Scott Keck-Warren
0:05
Hello developers, and welcome to the PHP Community Corner, where we have conversations with members of the web development community. I'm your host, as always, Scott Keck Warren, and today we're talking with Nia Luckey about her brand new book, Trust Hacked: What Firewalls, Failures, and Frontline Teach About Trust. Nia Luckey is a cybersecurity leader, author, and speaker who helps organizations build resilient security, governance, and trust strategies. Drawing on experience spanning military service, enterprise leadership, and regulatory compliance, she bridges the gap between technology, business, and human behavior. Nia is the author of Trust Hacked: What Firewalls, Failures, and Frontline— the Frontline Teaches About Trust, and is known for translating complex cybersecurity challenges into practical leadership insights. Thank you so much, Nia, for finding some time to talk to us today.
Nia Luckey
0:51
Thank you for bringing me back, Scott. And yes, it's It's here, it's happening. So I'm just grateful for the opportunity to have a platform to talk about it.
Scott Keck-Warren
1:01
Yeah. And, and so can we talk about like a little bit about, so we're here to talk to you about your book, your book that just came out. Like when I forgot to look, I know I had it researched, but it's recent, right? You just recently had this book out?
Nia Luckey
1:14
July 9th recent. Yeah.
Scott Keck-Warren
1:16
Okay. So we're, this is August, we're recording this in August, so it's very, very recently out. And so, can you just talk to us a little bit about like what the germ is for the book? Like, what's the general idea of it?
Nia Luckey
1:28
So, the general idea like really came from the heels of the TED Talk, which if any of you listening haven't seen it, just go check out YouTube. It's about 8 minutes long. And that's where I introduced my idea around the Trust Protocol, which is all about how we bring authentication, encryption, and resilience to the table as leaders. So, it's Less of the technical stuff, but more how do we get back to basics on authenticity? How do we get back to basics on trust? And Trust Hacked is more like, I look at it as the extension of that because oftentimes when we work in security, tech, cybersecurity, what have you, we tend to get kind of lost in the technical components of it and we forget the human components. So the book, at its core is a swing towards that leadership arm that says, hey, with the advancements of AI, automation, technology, here's an idea on where we can build trust better. Here are some concepts that, as leaders, myself included, I didn't even have names to when I started writing this book. I just knew what it was in jumbled words and here comes a concept like Cassandra syndrome that's in there, right? So, it's bringing these to the forefront in a simplistic way for leaders to look at themselves, look at the organizations around them, but look at their teams and really start calibrating and training for trust. So, a lot like, maybe the listeners weren't aware of this, but you and I met in March in person when I gave the keynote around The Trust Protocol. And the challenge was, how do we train trust, right? How do we practice it and develop the discipline that we need when crisis occurs? Because what I found in my military experience is when that crisis happens, you're going to default to the level of your training. You're not going to rise to the level of your academia or your credentials or your certifications. No, you're going to default down to the level of the training of the collective, of the group, of the organization. And that's a very different atmosphere to operate in and think through, right? Because as leaders, we're challenged to think through that and navigate it, navigate through it as a group. So the book aims to kind of pull that all together, but in a streamlined way. And I know that sounded really complex, so rest assured it's only 150 pages long. It's meant to be more of a pocket guide. So, when I think that trust is being deteriorated, I want leaders to think of my book and see if there is a chapter in there that can help you navigate the challenge that you're going through, right? Or is there a way we can measure for this? Which is why, you know, to the credit of Taylor Francis Group, our publisher, that it's under security, it's under leadership, and it's also under audit because there are some calibration mechanisms in there. Light touch that can give a leader an idea of how they wanna develop their program and their team.
Scott Keck-Warren
4:44
Yeah. And, and so I, um, I bought the book like before, before we did the interview and, um, and it's, it is a really, um, like for me it's very thought-provoking. Like it's, it's been an interesting like process of going through and like, 'cause you've kind of taken, and hopefully it, tell me if I'm wrong here, but you've kind of taken like this concept of authentication. Oh, I already forgot. There's the authentication, encryption, and like normal security stuff that like we as developers might know, right? And said, okay, well, this is how this maps into like how a human functions essentially. And like, as I've been reading through it, I've had, I've had an, I wouldn't say I've had a challenging time reading it because it's been one of these books where I don't just, didn't sit down and just read the whole thing all the way through. I read like 2 paragraphs and go, oh yeah. And then like, it really like, brings a lot of thoughts to the surface. And so that's like my kind of like, it's basically like, how do we take security and show that like, without trusting people, we have nothing within an organization? Is that kind of like a good synopsis or?
