Josh Steinman Interview

⊛ October 11, 2022

I think that this interview with Josh Steinman is probably one of the most interesting I’ve come across in a while not just in terms of high level cybersecurity issues, but also in how Steinman approaches and operationalizes various issues.

The key takeaways that I got were:

  1. The skill stack (stolen from Scott Adams)
  2. How to act on skills that are or may be missing in the skill stack
  3. The To Do/To Be concept.

For the first issue, the skill stack is similar to a tech stack in that it’s a set of skills one may possess and can utilize in a way to make progress toward a goal (developing an app, making money, getting exposure, etc…). The Scott Adams example is that Adams’ knew corporate America, liked to draw, and could tell funny short stories as his skill stack and developed that into Dilbert.

For the second portion Steinman talks about how he would have/hire NSC staffers and show them an index card with (roughly) 6 bullet points on it, and each bullet point had several sub points. Steinman would (generally) say to the staffer he was looking to hire “I have you for two years, in those two years, what are you going to tackle on this list?” This is a very high level Jira board (IMHO) in that it has a story/project, several sub-tasks, and a deadline attached to it. For me it reinforces the notion of breaking things down and tackling what you can.

Finally the To Do/To Be concept, Steinman quotes John Boyd and that he would apparently often say that “one can look to be somebody, or one can do something” which boils down to the concepts that you can either shape yourself to become what others want, or you can do things that others may not view in the most positive light, but ultimately may amount to something (or not, that’s the risk). I’ve been searching for a variety of things, so that really spoke to me.

There’s other lessons in the podcast as well, but those are the big ones I found. But I also found curious how Steinman approaches a variety of topics including business and various interests, basically he’s got a wide breadth of knowledge and it’s still surprising to me how much overlap their is between international relations and infosec.