Betsy Bevilacqua From Almost Lawyer to CISO and Security Leader

Betsy Bevilacqua0:00

So I realized that I had an app and I was always the kid who wanted to learn a lot more, learned how to hack our phone system and go right to the PBX exchange outside. And it was just, I realized that's where my passion was.

Betsy Bevilacqua0:39

When you take these large national exams, you have about three months to wait for your results to come out. And it was during that time I really started pondering, you know, what does it really mean to be a lawyer? What does it mean to be in the legal profession? And the more I dug into it, the more I realized, you know what, actually, I love computers. I love video games. It's almost like I did a self-audit very early on and I realized that I had made a mistake.

Betsy Bevilacqua1:09

So the idea is always looking for, one, is there passion? Is there an interest? Because security is not something you get into lightly, as you know, right? We basically, we take on a lot of risk. It's very stressful at times, but it's also very rewarding. And so I've always taken the point of if somebody has these qualities and they have transferable skills, you can very easily solve a lot of these problems with people who think differently.

Betsy Bevilacqua1:45

What does this language do to your psyche? Because I remember the first time somebody said master-slave and they were referring, I think it was a database or something. And I remember being taken aback and I was like, wait, what? And then all of a sudden it just became so commonplace that I started using it.

Betsy Bevilacqua2:07

Thanks for having me, Eamon.

Betsy Bevilacqua2:18

Sure. So again, my name is Betsy Bavalaqua and I'm currently the VP of Information Security at Chainalysis. Chainalysis is a blockchain security company. Prior to Chainalysis, I've been in the security industry for probably around 16 years, which sounds crazy for me to even say that out loud. It's been an interesting journey. I've led security teams at a medical device startup, Codafly. I spent almost five years leading a few security programs and teams at Facebook and before that at eBay, before that health insurance, academia, and a food and facilities company. So I've seen the rainbow of all manners of security programs, starting from when security was slapped on a firewall and some antivirus and called it job well done to where we are today, which is a completely different environment.

Betsy Bevilacqua3:26

That's right. It was not. So I thought I was going to be a lawyer. I'm originally from Kenya and the law degree is actually the first degree. So meaning you could go right from high school into law school, unlike here in the US. And it's also not easy to get into, right? You have to get certain grade levels and then you apply and it's a kind of rigorous process. So When I was in high school, you know, it was, you know, law sounded cool, lots of interesting problems to solve. And it was either that or med school and I couldn't deal with the idea of cadavers. So that was completely off. So yeah, so anyway, I do all this hard work, pass all my exams or get accepted into law school. And I realized that this was not for me.

Betsy Bevilacqua4:16

That's a good question. My parents really didn't drive. They did a good job of letting us decide what we wanted to do.

Betsy Bevilacqua4:24

And so law was a very, still is a very prestigious occupation. And so when you think about your future, you look around you and the people who are successful around you. And for me, folks in the legal side were, seemed to be doing well. I said, well, that's what I want for myself.

Betsy Bevilacqua4:40

But then we'd only have a break in Kenya. When you take these large national exams, you have about three months to wait for your results to come out. And it was during that time I really started pondering, you know, what does it really mean to be a lawyer? What does it mean to be in the legal profession? And the more I dug into it, the more I realized, you know what, actually, I love computers. I love video games. It's almost like I did a self-audit very early on, and I realized that I had made a mistake.

Betsy Bevilacqua5:08

Yeah.

Betsy Bevilacqua5:11

Well, the good thing is it's a national exam that everyone has to take. Oh, okay. It's not based on your grades and they say, yep, you qualify to go into law school. So it was during that process that as you finish the exam, you wait for the results. And then once those come out, then they tell you almost at the same time, whether you were able to get into the schools of your choice or the programs of your choice in the public university.

Betsy Bevilacqua5:42

Yeah. So I went to a public-private, sort of like a charter school in Kenya.

Betsy Bevilacqua5:47

And they happened to get a grant. It was probably in like the late 80s. They got a grant and they bought a bunch of computers. And they were one of the first few schools in the city to have a computer lab.

