This is AV Super Friends Off the Rails,
an almost regularly scheduled open
discussion on audio and video in higher
education.
We'll sound off about our most brilliant
ideas, our dumbest mistakes,
and everything in between.
And because this conversation will almost
certainly go off the rails at some point,
we'll end up covering just about
everything else.
And now, the AV Super Friends.
For March twenty twenty twenty six,
it's the best sounding and most secure
podcast in higher ed.
This is the super friends off the rails.
Episode number one hundred and thirty
four.
Two good ones broadcasting live at the
exact moment.
Day and night finally agree on something.
This is the spring equinox edition of
super friends.
The sun is rising.
The semester is dragging in somewhere on
campus.
An unsecured device is still begging to be
adopted by the nearest unmanaged switch.
So lock down your ports and add one
to all your passwords.
We're talking network security today.
I'm Chris Hector.
You're tuned in for another Friday
afternoon podcast adventure.
And let's say hello to today's panel of
AV Super Friends, which, as you see,
is larger than normal.
We'll get to that in a second here.
Our first panelist oversees the—whoops.
No, no, no, no, no.
Hold on.
We need music.
Hold on.
You can do this dry.
Here we go.
Hey.
Well, I pushed it, but it didn't—hold on.
Our first panelist oversees the delicate
balance between open collaboration and
absolutely not letting anyone plug random
crap into the courtesy LAN port on the
lectern.
He's a director of endpoint risk
mitigation from Kansas City.
Say hello to Mr. Jamie Reinhart.
That doesn't seem right.
I plug everything in.
Our next panelist designs secure AV
ecosystems while quietly judging IT staff
for every unmanaged switch ever hidden
above a ceiling tile.
He's a senior network AV security
architect from Corvallis, Oregon.
Say hello to Mr. Mark Kolowazinski.
Senior.
I love having to have ladders to manage
my network.
Sorry, that was a typo.
Senior.
Oh, senior.
Sorry.
Different.
A whole different role.
Our next panelist investigates mysterious
audio traffic storms and explains,
for the hundredth time,
why the network is not the cloud.
He's a principal analyst for Multicast
Forensic from Greensboro, North Carolina,
Salem, Mr. Larry Darling.
All of my audio storms are on private
islands.
I don't know what this has to do
with me.
It's in the cloud.
Island-like weather.
Island clouds.
Our next panelist leads enterprise
strategy for protecting classroom
technology from malware, misconfiguration,
and faculty who somehow have admin
privileges.
He's a vice president for Zero Trust
Infrastructure from Bowling Green,
Kentucky.
Say hello to Mr. Justin Rexing.
I'm also running Network Island,
so super secure, zero trust.
Perfect.
And we're joined by some special guest
panelists.
Our first guest panelist is brought in
whenever a campus decides the only truly
secure AV system is one nobody can
actually use.
He's a senior manager for AirGap
Educational Operations from Indianapolis.
Say hello to Mr. Doug Schaefer.
It's audio, Doug.
You got to say something.
Oh, hi.
Sorry.
You can tell I'm the theater of the
mind.
He was just being super secure.
Yes, super secure.
There's also live video,
so people are looking at you.
Yeah, yeah.
Our next guest, Panas,
is dedicated to minimizing every possible
vulnerability,
including unsecured touch panels and that
one projector that is still on a publicly
accessible network.
He's a director of AV threat reduction
from Northern Virginia.
Say hello to Mr. Colin Burney.
Hello.
I reduced all the threats by force.
And our final special guest panelist
focuses on protecting campuses from the
terrifying intersection of enterprise
networking, outdated AV control systems,
and hardware that still uses admin as the
password.
He's a distinguished fellow in cyber
physical defense from New York's ALM, Mr.
Frank Patakala.
Hey, how's it going?
Look at this.
And the song?
for having three extra guests we got
through that very fast i was pushing we
planned it that way we had a rehearsal
yesterday did we yeah on the live run
through this went just fine so um so
on today's show we're going to discuss av
network security and the lack of av
network security
But first, a little bit of housekeeping.
So if you're listening to this as a
recorded MP three, remember,
we do stream live on Fridays at about
three fifteen Eastern or twelve fifteen
Pacific or whenever Larry remembers which
authenticator app is his two factor to
join the show.
You can join us live for that on
YouTube, LinkedIn, Twitter,
where the packets are mostly clean.
The opinions are barely filtered and the
firewall is really more of a suggestion.
If you can't join us live,
please keep your connection persistent.
You can follow the AV Super Friends on
Twitter, LinkedIn, YouTube, and Blue Sky.
You can share the show with your
coworkers, your campus IT folks,
your least secure vendor in that one
department still using the same password
for every computer.
Spread the word like an unpatched
vulnerability.
We'd appreciate it.
Of course,
if you'd like to support the show,
please consider donating.
Your contributions help us to keep the
signal strong, our nonsense encrypted,
and the content flowing like suspicious
traffic from an unknown foreign IP that
somehow shows up every now and then.
This spring, clean out your closets,
rotate your credentials,
and for the love of all that is
holy, please do not cross the VLANs.
And finally,
while you're listening to us on YouTube,
Spotify, Apple Podcasts,
or any other platform you're getting this,
please rate and review us.
Your feedback helps us grow and reach more
listeners.
Thank you for your support.
We couldn't do this without you.
purely stolen all right um and now I'm
going to shoehorn this in because for
those of you who missed the last episode
or sixty seconds of what you missed Jamie
give me that other slate a full minute
If you missed the last episode of AV
Super Friends Off the Rails,
we did the hard work of discussing AV
cybersecurity, design drawings,
and the uniquely infuriating art of campus
departments buying random gear and
creating disasters for everyone else to
clean up.
It was the exact kind of episode people
claim they want more of right before they
skip it.
We discussed AV trust and the fact that
maybe, just maybe,
leaving things plugged into the network
for fifteen to twenty years with telnet
hanging out is not a flawless long-term
strategy.
Then we wandered into schematics, CAD,
napkin sketches, one-off room designs,
and the eternal question of where a real
AV design actually starts, which, frankly,
is more useful than ninety percent of the
thought leadership floating around this
industry.
So, if you missed the last episode,
congratulations.
You passed up security problems,
design arguments,
and real-world AV pain in favor of
whatever else you were doing,
which was almost certainly less
informative and somehow dumber.
Go fix that.
We'll wait.
Who was that?
Was that Al?
That's Al.
That was Al, yeah.
He sounds different.
All right.
And now,
because everyone's waited for it all week,
Justin, you ready to sing along live?
Do, do.
Here we go.
Do it.
Do, do, do.
Do, do, do, do, do, do.
Time for the news.
So this week's article comes to us from
Ed Surge,
which I gave our guest panelists the
better part of four seconds to read.
But sorry about that.
It happens.
Planning.
So basically,
the article is about a program dealing
with K- Twelve kids,
but getting them kind of
trained up in cybersecurity while they're
in high school.
So they kind of hit the job market
ready to jump right in.
It focuses on kind of what partnership
with with AV industry or with IT industry
manufacturers to try to get that so they
get real world training,
real world hands on,
and basically sets these kids up for
success right out of the gate.
So those of you who did skim the
article, thoughts,
I think it's the right direction.
Absolutely.
I would love to see the content because
I bet you it's probably not
incredibly relevant but awareness precedes
control it's something it's a step in the
right direction that's my take the one
thing i did like about what they were
doing where they were partnering with
employers to develop the content and it
was constantly evolving because that's in
my history of working with computer
science students that's one of the
complaints i always hear
is they're being taught stuff that's no
longer relevant in the real world the
closer you can get that gap i feel
like the the better off you are larry
does that class use books because if it
does it's probably behind stone tablets
brother that's all we have abacus teaching
portrait and still out there yeah hey i
i like this idea too um especially in
this kind of field
I,
being with coaching and having a bunch of
high school kids and everything,
I talk to kids a lot all the
time and they're like, well, what do you,
Hey, what's your next step?
What are you going to do?
Hey, I'm going to go to college.
I'm going to study cybersecurity.
Oh really?
How'd you get into that?
Well, I just heard it pays well.
Hold on.
They're not wrong.
Well, it may not.
Isn't that the number one incentive for
everything?
Well, it is.
But I feel like, you know,
sometimes we tailor that like, well,
I'm going to be a doctor.
No, I'm not.
I hate biology.
Right.
You know that by the end of high
school that you're not doctor material.
You're not whatever it is.
But you can be a doctor in a
lot of different things, though.
I don't know.
I think in this I like this because
it is kind of that.
um that merger like trade schools but it's
very it's tactical yes and and set these
kids up to on the right pathway now
to you guys's point usually the content's
a little behind but that's fine i mean
they'll catch up as they go it's more
of the exposure it's the awareness
I think the exposure is the important part
because there's a lot,
there's a certain level of risk that you
have to be comfortable with to work in
cybersecurity.
And I, for one,
am not comfortable with that.
