Students of the game: What are your go-to information sources for 2022?

Jan 24, 2022

CSO Perspectives is a weekly column and podcast where Rick Howard discusses the ideas, strategies and technologies that senior cybersecurity executives wrestle with on a daily basis.

Students of the game: What are your go-to information sources for 2022?

Listen to the audio version of this story.

When I was a young lad growing up in the Los Angeles suburbs (late 1960s), I wasn’t much of a football fan, professional or otherwise. Games were too long and boring to my 10-year-old mind. Come to think of it, they still are for me. But I stumbled upon this odd little highlight show, called “This Week in Pro Football,” produced by the now famous Sabol family of NFL Films. They broadcast it on the one UHF channel we got: Channel 33.

For you youngsters out there, back in the day, we didn’t have any internet and we only had three nationwide TV channels: ABC, CBS, and NBC. “Oh the Humanity!” I know! How did we ever fill the time? It was a burden.

But, local broadcasters used Ultra High Frequency channels for area programming. Where I lived, UHF gave me access to my first anime experiences like “Speed Racer” and “Kimba the White Lion,” and introduced me to the horror genre with crazy shows like Seymore’s Fright Night broadcast from TV station KTLA out of Los Angeles. The NFL highlight show took all the boring stuff out, added a voice track that explained what was going on, and overlaid a music track that was a mix of 1960s jazz and classical music. This stuff was inspiring. Because of the way they told the stories, NFL Films took rough and tough football players, perhaps not the most articulate people on the planet, and turned them into mythic gods, at least to me. It personally took me from “not-interested” to a student of the game. I think that’s when I started to realize that being able to tell a compelling story is a useful skill.

Students of the cybersecurity game.

Over my career, I tried to hone that skill and I began to appreciate those other people trying to convey information who were especially good at it. After all, we’re all students of the cybersecurity game too, but with no time to waste. We seek to find sources of information we can quickly and efficiently consume that will provide insight into how we should do our jobs. In 2022, we have an embarrassment of riches for this kind of thing right at our fingertips. I can roll out of bed, fire up the Google machine, and instantly find intelligence on the latest APT29 attacks, useful explanations about the progress and availability of the SASE architecture for startups, and the latest outages from my cloud provider. All of that is key information, but there is also a need for longer form thinking too. It’s good to get a summary of the headlines, but, to really learn something, it’s also good to dive deep sometimes into important topics. And I’m not just talking about cybersecurity topics either. If all you are doing is drinking from the same infosec well over and over again, you don’t provide yourself the opportunity to expand your horizons a bit; shock your system so to speak, with invigorating and new ideas that might cross pollinate your cybersecurity thinking. It’s OK if everything you consume is not about cybersecurity.

I like podcasts.

Over the years, I have tried various form factors to get my summary information and my long form big ideas: Conferences, one-on-one calls, intelligence briefings from my own staff, Youtube videos, podcasts and books. I still do all of these things but my two preferred form factors are podcasts and books.

I’ve been a podcast guy since before we had a name for them; mostly because I hate commercials. For at least the last twenty years, I’ve had to commute to work anywhere from thirty to forty-five minutes each way. And I don’t know about you, but I don’t enjoy being alone with my own thoughts. I have to be entertained. Before podcasts, all I had to keep me from falling asleep at the wheel was drive time radio, with 20 minutes worth of commercials for every hour. And in the Washington D.C. area where I live, the choices are limited: talk radio, soft rock, and local headline news (that repeats every 20 minutes - argh!!!). When I found podcasts, and later audio books, in the early 2000s, I began to relish my commute time, not hate it. I actually enjoyed the ride.

Back then, they didn’t have commercials. Today though, as podcast producing has become more mature and slick, commercials are everywhere. But since it's all digital, it’s so easy to fast forward through all that noise that it's as if they weren’t really there (SSHHHH … don’t tell my sponsors. They would hate me saying that.) My listening habit eventually followed me everywhere, not just my commute. If I'm walking the dogs, or doing the laundry, or washing the dishes, I'm catching up on podcasts or listening to a book.