Betsy Bevilacqua6:00

So we had computer class, but really at that point, computer class was 45 minutes of theory and it was our teacher doing his best to teach us the basics of programming. But the only thing we were excited about class for was playing games because we would then get 45 minutes to play games. It was on a Commodore 64 basic, and we were playing this game called Wizard of War. And we would take turns, and we had about five computers. And so in a class of about 40 kids, there would be eight people assigned to one computer. And I always went first, but then that meant if you were in my group, you never got a chance to play because I got pretty good at playing this game.

Betsy Bevilacqua6:41

And so they would just sit there and watch me play. And getting increasingly annoyed or getting increasingly excited because I kept going from a higher level to another higher level and unlocking new ghosts.

Betsy Bevilacqua6:54

Oh, yeah. Yeah. It was like Twitch, you know, but just back in the day.

Betsy Bevilacqua6:59

Yeah.

Betsy Bevilacqua7:00

So I realized that I had an app and I was always the kid who wanted to learn a lot more, learned how to hack our phone system and go right to the PBX exchange outside. And it was just, I realized that's where my passion was.

Betsy Bevilacqua7:21

Yeah, so it was again, like one of these, I love computers, but I don't know what I can do. And at the time, looking around the courses that were available were the certifications for Microsoft. So there's MCSE. Solutions engineer, MCSD, solutions developer. They were very expensive. I mean, the books themselves were, you know, just at that time in my life, something that I would probably have to work for a year before I could even afford that book. And so I started doing some research on what programs were available in Kenyon at the time, not as many for computers or computer science or information systems. And so I would spend a lot of time in internet cafes because we didn't have internet at home.

Betsy Bevilacqua8:25

And so they were always very supportive.

Betsy Bevilacqua8:29

Yeah. I mean, they didn't get it, but they were supportive. Oh, okay.

Betsy Bevilacqua8:33

That's awesome. So my dad, through his work, he was for a long time in the medical device business. And he had some contacts in Buffalo, New York.

Betsy Bevilacqua8:42

And he said, I have a friend in Buffalo, New York. All I heard was the New York part, by the way. I didn't really pay much attention to geography at the time. Okay. He says, I think we can organize, we can afford to send you there for a month and then you can figure out how you're going to pay for your schooling. Well, number one, if you can get in and then pay for your schooling. And I said, fine. And so he talked to his friend and his wife and they said, yep, we'll host Betsy for a month and she can do some tours and all that good stuff.

Betsy Bevilacqua9:13

And that was really the path that opened a door for me because I ended up in Buffalo. And the folks who know Buffalo out there, it's a wonderful place to go to school because it's extremely cold. And coming from a warm climate to a cold climate, being indoors meant I could focus a lot on my studies. And I ended up getting an undergrad. I started off in CS, but then changed my mind midway because I was interested in information systems because it offered a broader set of courses that I was interested in. So it was a little bit of programming, a little bit of database work, and then the business courses, which I was also interested in. How you can apply technology to solve business problems. That's really where my mind was going.

Betsy Bevilacqua10:09

Yeah, so I think today if I was inviting someone, and I do advise people trying to get into the field, that I still think that CS will give you a better base because if you look at where we are today and the problems we're solving, if you have a good understanding of data structures and algorithms and CS teaches you how to think. And also it gives you a good base for, even if it's just very simple programming. So, you know, I find having to do a little bit more extra work than if I had already a CS degree. But at the same time, from a business perspective, if somebody gives me a financial statement, I know exactly what's going on there. So, you know, it really depends on the path that you want to take.

Betsy Bevilacqua11:05

Yeah.

Betsy Bevilacqua11:12

Yeah, so right after undergrad, I went to work at a cable company. So if you're an international student in the U.S., back then you got a year after graduation to work in your field. And so I opted to find some work just so I could see what the real world was like. And I found myself definitely either going to banking at the time anyway, or healthcare. These are the major industries. And then there was this company called Delphia Communications.

Betsy Bevilacqua11:39

I was able to get a job at Adelphia as a technical support representative. Basically what that meant is I got to learn a lot about internet infrastructure because I'm the person you called when your cable went down and got to spend a lot of time talking to people. But we also had opportunities to work with the field techs and do write-alongs. And I really got a good education there on what it takes to provide internet and to bring that into people's homes.