So like.
Well, you have insurance for that.
You're fine.
It's like you make a mistake,
you're covered.
I have been places where the network has
been compromised.
Insurance does not keep your job.
Cybersecurity insurance.
So out of curiosity, you know,
As you were teenagers learning technology,
you were the ones testing the boundaries
anyway, right?
I mean, I guess.
I mean, we got three experts on here.
I'm pretty sure that you guys were,
I might've been the guy putting the blue
screen of death as the screensaver on all
the lab computers so that we didn't have
to have class because the teacher didn't
know how to do it, right?
That might've been this guy.
So maybe this is right up some of
these kids' alleys.
Like if they're playing around here
anyway, maybe.
Yeah,
you give them something that's practical
that they can kind of use that
discretionary energy on versus using it
for,
now teaching them how to be malicious but
there's also two but there's also that
element of like danger just like you
mentioned right they're like oh this this
is working with like a bit of that
dark side so there there may be a
natural kind of leaning element is to know
what is their curiosity because this can
be this can go in a different direction
right i think there's there is some
element of that maybe it's a different
crowd than our traditional i.t
I don't know.
I think it's good to expose more kids
to potentially this avenue.
And it also don't think cybersecurity is
necessarily like a singular thing, right?
There's a lot of overlap and you can
it's I guess one of those things that's
very cross-functional.
You can take the cybersecurity skills and
apply it almost anywhere.
I mean,
here we are talking about security.
Most of us know each other from our
AV backgrounds and our IT chops.
And here we are,
we're moving into cybersecurity.
The fact that it is essentially a part
of our conversation today.
So I think it's great that schools are
investing in that.
And I don't think any educational program
will ever equip you to do a job.
I mean, to be honest,
because it doesn't give you,
it gives you the skills to learn, right?
It teaches you how to learn.
And when they go into their first jobs,
I think what they've learned,
they'll be able to
probably apply it somewhere and just grow
with it it and cyber security so it's
so it's volatile it's dynamic it's
changing all the time there's no way you
can keep up so you got to be
in a job to get the bleeding edge
thing so if nothing else it's about giving
the exposure like do you want to learn
something new every single day then this
is a path for you exactly yeah yeah
and i think that's that's the thing that
struck me about this is that uh i
don't know there's two things that kind of
struck me about one is it almost feels
a little bit like the uh
know the after-school programs where
you're like hey come play basketball
instead of doing something else like they
found the kids that are you know because
we talk about money as a motivator you
know what pays really well too ransomware
pays real good that is a huge industry
and if you're glad that's not offered in
our school
Right, but it's offered online.
The other thing that I like about it,
as I said, credentials matter.
They only tell part of the story.
And I like that because it sounds like
this program is giving people, it's like,
yeah,
you can go get a CISSP or Security
Plus or whatever.
You can get those certifications.
But unless you've actually sat down and
dealt with this, that's an issue.
And I'm hoping that...
This gives them a couple years of
experience because the thing that we found
is that like every tech industry,
there are about fifty percent too many
entry level people for entry level jobs
and about ninety percent too few for any
level above that.
Like if you can break through that three
year barrier,
suddenly you just have jobs aplenty.
And so if they can kind of get
them to do that little hop
out of that entry level piece,
that is a valuable, that's valuable.
And I think that that's the issue with
with what we're dealing with in the
industry is that we have to figure out
how to get people past entry level
because, yeah,
you're going to get burned out and
disappointed and frustrated because no one
wants to hire you.
And we talk to people, you know,
AV in general,
it's like we talk to people all the
time that they're trying to get their
first AV job
And even though there's this huge need,
everyone wants an installer who already
knows something.
They don't have to reinvent and rebuild.
I think just any level of experience is
good experience.
Right.
And so getting people curious and not
making it seem like the first thing you
need for success is to go past this
massive exam somewhere.
Right.
Like that's,
that's not going to get a workforce that's
ready to go.
So show them a path to immediate placement
and get,
get them moving as fast as possible.
Yep.
I also like,
I like the premise at least of giving
people exposure to cybersecurity without
the stress, right?
Like teaching people about it as a
discipline and like being able to learn
some of the skills,
but not immediately be also, you know,
stressed out all the time about securing
an environment that's your responsibility
to take care of.
I think that's a good way to kind
of ease people into it a little bit
because some of that anxiety sometimes
comes from lack of education.
So having the knowledge and then being
able to kind of deal with the real
world problems afterwards,
it feels like it's the right order.
So I hope that works out.
I think that'd be really cool.
Or if nothing else,
this is going to generate an entire cadre
of awesome hackers who just start getting
into all our systems.
Which will then in turn create another
training profile for more.
It's the cycle of life.
Yeah,
the AV equipment will be first on their
list.
It's the easiest.
This certificate expired ten years ago.
Speaking of,
isn't that what we're talking about today?
We are, but first... Just wait a minute.
We've got to pay some bills.
We're going to take a quick break.
Jamie's going to go find that other thing,
and then we'll come back and we're going
to talk with Doug and Frank and Colin
about how we can fix this mess.
Hopefully.
Possibly.
It's like a thirty-year plan.
We're good.
Yeah.
Fifty.
Fifty years.
Do it.
Alright.
The AV Superfriends are supported by
Computer Comforts,
and they've got a brand new product
hitting the lineup.
Last year,
CCI's Evolve lectern was a big hit,
a push-button power table combined with a
super flexible AV cabinet.
But let's be honest,
not every room needs twenty-four units of
rack space.
Shocking, I know.
And that's where the new AV Hub comes
in.
It's a lighter,
more space-efficient solution for
classrooms that still need real AV
infrastructure.
you get eight units of rack space and
the whole thing sits only about ten inches
off the wall which makes it a great
fit when you're pairing it with a
sit-stand power table instead of building
a massive lectern footprint into the room
and this wasn't designed in isolation the
av hub was developed in collaboration with
texas state university so it's built
around real higher ed classrooms and real
deployment needs and that means fewer
compromises cleaner installs and way less
why is this furniture the size of a
refrigerator if you want to see photos
spec
and all the details,
head over to computercomforts.com slash
av-hub.
That's the new AV Hub from Computer
Comforts.
Purpose built, space efficient,
and designed for how classrooms actually
work.
And thanks again to Computer Comforts for
supporting the AV Super Friends.
All righty.
Security, big stuff.
Lots of good things with no actual plan
and no provisions, no capability.
Well, good show, guys.
Good show, yeah.
So who are these gentlemen on this show
with us, Chris?
Three people right up here.
So Colin, Doug, and Frank.
We teased this three weeks ago,
two weeks ago,
about the announcement about AV Trust.
And you guys came a couple weeks ago.
You announced the AV Trust as a nonprofit
to kind of,
get the industry moving forward to at
least, hey,
you guys don't need to be pointing in
the same direction about securing your
stuff because we want all the stuff on
the network.
We want our single panes of glass.
We want all the monitoring.
I'm just plugging a cable into the wall
and walking away.
And let's be honest,
I don't have any plans to touch, replace,
maintain,
or configure that device for fifteen
years,
which is not a good place to be.
So I'm kind of curious.
Let me finish.
So, yeah, I'll throw it to you guys.
Why don't you give us a quick overview
of AV Trust,
kind of how it came to be and
kind of your plan.
And then we've got a whole list of
topics, except for Justin,
who couldn't wait.
Justin, what?
No, I was just making comments.
He's excited.
Grunting noises.
He's excited.
Yeah.
I'm thrilled that you already talked about
us.
That's pretty exciting.
I think we can.
When you guys dropped the press release,
I think all of us went to our
back channel.
We're like, holy cow, what is this?
We actually know these guys,
and they're talking about things that are
important.
So we thought, hey, it's good show fodder.
Let's bring them on because we've said it
all individually, but we're not experts.
I mean, I guess my first question is,
you all realize how big this mountain is
to climb, right?
I mean, I'm pretty sure you know.
Ain't no mountain high enough.
So how, yeah, you probably recognize that.
How did you get this started?
Why are we doing,
why are you doing this?
Not we, you.
You're doing the hard work.
I got phished.
I had no idea what I was saying.
This has been bothering me for a while.
Security as a topic has been frustrating.
And like anything in the industry,
I think if you want to find a
solution,
you kind of have to start doing it
yourself.
we've talked in the past about like
creating communities and spaces and you
know places where we can have honest
conversation and this is another space
that i think at the core is about
honest conversation because this
potentially involves a lot of negativity
and i tested the waters last infocomm by
talking to a whole bunch of manufacturers
it's like hey
We, you know, do you do security?
And they're like, yeah, very secure.
And it's like, cool.
That's not true.
No, it's not true.
Right.
It's like, well,
you donate some gear for a hackathon.
And they're like, no.
We don't need that kind of publicity.
Colin, they're already secure.
They don't need you to be messing with
it.
It's secure.
Right.
You can't stop me,
but I'd love for you to participate.
