Episode 10 - From Lab Research to Founder: Grit and The Leap into Cybersecurity

Welcome to Corelight Defenders. I'm Richard Bejtlich, strategist and author in residence at Corelight. In each episode, we explore insights from the front lines of NDR, network detection and response. Today, I'm speaking with Greg Bell, co-founder and chief strategy officer at Corelight. Welcome, Greg.

Thank you, Richard. It's a pleasure to be here. I gotta do a full disclosure here. Greg is my boss, so I'm, uh, I, I, I don't fear any- anything, uh, about that relationship, but, uh, I, I figured I would let the audience know.

We're a company about full transparency, Richard, so thank you. That's a good point, actually. Yeah, that is true. We are, we are very transparent, and that's been, that's been my experience over the last, uh, many years, uh, that both of us have been here. And speaking of Corelight, I have a very simple question to, to start the, the podcast is, why Corelight? Uh, why did you co-found this company? Most of the co-founders for

Corelight were actually working for or affiliated with in some way with this amazing institution, um, in the city of Berkeley. It's on the hillside above the university. It's called Lawrence Berkeley National Lab, sometimes known as LBL, LBNL.

Berkeley Lab is the favorite branding these days, and it is an amazing basic sciences facility dedicated to large-scale team science. Um, and that means experiments that small groups of scientists can't conduct in their laboratories at universities. So really dedicated to collaboration at large scale.

It's a fascinating place with inspiring people, lots of amazing, um, scientific instruments too: electron microscopes, accelerators, supercomputers, and the infrastructure that connects them all together and makes them work, uh, as a unit. It's a place where, um, lots of discoveries have been made in the past. I, I just checked their website, and it sound-- it looks like seventeen Berkeley Lab scientists have won Nobel Prizes. So that gives you a sense of the... Yeah, it's, um, it's just a real jewel in the crown of the, of the National Lab system and, and has strong affiliations with UC Berkeley, too. Vern and Seth and Robin and I, and other early employees like Vince, I think you've already interviewed, were dedicated to advancing the missions of the lab, and in one way or another, we were all connected with open-source software that Vern had created, um, actually starting in the mid-nineties when he was a grad student at UC

Berkeley, a- and it had developed a pretty impressive community, um, lots of users. Um, the project is called Zeek Now. At the time, it had a different name, Bro, um, and it was getting just more and more popular.

W- it was-- And I think, Richard, you were probably part of that community, too, because I, I know from your books that you did training, and you wrote, and you, you grappled with earlier, more difficult-to-use versions of the software, so you saw some of that history in the making as well. Yes, very early, I used other software, and then I had a colleague or someone who had, had known of what I was doing say, "You should take a look at Bro." And I realized it was a little bit too difficult, and I think I had a guest author write some material in my first book about Bro. But then I went to one of the open training sessions, and that changed everything. I, I realized I need to use this software, and I rewrote my entire class that I was offering at that time to use what was then

Bro, and it sort of changed the way I looked at, uh, gathering certain types of data. Yeah. A lot of people have that light bulb moment when they first encounter the software because it is so- it provides such a high quality of, of data, um, that can be used for a variety of purposes, often used for defensive cybersecurity, and also a platform for building detections, observations, and really, it's a... I like to say it's a Swiss Army knife for anything that you wanna do, um, with network traffic.

So at the time we started the company, the project was already pretty mature, and it had benefited from really generous funding coming from the National Science Foundation. Hats off to them, um, for their visionary, uh, investment, and also from the Department of Energy. And I think they were, um, off of the Office of Science at the Department of Energy, and I believe there may have been smaller grants, um, from other agencies as well. But that funding really helped the project mature. It was focused in, in sort of two areas. One, a whole series of research questions that the developers of, uh, Bro, now Zeek, um, grappled with to improve the functionality and to keep modernizing the software, and then separate grants to help ensure that the community was, um, well-maintained, that there were conferences, and there were, there were... the community was engaged and fed. So what happens over time for federal research funding like this is that it, it ultimately isn't designed to be, um, everlasting. There needs to be a transition to commerciality, and, um, and as we looked as the, as the co-founders of the company, um, looked at the success of the project and, and we're foreseeing the imminent decline of federal investment, we thought, "Well, this software is really great."

Um, let's think back to the reaction you had, the aha moment that led you to really change the way you thought about cybersecurity, and there needs to be a business model, a funding model, to support ongoing development and to support, um, you know, community engagement and to help sustain the community as well. And given the... At that time, there was clear evidence that probably tens of thousands of organizations were using the software, including some of the largest government agencies, research universities, um, commercial entities. You could tell that sometimes from their job postings, even if they weren't explicit about using the software. But in many cases, um, large companies would make presentations, um, that explained how they were using Bro Zeek, or would even contribute, um, code, because it's an open-source project. So-... we thought hard and, um, we took a big leap, uh, together. And, um, there was a lot of volunteering and burning the midnight hours at first, and then eventually we were able to secure venture funding. That was a big, big step for us and enabled us to hire ourselves and some early employees, including some of the folks you've interviewed and, and some others you may in the future, too. Um, and just get started as a venture-backed company. But with that, with that early goal in mind, there were some other goals, too, but one really critical early goal is we want to hire the, the Bro Zeek developers, make sure that, um, they get paychecks so that project can survive and thrive. And that's really been a foundational goal for the company since the very beginning.

