Getting Into Infosec, Episode 39: Samantha Cowan - From National Parks Service To Head Of Compliance
Published June 1, 2021 · 40 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/samantha/

[0:00] Samantha Cowan: We don't want to be seen as token hires. We have skills, no matter what our ethnicity, no matter what our gender identity, we have skills. We don't need extra help to get positions. We got the position based on our merits. And please don't question that. And we're just as competent as anybody else.

[0:39] Ayman Elsawah: Welcome to Getting Into Infosec. I'm your host, Ayman Elsawah. My guest this week is Samantha Cohen. Samantha is currently the head of compliance at HackerOne. She's a former director of compliance at OneLogin and former security engineer at CoverHound, Cyber Policy, and Zenefits. In today's episode, Sam will share her incredible journey from having to perceive infosec as an unhappy job towards paving her way to cybersecurity.

[1:01] Samantha Cowan: I come from a family where we were always told, whatever you do, don't go into tech. I have an uncle who is a programmer and it was not the right career path for him. So he is unhappy. And that was interpreted as it not being the right career path for anybody.

[1:22] Ayman Elsawah: Despite having a master's degree, Samantha was never an exemption from rejection when getting into cybersecurity. Her greatest advice for people who want to work in the weeds of security or security management is to take the time to learn the ropes.

[1:34] Samantha Cowan: And so I would definitely say, even if you have a non-technical undergrad, definitely take the time to teach yourself to code. Take the time to learn to have those skills because they're going to be really useful. Learn about like the OWASP top 10, how to exploit vulnerabilities, because if you know how they're exploited, you know how to defend against them. So I think that kind of knowledge for people who want to stick in the technical track is hugely beneficial.

[2:07] Ayman Elsawah: I know you'll love this episode with Samantha. She's incredibly amazing in sharing actionable tips that you can apply in growing your career. All right, on to the show. Hi, Samantha. Welcome to the show.

[2:16] Samantha Cowan: Thank you so much.

[2:18] Ayman Elsawah: Yeah. Thanks for coming on. So for those out there that don't know you, maybe you could introduce yourself and let people know what you do today.

[2:24] Samantha Cowan: Absolutely. My name is Samantha Cowan. I am the head of security compliance at HackerOne currently.

[2:30] Ayman Elsawah: Okay. Okay. That's awesome. And you've been in similar roles in the past?

[2:34] Samantha Cowan: I have. Previously, I was the director of compliance at OneLogin. And before that, I was a security engineer who also did compliance at Coverhound and Cyber Policy. And before that, I was a security engineer at Zenefits.

[2:51] Ayman Elsawah: Okay. So compliance gets a bad rap sometimes out there. Can you tell us what compliance is about and what goes on in your world as the head of compliance?

[3:00] Samantha Cowan: Absolutely. So compliance, I feel like it's a bad rap, largely because they're seen as two things. They're seen by people and employees as that department that's always telling you no. Security also gets that reputation. And we're also seen as that department who's always giving new requirements with no real explanation as to why they're needed other than because compliance. And so engineers a lot of times will get frustrated with us because they're being asked for things, but they don't really understand why.

[3:35] Ayman Elsawah: Mm-hmm.

[3:36] Samantha Cowan: So what we do on my team and the way that I generally approach compliance is that we take things that are a business need that are needed in order to drive sales. So we take actual evidence from our sales teams, like we're potentially losing sales because we don't have X. And then we look at what it would take to add that to our compliance portfolio, essentially. And then we see where we already match up with that. And if we already have a compliance framework that offers that, or if we needed to bring into something new. And we do a cross mapping for bringing in something new where we already meet the requirements versus where we have gaps. And then we'll work with any teams, generally engineering teams, sometimes HR, finance, depending on what controls are there.

[4:32] Samantha Cowan: To see where we need to perhaps add some more tech, some more policies, anything like that to be able to meet this new framework. And then that in turn goes back to sales and boost sales for the company, which lets us grow and benefits all of us. So that's one component of what we do. We also do RFIs. So when we have either customers who are renewing or we have new customers, they send us questionnaires so we can provide information about the security of our company, the compliance of our company, how we meet privacy requirements, which allows sales to happen and renewals to take place or expand programs. And then the third component of what we do is to perform our vendor risk assessments. So when a department needs a new tool that they want to bring in, they submit that to my team and we review the vendor based on their own security to ensure that we're not introducing a risk into our company.

