Keya Horiuchi From Teacher, Filmmaker, and Website Design to Security Engineer!

Keya Horiuchi0:00

Ended up having the most amazing time because I'd never been surrounded by such a large group of super smart people who were by and large, incredibly, just really nice people. You could strike up a conversation with people who reverse engineer viruses, people who are involved in all sorts of interesting projects.

Keya Horiuchi0:45

It's easy to get into what you're comfortable with. So you sort of just hang on to retirement. And I didn't want to have a job like that. And infosec is definitely not that way. I think infosec is something where you're constantly learning and you're constantly challenged because the whole environment is moving so quickly.

Keya Horiuchi1:07

It was the most amazing thing. I went through this like, okay, I'm not going to sleep until I can turn the stepper motor. And it was magical when it happened because you're giving commands in a language that the device understands and it makes it do stuff. Like for me, that was magical.

Keya Horiuchi1:27

Yeah, thanks for having me.

Keya Horiuchi1:35

Okay. My name's Kia Horiyuchi. I work at Red Canary as a detection engineer and as part of the CERT team. I have been in infosec about four years now, and it's been a really interesting ride for sure.

Keya Horiuchi1:56

Yeah, that's correct.

Keya Horiuchi1:59

That's correct. I was a public school teacher endorsed in secondary education. So I was endorsed in essentially middle school through high school and worked at a few different places. I would intersperse that with the very first job that I had was actually in New Mexico and And on the Navajo Indian Reservation and had the opportunity to learn video production. And so sort of fell in love with that process. So at that time, everything was going digital. And it was super exciting because you could be an independent filmmaker. So I would make a documentary during the summertime and go back to work. Or I would just cash out my retirement and travel around the world and make other documentaries. But that gave me the opportunity to learn about making websites and promoting the film.

Keya Horiuchi4:00

Well, I think being a teacher is a really good and noble job. But, you know, we're all different people. I'm very more rational in thinking like there was one teaching job where we had to take personality tests. And at that school, I think it I had a staff of about 40 or 50 people and I was the only one. And so then, you know, it was this exercise of get to know the other people and what drives their decision making and, you know, go to your group. And I was the only person in the rational thinking group, like whereas other people were more feeling. So I was like, well, I do think a little bit differently and I enjoy the rational process. So I thought, you know, I should make a career change.

Keya Horiuchi4:56

I do enjoy the problem solving process. I knew that I wouldn't teach for a really long time. It was something that I wanted to do early in my career to give back to society. It was something that I enjoyed, but I definitely feel more at home with the cohort that I work with currently and with what I do. I mean, I do work 10 hour shifts and I by and large enjoy it. Of late, it's been going over that time. But it is like I got to a point where I just couldn't do it. It seemed like it was challenging, but in a different way. But it's easy to get into what you're comfortable with. So you sort of just hang on to retirement. And I didn't want to have a job like that. And infosec is definitely not that way.

Keya Horiuchi5:55

Yeah, lots of problems to solve, for sure.

Keya Horiuchi6:06

Yeah. And I think personality-wise, I've always been this way. In making that career change, I decided to, because we have a lot of online resources currently, edX has a lot of really good intro to computer science type courses. So I started taking some of those through Harvard and MIT and got a base underneath me and moved back to Colorado from New Mexico and I looked online and found different meetups, Linux meetups, and went to meet a group of people. And they're like, oh, hey, you're already playing with the terminal. If you have any questions, we're on IRC all day. Just feel free to ping us and send us any questions that you have. And while I was there, I was like, you know, I can do what they do.

Keya Horiuchi7:36

Yes, I was still working freelance doing websites for clients.

Keya Horiuchi7:45

Correct. And as a teacher, you have that pay through the summertime. So I was looking for something to do. And at the time I was looking at going into web development or should I go into networking? And this sort of just fell into my lap because there's a need for people to fill in infosec. And I thought, okay, so This is pretty interesting. Let's check it out. I mean, I can't not do it if somebody says, oh, here's this scholarship that will pay for everything and give you some. So I ended up getting it. That was the end of summer. And so I started doing some research like, What can I learn about this interesting world of infosec? And so the biggest security slash hacker conference was happening in August at DEF CON in Las Vegas.

Keya Horiuchi9:28

So it was an amazing process and it's an amazing venue and an amazing gathering of people. The very first time that I went, it was not held on the strip. You look on the website, you're like, where do I go to pick up tickets? But I was staying in a hotel where there were lots of people who were obviously there for infosec. Like you first start noticing everybody has these really bright, blinky badges that they're wearing. And I just was like, oh, hey. Do you know where we're supposed to go tomorrow to register? And they're like, yep, wake up as early as possible and head and just follow the line of people wearing black. Nice. So that's what I did. And it was at the time where they still didn't open up registration until a certain time.

Keya Horiuchi11:27

It's a two-year program to get your associate in computer science with an emphasis in cybersecurity or development.