Nia Luckey
5:52
Scott, you just hit like probably the biggest nail on the head. So second to my sister-in-law, who's also in the middle of reading the book, and she works in just, she's a teacher, for perspective for everyone listening. So nothing to do with our world. So nothing to do with developing, risk, security, none of it. She's a teacher. And she's really interested in understanding from her world within education what's important to look out for, because at the end of the day, her business is investing in the success of children's futures, which is Very different output. And you hit on it perfectly. This book is meant to be lean and mean, but it's meant to get you thinking about how you show up. And so I'm glad it's really helping you think of relationships, interactions. And I think the step beyond that though is, all right, now let's sit with it and let's, let's talk about Scott. Let's talk about Nia. Right? What are the calibrations we need to make internally? Because my whole message is it really starts with you as the, either the individual contributor, the manager, the team member, what have you. Maybe it doesn't have to do with where you work at all. I think while I was writing this book, it's— this is the through line of my life and the way I kind of operate in. And the reality that I think is coming through, and the more people that start to give feedback, is that really started to shine through and pull through, which makes me really happy. So I'm glad that's your takeaway currently because that was one of the unexpected outcomes that I really didn't share with anyone. So it's great to hear ripples of that already starting to occur.
Scott Keck-Warren
7:50
Yeah, and I think ultimately the struggle I'm— and I use struggle in the nicest possible terms. The struggle that I'm having while I'm reading this is I'm just like, I read a sentence and I'm like, oh yeah, that's this boss, or oh yeah, that's this coworker, or oh yeah, that's this partner that I was involved with a long time ago. Because it's just like, oh yeah, trust is like this big— you have all these examples and I'm always just going like, how does this apply to me, the most important person? And I can easily see that trust is the thing. Trust is very, very important in our modern world, essentially.
Nia Luckey
8:22
100%. And what you just keyed in on is I want to challenge the readers and listeners to step back from the person that it reminds you of. And I want you to start capturing that as a persona, right? Understand that those personas, ourselves included, exist in the world. They're not going anywhere, right? And I think that's the biggest aha moment I had while I was writing this. Is, they exist. So, instead of trying to figure out how to fix something that is outside of our control, how can I figure out how to get to a certain level of trust with that existing persona? And how do we communicate through that? And then how do we manage the repair of trust over time, either from an organizational perspective, a team trust breakdown perspective and some of the other scenarios that I talk through in the book.
Scott Keck-Warren
9:21
Yeah. And that's, and it is really like a fascinating concept, but, and there's just like one thing I want to kind of jump back on is like you said it was like a lean book and I honestly don't feel like it's that lean. Like I buy my books through like my, the Kindle. I, so I have the Kindle version of it and I'm just like every page I'm highlighting something. So like I have right now, I have Yeah, I have 28 highlights right now of just like things that I've been like, oh yeah, this is interesting, or that's new. Because especially since like there's stuff in here that like, there are terms that I haven't ever heard of before. Like you've mentioned the Cassandra complex, which I saw that and I'm like, oh, this is fascinating. And then there's also like innovation paralysis, which I've never heard of, and talent hemorrhaging. And like, what else have I come up with? Hesitation task. the silence penalty, the verification overhead. And I'm just like, every time I, I go like, oh no, like I've been somewhere where this has been a problem, right? Or I'm at somewhere where this is a problem. And like, it really is just like, I, what I really need to do is get not me. I'm like a terrible person to be the audience for this because like, I'm already on board with all this stuff, right? It's like other people who, who like, I need to send this like anonymously to my old bosses and just be like, hey, You know, read this thing, it might help you. I mean, they probably won't read it, but, you know, these people. And I think that's a little bit of the challenge today, right?
Nia Luckey
10:43
It's hard to envision going into a boardroom and being like, oh, trust is broken because your leadership sucks. Like, that is not the goal here, ladies and gentlemen. Like, we're— that is not the business I am in. So, when I was writing this book, being, you know, a people manager in the past, also an individual contributor, like, I've had various roles. Across my career, military and now private sector. And like I said, even as I was researching, and I'm just describing what the thought is coming out, there's a term that comes up, innovation paralysis. Like, you can only innovate so much without guardrails or without parameters. You have people that will use silence as an avoidance tactic. Like, that is a tactic that is leveraged during crisis mitigation, right? And it is, it can be translated quite simply to the silent treatment, right? But also what happens when your team members go silent? Are we peeking and pulling when your top performers are going on mute? Is that an indicator to you as a leader? Because to me, at least in the work that I've done and in my background, it's a huge indicator in some cases and in some spaces. And I would say, like, especially in development spaces, risk spaces, security spaces, sometimes that silence is your, like, sounding alert. Like, think of a security operations center, right? Like, big, giant red light going off.
Scott Keck-Warren
12:27
Mm-hmm.