[5:38] Ayman Elsawah: And how do you work with vendors that maybe or even employees or systems that don't meet your standards? Is it like you must change this right now or do you have a more gradual approach towards having them fix things?

[5:51] Samantha Cowan: It depends on the vendor. Honestly, a lot of things that we encounter are relatively minor and we can work through it with the vendors. Or maybe they didn't understand the question in the questionnaire and were able to find that they actually do have compensating controls around something. Or again, maybe they just flat misunderstood the question. Other times we ask if they can make a change that eliminates the risk that's in that area. And we try to work with the vendor to eliminate the risk. If we absolutely can't do that, we start looking to see if there are alternatives, if there are other vendors that perhaps weren't explored, if there's another way to accomplish this function, if maybe we already have a vendor that does this that was overlooked so that we aren't bringing unnecessary risk into the systems or into the company.

[6:44] Ayman Elsawah: Right. And do you find working compliance at a security company to be easier than if you were compliance at a non-security focused company?

[6:53] Samantha Cowan: Yes and no. Yes, in the sense that our security functions are pretty spread out throughout the company and our employees are all very security minded. So when we say there's a problem because of these security issues and it would introduce this kind of risk into the company, the employees are very understanding.

[7:16] Ayman Elsawah: Okay.

[7:17] Samantha Cowan: Not as much in the sense that when we send out a vendor questionnaire, they're very detailed and we look at a lot of things. And so the vendors that we send them to are not always really happy to fill them out.

[7:32] Ayman Elsawah: Yeah. So when they're not happy to fill that out, are you having to do a lot of coaching and kind of justifying why they need to fill it out?

[7:39] Samantha Cowan: We do some coaching with them. We try to work with them and see if they have other questionnaires that ours is based off of. So perhaps we can cross map some answers or we can let them know. You can pull a lot of your answers from this type of questionnaire if you perhaps already have completed it. So you'll already have most of that information.

[7:59] Ayman Elsawah: Gotcha.

[7:59] Samantha Cowan: Which usually helps them find most of what they need. And then there are just a couple customized answers or questions that we've put in there, which makes it go a lot faster for them. We also usually prep them and let them know you are going to need technical resources. So don't expect to be able to hand this to any employee in the company and have them like zip through it.

[8:18] Ayman Elsawah: Right. And do you find being an engineer in the past helping you a lot more in your position right now?

[8:24] Samantha Cowan: I would say it helps more in that I'm used to working with engineers. Okay. And I have a background in working with some of the systems that we utilize. However, at the same time, all companies are different.

[8:41] Ayman Elsawah: Okay.

[8:42] Samantha Cowan: And not working with the systems as much when I go from company to company in a compliance role, it definitely leaves me more out of touch with how that system operates, especially when their infrastructure gets more complicated.

[8:57] Ayman Elsawah: Right. Yeah. And then what's the typical career path for someone looking to get into compliance? There are folks out there that do want to go straight into compliance, but don't have that experience. How would someone get into that type of role?

[9:09] Samantha Cowan: I would say just like with security, compliance doesn't have any one set career path. So I got into security in a very roundabout manner and probably compliance and even more of a roundabout manner.

[9:22] Ayman Elsawah: Yeah. Tell us about that. I was going to get that today, but yeah, let's hear your story.

[9:25] Samantha Cowan: So I started off working my way through college in the medical field. I worked in pharmacy as I was in college and I had planned to go to law school. I eventually decided I didn't like that field. Theory isn't really something that I wanted to work with every day. I like having yes and no answers, knowing that what I'm doing has a set answer I can get to. So when I went through undergrad, I got a degree in liberal studies. I was working for the National Park Service by that point. And I wasn't very happy with my job and realized if I didn't go on to higher education, I was never going to move out of my job.

[10:06] Ayman Elsawah: Okay.

[10:07] Samantha Cowan: It was a lot of administrative work. I spent multiple days a week synchronizing my boss's calendars because she had five. So I was initially looking for an MBA program because there's a lot of business in my family and it made sense. As I was looking, I came across a dual master's program for cybersecurity and MBA. And when I was looking into that, I realized that actually appealed to me. And I come from a family where we were always told, whatever you do, don't go into tech.

[10:40] Ayman Elsawah: Oh, really?

[10:41] Samantha Cowan: Yes.

