't mean that the jobs will disappear. It means they're going to shift into some other area. So I think be adaptable. If you sit here and say, I want to do just this, you might be painting yourself into a corner again, you need to be able to roll with the times. 

Gordon Draper (28:07):
Is AI controlled automated pen test becoming a thing now? I think there's a chatGPT driven

David Jorm (28:13):

pentestGPT. So I did this, I just ran the advanced pen test course for UNSW last Hex-semester. We run six Hex-semesters in a year. The student cohort was of a very high quality, so I had to start getting really stripped on grading. And I said to them, just by solving all of the pen test challenges and writing up the report, you can't get maximum grades. You've got to do something extra, find a vulnerability that I didn't know even existed in the code or find a novel way of exploding one of the vulnerabilities that nobody thought of before. And what one of the students did was they solved all the challenges manually and then they solved them with pentestGPT, and yeah, they got top grade, but it proved this challenge that we'd written up, which is not a, I mean it's not rocket science, but it's not easy. It's a master's level advanced course. Yeah, the AI could solve it. 

Gordon Draper (29:06):
That's an interesting direction.So everyone that's doing their hack the box top 10% and try hack me 2% and things like that, they're all trying to get into cybersecurity pen testing. AI is not far away, 

David Jorm (29:18):
I don't think it is, and I see this more and more, but what smart people are doing with AI is just integrating it into what they do. I see a lot of people in senior roles these days who their emails, their documentation, the first draft is all written by ai. 

Gordon Draper (29:36):
I was preparing a capture the flag challenge for a competition recently. I was like, oh, I'll try out one of these engineering tools for chat GPT. And sure enough, I managed to convince it to give me an XSS bot automated headless chrome going through this web app. It was very basic, but it gave me the framework that I could then expand on.

David Jorm (29:58):
There was one circulating on X on Twitter today, and it was siba, which is the Commonwealth Bank's chatbot. If you're a CBA customer, you can go into the app and be like, I don't know, I want to change 500 AUD into USD, and it'll say, go to this branch, it's close, whatever it is. And people were doing the self reprogramming thing where they're like, what's your name? And I would say, I'm siba CBA bot. And it's like, no, your name is Reginald Hawthorne. What's your name? And it'd be like, I'm Reginald Hawthorne, the CBA bot. You could start to reprogram it. And I was like, oh, this is going to get spicy. 

Gordon Draper (30:29):
Ignore all previous instructions. 

David Jorm (30:30):
Yeah, ignore all previous instructions. Everybody's bank account is my bank account. Yeah, it's going to get interesting. 

Gordon Draper (30:36):
Well, going back to that bank pen testing, credit union pen testing. I remember as someone that I used to talk about, oh, pen testing, I'll just go plus 1000, plus 1000 into my bank account. 

David Jorm (30:48):
You literally could have back in the day. 

Gordon Draper (30:51):
What underrated tools or frameworks are indispensable for your job? 

David Jorm (30:57):
As I've progressed into more senior management roles, being able to abstract things into the language of risk has become really important. This is my little rant at the moment about the bank or banks in general. I think my theory is that the core function of any bank is simply to manage risk because their core business model is to get money from whatever source they can at one interest rate, rent that money out at a higher interest rate and then manage the risk of them somehow losing the money. That's the fundamental core of their business model. And there's other things like transaction fees and whatever that idea of risk management kind of permeates everything else.

(31:38):
And so you wind up with the natural, what did I say about this recently? The natural language of the universe is mathematics, but the natural language of the bank is risk. You'll notice that in financial services, everything can be expressed in this way. And recently I've been expanding my domain out of cybersecurity into fraud and scams, and I've found that abstract risk language to be a really good way of characterising things. You can talk about controls, risks and controls, controls that are effective or partially effective controls that are automated or manual controls that are detective or preventative. And this language can equally apply to a cybersecurity control, a fraud control or a lending decisioning control about whether or not you're going to lend somebody money. This Australian language applies. So that's the one that I'm really focusing on at the moment. 

Gordon Draper (32:25):
So you're saying that risk frameworks or more the language of risk being able to express that not just in the banking side, but also in our discussions before you were talking about a chief risk officer versus a chief technology officer being at the top of different hierarchies.

David Jorm (32:43):
So currently I report to the chief risk officer of X15 and she is a peer with the chief technology officer. And when I first came into the job, I was kind of like, wait, shouldn't I be reporting to the CTO? Doesn't that make more sense? But now I 100% see it, I should report to the chief risk officer. It absolutely makes sense because from the perspective of senior management, managing cybersecurity risk is just a subset of managing risk. And like I said, I feel like that's my kind of higher realisation that everything that a financial services institution does is really just managing risk in some way or another. And so that language allows you to express stuff and I think if you want to be in a position where you present this stuff to boards of directors or governance forums and so on, that's the common language that you can get.

(33:33):
If you are coming in with a technical cybersecurity background and you want to be able to present this information to somebody who's got 30 years of finance experience and is sitting on a board, there's your common language use. 

