Episode 32 · · 39 min
Kavya Pearlman From Hairstylist to CISO to XR Superhero
Founder and CEO of the XR Safety Initiative (XRSI)
Episode summary
Kavya Pearlman is an award-winning cybersecurity professional with a deep interest in immersive and emerging technologies. Kavya is the founder of the non-profit XR Safety Initiative (XRSI). XRSI is the first global effort to promote privacy, security, ethics, and develop standards and guidelines for Virtual Reality, Augmented Reality, and Mixed Reality (VR/AR/MR), collectively known as XR.
Kavya is constantly exploring new technologies to solve current cybersecurity challenges.
Quotes:
"Money, money, money. How much money [are] you going to make? I was so put off. No, it's not about money. I really just want to learn."
"What would you become when you grow up? I would be a D.I.G. (Deputy Inspector General)."
"This country needs me. This world needs me."
"You owe it to yourself to explore this little itch, and figure out whether this is your passion or not."
"You will inevitably make (sometimes) bad decisions."
"Technical support IS security."
"I don't think anyone read that [report], but then it gave me some satisfaction that this is awesome. I can actually take what I'm learning and apply it to the job."
"Believe in yourself. Not just for information security."
Before infosec: Hairstylist, after call-center and tech support work in India
Chapters
- 0:00
Intro: Kavya Pearlman and her career twist
Ayman introduces the former hairstylist and previews her advice on failing forward and being uncomfortable.
- 1:29
What the XR Safety Initiative does
Kavya explains extended reality and XRSI's mission to build safe virtual environments.
- 4:34
Privacy, gaze data and abuse in XR
She gives examples of data collection, manipulation and harassment in virtual worlds, including her own experience in VR.
- 11:29
From India to hairstylist to the book Cyber War
She describes tech work in India, a cosmetology license in the US and the customer who gave her Cyber War.
- 16:48
The childhood dream of a deputy inspector general
Her sense of ethics and a childhood wish to bring bad guys to justice drew her to security.
- 21:44
Master's in network security and failing forward
She describes a difficult first year at DePaul until a convergence class made the pieces click.
- 24:30
Interviews and the tech support bridge job
A part-time university tech support role and repeated interview failures led to her first security work.
- 27:35
How hairstyling built customer service skills
She explains how people skills help in boardrooms and with engineers.
- 29:04
An unrequested incident report at an MSP
She treated a client's DDoS attack as a security incident and wrote the report on her own initiative.
- 31:32
How to help XRSI
She describes the XR data classification framework meetings and how volunteers can contribute.
- 34:58
Parting advice: believe in yourself and persist
She urges listeners to trust their gut, expect constant change and be okay with discomfort.
- 38:09
Closing: Ayman's new community
Ayman thanks listeners and plugs his new community.
Key takeaways
- Fail forward: finish the course or project even when it feels impossible, because understanding often arrives much later.
- If you are curious about security, explore it part time to find out whether it is your passion before changing careers.
- Connect your old career back to technology through a bridge role such as help desk or university tech support.
- Prepare for interviews by researching likely questions, even basics you have forgotten, and expect to fail several before one succeeds.
- You do not need security in your job title to do security work, so apply what you learn wherever you are.
- Soft skills such as customer service and communication matter as much as technical depth, especially when delivering bad news to executives.
Notable quotes
You owe it to yourself to explore this little itch and figure out whether this is your passion or not.
everybody who aspires to be a security professional is always fail forward.
technical support is essentially security.
Questions answered in this episode
- How did Kavya Pearlman get into cybersecurity?
- A hairstyling client who worked as a bank security analyst gave her the book Cyber War around 2011. She then earned a master's in network security at DePaul University, took a part-time tech support job and moved into network and security analyst roles.
- Can you switch to cybersecurity without a technical background?
- Kavya did, though she had a computer applications degree from India and earlier tech support experience. She recommends finding a bridge role such as tech support, preparing hard for interviews and being willing to feel uncomfortable while you learn.
- What does the XR Safety Initiative do?
- XRSI is a nonprofit working on standards for privacy, security and ethics in virtual, augmented and mixed reality. Projects include an XR data classification framework that covers data such as gaze, pose and biometrics.
Show notes and links
Show the original episode notes
Kavya Pearlman is an award-winning cybersecurity professional with a deep interest in immersive and emerging technologies. Kavya is the founder of the non-profit XR Safety Initiative (XRSI). XRSI is the first global effort to promote privacy, security, ethics, and develop standards and guidelines for Virtual Reality, Augmented Reality, and Mixed Reality (VR/AR/MR), collectively known as XR.