Yeah, I think that's important for listeners to, to appreciate, is that a lot of the open source software they use, and, and probably most at this point, and e- especially the core stuff like the Linux kernel or, or desktop environments or almost y- you name it, there has to be some way to compensate those developers. Um, there's very few people who can survive independently making open source software strictly by donation. The, the one that comes to mind is, uh, the gentleman who makes the Kalibrr library software. He's a single- Uh ... developer, open source, uh, software, and he, he subsides on donations, and he's been doing that now for, I don't know, almost twenty years.

That is extremely rare. Um- Yeah. Most of these large projects, and even, you know, large in this context with, with Zeek, is what we're talking probably about a dozen people. Uh- Mm-hmm. Almost all of them are, are paid Corelight employees, because that's the only way we can, uh, support that project. Right. That's exactly right. I, I think, you know, there's a range of open source business models, but in almost every case, there is a company or a collection of companies, um, who dedicate some portion of their investments in R&D to just making sure that the open source software is properly maintained, that it has a good roadmap, that it's getting input from the community. Um, especially- this is especially true in mission-critical software projects. There may be some exceptions here and there, um, but generally, there has to be a company that's succeeding in order for the project to succeed, and then there's a virtuous cycle. Um, so the success of the project, um, and the, and, and the company mutually, um, sustain each other. And that's really the cycle that we're looking to create, and we, we've been able to create since, since the beginning, and

I... You know, I'm proud of that. Now, there's still further whys lurking behind that. You sort of asked the why of the company. O- one why is, um, to, to be a business model for the project, but you might ask, what's the why of the project? Like, why does it matter? Um, why, why are people motivated to voi- to join Corelight? And that's a kind of a, a deeper question. Uh, but I, I think one way to look at that is that the company is aiming to democratize an architecture, an approach to security, that we saw evolving, um, in really similar ways when we first got started ten years ago or so at universities, national labs, and large companies. And we wanted to take what was a pretty difficult formula to master and deploy and make it a lot simpler to, to make it as turnkey as possible for smaller organizations that didn't have massive staff of ex-physicist PhDs working in cybersecurity, um, eh, to deploy quickly, and so that those teams could ba- gain the benefit of what Zeek had to offer. So we're, we're still on that journey, you know, making, um, Zeek and the other technologies that we also commercialize, Suricata, YARA, and others, in addition to our proprietary, um, IP, and there's plenty of that in the Corelight product offerings now. But as simple to deploy as possible so that the impact can be as broad as possible. You can start strictly in an open source situation, alone with Zeek if you wanted to, or you could use a distro that packages it or something like that, and you can get something going. You can see traffic, you can write logs, you can do something useful with them. Yeah, that's a very important point, Richard. It's not just that we're democratizing an architecture for organizations, but we're making open source security software, and open source software generally has this powerful secondary impact. And I don't think it's as well appreciated as it might be, that it helps people who don't necessarily have the means to get a computer science degree, to buy, um, proprietary hardware. It helps them, um, get access to really cutting-edge tools, data formats, technologies, in a way that's- it's- it can be free. Yeah, that's right. If, if I'm looking to hire someone, I, I'll ask, "Tell me about your lab," or, "Show me your GitHub repo," or, "Show me what, uh, open source tools you've used."

And if you have commercial experience working in other places, I'll be wanting-- you know, I'll want to hear what you've used there. But, uh, for the most part, it's the stuff you've done on your own, and, uh, unless you're independently wealthy, you're probably gonna have to rely on, on free software, you know, free as in no cost. Yeah, that's exactly right, and, um, that's often my first advice to, um, younger people looking to get into cybersecurity. I, I try to paint a picture of all the tools they can get access to, and now, of course, that includes a bunch of GenAI tools, um, tools related to all- machine learning and to, um, you know, LLMs.

Um, there's just a whole, just an, an, an amazing abundance of free and open tools that can accelerate your learning. Uh, so, um, if, if you're in that position and you're listening, I'd say dive into those.

Yeah, that's a great point. You can do so much now with these models.... and you don't have to pay a lot. I mean, some of them are free, some of them you can run locally if you have the hardware. Uh, but it-- again, if you're looking to get hired somewhere, and someone says:

"What have you done?" Well, it doesn't really matter exactly which model you've, you've used, as long as you've tried something, and you can talk about what, uh, you know, what you were able to accomplish or what value you could bring to your, your new employer. And this is definitely an issue now with the... Tech market is tough.

