Notes:
Chris Cochran's interest in technology began early -
from watching Terminator as a child to studying computer science after
hours in high school. In this episode, he shares how his experiences in
the Marine Corps and working in government and the private sector have
helped him not only build a successful career in cybersecurity, but also
confidence in himself by viewing work and life as practice for critical
situations. Cochran also touches on the importance of communication,
openness, and being a model for others, and why it's essential to never
give up on your goals.
Bio:
Chris Cochran is a former active duty US Marine
Intelligence. He currently leads threat intelligence for a premier
entertainment company in Silicon Valley. Cochran has dedicated his
career to building advanced cybersecurity and intelligence capabilities
for national-level governments and the private sector. Cochran has made
it his personal mission to motivate and empower cybersecurity
professionals and teams through coaching, his podcast Hacker Valley
Studio, and speaking engagements. His concern for the ever-growing
cyber-skill gap serves as a motivator for his need to inspire the next
generation of cyber-warriors to take the helm.
Transcript:
Jason Nickola: This is "Trust me, I'm
Certified" brought to you by GIAC Certifications, a podcast exploring
how to conquer imposter syndrome. This is your host, Jason Nickola, and
on this episode, we'll talk with Chris Cochran, threat intel lead at
Netflix. From his early interest in computers, his time in the Marines,
building his career in the private sector, and his role now as one of
the more visible and thoughtful figures we have in infosec, Chris has
continually focused on doing the kind of hard work behind the scenes
that no one ever really sees, which has really served him well
throughout a career pushing his edges and stretching his comfort zone.
He offers a ton of great tips and insights from his own journey, as well
as a really open and honest view of some of the challenges he's had
along the way, so let's dig in. I hope you enjoy it.
Jason Nickola: Welcome back to the show. Thanks so much to Chris Cochran for joining us today on the show.
Chris Cochran: Thanks for having me.
Jason Nickola: Awesome. So, one of the things that I wanted to start
off with is we've kind of been asking what the origin stories are for
different guests that we have on the show. So, what's your path into
technology and security? Were you a child hacker? Were you a prodigy
that was taking down nation states in your middle school years, or is it
something you more stumbled into?
Chris Cochran: Yeah, I've taken down so many nations states as a
child, I think it started about three years old. No, in all seriousness
I'd say my interest in technology really blossomed in high school. And
the story I tell quite often is that I was part of a school that had a
program where you could get your CCNA during school. And I missed the
cutoff because I changed schools mid-year, and my friends were in the
programs and I was like, Hey, how do I get into this computer stuff and
they said, oh, well you missed the cutoff, but just go get the book and
you start learning about computers and stuff like that. And so what I
did was I actually took my school clothes money that I was supposed to
use coming into this new school and I bought a CompTIA A+ book. And I
read it like a novel. And so I read it, page to page, and so I would
come and I'd ask my friends questions about components and stuff, right?
And they were like wow, you're really reading this stuff, you're really
soaking it in. And eventually, I started buying old computers, taking
them apart, you know, playing with them, putting components back
together. And that's what really sparked everything. And then I went to
the Marine Corps. As fate would have it, I chose my job field as
intelligence and eventually I got into basically what is threat
intelligence today.
Jason Nickola: That's super interesting. I think that most kids
probably wouldn't trade in their school clothes money to try to buy
books. I think that you're firmly in the minority in that department.
But what was it, if you can remember, that made you want to get involved
in that club? What was it that made you think, yeah, I want to
reallocate this money from my parents to buy school clothes to go buy a
book to learn how to do this stuff? Was there something in your past
where you were more connected with technology, and you just fell into
the right group when you went to a new school?
Chris Cochran: So, I don't tell many people this, but I'll give it to
you and for your guests, but it actually started when I watched
Terminator. That's when I really got into technology. Because I was
like, I wanna build robots. I want to make Skynet and I found that, you
know, just being in touch with technology was super interesting for me.
