Guardians of the Digital Realm

Chapter 9: Guardians of the Digital Realm: Navigating Cybersecurity

?

"The only truly secure system is one that is powered off, cast in a block of concrete, and sealed in a lead-lined room with armed guards." – Gene Spafford, Computer Scientist and Professor at Purdue University

?

In Acton, MA, where we live, Main Street and its surroundings feature some of the town's key locations, such as the library, police station, coffee shops, restaurants, and post office. When I founded Sec Armor in 2021, it was with the specific goal of helping local businesses—mom-and-pop shops, family-owned bodegas, and corner stores—protect themselves against online threats, particularly ransomware attacks, which were rampant during COVID-19.

Large companies can afford cybersecurity tools and professionals, but smaller businesses with a website often struggle to protect themselves. Sec Armor was founded as a social enterprise to protect Main Street, not Wall Street. To achieve this, I needed a team of affordable cybersecurity professionals to help secure our local businesses.

?At a small, outdoor, socially distanced gathering with my parents, I met Dr. Aanjhan Ranganathan, a cybersecurity professor at Northeastern University. During our conversation, he highlighted that a handful of simple tools could prevent such attacks. Over the next two months, Dr. Ranganathan patiently taught me and the other founders a curriculum on Cybersecurity via Zoom. I then used this same curriculum to teach the members of the Cybersecurity Club I established at Acton-Boxborough Regional High School. Additionally, I partnered with a local IT services company called Maitsys to provide practical training in ethical hacking and penetration testing. All the practical training happened at our dining room table, with kids sitting around with laptops running Kali Linux.

As I write this, we have three pilot customers and are looking to scale operations later this year. The Cybersecurity Club became the talent pool from which I recruited my fellow founders and associates for Sec Armor. Cybersecurity is a growing field and will continue to boom over the next decade. I realized that general awareness about online security measures is still dismally low, which is why I dedicated an entire chapter in my book to assessing this crucial component of our contemporary networked society.

?Cybersecurity is all about protecting computer systems, networks and objects from threats that could lead to unauthorized access, data theft, or damage to hardware and software. It's a field that's become super important because we rely so much on technology these days, from the Internet and wireless networks to smartphones and IoT gadgets. Given the complexity of our information systems and the critical role they play in our lives, keeping them secure is a massive challenge.

?Gene Spafford’s quote really highlights how tough it is to achieve perfect security. Obviously, real-life conditions prevent us from just shutting everything down and locking it away. Instead, we have to find ways to protect our systems while keeping them functional and accessible.

Most of us are already familiar with digital security measures such as passwords and encryption. Yet, there are key gaps in popular knowledge about cybersecurity: It's not just about protecting our systems against hackers; it's also about safeguarding against vulnerabilities and potential attacks. These attacks can come in many forms, such as malware, phishing, denial-of-service (DoS) attacks, and man-in-the-middle attacks.

One of the key aspects of cybersecurity is understanding the different types of attacks and how to defend against them. For example, backdoors are secret methods of bypassing normal security controls, often installed by attackers using malware. Denial-of-service attacks aim to make a system or network unavailable to its users, while direct-access attacks involve physically accessing a computer to steal data or install malicious software.

Eavesdropping, where attackers secretly listen to private communications, and social engineering, where they trick people into revealing sensitive information, are also common threats. Malware, such as viruses, worms, and ransomware, can cause significant damage by corrupting data or taking control of systems.

?To protect against these threats, cybersecurity professionals use a variety of tools and techniques. For instance, using a virtual private network (VPN) can help secure data transmissions, and implementing strong encryption for wireless networks can prevent unauthorized access. Additionally, fostering a strong information security culture within organizations is crucial, as employee behavior can greatly impact overall security.

?The Evolution of Cybersecurity: From Perimeter to Zero Trust

?Cybersecurity has evolved through three main eras: the Internet Era around 2000, the Mobile Era from 2008 to 2012, and the current IoT/Post-COVID Era. Initially, during the Internet Era, security focused on protecting the network perimeter using firewalls and antivirus software, addressing threats like viruses, phishing, and DoS attacks. The Mobile Era shifted the focus to securing individual devices with encryption and mobile device management as smartphones and tablets became prevalent, facing attacks such as mobile malware, MitM, and ransomware. Today, in the IoT/Post-COVID Era, cybersecurity has adopted a Zero Trust model, which assumes threats can come from both inside and outside the network, requiring verification for every user and device. This era addresses complex threats like IoT exploits, advanced persistent threats (APTs), and supply chain attacks.