After scaring everyone,
I had some conversations with Doug and
with a few other folks,
and we talked about,
how do we make this a reality?
One of the big gaps that Doug brought
up that I thought was really important is
that there's no secretariat council for
what we do.
There has been a history of researchers
finding vulnerabilities, reaching out,
and then getting threatened.
That was number one on our list to
say, hey,
we'll create a buffer of communication,
a legal buffer,
and allow a safe way for research to
interface with us.
Because if we start exposing the industry
to more of the broader security community,
they're going to get curious and they're
going to start poking on stuff and they're
going to find out some information.
We put the brakes on going straight to
hackathon,
And Doug said, let's start a nonprofit.
So we are the founding board of the
nonprofit.
I am the vice president and treasurer.
Doug is the president.
Frank is the secretary.
And so that's sort of how this was
born is like, well,
we need some way to funnel people into
something.
You know, we're still figuring this out.
I think we have some good plans and
we have some good people joining in.
But this really needs to be a
collaborative effort or it's not going to
work.
And so, you know, thankfully,
with that press release,
we've gotten a lot of manufacturers
reaching out to us.
We've had a lot of individuals reaching
out saying, Oh, finally,
someone doing this.
We're still I'm still working.
There's a few key security folks I'd
really like to be involved who are like
hardcore
IoT security researchers that we would
like to have on board.
I think that's the direction.
It's like there's a multi-pronged way to
deal with this.
I think our first push right now is
education.
I think we were talking to a manufacturer.
I was like, yeah,
I don't want to be the person that
comes in and starts flipping tables and
slapping people saying,
what's wrong with you?
Because I think most people know people
don't think about it like if I'm and
I'm told to plug that thing in I
plug it in I turn it on and
I leave and I'm not gonna like it's
not gonna be Beneficial or productive to
be mad at everyone right off the gate.
I think after a while we have to
go Hey What are we doing here?
We've talked about this.
Are you serious?
We're still doing this.
But I think right now it's like, okay,
now we have a platform to start saying
that, to start saying,
these are standards.
You must meet these minimum standards or
it doesn't work for us as an industry.
It exposes us to risk.
It exposes customers at risk.
It makes everyone upset.
You gotta stop.
So that's where we're at.
It's really simple.
I mean,
either we could do it or somebody else
could expose us and hold us responsible
for it.
I mean,
the options are pretty much pretty simple
right there.
And I think all of us, Colin,
Doug and myself,
I've spent a better part of my career
just talking about security.
My background is in cybersecurity.
I use that cybersecurity knowledge to be
useful in my job every day.
I mean,
so that's that's kind of been my niche.
And when this came along,
I was like all in.
And the reason is like
Education is very important.
But I also,
I want to start this off by saying
we're not the doom and gloom people,
right?
Security never has to be painful.
It doesn't have to be challenging.
There's a better way to do it.
And the reason why anything is challenging
is a lack of awareness and most
importantly,
lack of the language and how to speak
it and how to communicate security.
The fact of the matter is
I feel AV has come a long way.
I mean,
there's a lot of people who are doing
security practices,
but just don't know what they're doing.
They change their password.
The thing is,
security as an industry has existed for a
long time,
probably longer than AV in itself.
And what it has done is given us
plenty of standards,
plenty of ways of communicating these
things.
and the hope is that we can kind
of make this popular make it common
knowledge i mean av needs to be integrated
with security the the next generation of
integrators the next generation of
manufacturers the next generation of av
designers need to have a security first
mindset and that's that's just the way it
is as long as you plan on existing
on a shared infrastructure
As long as you're not going to pull
your own cables.
That didn't exist.
I don't know who.
It's my pet peeve.
When I hear island,
I don't think there's ever been an island.
There's no such thing as an island.
Yes!
That's a whole other show.
Jamie and Mark are on Frank's team.
We're on Frank's team.
Pick me, pick me.
The network.
Yes.
Yeah.
I think we've kind of defaulted to a
very simple way of approaching AV
deployments by saying, yeah,
we're isolated, we're segregated.
And you go into network teams and say,
hey,
can I have a VLAN that has fifty
devices?
You have no idea the challenges involved
with some of these things and how security
operates and how networking teams operate.
And so what do you do?
You're antagonizing the people who are
supposed to be friends with.
And then I think there's an entire group
of people.
I think the AV's IT argument that was
like, I guess,
every day in the Twitter spheres for a
long time.
That is so old at this point.
I know, but the thing is,
we try to paint ourselves as something
we're not.
Yes, AV is all about the experiences.
Yes,
AV is all about the visual and the
experiential impact that we give.
But at the end of the day,
are you saying that we don't need
electricity or we do we not need the
infrastructure do we not need the
resources yeah and we have to play by
their rules right you can create your own
rules by saying i'll bring my own switch
and i'll create my own network you're
saying i will do this whole thing by
myself and they're like no you can't
because you're in my space you're in my
building you're in my facility
And that's basically what security has
become.
And we're hoping that by creating a space
where people can come in and contribute
and build that next standard future of AV,
we'll give people the voice to do that.
And that's practically the hope behind
this nonprofit.
And I know there's people that are
listening right now.
Their blood is just like boiling.
And because there's like the path of
getting something done versus the path of
getting something done correctly.
And there's philosophical differences
about getting my ass out of this room
and being done, done for me.
and making my systems and services work
versus it living harmoniously in this
luxurious cloud connected and enterprise
environment where do i care i don't know
and i think there's a lot of ground
in between these two examples and we talk
about it i don't know every day justin
yeah pretty much my my biggest question is
we we all understand you know how windows
and apple and all these
big companies deal with security and their
challenges with it.
And they have teams of what?
I don't know.
You guys know more than I do.
Thousands of people dealing with security
on their whatever more secure numbers.
So how I want to like, logically speaking,
it's like a guy in the basement.
How do these small manufacturers that are
all making these products that live on the
network have a security team each in their
house?
Because we all understand that it
changes daily, right?
We all talked about that.
So producing a product with Firmware X and
then not releasing another firmware for
six months.
So are we expecting these people to
release updates weekly, daily?
Like,
what is your thoughts on the long term
here and how this is actually achievable?
So there's a multifaceted approach to
that,
and I think it does vary a little
bit based on what type of product it
is.
So you see a lot of Windows-based devices
in audio visual today,
and there's an existing security framework
and a lot of rules that kind of
wrap around Windows just by itself,
not even including the other parts that
would be Teams or Zoom or whatever
specific, right?
It's pretty hard to say that as a
mandated standard,
you should have X amount of security
professionals regardless of your business
size or anything like that.
But I think part of what we're trying
to kind of help with too is identify
what should be expected as far as
standards for the products that people
kind of buy.
um how somebody decides to make sure that
those are in their products is up to
them it can be a full-time person it
can be a contracted team it can be
you know a software development team it
can be a cio right and i think
how that works is going to be different
based on the organization and the type of
product that they sell and where they're
trying to sell it
But part of I think some of the
variance amongst the vendors in the space
has been a little bit just because there's
not been a constant,
a consistent type of communication about,
hey,
this is going to be the bare minimum
stuff that we for sure expect out of
everything that we're going to see go into
a corporate or higher education or
whatever environment from a networking and
application security side of things.
And having those standards would make a
world of difference towards helping then
the companies making the products staff
and plan appropriately for product
development.
Some will know exactly what needs to go
in there when they do want to take
something to market, right?
Because right now it is all over the
place.
What would some of that be?
I mean, we have our ideas,
but from your guys' experiences,
what are some of those bare minimums?
If I'm evaluating in the future today,
yesterday,
What do you feel some of that bare
minimum?
What,
what kind of things should we be asking
from,
from the end user side to this
manufacturer says, look,
we all agree that these are the things
you don't have to be super specific
because none of us know,
but just the overarching thing.
What is, what is that?
What's it look like?
I.
I think that there's part of it,
and this is a discussion that we've all
had,
is that our method of updating devices has
been broken from the start.
And it's the idea that security updates
are tied to feature updates.
So there's companies,
they won't patch a security issue until
they have a new feature to roll out.
Because you remember the whole thing.
It's like there's certain brands where
once you get an unstable firmware,
don't touch it.
Don't touch it.
It's working.
Walk away.
Manufacturers are like, we're done.
This is it.
We're done.
I've even had somewhere,
it's like if you want this feature,
it's on this one.
If you want this feature on this one,
they do not exist across these two because
we couldn't figure out how to do it.
I think that there needs to be a
difference between security patching,
which should be mandatory over the year
patching,
and features which are optional.
I shouldn't have to accept a new version
just because I want to patch a security
issue.
I think that's a big thing that customers
can be asked for to be like, hey,
you need to separate these two things.
And I think that's part of the issue.
I think the other big issue that we
have as an industry and this is going
to, you know,
we're already starting to kind of like
poke on some some sore spots is we
have a serious issue with rebadged
devices.