Betsy Bevilacqua12:13

Oh, yeah, this is basic IT. Okay. And I should mention that when I was in college, I also worked in the IT department. So I was a help desk, I was building labs.

Betsy Bevilacqua12:23

So I always had a computer job. That was pretty much how I paid for my meals.

Betsy Bevilacqua12:34

Yeah, it was a lot of fun. I mean, I used to push carts with the all-in-one Macs. I don't know if you remember those.

Betsy Bevilacqua12:41

I got the chance to replace some silicon graphics machines in the CS lab.

Betsy Bevilacqua12:45

Yeah, so I learned how to ghost machines. I also learned what viruses can do in a university once they hit the network.

Betsy Bevilacqua12:52

Yeah. So lots of interesting times there.

Betsy Bevilacqua12:58

Oh yeah. Or even a knack, right? Like what is network access control?

Betsy Bevilacqua13:07

Yeah, so as part of this MIS program, I got to meet, and by the way, I should add, you know, I worked for a year at this cable company, and then I went back and got my master's, I got an MBA. Oh, okay. But within that time, I met a professor who was working part-time for the FBI working on cybercrime. And she was also writing a book on security. And the more I got to know her, I took a few of her classes and I was really interested in what is this security thing? And it's almost as if I'm sitting in class one day and it just clicked. She started to talk to me about trust and confidentiality. And these are things that I had thought of, but never really applied them or even thought about how they would apply into people who are building companies or building systems.

Betsy Bevilacqua14:09

I met her towards the end of my undergrad and because it's a small school and I was always living in that community. So we can say it was between undergrad and the grad time.

Betsy Bevilacqua14:22

Oh, no. Unfortunately, she's no longer with us. She passed, but she was a full professor.

Betsy Bevilacqua14:27

In fact, she was at one point the head of the department.

Betsy Bevilacqua14:32

Yeah.

Betsy Bevilacqua14:33

She taught courses intro to security.

Betsy Bevilacqua14:39

Yeah.

Betsy Bevilacqua14:42

I just happened to have taken it. And back then, nobody was really working on security classes.

Betsy Bevilacqua15:10

Oh, yeah. So it was at that point, it's like, how do I do this for the rest of my life? Nice. Again, back then, nobody was really hiring for security folks. So I get this MBA and then I'm like, okay, what do I do now? And I started applying and I was very close actually to getting a gig at a bank, one of the large banks doing AML, anti-money laundering, which I find it hilarious because... Industry I'm in now.

Betsy Bevilacqua15:36

But I had two choices. Go work in the email industry or go and work at another university. So University of Buffalo as an incident handler.

Betsy Bevilacqua15:46

Yeah. And I said, well, the anti-money laundering thing is cool and all, but I'm going to learn so much more going to this university. And also just the fact that there was room for growth in different parts of security, which by then I started gobbling up all this information about the field.

Betsy Bevilacqua16:02

When I looked at the path, I said, I've probably learned more working on incidents. So that was my first official job in security was a security incident handler.

Betsy Bevilacqua16:13

Yeah.

Betsy Bevilacqua16:22

Yeah, so for the bank, it was a fairly, I would say, easy interview because they were looking for people they could train. You might know a little bit about anti-money laundering controls, but for them, it was, we'll get a bunch of grads and we'll walk them through this path. And the work was very structured. On the security incident handling, and by the way, it's not like there was a plethora of jobs that I had interviews for. It was a pretty tight market at the time.

Betsy Bevilacqua16:57

Only locally. So at the time I wasn't thinking about leaving Buffalo. Okay. So my search was very much focused. And in Buffalo, there's, I mentioned academia, there's healthcare, biotech, there's of course the banking. I think Yahoo had a bunch of, and maybe still does have a bunch of data centers.

Betsy Bevilacqua17:15

But we're talking, you know, this is a long time ago. Yeah. So yeah, so I would apply in a lot of the jobs, like the help desk job. So there's a lot of IT jobs. So if I wanted to be a sysadmin, this would probably have been much easier. If I wanted to go work in insurance, this would have been much easier. But I was very focused on getting a security role and then a security role and in Bufflin that married my possibilities. I even randomly reach out to recruiters and they would say, well, is 10 IT help desk jobs? And I'd say, nope. So, yeah. So the interview process for this particular role, because I had already worked in the academic setting. So I went to Canisius College and then I was applying for a job at the University of Buffalo.