I know my loathing of commercials sounds hypocritical since I work for a podcast company that sells them. But hey, if you hate them as much as me, then subscribing to the Cyberwire Pro side cuts all of that out of your feed. That’s a good deal. I don’t mind that companies have to sell advertising to make money. I mind the method. For me, subscription services are the way to go.

And in the podcast universe, there’s content for anything that might be interesting. There are literally hundreds of security podcasts. The CyberWire has ten ad-supported podcasts and four subscription podcasts alone on a wide range of topics: news, law, social engineering, thought leadership, security awareness, executive strategy, careers, and jargon. But there are thousands of other kinds of podcasts too. If the podcast you’re listening to is boring, turn it off. Not mine of course. Always play my podcasts first because, you know, I have mouths to feed. But, for those other podcast professionals, you can turn them off as soon as they stop being interesting.

My favorite podcasts right now.

Going into 2022, my podcast interests scan a wide range of topics.

Cybersecurity and infosec (of course).
Security and general news (headlines).
News and science analysis (Deep dives).
Story telling (we are all storytellers. Listening to people who do it well is essential training).
Tech (what’s on the horizon?)
Pop culture (because I'm a geek).
History (because I like understanding how we got into our current situation).
Books (smart people recommending books that they are reading and why).
Interviews (listening to what smart people have to say about anything).

But that’s just scraping the surface of what’s out there. If you think the science and technique of milking snakes is the coolest thing in the universe, I guarantee you there is a podcast for it. If you have a fascination with the Lizard Illuminati conspiracy, there are probably five. For me, I group all of my favorite podcasts into two general buckets. The first bucket is filled with shows that I'm going to listen to regardless of the subject because they are always good and I can’t wait to hear what’s next. Right now, here is my current roster:

Common Sense by Dan Carlin (Deep dives about history and politics).
CSO Perspectives from the Cyberwire (‘natch).
Word Notes from the Cyberwire (Another of my podcasts, short, defines words and gives context).
On the Media from WNYC Studios (Deep dives on how the news is reported - king of metta).
Radiolab from WNYC Studios (Good storytelling).
Revisionist History by Puskin Industries (Good storytelling about history).
Risky Business by Patrick Gray (Cybersecurity Headlines).
The Daily Podcast from the Cyberwire (Cybersecurity Headlines).

The second bucket is filled with shows that are high quality, but I'm only going to listen to them if I'm interested in the topic or the guest. After all, there is only a finite set of hours in the day. Here’s my current list:

All Things Considered from NPR (News headlines).
Fresh Air by NPR (Deep dive analysis).
Make Me Smart by Marketplace (Deep dive analysis).
Pop Culture Happy Hour by NPR (Pop culture everything).
Smartless by Jason Bateman, Sean Hayes, and Will Arnett (Comedy celebrity interviews).
Sway by the New York Times (Tech leader interviews).
Strong Songs by Kirk Hamilton (Pop culture music).
The Daily from the New York Times (Deep dive analysis).
The Experiment by WNYC Studios (Deep dive analysis).
The Great Books by the National Review (Smart people talking about important books).
The Lawfare Podcast by The Lawfare Institute (Deep dive analysis).
The PoliticsGirl Podcast by Meidas Media Network (Deep dive analysis).
The Rewatchables by the Ringer (Pop culture movies).
WTF with Marc Maron (Celebrity interviews).

Podcasts are not everybody’s bag. I get it. Auditory content is not their thing. They have to read it themselves or they don’t like it. Or, they can’t be bothered with making the technology work every time they go for a walk. My wife is like that. Or, as my editor John Petrik points out, they can read faster than they can listen. So, I totally understand. I'm just saying that there’s a rich mine of good content out there. You should at least check it out. To get over the technology hurdles, there are many ways to listen, from right off the show’s website to spotify to dedicated phone apps designed specifically for podcast nerds. That’s my preferred way. I use an app called Pocket Cast but there are many different apps to choose from. Take an hour and try a couple and see if this podcast thing can be useful for you.

I like books.