[10:41] Ayman Elsawah: Why is that?

[10:42] Samantha Cowan: I have an uncle who is a programmer and it was not the right career path for him. So he is unhappy. Oh.

[10:52] Ayman Elsawah: Okay.

[10:53] Samantha Cowan: And that was interpreted as it not being the right career path for anybody.

[10:58] Ayman Elsawah: Oh, wow. Okay. Yeah. And so you saw this cybersecurity program, but then you had this like whisper in the back of your head about not going to tech.

[11:05] Samantha Cowan: Yes. Yes. But I saw this cybersecurity program and I did some research and I talked to the school about what jobs look like in the field.

[11:16] Ayman Elsawah: Mm-hmm.

[11:16] Samantha Cowan: What the program itself looks like and whether somebody who doesn't have an undergraduate degree in like information systems and programming and something like that can go into the program. And as long as I was willing to put in extra research time on my own to catch up on anything that I may need for the classes, they're happy to take you into the program. Okay. So I ended up enrolling in that. And while still working full time at the park service, or mostly full time at the park service, my hours fluctuated every once in a while. But while still working at the park service, I worked my way through first my master's of science and cybersecurity, and then switched to my MBA once I completed the first master's and a couple different graduate certificates, I believe.

[12:00] Ayman Elsawah: Okay. And what was your understanding of cybersecurity before you even saw that program?

[12:06] Samantha Cowan: I didn't know much about it. I knew that it was something. I worked for the government, which we had to have our annual security awareness training. But I also, I worked for the government, keep in mind, and their view of cloud computing at that point, like FedRAMP wasn't a thing at that point. Their view of the cloud was very much like, this is a fad, it will go away, but it's a really bad idea.

[12:35] Ayman Elsawah: Yeah. Okay. Yeah. I hear that. Cool. And then, so you're finishing up your program doing the master's of cybersecurity was like two years.

[12:42] Samantha Cowan: Yeah. The master's of cybersecurity was two years and then the MBA was an additional year.

[12:48] Ayman Elsawah: Okay. And then after that, I,

[12:50] Samantha Cowan: I moved down to the Bay Area and eventually got into an IT support position with Zenefits where I wrapped up. They didn't have a security program at the time, but as soon as they got a CISO, we figured out a transition onto the security team. Okay. And I worked in what would basically be like corporate system security. Okay. While I was there, and then I transitioned to cyber policy slash cover hound. They're two faces of the same coin who basically provides insurance quotes. I was there first, and I think still only actual security hire. My first day, my boss said she wanted me to get them to PCI compliance. Yeah.

[13:37] Ayman Elsawah: Okay. Yeah.

[13:38] Samantha Cowan: Having not done compliance before, mind you. Right. Except like bits and pieces peripherally. So that was an undertaking, especially for a company that had call centers, had numerous different computer types.

[13:52] Ayman Elsawah: Wow.

[13:52] Samantha Cowan: But we got there and I realized that I didn't mind compliance, whereas a lot of security engineers do everything in their power to avoid it.

[14:06] Ayman Elsawah: Mm-hmm.

[14:06] Samantha Cowan: And what's more like approaching compliance as a security engineer makes it a lot easier for me to both talk to auditors and talk to technical resources.

[14:17] Ayman Elsawah: Absolutely. Yeah, I agree.

[14:19] Samantha Cowan: So yeah, yeah, definitely.

[14:22] Ayman Elsawah: Yeah. And so when you got out of the program, did you apply to cybersecurity jobs before that IT support position?

[14:27] Samantha Cowan: I did. I applied to a few.

[14:30] Ayman Elsawah: And how was that experience? I'm sure you probably got some rejections at that point.

[14:33] Samantha Cowan: I did, mostly because my master's program had focused more on how to manage a program as opposed to how to conduct log reviews, for instance.

[14:50] Ayman Elsawah: Versus like running a program and building a program, those other coins, I guess.

[14:54] Samantha Cowan: Yeah, so I knew from a high level what a program needed. I didn't know how to go into logs and identify a type of attack.

[15:04] Ayman Elsawah: I see, okay.

[15:04] Samantha Cowan: While I could operate like a password cracker, while I knew what was required of password requirements, I could write policy, I couldn't necessarily go in and configure a firewall.

[15:17] Ayman Elsawah: And that's what the rejections were based on? They were looking for someone operational?