Betsy Bevilacqua18:28

Yeah, you know, again, I was entry level. So sometimes when you're hiring entry level, you want to make sure that the person won't require too much handholding because when you are starting a job, there is need to provide folks a lot of guidance. And sometimes depending on the size of the team, if the hiring manager doesn't necessarily have the cycles to grow someone, then they're probably looking for who can ramp up quicker.

Betsy Bevilacqua19:01

For me, what's really important is EQ.

Betsy Bevilacqua19:05

Emotional quotient. Of course, IQ is important.

Betsy Bevilacqua19:08

But EQ for me is paramount. And part of the reason why I bring this up is in the roles that are in the industries we are in today and just looking at where security is headed, it's really important to have empathy for the teams that you're working with and supporting.

Betsy Bevilacqua19:25

So for me, I look at it as if you already come in with the correct attitude around how we coach people, how we, I love Netflix's approach of guardrails, not gates. I really buy into that because I think you can build a really strong program with that. That as a context. So in any of my teams, I always look for people who are willing to use the word no sparingly and to help advise people, provide people the data that they need to make a good decision. But that means you have to invest a lot in teaching. You have to invest a lot in influencing. And that's not always easy. That's the hardest skill to hire for versus going and getting the top Contestor or Reverse or whatever technical background we're hiring for.

Betsy Bevilacqua20:27

Yeah, it's really hard. I mean, sometimes you can fall into that trap of looking for somebody who's just amazing at their job that nobody wants to work with them. And so then the question is, are they up leveling themselves or the rest of the team, especially if you're in a small company or a small team, you want someone who's going to connect the organization and not just focus on one particular thing and not have influence there. Or even have a negative influence because at that point, building up a team morale can be really challenging.

Betsy Bevilacqua21:03

Oh, was it we're debugging humans?

Betsy Bevilacqua21:06

Is that the word?

Betsy Bevilacqua21:10

Oh yeah. Oftentimes the problems we're dealing with are, yeah, they start off as technical problems, but then you dig deeper and you realize humans are kind of human. So we've been in the business of debugging humans.

Betsy Bevilacqua21:28

Yeah.

Betsy Bevilacqua21:37

Oh, you know, one, just shout out to the people who are living and working in IR. So all the SOC analysts, people carrying around, we don't have pagers anymore, but you've got the app on your phone. I mean, it was interesting. So at the time, AOL was a big thing on the college campus. And we watched, there was one time we watched the AOL warm just take over our network. Oh, wow. We had instances where, because it's a public university, we would have people come in and connect online. They're machines that are living lives of crime because they're part of a botnet and they don't know, you know, the people who own the machines don't know that. And I would have to be the person to send them a note and say, hey, you need to get off my network because we need to fix this infected computer.

Betsy Bevilacqua22:55

It was crazy, right? And so this is how we were doing containment. And then after a while of this, we ended up growing that team, our team, and we hired a security analyst. And between the security analyst, myself, as the incident response, and I think there were two more people involved, the networking team, we started looking at building a NAC, a network access control, like a homegrown NAC.

Betsy Bevilacqua23:20

I think about this now, and now, I mean, these are products that are available on the market. Cisco, I think, has cornered that market. But anyway, so we built this thing, or the network team built this system called NetPass. And the idea was you would connect your device. It would put you in quarantine. You would have to get scanned, and that would, at the time, we were using Snort. Okay. And then we were, because we're a heavy Windows community, I would work then with another Windows sysadmin and we would look at the largest phones. And then, you know, we would pick which ones we cared about. I think we also included a botnet scanner. But anyway, so you'd go into this, you know, jail, your device would go into this jail and you'd get scanned and then you would get a pass, meaning that you'd get out of quarantine.

Betsy Bevilacqua24:08

And there were times that the switch would fail. There were some upgrades that needed to be done. So it didn't always work. It was really, really buggy. But we actually saw good results out of that. And at the time, I didn't realize that we could probably just have done this easier by going to purchase a solution versus... Spending all the time we did to build it. But I learned a whole lot through that experience. And most of what I learned was around how to communicate to people about what was wrong with their devices and then how best to fix them. So we ended up getting a partnership with the campus bookstore where people could go in and, you know, take my letter with them and they would be able to get help, which oftentimes just meant re-imaging the boxes and we were fine.