So there's an original manufacturer
And then there's,
like we play that game where you go
to the little tiny tables around the edge
of InfoComm and you take notes.
Yeah,
and then you go and find it in
a thirty booths.
And so if the OEM finds a security
issue,
they can't patch that because everyone has
written custom firmware that at the very
least has a different name and logo in
it, or even better has, you know,
some other items,
but it means that there's this long,
complicated process of communicating
through.
And we've seen this in the past.
And we've called them out on that.
They're like, yeah,
that's the company we buy this shit from,
from Australia or whatever.
And you're like, well,
it's still a problem.
It's still your name on this invoice, sir.
Yeah.
Yeah,
you're still the support number I was told
to call.
And at a certain point, it's like, okay,
you're torpedoing your business model by
pointing backwards.
It's like, well,
then why wouldn't I just buy from the
person who's guaranteed to patch it?
And I think that's a big issue.
And these are things that I think are
important discussions to have.
And I'm hoping that this is part of
what we're talking about is to say, okay,
why don't we start pushing on these points
in a little more serious manner?
The other thing I just want to jump
in and say is like,
when we talk about security,
if you've noticed the last twenty minutes,
we're all trying to go towards that
technical conversation, right?
We're looking for how to secure things.
The fact of the matter is security never
starts from a technical conversation.
Security starts from a pure non-technical
documentation.
My favorite security term,
and I love using this, is risk profile.
What's a risk profile?
A risk profile is telling the stakeholder
that, hey,
I'm giving you this box and I have
no idea what it does.
Right.
And if Larry says, I'm cool with that,
I know what it does.
I'll take care of the risk.
I've done my job.
I've informed you that I'm clueless as far
as the security is concerned.
And Larry's like,
I know the function of the box.
I have a strategy in place for dealing
with boxes that have no security profile.
This is not uncommon in the world of
IT.
You'd think that IT is completely
standards-based and all uniform.
Heck no.
It's worse than this.
IT people and security people deal with
the same problems that we're talking
about.
Manufacturing inconsistencies,
firmware issues, patching problems,
security patching updates.
There are several products out there that
are very popular in the IT world today
that have not had a security update for
months.
And you know what?
That's common, they know it.
The thing is what we need to enable
the AV community as a whole is to
understand how do we deal with the risk
of it and what is the strategy associated
with it?
That is what we lack from the get-go,
right?
Once we've identified the strategy
associated with dealing with the risk,
then you'll have the right questions to
say, hey,
my network team will not accept something
that does not do this.
That is a more informed conversation to
your manufacturer than this saying, hey,
can you give me a document that says
all the different things you do?
They don't know what you're looking for.
And so maybe help the community as a
whole by building a collaborative
environment.
The problem is nobody knows what to ask
and nobody knows what to say.
So it's like it's a completely confusing
environment.
You have to build a common lexicon.
And I look at this and it feels
like this is a coming of age of
AV.
Are we finally being tall enough to ride
this IT rollercoaster in a way that we're
not just taking black boxes and just
pushing shit around structured cable?
Because that's really where this all came
from.
How can I save money and not have
to put this Klingon cable through this
wall where I can just use this CatFive
that's right here?
It all just kind of grew up a
little bit.
It was cheaper for a lot of people
to kind of...
basically put the blinders on and say,
hey, you know what?
I'm going to not care about that right
now because I can put this in a
closet and not look at it.
Network island.
And to Frank's point,
the whole premise about communication
is...
called security by obscurity and something
that's a big problem in av is like
this stuff is secured by basically not
having information available about it and
they say you know nobody knows how to
find anything so it's it's fine we're not
we're not gonna look it's all good yeah
uh and that's that's not a as functional
it never really was a strategy but it
kind of finds a lot of holes
as people are starting to require that
information in order to adopt the
technology properly because it needs to
integrate with the rest of your network
security profile, right?
That's how you communicate.
That's how communication works.
I like how Frank brought that up because
Mark and I,
you know,
when we're trying to put everything on,
on our enterprise, right, we had to have,
like,
one of the things I really struggled with
right away was I didn't understand network
names and terms.
And the the white sheet you get from
manufacturers, like, well,
QoS has to be well, that on enterprise,
that's not necessarily how work.
No, it's not.
Right.
And so I had just bark out orders
and say, do this.
It's not I had, yeah,
I had to learn all that I had
to learn the lexicon,
I had to learn
And I don't even know how to be
a systems admin,
but I had to know the language and
I had to be able to talk to
him.
And to Mark's point earlier,
I feel like this is the next step.
Like, I don't know what to ask.
I don't know what's going to get blocked
tomorrow until it is.
And then I say, well, why?
Well, because of these things.
Oh, well, I'll remember to ask next time.
Is this something for that lexicon thing?
Is that something that's kind of part of
the pathway too?
Kind of like, hey, dummy,
here's your primer.
These are the key words that you need
to ask even if you don't understand them.
So we can print them on AVSF cards
and have them at Infocomm.
These are the key security words you need
to know.
Know these words or know how to use
them in a sentence to sound like you
know these words.
Honestly, it's like even in the networks.
When I do teaching across managed
services, across IT stuff,
and now across security,
vocabulary is really big because
Everyone has acronyms that they know,
and they all speak this language,
and they have common meaning for words
that might just be normal words to the
rest of us.
And I think that is really important.
And I think the great thing about what
we're doing,
and this was a discussion early on about
how we were approaching this,
we don't want to create,
we don't want to baby the AV people
and say, oh, we're special.
We run IOT devices,
which are the most miserable,
hateful devices you could possibly put on
a network.
And once we accept that, we go, okay,
there's a framework for containing this
threat.
There's a vocabulary to go around it.
There are some specific things that are
unique to what we do because we have
things like Dante and we have NDI and
we have all sorts of fun stuff like
that.
But there does need to be a common
language.
And I think the nice thing is that
all that training is available and free
and
right now like i always tell people like
go get the cc it's an easy like
it's a it's a sort of one-on-one
vocabulary lesson okay cc expand that what
is like an acronym what does that mean
it's the sort of processor to the cissp
it's kind of like if you went to
infocomm and you got the
What's the one you do the little tests
for where it's like,
you're a certified AV technician?
What is that one?
There's a really easy test that you do
on InfoComm that gets you a really easy
test.
Oh, the recognized AV technologist one?
Yes, that one.
It's basically that for security.
It's a little more in-depth,
but it basically spends a lot of time
on the security triad and a lot of
the language,
because there is that sort of divergent
path within security.
there are the managers like cso's
generally aren't sitting and configuring
all of the security tools and at the
same time people who configure security
tools aren't generally writing policy
around risk and setting you know our risk
appetite around you know certain products
and that sort of piece so there's a
little bit of the language you have to
have just to get into the technical part
of it because they have to work together
and so yeah that is part of our
plan is to say
look, if we don't have the training,
I'll point you at it all day long.
And there's a lot of great resources
already available.
Exactly.
There's plenty of certifications in IT.
CC is one, Security Plus.
Heck, get a good network certification.
Even a vendor-based network certification
will give you some understanding of how
these things operate.
The problem is we come into it
saying that we're AV designers,
AV integrators, AV people,
and we have no idea what we're asking
of other people,
the other communities involved in our
deployment.
The crazy part is we do this really
well with everybody other than IT.
We have coordination documents
that are excellent, that go to architects,
that go to mechanical vendors,
that go to contractors, right?
But when it comes to IT,
you send them a signal flow drawing,
which is every network person that looks
at a signal flow is like,
what the hell is this?
Why are you giving me this?
What does this mean?
And that's the problem, right?
We've stopped somewhere along the way
saying this is not my job.
I don't know why.
But it is our job.
There's a lot of animosity still that's
built up over the years, right?
And so I think a lot of us,
we put things on,
I'm going to use their network, right?
So here that is.
And then we get the sense,
we're going to go talk to a network
security group today.
And everybody's like, okay,
you got your cheat sheet.
You got to just have the lingo right.
Because it's like unlocking an API.
If you don't have the correct code words,
it's done.
They're like,
you don't even know what the fuck you're
talking about.
Well,
and also to just as well as we
do, like they use their acronym.
We don't know what it is.
And that's it.
It's open.
And also you get one shot to authenticate.
In reality,
when you're communicating with a network
group or security group,
you as a AV professional, any of us,
don't make these things.
We're not making these boxes.
And so we're relying on the manufacturer's
documentation.
And so we conjure that up.
We call our reps.
We're like, do you have anything else?
Because this is shit.
I need some more information.
They send you some more stuff that's like
closed up in the back room that they're
not going to let out.
And you give that to the network group
and they're like,
none of this makes any sense.
You're an idiot.
We're like, ah,
so it starts with the manufacturers
really.
And it, and it flows from there.
That's the reality of it.
The biggest,
whatever thing in the world and give them
that.
I think this is an immature product.
Like we can't make up what the boxes.
Hold on here.