Kavya is constantly exploring new technologies to solve current cybersecurity challenges.
Quotes:
- "Money, money, money. How much money [are] you going to make? I was so put off. No, it's not about money. I really just want to learn."
- "What would you become when you grow up? I would be a D.I.G. (Deputy Inspector General)."
- "This country needs me. This world needs me."
- "You owe it to yourself to explore this little itch, and figure out whether this is your passion or not."
- "You will inevitably make (sometimes) bad decisions."
- "Technical support IS security."
- "I don't think anyone read that [report], but then it gave me some satisfaction that this is awesome. I can actually take what I'm learning and apply it to the job."
- "Believe in yourself. Not just for information security."
Links:
- Kavya Pearlman - https://twitter.com/KavyaPearlman
- XRSI - https://www.xrsi.org/
- Caroline Wong - https://twitter.com/carolinewmwong
- Steve Hunt [22:17] - https://twitter.com/Steve_Hunt
Getting Into Infosec:
- Breaking IN: A Practical Guide to Starting a Career in Information Security: https://www.amazon.com/dp/B07N15GTPC/
- T-Shirts, Mugs, and more: https://gettingintoinfosec.com/shop/
- Stay in touch and sign up for sneak peeks, updates, and commentary: https://pages.gettingintoinfosec.com/subscribe
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
You know, when I move forward, there is a term in our software industry is called fail forward. And I recommend that for every cybersecurity professional, everybody who aspires to be a security professional is always fail forward. And I think it's true for any career.
Welcome to Getting Interned for a Sec. I'm your host, Eamon Ossawa. My guest this week is Kavya Perlman. Kavya had an interesting career twist.
I used to be a hairstylist. Think about it. I was cutting hair for $10 an hour. So it's like, I really need those people to come back to me. And I had to really understand how to relate with people, you know, how to provide them a good, excellent customer service.
Customer service is such an asset in our industry, more than many people know, both junior and senior. Just like many of my guests, all of our experiences came together.
Every technical, psychological, everything that I had learned in college, plus my previous experiences, they all came together.
She also shares some valuable truths.
Be okay to be uncomfortable. So many times there are situations when you don't know and Google does not give you the answer. You really have to think and know and dig and really investigate.
All right, on to the show. Hi, Kavya. Welcome to the show.
Thank you, Eamon. It's so great to be here.
Great. Yeah. Thank you for coming on. So for those who don't know, maybe you could walk us through, I guess, who you are and what you've done with security lately.
It's funny. I have, Ayman, recorded a few podcasts before, but this would be the first podcast where I would proudly be able to say and sort of own the role that the industry has sort of put me in. A lot of the people are calling me a cyber guardian, which is interesting. In fact, it took me a while to sort of own up to it because, you know, we all have a little bit of this hunch, a little bit of this hesitation. Am I up to the expectations or not?
Right.
So almost fairly recently, I started to own up to it. Anyhow, currently, I am the founder and CEO of XR Safety Initiative. XR Safety Initiative, it's a nonprofit. It started with an idea that we are moving towards a different type of reality. And XR, as you know, is extended reality. What is extended reality? It's, you know, a combination of various types of simulated, you could say, augmented reality, virtual reality, mixed reality.
So XR is the acronym catch-all for AR slash VR slash MR, right?
Exactly. Exactly. So even though, you know, as an industry, we haven't even come together and admitted to that per some kind of written standards. But that's precisely like that's like the very minute example of what we are doing is standardizing these terms.
Okay.
All the way to standardizing privacy, security, and ethical aspects in these type of environments. So, I mean, if I were to put in a sentence, XR Safety Initiative's goal and the mission is to help build safe virtual environments.
Okay.
Because we are moving to this extended reality. We are inevitably going to be utilizing some sort of interface, whether it is contact lens. I mean, at the moment, we are in the era of putting these head-mounted displays, HMD goggles to experience these alternate realities. But at some point, we are kind of moved to the direction where these interfaces are quite seamless, even though they may still be HMDs, but they would be seamless. And the question we've got to ask is, are we going to wait for all the way to that point to start thinking about security, privacy, and ethical issues? We can't afford to wait until then. We have to start now to think about the negative, the unintended consequences of what could go wrong in these type of environments.
