Episode 39 · · 40 min
Samantha Cowan From National Parks Service To Head Of Compliance
Head of Security Compliance at HackerOne
Episode summary
Samantha Cowan is the Head of Compliance at HackerOne. She's the former Director of Compliance at OneLogin and former Security Engineer at CoverHound, Cyber Policy, and Zenefits. Sam initially perceived Infosec as an "unhappy job", but later found herself taking her MBA and paving her way into the security industry. Despite having her master's degree, she was not an exemption to facing rejections when applying for cybersecurity. Her episode is mind-blowing as she shares how you can break into boundaries by being confident in yourself and by not compromising to being seen as a token hire.
Before infosec: National Park Service administrative worker
Chapters
- 0:00
Intro: Samantha Cowan's path to compliance
Ayman introduces her journey and previews advice on learning the technical ropes and being seen for your merits.
- 2:18
What compliance does at HackerOne
Samantha explains how her team ties compliance frameworks to sales, answers customer questionnaires and runs vendor risk assessments.
- 9:25
From National Park Service to a cybersecurity master's
She describes leaving the pharmacy and law track, her family's anti-tech advice and enrolling in a dual master's program.
- 12:50
Zenefits IT support and the CoverHound PCI project
Samantha moves to the Bay Area, transitions to the security team and takes on PCI compliance as the first security hire.
- 14:22
Early rejections and whether a master's is worth it
She explains why her education alone did not land security jobs and what to look for in a program.
- 19:27
Mentorship, career planning and anti-mentors
Samantha talks about mentors who helped with skills and career direction, and learning from bad examples.
- 26:58
Token hires, confidence and combining minority groups
She discusses her talk about underrepresented groups and how to rely on your qualifications and speak with confidence.
- 31:51
Handling challenges and outdated frameworks
She explains how she handles being challenged and works with compliance frameworks that lag behind technology.
- 35:11
Hiring for compliance roles
Samantha explains that communication, enthusiasm and personality matter more than knowing every framework.
- 36:58
How to get into compliance
She advises learning security and privacy frameworks, following news such as the Privacy Shield ruling and following IAPP.
- 39:26
Sign-off and Ayman's new community
Ayman wraps up with show links and asks listeners to check out his new community.
Key takeaways
- Even with a non-technical undergraduate degree, teach yourself to code and learn the OWASP top 10, because knowing how vulnerabilities are exploited helps you defend against them.
- A master's in cybersecurity is often overkill; if you do choose one, pick an accredited program with instructors who have industry experience and a capture the flag team.
- Have both mentors who help with technical roadblocks and mentors who help plan your career, and learn from 'anti-mentors' whose mistakes you can avoid.
- Fall back on your qualifications and speak with confidence when challenged, and avoid splitting into many small groups with limited resources.
- When hiring for compliance, communication with engineers and enthusiasm matter more than listing every framework, because you can learn a framework but not people skills.
- To prepare for compliance roles, read up on security and privacy frameworks, follow industry news and understand which frameworks apply to which companies.
Notable quotes
even if you have a non-technical undergrad, definitely take the time to teach yourself to code.
bad examples are still examples.
you can learn a framework, but you're not likely to learn people skills if you don't have them yet.
Questions answered in this episode
- How did Samantha Cowan get into cybersecurity?
- Samantha worked at the National Park Service and wanted a higher degree to move up. She found a dual master's in cybersecurity and MBA, completed it while working, then took an IT support job at Zenefits and transitioned to the security team when a CISO was hired.
- Do you need a master's degree to work in cybersecurity?
- Samantha says a master's is often overkill and many people in the industry are self-taught. She suggests higher degrees mainly for research, teaching or management, and says hands-on skills such as coding and OWASP knowledge are more useful.
- How can someone without experience get into compliance?
- She suggests learning security and privacy frameworks, understanding which industries use them and following news like the invalidation of Privacy Shield. Resources she mentions include IAPP and privacy groups on Reddit.