Here's the thing that I,
I struggle with is that,
Yes.
Security people are kind of throwing their
hands up and, you know, be like,
I think there's some there's some there's
something to be said for, hey,
we need to go patch things up with
security people.
We've been, you know,
letting our dog take a dump in their
yard every day and not cleaning it up
and then going, hey, neighbor.
And that's rude.
Moving on.
That's rude.
Wait.
It is.
One thing I would say is,
is I can't think of anyone who got
all the gear to the to their warehouse.
got it in a rack and then just
ran a basic vulnerability like a standard
vapt test on that gear and just check
to see if there's anything going on on
it yeah right and so hey okay cool
did you you know have you done your
basics like did you did you at least
check it out and make sure it's not
goofy or weird and you go i don't
know what you're talking about where i'm
just gonna throw it on your network so
now i have to do it while it's
on my production network
Well, we've been burned on this.
So we will, you know,
we'll lab it up or whatever one time.
Yeah, that's great.
Oh, this thing, this thing.
That's the other thing is the scale of
this.
So we lab it up.
Let's say it's a manufacturer X model Y.
We're like, OK, well, it passed.
There's no documentation that it says it's
using Telnet and you buy them.
And then, you know,
part of our practice is, you know,
we have to have the security group scan
our devices when they do end up on
our network because sometimes they do.
Um, I joke about network islands a lot,
but you know, it's whatever.
Yeah.
And then all of a sudden they,
they have this new firmware and then
there's this new thing exposed.
And now we look like idiots again,
because the security team caught it.
Like, why didn't you catch this?
Well, I'm not,
I'm not scanning every system that I have.
Cause we don't have the personnel to do
that.
And it goes,
it kind of goes back to the resources
too.
It's a, it's a.
it's a game cyclical thing that just never
ends.
Right.
But,
but I think that understanding who's
responsible, if you know that you're,
you're kind of responsible because you're
going to allow that firmware to go on,
but giving them a heads up being like,
Hey,
we're going to be pushing some new
firmware.
Just so you know.
Well, you don't even know.
You buy the product and it came with
it.
And you're like,
I didn't read every manual every time I
buy a product.
The one I tested came with version two
point oh.
And well, I mean,
I'll let you in on a secret.
I don't think all the manufacturers made
it either.
Exactly.
That's my point, Frank.
There's probably one person or two or a
small group of people who understand that
six-page white paper.
You're probably getting it from a rep.
They've seen two pages in it.
Heck, we have AI today, right?
I think AI is going to be a
bridge in a lot of these communications.
It has to.
At some point,
we have to understand that our language
needs to align with whoever we're talking
to, otherwise our products.
And it doesn't help that there are still
strong proponents of,
let's build it out on our own island,
let's build it out on our own thing.
And you know what?
I'm okay with that.
If that's how your deployment strategy
works,
and if the client is okay with it,
Attach a risk profile to that and tell
them, hey,
we have no idea what's on your switch,
but we know your switches exist.
If that's okay with the client, sure.
But that's the thing.
We need to be able to give those
educated opinions, educated, qualified,
technical conversations about our
products.
If we're selling a product,
if we own a product,
we need to own it.
We need to understand it.
That's basic, basic, basic.
Any sales one-on-one.
I'm curious about how
we go beyond this black box strategy.
Because as we look forward,
I for one believe that it becomes less
about the black boxes.
When we start throwing in things like
cloud,
And service delivery from that.
That is a whole different layer of this
cake that I can tell right now from
my recent interactions with all these
monitoring companies and the manufacturers
they're tying up to.
I believe the industry is way out over
its skis.
Way out over its skis on a lot
of things right now.
And I don't know how...
they're going to pull things back because
right now they're trying to figure out how
to monetize things faster than they can
even support them.
And I think one of the things I
was going to ask on,
I think it dovetails here, Mark,
under your question is that I've heard
Colin say several times, IOT, IOT.
The only thing that my, like my people,
uh,
security people hate the term more than AV
is IOT.
Um,
but IOT because of the internet of things,
right?
That's the internet connected to the
cloud.
I agree.
I think we are moving to Mark's point.
We are moving to an IOT.
We are moving to a cloud persistence.
We are moving to a true internet of
things, whether or not they'd move audio,
video, something else.
So I was interested.
I was going to ask similar to call
it like you keep saying IOT,
which I agree with.
Um,
but that brings all these other challenges
to what Mark said.
How do we merge that?
How do we take it from the trons
to the cloud?
It's not just to have an account and
you owe your provision and you're paying
your thousands of dollars a month.
Well, everything's good.
It's like, no, no, no, no, no.
There's so much more to this story.
I think this is a little bit,
this is a challenge for even the IT
folks because, you know,
removing AV from the conversation,
the area of IoT security is honestly kind
of a new space for a lot of
people by itself, right?
So, you know,
it's helpful to be able to articulate,
I think,
that your devices are non-standard on the
network,
but also
the IT folks that a lot of people
are used to working with don't necessarily
have an immediate answer to the question,
hey,
how do you secure your IoT devices either?
Which is why it's all the more important
that we're able to articulate at least for
our own technology stack,
like what the needs and responsible usage
of that is.
I agree with the being out over our
skis thing.
History kind of usually shows that there's
a little bit of a rubber band effect
at some point when that starts to bite
us on the butt.
That was the journey and the experience
when we started to venture onto the
network in the first place with a couple
of things about application security and
functions online.
networking protocols and stuff like that.
I don't know what that catalyst is going
to be, but supply-demand situation,
if people are looking for more features
for maturation of their devices,
then usually there's a lot of stuff that
happens to catch up when it needs to
happen.
Usually there's a little bit of a
punishment first.
I think we all have CISOs or some
version of that on our campus.
I've had some recent conversations and a
lot of the belief is it's not the
traditional vector of attack.
It's not from an actor who's going to
come into our network.
The calls are going to come from inside
of the house.
That's going to be something that's here
that's going to call out and invite in
what's going on.
Probably those high school students we
just talked about earlier.
That's a different traditional posture
than your normal security.
And I think just the volume of stuff
that we have
makes them look at us a little bit
differently.
You have a lot of stuff that can
potentially communicate to the cloud
system, which we have no control over.
Well, not only that,
we have a lot of stuff,
and this is a very, very real concern,
is that anymore,
we're getting a little deeper into some of
the major issues and the things that give
me stress.
is that it is entirely possible,
because it has been caught numerous times
already,
for a device to record information
locally,
wait for an opportunity to open up a
window to open up,
and then exfiltrate that data out.
And when you have devices that are sitting
and listening to private conversations,
privileged conversations,
I can set advice to be like, hey,
look for the CEO of this company.
When you see that dude's face,
you start recording that audio.
Transcribe it to text.
Hide that text somewhere encrypted and
next time there's a little call out,
send that out and maybe we'll learn
something, you know,
and that's the kind of thing that we
are.
We are especially dangerous,
not just because we are an attack vector
that exists and is kind of forgotten
about.
But we are also capable of doing a
lot more damage because of what we can
bring in.
You've seen what's happened with the flock
cameras.
Their credibility is absolutely destroyed
right now.
And you watch the videos.
It's so easy to get into a flock
camera and just watch what's going on.
That's a lot of power.
Because if I can find a flock camera
somewhere that has privileged activities
going on in it,
I'm not now just getting into a camera.
I'm potentially getting information that I
should not have access to and probably
wouldn't have any other way.
And so we are in a very dangerous
position because we have put these things
inside of boardrooms.
We put this inside of government agencies.
And that's what stresses me out about it
is that we're such a widespread
technology based like everyone just
assumed you're going to have some sort of
video calling at this point.
But we're I don't think we're really up
to it.
I think it's the philosophical approach
from the years is like in q one,
we're going to sell this black box q
two, we're gonna sell this black box.
And yeah,
I think the industry is just overly
concerned about the better mousetrap
continuously that they're just not seeing
the entirety of this picture.
And they're not even staffed and their
organizational structure is not made up to
even dive into this.
We've engaged with the conversation and
they're just like,
they look at you in the biggest of
the big ones, all AV.
I want to throw them all in the
same bucket.
Nobody is tall enough to engage in this
for this ride and have the conversation
that they're too concerned about staying
solvent than they are solving the network
problem.
I mean, to be honest,
that's one of the reasons it was really
important to us to start AV Trust as
a nonprofit.
I think it's really tricky for a company
to prioritize security over revenue when
your whole business model revolves around
sales, right?
something that we kind of have to our
advantage or to our credit.
And I hope this is, you know,
ultimately what helps other people or help
other organizations is like we would be
one of the only, you know,
bodies of people that are actively working
on us because we care about it and
not because we're being forced to in order
to make money.
Right.
And that's really important in the
security space.
There are other industries where that's
been a precedent to where it's like, hey,
in order for there to be any kind
of consistent work put in to help kind
of keep this thing afloat, you know,
some some nonprofit participation is
required.
