Alexis
Hi everyone. Welcome to Data Dave Dives Deeper, your favorite companion podcast to Talk Tech with Data Dave. I am your host, Alexis, and I am here today with Data Dave.
Dave, how are you?
Data Dave
I’m very well, Alexis.
Alexis
I guess it’s morning for you still. Good morning.
Data Dave
No, it is still morning. Yes, it is still morning. Only just. It’s 11 o’clock. So, there we go.
We’re here today with a guest, Taylor Hersom, who is the founder of Eden Data, working in security and some other things. So good morning, Taylor. Welcome to Data Dave Dives Deeper with Alexis and I.
Taylor Hersom
Dave and Alexis, thanks so much for having me. I appreciate it very much. Thanks to the viewers that are listening to the show. Forgive my sweater, it’s cold here in Austin. We were just talking about that. I know it’s probably not as cold as the other places, but to us, we are wimps.
Alexis
I was just about to say you’re in Austin too. That’s where Dave is. Our listeners, I think know that that’s where D3Clarity is headquartered. That’s really awesome.
Taylor Hersom
I feel like everyone’s coming here. This is the tech hub. You chose it, right, Dave.
Data Dave
Yeah, it’s starting to become so.
Alexis
Well, we love to start these Data Dave Dives Deeper episodes with a simple question, and it’s the question about you, Taylor. Can you tell us your story? How did you get into this industry? How did you get into this world? Tell us about Eden Data. Tell us about how you got here.
Taylor Hersom
Of course, yes. So, I am just a total cybersecurity nerd. I have been since college. I had a failed attempt at wanting to be a chef and then a physical therapist and then…
Alexis
Me too!
Taylor Hersom
I love it. I love it; if you have a passion like that. I respect the chefs out there, but I didn’t want to turn that passion into a profession.
So, I actually got exposed to the world of Big Four consulting as the first job in my career. I was recruited by Deloitte and went to Portland, Oregon and was working as an IT auditor. So, essentially it was my job to come in and audit financial systems related to how people get access to them, how money moves, all that fun stuff. I was working with life sciences and healthcare companies, mostly Fortune 500. Huge, huge companies.
So, one thing I figured out very quickly is… nobody likes an auditor. No offense to the auditors out there, but I felt like I was on the wrong side of the table. I got early exposure to some cybersecurity projects at Deloitte and that’s really what sparked my interest and allowed me to pursue a career.
For the five years that I was there, I got to work on being an auditor. Seeing that side of the world and then also being a cybersecurity professional. It actually helped me a ton. Fast forward to Eden, which I can talk about in a bit, simply because a lot of cybersecurity development is around compliance and around compliance programs and passing audits and all that stuff. I then got the opportunity to be a Chief Security Officer for a consulting firm in Austin. And then I ended up quitting my job thinking, “Oh, I have all these interviews, I’m going to go find a new job.” I wasn’t enjoying what I was doing.
That was the week before COVID hit and everything dried up. I had just proposed to my now wife, we had just bought a house, we had just bought a new vehicle, all these big life moves, and I was unemployed.
So I, out of necessity, had started to just ponder, “What could I do?” And I came across- on Upwork of all things- there were a variety of companies that were posting on there and saying, “I need help with cybersecurity.” And that gave me the data on the fact that there are a lot of startups and a lot of small businesses out there that need help with cybersecurity. They don’t have anything in place. They’re having to meet expectations of their customers and their prospects and they need fractional help.
And so Upwork kind of took off. I kind of gamified that system to where I fought for five-star reviews in exchange for cheaper services. And then when you get to a certain level on there, then everything, all the doors start opening. I got to take off on Upwork first, and then started Eden Data in 2021.
Listeners don’t even know what Eden Data is yet, but Eden Data is essentially a cybersecurity firm. We focus on being the outsourced security, compliance, and privacy teams for everything from startups to scale-ups to enterprises. And so, we take over on anything from meeting a compliance standard to helping secure their customer’s data, to helping them align with data privacy requirements in other countries, and everything in between. That’s what I do in a nutshell. I love every second of it. We’ve been at it for four years now. Eden Data has almost 70 people on the team. We have customers all over the world and I love nerding out on just about any compliance or cybersecurity framework out there.