When I was younger, I got one of those kits where you could build your
own radio, and other electronic devices, make your own alarm systems.
And I've just always been fascinated by technology. And so that's just
sort of snowballed into where I am today.
Jason Nickola: Yeah, that's actually really interesting. So, in high
school, you start digging into technology, learning some things on the
side, which is unique, right? So one of the things that I'd like to
think about is when we're adults and we're formed in our careers and we
look back there are oftentimes threads and nuggets that when we review
it all, in hindsight, it seems like, well, obviously I was gonna work in
security and obviously I was gonna be a hacker, or somebody that tries
to defend systems and those kinds of things. But for me, and for a lot
of people that I speak with about these things, it's never so obvious
when you're there, right when you're younger and trying to figure out
what you want to do. So what were some of those things for you? When you
look back and you try to paint the picture to people that you always
knew that you were gonna be in threat intelligence, even if that's not
true, what are the things in your background, the common threads, your
personality traits, that allowed you to be someone that in middle
school, high school, would take machines apart and put them back
together and take your own time to try to study? Because my guess is
that those things have served you very well in your career sense.
Chris Cochran: Oh, yeah, it's been phenomenal, and really, it's both
an aspect of preparation on my part, but then a whole lot of dumb luck. I
just remember, you know, being in my unit in the Marine Corps and I was
just sitting around talking with everybody, and then we had a visiting
Marine that we're training who was about to go forward and deploy, and
we're sitting there talking about different types of intelligence and
one of the intelligence facets that - I asked a question. I said, if you
could choose any of the facets of intelligence to get into right now,
what would it be, and he said digital networks intelligence. And so, at
that time, I had no idea what it was. I volunteered, you know, for my
unit and I said I want to be the guy that starts this stuff and they
said go do it. And so, I went through the schooling and stuff like that,
and it just kind of snowballed from there. And then from the Marine
Corps, I went to the United States Cyber Command and I thought it was
gonna be this super hands on keyboard, super technical role. But really
what I was doing was the beginnings of what is threat intelligence
today. And to be honest, I was scared when I was in that role because I
was like oh my goodness, if I have to go out to the commercial sector,
how am I gonna use this? This isn't going to apply, but lo and behold,
you know, it really started with the APT1 report from Mandiant. And it
just it just exploded into this huge field where people were needing
intelligence, not just government entities, but commercial organizations
were really thirsty for intelligence, and it just took off.
Jason Nickola: Right. So, you mentioned being somewhat fearful when
you're in the military and having to dig into the intelligence side and
worrying about, you know, my next step after this, how am I gonna apply
it? And thankfully, there has been a nice landing strip for you in the
development of a formal threat intelligence industry and career path.
But, at the time, you mentioned that you were fearful about it. What did
you do to overcome that? I think about it and in those situations, you
can either continue down your path or try to do something different,
right? So, did you have a broader vision of "I'm gonna make this happen"
and it's a lot of just real planning along your own personal path, or
was it more "I'm gonna do the right things today and work as hard as I
can and build and develop as much as I can, and things will work out."
So, how did you work through that?
Chris Cochran: It was really two things. The first thing was, I went
back to school and my first program was computer networks and security.
And within that realm, you could either take the final exam or get a
certification. So, whenever I had that choice, I selected the
certification. So, I got a lot of the CompTIA certifications, ended up
getting my GCIH with SANS and just kind of took it from there. But I
would say the really big bump, and super risky move, but we lost the
contract that United States Cyber Command and I started my own little
firm. It was just me and two other guys and we started building threat
intelligence capabilities all around the country. And that is where I
probably learned the most because I had to figure out what were the
things in the commercial industry, what were the problems that they were
dealing with, what are the solutions they're using? Because in the
government we have our own stuff. But in the commercial sector, there's a
whole plethora of different solutions out there. So, I had to learn all
of those things in order to be able to say with any sort of confidence
that this is what I think an organization needs to move towards. And
that was pivotal for my career.