And that's that's kind of you know,
it was very important to us for that
reason,
that we would be a source of trust,
but also just
People know that we're not making money.
They're not doing it to make money.
They're doing it to make sure that it's
happening and happening for the right
reasons.
That's one of the most important parts of
that.
So for some of our, there's probably,
we may have a listener or two that
are very interested in this.
Well, not total listeners,
just that are interested in this.
Like if they're sitting there thinking,
how do I get involved with this?
This sounds awesome.
This is where I want to go.
This is my passion also.
And I've never heard somebody do an
organization like this.
How can they get involved with you?
And what kind of things are you like?
What kind of helpers are you looking for?
I'm going to guess you don't just need
some nerd.
You know,
like you have specific initiatives you
want to go to.
No more nerds,
only non-nerds who can communicate.
No super nerds.
Got my candy, right?
But like what skill set,
not skill set in particular,
but like your initiatives are X, Y,
Z right now, your short term goals.
What kind of people are you looking for
to help you get there?
Because as a nonprofit,
it's not like you're just out there
throwing money at all these people.
So if somebody is passionate,
what kind of passionate person do you
want?
Yeah, so I mean,
it was important to us to be able
to have a lot of different types of
people contribute.
There are going to be people that care
that don't have a whole bunch of
cybersecurity training formally,
but they would potentially want to learn.
There's also some people that have come to
us from actual full-time cybersecurity
jobs that haven't done very much AV that
were like,
this is really interesting to us because
of the IoT conversation, right?
which is really great.
And that was honestly the goal.
We were really,
really hoping we would get people from
both sides because that's that's what's
going to make us better,
because I think the the being able to
translate from cybersecurity as a whole to
audio visual and make sure the lexicon
works and stuff like that,
it's going to require a good understanding
of our environment, our ecosystem,
our technology stack,
but also a good understanding of how the
industry as a whole does things we can
learn from each other.
Right.
So we're kind of putting together a couple
of different councils about one is
generally for standards development,
you know, just understanding, hey,
this is going to be, you know,
we talked about what the bare minimum is
going to be for technology that goes on
the network that we see from vendors like
putting together councils to start to
build those standards a little bit so that
we can say, hey,
if you guys want to, you know,
X vendor,
if you guys want to have a technology
product that gets reviewed by us or,
you know, by a client,
they ask us for help or whatever.
These are the standards we're going to use
to kind of benchmark that, so to speak,
and kind of start to put that together
so that people can understand what that is
and have a common understanding of like
what the expectation is.
We're also kind of looking for people to
help with some events and some training
materials, education,
writing documentation,
because there is a ton of that that's
so very needed that they'd be able to
interface with some of our nerds and help
with some of that in writing and help
with the education part of it,
because that's going to be really
important for us as well.
I think contact information wise and we
can share this in any format necessary,
but we have a Discord right now that
that's been kind of doing well,
popping off.
We have a website, which is aviatrust.org,
which Colin put a lot of time and
effort into.
So that's awesome.
And our email address and contact info is
on there as well.
I put a lot of time and effort
into it because I'm not good at making
websites.
So what you see on there is the
absolute best I can do.
Yeah,
a lot of time and a lot of
like...
why why doesn't this work no but yeah
i think i think the and the other
thing too is like we do have the
secretariat council that is meant to uh
ingest the any sort of security sides to
it um i i think
to it's like, yes, we're a nonprofit.
Yes, we do need money.
I think one of the things that some
of the people that we need to interface
with will not work for free and I
wouldn't expect them to.
If I want to hire a security researcher
to study a family of products,
I need to be able to buy those
products,
pay for that person's time and then
present that information.
I'd love to do that in partnership with
someone so I can put their name on
it, we use it for marketing, whatever.
But then it will be freely available to
everyone.
That is a really important piece about
what we talked about is that there's not
really membership.
People will be on councils,
people will be sponsors,
but everything we do,
we want to be available.
If we put on an event,
we're going to record it,
we're going to put it on for free
because it is better for all of us
that that information is available.
than to try and turn it into some
sort of incentive to give us money.
I just want to get things out there.
But there is some money necessary to get
into that,
because I would like to pay researchers to
just dive on stuff.
Send them a box full of stuff and
say, hey, take this apart.
Look at the boards.
Tell me what components are on it.
tell me what's going on.
I'd love to, you know, to that point,
it's like when we talk about like,
how do we get better with this?
I don't think anyone,
there is not currently a YouTube channel
where someone gets AV gear and opens it
up and looks at what's actually on there.
And there's a famous picture that, um,
this has gone around us every time the
sticker, the warranty sticker.
Oh yeah.
There's that last screw and you can't,
you cannot get through it.
It stops me every time.
I'll just tell you.
It's your deep conscious.
No,
but there's a famous picture of this
converter box that is filled with USB to
BNC converters.
And then there's an Arduino and a
Raspberry Pi.
And it's in a chassis.
It looks like a product,
but you open it up and they just...
have stuffed a bunch of stuff in there,
coded it together,
put some nice interfaces on it,
and shipped it out.
It's insane.
Chris is already on it.
He's like, I got this.
I think this is actually a really good...
chance for higher ed to just like you
mentioned before to really dive in because
I think there is a level of importance
of like third party in this right where
it's sometimes we're not going to take the
manufacturers and say, Okay,
they've they've done these things where
we're talking about large scale enterprise
deployments that have mature security
parts within their organization,
they can actually do
this testing and do the reporting at
scale,
I think higher ed is perfectly positioned
to do that.
And I think that this is a great
vertical to kind of start getting that
word out.
And if nothing else,
like if you're listening to this now and
you think you can contribute,
you have to reach out to these guys.
Sounds like a thesis material to me.
That's what it sounds like.
And especially since so many of our
colleges are in the process of opening up
cybersecurity centers and test hubs,
like this sounds like a perfect
partnership.
I agree.
And I think that would be a huge
tool to even the manufacturers because you
got to look at it from their perspective
too, right?
What are they trying to solve?
Because you have the entire spectrum in
AV.
We have people who just want the box
and they don't care about any security all
the way up to government deployments that
are ultimately there.
Yeah.
So it's that entire spectrum.
So
Our hope with AV Trust is that it
becomes that information is crowdsourced
and crowd driven and the community is able
to push the industry forward together in
saying, hey, this is what we need.
And then once that baseline is set,
I think it makes it easy on everyone.
You know, there's no animosity here.
The goal is to make sure that everybody
plays to the same, you know,
tunes and everybody's talking well and
communicating.
And eventually we have a more secure AV
industry,
which is what we need before we have,
we end up in the news as some
box that caused the entire thing to crash.
That's not an if, that's a when, right?
I'll tell you, I was a little terrified.
Like this excites me because I was a
little terrified earlier when you were
like,
nobody puts their stuff in a stack and
just runs a security system.
audit on it i'm like oh god don't
don't just know that i don't want to
know it's that ignorance is bliss right
yep but i do need to know and
and some of the reason is that i
can see why integrators and some
manufacturers are like well that just
that's that's a bottom dollar thing at
that point where to everybody's point like
in higher ed we're like well we can
run these tests all day long and we
all have these enterprise systems and and
we're not making money on these most of
the time
So I've always said that higher ed will
definitely lead the AV industry in setting
the security standards.
It's been my belief because they're
uniquely positioned, they're enterprise,
yet they also have resources and the need,
frankly, to secure some of these things.
I'm going to say something controversial.
Do it.
This is not the show for this, Colin.
I think also higher ed leads the industry
in putting AV devices on public IP
addresses.
Yeah, let's do it.
There is some absolutely incredible stuff
that happens.
Yeah,
like throwing everything in the DMZ
because, well, it's just easier.
I'm not like, again,
this is not what we're trying to do
with AV Trust.
It's like, call people out.
That's too easy.
The better thing is to be like,
I'm going to do education that may happen
to mention your specific situation.
And then when I check back with you
in a year,
you better not see this thing still
happening.
And that's the kind of stuff I'd like
to see.
I'm curious, like as a goal,
do you see yourself as like a scoring
and grading service?
You know,
that's something that we've had some
discussion about.
Like one of the things I've been trying
to work with is trying to find good
vendors that we can vet
and actually offer services to to be like,
Hey,
here's like if you want to do security
training for your, you know,
for your staff,
here's a product we recommend.
Go use, you know,
you use discount code AV Trust and we
get a little, you know,
a little money for us and you get
a product that we've added because I think
what's what's happening,
what will happen with this because this is
this has been a discussion with like
managed services
where you get to the stage like, okay,
pick a ticketing platform and they go,
and you start looking and you look at
the quadrant and you see six thousand
logos and then you go,
I'll do this some other time.
And then you just leave and you never
come back.
And I want people to be able to
say, okay,
if this is a concern of yours, here's,
here's something to buy.
And because to a certain extent,
it's like,
if you're not an expert in it,
someone's got to just say, do this,
just do this, be good.