Do you know what the best thing about books is? They don’t have commercials. Ok, maybe that’s not the best thing, but it’s the least annoying part for sure. I remember exactly the day when I realized the value of books in my personal life. I was a lieutenant colonel in the U.S. Army and the powers that be were about to roll out a PKI program (Public Key Infrastructure) across the service. I was in charge of a big Army network at the time (1999 ish) and I realized that I didn’t understand how PKI worked. I knew my bosses were going to ask me about it so I needed to get up to speed quickly. The internet wasn’t a rich treasure trove of information back then as it is today so I was at a loss. I looked up from my desk and noticed the bookshelf where I had proudly displayed my grad school books, you know, the optional ones that you didn’t actually get around to reading but thought were so important to have. I found, “Mathematical Cryptology for Computer Scientists and Mathematicians,” by Wayne Patterson and my world opened up. This little container of ideas covered the entire thing. It gave me enough knowledge to be able to explain, at least in part, how PKI worked, and why we were going to expend resources trying to install it.

Ever since, my first move on trying to learn anything new, cybersecurity or otherwise, is to find a book about it. What I’ve learned is that, usually, if you read one book, you're the smartest person in the room on that subject because most people don’t read that much any more. Oh, they might read the technical paper associated with the topic, but that's not quite the same thing. Read two books, and you’re an expert in the field. And that doesn’t just apply to boring textbooks that you don’t want to read from grad school. Novels count. If you can find some historical fiction or near term science fiction that tells a compelling story, you might learn a little something along the way. Michael Crichton (probably most famous for writing Jurassic Park) may have invented the genre, but since his death, other authors have joined the fray. Neal Stephenson, Peter Singer, and Daniel Suarez are some of my favorites.

Here’s the thing about a book. The author probably spent a year or two writing it. And, for the authors who don’t write books for a living, they most likely based the content on their entire lifespan of experience. For the price of a family meal at McDonalds and roughly 20 hours of study, anybody can learn the highlights of what it took an expert a lifetime to acquire. As Socrates said, “Employ your time in improving yourself by other men's writings, so that you shall gain easily what others have labored hard for.”

And, as President Harry Truman said, “Not all readers are leaders, but all leaders are readers.” I have found this to be a truism in every job I've had. Look back on your career at the leaders you respected. I guarantee you that they were big readers. And they didn’t just read about topics in their field. Steve Jobs read Shakespeare, poetry, and books about yoga and health. Bill Gates thinks reading is so important that he takes a week or two every year to visit his cabin to catch up. And, as my favorite character in Game of Thrones (Tyrion Lannister) says, "A man needs books as a sword needs a whetstone if it is to keep its edge."

I realize that most of this sounds like more work that you have to do: something to get through, a mandatory task. Let me tell you, it doesn’t have to be that way. If you’re reading a book and it feels like a slog, close it. Find a different book. I know, you feel guilty because you spent money on a book that you didn’t read. I give you permission to forgive yourself. Even if everybody says the book is great, it may not be for you. Besides, there are lots of crap books out there. Don’t force yourself to read a bad one. And, there are resources out there that help you find the good ones. I use Goodreads to keep track of the books I'm interested in. It’s like facebook for book nerds. And, I’ve been involved in the Cybersecurity Canon project since inception, a volunteer effort to find the cybersecurity books that everybody should read.

Reading bad books just reinforces the wrong notion that reading is work and not fun and makes you not want to do it; especially on the weekend when you would rather watch the latest episode of “Hawkeye” on the Disney channel. I hear you. First, I'm watching the latest episode of “Hawkeye,” regardless. But once it’s done, if I get the strong feeling that the book I'm reading isn’t interesting or good, I'll close it. Life is too short to waste time on bad books. And there are so many good ones out there and so many ways to consume them.