Jason Nickola: So, it sounds like a lot of what you're describing
from the early stage of trying to get in this club, and buying books on
your own on this side, and on through getting into the military and
trying to identify kind of edge areas that you can start to carve out a
niche in. And then moving into the commercial sector and starting your
own thing that you're really used to this process of "I want to push
forward. I want to grow. I want to be where there are opportunities." Is
that uncomfortable for you? Or is that just how you live your life and
you're used to it?
Chris Cochran: So, yeah, I felt in the beginning it was nerve wrecking, right?
Jason Nickola: Right.
Chris Cochran: But I almost got to a point where I feel like I've won
so many times that I'm excited for it. I like being in a role where I'm
like, oh man, I have to go back to the drawing board and figure out
what I have to do because that's where I find my most growth. And I know
a lot of people out there, they get in these roles and they feel almost
defeated. Like oh no, I've gotten here, and I don't have the requisite
skills to continue to do this job the best I can, and I would encourage
people that are listening this podcast. You know, if you're if you're
feeling that right now, just I understand that this is a perfect
opportunity for you to grow and just nose to the grindstone and get
better.
Jason Nickola: Yeah so, throughout all of that, it sounds like you
were able to really leverage it as a strength. Were there times when you
felt out of your depth and out of your element? And there's some
cultures that are more supportive of people who are working their way
through and learning things than others are. So sometimes that that
doubt can come from outside and people who aren't on the same
wavelength. And sometimes it's just getting tired and getting
overwhelmed with yourself in your own things you have going on. So, were
there times when you felt like that?
Chris Cochran: Oh, yeah. And I think it really depends on the
environment that you're in. I feel if you are in a learning environment,
it's a much safer place to take risks. But if you're in an environment
where they're calling you out every time you're wrong, if you make a
mistake, if you say you don't know something and they're kind of coming
down on you, then that's not the best place for you, for one. But then
also not the best place to grow, because then you're not going to say
anything. You're going to stay guarded and you're not gonna share your
insights. You're not going to share your ideas. And so, yeah, I've felt
like that. I've been in organizations like that, and I tried to stay
away from those organizations as far away as I can.
Jason Nickola: Yeah, and after you've been in an environment that
kind of prioritizes vulnerability, which is something that is kind of
taboo to talk about, I guess, in American culture and. the technical
world as well, right? Because it's feeling stuff. It's not necessarily
cold bits and bytes. It's how we go about and how we feel about
ourselves and people around us. But if after you've been in that kind of
an environment where you're allowed to be vulnerable and you're allowed
to say I don't know, and you're allowed to have support and safety as
you start to go off and learn these things, it is really difficult to go
back into environments where that doesn't exist. You start to realize
all of the places where that's just not true. Hopefully we're getting
closer to that being more pervasive. But if you can find it, keep it
because it's special and it's rare.
Chris Cochran: Absolutely. And that's one thing that we push on our
podcast, "Hacker Valley Studios," is being vulnerable. We've had two
episodes right now geared towards vulnerability. And interestingly
enough, those are both of our more popular videos. Because not a lot of
people are talking about being vulnerable. You have your Brene Browns
and stuff. But people in tech, there's not a lot of people talking about
it.
Jason Nickola: For sure. And one of the reasons outside of just your
reputation and mastery of the threat Intelligence area. One of the
reasons why you really got on my radar and why I've started listening to
the podcast and paying attention to what you put on LinkedIn and stuff
like that is you talk about all that stuff. You don't just keep it about
feeds and indicators and context around your data and stuff like that.
And a lot of people in technology restrict themselves to that and kind
of cordon off their professional profile from what they feel as a human
being and the personal lives and things like that. But one thing I
really appreciate about the way you conduct your outreach is you're
super positive, which is always a big part of the battle. But you're
really open and upfront and honest about the whole people side of it.