?While I have previously discussed my interviews with cutting-edge thinkers in this field, such as Remko Voss and Jonathan Cobb, I would like to further explore this domain by highlighting the ideas shared with me by Ahmad Douglas— one of my mentors and the very first guest on my podcast and the Chief Information Security Officer at CommScope.

?Career Journey

?Ahmad Douglas has had an impressive and varied career in the field of cybersecurity. He kicked things off right after college with a computer science degree and moved to New Mexico to work as a Unix system administrator at Los Alamos National Lab. He described it as a "big change from Pittsburgh (where I'm from) but really positive." During his time there, he not only worked on Unix systems but also moved up to lead a team that developed enterprise security standards and practices to make their work more scalable.

?Ahmad's journey into security began at Los Alamos, where he was also working on his master's degree in computer science. He got involved in national security work, which aligned with the lab's mission. He mentioned, "I spent the first four or five years of my career doing that professionally and then moving up to lead a team." His time at Los Alamos culminated in becoming the deputy chief security officer under his mentor and friend, Jameel Farshi.

?After nearly a decade at Los Alamos, Ahmad made a significant shift to the private sector by joining Visa. He described this transition as "my first role in industry and what a change from the government." At Visa, he was part of a mandate to transform the security program into a world leader in information security. He spent about four years there before moving on to Comcast.

?At Comcast, Ahmad led information security and later compliance and risk management for their home security product, Xfinity Home. This role exposed him to product management and the product lifecycle, which was a new and valuable experience for him. He said, "It was really there that I got exposed to product management and product lifecycle and building security, in addition to the operational aspects of a traditional security program."

?In 2018, Ahmad took on a new challenge by joining Equifax right after their well-publicized security breach. He spent about five years between Atlanta and St. Louis, helping the firm to recover from the breach and build a world-class security program. He described this period as "a really fortunate ride with a lot of great experiences and challenges."

?CommScope: A New Age in Security

Currently, Ahmad is the Chief Information Security Officer at CommScope, where he oversees the entire security program. "Now the entire program is under my direction,” he said on my podcast. “And again, I’m working with a great team to do some great things"—that are nevertheless challenging and rewarding. He oversees the entire security program, ensuring that the company stays ahead of evolving cyber threats. Ahmad shared that one of the key aspects of his job is understanding the culture of the organization and driving security from the top down. He emphasized, "I've never seen security succeed when you ask an employee or another member of the leadership team, 'Who's responsible for security?' and their response is ‘The chief security officer’ or ‘the security team.’"

?Ahmad believes that for a security program to be effective, it needs to be a shared responsibility across the entire organization. “The tone is set by the leader of the organization... they need to be seen publicly as caring about security,” he remarked. This approach ensures that everyone in the company understands the importance of security and their role in maintaining it.

?One of the insights Ahmad has gained from his work at CommScope is the importance of partnerships, especially external ones. "Law enforcement has been essential to us,” he said, “working with the FBI, with CISA, with DHS, with other organizations that have threat intelligence ... has been an eye-opener." These partnerships provide valuable resources and support that smaller companies might not be able to afford on their own.

?Ahmad also stressed the significance of adopting a post-breach mentality. He explained, "The closer you can get to experiencing a breach and thinking about what you would wish you had had in place prior to that happening—that's really a great stimulant to thinking about what you need." This proactive approach helps organizations prepare for potential breaches and ensures they have the necessary measures in place to recover quickly.

?Another key insight Ahmad shared is the role of the technology organization in security. He stated, "So much of security either requires work from the technology organization in terms of patching or maybe configuring their systems." Which is why it's crucial for the technology team to view security as an integral part of their work rather than a hurdle.

?

Nuggets of Wisdom from Ahmad Douglas

1. “Security starts from the top, so as a security personnel in the organization, you should do whatever you can to influence the leader of the organization—the one whom everybody follows—to publicly emphasize the importance of consistently maintaining security.”
2. “Whether you're a company or an individual, you should assume that you've already experienced a data breach and from there work backwards to figure out what things you would like to have in place to protect you.”
3. “It’s very important for security professionals to speak in business and risk terms to enlist support from their colleagues in a cost-challenged environment and to dispel the misconception that cybersecurity is just for IT nerds.”
4. “Anyone involved anywhere within the security industry needs to be adaptable.”

Looking Ahead

Ahmad has some insightful plans and predictions for the future of cybersecurity. He is deeply committed to advancing the field and ensuring that organizations are well-prepared to handle emerging threats. One of his key focuses is on leveraging cutting-edge technologies like AI to enhance cybersecurity defenses. "AI is so hot right now,” he mentioned excitedly, “that with the speed at which AI is advancing and the way in which different capabilities are being developed—whether for developing graphics or emulating someone's voice—especially that adversarial AI aspect... it’s all a wonderful opportunity."