[15:21] Samantha Cowan: Yeah.

[15:21] Ayman Elsawah: Okay. Was that confusing coming out of the cybersecurity? Was that confusing? You're like, okay, I have this credentials.

[15:27] Samantha Cowan: It mostly made sense. I didn't have a work history in the field. They were contacting me based purely on my education.

[15:33] Ayman Elsawah: Gotcha. And so what do you recommend to those out there looking to get a master's in cybersecurity? What should they look for?

[15:39] Samantha Cowan: I would say definitely look at, I mean, a master's in a lot of cases is probably overkill. There are tons of people in the industry who are self-taught. Really higher level degrees are if you want to do things like research, maybe management.

[15:58] Ayman Elsawah: Mm-hmm.

[15:59] Samantha Cowan: Research in particular, like a PhD, I had somebody asked me recently about getting a PhD in cybersecurity. And I was like, really, if you want to do research, that's probably research or maybe teach at a university. Those would be the only reasons I would bother with that. Otherwise, I think I've encountered maybe one PhD in the field.

[16:21] Ayman Elsawah: So that's a good point. Getting a master's might not actually be necessary. Would you do anything different looking back on your adventure into cybersecurity?

[16:30] Samantha Cowan: I don't think I necessarily would because I like working at the management level and especially working at it in compliance. The background that I have is very useful. But for people who want to do more in the weeds security work or even want to do more security management work, like you're going to have to move up through the in the weeds work, the IC work for that.

[16:58] Ayman Elsawah: That's true. Yeah.

[16:59] Samantha Cowan: And so I would definitely say, even if you have a non-technical undergrad, definitely take the time to teach yourself to code. Take the time to learn to have those skills because they're going to be really useful. Learn about like the OWASP top 10, how to exploit vulnerabilities, because if you know how they're exploited, you know how to defend against them. Yeah. So I think that kind of knowledge for people who want to stick in the technical track is hugely beneficial.

[17:30] Ayman Elsawah: Gotcha. Okay. And back to the master's in cybersecurity, just so we can finish that off. There are folks that insist or feel like they learn better in that type of environment. So what would be some things they should look for if they're definitely going to embark and have done the research, whether they should or not, if they're going to embark on a master's of cybersecurity? Yeah.

[17:48] Samantha Cowan: I would look for programs, obviously, that are accredited where you have instructors who have actually worked in the industry.

[17:56] Ayman Elsawah: Oh, that's so important.

[17:58] Samantha Cowan: Yeah. So they actually have experience as opposed to just having completed their education so they can then teach others.

[18:05] Ayman Elsawah: Yeah.

[18:08] Samantha Cowan: Right? Yeah. So make sure your instructors have industry experience. Another good option, especially whenever we go back to on campus classes, look for a school that has a capture the flag team.

[18:21] Ayman Elsawah: Yeah, good one.

[18:22] Samantha Cowan: Because then you learn to do a lot of hands-on work by joining that team. I mean, it's a lot of more red team type work, but it is a lot of hands-on work. So those would be some of the things that I look at. I would also look at what your resources are like. My undergraduate school didn't have a very easy to use library system for while I was doing work at home. So look and see what kind of support you have from the school, just because you're going to reach those times where you're like working on a paper about some bizarre technical problem. And You want to make sure you're able to do your research and it's not necessarily going to be in a book. And also you don't necessarily want to have to buy a ton of books.

[19:09] Samantha Cowan: So make sure you have the ability to do research without having to go into the library all the time.

[19:14] Ayman Elsawah: Gotcha. Okay.

[19:16] Samantha Cowan: But I think the two I would, I would mostly emphasize is those instructors with real world experience. Those are some of the best instructors I had. And then also get on a capture the flag team.

[19:27] Ayman Elsawah: Yeah, no, that's great advice. That's really good advice. And talking about instructors with real world experience, let's talk about mentorship a little bit. I think the way I met you was at a day of security talk. And I was really blown away by that talk. I was really like kind of inspired. And I'm like, oh, so and you talked about mentorship. So how did mentorship play a role in your life?