Show notes and links
Show the original episode notes
Samantha Cowan is the Head of Compliance at HackerOne. She's the former Director of Compliance at OneLogin and former Security Engineer at CoverHound, Cyber Policy, and Zenefits. Sam initially perceived Infosec as an "unhappy job", but later found herself taking her MBA and paving her way into the security industry. Despite having her master's degree, she was not an exemption to facing rejections when applying for cybersecurity. Her episode is mind-blowing as she shares how you can break into boundaries by being confident in yourself and by not compromising to being seen as a token hire.
LINKS
- Linkedin: https://www.linkedin.com/in/samanthacowan/
- Intro Music: https://trash80.com/#/content/133/weeklybeats-2012-week5
- Security and Privacy Framework: iapp.org
----------------------------------------------
Follow @coffeewithayman on Twitter for more
For more information check out: gettingintoinfosec.com
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
We don't want to be seen as token hires. We have skills, no matter what our ethnicity, no matter what our gender identity, we have skills. We don't need extra help to get positions. We got the position based on our merits. And please don't question that. And we're just as competent as anybody else.
Welcome to Getting Into Infosec. I'm your host, Ayman Elsawah. My guest this week is Samantha Cohen. Samantha is currently the head of compliance at HackerOne. She's a former director of compliance at OneLogin and former security engineer at CoverHound, Cyber Policy, and Zenefits. In today's episode, Sam will share her incredible journey from having to perceive infosec as an unhappy job towards paving her way to cybersecurity.
I come from a family where we were always told, whatever you do, don't go into tech. I have an uncle who is a programmer and it was not the right career path for him. So he is unhappy. And that was interpreted as it not being the right career path for anybody.
Despite having a master's degree, Samantha was never an exemption from rejection when getting into cybersecurity. Her greatest advice for people who want to work in the weeds of security or security management is to take the time to learn the ropes.
And so I would definitely say, even if you have a non-technical undergrad, definitely take the time to teach yourself to code. Take the time to learn to have those skills because they're going to be really useful. Learn about like the OWASP top 10, how to exploit vulnerabilities, because if you know how they're exploited, you know how to defend against them. So I think that kind of knowledge for people who want to stick in the technical track is hugely beneficial.
I know you'll love this episode with Samantha. She's incredibly amazing in sharing actionable tips that you can apply in growing your career. All right, on to the show. Hi, Samantha. Welcome to the show.
Thank you so much.
Yeah. Thanks for coming on. So for those out there that don't know you, maybe you could introduce yourself and let people know what you do today.
Absolutely. My name is Samantha Cowan. I am the head of security compliance at HackerOne currently.
Okay. Okay. That's awesome. And you've been in similar roles in the past?
I have. Previously, I was the director of compliance at OneLogin. And before that, I was a security engineer who also did compliance at Coverhound and Cyber Policy. And before that, I was a security engineer at Zenefits.
Okay. So compliance gets a bad rap sometimes out there. Can you tell us what compliance is about and what goes on in your world as the head of compliance?
Absolutely. So compliance, I feel like it's a bad rap, largely because they're seen as two things. They're seen by people and employees as that department that's always telling you no. Security also gets that reputation. And we're also seen as that department who's always giving new requirements with no real explanation as to why they're needed other than because compliance. And so engineers a lot of times will get frustrated with us because they're being asked for things, but they don't really understand why.
Mm-hmm.
So what we do on my team and the way that I generally approach compliance is that we take things that are a business need that are needed in order to drive sales. So we take actual evidence from our sales teams, like we're potentially losing sales because we don't have X. And then we look at what it would take to add that to our compliance portfolio, essentially. And then we see where we already match up with that. And if we already have a compliance framework that offers that, or if we needed to bring into something new. And we do a cross mapping for bringing in something new where we already meet the requirements versus where we have gaps. And then we'll work with any teams, generally engineering teams, sometimes HR, finance, depending on what controls are there.
