Getting Into Infosec, Episode 24: Keya Horiuchi - From Teacher, Filmmaker, and Website Design to Security Engineer!
Published June 15, 2019 · 30 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/keya/

[0:00] Keya Horiuchi: Ended up having the most amazing time because I'd never been surrounded by such a large group of super smart people who were by and large, incredibly, just really nice people. You could strike up a conversation with people who reverse engineer viruses, people who are involved in all sorts of interesting projects.

[0:38] Ayman Elsawah: Welcome to Getting Into Infosec. I'm your host, Ayman Elsawah. My guest this week is Kia Horiyuchi. Kia was a public school teacher who stood out of the crowd.

[0:45] Keya Horiuchi: It's easy to get into what you're comfortable with. So you sort of just hang on to retirement. And I didn't want to have a job like that. And infosec is definitely not that way. I think infosec is something where you're constantly learning and you're constantly challenged because the whole environment is moving so quickly.

[1:03] Ayman Elsawah: Kia loves to problem solve and when first getting into technology, she had some really magical experiences.

[1:07] Keya Horiuchi: It was the most amazing thing. I went through this like, okay, I'm not going to sleep until I can turn the stepper motor. And it was magical when it happened because you're giving commands in a language that the device understands and it makes it do stuff. Like for me, that was magical.

[1:23] Ayman Elsawah: It was an amazing conversation. All right, on to the show. Hi, Kia. Thanks for coming on the show.

[1:27] Keya Horiuchi: Yeah, thanks for having me.

[1:28] Ayman Elsawah: Awesome. Yeah. So maybe we could start off, introduce yourself to the audience, let them know what you do in information security.

[1:35] Keya Horiuchi: Okay. My name's Kia Horiyuchi. I work at Red Canary as a detection engineer and as part of the CERT team. I have been in infosec about four years now, and it's been a really interesting ride for sure.

[1:50] Ayman Elsawah: Yeah. So basically, I think you started off as a teacher slash filmmaker. Is that correct?

[1:56] Keya Horiuchi: Yeah, that's correct.

[1:57] Ayman Elsawah: You used to be a teacher filmmaker. Is that right?

[1:59] Keya Horiuchi: That's correct. I was a public school teacher endorsed in secondary education. So I was endorsed in essentially middle school through high school and worked at a few different places. I would intersperse that with the very first job that I had was actually in New Mexico and And on the Navajo Indian Reservation and had the opportunity to learn video production. And so sort of fell in love with that process. So at that time, everything was going digital. And it was super exciting because you could be an independent filmmaker. So I would make a documentary during the summertime and go back to work. Or I would just cash out my retirement and travel around the world and make other documentaries. But that gave me the opportunity to learn about making websites and promoting the film.

[2:55] Keya Horiuchi: And that led into freelancing for small businesses, nonprofits. And there was a point about five or six years ago where... I knew I had to make a choice because when I got into teaching, it was something that I thought I would do for a little while. It wasn't something that I do all my life. And so I was looking at potentially web design or going more into computer networking because in doing websites, I would have to also set up people's DNS and learn about zones and sort of go deeper into the network stack. Versus the upper application layer. And so I really wanted to learn more about those things. I got the biggest raise that I had ever gotten as a teacher. So in the state of New Mexico, they just have three levels.

[3:45] Keya Horiuchi: So I essentially went from the first level to the second level and you get a big pay raise. Well, for teachers, big pay raise. And they're like, yeah, here's the contract for next year. And I just said, no, I can't do it. I need to make a change.

[3:58] Ayman Elsawah: Oh, why was that?

[4:00] Keya Horiuchi: Well, I think being a teacher is a really good and noble job. But, you know, we're all different people. I'm very more rational in thinking like there was one teaching job where we had to take personality tests. And at that school, I think it I had a staff of about 40 or 50 people and I was the only one. And so then, you know, it was this exercise of get to know the other people and what drives their decision making and, you know, go to your group. And I was the only person in the rational thinking group, like whereas other people were more feeling. So I was like, well, I do think a little bit differently and I enjoy the rational process. So I thought, you know, I should make a career change.

[4:42] Keya Horiuchi: I don't necessarily like being surrounded by people all day.