[19:47] Samantha Cowan: I would say mentorships mostly played a huge role because I mean, I've never necessarily had a problem finding the mentors, but I've found that some of the best experience I've gained has been from people who helped me plan my career. Okay. So going into cybersecurity, going into the security employment force, it's hard to figure out which areas maybe I'll be good at or which areas really appeal to me because there are so many different areas of security. And so having somebody who's been in security for a little bit and knows what the different options are, knows what certifications might be useful, or at least what classes might be useful to learn more is hugely helpful. Even if they aren't necessarily mentors in the sense that they sit down and they work through, this is exactly how you do something.

[20:50] Samantha Cowan: They can help point you in the right direction to help your career grow. That's not to say that I haven't also had mentors that have done things like work through how to figure out different things in Active Directory with me. I had one mentor who worked through bits and pieces of an OS query implementation with me. I did chunks of it on my own, and if I hit a wall, he would point me in the right direction. Okay. So having both types is hugely useful because one will be available when you hit roadblocks in your work because they have those skill sets that you may not have developed yet. And the other one helps you to figure which direction you want to go in your career and how best to meet your goals.

[21:39] Ayman Elsawah: Yeah, I think the career planning part is really hard because with so many forks in the road, right, so many options out there.

[21:46] Samantha Cowan: Yeah.

[21:46] Ayman Elsawah: Where do we go? And then does personality type help as well?

[21:49] Samantha Cowan: Personality does to a point for sure.

[21:52] Ayman Elsawah: Yeah.

[21:52] Samantha Cowan: Like you definitely won't have somebody who is just made for application security. You don't want to stick them in a compliance job. Yeah.

[22:03] Ayman Elsawah: Yeah, yeah.

[22:05] Samantha Cowan: So I feel like most people, they get into security and they have that image of it being largely application security with maybe like a little bit of blue team. But there are so many different roles and it's so much like you have product security, you have compliance, you have physical security. Like it's breaking up into smaller roles more and more often.

[22:25] Ayman Elsawah: Mm-hmm.

[22:26] Samantha Cowan: And so that is something that it really helps to have some guidance in. So you know where, I mean, partially where your skill set fits, but even if your current skill set doesn't fit there, but you have like a really strong interest in an area, then maybe it makes sense to adjust your skill set a little bit. Like maybe you just love working with AWS and it makes more sense to be more like infrasec. Because you like securing the infrastructure within AWS and making sure deployments are secure. It doesn't make as much sense for you to work on application security, even if you already have that skill set.

[23:06] Ayman Elsawah: Yeah, cool. How did you find your mentors? And what is some advice for folks out there regarding finding a mentor? What is your advice for folks out there looking to get mentorship today?

[23:17] Samantha Cowan: Absolutely. I have mostly, I guess, happened into my mentors based on workplaces, but mentors can really be anyone. Mine, two that come to mind happen to have been my boss in IT from Zenefits and then a CISO that I've worked for a couple of times. My IT director helped me figure out that transition from federal government to tech startup, which was a huge change. Communications were super different. The politics were super different. And the functions of different departments worked different. So that was something he helped me navigate. And then my CISO was that career planning person for me. Specifically helping to figure out directions that made sense for me and how to map to my personal goals.

[24:15] Samantha Cowan: He was always available for questions surrounding different security subjects and overall just provided a lot of support and guidance. But really, I think it's also important to keep in mind that you can have things that I personally like to call anti-mentors. And I'm sure you encounter like people encounter these at work. They encounter them at school. They encounter them just throughout life.

[24:38] Ayman Elsawah: Yeah.

[24:39] Samantha Cowan: And I think it's important to remember that like bad examples are still examples.

[24:44] Ayman Elsawah: Oh, interesting. Yeah.

[24:45] Samantha Cowan: So when you see somebody who's doing something that shouldn't be done, learn from other people's mistakes. Make that mental note so that you don't make the same mistake.

[24:55] Ayman Elsawah: Mm-hmm.

[24:56] Samantha Cowan: I mean, for example, if there's an issue in the company, if some client information is leaked, make a mental note of how that was done or make a mental note of where your data classification policy is and what you can and cannot share. So you make sure you don't make that same mistake. If you have somebody who just is always that water cooler chatterer, Who annoys everybody because they go desk to desk to desk talking all the time and nobody can figure out when they do actual work.

[25:33] Ayman Elsawah: Oh my God.

[25:34] Samantha Cowan: Make sure that maybe while you are still making sure you network with your colleagues, that you're keeping it to a point that it's still professional.

[25:45] Ayman Elsawah: Or at least have some emotional intelligence to understand when you're interrupting someone, right?