And then right now, as we are building these technologies, the software, you know, the overall development, the, you know, code of conduct, the impact overall on us as emotional or social human beings, all of these aspects have to be thought through. And that's kind of what my mission is at the moment is to be able to guard against these unintended consequences wherever they come from.
And what are some of these examples?
So there are several examples. Let me give you a little bit of each segment's example. So if you talk about information security, we should think about the kind of data that these devices or the companies or the platforms are collecting. So we are experiencing reality through this digitally coded environment. Either they're overlaid on our existing reality, which is augmented reality, Or they are completely digitally created artificial environment, which is VR. So whenever you dive into these environment, whenever you're experiencing it, you are inevitably giving out data about, you know, sometimes you're giving away voice data, you're putting sort of your behavioral data, the way you walk, the way you gaze on some things, the way you pose, of course, biomatrix data.
And, you know, these devices are now moving on to tracking your eyes and all of this. So Of course, that is also a concern is be able to track how you perceive things. And I mean, just about yesterday, Google had rolled out a particular project where they are going to place a particular cube that if you're in a VR environment, AR environment, if you gaze at that cube, it will open up and it will play a YouTube video. And think about that. So if I'm an organization already had some of these data-related issues where companies are collecting massive amount of data, they share it with third parties, and then what happens is these third parties misuse that data. So these kinds of issues, we have to identify them early on because what happens when big tech or even a small company has this gaze data?
They can potentially manipulate you into looking at something that you may not want to or persuading you. Think about, you know, hey, I want to push now Pepsi commercial. Like all these ads could be placed in these virtual environments. And then we go on to the issue of privacy is we have this consent in these platforms, which is social platforms these days. We don't have the ideal version of social VR quite yet, but we're getting there. So when these social media companies or these social platforms move to VR, move to AR, we're going to have the same issues. We're going to have the same companies or similar people taking that data to persuade us to, hey, now buy Pepsi or now buy this thing.
Right. And they're going to use it against us. So those are like, you know, things that I think about. And then there is the ethical aspect of XR, which is, in fact, I'll take an example for this. When I was working at my previous organization, which is Linden Lab, and those of you who don't know Linden Lab, it's known for its oldest virtual world called Second Life. Second Life started about 16 years ago, and they've had tremendous amount of experience in terms of virtual currencies, all of that. In 2017, they started their VR portfolio called CNSR. I was absolutely interested. I used to spend a lot of time in that environment. One of these days, I encountered abuse. So somebody actually just literally yelled at me and screamed at me and used all sorts of swear words.
Oh, wow. And I was really taken aback. That was like very early on the first time that I experienced abuse in virtual reality. And it just ticked me because, you know, for whatever reason, my childhood was not like the ideal childhood. And it triggered a lot of trauma sort of thing, which I didn't even realize. Like, you know, for three days after that, in fact, probably more, I did not step into VR.
Oh, wow.
And it occurred to me, I'm like, wow, if this is what's happening to me, there are people, I mean, we are all human beings. We have various experiences, various past experiences, trauma. So then I started to think that, okay, well, this technology has positive impact, but it also has a negative impact. And especially in the social settings. So the way human beings behave with each other, they could yell at each other, they could harass each other, they could bully each other. These are like some of the ethical aspects that would inevitably come into these environments and we have to be ready for it.
It's like all the garbage of the internet in words now translated to VR.
Exactly.
Wow.
Because it really isn't too far away from the real world. You know, when you talk about the impact on our brain, whether it may seem like it or not, the impact is literally same as experiencing something in real life.
Okay, wow, that's pretty heavy. So yeah, I guess, you know, when you have private VR developers, do you have the same like biases as you know, because there's a lot of news about like game developers, and they have biases and the companies and etc. Does that exist in the VR space? And does that come under, you know, trust and privacy?
I think so. Absolutely, it does. In fact, one other story I want to tell is I was at Augmented World Expo and I wanted to try different VR experiences, you know, everybody is showcasing. So I dived into this one. It was an environment, it was a prototype. Somebody created a sort of a baby. So you put on a headset, you're transformed into an environment where you're actually a little child and the child is literally crawling. And obviously these game developers aren't thinking about what if somebody really had a bad childhood? And honestly, it freaked me out. I was like, what is this? Why am I a baby? And he told me that for some people, it's great. They love it. For me, I could not stay in that environment for more than 30 seconds.