Nia Luckey
12:27
That's your alert. Like, I'm not saying we have a breach, but as a leader, should be something that gets it, catches your attention. Or if you feel yourself going silent when you feel like you have a valid conversation to be had, I've experienced this where I raise an observation or I raise a risk or something I'm very passionate about. Is not received with the active listening or the level of engagement I expected, I'll find myself going silent. It's an indicator. It's an indicator that we have maybe some trust exercises we need to lean into because at the end of the day, it doesn't feel good to not feel heard, listened to. It's one thing to say, hey, I hear you. I am looking at this scenario, the same scenario in XYZ fashion, so that you're not diminishing what's being brought to you as a leader. But the reality is we're not acting in that way consistently enough to train it as a discipline. At least that's my observation. And then, like, second to that is, you know, huge inspiration for the book came from the work of Dr. Brené Brown. Leans into. So privately, what a lot of people don't know is her work saved my marriage. And, you know, just to get a little bit like personal there, it was her work around trust. And it was her, you know, she gives a great analogy around trust and it's this marble glass jar. And every interaction you make with a person is a marble in the jar. And so sometimes The way you fill your jar, Scott, might be different than the way Nia fills her jar. But let's say I'm going through something or my kiddo's going through something. If you're my leader and you're like, hey, how's your kid doing? I know they went home sick yesterday. Maybe that's a marble of trust, right? But we also have to be mindful of the heavier marbles that we're asking people to carry that may fracture that trust. And those can be, hey, I raised a legitimate risk or concern and you ignored me. And that can start to cause fractures in that same marble. So it's just, it's a lot to try and pack. And so I did say lean because I have seen some more thicker, like significantly thicker books in cybersecurity overall. But what really came to mind was that pocket guide approach of exactly what you're saying. Like you could probably flip to the chapter. Find that word and you know what conversation you wanna plug it into. And that's, that's the whole principle behind it. And that's why I said lean. So maybe it is context-rich and it goes deep, and I'm happy to hear that. But the whole goal was, how do I get this in the hands of everyone that needs it? Because AI's everywhere. And right now, I don't think I'd make it 24 hours without talking about AI or the risks that I'm seeing, considerations. How do we build trust? How do we trust AI?
Scott Keck-Warren
15:41
Yeah.
Nia Luckey
15:42
How do we trust the technologies around it? And I'm like, well, how are we building trust within our teams first and foremost? Because in order to trust the extension that we're building, I feel like that's where it needs to start.
Scott Keck-Warren
15:54
Yeah, and that's all like really, like it's all really fascinating to me. Like, I just have been, I don't know how much more I can say. Like, I'm devouring the book essentially as much as I can. And it was like a struggle to try and explain. So I started reading it and I went to talk to my therapist and I tried to explain this to him and it was just like a struggle. And then I tried to explain it to my partner who's also non-technical and it was also a struggle. And so I think like that's my only like downside to this whole thing is that like it is like you're trying to tell the story through what we as developers or security people might understand. And so that's my only flaw with this book. I think that like everyone should go and and buy it. Um, so, so yes, go buy it for sure. Um, but I think that like—
Nia Luckey
16:44
I mean, go ahead.
Scott Keck-Warren
16:46
Nope, you go ahead.
Nia Luckey
16:47
I was just gonna say feedback's a gift. Um, and sometimes, you know, when you're a first-time author, which this is my first publication, like I, I really take that to heart. Um, trying to explain it clearly, I think was, I will echo, was a challenge in and of itself because it does go so deeply personal for me. Um, but I'm glad that there are aspects of it that are sticking. So.
Scott Keck-Warren
17:14
Yeah. And, and I think that, like, I, again, like, I think that I'm, I'm the perfect person to read it cuz it's, it like speaks to me, but I'm not necessarily like the perfect person. I'm not in the best position right now to enact it. Right.
Nia Luckey
17:28
That's fair.
Scott Keck-Warren
17:28
Um, I think that's like the big, the big boulder that I have to push uphill is I have to give this to people up higher in the chain of command and tell them, you guys got to read this because it's talking about what's going on or whatever. So I definitely think that's like, it's really good. And I do like also like we've, our family has been, has listened to Brené Brown as well. Like we've, we read her books and we've seen her talk and things like that. So she's also an excellent resource if people are looking for something because we definitely enjoy that. And we'll be back after this word from our sponsors. Every app builds up technical debt over time. It's the unfortunate price that we pay for shipping new features and moving fast. When we build up too much of it though, it can start to impact how we work. Team velocity suffers, bugs become more frequent and take longer to fix, and everyone starts to get a little bit frustrated. The key to managing debt is to measure it. A credit score can help you understand how well you're managing your debt, and now there's a credit score for technical debt. Go to php-score.com to get a free technical debt score and monitoring for all of your PHP applications today.
Nia Luckey
18:30
today.