You can read a physical paper and ink book. It’s a little old fashioned, but hey, if that’s what you like, go for it. My wife is like that . She needs the tactile experience of feeling the paper between her fingers. You can read digital books, or eBooks, in various formats. I prefer the Amazon Kindle format because I like the convenience of it, but there are others out there. You don’t need the Amazon hardware device for this either. The Kindle reader app is free and will run on practically any platform. I’ve installed it on both my laptop and my phone. I use the laptop version when I'm studying a book. I use the phone version to kill time when I'm stuck in a line somewhere. What’s especially nice is that the Kindle Reader allows me to highlight passages and easily lift quotes from the book to use in my own personal writing. And the search feature is a huge time server. What was that thing that Tyrion said in “Game of Thrones” about reading?

But, I think the most interesting way to read a book is to listen to it. I use the Audible service, again, because it's convenient, but like podcasts, listening to a book while doing mindless chores around the house is a good way to plough through a lot of material quickly. And the production quality has gotten so good too. I listened to the entire Harry Potter series last summer, seven books and over four thousand written pages. The narrator, an actor by the name of Jim Dale, did the voices for all seven. He did women, men, children, adults and various forms of the big three (Harry, Hermione, and Ron) from when they were children to when they became old geezers. It was truly a virtuoso performance. For me, it was like listening to a better version of the movie.

But there is joy in whatever format suits you. As Neil Gaiman said, “A book is a dream that you hold in your hand." If your book dreams aren’t causing you joy, find another dream. Or, as J.K. Rowling says, “If you don’t like to read, you haven’t found the right book.”

Let me make one last point about why reading books should be something that we all do. It makes your world a bigger, richer environment. In other words, it gets you out of your own bubble. As Confucius says, "No matter how busy you may think you are, you must find time for reading, or surrender yourself to self-chosen ignorance.” That's the nicer form of the sentiment. Mark Twain was more blunt: "If you don’t read, you’re not any better than people who can’t read."

My favorite books of 2021.

With all of that said, here are the books that I read in 2021 that I thought were especially good.

Cybersecurity books.

“Code Girls” by Liza Mundy: WWII code breaking efforts done by the U.S. with the bulk of the operational work done by American women (Cybersecurity Canon Hall of Fame Winner).
“Crypto” by Steven Levy: History of modern day cryptology, especially public key encryption, and the fight to keep backdoors away from governments (Cybersecurity Canon Hall of Fame Winner).
“LikeWar” by Peter Singer and Emerson Brooking: Current state of influence operations and what we can do about it (Cybersecurity Canon Hall of Fame Winner).
“This is how they tell me the World ends” by Nicole Perlroth: Short history of the exploitation market (Cybersecurity Canon Hall of Fame Candidate).

Non-fiction.

“Sapiens” by Yuval Noah Harari: My second reading of it and it still blows my mind. I'm still thinking about it months later. It's about many things but his ideas about the myths we tell ourselves are eye opening: humanism, capitalism, religion, the U.S constitution. His point about empires falling when they stopped believing in their own myths seems apropos of our current situation.
“The Innovators” by Walter Isaacson: The history of digitization and the life stories of the people who made it happen.
“High Conflict” by Amanda Ripley: Strategies to bring polarized groups together.

Horror.

“The Hunger” by Alma Katsu: What a great idea. Take the infamous Ill-fated Donner Party, add a bit of creative fiction about a disease that creates zombie-like creatures as the cause for cannibalism, and see where it goes.
“Horrorstor” by Grady Hendrix: A haunted house story set in an Ikea.
“Salem’s Lot” by Stephen King: Still the best vampire story ever.

History.

A Man Called Intrepid by William Stevenson: Counterespionage and influence operations prior to WWII and all through it; an unbelievable tale of a non-governmental spy organization, called the British Security Coordination (BSC), and the man that ran it: Sir William S. Stephenson (Code Name: Intrepid).
The Bomber Mafia by Malcolm Gladwell: A small handful of Army pilots, aghast at the carnage wrought during WWI, sought to create a more moral way to conduct war, a precise way to drop bombs.
Forget The Alamo by Bryan Burrough, Chris Tomlinson, and Jason Stanford: The historically inaccurate and egregious myths that Texans tell each other about the formation of the state.

Fantasy.

The Lord of the Rings by J.R.R. Tolkien: My first re-read since high school and still a better version of the story than the movies (but not by much).