Not only just some of the vulnerability things that we talked about,
but, you know, how do you build your career and how do you add context
with things like viewing yourself as a holistic being, and you're not
just a professional resource. You're not just a tech widget, right? So,
you have to take care of yourself. You have to push yourself a little
bit and really optimize your life so that you can be the best version of
yourself. Now, a lot of people go too far down that path and think that
it's, you know, voodoo or whatever, but I think it's really important.
And I think that the more it gets talked about and the more people like
you that have a platform because they've achieved technical success and
technical prowess, the more we can talk about the other side of it, the
more things like an environment that encourages you to be vulnerable and
making you safe to do that, those things might not be so rare. And even
just imposter syndrome and hearing about how people like you are known
and respected have had that at every step of the way and found ways to
try to use it as a real advantage and to seek out more opportunities to
push and grow. So, I don't know if I really have a question about that.
More just saying thank you for being that way as a consumer of that
information. It's been very encouraging.
Chris Cochran: No, that's high praise. I really appreciate that. I
just I feel like as cyber security professionals, I feel like we are
really mental athletes, and we look at athletes across the spectrum,
whether they're going to the Olympics or they're professional athletes.
They take care of everything. They take care of their body. They take
care of their households, they take care of their mentality. They're
going to see a sports psychologist to make sure that their minds are
right, and I do feel like we are mental athletes, but we don't have an
off season. We don't really have the luxury of taking months and months
off. And so just taking care of all that stuff is just gonna make you a
better practitioner. It's gonna not only increase your ability to
perform in your career and at the workplace, but also at home.
Jason Nickola: Right, absolutely. The other part of it is that we're
not, especially the stuff that you work with, but in general, in cyber
security and information security and trying to protect assets for large
organizations and nations and these kinds of things, this isn't a game
for a lot of that stuff. There's real world consequences for what
happens when somebody drops the ball, or when we're not taking care of
ourselves enough to really do a great job during the day. So, one thing I
wanted to ask you about is not only have you been able to push yourself
and grow and get new roles and go into new areas, but when you do that,
it's like, "OK, I want I want to move in a cyber threat intelligence. I
want to really stake a claim there and be an expert on it" it's like
okay, great. Now you must perform. You must have enough of a handle on
our processes to get information from the outside world in terms of what
they're seeing and then look at our own traffic, our own activity, and
detect that stuff. So, being a forward thinking and growth-oriented
person as you are, was there a period of time when you had your first
event or your first kind of major incidents in a professional
environment that you're like, yeah, well, I'm here. Okay, now, this is
what the job is, right? So did that happen for you ever?
Chris Cochran: Oh, yeah. So, I remember probably my first incident
ever. It felt like being punched in the face, and I don't know if many
of your listeners have been punched in the face. Whether they're
practicing mixed martial arts or getting in a street fight, but it was
like being punched in the face, and you didn't know it was coming. So,
you have to kind of get your bearings and say okay, so what happened?
What's the situation right now? And I feel like there's two things that
you have to do when you get into that. That's sort of like mind set. One
is you have to have confidence in what you do know and what you can do.
But then also, you have to look at it as an extension of practice,
because, you know, if you practice up until that point, like you're
someone who has been practicing in the gym, you know, you're fighting
and stuff like that and then you get sucker punched, then sure, you'd be
able to get your bearings quickly, or get yourself in and then execute
whatever you need to do. But if you have zero training at all and you
think that you're gonna rise to the occasion, it's gonna be an uphill
battle for sure. And so deliver practice both from the standpoint of
building yourself up when there isn't an adversary like this coming at
you, but then also looking at each and every component of your career as
practice, right? And so, we actually just did an episode for Super Bowl
Sunday, and what we said was they had their practice all week long
throughout the entire season. But then they had their games, and each
game actually gave them those battle wounds, those battle scars that
enabled them to get to the Super Bowl. And so, you have to - it's okay
to make mistakes. It's okay to learn from them, and so you want to look
at that as an aggregate. So, what have I learned all over time? You can
get that experience in low risk situations, whether it's from table tops
or war games and stuff like that, that's great, but it's not always
gonna happen that way, and you have to look at each incident as a
learning lesson.