[25:49] Samantha Cowan: Yeah. Make sure you're not that person that's interfering with people's work. Make sure that people know you're still getting your work done so that your position at the company isn't in question.

[26:01] Ayman Elsawah: Gotcha. So I pulled up my notes from the day of security talk and I have some quotes in here. So there's one thing where you said, I don't know what the context of it was, kind of a security mentor to an everything mentor. What's the difference there?

[26:12] Samantha Cowan: Yeah, I believe that was my CISO that I was talking about. So after he left Cinefits, he moved to another company. I also ended up moving to another company. And... He transitioned from mentoring me in my role and security to just kind of like helping mentor through a lot of different life problems. We became really good friends. So like I knew I could go to him if I had questions about career, if I had questions about travel, just like things you would go to a normal friend for. Yeah. So that was one of those areas that I just, I lucked out and I got a really good mentor that went beyond the bounds of just helping my security career.

[26:58] Ayman Elsawah: Nice. Okay, cool. And then, yeah, there was just several other things I remember from that talk. You talked about the National Consortium of Minorities. Can you tell us more about that?

[27:08] Samantha Cowan: Yeah. So when I was at OneLogin, one of the things we did was we did a, I believe we called it a bug bounty bash. So basically it was like a hacker event where some of the top hackers were invited to come and live hack some programs.

[27:28] Ayman Elsawah: Mm-hmm.

[27:28] Samantha Cowan: Because we set it up, I believe what we did is we did a live event for one login. And the way we ran it was we identified two different charity organizations that a minimum of X amount or X percentage of any proceeds that the hackers won would be donated to. And then the hackers could choose to donate any percentage more that they wanted. And of the two, we went with QueerCon and the National Consortium of Cyber Professionals. Is that what you said?

[28:04] Ayman Elsawah: I said National Consortium of Minorities, but I guess... National Consortium of Minorities. Minorities, yeah.

[28:10] Samantha Cowan: So just about different minorities working together.

[28:12] Ayman Elsawah: Yeah. Something about underrepresented minorities and, or we don't have to talk about it. Those are things that I have in my notes.

[28:18] Samantha Cowan: Yeah.

[28:18] Ayman Elsawah: Of course, what you had in your presentation was much more powerful than me. And it's not something that, you know, but yeah.

[28:25] Samantha Cowan: Yeah, absolutely. So there's a quote I had in my presentation from the president of Harvard, which was, I'm not the woman president of Harvard. I'm the president of Harvard. I think it's definitely something that still comes up and it's why you encounter conferences that are Designed just for women or just for minorities because they're not necessarily comfortable with people outside their community coming in. So I think it's important to keep in mind that some of these boundaries need to be broken down. For example, we don't want to be seen as token hires. We have skills. No matter what our ethnicity, no matter what our gender identity, we have skills. We don't need extra help to get positions.

[29:16] Samantha Cowan: We got the position based on our merits. And please don't question that. And we're just as competent as anybody else.

[29:23] Ayman Elsawah: Mm-hmm.

[29:24] Samantha Cowan: So by questioning that, like some CS is asking for special treatment, but we need to believe that, I guess we need to make sure we're asking for our support. Like when we're in a meeting, make sure that whatever point we're making, we're backing up with our own skills, our own qualifications, our own points. So that people understand we do have those skills and we're not just falling back on, oh, you need to listen to me because I'm that token hire. So like when you are challenged, I mean, it's going to happen. You're going to be challenged in any work meeting, right? Nobody's ever going to agree. Like just fall back on whatever your qualifications are. Have you been coding since you were 16?

[30:09] Samantha Cowan: Yeah. Did you teach yourself to hack when you were 12 and you just happened to have a ton of experience? Do you have four different undergrads in information security because you just really loved it? And do you have your CISSP? Do you just have this insane memory that holds facts and you know you read this in 12 different places? Hmm. So fall back on your qualifications and your experience. Don't be afraid to share that you know these things, because that information is valuable. And the fact that you know, it just has brings that much more to the table. And then I mean, know that your team should be backing you like You might disagree with part of it, but ultimately that information is going to help move whatever that discussion is forward towards what is going to be a better solution in the end.