To see where we need to perhaps add some more tech, some more policies, anything like that to be able to meet this new framework. And then that in turn goes back to sales and boost sales for the company, which lets us grow and benefits all of us. So that's one component of what we do. We also do RFIs. So when we have either customers who are renewing or we have new customers, they send us questionnaires so we can provide information about the security of our company, the compliance of our company, how we meet privacy requirements, which allows sales to happen and renewals to take place or expand programs. And then the third component of what we do is to perform our vendor risk assessments. So when a department needs a new tool that they want to bring in, they submit that to my team and we review the vendor based on their own security to ensure that we're not introducing a risk into our company.
And how do you work with vendors that maybe or even employees or systems that don't meet your standards? Is it like you must change this right now or do you have a more gradual approach towards having them fix things?
It depends on the vendor. Honestly, a lot of things that we encounter are relatively minor and we can work through it with the vendors. Or maybe they didn't understand the question in the questionnaire and were able to find that they actually do have compensating controls around something. Or again, maybe they just flat misunderstood the question. Other times we ask if they can make a change that eliminates the risk that's in that area. And we try to work with the vendor to eliminate the risk. If we absolutely can't do that, we start looking to see if there are alternatives, if there are other vendors that perhaps weren't explored, if there's another way to accomplish this function, if maybe we already have a vendor that does this that was overlooked so that we aren't bringing unnecessary risk into the systems or into the company.
Right. And do you find working compliance at a security company to be easier than if you were compliance at a non-security focused company?
Yes and no. Yes, in the sense that our security functions are pretty spread out throughout the company and our employees are all very security minded. So when we say there's a problem because of these security issues and it would introduce this kind of risk into the company, the employees are very understanding.
Okay.
Not as much in the sense that when we send out a vendor questionnaire, they're very detailed and we look at a lot of things. And so the vendors that we send them to are not always really happy to fill them out.
Yeah. So when they're not happy to fill that out, are you having to do a lot of coaching and kind of justifying why they need to fill it out?
We do some coaching with them. We try to work with them and see if they have other questionnaires that ours is based off of. So perhaps we can cross map some answers or we can let them know. You can pull a lot of your answers from this type of questionnaire if you perhaps already have completed it. So you'll already have most of that information.
Gotcha.
Which usually helps them find most of what they need. And then there are just a couple customized answers or questions that we've put in there, which makes it go a lot faster for them. We also usually prep them and let them know you are going to need technical resources. So don't expect to be able to hand this to any employee in the company and have them like zip through it.
Right. And do you find being an engineer in the past helping you a lot more in your position right now?
I would say it helps more in that I'm used to working with engineers. Okay. And I have a background in working with some of the systems that we utilize. However, at the same time, all companies are different.
Okay.
And not working with the systems as much when I go from company to company in a compliance role, it definitely leaves me more out of touch with how that system operates, especially when their infrastructure gets more complicated.
Right. Yeah. And then what's the typical career path for someone looking to get into compliance? There are folks out there that do want to go straight into compliance, but don't have that experience. How would someone get into that type of role?
I would say just like with security, compliance doesn't have any one set career path. So I got into security in a very roundabout manner and probably compliance and even more of a roundabout manner.
Yeah. Tell us about that. I was going to get that today, but yeah, let's hear your story.
So I started off working my way through college in the medical field. I worked in pharmacy as I was in college and I had planned to go to law school. I eventually decided I didn't like that field. Theory isn't really something that I wanted to work with every day. I like having yes and no answers, knowing that what I'm doing has a set answer I can get to. So when I went through undergrad, I got a degree in liberal studies. I was working for the National Park Service by that point. And I wasn't very happy with my job and realized if I didn't go on to higher education, I was never going to move out of my job.
Okay.
It was a lot of administrative work. I spent multiple days a week synchronizing my boss's calendars because she had five. So I was initially looking for an MBA program because there's a lot of business in my family and it made sense. As I was looking, I came across a dual master's program for cybersecurity and MBA. And when I was looking into that, I realized that actually appealed to me. And I come from a family where we were always told, whatever you do, don't go into tech.
Oh, really?
Yes.
Why is that?
I have an uncle who is a programmer and it was not the right career path for him. So he is unhappy. Oh.
Okay.