Jason Nickola: Yeah, and I think sometimes there may be fewer of them
than there were 5-10 years ago. There are lots of organizations that
think that when it happens, they'll know what to do, and I cannot
disagree with that kind of a stance more. It's so important to go
through and just say we don't know all the answers. Even if you're just
starting out fresh and you're looking at something like the CIS controls
and you're just starting there and you're not one of the top
organizations in the world in this area, what might you do? Right? What
are other people doing? And how can you try to implement that so that
you get some process up front ahead of time and then test it,
absolutely, with tabletop exercises and audits, whether it's your own
internal team, or bringing in an external team. For me, when I've been
in situations that are mission critical at work, or when there's an
incident or even just things that you get jacked up about outside of
work, right? Having played sports and stuff like that, there are lots of
ways to do it. What has always made me feel better is I've done
everything that I can to this point and what's gonna happen now is
already decided. So just like you're saying, it really is in that
preparation component of it, right. When you sit down for your first job
in the commercial sector and then, you know, you get 1000 alerts in the
first half hour, something like that. You gonna start combing through
them, then all of the nights where you were breaking stuff apart and
reading books with clothes money and getting out into the world talking
to people about stuff, that's really when it all becomes important,
right? So, yeah, I couldn't agree more with preparation side of it. What
can you do to try to war game it and go through things before the
actual incident? So that - it's muscle memory, right? And you adapt it
over time, it'll be wrong. Right? But you can definitely make it better
as you go.
Chris Cochran: Yeah, there was a good quote - I cannot for the life
of me remember where I got it - is that when bad things happen, you
don't rise to the occasion, you fall to the quality of your training.
Jason Nickola: Oh, yeah. It's one of my favorite ones. I think I heard that in James Clear's book on habits.
Chris Cochran: Oh okay.
Jason Nickola: Yeah, I don't know who it was, but I think that I
couldn't agree with that more in principle, right? It's maybe in one-off
situations you might just rise to the occasion, right? But overall,
repeatedly, sustainably, it's more about what have you done to prepare
and what processes do you have in place to deal with the times when
something does fall through the cracks? And obviously we're being more
general in how we're talking about here. But I think you can take that
and apply it absolutely directly to almost any area of cybersecurity.
Whether it's incident response, penetration testing, cyber threat
intelligence, what processes have you put in place to confirm that what
you're doing is making any kind of a difference whatsoever. And having
that stuff in place just reduces the likelihood that you're gonna run
around with your hair on fire when something actually does happen,
right? Yeah, so more in the moment, right, and maybe less about
preparation. Have you had times throughout your career where there's
something serious going on, whatever it might be, maybe it's an
environment where the preparation wasn't where it needed to be yet, or a
team that wasn't as strong, are there things that you can recommend
when you're in the moment and things are coming off the rails a little
bit and you're starting to realize it. What would you do to try to get
things back on track?
Chris Cochran: So, the best thing you can do is really rely on your
team at whatever level they are, you have to really rely on them and
trust them to do what you think is going to be the most beneficial for
the situation. And so really understanding who your people are and who
you can rely on for different things is gonna be paramount. But then
also communication is key. Communication will get you so far in a
situation where there's uncertainty and doubt, and so the better you can
communicate in those scenarios, and the better you can have your team
communicate with you, is gonna be gold.
Jason Nickola: Yeah. So I know that you've done a lot of hiring and a
lot of interviewing. Beyond just the communication component of it,
what are some of the things you would look for in potential team members
ahead of time that let you know when things do hit the fan and we do
have an incident, and we have to rely on each other because things are
moving quickly and the stakes are high in some of these environments,
what are the things that you look for?
Chris Cochran: Yes. So, I look for team-oriented people because you
can sense the people that are just kind of "I just do my own thing and I
don't like talking to people" and that's fine, you're a researcher,
your big brain, and all you want to do is focus on one particular facet.