[31:00] Samantha Cowan: And be confident in yourself. Speak with confidence. It lends that much more to your argument or your discussion, whatever topic you're trying to bring up. And just beyond that, I would mention that we need to try to be a little less divisive in there's this minority group in security and this minority group in security and this minority group in security, because then you have a lot of small groups with limited resources. And if these groups can combine, then you're going to have a much larger group with a much louder voice and a lot more resources.

[31:38] Ayman Elsawah: Wow, that's pretty powerful. Yeah, that's really interesting perspective and something to think about. And just good advice in general, like I can use that advice, right? Anybody can use that advice, like just talking confidently and just falling back on your merits.

[31:51] Samantha Cowan: Yeah.

[31:51] Ayman Elsawah: So you talked about something, you know, when you're challenged in the workplace, I get challenged all the time. How do you as a security person handle being challenged?

[31:59] Samantha Cowan: It depends on the challenge, obviously. But I, for the most part, will take it in context. If it's something where I know that my point is correct, then I will explain my position. If it's more something where it's based on whatever somebody's opinion could be, then it's more of a discussion compromise kind of thing. Right? Like, what's the best way to do this? Well, you could do it any number of ways, and there's not really a best. So let's see what's going to be most effective for our team. If it's something that's more, there is a yes or no, and we just need to figure out what that is, then it's not so much a discussion compromise. Mm-hmm. And sometimes it takes going back to research, right?

[32:49] Samantha Cowan: If nobody's absolutely sure, then we need to go back and find what the actual answer is. But I do try to make sure that if I'm not 100% sure, I'm going to make sure that the right answer is Found and I'm not just pushing my answer because it's my answer. And then also if it is one of those situations where it's more of what's the best in this situation that we are considering all of the viewpoints and what is going to be best for this particular situation in this particular company at this particular time.

[33:25] Ayman Elsawah: Right.

[33:26] Samantha Cowan: But also that can scale so that we're not doing something that's right just right now, but won't be in two months and we're going to have to completely redo it.

[33:36] Ayman Elsawah: Gotcha. Yeah. So that was just a tough discussion to follow. So compliance frameworks seem to like be slow to change, right?

[33:44] Samantha Cowan: Yeah.

[33:44] Ayman Elsawah: And so how do you deal with a compliance framework that hasn't really kept up with the latest like technology as far as like, yeah, looking for compensating controls and stuff?

[33:53] Samantha Cowan: I would say you're usually lucky in that if you go above what's required, you're not generally penalized.

[34:02] Ayman Elsawah: Interesting.

[34:04] Samantha Cowan: Yeah. So while it may only require TLS 1.1, if you do TLS 1.2, they're not going to complain.

[34:12] Ayman Elsawah: Right.

[34:13] Samantha Cowan: Yeah.

[34:13] Ayman Elsawah: Okay. Well, what about things like 90 day expirations, right? Like PCI, for example, requires 90 day expirations, but 4.0 it's coming out. That's going to go away for certain user accounts, for example, especially if you have 2FA or whatever, maybe I haven't read the latest.

[34:27] Samantha Cowan: Right.

[34:27] Ayman Elsawah: Right. Like, so how do you deal with that, for example?

[34:30] Samantha Cowan: I mean, part of it has to do with your auditor and how they will interpret particular frameworks. With some frameworks, it's a matter of you can find exceptions around certain rules if what you're doing can be shown to be more secure. Yeah. With other things, sometimes you have to be a little bit more by the book and then just also offer your own extra security. It's usually better when you have a framework that will let you do something more secure as an exception because it's better security based on whatever this NIST guideline is or something like that.

[35:11] Ayman Elsawah: And so you're in a hiring manager position right now. Yep. And you have been in the past. What are some things you look for when you're looking to hire a compliance person?

[35:19] Samantha Cowan: I look for a combination of things. Experience is always a bonus. Okay. And that being just a combination of things like which frameworks they've worked with, the amount of years they have in, their ability to communicate well with people. Can they communicate well with engineers is huge. And enthusiasm is huge. I would much rather have somebody who's enthusiastic and can talk to my engineers without upsetting them than has every single compliance framework on their list that we have, because you can learn a framework, but you're not likely to learn people skills if you don't have them yet.

[35:59] Ayman Elsawah: Yeah. Wow. That's well said. Okay.

[36:02] Samantha Cowan: Yeah.

[36:02] Ayman Elsawah: And what else do you look for?