[4:46] Ayman Elsawah: So you took this personality test and you found yourself that you're in the rational group. I mean, how long were you teaching and were you getting enticed by technology or, you know, what was going through your head at the time?

[4:56] Keya Horiuchi: I do enjoy the problem solving process. I knew that I wouldn't teach for a really long time. It was something that I wanted to do early in my career to give back to society. It was something that I enjoyed, but I definitely feel more at home with the cohort that I work with currently and with what I do. I mean, I do work 10 hour shifts and I by and large enjoy it. Of late, it's been going over that time. But it is like I got to a point where I just couldn't do it. It seemed like it was challenging, but in a different way. But it's easy to get into what you're comfortable with. So you sort of just hang on to retirement. And I didn't want to have a job like that. And infosec is definitely not that way.

[5:44] Keya Horiuchi: I think infosec is something where you're constantly learning and you're constantly challenged because the whole environment is moving so quickly. Yeah.

[5:52] Ayman Elsawah: Yeah, there's plenty of problems to solve.

[5:55] Keya Horiuchi: Yeah, lots of problems to solve, for sure.

[5:58] Ayman Elsawah: So it seems like you were looking for that, you know, your brain tasted the problem solving part of life or part of technology. And it seemed like you wanted more of that. Is that right?

[6:06] Keya Horiuchi: Yeah. And I think personality-wise, I've always been this way. In making that career change, I decided to, because we have a lot of online resources currently, edX has a lot of really good intro to computer science type courses. So I started taking some of those through Harvard and MIT and got a base underneath me and moved back to Colorado from New Mexico and I looked online and found different meetups, Linux meetups, and went to meet a group of people. And they're like, oh, hey, you're already playing with the terminal. If you have any questions, we're on IRC all day. Just feel free to ping us and send us any questions that you have. And while I was there, I was like, you know, I can do what they do.

[6:53] Keya Horiuchi: So the next day, I went to the community college. And I wanted to find out if they had any computer science courses, which of course they did. They had an associate's. And I went to financial aid and they said, oh, hey, you just happen to come at a good time. We have one of the biggest scholarships that we offer is for infosec. And it's sponsored by the National Science Foundation. And actually, you should apply to it because we don't have that many applicants for it. Nice. So this was on a Friday. So I quickly got in touch with people and asked them to write up a letter of recommendation, started the process of filling all the paperwork out so I could get everything into them by the following Monday.

[7:34] Ayman Elsawah: Wow. And were you working at the time?

[7:36] Keya Horiuchi: Yes, I was still working freelance doing websites for clients.

[7:39] Ayman Elsawah: Okay. So when you decided to move to Colorado, you kind of stopped teaching at that point and were kind of just freelancing in technology?

[7:45] Keya Horiuchi: Correct. And as a teacher, you have that pay through the summertime. So I was looking for something to do. And at the time I was looking at going into web development or should I go into networking? And this sort of just fell into my lap because there's a need for people to fill in infosec. And I thought, okay, so This is pretty interesting. Let's check it out. I mean, I can't not do it if somebody says, oh, here's this scholarship that will pay for everything and give you some. So I ended up getting it. That was the end of summer. And so I started doing some research like, What can I learn about this interesting world of infosec? And so the biggest security slash hacker conference was happening in August at DEF CON in Las Vegas.

[8:33] Keya Horiuchi: So I did a little bit of more research and it seemed like women did not have that great of an experience there. And I would be going alone. But I thought, well, if you're Getting Into Infosec, just go and check it out. And ended up having the most Amazing time because I'd never been surrounded by such a large group of super smart people who were by and large, incredibly, just really nice people. You could strike up a conversation with people who reverse engineer viruses, people who are involved in all sorts of interesting projects, sniffing all sorts of traffic, network traffic for various reasons, finding out all sorts of things, interesting things. So I fell in love with it.

[9:17] Ayman Elsawah: How was it to go to this huge conference in Las Vegas and you went alone? Describe that experience and tips for others that might want to go but not know anybody to go with.