Betsy Bevilacqua24:51

It's the campus bookstore, but it also was, you could buy like computers from there or you could buy your software.

Betsy Bevilacqua24:58

Yeah.

Betsy Bevilacqua25:08

Oh, yeah. I mean, we're talking about college kids, so.

Betsy Bevilacqua25:13

Lots of patience involved.

Betsy Bevilacqua25:28

Yeah, so some of the things I can share, I was brought in to Facebook after, and this is public knowledge, so Facebook signed what is known as a consent order from the FTC, which basically means that for the next 20 years that Facebook would be required to undergo a number of audits, security audits, as well as provide the results of these audits to the FTC. But at the same time, Facebook was also looking to roll out its workplace product, which is Similar to Slack. And so there were a number of activities going on that meant that for the first time that Facebook would be under a lot of scrutiny from auditors and regulators. And the team was fairly small when I got there. The security team was small, but also the risk, people focusing on risk and compliance and sort of

Betsy Bevilacqua26:38

Yeah. So there was a lot of activity going on and brought in to work with the audit team and work with the engineering team and work with the privacy team. So lawyers as well, because we were also looking at Privacy Shield. This is right when, what is the, I'm forgetting now the name of the law that was struck down to replace Privacy Shield. Safe Harbor. So Safe Harbor was gone. And now there's all of these controls that we put into place that we have to build out and work with multiple groups. And I just loved this kind of work because it meant that I got to spend a lot of time with not just security engineers, but also our product. So people who are building out very nascent versions of features, or even if we're working on an acquisition, helping that acquisition come in and understand how to build on top of the Facebook stack.

Betsy Bevilacqua29:32

Yeah. Yeah. Yeah, sure. One of the things that I noticed was being in security and I got in fairly early. So we're, you know, we're talking 16 years plus at this point. And starting out, when I think about how I attribute my success, it wasn't, yes, of course, I did the work, whether it's studying or at the time it was CDs and buying the books and just, right?

Betsy Bevilacqua29:58

I know. My mind is so blown when I'm like, I can just get a VM. I have my own AWS instance. Right. And I can go in there and play. This is just crazy. It was either too expensive or just not possible.

Betsy Bevilacqua30:29

Yeah. So I did the work, but I also had lots of mentors, people who were very, very generous with their time. So when I left the university, I went to go work at a food and facilities company. And I was a security analyst at that point. And one of my job responsibilities was firewall. I was a firewall admin. And I had taken a few courses, but getting into this job, it's not like I can just go in and start making changes in fraud.

Betsy Bevilacqua30:56

Without much guidance. I'll never forget I had my colleague was a security engineer. I mean, you know, he had been in the industry for a while, but he came out of networking and then got into security. And he basically took me under his wing and he taught me hand to keyboard at the time it was checkpoint, how to change firewall rules and how to configure switches. And when I think about that today and that sort of apprenticeship, without that, I probably wouldn't be where I am today. And I have many other examples of also learning from people when we were deploying PGP, whole disk encryption, to a very large organization of about 7,000 people. And that was my project. Oh, wow. Yeah, I was one of the two engineers who were deployed to that program.

Betsy Bevilacqua32:51

And so I've always taken the point of if somebody has these qualities and they have transferable skills, you can very easily solve a lot of these problems with people who think differently from you. Because I think sometimes in security, if you've been in it for a while, it sort of becomes like a tribe. And then you all think the same way.

Betsy Bevilacqua33:12

Why are we still in 2020 worried about password reuse?

Betsy Bevilacqua33:16

The fundamentals, like something needs to change. And I think that we're going to get there by inviting more people who think creatively about some of these challenges.

Betsy Bevilacqua33:29

Basically, yeah.

Betsy Bevilacqua33:35

Yes, and we don't want bad results. We're already suffering.