And that was interpreted as it not being the right career path for anybody.
Oh, wow. Okay. Yeah. And so you saw this cybersecurity program, but then you had this like whisper in the back of your head about not going to tech.
Yes. Yes. But I saw this cybersecurity program and I did some research and I talked to the school about what jobs look like in the field.
Mm-hmm.
What the program itself looks like and whether somebody who doesn't have an undergraduate degree in like information systems and programming and something like that can go into the program. And as long as I was willing to put in extra research time on my own to catch up on anything that I may need for the classes, they're happy to take you into the program. Okay. So I ended up enrolling in that. And while still working full time at the park service, or mostly full time at the park service, my hours fluctuated every once in a while. But while still working at the park service, I worked my way through first my master's of science and cybersecurity, and then switched to my MBA once I completed the first master's and a couple different graduate certificates, I believe.
Okay. And what was your understanding of cybersecurity before you even saw that program?
I didn't know much about it. I knew that it was something. I worked for the government, which we had to have our annual security awareness training. But I also, I worked for the government, keep in mind, and their view of cloud computing at that point, like FedRAMP wasn't a thing at that point. Their view of the cloud was very much like, this is a fad, it will go away, but it's a really bad idea.
Yeah. Okay. Yeah. I hear that. Cool. And then, so you're finishing up your program doing the master's of cybersecurity was like two years.
Yeah. The master's of cybersecurity was two years and then the MBA was an additional year.
Okay. And then after that, I,
I moved down to the Bay Area and eventually got into an IT support position with Zenefits where I wrapped up. They didn't have a security program at the time, but as soon as they got a CISO, we figured out a transition onto the security team. Okay. And I worked in what would basically be like corporate system security. Okay. While I was there, and then I transitioned to cyber policy slash cover hound. They're two faces of the same coin who basically provides insurance quotes. I was there first, and I think still only actual security hire. My first day, my boss said she wanted me to get them to PCI compliance. Yeah.
Okay. Yeah.
Having not done compliance before, mind you. Right. Except like bits and pieces peripherally. So that was an undertaking, especially for a company that had call centers, had numerous different computer types.
Wow.
But we got there and I realized that I didn't mind compliance, whereas a lot of security engineers do everything in their power to avoid it.
Mm-hmm.
And what's more like approaching compliance as a security engineer makes it a lot easier for me to both talk to auditors and talk to technical resources.
Absolutely. Yeah, I agree.
So yeah, yeah, definitely.
Yeah. And so when you got out of the program, did you apply to cybersecurity jobs before that IT support position?
I did. I applied to a few.
And how was that experience? I'm sure you probably got some rejections at that point.
I did, mostly because my master's program had focused more on how to manage a program as opposed to how to conduct log reviews, for instance.
Versus like running a program and building a program, those other coins, I guess.
Yeah, so I knew from a high level what a program needed. I didn't know how to go into logs and identify a type of attack.
I see, okay.
While I could operate like a password cracker, while I knew what was required of password requirements, I could write policy, I couldn't necessarily go in and configure a firewall.
And that's what the rejections were based on? They were looking for someone operational?
Yeah.
Okay. Was that confusing coming out of the cybersecurity? Was that confusing? You're like, okay, I have this credentials.
It mostly made sense. I didn't have a work history in the field. They were contacting me based purely on my education.
Gotcha. And so what do you recommend to those out there looking to get a master's in cybersecurity? What should they look for?
I would say definitely look at, I mean, a master's in a lot of cases is probably overkill. There are tons of people in the industry who are self-taught. Really higher level degrees are if you want to do things like research, maybe management.
Mm-hmm.
Research in particular, like a PhD, I had somebody asked me recently about getting a PhD in cybersecurity. And I was like, really, if you want to do research, that's probably research or maybe teach at a university. Those would be the only reasons I would bother with that. Otherwise, I think I've encountered maybe one PhD in the field.
So that's a good point. Getting a master's might not actually be necessary. Would you do anything different looking back on your adventure into cybersecurity?