I was like, get me out of here. However, then I asked the person, I was like, What about the ethical implications? What about the long-term impact of these environments? What about any disclaimer that you're about to become a child and experience your surroundings as a little six months old baby? And he's like, you know, those are good points. And as independent developers, I mean, he was a Caucasian dude. He was like, I never thought about it. So then we come into this other aspect of having diverse voices and experiences. Those are the things that are going to allow us to look at these technology development differently. And allow us to incorporate these unintended consequences and go about it that way.
So, you know, if somebody with a negative experience in the childhood comes into this, they at least have a disclaimer and they're not like completely surprised. Or what if it's a horror movie or horror environment? What if I don't want to see that? So those type of disclaimers and, you
Is something already lacking in our existing platforms where you just check a box, you accept the TOS, you accept the privacy policy, and you just dive right in. Whatever happens with the data, whatever happens to somebody tracking you, your gaze or your heat map for the different screens, all of that is something you don't even think about.
Interesting. So let's shift gears for a second and talk about how you came into infosec. I think your path into infosec is very interesting. I've heard it before, but maybe in your own words, describe to us what you did before infosec and how you got into the field.
Yeah, it's a very interesting story. And I must thank my dear good friend, Caroline Wong, who was the first person to encourage me to talk about my story.
Yeah, she's awesome.
She is great. And most people who are in AppSec, infosec, DevSecOps, they know who she is. She's a superstar. I sent her a message on LinkedIn about some kind of a thing. And she was like, no, your story is awesome. You should tell it. So, talk about my story. And then that's when I started talking about that I used to be a hairstylist. And what may sound like previous life, it wasn't too long ago. It was about 2011. And then I have to really talk about a little bit before that because originally I'm from India. I grew up in India. And until about 2007, I was in India. So, around 2007, I moved to the United States. And I had a bachelor's in computer application degree. And I had done a little bit of troubleshooting type of tech support for Microsoft HP back in India.
So you did have a career in technology, or you started off your first career, I guess.
Yeah, I wouldn't actually call it career. So let's put it this way. I did my BCA, which is bachelor's in computer application. I was always curious about technologies. But then when it came to getting a job, I just couldn't find a tech job. So I ended up working for different call centers, various odd jobs. And, you know, another reality back then growing up in India was that my English wasn't all that great. I couldn't even have a conversation with you in English. So it took me a while to get to a sort of corporate level standard, be able to work in a tech environment. I finally ended up doing that for like last six months in India in 2007. But then I moved to the United States and I was like, you know what?
I can be anything I want. I was really fascinated about the idea of America is a free country. You can have any religion. You can be anything that you want. You can pursue whatever dreams you want. So I felt really empowered. And I was like, you know what? I'm just going to be a hairstylist. In fact, at that time, I felt like, oh, that's my passion. Like I want to be some creative or something.
Right. That's great. That's great.
Yeah, so I ended up, you know, getting cosmetology license and pretty much for about four to five years, that's exactly what I was doing. I was just cutting hair. And I started out at a really upscale salon, but I ended up doing like a $10 an hour for 25 hours a week type of work.
Very simple life, you know, just enjoying my life, a lot of hanging around, learning the culture. It was great. It actually really helped me, you know, coming from a different country, this culture can be overwhelming. And this was a perfect job to be able to interface with all sorts of walks of life, stories from different people. It was like a perfect setup to give me that primer into this new culture.
Yeah, that makes sense.
Yeah. So how did I get into infosec? Well, that's kind of where the infosec door opened, where one day I was cutting hair for this gentleman. He told me he was a security analyst at a bank. And I was like, oh, interesting. I thought he's like really, really smart guy. So we ended up talking and then when he's leaving, he's like, hey, you sound really interesting. Here's a book for you. It's called Cyber War by Richard Clark.
Oh, okay. That's awesome.
And I mean, you would think like, you know, what is a hairstylist got to do with cyber war? But that's how the conversation ended. I went home, downloaded the PDF, found it interesting. I bought the whole book. And then I think within like a matter of a week, I knew. That I just want to be a cyber security officer. It was so clear to me on that day that's what I want to be. So I obviously made effort to be able to get there. And in 2011, there weren't that many resources. There were no coffee with Amon. Where people could listen to stories and figure out like what is a hairstylist supposed to do or a nurse or anybody, you know, who is like without a tech background. We didn't have these things.
We didn't have that many YouTube videos where people were like, hey, I used to be this and then I got into infosec.
That's right.
But we did have Google. So I Googled like top 10 cybersecurity colleges and one happened to be in Chicago where I was at that time and ended up doing my master's in network security. And that sort of put me on the right track to be able to pursue this career.
That's awesome.