[9:28] Keya Horiuchi: So it was an amazing process and it's an amazing venue and an amazing gathering of people. The very first time that I went, it was not held on the strip. You look on the website, you're like, where do I go to pick up tickets? But I was staying in a hotel where there were lots of people who were obviously there for infosec. Like you first start noticing everybody has these really bright, blinky badges that they're wearing. And I just was like, oh, hey. Do you know where we're supposed to go tomorrow to register? And they're like, yep, wake up as early as possible and head and just follow the line of people wearing black. Nice. So that's what I did. And it was at the time where they still didn't open up registration until a certain time.

[10:15] Keya Horiuchi: I think it was like I don't know, maybe nine or 10. So I was pretty far back in the line, but made friends with all the people around me. So we would hold our place in line, go grab some food, come back. And it was like a big party scene, I guess. But also where a lot of information is being exchanged. There's so many different activities that you can be involved in. There's a lot of great, I don't want to say treasure hunts, but various games that you can engage in. There's great talks, like people who you read about online are there. I will say that I found the community overall really welcoming. And other women, we were sort of watching out for each other, which was also very cool. I would definitely recommend it to anybody who is looking to get into infosec, but you do have to sort of have your wits about you and not be totally stupid because there's a lot of alcohol there.

[11:09] Keya Horiuchi: There's a lot of people who... Often don't get out to be around massive amounts of people. So it's an interesting mix.

[11:17] Ayman Elsawah: Okay, interesting. So you went to this conference, you're learning, and you're about to start this infosec program in September, I'm assuming. And so you went through the program. How long was the program?

[11:27] Keya Horiuchi: It's a two-year program to get your associate in computer science with an emphasis in cybersecurity or development.

[11:35] Ayman Elsawah: Okay. And you went through the coursework and, you know, was it hands-on? How was that experience? And then what were you doing for just to stay, still freelancing on the side, I guess?

[11:45] Keya Horiuchi: Yeah, I was still doing a little bit of freelancing through the coursework. It was at a community college, Red Rocks Community College. And so because I had a previous or because I had gotten a previous degree, it was a lot faster for me. So I only attended for a year and a half. I am incredibly thankful in that there were a lot of opportunities in community colleges. So one summer I gathered a team together and there was a competition also through the National Science Foundation to create a project that filled a market need. And so they had a few different categories and we created a medical device. That could be taken out into the field, but we did it all off of a Raspberry Pi, those little microcontrollers.

[12:34] Keya Horiuchi: We built two prototypes and we were chosen as part of the top 10 groups out of all the community colleges in the States and went to DC for a summer to compete with our project. And we won. Nice. So it was a really good process. There were three other people on the team. And so we built prototypes where the first one, like for me, it was an amazing process because I hadn't ever SSH'd into a device. And I had to figure out how to get like port scan, the local environment, access the device and start programming it. So Raspberry Pi is great because it uses Python.

[13:12] Ayman Elsawah: Mm-hmm.

[13:12] Keya Horiuchi: A very accessible language. And so every project, things will come up where you have to do more problem solving, I think, that you anticipate. And so the programmer that we originally brought on didn't do any programming. So I was tasked with figuring out how to turn a stepper motor that was connected to one of the GPIO pins On the Raspberry Pi and created logic. So we essentially created a device that could read RFID. So if a certain RFID tag was recognized, then it would dispense medicine. So it essentially turned stepper motor and we made the outer gating and put it all together and it worked. It was the most amazing thing. I went through this like, okay, I'm not going to sleep until I can turn the stepper motor.

[14:01] Keya Horiuchi: And it was magical when it happened because you're giving commands in a language that the device understands and it makes it do stuff. Like for me, that was magical.

[14:10] Ayman Elsawah: Okay. Reading a lot of documents and just kind of understanding what each command did, all that, right?

[14:16] Keya Horiuchi: I read so much documentation on all the little things that we connected to it. I watched a bunch of YouTube videos. I looked at a lot of GitHub accounts, like trying to figure out, like, I've got to make this move. And our second prototype, we then integrated in a database so we can put in different types of medicine or different categories of things that we could better track what's being dispensed. So those types of experiences all added to the different things that I was learning inside of the classroom.

[14:47] Ayman Elsawah: Okay. And are there any of those write-ups available online?

[14:50] Keya Horiuchi: Yeah, I do believe that there's a site that's online that connects over, I think it's a Bitbucket account.