I don't think I necessarily would because I like working at the management level and especially working at it in compliance. The background that I have is very useful. But for people who want to do more in the weeds security work or even want to do more security management work, like you're going to have to move up through the in the weeds work, the IC work for that.
That's true. Yeah.
And so I would definitely say, even if you have a non-technical undergrad, definitely take the time to teach yourself to code. Take the time to learn to have those skills because they're going to be really useful. Learn about like the OWASP top 10, how to exploit vulnerabilities, because if you know how they're exploited, you know how to defend against them. Yeah. So I think that kind of knowledge for people who want to stick in the technical track is hugely beneficial.
Gotcha. Okay. And back to the master's in cybersecurity, just so we can finish that off. There are folks that insist or feel like they learn better in that type of environment. So what would be some things they should look for if they're definitely going to embark and have done the research, whether they should or not, if they're going to embark on a master's of cybersecurity? Yeah.
I would look for programs, obviously, that are accredited where you have instructors who have actually worked in the industry.
Oh, that's so important.
Yeah. So they actually have experience as opposed to just having completed their education so they can then teach others.
Yeah.
Right? Yeah. So make sure your instructors have industry experience. Another good option, especially whenever we go back to on campus classes, look for a school that has a capture the flag team.
Yeah, good one.
Because then you learn to do a lot of hands-on work by joining that team. I mean, it's a lot of more red team type work, but it is a lot of hands-on work. So those would be some of the things that I look at. I would also look at what your resources are like. My undergraduate school didn't have a very easy to use library system for while I was doing work at home. So look and see what kind of support you have from the school, just because you're going to reach those times where you're like working on a paper about some bizarre technical problem. And You want to make sure you're able to do your research and it's not necessarily going to be in a book. And also you don't necessarily want to have to buy a ton of books.
So make sure you have the ability to do research without having to go into the library all the time.
Gotcha. Okay.
But I think the two I would, I would mostly emphasize is those instructors with real world experience. Those are some of the best instructors I had. And then also get on a capture the flag team.
Yeah, no, that's great advice. That's really good advice. And talking about instructors with real world experience, let's talk about mentorship a little bit. I think the way I met you was at a day of security talk. And I was really blown away by that talk. I was really like kind of inspired. And I'm like, oh, so and you talked about mentorship. So how did mentorship play a role in your life?
I would say mentorships mostly played a huge role because I mean, I've never necessarily had a problem finding the mentors, but I've found that some of the best experience I've gained has been from people who helped me plan my career. Okay. So going into cybersecurity, going into the security employment force, it's hard to figure out which areas maybe I'll be good at or which areas really appeal to me because there are so many different areas of security. And so having somebody who's been in security for a little bit and knows what the different options are, knows what certifications might be useful, or at least what classes might be useful to learn more is hugely helpful. Even if they aren't necessarily mentors in the sense that they sit down and they work through, this is exactly how you do something.
They can help point you in the right direction to help your career grow. That's not to say that I haven't also had mentors that have done things like work through how to figure out different things in Active Directory with me. I had one mentor who worked through bits and pieces of an OS query implementation with me. I did chunks of it on my own, and if I hit a wall, he would point me in the right direction. Okay. So having both types is hugely useful because one will be available when you hit roadblocks in your work because they have those skill sets that you may not have developed yet. And the other one helps you to figure which direction you want to go in your career and how best to meet your goals.
Yeah, I think the career planning part is really hard because with so many forks in the road, right, so many options out there.
Yeah.
Where do we go? And then does personality type help as well?
Personality does to a point for sure.
Yeah.
Like you definitely won't have somebody who is just made for application security. You don't want to stick them in a compliance job. Yeah.
Yeah, yeah.
So I feel like most people, they get into security and they have that image of it being largely application security with maybe like a little bit of blue team. But there are so many different roles and it's so much like you have product security, you have compliance, you have physical security. Like it's breaking up into smaller roles more and more often.
Mm-hmm.