[36:04] Samantha Cowan: I mean, personality a lot of times, because if you have clashing personalities on your team, it's going to be difficult. And some of that comes down to like taking into account how nervous they are and everything. For example, if you're an employee who cannot handle working with female engineers, that's not going to work very well. And that has to be taken into consideration. That also comes up in the like, can't talk to engineers because one of my interviewers is usually a female engineer.

[36:34] Ayman Elsawah: I guess you just figure that out in an interview?

[36:36] Samantha Cowan: Yeah.

[36:37] Ayman Elsawah: Have you had that happen before?

[36:38] Samantha Cowan: Yeah, I'll do joint interviews. And if they won't look at that person or answer their questions, it's usually not a good sign.

[36:44] Ayman Elsawah: Whoa, that happens?

[36:45] Samantha Cowan: Yep.

[36:46] Ayman Elsawah: I'm pretty naive in many areas. So really, you'll have candidates that won't answer questions from female engineers?

[36:54] Samantha Cowan: It's not happened a lot, but it's happened once or twice.

[36:56] Ayman Elsawah: Wow, that's sad.

[36:57] Samantha Cowan: Yeah.

[36:58] Ayman Elsawah: That's interesting. Okay, so on the note of enthusiasm and not having that much experience, so like someone who doesn't have experience and is looking to get into compliance. So for example, they may have either graduated from college or went to some boot camp or I don't know, have something but don't really have real world experience, but they want to go to compliance for whatever reason. What is some advice to them from you on how to get into compliance?

[37:22] Samantha Cowan: I would say look into, like read up on some different frameworks and the requirements there, like the industries that use them and at least the best practices. Make sure you're familiar with both security frameworks and privacy frameworks. And just try and stay on top of some industry news. So like the EU just invalidated Privacy Shield, for instance.

[37:44] Ayman Elsawah: I know, that's right. Oh, we could have a whole podcast on that.

[37:48] Samantha Cowan: We could. Yeah.

[37:50] Samantha Cowan: So you don't necessarily want to go into an interview next week and talk about how great Privacy Shield is because we can move data from any European country or any EU country to the US because yay Privacy Shield when it was just invalidated. So you definitely want to keep up on some of that.

[38:11] Ayman Elsawah: Yeah.

[38:12] Samantha Cowan: So I would definitely keep up on some of that news. IAPP is a great one to follow for privacy.

[38:17] Ayman Elsawah: IAPP?

[38:18] Samantha Cowan: Yes.

[38:19] Ayman Elsawah: Okay.

[38:19] Samantha Cowan: And then security is just kind of a matter of what kind of information you're looking for. Actually, one of my employees swears by the privacy groups in Reddit.

[38:28] Ayman Elsawah: Okay.

[38:29] Samantha Cowan: She absolutely loves them and she's my go-to privacy person on the team.

[38:32] Ayman Elsawah: Okay.

[38:33] Samantha Cowan: So I would keep up on top of some industry news and just make sure you have like a working knowledge. It doesn't have to be like in depth. You don't have to be able to quote every control in the framework, but have a general idea of like what the framework does and who it applies to.

[38:49] Ayman Elsawah: Hmm. Okay.

[38:50] Samantha Cowan: So if you're a company that doesn't handle PHI, you don't touch PHI, you don't want to go in talking about how much you know about HIPAA.

[39:01] Ayman Elsawah: Right. Makes sense.

[39:02] Samantha Cowan: Yeah.

[39:02] Ayman Elsawah: Okay, cool. Well, this has been fun and quite informative. This has been a fun interview and I'd love to get those Reddit links about privacy and I'll include them in the show notes.

[39:13] Samantha Cowan: Yeah. I will ask her for the groups that she follows.

[39:15] Ayman Elsawah: Yeah. Any other parting advice before we go?

[39:18] Samantha Cowan: Not that I can think of off the top of my head, but it's been great speaking with you again.

[39:22] Ayman Elsawah: Okay. Yeah. Thanks again for coming on and I really appreciate your time.

[39:26] Samantha Cowan: Likewise.

[39:26] Ayman Elsawah: All right. Bye-bye. Bye. As always, if you like the show, please thank my guests for their time and let others know about the show. They might thank you for it. Intro music is Cascadia by Trash80, Trash80.com. Check out the website, gettingintoinfosec.com for show notes, a preview of my book and more. And stay in touch on Twitter for more Getting Into Infosec reflections.

[39:53] Ayman Elsawah: Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.