The best advice I can, um, I could give is to just be really conversant in the cutting edge of, um, AI-related tools as they evolve, and be the person who can use them skillfully and creatively, uh, and, um, and I would say sort of non-defensively. They're certainly not perfect, uh, but the state of the art is evolving so quickly that the people who succeed in this kind of s- rapidly changing environment are gonna be those who really keep up with that, practice their skills, and are intensely curious. That's one of the values that we try to instill, what we filter for at Core- at Corelight when we hire, and we try to instill, too, is, is a sense of insatiable but applied curiosity. Uh, so to always be asking questions, and, um, and I think it's folks that have that mindset and have that, um, DNA, they're gonna do, um, a little better in this kind of job market that's so rapidly evolving. Well, we've talked a little bit about advice for, uh, employees. Could we end on a, uh, uh, your advice on founders? Like, if someone wants to start their own company. Uh, the, the most critical mental perspective that I, that I'd recommend trying to, um, adopt is just grit. Just the ability-- and, and I think that comes with optimism as well, but just the ability to get up every day and be, uh, inspired by the, um, uh, all the challenges that come up, and some of them are going to seem insurmountable. And that is sort of the steady diet of the founder, is to wake up and try to tackle insurmountable challenges with optimism and aplomb, and to bring people along, um, narratively.

Like, to create a narrative for people and a sense of grounding for them in mission, in impact, in meaning, so that, um, no matter what happens, 'cause you won't be able to predict what happens, um, you're anchored around that collective, um, uh, mission together. Uh, so just... It, it's one of the-- Just making this decision to leave a secure pension system and just this wonderful environment that I described at the beginning of our discussion at LBNL, and to leap into the unknown and to take a big salary cut. I did that when I had two kids in private college at the time, and a very understanding and cooperative, uh, life partner, my wife, Shalon. Um, making that decision was one of the most, most sort of, um, difficult but also rewarding decisions I've ever made in my life, and I've never regretted it. But, um, it, it really put me on a path to, um, experience exactly what I've just described. If that sounds like something you'd like to experience, um, then I'd say go for it, and so many people wait a little too long to take that leap. I think they wait until they get their MBA, or they wait until they've had exactly the right job experience that they think perfectly qualifies them for the leap they wanna take, and s-some of that is rational. Um, you shouldn't take a completely unguarded leap. But I think if it's a leap worth taking, um, then there's a gap involved.

There, there's, um, there's some big question marks, uh, that will be there, and that's just part of the adventure. So don't, don't be too cautious, don't too-- wait too long to take that leap. I guess that's a, that's a important part of my, uh, lesson as well. I hope that makes sense. It does, but I'd like to counter it a little bit because there's been some... And, and you're a perfect example of this. Uh, there's been some good research, uh, recently that's shown, and I don't mean to be ageist here, uh- ... but, uh, companies that are founded by people later in their careers have been more successful. So a- and what's surprising about that, as you might expect, is, uh, you know, like you said, you're established, you, you may be putting a lot at risk, you may have kids in school that you have to pay for. There's all sorts of things associated with being at the age that, you know, the two of us are at, uh, and yet you chose to, to take that step and to try to found this company. So, um, there may be a perception out there among some people that, "Oh, you know, being a founder is, is being a twenty-something, or you're still in high school-

Oh. ... or, or whatever it is. But no, there's probably no bad age to give this a shot if you have a good idea and you, you wanna give it a try. Excellent point, and that's a really important context. So by the time I did this, I had run the Global Mission Network for the Department of Energy, um, interconnecting the National Lab complex and, and the nuclear weapons complex. I'd actually, prior to my career, um, run a small nonprofit, and that was quite relevant as well. I'd gotten a PhD in an unrelated field, but th- that had taught me a lot about research, about grit required to finish a book, um, about teaching, about explaining complex ideas. I'd been a chief technology architect for the CIO at LBNL, so I had...

And a bit, just been a network operator, done that CCNA, just like you did. So I had a lot of life experience to build on. Yeah, there might be some people listening who wonder if they're too old or too set in their ways or, or too conservative due to financial dependencies to take this leap, and I'd say

I had, I had probably all those qualities at the time I took the leap, and I thought really carefully about it with my family, uh, as well, and decided to do it, and I'm so glad I did. It's not for everyone, but I'm glad I did it. It might be for you, and I'm also happy to talk to anyone listening, uh, uh, if they're contemplating such a leap. I'm greg@corelight.com. I'm pretty accessible, and so I'd be delighted to talk it through if you're thinking about that.

Well, Greg, I think that's a great place to stop. Uh, I, I'm glad you, that you took that leap because, uh, this has been my home now for- Mm ... for many years, uh, definitely appreciate it. So thank you for, uh, joining me today on the Corelight Network Defenders. podcast. My pleasure, Richard. We're so glad you're here at Corelight, and thanks for the invitation to talk with you. Thank you for joining us on the Network Defenders podcast, sponsored by Corelight. We will see you on the network.

You've been listening to Corelight. Defenders. To stay informed with expert intelligence on today's cybersecurity challenges, please subscribe to ensure you never miss an episode. We'll see you on the network.