Data Dave
What made you think cybersecurity was cool? Right? You said you liked cybersecurity. What about cybersecurity said to you, “I want to be here.”
Taylor Hersom
Well, besides the fact that I got the exposure to being an auditor and realizing, “Oh my gosh, I would rather help than be the… almost like the hall monitor, the tattletail, that was one aspect of it. But the other element for cybersecurity, it was two main things. One, when I got exposure early on, it was very fascinating because I’ve always loved technology. And so being able to figure out, “How do I secure technology,” just seemed like a fun challenge that I resonated with. And then secondly, I had multiple instances within my family and friend group of being impacted negatively by cyber-attacks and by hacks and data compromises, all of that.
Back in college, my grandmother got a call thinking it was from me that I had got arrested in another state, and she sent $8,000 in cash to some random location. Classic phishing attempt over the phone. Now that’s, oh my gosh, it’s gotten so bad because of AI, but even back then it worked. Thankfully, we were able to recover the funds. But that was an eye-opening experience for me of just how we’ve been very laggard, especially in the US, and how we protect our data and how we protect ourselves against malicious intent. And that was something that I kind of felt like there was a calling, for lack of a better term, when I got exposure to it.
Data Dave
How do you think your experiences as a chef helped you?
Taylor Hersom
Oh, that is such a great question. A few ways actually. I think that one of them is as a chef you are constantly strategizing, so you are figuring out what you’re going to make, what recipe you’re going to [use]. Are you going to follow a recipe? You’re going to make it up as you go along? What ingredients, where are you sourcing those ingredients, all of that? That principle applies perfectly to security.
I may have to run with that, Dave. We may have to just like completely change our topic, but that principle and security remains consistent because you’re essentially planning out an entire security program around how are you protecting every asset in a company’s environment? And then also what tools are you using? What personnel are you using? What standards are you aligning with? Are you aligning with the standard? Are you making up your own security program, everything in between?
So I would say that’s one of the biggest elements. And then there’s a creativity aspect too with cooking in general. Being creative and feeling like you have the wherewithal to make adjustments on the fly, that’s cybersecurity in a nutshell. Everybody thinks we have it all figured out, but we don’t. The industry is very new. The industry is currently developing rapidly, and so being able to pivot on the fly is something that you absolutely have to have.
Alexis
Yeah, I don’t know about you, Taylor, but I learned how to project manage in culinary school. Any project management skills that I carry right now, I will tell anybody and everybody I learned in culinary school. Because that’s what we had to do. Like, we just had to learn to get something done from point A to point B and do it fast and well and the way we were supposed to, and then at the end of the day, we had to problem solve, just like you said. So, I totally agree with you.
Data Dave
Running a commercial kitchen is an exercise in project management, really, because every evening, every dinner service is a project, and you are planning out a menu, you are planning out your resources, you are planning out your ingredients, and then you are putting it together to a schedule. And people are very intolerant of things being late. So, actually, a great microcosm of that kind of construct.
Taylor Hersom
Very well said. Yes, yes. That’s an incredible analogy. Like, such a great comparison.
Data Dave
One of the things we love to do on this podcast on this show is explore things like that just a little bit, because we always think technology and cybersecurity and data management and all these things are microcosms in and of themselves. And what we find more and more is that people’s life skills are way more valuable than necessarily the technical skills. The ability to see through a project, see through a delivery, see through a scam, see through privacy, et cetera, is way more important than being able to write this code or that code or configure one of these or one of those. It’s the life skill that is incredibly important in this space.
Taylor Hersom
Could not agree more. Very well said.
Data Dave
So that’s why I wanted to drill down into that. And we’ve had pilots, we’ve had musicians, we’ve had all kinds of people.
Alexis
Biologists.
Yeah, people who started in areas that you would never start with thinking they were data people or they were tech people. And then all of a sudden they’re like, “Oh, yeah, this is my life now. This is how I got here.”
Data Dave
And this is how I got to this point.
Alexis
It’s kind of kind of amazing.