Scott Keck-Warren
18:30
Head over to php-score.com and get control over your technical debt. Um, so the, the other kind of like piece that I wanted to touch on, um, is that this is part of a larger series. It's part of the, um, security audit and audit and leadership series. And, and like, I think that like realistically, this is good for security people and leadership. Um, and then like, do you see other people, um, Like, where do you, who do you see as like the key, the, like the main person to be reading this? Is it security people? Is it leadership people? Is it just anybody who has trust issues?
Nia Luckey
19:05
Oh my goodness, that's a loaded question. So, maybe not for the people that have trust issues. This might be a bit of an accelerant. And then again, with like the tangible application to solve, like that, that could be a challenge. So, just stepping back to like your previous Kind of point of feedback and trying to like volley this up to leadership, right? What I would recommend is start with a chapter. So, the one, like if I'm talking about AI or innovation in AI, I would go to probably chapter 7, right? Where we're touching on concepts of human in the loop, on the loop, out of the loop. Make it relevant to the problem you're trying to solve. So, get very tactical. If we're trying to solve a people problem, maybe it's the chapter that touches on the concepts around behavior and where we're really peeling back how your team members or even yourself may react in either stressful or just standard leadership situations, right? That's not a one-size-fits-all, so I would not attempt to throw the entire book at a problem, but the idea is, is there a chapter you can root on? And is there a concept in that chapter that you're like, oh, that's snappy enough and that can maybe start the conversation? That's where I always like to go is like, where's the conversation starter? But to your question about the series and who should read the book, I think this is a great book for anybody that is prepping to step into leadership, right? Because I think it's a good way to start calibrating your own internal inventory. on trust. And the reason I'm saying this is coming out of a military experience or coming out of the intel community or coming out of high stress environments, your calibration may be hypertuned. So that's the other part that we really don't touch on in the book at all. And I needed something that could help me understand how to tune where I was, right? Coming out of all of that experience, I think my alarm system, if you will, was just hypertuned everywhere. So like everything was on fire all the time. Oh my God, don't trust anything. It's not the case. What you need to do is you need to recalibrate it to the relationship you're in, the environment you're in. And that's kind of the whole idea there is how do you, how do you bring that down so then you could think clearly, but also most importantly, lead people. And so second, so leadership first, like if you're thinking like, hey, I want to be, you know, a team lead one day, or, you know, I could see myself on that path. I have a passion for people and the work. I think that's a great plug because trust is always going to be there. Second to that, yeah, if you're in any cybersecurity adjacent role, you're in an organization where You know, trust is important, or it's coming up as a key pillar, like from the enterprise level, like, hey, this is like a part of our, like, I don't know, core mission is what's coming to mind. I would encourage you to pick up the book. I know trust is a big part of any organization I've ever worked for, military. So understanding how to show up in the right capacity, ask the right thought-provoking questions, or even be able to have like a graphic, right? A graphic or a lean chart to drive a conversation. That was kind of the purpose I was trying to get at there. And then, yeah, if you're just in business or a leader in your own personal life and you have curiosity for security and trust in the intersections of That might be a little overwhelming, but it also might be for you too.
Scott Keck-Warren
23:02
Yeah. And I, I do like that idea of just taking like one chapter and then trying to apply that. That's a good, a good suggestion. Um, and I also like, it really resonates with me, the whole, like, if you wanna be in leadership, this is like a good first step. Um, because I, um, I'm trying to think of how to say this tactfully. I've, I've seen a lot of people who were put in leadership roles who didn't necessarily prepare for it. And then they sink or swim within that piece. And a lot of people just aren't good leaders. They just like, they end up in that by default somehow or whatever, and they just kind of, I don't know, thrash or I don't know how to explain that, I guess. I guess that's not my area of expertise, but I do recommend the book. Unfortunately, we are going to have to let you go for today. I do. It's always a joy talking to you. Is there anything that you'd like to direct our listeners to before I let you go?
Nia Luckey
23:57
Not anything in particular, but if you are interested in reading the book, it's available on Barnes Noble, Amazon, Taylor Francis, I think the Rutledge website directly. And any, like I said, feedback is a gift. So if you have an insight or you have a thought, Feel free to share it. Um, and don't hesitate to look me up on either YouTube or LinkedIn and reach out and connect.
Scott Keck-Warren
24:24
Awesome. Thank you again for your time today.
Nia Luckey
24:27
Thank you for having me.
Scott Keck-Warren
24:29
Yeah, absolutely. I had to say another heartfelt thank you to Nia for all of her time, as well as for you for listening. If you're not already a subscriber, make sure you subscribe with whatever your preferred method is so you can get the episodes as soon as they're released and maybe share this post with a coworker or your boss who might need to know about it. The podcast is available both in an audio version on the PHP Architect website, as well as a video version on our YouTube channel. This is Scott Cack Warren for the PHP Community Corner signing off and reminding you to keep listening, keep coding, and keep reading.