And so that is something that it really helps to have some guidance in. So you know where, I mean, partially where your skill set fits, but even if your current skill set doesn't fit there, but you have like a really strong interest in an area, then maybe it makes sense to adjust your skill set a little bit. Like maybe you just love working with AWS and it makes more sense to be more like infrasec. Because you like securing the infrastructure within AWS and making sure deployments are secure. It doesn't make as much sense for you to work on application security, even if you already have that skill set.
Yeah, cool. How did you find your mentors? And what is some advice for folks out there regarding finding a mentor? What is your advice for folks out there looking to get mentorship today?
Absolutely. I have mostly, I guess, happened into my mentors based on workplaces, but mentors can really be anyone. Mine, two that come to mind happen to have been my boss in IT from Zenefits and then a CISO that I've worked for a couple of times. My IT director helped me figure out that transition from federal government to tech startup, which was a huge change. Communications were super different. The politics were super different. And the functions of different departments worked different. So that was something he helped me navigate. And then my CISO was that career planning person for me. Specifically helping to figure out directions that made sense for me and how to map to my personal goals.
He was always available for questions surrounding different security subjects and overall just provided a lot of support and guidance. But really, I think it's also important to keep in mind that you can have things that I personally like to call anti-mentors. And I'm sure you encounter like people encounter these at work. They encounter them at school. They encounter them just throughout life.
Yeah.
And I think it's important to remember that like bad examples are still examples.
Oh, interesting. Yeah.
So when you see somebody who's doing something that shouldn't be done, learn from other people's mistakes. Make that mental note so that you don't make the same mistake.
Mm-hmm.
I mean, for example, if there's an issue in the company, if some client information is leaked, make a mental note of how that was done or make a mental note of where your data classification policy is and what you can and cannot share. So you make sure you don't make that same mistake. If you have somebody who just is always that water cooler chatterer, Who annoys everybody because they go desk to desk to desk talking all the time and nobody can figure out when they do actual work.
Oh my God.
Make sure that maybe while you are still making sure you network with your colleagues, that you're keeping it to a point that it's still professional.
Or at least have some emotional intelligence to understand when you're interrupting someone, right?
Yeah. Make sure you're not that person that's interfering with people's work. Make sure that people know you're still getting your work done so that your position at the company isn't in question.
Gotcha. So I pulled up my notes from the day of security talk and I have some quotes in here. So there's one thing where you said, I don't know what the context of it was, kind of a security mentor to an everything mentor. What's the difference there?
Yeah, I believe that was my CISO that I was talking about. So after he left Cinefits, he moved to another company. I also ended up moving to another company. And... He transitioned from mentoring me in my role and security to just kind of like helping mentor through a lot of different life problems. We became really good friends. So like I knew I could go to him if I had questions about career, if I had questions about travel, just like things you would go to a normal friend for. Yeah. So that was one of those areas that I just, I lucked out and I got a really good mentor that went beyond the bounds of just helping my security career.
Nice. Okay, cool. And then, yeah, there was just several other things I remember from that talk. You talked about the National Consortium of Minorities. Can you tell us more about that?
Yeah. So when I was at OneLogin, one of the things we did was we did a, I believe we called it a bug bounty bash. So basically it was like a hacker event where some of the top hackers were invited to come and live hack some programs.
Mm-hmm.
Because we set it up, I believe what we did is we did a live event for one login. And the way we ran it was we identified two different charity organizations that a minimum of X amount or X percentage of any proceeds that the hackers won would be donated to. And then the hackers could choose to donate any percentage more that they wanted. And of the two, we went with QueerCon and the National Consortium of Cyber Professionals. Is that what you said?
I said National Consortium of Minorities, but I guess... National Consortium of Minorities. Minorities, yeah.
So just about different minorities working together.
Yeah. Something about underrepresented minorities and, or we don't have to talk about it. Those are things that I have in my notes.
Yeah.
Of course, what you had in your presentation was much more powerful than me. And it's not something that, you know, but yeah.