Data Dave
This is why I love it. And this is how it joins together, because it does all join together. Because this is all part and parcel in life and in the way that we operate, not only as professionals and as organizations, but also as individuals. And people forget that that weaves together more than people think it does. Because every time you, as a person, go into a store, you, as a person, gets pulled over by a speeding or whatever it is, that is your data being exposed out into the world and being operated on by organizations that you are in some way trusting to protect it. You agree?
Taylor Hersom
Yes. And frankly, it’s become a misconception in society. I think we have almost shied away from even understanding the fundamentals of the implications of this rise in data and such. But, man, I just love the analogies that y’all made.
Because a lot of times in cybersecurity, we have a lot of people that want to get in the industry and they think, “Oh my gosh, I have to have some technical background or I have to have some technical degree.” And in reality, especially in the day and age of where the Internet is at today, like the skill sets that we’ve developed. When I started Eden Data, I had built up some loose principles, but what I did then versus what I do now is completely different. And so a lot of that stuff was self-taught on the Internet. And that’s what I love about the cybersecurity industry specifically, is people can get in by simply getting online certifications, by watching YouTube videos, by just having the passion. And that’s universal. Yeah.
Data Dave
So one of the things we talk about quite a lot, and certainly I speak on quite a lot, is the idea that data actually does describe real-life things. It describes people, it describes computers, it describes vehicles, it describes real-life things. And you have to get back to the real-life thing because the data is a pointer to that thing. And if the data is secure, then the thing is secure. If the data is not secure, then the thing is not secure. And that goes with people. It goes for all these things across the board.
It’s interesting to see how we’re evolving in this space and how data means more and more to us in our daily lives, because we do trust people with our data. We give people our data all the time. And it’s not only from a business perspective saying, “I want to pass an audit,” which is a valid construct. “I want to pass an audit because I’m going to be audited. And I need to make sure that I am following appropriate restrictions, that the data that I am a custodian of for my business is actually treated as per the legislation.” But is that really enough?
Is the legislation really just the tip of the iceberg? And what we should be looking at is well-managed businesses, well-managed data, and a construct that says we should be going way beyond what the regulations say and looking at, “How do I make sure that I am an appropriate custodian for this valuable asset that I’m being given by people?”
Taylor Hersom
Very well said. The regulations themselves are meant to be a starting point, and a lot of them still don’t even exist. Look at the US for example. We don’t have federal data privacy laws. We have state level. But they are meant to start enforcing and getting people to accept the fact that data security is important. But in reality, we’re quite laggard. And regulation in terms of what it enforces and who it enforces for that has put us in quite a pickle because of what you just said, Dave, where we’ve been giving up our data for years, but now we’re on the spectrum of what is appropriate versus what is not. When we have this rise in AI, it’s impossible to get on the Internet and buy a product or get on a website or participate in a service without giving up some kind of data at this point. And so it’s like at this point we have to understand what we are drawing the line on, both personally and professionally, as companies and as individuals. And those are sometimes in unison, sometimes two very different things.
Data Dave
So, let’s peel it back a little further. You said it’s impossible to get on the Internet. It’s impossible to buy something on the Internet. I’ll go further than that. I pretty much think it’s impossible for me to leave my front door without me giving up some of my data.
Taylor Hersom
That’s eerily accurate.
Data Dave
Yes. Because as soon as I leave my front door, my Ring camera goes off and notices the fact that I’ve just walked out of my front door. So, that image has now gone to Ring. So, they know that I’ve left my house.
If I get in the car, I’m going to buy gas at some point. I put new tires on my truck the other day. All these things is a digital footprint.
Taylor Hersom
Right.
Alexis
And this argument Dave, though is like moot because we’re not even talking about cell phones at this point. You’ve given away your privacy the moment you woke up and turned on your cell phone. I don’t want to say you’ve given away your privacy, but you’ve created data by turning on your cell phone.
Data Dave
Exactly. But I was going in, I was trying to go further. I was saying we don’t have to interact with a piece of technology. We could go back to the technology of 20 years ago when we weren’t all carrying cell phones, but we are buying gasoline to put in our cars, we are buying clothes at the store down the road, we’re buying groceries. We were members of different purchasing clubs in grocery stores and different things. And this is all collecting data.