And mind you, I actually went to one other college and I'm not going to name it, but the very first conversation these guys started to have with me is like, oh, wow, that's great. How much money are you going to make? This much money, money, money. And I was like, so put off. I was like, no, it's not about money. I really just want to learn. Tell me how competent you are. What kind of knowledge am I going to gain? And so the next school that I went to, DePaul University, and they had this, you know, they were like the NSA Cyber Excellence Program Register or something, which is a very good honor. So that happened to be the place that I wanted to be at for the sake of knowledge.
That's awesome.
Yeah.
And did you always have a knack for security? I mean, obviously, this person that recommended the book knows that you're a reader, that you're a curious person. But, you know, were you doing security stuff, like even in your own personal IT environment?
So the truth is not really. But the one thing that I had, which if I reflect back into my life now, is ethics.
Okay, there you go.
Even as a child.
It's always something.
It's something, right?
Yeah.
It was like a very, and this is the first time even mentioning this on a public sort of avenue. It was like a deeply hidden dream. As a really, really young child, if somebody asked me, hey, beta, what would you become when you grow up? I would tell them I would be a DIG. And what that was is in India, there is something called a deputy inspector general. I had seen a TV show. So in this TV show, this lady, she was in all this uniform and she was a deputy inspector general. She was taking out the bad guys in India and bringing people to justice. So that just impression stayed in my head. But when I became a cosmetologist, I was like, oh, that ship has sailed.
Mm, I see.
So with that sort of mindset, when I'm reading this cyber war, I was like, oh my gosh, this is it. I'm going to live my dream.
Yeah.
Yep, exactly. It brought it back. So that sort of ethical balance, the compass guided me. But at the same time, cyber war, if you read, it tells you that in future, we're going to literally fight war, which we are now. Mm-hmm. At the front of like information warfare, not just hints that it literally tells you. And the book was pre-Stuxnet. Stuxnet is one of those viruses that, you know, really changed the game of cyber warfare. So this is pre-Stuxnet. When I read that, I was like, oh, wow, I think this country is going to need me. This world is going to need me. I don't know if you believe it, but that's how compelling this cause was for me. And at the same time, I was like, okay, I couldn't be a DIG, but I'm going to be a CSO, a cybersecurity officer.
Right. You had somewhere to channel that energy, that energy this whole time. You're like, oh, this is where I could spend my energy basically, right?
Exactly. And, you know, this is what I tell people when some students or people from different backgrounds, they come to me sometimes at conferences and they're like, hey, I'm really curious about security or I don't know if I can do it. I say, you know, hey, if you have any intuition, if you think that you want to explore, just do it part time. You owe it to yourself to explore this little itch and figure out whether this is your passion or not. And that's the important piece, is to discover that sort of spark and fuel. And if you discover that, I mean, yeah, the conversation shouldn't start from money. But yeah, money is not a problem in our industry if you have the zeal for it, if you're a problem solver.
And then you would absolutely never be bored. You'll do good work. And it's such a needed, like this is the work that we really absolutely need as humanity. We're diving into all these fascinating artificial intelligence, you know, distributed ledger technology. We're talking about XR, like all of these technologies are opening up these new doorways to cyber securities.
Yeah.
Uncharted territories that we must investigate.
Yeah. So let's talk a little also about your childhood. Walk us through, you know, so you mentioned the DIG, I guess you probably watching some sort of law and order equivalent in India. Were you exposed to technology when you're younger? Like any other technical influences when you're younger?
There are actually quite a few instances that I remember. If anything broke in our house, and I have two brothers, but I would be the person to be called upon to fix those things.
Nice.
And things would break often. We're talking about, you know, back in the day. So if an iron broke, I'm like, okay, here's a screwdriver. Let's fix this. Oh, great. If there is a loose connection, you know, electric, all of this. And just about, I think it's a high school. And I was really great with languages. So I was really good with Sanskrit and other Indian languages. Everybody told me to, you know, hey, do your biology or be a doctor or engineer. But only thing that I wanted to do after I saw a computer, I was like, this is my life. I don't know how. I've always had this intuition and the willpower to, one, by intuition, find where I'm supposed to go. And then using the willpower to absolutely pursue that.
So I absolutely threw a tantrum to my parents who didn't know what the hell is computer science. And they were like, well, what does this girl want? But I was like, no, mom, if I'm going to study any further, this is what I want to do. So I ended up taking computer science as major and just learning technology. So I think I was always interested in this sort of technological aspects.