Yeah, absolutely. So there's a quote I had in my presentation from the president of Harvard, which was, I'm not the woman president of Harvard. I'm the president of Harvard. I think it's definitely something that still comes up and it's why you encounter conferences that are Designed just for women or just for minorities because they're not necessarily comfortable with people outside their community coming in. So I think it's important to keep in mind that some of these boundaries need to be broken down. For example, we don't want to be seen as token hires. We have skills. No matter what our ethnicity, no matter what our gender identity, we have skills. We don't need extra help to get positions.
We got the position based on our merits. And please don't question that. And we're just as competent as anybody else.
Mm-hmm.
So by questioning that, like some CS is asking for special treatment, but we need to believe that, I guess we need to make sure we're asking for our support. Like when we're in a meeting, make sure that whatever point we're making, we're backing up with our own skills, our own qualifications, our own points. So that people understand we do have those skills and we're not just falling back on, oh, you need to listen to me because I'm that token hire. So like when you are challenged, I mean, it's going to happen. You're going to be challenged in any work meeting, right? Nobody's ever going to agree. Like just fall back on whatever your qualifications are. Have you been coding since you were 16?
Yeah. Did you teach yourself to hack when you were 12 and you just happened to have a ton of experience? Do you have four different undergrads in information security because you just really loved it? And do you have your CISSP? Do you just have this insane memory that holds facts and you know you read this in 12 different places? Hmm. So fall back on your qualifications and your experience. Don't be afraid to share that you know these things, because that information is valuable. And the fact that you know, it just has brings that much more to the table. And then I mean, know that your team should be backing you like You might disagree with part of it, but ultimately that information is going to help move whatever that discussion is forward towards what is going to be a better solution in the end.
And be confident in yourself. Speak with confidence. It lends that much more to your argument or your discussion, whatever topic you're trying to bring up. And just beyond that, I would mention that we need to try to be a little less divisive in there's this minority group in security and this minority group in security and this minority group in security, because then you have a lot of small groups with limited resources. And if these groups can combine, then you're going to have a much larger group with a much louder voice and a lot more resources.
Wow, that's pretty powerful. Yeah, that's really interesting perspective and something to think about. And just good advice in general, like I can use that advice, right? Anybody can use that advice, like just talking confidently and just falling back on your merits.
Yeah.
So you talked about something, you know, when you're challenged in the workplace, I get challenged all the time. How do you as a security person handle being challenged?
It depends on the challenge, obviously. But I, for the most part, will take it in context. If it's something where I know that my point is correct, then I will explain my position. If it's more something where it's based on whatever somebody's opinion could be, then it's more of a discussion compromise kind of thing. Right? Like, what's the best way to do this? Well, you could do it any number of ways, and there's not really a best. So let's see what's going to be most effective for our team. If it's something that's more, there is a yes or no, and we just need to figure out what that is, then it's not so much a discussion compromise. Mm-hmm. And sometimes it takes going back to research, right?
If nobody's absolutely sure, then we need to go back and find what the actual answer is. But I do try to make sure that if I'm not 100% sure, I'm going to make sure that the right answer is Found and I'm not just pushing my answer because it's my answer. And then also if it is one of those situations where it's more of what's the best in this situation that we are considering all of the viewpoints and what is going to be best for this particular situation in this particular company at this particular time.
Right.
But also that can scale so that we're not doing something that's right just right now, but won't be in two months and we're going to have to completely redo it.
Gotcha. Yeah. So that was just a tough discussion to follow. So compliance frameworks seem to like be slow to change, right?
Yeah.
And so how do you deal with a compliance framework that hasn't really kept up with the latest like technology as far as like, yeah, looking for compensating controls and stuff?
I would say you're usually lucky in that if you go above what's required, you're not generally penalized.
Interesting.
Yeah. So while it may only require TLS 1.1, if you do TLS 1.2, they're not going to complain.
Right.
Yeah.
Okay. Well, what about things like 90 day expirations, right? Like PCI, for example, requires 90 day expirations, but 4.0 it's coming out. That's going to go away for certain user accounts, for example, especially if you have 2FA or whatever, maybe I haven't read the latest.
Right.
Right. Like, so how do you deal with that, for example?