And I, and I do agree.
Like,
I think that scoring is a potential piece
of it.
I think that one of the things I'm
trying to find right now is a trusted
partner to do vulnerability testing and,
on hardware so that if you, a customer,
want to test gear, we can say, okay,
this is someone we trust that has good
output.
They have expertise in this area.
They're good to go.
Or if you're a manufacturer that says,
hey, I want to take this more seriously.
Who can I ship some boxes to to
actually hammer on this stuff and scan it
and try to break it and then come
back to me?
And that is something that we would like
to do just as a...
as a point of service for the industry,
because it'll be easier if we do all
the legwork and just go, hey,
this person is trusted.
Go for it.
You know,
and that's that's what we're trying to get
to.
You're going to come in, right?
You're going to build these types of
things pretty quick to actually leverage
that and start that kind of service.
Have you thought about partnering with a
higher ed institution about doing security
audits through the whole campus?
That would be...
Or just sitting in the parking lot of
one of them and doing... Yeah,
you don't have to...
Scattering USB drives and seeing that.
I mean, you all know this,
but a lot of IT companies...
You could probably just show up and be
like, oh,
I just did this ten minutes ago.
You might think about it.
But, I mean, that's the thing,
because I think IT companies hire,
you know, third party to, you know,
do a self-test on themselves.
Like, why wouldn't AV do the same thing?
And that could be you all, too,
just to get some extra money.
Just a ransom attack without the actual...
Potentially.
I mean, I think, I think the other,
I think the other piece is like,
you know,
if we're talking about AV as a business,
this is a huge opportunity.
Yeah, exactly.
As a, as a practice,
like there's no real,
like these are services that are valuable
and have like have real value.
They can't be afterthoughts.
Yeah,
and so I think that I think that
this is an opportunity.
It's like sure.
Well,
we'll probably look at some stuff But
honestly,
I think that some people out there as
they get going or kind of you know,
figure this out They're gonna go.
Okay.
This is this is a way to this
is a way to make money and that's
exactly if you're if you're good at it
and you hit it and
man, go develop it.
And that's a big,
I think that is a big potential to
say, okay,
when does the first firm pop up that
has a suite of security services
specifically tailored to AV?
Dedicated to AV, that's right.
Because you have to, yeah.
And you don't think we're,
we're there to partner after there's a
major vulnerability,
which takes out a huge university.
Well,
and so we're all starting to play around
with AI and Mark,
Mark and I have been doing some open
call stuff.
So daily I have a network security scan
and a vulnerability test on my home
network.
And guess what?
And I'll say the manufacturer's name
because it's not AV related really,
but I've got six or seven whaps here
at the house and,
And a specific manufacturer called
Ubiquity, for some reason,
has three of the WAPs open on Telnet,
and I can't figure out how to turn
it off yet.
And so I didn't know that because I
did my own security scan on my AV
devices, but here we are with...
Some of the access points in my house,
they're all the same model number.
Three of them run Intel net wide open.
I think that speaks to like,
we have to lower the threshold of like
interest in this and curiosity, right?
There has to be a level of folks
because we talk about InfoComm or any
other trade show you go to,
people are going to be like,
How many IO spigots does it have?
What's the latest chip that does on it?
Nobody's ever said, oh,
how's the security work?
Right.
And so I think.
Would that even be interesting on a
marketing document, though?
Try that next time you're at a trade
show.
Right.
But we as consumers,
because let's face it,
we are consuming these products.
We're not voting with our dollars
correctly.
We are not asking the questions.
Sometimes we don't have an option, Mark.
But yes, I agree with you.
But sometimes it's like,
don't look around.
We don't look.
It's just not in the lexicon.
And the sales reps are doing everything
they can to not talk about that.
Look at how many ports are on this
black box.
so frank a minute ago you mentioned would
that be interesting absolutely yes so i've
run into and mark i do vote with
my dollars in this case but it's a
very small amount of dollars so who cares
i've run into some some displays these are
large lcd panel big displays that we're
all putting all over the place that did
not support um uh modern namespace network
identification it was basically like you
could put in a
a pseudo hard-coded static IP address.
If you could wedge in a name,
it had to be within like eight characters.
It's like all these like semi-arbitrary
limitations on just how it even reports to
the network,
which didn't meet any current modern
standards of like ten, fifteen years ago.
And to the point where when I went
to buy another set of displays for another
building,
I did not buy from that brand because
I didn't want to deal with their nonsense.
And I'm currently dealing with that with
another huge, huge brand of displays.
It does projectors and displays and all
sorts of stuff that has trouble with how
their NICs report on the network.
And I don't want to deal with that.
So the next round,
I'm not buying that brand of displays.
Now,
I didn't actually light them up and tell
them that's why,
but I think that's a valid feature set
and a valid kind of, you know,
you know, customer feedback to say,
I can't use your stuff on my network
because of X, Y, and Z.
You don't meet the basic threshold.
You don't meet the modern requirements.
You don't meet whatever these,
and they're, they're so,
there's such a low bar.
It's so easy to kind of get across
these things, but you know,
it's that same challenge of like,
how do we,
how do we get that across to
manufacturers?
And so I love that you guys are
putting this together as a potential
content to do that.
And also to Mark's point,
maybe this helps us start to square that
circle of,
Most AV devices, now,
even if everything moves to the cloud,
we're still going to have endpoints that
are a display or speakers or whatever that
is,
something that has to be in the physical
space.
I'm going to purchase that once.
That is going to be good for ten,
twelve, fifteen years.
I'm not going to think about it again,
which means that thing never gets updated.
It never gets refreshed.
There's no firmware revs to it because
it's, let's be honest, it's a dumb device.
device a dumb endpoint that doesn't need
you know we talked about earlier those
security features transducer with no no
logic well the security may come with
feature updates but that you know a giant
lcd panel is not going to get a
feature update hopefully or older
equipment that like we're still rocking
mps-one-hundreds on our campus on right
that's my point because that's lower
restaurant patched by mps-one-hundred
So what's our conduit to the industry to
say,
you need to be more up to speed
with this.
We are interested in this,
but you also have to go back to
your monstrous back catalog of those four
other companies you purchased over the
last ten years and either fix that stuff
or give us some way to go in
and disable things,
or I'm taking it off the network and
I'm building an island because that's the
only way it'll work.
Yeah,
and I think that's why the information is
one of the most important parts of this,
because it's not going to be affordable
for everybody to just go throw away
everything they bought and buy something
else.
So at minimum,
we need to be able to say like,
all right, well,
we know that this one is not great,
but we know what it is doing and
what it's not doing,
and we can kind of respond appropriately.
If it needs to be on its own
segment, cool,
we can make the changes we need to
make, right?
But that's not information that we've
historically had publicly available.
And that's why I think the information and
the communication part is is also the most
important part of this for the short term,
especially because then that's going to be
what allows people to actually plan their
hardware strategy around that for long
term stuff.
And I, for one, you know,
I really like that the information part in
the in the bringing it all together is
there because it is an intimidating thing
to people who aren't used to it.
So I personally,
it's like it seems big and scary.
And I keep putting off learning more about
it.
But if you can give me a baby's
first step,
or these are what to look for,
then all of a sudden,
it's not a scary conversation.
It is not a,
how did I learn that this was insecure?
Well,
somebody else told me I couldn't have it
anymore.
You know, usually my CISO.
But...
I like this.
I like that you guys are trying to
go to baby's first step and take it
to a higher level and be that
intermediary.
I'm kind of excited for this.
I hope you guys,
they're all listening to the show,
our twenty thousand listeners.
Twenty two thousand six hundred and
fourteen.
And they all call you.
We get some real good experts and they're
throwing cash at you.
I really hope that this goes because I'm
looking forward to somebody being kind of
that centralized force.
to bring us all together and start having
that conversation without boxing gloves.
You're not going to have to commit to
this,
but I would really love a cheat sheet
preamble.com.
Oh, asking for a friend, just stay.
I will give you all of Chris's time
to put that together.
Go ahead.
If you guys can focus on two things,
yeah, the cheat sheet,
the common dictionary,
know these terms and what they mean so
you can start speaking the language and
build from there.
Colin, like you said, there's some early,
there's a lot of certs out there and
things you can kind of build towards,
but that first step.
The other thing is,
I think if you guys build this common
framework for like communicating security
issues, both directions,
like from manufacturers down to end users,
because God knows some of them are,
terrible at it and others just don't do
it um and then also the same direction
hey we're seeing this weird kind of thing
on our network how do we get in
touch with the right people at some of
these manufacturers and other
organizations and whatnot to to kind of
start community so like some sort of
framework to go both directions on like
centralizing and communicating some of
this stuff uh in that kind of like
you said kind of like we're gonna legally
like protect you pull you back one step
so you're removed slightly from that
you're not going to get hammered about it
but at the same time this is important
stuff to be able to communicate if you
can do those two things i think you
guys are going to be in a great
great great place because it puts us in
a good spot for conversation and that's
where we want to be yeah and if
you haven't looked at look at the educause
heck that as a potential model because it
is a very wide range if you haven't
looked at that it's free if not i'll
dig all universities should at least have
awareness of the heck that
Well,
somebody on each university campus has
awareness of it,
probably not the right person,
but it's a comprehensive kind of like
vendor evaluation thing for how you do
updates, how you do security,
how you maintain your security posture on
things, how you maintain your software,
all sorts of stuff.