[14:56] Ayman Elsawah: Okay, we can catch that later. That'd be great. So now you've graduated from the program. And how was it finding your first infosec job? Were there struggles? Was it pretty easy peasy?

[15:07] Keya Horiuchi: It was really easy for me in the sense that the community sponsor for that particular project offered me an internship. And so I started working there while I was still finishing up school. I worked there, I believe, two to three times a week. And as soon as I finished school, they offered me a job. And so I went directly into that industry. Job where it was with a security consultant. And so that was also a really good process and really good experience in that I touched all sorts of different networks.

[15:42] Ayman Elsawah: So the internship, was it also in security?

[15:44] Keya Horiuchi: Yes.

[15:45] Ayman Elsawah: Okay, great. And so now you're a consultant and you're getting to go to various different companies. So it's basically trial by fire in a way?

[15:52] Keya Horiuchi: Very much trial by fire in the sense that in school you learned about different concepts like, oh, make sure you go on the VPN. A VPN is a private tunnel. It encrypts the traffic. And so at work, they're like, OK, you need to use this type of VPN for this client. You need to hit this jump post from there. You need to pivot into this particular IP and then you need to do this. So, then you're actually doing all of those things that you once read about. You'd get different tasks like, okay, you need to jump into this environment, check to see if this service is working and it's a production environment, so be careful and just let us know what you find out. So, you document everything. It was doing those types of things, setting up different services within different networks as well as pen testing them or going on site.

[16:39] Keya Horiuchi: To conduct assessments. So it was a really great experience.

[16:43] Ayman Elsawah: And did you work in teams or were you thrown out there by yourself?

[16:46] Keya Horiuchi: I often worked with a team and we were given specific tasks within a larger job. And so it was great to try out different pieces of it.

[16:57] Ayman Elsawah: Right.

[16:58] Keya Horiuchi: And it was incredibly challenging. A lot of times I was trying to figure out. And once again, that's where that problem solving ability comes in, where sometimes information that you get from the client is essentially just hint of what's going on in the network. And you really have to go in and understand like, okay, so if nobody can log in, what is it? Is it the server that I'm looking at, the VPN, the ASA appears up, but something else is down in the network. And it turns out, oh, the LDAP server is down, which is why they can't log in. So it was a great experience in problem solving. It's always an experience in problem solving.

[17:34] Ayman Elsawah: Yeah, that's awesome. Any interesting war stories during that time?

[17:37] Keya Horiuchi: Yeah, there's so many things that I can necessarily talk about, but there are always challenges and you just need to figure them out. Something that you have, like a plan that you have in your mind may not always work out and you just have to pivot. Just like any adversaries, like they're within different networks and environments, but you just have to be creative and keep going at it until you can do what needs to be done. I mean, that sounds so like cliche, but.

[18:10] Ayman Elsawah: So now you're consulting and how many jobs from that to what you're doing now?

[18:15] Keya Horiuchi: I went from one to the other, but there was a gap of time in that consulting is hard work and I was pretty burnt out. That's right. So I took a break and traveled.

[18:28] Ayman Elsawah: Okay.

[18:29] Keya Horiuchi: During that time did other, you know, those war games online. They're so much fun. Yeah. And kept on advancing my skills and was traveling online. At the time, I happened to be in Canada and started to apply for different jobs. And going in cold was a lot different. I found that I had to be pretty aggressive in sending out applications. So I have both the Networking Plus and Security Plus at that time certifications. I don't know if it's because being a woman, but I found that if there was any sort of technical aspect of the interview process, like when you had to either fill something out or answer a few different questions, but those I got the furthest in. We returned back to Colorado because I was like, you know, if I'm going to be in infosec, I pretty much have to be in the United States for a lot of different positions.

[19:23] Ayman Elsawah: Why is that? Why United States? Because... Just to feel this better?

[19:28] Keya Horiuchi: No, I think it's that if I'm applying to American corporations in infosec, they are doing IP filtering or they should be to see where applications are coming in from.

[19:39] Ayman Elsawah: Oh, I see.