You don't want to work with people. That's fine, as long as you're in a
role that that can support that. But when it comes to teams and dealing
with big incidents, dealing with things where you have to coordinate
with other folks, you need team-minded people. And so that's one of the
main things I look for.
Jason Nickola: For sure. Yeah, absolutely better to work on a team
with people that that consider being on a team important, right, instead
of having to bring them along constantly, because I think we've all
found ourselves on teams where there are people who are critical but
would rather just work by themselves. And that's a difficult environment
to be in for sure. So, pivoting a little bit. I know that you've had a
conscious decision over the last year plus, to try to get more out in
the community and to publish more content and put more things out in the
world to try to help others along in their journeys. So, what spawned
that? And have you had similar feelings of trepidation moving in to
those kinds of areas where you weren't as focused on those things before
as you did earlier in your career just developing yourself? Or is it
easier because you have a real depth in some of the things you're
talking about?
Chris Cochran: Yes. So, again, it's twofold. The first thing is,
yeah, I did make a conscious effort and conscious decision to give more,
to communicate more, to try to inspire more. And that was just my way
of giving back because cyber security has done tremendous things for me,
for my family. And, you know, I would give more if I could. The other
thing is I like being an example, being a minority and from an
underrepresented population. And I want to sort of be this beacon, this
example of somebody that's doing well in the space. And I just want to
let everybody know that if they're from those areas or from those
countries, wherever they're from, that it is possible and that you could
make it and that there is light at the end of the tunnel to get you out
of whatever situation you're in now.
Jason Nickola: It's so important when you're a kid or when you're
moving into a new thing that is difficult or stressful to have a model
of someone that you can see that looks like you and sounds like you and
came from the kind of places that you came from that has had some
success in it. And it's not that it's impossible to do it without that,
it's just way more difficult and is probably more restrictive in terms
of the kinds of people and the things that you have to innately have to
overcome those kinds of obstacles. The deeper part that doesn't get
talked about in the social conversation is that you shouldn't have to be
willing to climb mountains to just get an opportunity in a career,
right? So, I think about your journey. And did you have people like that
when you were coming up and trying to move into technology and make
your way in cybersecurity that you could look to that where a model for
you? Or has your experience with that kind of flavored why you're
positioning yourself to do those things now?
Chris Cochran: I think it's flavored why I'm doing what I'm doing, to
be honest. I mean, I've had mentors throughout my life, but many of
them didn't look like me and many of them weren't from my background.
And so, I just - and not everybody's gonna be comfortable reaching out
to the people outside of their culture, and they're not going to be
comfortable reaching outside their gender. And so, to make it easier,
not only do I bring myself is a beacon, but anybody I bring on the
podcast is a beacon. So powerful women, powerful minorities, powerful
people just in general, that people can see as an example or as a role
model. That's really why we bring guests on the podcast is just to say,
hey, there's someone out here that fought the fight just like you're
doing right now. And this is where they are today.
Jason Nickola: Yeah, and as I said earlier, I think that that comes
through in the kinds of things that you do in the world and the kinds of
content that you put on your podcast. So, I think you're absolutely
doing a great job of pursuing that and making some headway there. So,
thanks for doing that.
Chris Cochran: I really appreciate that. Thank you.
Jason Nickola: You've also started doing a lot more speaking and
podcasts like this. So, thanks for being on this one. But you recently
spoke at the SANS CTI Summit. Is speaking in this way formally at events
something that you have a lot of background in or did you have to push
yourself to do it and kind of coach yourself to do it? And what were
some things that helped you going through that process?
Chris Cochran: Oh, man. Yeah, that was the journey for 2019.
Absolutely. So, I did my first, I guess, community talk. It was just a
lightning talk. Five-minute talk with SANS, and I said, you know what?
I'm gonna just gonna push on this this year. And so, every opportunity I
got to speak, I took it just because I wanted to practice. I wanted to
be able to deliver a message and have it be impactful, and I just slowly
got better over time. And so, I did things like stand-up comedy for the
first time this past year, which was nerve-wracking. I don't care what
comes up next, like for whatever speaking engagements I have, you could
put me on a stage in front of 100,000 people. Nothing was more
nerve-wracking than trying to do comedy for five minutes up on stage.