It's very wide ranging,
but it's a framework you could use as
a model to kind of like, I mean,
it's very comprehensive,
but you could use it as like,
how do we even just communicate some of
this stuff?
Yeah.
a good starting point yeah i think it's
a fantastic starting point look at that
steal from the best keep doing all those
things they spend all the time on it
why not just take that so um no
and i agree and i think that's that's
an important thing to realize that this is
already a mature practice for a lot of
people and i don't want us to come
in like
I feel like the old way of doing
things would have been like, okay,
in order to be more secure,
we're going to create a new proprietary
network port.
We need a new standard.
We have a new connector.
You'll know that if you plug into it
and you have to get a special switch,
which some manufacturers would love.
Yeah.
It's like, we can't,
we can't keep doing this.
Like we have this stuff in place and
it also, like, I think it'll,
I think it'll sort of clear a lot
of the, um,
How do I say this?
It'll clear up a lot of the...
opacity we have right now with hardware
specifically,
because I struggle to have those
conversations because there are companies
that are manufacturers that do not have a
factory.
They're a marketing company that will mail
you a box.
And that is something that I don't
particularly care for.
And I think that a lot of customers
don't know any better because the
branding's really nice and it comes in a
good box and everything's logoed and it's
good to go.
But I think that there's an obscurity
there.
And the people that are doing their own
work,
like I don't think it's necessarily bad to
OEM something,
but you have to do it in a
way that inspires some trust,
not that feels like you're trying to
obscure where it's going.
Like that's always the game.
Like every time a new product comes out,
you run over to alibaba and you see
uh which picture matches it and what their
unit cost is there you go oh cool
neat yeah that new phone found it i
could make one too i guess um why
not and that's not it's not all gear
but there's a lot of it every every
rack has
those little doodads and widgets and
things in there.
And like some of them,
I guess it doesn't matter.
Like some of them,
it does not matter because if it's just,
you know,
point A to point B transmitting HDMI,
I don't care.
And I think that there has to be
something to say.
It's like,
I agree that it's nice to know what's
going on with stuff,
but some stuff just doesn't need to be
on the network.
Like a TV, I don't know.
If I can tell whether it's drawing enough
power to keep that little LED light on
that says, you know, red or green,
I can probably tell if it's alive.
And that's all I need.
Because anything else that's wrong with it
is going to be something I cannot detect
remotely.
If someone punched a hole in it,
or there's a big red line running up
and down it,
No amount of remote monitoring tells me
that.
And so is it really worth it to
have that device on the network for
minimal benefits?
I have a massive amount of risk for
almost no return because I'm not updating
the firmware on it.
I'm not patching it.
I'm not pulling logs.
And all I'm doing is putting a device
on there that could end up part of
a bot network or something like that.
Everything should be serial controlled.
Yes.
Honestly, that's the network-based,
the IP-based RS-DU-DU controllers.
There is something to say for, okay,
if I have a bunch of unsecured devices,
the easiest way to secure them is to
have a device I know I can secure.
I can have a jump box with two
NIC cards on it.
Okay,
I only have to worry about that one
thing, and if something goes sideways,
I can pull the plug on it,
and it doesn't really matter what's
downstream of it because they're going to
be having their own issues,
and we can segregate it.
Is that the best idea?
Probably not, but that's how IoT is.
I mean, that's how IoT is dealt with.
There's devices that are specifically for
that that have a bunch of, like,
a billion USB ports because they're there
to keep track of a bunch of IoT
devices, and they don't want...
They don't want those devices actually on
a production network.
They don't want it on Wi-Fi.
That's why a lot of IoT devices,
like you throw a SIM card in and
it's like, great, it can get to something,
but it's not getting to my network.
So who cares?
Who cares about T-Mobile?
You know what?
That's their problem.
If they get taken down by my errant
air sensor, that's their problem.
Humidity is just right,
but T-Mobile went down.
Yeah.
Well,
I think this has been a fantastic
conversation.
We'll have to have you guys back because,
you know, let's check in six months.
And I think Mark gave us a good,
and I hope you have plans for it,
a good kind of benchmark.
It's like, what do you got at Infocom?
Because there's got to be something big.
You got, what, ninety days or so.
I'm sure you have some plans and things.
We'll have a new website, Colin.
A new one.
Come on.
You come up with little stickers you go
around and put on products.
Say, this thing sucks on your network.
Please don't.
We'll do it for you.
We love doing that kind of stuff.
A.V.
Trust acknowledged.
This is going to be a problem.
A.V.
Trust, just to get on there.
We have to get the word out somewhere.
And there's a lot of stuff that just
gets unpacked.
Firmware never gets touched.
It never gets configured.
It just gets plugged into the network.
People walk away.
So there's all sorts of problems.
So to that end,
people want to get involved.
People want to find out what's going on.
Where are we going?
Where are we sending them?
What are we doing?
Where are we looking for all that stuff?
AVTrust.org.
There is the link to the Discord on
there.
Link to our LinkedIn if you're a big
LinkedIn user.
Or, I mean, you have our names.
We're all online.
Come and find us.
Yeah, reach out.
Yeah, you can get up through LinkedIn,
through the website, through Discord.
We're all on there.
Yeah, definitely.
We're starting to form councils,
so if you have interest in creating
education, reviewing standards,
putting out information, great.
We joke,
but I would love someone who knows more
about making a website,
because if we're gonna have a lot more
content going out,
I can't spend twenty hours putting one
page up on a WordPress site.
You're gonna get spammed by every
contractor out there that has a Wix
account.
Everybody who's got their Clawbot running
is gonna be like, oh,
I can do that for you.
Doug and Frank, last words.
Any last things we didn't cover or didn't
mention you want to throw out there?
No, I mean, thanks for having us.
This was great.
I'm really excited about this.
It's nice to hear other people feel the
same.
You know, next up for us is definitely,
you know,
the documentation stuff you guys asked for
is already absolutely on our list anyway.
Specific feedback about stuff that you
guys would like to see in the lexicon
or other stuff,
we will take that feedback in any way
that you are willing to give it.
Because, you know,
we want it to be a community-guided thing.
We want the stuff to actually feel useful
to people,
and that helps get that real-time
feedback.
And, you know,
we're working with vendors and stuff like
that right now, actually,
having some early conversations about,
you know,
what would shared training materials look
like, what would, you know,
making sure that we have some kind of
consistent modus operandi sound like for
reporting things.
So more announcements to come from our
side on that as well.
Again, thank you for having us.
This has been great.
It's a fantastic conversation.
I think the conclusion is we understand
that AV is not so unique in that
we're just part of the network,
but we're also unique enough where there's
some nuances to the way we operate things.
Hopefully,
AV Trust can come in and bridge some
of that through education and training.
community participation we just want to
make security friendly uh security doesn't
have to be that taboo topic that we
avoid because you can't avoid it anymore
and hopefully more people talk about it
and you know there's a lot of like
we that we started this off on a
very nice note but with the with the
education platforms and how people are
talking about cyber security education
there's an opportunity in av there's like
thousands of boxes there's thousands of
networks
We could spur new businesses.
We could spur new job opportunities,
things that are absolutely necessary.
You know,
hopefully we can be the center point of
education or just the gateway to make
security friendly for AV people and AV
friendly for security people.
And hopefully this all becomes,
we'll all have our kumbaya moment,
you know?
Tons of opportunity.
Love it.
Indeed.
Yep.
So looking for that first huge
vulnerability.
It's out there.
Probably people will know about it, too.
All right.
Well, we're going to wrap this up,
and we'll see what the future brings and
what you guys have for us at Infocomm.
And hopefully,
I like those little stickers that says
this thing's terrible on your network.
Those just floating around.
If we don't make them, I will,
and we'll go put them out there.
We won't do the security scans.
Anyway, so thanks again to everybody.
Head over to abtrust.org,
see what's going on,
and we'll catch you guys next week with
another episode of Nonsense.
Same bat channel, same bat time.
Thank you.
Well,
we've managed to ruin yet another episode
of AV Super Friends Off the Rails.
You can contact us with questions,
topic ideas,
or general complaints at mailbag at
avsuperfriends.com.
If you complain loud enough,
we might just invite you on the show.
Nice work, everyone.
Short broadcast.
Really good.
Everyone on the floor as well.
Best sounding podcast.
The opinions expressed by the AV Super
Friends are solely those of the
individuals and do not represent their
respective institutions, organizations,
companies, or clients.
Hello.