[19:39] Keya Horiuchi: So, for example, the company that I work with now, we're under contract to customers to have all the workers within the United States because of the information that we potentially touch and the systems that we touch. So I knew that was a requirement and just being in the industry. And so because of that, we came back to Colorado. And I would say that starting cold, it took about a month to go through the interview process. And at that time, and I put a So I had about five different potential jobs that were at the same point where any one of them could come together at that time. So I was lucky for sure. And I think when you're at that point, you've already jumped over the different hurdles because a lot of people say that they know a lot of things and they haven't actually done them.

[20:30] Keya Horiuchi: So once you're at that point, Point, then it became really competitive to sort of choose between the different jobs. And even after I had started the current job that I have, other people that I had interviewed with would get in touch with me like, hey, just wanted to see how you're doing. Are you happy with your position? We have an opening at our place. Wanted to see if you wanted to come and talk to us again, open up discussions. So it's an interesting field. Like that would never happen in teaching. Yeah. I mean, the private sector is definitely more competitive.

[21:03] Ayman Elsawah: Yeah. It's like night and day.

[21:04] Keya Horiuchi: Yeah. It's amazing. And especially coming from public school teaching where I had seen almost physical fights, altercations happen over like reams of paper because there's just not that much allocated towards schools to where snacks are brought in. Like it's a very different environment where you have, you know, a stipend to buy desks and anything that you need for the job. Okay. So yeah, it's very different.

[21:28] Ayman Elsawah: Yeah. Wow. And so were there any challenges as you were interviewing for these different positions? You know, what were some of the hardest interviews that you had to go through?

[21:37] Keya Horiuchi: Let's see. I actually enjoyed the process of getting questionnaires, but some of them had like 80 questions of multiple choice and then you had to write up a proposal.

[21:46] Ayman Elsawah: Wow. Really?

[21:47] Keya Horiuchi: Yeah. So other consulting companies, as well as other companies that offer some sort of service around security and websites, I really enjoyed the ones that, well, I would say they were between two to four different sort of hurdles where you talk to a specific person. They then give you a technical questionnaire. There was even one that was, she was like, okay, you did great on the test, but I want to watch you take the test.

[22:14] Ayman Elsawah: Wow. Did they not believe it?

[22:16] Keya Horiuchi: Well, I don't know. I was like, you should have algorithms that look at how much time a person is spending on it and being able to, because it was an interesting one where they're like match of shapes. So I don't know that you could even cheat with something like that. But the background on that particular company wasn't an environment that I would want to work in. You know, there's all sorts of companies and I really enjoy where I am currently.

[22:41] Ayman Elsawah: Okay. Do you find yourself still learning right now?

[22:43] Keya Horiuchi: Oh, I'm learning so much.

[22:44] Ayman Elsawah: Nice.

[22:45] Keya Horiuchi: Yes, I'm definitely learning right now.

[22:47] Ayman Elsawah: Cool. Describe a day in your life at your current job.

[22:50] Keya Horiuchi: The detection engineering team works in 10-hour shifts. So we work four days on and then have three days off. When I am working, I am pretty much in front of the computer the whole time because we're working a queue. So we're pulling different events. So let me back up a little bit. The work that I do, we work with... Essentially endpoints. So we have managed endpoint detection and response. So there's a sensor that's on the endpoint, which is workstation server or laptop that's collecting all the processes. It's sent through an engine. And so it throws out everything that is normal and then sends anything that's interesting to a detection engineer. So in understanding what's normal on a computer and what is abnormal, we will essentially dive into those

[23:40] Keya Horiuchi: In a pretty timely manner because we want to make sure that we get those alerts to customers fairly quickly. And so we just pull events out of the queue. And so there's an algorithm that gives the item of most severity and as well as there's a time factor in there and serves it up to the detection engineer. And then we work through them. Everything is also peer reviewed. So we're working with Slack. And so anytime we're pinged, we immediately focus on the detection that's going out and Peer review it, and essentially give the okay. And then the person who wrote it up can then ship it.

[24:15] Ayman Elsawah: Are you doing a live response too?

[24:17] Keya Horiuchi: Another team is actually working with the customer. And depending on the relationship with the customer, they can work with the customer or potentially take actions on their behalf. So I'm part of the detection engineering team. And the other part of the CERT team, they're the incident handlers who they then work with the customers on remediation.