That just sets everything in perspective, right? I did a poetry reading.
I've never done a poetry reading in my life. And just taking all these
opportunities to speak. Because, like we talked about earlier, it's that
deliberate practice, those small, incremental improvements to get you
better. And so now I feel pretty comfortable on stage. And it wasn't
always that way.
Jason Nickola: Yeah. You have other events that you're planning on speaking at throughout the year. What do you have coming up?
Chris Cochran: Yeah. Coming up, I'll be at RSA, doing a panel on
emerging threats and threat research. A few other engagements that are
sort of in the works, but I haven't exactly nailed those down just yet,
and just more podcasts. We're gonna be upping the production value of
our podcast, constantly getting more and more guests on, better stories.
I mean, not that the stories before weren't better, but I think as a
podcast host, I'll be asking better questions in order to sort of
extract those stories from folks. So just look for me to get better, for
Ryan to get better, for everything to get better.
Jason Nickola: Cool. Well, thank you so much for coming on the show.
Before we break, is there anything you would tell listeners who are here
because maybe they're trying to work their way through and they're
trying to build a career, and maybe they're struggling with it, or maybe
right at that point where you know they're about to give up and aren't
sure if it's the right thing for them. What would you tell anybody
listening who's going through that thing?
Chris Cochran: I would say the best thing you can ever do whenever
there's a goal in mind is just never giving up. Because you find that
entrepreneurs have failed start-ups all the time. We don't see their
failures. We only see their successes. But if there's something that you
want to do, you have to just put your mind to the fact that you're just
not going to give up. It's going to get hard. It's gonna get tough.
You're gonna think about quitting. But you know, at that moment where
you're thinking about quitting, execute. Just move forward, do something
small. It doesn't have to be monumental. If you're writing a book, you
don't have to sit down and write an entire chapter because you're
wanting to give up. Just write a paragraph. Just say, you know what? I'm
just gonna write a paragraph today - or write a sentence. Take that
next step and keep moving forward and just never give up.
Jason Nickola: Have you ever seen the movie What About Bob?
Chris Cochran: No, I haven't.
Jason Nickola: It's a Bill Murray movie. It's actually really funny.
You should see it if you're ever looking for something watch. But it's a
ridiculous movie, but there's a therapist in it that has a book called
Baby Steps. It's supposed to be funny in the movie, but I think there's
something wrong with me because I often think about - there's actually a
lot of wisdom in What About Bob. Don't try to write your whole book.
Just do five minutes of writing today. Carve it up into the smallest
thing that you can. Whether you're studying for a cert, or you have to
take a training course, or you're trying to find a job. Just take the
next step and keep moving with it.
Chris Cochran: Yeah, absolutely.
Jason Nickola: I think that employing that across the board makes it
easier to not get to those points where you're really at your edge and
wondering if you should keep moving. So, yeah, that's great advice. You
heard it here from Chris Cochran, a guy who has made a career and life
out of living at his edge to the point that he's willing to do stand-up
comedy and poetry readings even though he's never done them before. Just
keep moving and keep testing your edges and be prepared enough so that
when the time does come, you ready for it. So, thanks so much, Chris, I
really appreciate you being on show.
Chris Cochran: Absolutely, thanks for having me. This was great.
Jason Nickola: That was Chris Cochran, Threat Intel Lead at Netflix.
Thanks to him and definitely to all of you for joining us. Don't forget
to subscribe to the show and sign up at giac.org/podcast to stay up to
date with new episodes. We'll see you in two weeks for our next episode
with Micah Hoffman, SANS instructor and OSINT expert, about how you can
apply some of those OSINT techniques in building your own brand and
applying your expertise to provide valuable content to a broader
audience. So, thanks again and we'll see you soon!