Science Fiction.

Hail Mary by Andy Weir: From the author of “The Martian,” another space engineering story about a spider-like alien and a human trying to save two worlds from destruction.
Neuromancer by William Gibson: My second reading of the classic that gave us cyber punk, the origination of the word “cyberspace,” the singularity in artificial intelligence, the idea that hacktivism could be a thing, and the prediction that a “Google-like” search capability would be the norm years before it would actually happen.
Termination Shock by Neal Stephenson: The science of geoengineering.

Historical Fiction.

Master and Commander by Patrick O'Brian: Set in the British Navy in 1800, a properly told story happening in and around the War of the Second Coalition, England's war against the French.
The Apollo Murders by Chris Hadfield: President Nixon canceled the real-life Apollo 18 mission. Hadfield, a real-life Canadian astronaut, creates a story about a Apollo 18 military mission to go to the moon but to also recon and disable a Russian military satellite.

The meaning of books is changing.

One last thing, I’ve noticed a trend in the publishing industry that I think will change the meaning of what a book is. For the time being, we still have physical paper and ink books. We got digital versions in 2007 when Amazon released the first Kindle reader. But the history of audio books started early:

1932: First Audio Book created by The American Foundation for the Blind.
1960s: Books captured on cassette tapes.
1980s: Books captured on compact discs.
1995: Audible made it possible to download books onto desktop computers.
2008: Amazon buys Audible.

The first podcast emerged in 2004 when MTV VJ Adam Curry wrote some software called “iPodder” that extracted audio files from RSS feeds to insert into an iPod. Since then, podcasts and audible books have been traveling in parallel. That all started to change last year when Malcolm Gladwell published his latest book “The Bomber Mafia.” In so doing, he leveraged all of the available formats:

Traditional book that you might find at a Barnes and Noble bookstore.
Digital book from Amazon.
Book on tape from Audible.com.
Podcast version that he sold from his website and distributed through his podcast feed for “Revisionist History.”

The Audible book version and the podcast version did something extraordinary. In a traditional book on military history, you might quote a dusty old general like General Curtis LeMay and footnote it heavily. Gladwell takes it a step further and found the archival audio files, wherever they existed. Instead of reading the quote, listeners can hear the general speaking it. In this manner, Gladwell has converted his book into a longform podcast complete with musical interludes. I think that’s the direction the book publishing will be going.

On the podcast side, we are starting to see podcast documentaries, limited one or two season series on a specific subject. The production quality on some of these is really good too. They could be books in their own right but they are enhanced with interviews, sound effects, and music; kind of like a podcast. Some of my favorites are

1619 by The New York Times: Reframes the country’s history by placing the consequences of slavery and the contributions of black Americans at the very center of our national narrative.
Dolly Parton’s America from WNYC Studios: The story of a legend at the crossroads of America’s culture wars.
Halloween Unmasked by the Ringer: Celebrates the remarkable and terrifying phenomenon of America’s most revolutionary horror film, “Halloween.”
Hunting Warhead by CBC Productions: Follows the journalists and police on a global mission to expose child abusers and pornograhoers hiding on the Darkweb.
Land of the Giants by Recode: Mini-series seasons on the tech companies that impact our lives. They have done five seasons so far: Amazon, Google, Apple, Netflix, and food delivery services.
The Lazarus Heist by the BBC World Service: The Story of the North Korean Lazarus Group from the Sony hacks to the attacks against the SWIFT banking system.
The Plot Thickens by TCM: mini-series seasons on Hollywood stories: Lucille Ball, Peter Bogdanovich, The movie; “The Bonfire of the Vanities.”
Wind of Change by Pineapple Street Studios: Did the CIA write a power ballad that ended the Cold War?

In our lifetimes, I think the definition of what we call books will expand into a multi form experience that is a cross between written books and podcasts.

Final thoughts.

