How do you describe your job to average people?
Since I typically do research and try to be more professionally involved in cybercrime, I describe it as prevention of electronic fraud. Since so many people are either victims of identity theft/electronic fraud or know someone who is, that makes it accessible to people without indicating to them that I'll help them fix all the problems they may have with their printer at home.
Why did you get into IT security?
By accident really. My degree is in theoretical astrophysics and I intended to become an astronaut until I injured my knees. I was exposed to computers at a young age and wrote computer programs (in BASIC) before junior high. I was exposed to SANS while in college, which piqued my interest in the field and I've stayed both in information security and around SANS ever since.
What was one of your biggest challenges?
Convincing people that information security is more than simple compliance with regulations (at least before a serious compromise), and that because something was done a certain way for 30 years doesn't mean it will work (or be secure) on the internet.
What keeps you up at night?
The prospect of electronic economic warfare. I tend to think the risks of cyberwarfare are somewhat hyped beyond the real risk of espionage. However, if an adversary wanted to cause real damage to our entire economic system, that's entirely possible. Luckily, most of our adversaries want to profit from our IT weaknesses, which prevents them from causing too much harm.
Of what are you most proud?
I was interviewed for a segment on The Daily Show with Jon Stewart called “Aclockalypse Now.” Being on TV is ok, but being in the same segment as Flava Flav is awesome.
For what would you use a magic IT security wand?
Since I typically do research and try to be more professionally involved in cybercrime, I describe it as prevention of electronic fraud. Since so many people are either victims of identity theft/electronic fraud or know someone who is, that makes it accessible to people without indicating to them that I'll help them fix all the problems they may have with their printer at home.
Why did you get into IT security?
By accident really. My degree is in theoretical astrophysics and I intended to become an astronaut until I injured my knees. I was exposed to computers at a young age and wrote computer programs (in BASIC) before junior high. I was exposed to SANS while in college, which piqued my interest in the field and I've stayed both in information security and around SANS ever since.
What was one of your biggest challenges?
Convincing people that information security is more than simple compliance with regulations (at least before a serious compromise), and that because something was done a certain way for 30 years doesn't mean it will work (or be secure) on the internet.
What keeps you up at night?
The prospect of electronic economic warfare. I tend to think the risks of cyberwarfare are somewhat hyped beyond the real risk of espionage. However, if an adversary wanted to cause real damage to our entire economic system, that's entirely possible. Luckily, most of our adversaries want to profit from our IT weaknesses, which prevents them from causing too much harm.
Of what are you most proud?
I was interviewed for a segment on The Daily Show with Jon Stewart called “Aclockalypse Now.” Being on TV is ok, but being in the same segment as Flava Flav is awesome.
For what would you use a magic IT security wand?
As an industry, information security has all but cemented itself in “reactive security,” where we always respond to the latest attacks after they happen. If I could change anything, it would be to develop (and find funding for) methods to proactively end avenues of attack before they are realized.
