16 Oct Debbie Gordon Launches A Cloud Range Into Cyberspace
CEO marches to the beat of her own drum
– Di Freeze, Managing Editor
Northport, N.Y. – Oct. 16, 2020
Debbie Gordon is a visionary and a three-time entrepreneur. Her most recent company, Cloud Range, is a virtual cyber range training platform. How Gordon progressed through her entrepreneurial stages is fascinating.
Gordon grew up in New York. She exhibited that entrepreneurial spirit as a teenager.
“I used to make necklaces and go sell them at Grateful Dead shows,” she recalled. “I’d come home with a bunch of money and my parents would wonder how I got it. They’d laugh when I told them. I wasn’t the biggest rule follower when it came to constraints. I was always kind of independent and doing my own thing, marching to the beat of my own drum.”
Gordon went to college at Vanderbilt in Nashville, at first as an economics major before switching to the human and organizational development program. She wasn’t sure what she would do with her BS, but she did know one thing.
“I knew that I probably wouldn’t work for anyone for most of my life,” she laughed.
After graduating, Gordon worked for a small marketing and advertising company for five years.
“I was employee number four. It was in the technical education space. We did marketing and advertising for Novell and Microsoft and Lotus authorized education centers. It was a very small entrepreneurial company. The owner trusted the decisions I made and kind of let me run with things.”
For the next few years, Gordon worked for a software company.
“Our customers were in New York and we were very affected by 9-11,” she said. “That was an opportunity for me to go off on my own.”
A fascination with eBay led to the next phase of her life.
“I wanted to see how it worked and I decided I wanted to try selling something,” she said, “but I didn’t have anything I wanted to sell.”
What she did have was a coupon for the Saks Fifth Avenue outlet for 15 percent off an entire purchase.
“I went and spent about two thousand dollars on high-end designer shoes,” she said. “I went all in and decided I was going to try to sell those things for the outlet price. If I did, I’d make 15 percent margin. My friends thought I was crazy. They asked what I would do if they didn’t sell. I said I’d return them because I had 30 days to take them back.”
Gordon bought a digital camera and then hired someone to take pictures, do the listings, and box and ship the shoes.
Once people saw what she was doing, they started asking Gordon to sell their stuff for them.
“It was just a little hobby,” she said. “I didn’t really want to sell their stuff. Too much work. But it did give me an idea that as easy as it is to buy stuff on eBay, nobody really wanted to learn and understand the ins and outs of selling on it. That’s when I figured out there was a huge opportunity to do that.”
When an elderly neighbor asked Gordon to sell her family’s estate antique jewelry, Gordon decided it was a great opportunity. She told her that she would create marketing materials, a contract, a company name and website, and then test the business model out on her. Gordon successfully sold the jewelry and began to think about the next step.
Cybercrime Radio: Debbie Gordon on Cloud Range
Cyber Range for MSPs, MSSPs, CISOs and Security Teams
“For me, once something works really well, then I have to get innovative,” she said. “I like to invest time. I don’t like to spend time. When I’m just doing something repetitively, that’s totally a waste of my life.”
Knowing that she could provide her service to others, Gordon went in search of commercial real estate space. However, at the same time she had been interviewing for a job with a company that had just relocated their headquarters to Nashville.
“It was a pretty big job,” she said. “I was sitting on an offer from them.”
A dream hastened her decision regarding what to do.
“There was a video game store next to one of the commercial real estate places I looked at,” she said. “I dreamed that I went in the store and they said, ‘We’ll sell your stuff on eBay.’ I woke up and I thought, somebody’s going to steal my idea! I need to do it. I called the company that had given me the offer and said thanks but no thanks, and I called the owner of the building and said OK, I’ll sign the lease.”
Gordon recalls putting about 15,000 dollars into a build-out and signage for Snappy Auctions, which opened in October 2003.
“People kept asking me if it was a franchise and I’d say no, but I want it to look like a professional business,” she said.
Her next step was to get a reporter to write about what she was doing.
“There was a front-page article the day I opened,” she said. “Then it was off and running.”
Gordon hired a university student to write a software program that would connect to eBay so she could launch her listings. But she didn’t just want one store. Her vision included franchises.
“I tend to go with my gut on things,” she said. “Just move forward and don’t second guess. From day one, everything I did was based on systems and processes, instead of reinventing the wheel every day. Even before I started franchising, I was basically building systems and processes so I could see how to replicate the business.”
Gordon learned that the International Franchise Association Expo would be taking place in Washington, D.C., in April 2004. Her plan was to launch her franchise opportunity for Snappy Auctions there, so she had six months to prepare.
To save money, she went over other franchise agreements and crafted her own. Then, she sent it to a lawyer to edit.
“We sold about three franchises as a result of people we met at that show,” she said. “It all grew from there. We got a ton of media attention and I hired people to run the business in Nashville while I worked on the franchise side of things.”
Gordon’s eBay facilitation service would grow into 75 stores in the U.S. and Japan. Over a 13-year-period, Snappy Auctions went from selling people’s things on eBay to becoming a data security company.
Gordon began providing IT asset disposition to companies that were retiring their IT equipment.
“We were working with our partners who were selling new equipment,” she said. “We had a trade-in program. We would take the old equipment, decommission it, certify that it was sanitized, and then they would get some money back.”
That business evolved into S3 Asset Management (which Gordon sold in 2016). As partners began to offer their services to their customers, Gordon began to see a need for another service she could offer.