Ahmad envisions a future where AI plays a significant role in automating and streamlining daily security tasks. He shared an exciting prediction: "I imagine a time when there's something like a chatGPT model, and you can ask it, 'Hey, why don't you tell me... I'm interested in attacking ahmaddouglas.com , can you please get me all the intelligence on that?’ and it comes back with the DNS information and the hosts and the subnet." This level of automation could revolutionize how both attackers and defenders operate, making cybersecurity more accessible and efficient.

Despite the potential for AI to aid attackers, Ahmad is optimistic about its benefits for defense. He believes that AI will provide significant advantages to cybersecurity professionals, helping them protect more assets with fewer resources. He said, "I'm optimistic that even if the same capabilities accrue in favor of both sides, the amount of help it will afford the defense over time is going to outweigh the benefit that it has for the attackers.”

Ahmad also highlighted the importance of continuous learning and adaptability in the field of cybersecurity. "Anyone involved anywhere near the security industry needs to be adaptable... you have to always be keeping up with current developments, you have to be interested, and you have to be passionate." This mindset is crucial for staying ahead of evolving threats and ensuring that security professionals are well-equipped to handle new challenges.

Looking ahead, Ahmad plans to continue fostering a strong security culture within organizations and promoting proactive strategies to mitigate risks. He is committed to building partnerships and leveraging advanced technologies to enhance cybersecurity defenses. His vision for the future includes a more automated and efficient approach to security, driven by advancements in AI and continuous learning.

From the domain of computer security, I would like to veer slightly towards a related field: cyber insurance. In this context, my conversation with Angela Whiteford, Chief Marketing Officer at Corvus Insurance, whose offerings include the Smart Cyber Insurance plan that insures businesses against various threats such as system failures, cyber extortion and ransomware, and digital asset destruction, was rather enlightening. The idea of incorporating such a system of insurance into my own cybersecurity startup was intriguing, which is why I sat down to speak with Angela quite enthusiastically.

Career Journey

Angela Whiteford started her career as an electrical engineer and then went on to become the Chief Marketing Officer (CMO) at Corvus Insurance. She kicked things off right after college with a degree in electrical engineering and began her career as a customer support engineer. "I liked working with customers so then I moved into a sales role, so I was a sales engineer," Angela said at the beginning of our conversation.

After gaining some experience, Angela decided to go back to school and pursued her MBA at MIT. "If there was one place I wanted to go for my MBA, it was MIT," she said. During her time there, she got involved in the startup track and even participated in an entrepreneurship lab, which gave her hands-on experience with startups.

One of the pivotal moments in Angela's career was when she decided that she “really wanted to work in mobile technology and in Asia.” A chance conversation at a conference led to an interview and a job offer in Singapore with Nortel. Angela spent over two years in Singapore, traveling to countries such as China, Indonesia, and the Philippines, and working in the mobile industry.

Angela's career continued to evolve as she moved into various roles in different industries, including fraud prevention, blockchain, robotics, and now cyber insurance. She explained, "I've kind of played in a lot of different spots in enterprise networking, telecommunications, fraud prevention, blockchain, robotics, and now cyber insurance."

At Corvus, Angela is focused on cyber insurance, which she describes as a unique type of insurance that not only helps recover data and systems but also makes businesses safer by constantly monitoring their security. She said, "When you buy cyber insurance... we're constantly monitoring your business and your perimeter and making recommendations to you on where you might have gaps."

Throughout her career, Angela has also gained experience in marketing and product management. She emphasized the importance of understanding your audience and the channels they use, saying, "It is really important in B2B to understand your audience... and how they make buying decisions."

Angela's journey has taken her around the world, working in different geographies like Europe, Asia, and the US. She highlighted the importance of understanding cultural differences and how they affect consumer behavior. For example, she mentioned that in China, WeChat is a crucial platform for marketing and understanding how users interacted over it—the slang and colloquialisms, the popular memes and gifs shared across the platform—can be of tremendous use to businesses looking to break into the Chinese market.

Cyber Insurance: Corvus

Angela's current work at Corvus involved combining her expertise in technology and marketing. Corvus is an insurance company that offers cyber insurance, which Angela explains as follows: "You can actually buy insurance to help protect your companies—from small companies to big companies." This type of insurance is particularly relevant in today's world, where data breaches and ransomware attacks are common threats.