So, even when we’re not interacting with a piece of technology. Yes, everybody expects- pick up a cell phone, you are going online, you’re creating that digital wake, if you like that digital footprint. But it’s bigger than that. It’s actually everything we do. I think the only thing I can do that doesn’t create a digital footprint is take the dog for a walk.
Taylor Hersom
Yeah. Without your phone.
Alexis
And leave out your back door.
Data Dave
Without my phone, out my back door.
Alexis
If it doesn’t have a camera on the back door.
Taylor Hersom
It’s truly unreal where we’ve gotten to, and we talk about these. For example, the regulations on things that you can and can’t do with data. You get on websites, and you can technically consent or not consent in sharing data. But there are flaws in that model for a couple different reasons. One is right now, we don’t have enough enforcement for the businesses that are not doing that. And so what are the repercussions? The regulators are going after the biggest companies in the world, not the random one-off websites that are ecommerce platforms or something similar that don’t have any way to turn off data collection.
You also have the issue of, I think we’ve all experienced this. You talk about Mittens with someone and suddenly your Instagram or your Facebook or something is advertising Mittens to you. That is incredibly invasive. There’s no real enforcement. There’s not even the ability to turn that off on your phone. Like that’s just crazy to me.
Data Dave
So, from the cybersecurity world, whose responsibility is it to protect this?
Taylor Hersom
Oh my goodness. I will potentially cause strife between parties that believe different things. But in my mind, at the end of the day, it is ultimately going to be our responsibility. It’s something- that while data can’t be held- it is something that we own on ourselves. It is something that is in our big, beautiful brains that we can choose to disclose or not disclose. However, you now have yourself sharing your family members, sharing your friends, sharing the services that you use, sharing with other services. You got third party, fourth party, fifth party involvement. So, the world has just become a more connected place and it makes it harder and harder to enforce.
So, I treat this the same way I would when protecting a business asset. You’re building a data privacy program for yourself to limit the risks that you care about. And there are ways to do that, There are ways to mitigate. You usually can’t remove a risk entirely, but you can focus on the things that are substantially risky to you and ignore the things that are not.
Data Dave
I’m going to drill down just a little bit on that. You said it’s “our responsibility”.
Taylor Hersom
Yes, yes.
Data Dave
So who is “us”? Who is “our”.
Taylor Hersom
Oh, great clarification.
So, I actually mean that as a two-pronged answer. One is me, myself, caring about my own data and protecting myself. But then it’s also the folks that are indirectly or directly interacting with data. All of us have a responsibility to understand the value of data and the value of our own data and others. And so if you’re in a business setting to where you’re interacting with data, having the wherewithal to understand what is important and what is not, it’s a collective mindset is basically what I’m implying. Having a basic understanding of why we are having this conversation in the first place and why data is important, and then using that in your judgment and how you interact with data in the world. That is what I was referring to.
Data Dave
And I think I agree with you. So, what you’re saying there is that we, as individuals, as participants with whatever role we are playing in our lives at any point in time, need to be responsible to the data that we are giving and responsible to the data that we are using in a morally defensible manner. Let’s put it that way.
Alexis
I’m going to ask you both a very loaded question, and I’m going to carry the right to cut the answers out of the podcast if you guys want me to.
If you had to give our listeners one piece of advice, to what Taylor just said, “it is my responsibility as me to protect the data about me, to protect my privacy”. What’s one piece of advice that you would give our listeners? The one action that they can take to help themselves? To take that step, to protect themselves, to be mindful of what data they’re creating, of the privacy that they’re giving away. But I’d love to hear an answer from each of you on that one.
Taylor Hersom
Dave, you want to go first?
Data Dave
Okay. I’m going to be a little bit profound.
Alexis
That’s something we do on this podcast pretty much all the time.
Data Dave
I’m going to be a little bit profound on this one. I’m going to say, “Do to others as you would have done to yourself.”
Taylor Hersom
I like that.
Data Dave
And do to yourself as you would have others do. etc. Right? So, the reflection as well.
And my point here is, be responsible and be responsible and think. We’ve got this habit as people of thinking, “I have a different role. I’m a different person when I’m in my business to who I am as an individual.”