Nice. I think you hit on the head there is about persistence. And, you know, like, say, for example, even you're trying to fix an iron. Right. So you have the hacker mindset. You're like, I can fix this. But, you know, you're not going to always get on the first try. I'm sure. Right. Yeah. So having the hacker mindset to persist and fix and, you know, kind of go through it. Right.
Exactly. In fact, it came up quite often. So imagine, you know, you've completely sort of gotten away from IT or computer science and then moved into hairstyling for about four or five years. That's all I did. So when I went back to master's in network security, I mean, you're talking about reading packets off the wire. Doing port scans, packet tracing, building signatures for intrusion detection systems and all that. This was very complicated. This was very tough. In fact, in so many of my first six months or probably almost a year, so many of my classes, I just sat there and I thought to myself, I'm like, oh my God, am I ever going to be able to understand it to the point that I could actually be a cybersecurity officer?
What was that feeling?
Oh, it's very uncomfortable. It's very uncomfortable, especially if you are a person who believes and wants to excel at something. So if you always have been like somebody who's like good at stuff, it's the kind of feeling that we all get when you have like a new job, right? Feel like a fish without the water, even though you may know a lot of it, but you're still going to have this sort of uncomfortable territory where you're like, oh my gosh, I don't know if I would be able to do this. It's a little bit of a self-doubt.
Did you ever feel like giving up?
No.
Okay.
Yeah, I don't know. But I have always been a person who, you know, when I move forward, there is a term in our software industry is called fail forward.
Okay.
And I recommend that for every cybersecurity professional, everybody who aspires to be a security professional is always fail forward. And I think it's true for any career is fail forward. Sure enough, some things may not work out, but just persist and see it to the end. Like make sure that you have already completed that course. Don't give up in the middle. Because you would always wonder, what if I had taken it to the end? Maybe I would have succeeded. So those were uncomfortable times, classes that I sat through. And I was like, oh, my God, it doesn't make sense. It doesn't make sense. But then one day, one day, there was one class that I took. And it was talking about convergence of IT and security.
My amazing professor, Steve Hunt, who is, by the way, now an advisor for XR Safety Initiative. How cool.
Oh, cool. Nice.
Yeah. So he was teaching this convergence class and a light bulb just went into my head. And I was like, wow, every technical, psychological, everything that I had learned in college, plus my previous experiences, they all came together. And I really understand how these dots connect, how we're supposed to think about cybersecurity and this other ethical privacy, all of these aspects. It was just amazing to really, that was the class. And it happened almost after like a year and a half later.
Oh, interesting.
After I started college. So it takes time. It takes time, but you'll get there.
Yeah, that's so wonderful. And so after you finish the program, walk us through the interview process. And, you know, was it difficult? Was it easy? You know, some challenges that you might have went through and things that maybe would have made it go faster, you know, if you on hindsight for that first job.
For sure. And this is another point of advice for anyone who is trying to come back to IT kind of career or security career, or who is trying to just first time take on this career, is you have to really try to connect the dots back to technology. So how does a hairstylist go from hairstyling, creative aspects to technology? In fact, I heard your interview with the infosec Sherpa, and she used to be a librarian. And, you know, it's a very similar thing that we all have to think about. If we're coming from a non-technical background, how do I go into technology? So what I did, where I kind of got lucky, I picked up a tech job at the university. It was literally just like 10 hours of doing technical support, fixing servers, doing remote monitoring, fixing some of the endpoints and all that.
So that was the interface that connected me back to tech. And then once I finished my grad school, then I was able to do some network analyst and security analyst type of work. And the interview, let me tell you that my first interview when I went to for that technical support job, I basically prepared for the interview, searching all of the stuff they could possibly ask me. Because, you know, you forget things. I googled, what is an IP address? I was ashamed to do that. But I was like, you know what? I've forgotten all these concepts. And I prepared for this interview. And it was very uncomfortable to admit that I don't know all this. But take that leap and research, learn. And I think interview process can be challenging.
But if you prepare, if you know that who you're speaking with, if you know the level of complex questions they may ask, there's always a chance and you have to go for it. One of the interviews, which was the critical interview, was security operations, you know, SOC analyst interview. And thankfully, by that time, I had learned enough basic skills from college. And I've had a little bit of an experience doing network analyst type of work, some tech support. And that sort of paved the path. But let me tell you, I had to give at least a few interviews, which means I had to face a bit of a failure at least four or five times, which is normal, you know.
Right.