Keya Horiuchi11:45

Yeah, I was still doing a little bit of freelancing through the coursework. It was at a community college, Red Rocks Community College. And so because I had a previous or because I had gotten a previous degree, it was a lot faster for me. So I only attended for a year and a half. I am incredibly thankful in that there were a lot of opportunities in community colleges. So one summer I gathered a team together and there was a competition also through the National Science Foundation to create a project that filled a market need. And so they had a few different categories and we created a medical device. That could be taken out into the field, but we did it all off of a Raspberry Pi, those little microcontrollers.

Keya Horiuchi13:12

A very accessible language. And so every project, things will come up where you have to do more problem solving, I think, that you anticipate. And so the programmer that we originally brought on didn't do any programming. So I was tasked with figuring out how to turn a stepper motor that was connected to one of the GPIO pins On the Raspberry Pi and created logic. So we essentially created a device that could read RFID. So if a certain RFID tag was recognized, then it would dispense medicine. So it essentially turned stepper motor and we made the outer gating and put it all together and it worked. It was the most amazing thing. I went through this like, okay, I'm not going to sleep until I can turn the stepper motor.

Keya Horiuchi14:16

I read so much documentation on all the little things that we connected to it. I watched a bunch of YouTube videos. I looked at a lot of GitHub accounts, like trying to figure out, like, I've got to make this move. And our second prototype, we then integrated in a database so we can put in different types of medicine or different categories of things that we could better track what's being dispensed. So those types of experiences all added to the different things that I was learning inside of the classroom.

Keya Horiuchi14:50

Yeah, I do believe that there's a site that's online that connects over, I think it's a Bitbucket account.

Keya Horiuchi15:07

It was really easy for me in the sense that the community sponsor for that particular project offered me an internship. And so I started working there while I was still finishing up school. I worked there, I believe, two to three times a week. And as soon as I finished school, they offered me a job. And so I went directly into that industry. Job where it was with a security consultant. And so that was also a really good process and really good experience in that I touched all sorts of different networks.

Keya Horiuchi15:44

Yes.

Keya Horiuchi15:52

Very much trial by fire in the sense that in school you learned about different concepts like, oh, make sure you go on the VPN. A VPN is a private tunnel. It encrypts the traffic. And so at work, they're like, OK, you need to use this type of VPN for this client. You need to hit this jump post from there. You need to pivot into this particular IP and then you need to do this. So, then you're actually doing all of those things that you once read about. You'd get different tasks like, okay, you need to jump into this environment, check to see if this service is working and it's a production environment, so be careful and just let us know what you find out. So, you document everything. It was doing those types of things, setting up different services within different networks as well as pen testing them or going on site.

Keya Horiuchi16:46

I often worked with a team and we were given specific tasks within a larger job. And so it was great to try out different pieces of it.

Keya Horiuchi16:58

And it was incredibly challenging. A lot of times I was trying to figure out. And once again, that's where that problem solving ability comes in, where sometimes information that you get from the client is essentially just hint of what's going on in the network. And you really have to go in and understand like, okay, so if nobody can log in, what is it? Is it the server that I'm looking at, the VPN, the ASA appears up, but something else is down in the network. And it turns out, oh, the LDAP server is down, which is why they can't log in. So it was a great experience in problem solving. It's always an experience in problem solving.

Keya Horiuchi17:37

Yeah, there's so many things that I can necessarily talk about, but there are always challenges and you just need to figure them out. Something that you have, like a plan that you have in your mind may not always work out and you just have to pivot. Just like any adversaries, like they're within different networks and environments, but you just have to be creative and keep going at it until you can do what needs to be done. I mean, that sounds so like cliche, but.

Keya Horiuchi18:15

I went from one to the other, but there was a gap of time in that consulting is hard work and I was pretty burnt out. That's right. So I took a break and traveled.

Keya Horiuchi18:29

During that time did other, you know, those war games online. They're so much fun. Yeah. And kept on advancing my skills and was traveling online. At the time, I happened to be in Canada and started to apply for different jobs. And going in cold was a lot different. I found that I had to be pretty aggressive in sending out applications. So I have both the Networking Plus and Security Plus at that time certifications. I don't know if it's because being a woman, but I found that if there was any sort of technical aspect of the interview process, like when you had to either fill something out or answer a few different questions, but those I got the furthest in. We returned back to Colorado because I was like, you know, if I'm going to be in infosec, I pretty much have to be in the United States for a lot of different positions.

Keya Horiuchi19:28

No, I think it's that if I'm applying to American corporations in infosec, they are doing IP filtering or they should be to see where applications are coming in from.

Keya Horiuchi19:39

So, for example, the company that I work with now, we're under contract to customers to have all the workers within the United States because of the information that we potentially touch and the systems that we touch. So I knew that was a requirement and just being in the industry. And so because of that, we came back to Colorado. And I would say that starting cold, it took about a month to go through the interview process. And at that time, and I put a So I had about five different potential jobs that were at the same point where any one of them could come together at that time. So I was lucky for sure. And I think when you're at that point, you've already jumped over the different hurdles because a lot of people say that they know a lot of things and they haven't actually done them.