At Corvus, Angela and her team provide services that go beyond traditional insurance. She mentioned, "We provide services that help recover the data, help recover the systems, notify your clients, and potentially even help with negotiating with ransomware attackers." This comprehensive approach ensures that businesses are not only insured but also supported in the event of a cyber incident.

Angela also emphasized the importance of data in predicting and preventing cyber risks. She stated, "Our data is really good at predicting the risk. We have done an incredible job in this avenue... we have proprietary scan data that allows us to correlate and understand what types of data we receive could lead to a breach." This ability to analyze and interpret data enables Corvus to provide targeted security recommendations, focusing on the most critical areas that need attention.

Moreover, Angela pointed out that Corvus's focus on cyber insurance sets them apart from other insurance providers. She explained, "We just focus on the cyber subset or niche in the insurance domain. That is all we do." This specialization allows Corvus to stay deeply engaged with the latest threats and trends in cybersecurity, ensuring that their clients receive the most relevant and effective protection.

Nuggets of Wisdom from Angela Whiteford

1. “Try to work in different roles—product, sales, customer support—to understand how to deal with people from diverse backgrounds.”
2. “Networking is super powerful, and there’s nothing wrong with asking for help from your networks.”
3. “In senior roles especially, it’s really important to build those lasting relationships.”

Looking Ahead

Angela has some insightful predictions for the future of cybersecurity and cyber insurance. Like other guests on my podcast, she also believes that the integration of advanced technologies like AI and machine learning will be game-changing. "The ability to use technology to make better decisions is game-changing," she said, emphasizing how these technologies can significantly enhance decision-making processes in cybersecurity. "What you're seeing in insurance now is this wave of technology coming in around AI and ML to help with... really harnessing all that data and putting those into proper models to help mitigate and combat risks," she remarked at length during our conversation. This technological advancement will enable more accurate risk prediction, pricing, and prevention.

One of her key predictions is the growing importance of data in predicting and preventing cyber risks. She explained, "Your ability to scan the perimeter of the network, your ability to gather as much data about the enterprise as possible to build a really robust database to identify where you have potential threats... that is what’s really important." This focus on data-driven insights will help businesses better understand and mitigate their cybersecurity risks.

Angela also highlighted the evolving role of cyber insurance in making businesses safer. She mentioned, "Cyber insurance in general is a different type of insurance that really helps businesses become safer when you buy it." This proactive approach, where insurance providers continuously monitor and make security recommendations, will become increasingly important in the future.

Conclusion

Reflecting on my conversations with Ahmad Douglas and Angela Whiteford, it's clear that cybersecurity and cyber insurance are critical components of our increasingly connected world. Though Gene Spafford's quote underscores the immense challenge of achieving perfect security, innovative approaches can go a long way in protecting our systems and data. Ahmad's emphasis on a top-down security culture and proactive strategies, combined with Angela's insights into the transformative power of AI and data-driven decision-making in cyber insurance, highlight the dynamic and evolving nature of this field. While founding and managing Sec Armor helped me become rather well versed with the fundamentals of cybersecurity for business needs, my conversations with such leading thinkers have hopefully equipped me—and you, my readers—with a more in-depth understanding of the current and future direction of this domain.

?

One-minute Takeaway

1.????? Cybersecurity is the science and practice of protecting computer systems and networks from threats that could lead to unauthorized access, data theft, or damage to hardware and software.

2.????? Cybersecurity has evolved through three main eras: the Internet Era (2000) with perimeter security, the Mobile Era (2008-2012) focusing on endpoint security, and the current IoT/Post-COVID Era using a Zero Trust model.

3.????? A post-breach mentality encourages organizations to assume they have already been breached and work backwards to identify and implement necessary protections.

4.????? Data-driven insights involve using data to understand and mitigate cybersecurity risks, enabling more accurate risk prediction, pricing, and prevention.

5.????? External partnerships with law enforcement and threat intelligence agencies provide valuable resources and support for cybersecurity efforts.

6.????? Continuous monitoring involves constantly observing a business's security posture and making recommendations to address potential vulnerabilities.

7.????? A strong security culture emphasizes the importance of fostering a shared responsibility for security across the entire organization, driven by leadership.

8.????? Cyber insurance is designed to protect businesses from the financial consequences of cyber incidents, such as data breaches and ransomware attacks.

9.????? Key trends in cybersecurity include the integration of AI and machine learning, increased emphasis on data-driven risk predictions, continuous monitoring, and the rise of cyber insurance as a proactive security measure.

10.? Cybersecurity is a field predicted to boom over the next decade, driven by the increasing reliance on technology and the evolving nature of cyber threats.