Sometimes people get really disheartened when they feel like the big interview. And I've got friends who literally call me and are very sad because they feel this Facebook or Google or this other interview as a or they couldn't get an internship. And it's their first time. And I'm like, that's great news. That means you're like one step farther. Or one step forward.
Closer.
Yeah, closer to whatever you want to achieve. And that's the way we have to look at all this is failures. Sometimes, you know, when you are actually in the game, you will inevitably make sometimes bad decisions. Failures will happen. Your technical competencies are not always going to be right. But again, as I say, you have to fail forward.
And the four years and plus of hairstyling, I mean, that's like excellent customer service, right? You have to learn good customer service to be a good hairstylist. And so how does that apply now to your career in information security?
It certainly does. So I think I mentioned, you know, the whole cultural aspect. So if you're coming from a different country to the United States or, you know, just changing your culture overall, that sort of interface with various people sets you up for being able to relate with people. And I mean, you think about it. I was cutting hair for $10 an hour. So it's like I really need those people to come back to me. And I had to really understand how to relate with people, you know, how to provide them a good, excellent customer service. And those aspects are always going to stay with you because that's part of the job. And these are the things that come handy in customer service. So now that I'm, you know, at times when we have to speak to the board to give bad news, or you have to relate with software engineers, you have to relate with different managers, managerial type of roles, all of that helps you navigate these things, helps you with the human aspect of information security, cybersecurity.
Mm-hmm. And that is very, very essential. A lot of people have a lot of technical knowledge. They are excellent. They could be a great pen testers. But when you put them in front of people, they're really like a fish without water. And that's the aspect I think that four years, five years of hairstyling, oh my gosh, I have absolutely no regrets. I would do it all over again the same. Yeah, it really helped me out.
That's awesome. That's really good. Do you have any war stories from your time in security that you can talk about? Either interesting incidents or anything like that?
Hacker war stories, interesting incidents.
Yeah, that you could talk about, you know, either a time that you covered some sort of security incident that happened or anything like that.
I've covered a lot of cybersecurity related active attacks and incidents. So before my core security job, you can call it the intermediary job where I was working for a managed service provider.
Okay.
And I was also going to grad school. And this is something that could happen to a lot of people where your core job is not really security, but it's technology. You could be an IT admin. You could be somebody just coding in the part-time or something. Mm-hmm. But around this time, I was working for MSP and one of their clients had a denial of service attack, like a DDoS. And since I was going through my grad school, I was like, hey, you know what? This is an incident. And, you know, 2012 or something, they didn't really care. I was like, no, we need to write this incident report. And while my bosses really didn't care or understand, I collected two of the tech support folks and I started to write that incident report.
And nobody cared. But I really just, you know, on my own, wanted to standardize these things for this managed service provider who didn't really focus on the aspect of security at that time. My job wasn't it. But wherever possible... I think that's probably the passion part. It came across as that I wanted to standardize these things, instill security wherever I was, even though it was not a core security job. And so I ended up, you know, sort of investigating where the traffic was coming from. Okay, at that time, I'd recently learned about blackholing a traffic. So we further investigated together. It's like, okay, what can we do? Or we already actually mitigated that. And, you know, technical support is essentially security.
Frontlines.
Exactly. You're trying to protect the confidentiality, integrity, and availability. So I had to just tell those guys, I'm like, hey, this is a security incident. We are trying to protect availability here. And they're just looking at me like, this girl is crazy. He's like, hey, our job is done. Go home. And I'm like, no, no, no. Let's prepare an incident report. And I don't think anybody even read that. But then it gave me some satisfaction that, you know, this is awesome. I can actually take what I'm learning and apply it to the job.
Yeah. You don't need security in your title to do security.
Exactly.
Yeah, that's awesome. That's really good. So with XRSI, it's a nonprofit, I'm assuming. And you know, how can people help you in this initiative?
Yeah, since it is a nonprofit, we absolutely need a lot of help. And one thing that you just said, that in order to do security, you don't have to have security in your title. But that's the other truth about cybersecurity, information security. It's not just the security work. There is a lot of other aspects, the dots that have to be connected in order to deliver that core objective.
Mm-hmm.
So, you know, we need to fundraise. We need to be able to interface with organizations that are international and that are in the same type of environment because we don't want to have to re-spin the same or reinvent the wheel kind of thing. Right. So we want to utilize their resources. So, you know, currently we're talking with organizations like National Cybersecurity Alliance, Stop Think Connect type of campaigns. Right. So when we're trying to connect these dots, we obviously need people. I'm just alone. And then we have few advisors, but then we need people to be able to reach out. There are so many different spectrum of skillset and just overall a diverse input from, you know, I could think about technology one way.