Keya Horiuchi21:04

Yeah. It's amazing. And especially coming from public school teaching where I had seen almost physical fights, altercations happen over like reams of paper because there's just not that much allocated towards schools to where snacks are brought in. Like it's a very different environment where you have, you know, a stipend to buy desks and anything that you need for the job. Okay. So yeah, it's very different.

Keya Horiuchi21:37

Let's see. I actually enjoyed the process of getting questionnaires, but some of them had like 80 questions of multiple choice and then you had to write up a proposal.

Keya Horiuchi21:47

Yeah. So other consulting companies, as well as other companies that offer some sort of service around security and websites, I really enjoyed the ones that, well, I would say they were between two to four different sort of hurdles where you talk to a specific person. They then give you a technical questionnaire. There was even one that was, she was like, okay, you did great on the test, but I want to watch you take the test.

Keya Horiuchi22:16

Well, I don't know. I was like, you should have algorithms that look at how much time a person is spending on it and being able to, because it was an interesting one where they're like match of shapes. So I don't know that you could even cheat with something like that. But the background on that particular company wasn't an environment that I would want to work in. You know, there's all sorts of companies and I really enjoy where I am currently.

Keya Horiuchi22:43

Oh, I'm learning so much.

Keya Horiuchi22:45

Yes, I'm definitely learning right now.

Keya Horiuchi22:50

The detection engineering team works in 10-hour shifts. So we work four days on and then have three days off. When I am working, I am pretty much in front of the computer the whole time because we're working a queue. So we're pulling different events. So let me back up a little bit. The work that I do, we work with... Essentially endpoints. So we have managed endpoint detection and response. So there's a sensor that's on the endpoint, which is workstation server or laptop that's collecting all the processes. It's sent through an engine. And so it throws out everything that is normal and then sends anything that's interesting to a detection engineer. So in understanding what's normal on a computer and what is abnormal, we will essentially dive into those

Keya Horiuchi24:17

Another team is actually working with the customer. And depending on the relationship with the customer, they can work with the customer or potentially take actions on their behalf. So I'm part of the detection engineering team. And the other part of the CERT team, they're the incident handlers who they then work with the customers on remediation.

Keya Horiuchi24:47

So we work with an incident responder. So they are sent to various breaches of various severities and we're often dropped right into those. And so when there's something raging in their network, it creates a lot of noise because they're For one reason or another, they just haven't had that insight into their network and something just got carried away. A breach happened and it just spread through their network. Those are the worst because they are so noisy. And so we've been working out different stuff. Like, for example, something like a worm. There's so many different kinds. Emotet or Cryptic or TrickBot or... And one of those that has the ability to change its structure so it's highly polymorphic.

Keya Horiuchi26:06

I don't know necessarily what is worse, the super noisy ones. I would say the quieter ones are, I don't want to say more rewarding, but they're interesting. And when you do catch them, I mean, it's always sort of a cat and mouse game, I think.

Keya Horiuchi26:21

Yeah. Also with red teamers that are actively pen testing. They also vary. But so yeah, definitely interesting. Definitely opportunity to learn lots of new exploits happening or just things where a lot of point of sale devices that are also being popped.

Keya Horiuchi26:42

Middle school to high school, but also some elementary. I taught a lot of different audiences.

Keya Horiuchi26:54

I think as long as someone is curious and wants to understand how something works, they will do okay in infosec. I mean, you have to be fairly aggressive, whether or not that's being quiet and constantly reading, playing war games online, setting up new servers, because it's really easy to play with these things. I have talked to students who've wanted to go into it or sons and daughters of friends And the ones who are actively seeking out things and doing things are the ones that are successful.

Keya Horiuchi27:29

I think that it's one thing to read and get the certifications. Like I had mentioned earlier that I do have some certifications. Mm-hmm. And those are sort of like a bar of legitimacy just within the answering questions and knowledge sense, which is important to have. But I think that you also have to really dig into something and not be scared of doing that. I think of the successful people who actively problem solve and who just dive into things and really want to understand how things work to others who don't. They say that they really want to do it and they've been interested in it, but they just won't take that first step because you're like, you know, you can go to DigitalOcean, you can set up servers on Amazon, you could do this all for free and like just play with it and figure out how things work, like the different layers of the network.

Keya Horiuchi28:42

Sniffing your home network.

Keya Horiuchi28:46

Correct. Correct. Yeah. Those things are really good in helping you learn how communication occurs because it's magical. It's amazing that the internet even works. Yeah. It's amazing that we send all this data. We're communicating sound also over the internet and it's being recorded and stored in, I think, the cloud. So it's fascinating.

Keya Horiuchi29:17

Yeah, sounds good. Thank you for having me.