[24:38] Ayman Elsawah: Great. So describe to us maybe the worst network you've ever seen in any job. You'd have to be specific, but like, what's the worst network you've entered in?

[24:47] Keya Horiuchi: So we work with an incident responder. So they are sent to various breaches of various severities and we're often dropped right into those. And so when there's something raging in their network, it creates a lot of noise because they're For one reason or another, they just haven't had that insight into their network and something just got carried away. A breach happened and it just spread through their network. Those are the worst because they are so noisy. And so we've been working out different stuff. Like, for example, something like a worm. There's so many different kinds. Emotet or Cryptic or TrickBot or... And one of those that has the ability to change its structure so it's highly polymorphic.

[25:33] Keya Horiuchi: It's making external netcons. It's creating new files on the system. So there are those very noisy ones. And then there are those very quiet ones where something is... Slightly unusual, but it's being very quiet. There's some lateral movement. And then all of a sudden you see LSAS being dumped on a domain controller. Those are where your fight or flight instincts kick in because you know something is wrong and you're trying to understand the depth of what's occurred so you can convey it to the customer, put it on the detection.

[26:05] Ayman Elsawah: Mm-hmm.

[26:06] Keya Horiuchi: I don't know necessarily what is worse, the super noisy ones. I would say the quieter ones are, I don't want to say more rewarding, but they're interesting. And when you do catch them, I mean, it's always sort of a cat and mouse game, I think.

[26:21] Ayman Elsawah: That's right.

[26:21] Keya Horiuchi: Yeah. Also with red teamers that are actively pen testing. They also vary. But so yeah, definitely interesting. Definitely opportunity to learn lots of new exploits happening or just things where a lot of point of sale devices that are also being popped.

[26:37] Ayman Elsawah: Yeah. Do you think as a teacher, and you taught, I think, elementary school, is that right?

[26:42] Keya Horiuchi: Middle school to high school, but also some elementary. I taught a lot of different audiences.

[26:46] Ayman Elsawah: Okay. What would you recommend for those who teach in those environments or the students in those environments to learn more about infosec?

[26:54] Keya Horiuchi: I think as long as someone is curious and wants to understand how something works, they will do okay in infosec. I mean, you have to be fairly aggressive, whether or not that's being quiet and constantly reading, playing war games online, setting up new servers, because it's really easy to play with these things. I have talked to students who've wanted to go into it or sons and daughters of friends And the ones who are actively seeking out things and doing things are the ones that are successful.

[27:29] Ayman Elsawah: Mm hmm.

[27:29] Keya Horiuchi: I think that it's one thing to read and get the certifications. Like I had mentioned earlier that I do have some certifications. Mm-hmm. And those are sort of like a bar of legitimacy just within the answering questions and knowledge sense, which is important to have. But I think that you also have to really dig into something and not be scared of doing that. I think of the successful people who actively problem solve and who just dive into things and really want to understand how things work to others who don't. They say that they really want to do it and they've been interested in it, but they just won't take that first step because you're like, you know, you can go to DigitalOcean, you can set up servers on Amazon, you could do this all for free and like just play with it and figure out how things work, like the different layers of the network.

[28:16] Keya Horiuchi: Interact with one another or you know see if you can compromise it you know install an operating system and just start playing with one of the flavors of linux it's all open source it's all so accessible well not everything is open a lot of linux is open source and but it's all out there it's about the mindset and kind of just hopping into it right just Diving into it and playing with it. Yeah. Sniffing your network.

[28:41] Ayman Elsawah: Sniffing your home network.

[28:42] Keya Horiuchi: Sniffing your home network.

[28:44] Ayman Elsawah: Or a network that you're authorized, right?

[28:46] Keya Horiuchi: Correct. Correct. Yeah. Those things are really good in helping you learn how communication occurs because it's magical. It's amazing that the internet even works. Yeah. It's amazing that we send all this data. We're communicating sound also over the internet and it's being recorded and stored in, I think, the cloud. So it's fascinating.

[29:09] Ayman Elsawah: That's awesome. Well, well said, Kia. Thank you so much for coming on the show. I really appreciate your time and look forward to talking in the future.

[29:17] Keya Horiuchi: Yeah, sounds good. Thank you for having me.

[29:19] Ayman Elsawah: All right. Thank you. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.