I absolutely need other perspectives to contribute to it. And, you know, with that same mindset, Abe, Regine, those are the other co-founders of XRSI. Mm-hmm. We've tried to put together a really amazing team, but we still need more people to contribute. And the people are really excited they're coming together, actually, because one, they want to learn about emerging technologies and all these immersive environments. The second thing is it really gives you great experience and to just be around these awesome set of people. It will help you think differently. It will help you think security privacy. So there are a lot of good benefits that you can gain out of working for us.
Yeah, I think there's a lot of work to be done here. And with any emerging technology, it's going to take a lot of wrangling and getting kind of the vendors all on board. And I mean, just like anything in security, it's good to get ahead of it early than late, right?
Exactly. And, you know, one of the projects that we're currently working on is this XRDCF project. It is XR data classification framework. And that's like the easiest thing anybody can do right now is every Thursday we meet up and we talk about how should we classify this type of data. Now, everybody talks about gaze data, pose data, biometrics data. What does that look like at the database level? What kind of encryption should be put on it? If you are destroying the data within, you know, like if it's an ephemeral data, do you really need an encryption? Like all these kinds of questions we're trying to solve. And every Thursday we meet these people. You could be a software developer. You could be, you know, some people are literally just no technical background, but they dial in just to sort of listen into and learn how we are approaching these problems.
And that's like the easiest one. And then you could actively contribute to be such as, you know, one of my mentee, Emily, she reached out and she's like, hey, I really want to contribute. And she's helping me interface with external partnerships, you know, all the way to EU commissions sometimes when we have to talk to these people. She can help set up some of these calls, be the frontliner to like open up doors and then bring me in to have the core conversation. So, you know, those are all kinds of things that people can work on and pick up on the security mindset, eventually build up to become the core security person.
That's awesome. That's really good. Any parting advice for those out there looking to get into the field?
Oh, yes. And I think I would go back to and refer to my previous experiences. And first of all, believe in yourself. And that's not just for information security. If you want to pursue anything, people want to pursue music, art, anything, you have to believe in yourself. Even before information security, I wanted to do cosmetology. If I hadn't pursued that, I probably wouldn't have arrived at the moment of reading Cyber Wars. So you know just go with your gut believe in yourself anything is possible so lately you know since about 2016-17 I've had the honor and the privilege to receive several awards so what I say is what you do in private and quietly and put your mind to put your hard work to people would then recognize you in public for it and that's why like you know I've gotten several awards for my work and
That is now is sort of a testament to, you know, I persisted. I pursued. I didn't care about, hey, am I talented enough to do security? This field is more about skills. You will become talented eventually, but like it's really about acquiring the soft skills, the technical skills. So pursue this field and persist and keep going and you will be able to be successful. I guarantee you. One of the things we have to think about when you're going into this change is inevitable in this field, which you can perceive twofold. You can think, oh my gosh, no matter how much I learn, it's always going to change. But that could be a good thing. You'll never be bored. You'll always be learning new things, solving new problems.
That challenging aspect, it should be a driving force. It should be like, hey, I can do this. And be okay to be uncomfortable. So many times there are situations when you don't know and Google does not give you the answer.
Right.
You really have to think and know and dig and really investigate. So it's OK. It's OK to be uncomfortable for a while and then you'll persist. You'll get to the comfort zone. So some of my advice is, you know, just don't give up. Yeah. No matter what you do is you have to persist. You have to continue. You have to learn. You have to just keep at it.
Right. That's awesome. Great wise words from yourself. So. Kavya, thank you so much for sharing your time today. And I think people will really benefit from your episode.
Thank you, Eamon. And this is good. Like, I really appreciate what you're doing here as well, especially someone who had to transition to an IT security career. We really need these stories to be out there because sometimes people think that, oh, yeah, these people must be these awesome engineers. You know, very, very intelligent.
Right.
Or always in security or grew up with this computer science mindset, hacker mindset.
Right.
No, we're all just different, diverse, normal people who came from a lot of different places. Yeah. But then ended up in security. And so these stories are really important. I'm really glad that you were taking the time to go dive into these things and help other people to understand this aspect.
Well, thank you so much. Thank you. Yeah. Absolutely. We'll leave it there. Thank you so much, Kavya.
Thank you, Eamon. Bye-bye. Bye now.
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