“When they were selling cybersecurity products, there was a challenge in their sales efforts,” she said. “An end-user company may have budget and every intention to buy a SIEM (security incident and event management), for example, but maybe they haven’t built a SOC yet or don’t have people in the SOC. Basically, because of the skill shortage, they just couldn’t sell what the customers needed, and the customers couldn’t buy it. The skill shortage was increasing the risk, perpetuating it. If people don’t exist, you can’t just magically snap your fingers and have these experienced people to hire.”
Gordon realized that the only way to do that was to create experience, and the only way to do that is through simulation. She now had a vision for a new company.
“I wanted to provide something for the channel where they could offer security simulation training, alongside of selling whatever type of security products they had, to help enable customers and sales,” she said.
In June 2018, Gordon formed Cloud Range Cyber, a virtual cyber range that uses simulation to improve security operations teams.
Cyber ranges aren’t new, although Gordon’s space is unique.
“Traditionally, simulation has been used for live red teaming,” she said. “For example, there is a category in the industry for cyberattack simulation. That’s to test vulnerabilities in a safe way. Then you’ve got cyber range. Think of it as a lab environment, which traditionally has been used by the military to also do red teaming, to mimic a network and to test vulnerabilities from a technical standpoint. We’re the intersection of those two. We are a virtual environment. It’s a lab environment, but our goal is for the defenders, the last line of defense, the blue team, to be able to practice and be measured on their detection, response and remediation skills. That hasn’t been done before.”
Cybercrime TV: Debbie Gordon on Cyber Ranges
30,000 Foot View of the Cloud Range platform
Gordon uses the analogy of a flight simulator to show what makes this training so valuable.
“Pilots used to have to learn the hard way what to do when their engine went out or when there was a thunderstorm,” she said. “Then the flight simulator was invented. I wouldn’t want to get on an airplane with a pilot who has never been in a flight simulator. The same thing goes for cybersecurity. When security analysts are going through these exercises, they’re using licensed security tools. They’re learning the critical thinking and the processes necessary to quickly, properly and efficiently detect and respond and remediate cyberattacks.”
Cloud Range’s virtual exercises are typically three or four hour sessions, done monthly, with a different attack scenario each time. An instructor teaches the exercises.
“An instructor isn’t required from a technical perspective,” Gordon said. “In this industry, there’s so much automation, but this is one part where we have to go back to the basics. We have to go back to the human touch. That’s where the impact is. AI cannot teach or access soft skills and all the different skills and roles of the people.”
Gordon, who has always been intrigued by human behavior, said that this is becoming a significant part of Cloud Range.
“We’re finding in our training and simulation exercises that soft skills and communication are an integral part of the success of a security team. That’s not something a lot of people focus on.”
COVID-19 hasn’t affected the business model of Cloud Range, since it was designed for security teams that could be co-located, distributed or partially distributed. But with so many people now working at home, Gordon said it has changed the dynamics with how people handle incidents and has magnified the importance of what they’re doing.
“When somebody is working in a traditional SOC, everyone can talk to each other and communicate,” she said. “It’s a lot different than when people are working at home and they have to pick up the phone to go through an incident. This has exacerbated the importance of doing simulation.”
Cloud Range gets formal feedback after each of these sessions that Gordon says indicates clearly that the participants, the security analysts and incident responders, feel more capable and confident.
“They feel more empowered,” she said. “They also enjoy their jobs more because now they have a sense of purpose.”
This all emphasizes how Cloud Range is helping to address the skill shortage and increase employee retention, which Gordon said were unexpected positive consequences.
Cloud Range can also change how people are hired.
“Job requirements are misaligned with someone’s actual ability to do a job,” she said. “They may say somebody needs a four-year degree. Well, we have a way to access their capability using simulation. It removes the antiquated requirements that HR departments put on job descriptions. Instead of some industry certifications, number of years in a job and four years in college, we can do a simulation of what that exact job role will be and have people go through an exercise. The hiring manager can watch how the person performs.”
It also eliminates unconscious bias for hiring somebody.
“If a woman or minority is taking one of those assessments, it can be completely biased,” she said. “We’re working with some universities to help bridge the gap between people’s formal education and being able to get a job, as well as the Workforce Development Initiative, changing jobs and being able to do training and then these assessments.”
Over the years, Gordon has been asked many times to speak about being a woman entrepreneur, a woman in business, or a woman in cybersecurity.
“I say no, I’m going to speak about what I do,” she said. “I’m a businessperson who happens to be a woman. I don’t like to dwell on it.”
She does believe it’s important to be a role model and show other girls and women that they should not be intimidated, particularly when it comes to the field of cybersecurity.
“This doesn’t have to be a man’s industry,” she said. “Don’t think you can’t, just because stereotypically it might be a man’s field. Women are such great critical thinkers, multitaskers and creative thinkers. There is absolutely no reason that women shouldn’t be in this role. It’s up to all of us to make sure that we show the world that there are women in it.”
She also says it’s important that people realize that you don’t have to be a “technical cybersecurity person” to be in cybersecurity.
“I’m a businessperson,” she said. “I understand cybersecurity from strategic direction and assembling a team and having innovative products and services. But being in cybersecurity doesn’t mean you are the stereotypical person in a hoodie in the basement.”
– Di Freeze is Managing Editor at Cybersecurity Ventures.