So, what I should be thinking about isn’t just how do I give my data and how I minimize my data, but I should also be flipping myself around and saying, “I should be treating the data that I am a custodian of in my business in the manner that I want my data to be treated.” And I think we all need to look at that with introspection across the entire band of society and start to think about… What should the statute of limitations on this data be? Has the data expired? If somebody pulled data from my 20 years of history or 30, 40 years of history and used it, would I be happy about that? If I wouldn’t be happy about it, then I should be treating other people’s data with the same statute of limitations and the same consideration.
Taylor Hersom
I like that a lot. There’s a tie to how you treat someone’s physical possession or property, and it’s very similar mindset. I like that a lot.
So, my answer would tie to that, Dave. And Alexis, I feel like on my end, all I’m asking for from folks that could be changed right now is a shift in mindset. Because if you think about it, a lot of people just don’t understand data privacy. They don’t understand that this is important. By simply shifting how we are looking at data and how we understand what it is and why it’s important, that allows us to make better decisions in our lives.
It’s very similar to, you go and you pick out that beautiful fiery red Camaro and you take it off the lot, and from then on, all you see is red cars, right? Your mindset has shifted. You are seeing red cars everywhere. You are seeing other fiery red Camaros. Your mindset has shifted. That’s all that’s happened. And you now have a little bit of a different perspective of the world.
And that is exactly what we as cybersecurity professionals are asking for. Because that will go a long way in how you look at something and how you make a decision about it. And it applies to this just as it applies to many other principles in life.
Alexis
So, just as easy as the idea of… in my life, it was when I started this podcast, started to learn more about my data, and I got those notifications when I got a new app that said, “Do you agree to our privacy policy?” The first thing I did was go look at the privacy policy before I said yes to it. And that was something that I started doing because I started talking to Dave about these topics.
So, it shifted my mindset. And so, your hope is that people will start to be aware so that they will start to realize things like that. Is that what you’re saying?
Taylor Hersom
Yeah. Very well said.
And to take that example, even going one layer above, which is simply looking at these services that are so readily available to us and understanding if we actually need them. Like, we got in this mindset as a society that we could download any app off the App Store and share our data, and that has become rampant.
I don’t know if y’all saw all the stuff coming out with deepseek specifically, but the competitor firm from China that has come out with LLM and services around that it was one of the top downloaded apps on the App Store, and they did a security review on it, an independent research firm, and they saw that all the data was unencrypted, the encryption keys were static, that the data was funneling to multiple companies in China. And lastly, that they are also funneling things to TikTok’s parent company, which is then a segue to all the issues we’ve been having with TikTok. At the end of the day, what is the average person using deepseek for or OpenAI for? Like, some of us use it in our workplace settings. A lot of people just want to see the technology for the first time.
I’m asking that people shift their mindset to say, “Do I really need this app that tells me when the water in my refrigerator is low, or that I need to water my plants?” Things like that. That’s also a way that we can significantly improve and make a decision before we ever get to that privacy policy, for example.
Data Dave
Yes. Just tying it back in. We’ve talked about technology, we’ve talked about cybersecurity, but we started the session with a discussion on life skills. And I think we’ve come back to exactly those life skills and people acting in a responsible manner, using their entire life skills to essentially protect and manage what is becoming an increasing part of our personality, which is our data that describes us.
Taylor Hersom
Absolutely. Absolutely. Yeah. What a great conclusion. You summed it up very well.
Alexis
Agreed. Well, Taylor, thank you so much for being with us today. This has been a great podcast. Dave, as always, I appreciate you being here with me today. This has been great. I love this.
Data Dave
Thank you, Alexis. Thank you, Taylor.
Taylor Hersom
I can’t thank you all enough for the opportunity. Thank you for nerding out with me on cybersecurity and cooking and everything else in between.
Alexis
Yes, very much so. Well, to our listeners out there, before we go, two final things. First of all, always feel free to submit questions to Data Dave by emailing us. Or you can reach out to us on the D3Clarity website or by connecting with Dave or I on LinkedIn. And then if you’re interested in joining us for one of these Data Dave Dives Deeper episodes, you can also reach out to us at talktech@d3clarity.com.
Again, Dave, Taylor, it’s been a pleasure. Thanks again.
Data Dave
Thank you.