I mean, part of it has to do with your auditor and how they will interpret particular frameworks. With some frameworks, it's a matter of you can find exceptions around certain rules if what you're doing can be shown to be more secure. Yeah. With other things, sometimes you have to be a little bit more by the book and then just also offer your own extra security. It's usually better when you have a framework that will let you do something more secure as an exception because it's better security based on whatever this NIST guideline is or something like that.
And so you're in a hiring manager position right now. Yep. And you have been in the past. What are some things you look for when you're looking to hire a compliance person?
I look for a combination of things. Experience is always a bonus. Okay. And that being just a combination of things like which frameworks they've worked with, the amount of years they have in, their ability to communicate well with people. Can they communicate well with engineers is huge. And enthusiasm is huge. I would much rather have somebody who's enthusiastic and can talk to my engineers without upsetting them than has every single compliance framework on their list that we have, because you can learn a framework, but you're not likely to learn people skills if you don't have them yet.
Yeah. Wow. That's well said. Okay.
Yeah.
And what else do you look for?
I mean, personality a lot of times, because if you have clashing personalities on your team, it's going to be difficult. And some of that comes down to like taking into account how nervous they are and everything. For example, if you're an employee who cannot handle working with female engineers, that's not going to work very well. And that has to be taken into consideration. That also comes up in the like, can't talk to engineers because one of my interviewers is usually a female engineer.
I guess you just figure that out in an interview?
Yeah.
Have you had that happen before?
Yeah, I'll do joint interviews. And if they won't look at that person or answer their questions, it's usually not a good sign.
Whoa, that happens?
Yep.
I'm pretty naive in many areas. So really, you'll have candidates that won't answer questions from female engineers?
It's not happened a lot, but it's happened once or twice.
Wow, that's sad.
Yeah.
That's interesting. Okay, so on the note of enthusiasm and not having that much experience, so like someone who doesn't have experience and is looking to get into compliance. So for example, they may have either graduated from college or went to some boot camp or I don't know, have something but don't really have real world experience, but they want to go to compliance for whatever reason. What is some advice to them from you on how to get into compliance?
I would say look into, like read up on some different frameworks and the requirements there, like the industries that use them and at least the best practices. Make sure you're familiar with both security frameworks and privacy frameworks. And just try and stay on top of some industry news. So like the EU just invalidated Privacy Shield, for instance.
I know, that's right. Oh, we could have a whole podcast on that.
We could. Yeah.
So you don't necessarily want to go into an interview next week and talk about how great Privacy Shield is because we can move data from any European country or any EU country to the US because yay Privacy Shield when it was just invalidated. So you definitely want to keep up on some of that.
Yeah.
So I would definitely keep up on some of that news. IAPP is a great one to follow for privacy.
IAPP?
Yes.
Okay.
And then security is just kind of a matter of what kind of information you're looking for. Actually, one of my employees swears by the privacy groups in Reddit.
Okay.
She absolutely loves them and she's my go-to privacy person on the team.
Okay.
So I would keep up on top of some industry news and just make sure you have like a working knowledge. It doesn't have to be like in depth. You don't have to be able to quote every control in the framework, but have a general idea of like what the framework does and who it applies to.
Hmm. Okay.
So if you're a company that doesn't handle PHI, you don't touch PHI, you don't want to go in talking about how much you know about HIPAA.
Right. Makes sense.
Yeah.
Okay, cool. Well, this has been fun and quite informative. This has been a fun interview and I'd love to get those Reddit links about privacy and I'll include them in the show notes.
Yeah. I will ask her for the groups that she follows.
Yeah. Any other parting advice before we go?
Not that I can think of off the top of my head, but it's been great speaking with you again.
Okay. Yeah. Thanks again for coming on and I really appreciate your time.
Likewise.
All right. Bye-bye. Bye. As always, if you like the show, please thank my guests for their time and let others know about the show. They might thank you for it. Intro music is Cascadia by Trash80, Trash80.com. Check out the website, gettingintoinfosec.com for show notes, a preview of my book and more. And stay in touch on Twitter for more Getting Into Infosec reflections.
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