Betsy Bevilacqua33:43

Yeah, so there are two that I've talked about were people in my workplace. But I also, once in a while, when time allows, I do have people who reach out via LinkedIn or through mutual connections. Especially, I get a lot of questions from folks who are in audit and are trying to figure out the best way for them to move into more technical roles.

Betsy Bevilacqua34:04

That's something I've noticed, especially over the past three years.

Betsy Bevilacqua34:08

My advice to them is normally if they're in a large organization to make use of the training budgets that are available and then partnering with more technical teams or working with their managers to get more assignments or projects that would expose them to the more technical side of the house.

Betsy Bevilacqua34:27

And also the folks that I'm referring to coming out of audit are looking to get into GRC roles. And I've noticed over the past two to three years, it's been my experience, we've moved away from this idea of audit just being a checklist or GRC as being a checklist. You really have to have that context now to be able to make recommendations, whether you're dealing with risk assessments, Or this idea of compensating controls. It's not just so you can just throw these words out there without some guidance for a lot of the engineering teams. And so a lot of these roles now require you to have that technical context to be able to help guide these conversations on both sides. That's really where I advise them.

Betsy Bevilacqua35:43

Yeah, that's a good question. So I think today more than ever, there's a lot of groups that people can join and you don't even have to be there in person. I mean, we're now all mostly confined to our homes, but there's lots of digital communities. One of my favorites is WISIS Women in Cybersecurity. There's Blacks in Cybersecurity. There's a number of communities that you can join that don't cost money where you can network and The idea of mentorship, it doesn't have to be something where you're building or you're investing so much time with someone. You could have the micro, I'm just calling it this, you know, the micro mentorship where if you have a specific question that you'd like to get answered, that you approach someone through those networking channels and just ask that one question.

Betsy Bevilacqua36:35

And they don't know. Right. And I say you have to do the work first. You have to decide what it is that you want to get out of a mentorship relationship.

Betsy Bevilacqua36:44

And then zero in on that because it could be that you have a number of people who can help you. It's much easier if you're coming to ask me a very specific question versus if you're coming to ask me a number of questions to work with you to identify. Right. It maybe sounds harsh, but at the end of the day, even the people you're approaching as mentors, they probably have a number of other competing priorities and they can't always extend the energy. But if you can at least just get one or two questions answered that will take you down a specific path of more self-discovery, then that's better than nothing.

Betsy Bevilacqua37:34

Yeah.

Betsy Bevilacqua37:37

Yeah. And I think people are pretty generous with, I mean, I guess it depends on the digital communities we're talking about, but I even see people on LinkedIn who will just, if you share what your dreams are.

Betsy Bevilacqua37:48

That people are willing to just help.

Betsy Bevilacqua38:09

One, I love that right now we're in fever pitch with this message of diversity and inclusion. And actually, something that I saw this morning that really warmed my heart was we've started seeing discussions around the language we use in technology today.

Betsy Bevilacqua38:25

And somebody said, it was in a Slack thread somewhere, said, I want us to think about how we put certain topics. And they gave the example of master and slave. And this was in relation to GitHub, right?

Betsy Bevilacqua38:37

And, you know, even in security, we have a lot of these, the language that is, I'll call it legacy language that will attribute negative characteristics to the color black. You know, so we have a black hat and the white hats and the gray hats and And so I think a lot about this and I think about from a technology perspective, people coming up through the industry and what does this language do to your psyche? You know, because I remember the first time somebody said master slave and they were referring, I think it was a database or something.

Betsy Bevilacqua39:06

Right. And I remember being taken aback and I was like, wait, what? And then all of a sudden it just became so commonplace that I started using it.

Betsy Bevilacqua39:16

Right. So this is something that it will take a long time to fix, but just being conscious of it.

Betsy Bevilacqua39:23

Sometimes even the words that we use in an industry can have a negative impact on people who are hearing them for the first time and might be taking them out of context. We should be thinking about how to make changes there.

Betsy Bevilacqua39:38

Yeah.

Betsy Bevilacqua39:45

Exactly.

Betsy Bevilacqua39:54

No, thank you. This was a lot of fun. And thank you for inviting me. And I hope that this will be helpful and useful to folks who are looking to get into the industry.

Betsy Bevilacqua40:07

Thanks.

Betsy Bevilacqua40:07

Thanks.