That’s my take on podcast and book sources for 2021 and going into 2022. If podcasts haven’t been your thing, maybe that could be your New Year’s resolution in 2022; to spend some time with the medium to see if it works for you. For books, especially if you are looking for good cybersecurity books, check out the Cybersecurity Canon Project sponsored by Ohio State University. But remember, I give you my permission to close a book, or stop listening to it, if after a chapter or two, you just can’t get into it. As I said, life is too short to fight through a bad book.

My favorite reading quotes.

Sharpen the stone.

"A man needs books as a sword needs a whetstone if it is to keep its edge."

– Tyrion Lannister

"The more that you read, the more things you will know. The more that you learn, the more places you’ll go."

– Dr. Seuss

"You know stuff because you read stuff."

– Christopher Willson

“The only thing you absolutely have to know is the location of the library.”

– Einstein

"Only in the printed word can complicated truths be rationally conveyed."

– Neil Postman

"Reading books requires you to form concepts, to train your mind to relationships."

– Henry Kissinger

"Usually, if you read one book on a subject, you're the smartest person in the room. Read two, and you are THE expert in the field."

– Rick Howard

Joy of reading.

“Books are a uniquely portable magic.”

– Stephen King

"Looking back, I started out feeling reading was an escape, then a chore, then a habit, then a luxury. Only now I’ve realized what a necessity it is, and how easily it’s taken for granted."

– Phoebe Waller-Bridge

“If you don’t like to read, you haven’t found the right book.”

– J.K. Rowling

Reading has always been the chief joy, a never-ending topic of conversation, and often a lifesaver, in my family.

– Elizabeth Borton de Trevino

"A book is a dream that you hold in your hand."

– Neil Gaiman

"To learn to read is to light a fire; every syllable that is spelled out is a spark."

– Victor Hugo

Leadership.

“Not all readers are leaders, but all leaders are readers.”

– President Harry Truman

“Today a reader, tomorrow a leader.”

– Margaret Fuller

Learn from the experience of others.

“A reader lives a thousand lives before he dies. The man who never reads lives only one.”

– George R.R. Martin

"Any fool can learn from experience. It’s better to learn from the experience of others.”

– Bismarck

"The problem with being too busy to read is that you learn by experience (or by your men’s experience), i.e. the hard way. By reading, you learn through others’ experiences, generally a better way to do business, especially in our line of work where the consequences of incompetence are so final for young men.

– General James Mattis

Books are your ticket to the whole world. They’re a free ticket to the entire earth. They’re an entry to conversations you wouldn’t be privy to otherwise ... The library is the key. That is where the escape tunnel is. All of the knowledge in the world is there. The great brains of the world are at your fingertips.

– Billy Connoll

"A capacity, and taste, for reading gives access to whatever has already been discovered by others."

– Abraham Lincoln

“The reading of all good books is like conversing with the finest men of past centuries.”

– Descartes

“Read more. It allows you to borrow someone else’s brain, and will make you more interesting at a dinner party."

– Matthew Dicks

“Employ your time in improving yourself by other men's writings, so that you shall gain easily what others have labored hard for.”

– Socrates

"To learn to read is to light a fire; every syllable that is spelled out is a spark."

– Victor Hugo

"Books may well be the only true magic."

– Alice Hoffman

Consequences of not reading.

"If you don’t read, you’re not any better than people who can’t read."

– Mark Twain

"No matter how busy you may think you are, you must find time for reading, or surrender yourself to self-chosen ignorance.”

– Confucius

History of podcasts.

2001:

The first iPod debuted in 2001.

2004:

Dave Winer authored RSS (Really Simple Syndication).
MTV VJ Adam Curry coded “iPodder” that extracts audio files from RSS feeds to insert into an iPod.
Ben Hammersley originates the term: Podcasting.
Libsyn.com (Liberated Syndication) launches the first podcast service.

2005

New Oxford American Dictionary named ‘podcast’ the Word of the Year.
The Mommycast podcast became the first six-figure deal.
President Bush published his weekly address in a podcast.
Apple introduces podcasts into iTunes.

2006

Steve Jobs instructed a live audience about how to create their own podcast using Apple’s free GarageBand software during a keynote address.
This American Life launched.

2007