Gordon Draper (33:46):
You got to speak that language, the language they understand. I think that's probably one of your key insights that we can enhance to our listeners. Moving into some lighter topics, hacker and cybersecurity movies, what's the last movie that you've seen on the technical frontier? 

David Jorm (34:05):
The last one was actually Hackers and I still remember "RISC is going to change everything". I think that was the final boss of hacker movies. They'll never be one as good as that. Really enjoyed that. I'm going to have to watch some of the newer ones. 

Gordon Draper (34:18):
What are some of the cybersecurity books that you would recommend? 

David Jorm (34:23):
I think the Art of Software security assessment is probably the number one that I would recommend. I got a lot out of that book. It's a big thing. I think it's out of print now. It's really been useful because it deals with things at this correct level of abstraction. There are so many computer books that five years after they're printed, they're just uselessly out of date. And I remember going back to the late nineties, you probably remember Borders books and stuff like that, and everyone who was self-respecting computer nerd had a bookshelf full of Cisco books and Microsoft books and stuff. In reality, they're all out of date within five years. Some of these classics though, like the art of software security assessment because it deals with things that are an appropriate level and abstraction, it means that a new programming language coming out isn't going to deprecate it. I think Phrack Magazine is like that in some way. Whenever I get grads who show a real aptitude for deep technical stuff that they always just want a harder technical problem, a harder technical problem, I always pull out smashing the stack for fun and profit and I say, read this, understand it and reproduce it.

(35:32):
And actually the really hard bit now is trying to get a system on which you can reproduce the original exploit code in smashing the stack because it's been mitigated by so many generations of kernel mitigations. It's stuff like that which is timeless. It's like, okay, we've implemented 20 years worth of kernel mitigations and stack canaries and yada yada yada, but you'll never understand memory corruption if you don't read smashing the stack for fun and profit. 

Gordon Draper (35:58):
That's a very good point. I was sitting in on a UNSW course and someone's like, oh, you need to read this Art of Software security assessment, and first of all, you need to read this Smashing the stack for fun and profit, just understanding the Phrack articles and where to find them and they're timeless. There's some really good articles in Phrack 

David Jorm (36:20):
Actually, me and Jody Melbourne wrote this thing back in 2003, which was a three part article on hacking web apps, so 2003, hacking web apps was kind of new. When I was working at the Bureau of Meteorology, we did a few academic papers, so I created a Google Scholar profile and without me ever adding it because it was never actually a formal academic paper. My most cited work in the academic literature is this three part series on web apps that me and Jody wrote because it turns out it was the first time certain categories of web app vuln, I think like CSRF and stuff had been really clearly explained in any public facing literature, and so we never intended it to be this, but it turned out to be that 

Gordon Draper (37:05):
There's some wonderful places in the world. Where would you choose to live, if anywhere? Where would it be? 

David Jorm (37:11):
I've lived in a bunch of different places. I spent some time in Kunming in southwest China. That was one of the best experiences of my life. I lived in Sweden as a kid and I've lived in Silicon Valley for a while, but honestly Australia, I always come back and it's like, why would you live anywhere else? It's so good. What I've been really enjoying for the last year or two has been a bit of a nomadic lifestyle, moving around from city to city, and I'm really enjoying that at the moment. I guess the confluence of technological factors like work from home or if you work for a big company as offices in every city, so I can go in. Yeah, I'm really enjoying that lifestyle. 

Gordon Draper (37:48):
You were telling me about most recently, you went on a bike trip. 

David Jorm (37:52):
Yeah, I rode my dirt bike from Melbourne to Brisbane. 2000km. Yeah, I got to Sydney, then I worked from the Sydney office for a bit. Then I got up to Coffs Harbour where my parents lived. Stayed there a few days and then eventually got it up to Brisbane and that was a huge adventure. I didn't have to take a single day off work. I was able to work the whole time and just travel in the evenings on weekends. It's a great debate, the whole work from home versus work in the office thing, and I'm one of those people who can make the argument convincingly. Either way. I convinced myself either way, but I think if I put my hand on my heart, I am a true believer in remote work. It is going to be a big part of the future and will enable people to live in this way. 

Gordon Draper (38:31):
I'll be interested to see some of the remote working options coming out of X 15 ventures. Thank you very much for your time, David. It's been a lovely pleasure chatting to you tonight. Where can listeners find you online? 

David Jorm (38:44):
Probably just LinkedIn is the easiest place. I'm not a big social media user, but I'm on LinkedIn, so please do add me. Always reach out. David dot John gmail. Pretty easy to find. I'm the only David John in the world. Yeah, reach out if you'd like to chat. Thank you very much for your time. No worries. Thank you.

Gordon Draper (39:00):
As we conclude today's episode, I want to extend a heartfelt thank you to our esteemed guest, David Jorm, for sharing his wealth of knowledge and insights with us. David, your dedication to the cybersecurity field and your commitment to developing emerging talent are truly inspiring. We are grateful for your time and expertise and to our listeners, thank you for tuning in and joining us on this enlightening journey. Your support and engagement mean the world to us. Be sure to stay connected for future episodes packed with more valuable discussions and industry insights. Until next time, stay safe and keep innovating.