Simply Solving Cyber: Joanna Grama

I'm Aaron Pritz.

And I'm Teddy Guzik.

Welcome to Simply Solving Cyber, the show that focuses on solving complex technology and cybersecurity issues with creative solutions featuring people and process, the human element. All right, Teddy, tell us why you're excited about being on this show.

So given that it's all about improving people and processes in pentesting, oftentimes I'll note that the biggest gaps are in people and processes. So I am extremely excited to learn from our guests and help spread the word of how you can use people and processes to improve security posture.

Yeah, no, that's great. And we, we hear, we like tools and technology. They're absolutely required. But I think sometimes the human factor gets overshadowed or excluded from the narrative in cybersecurity. So we want to shine a light on it and really make sure that companies and individuals know some of the small things that they can do. And like Teddy said, we're going to interview a whole bunch of people that have solved some unique things. Using people and process, and hopefully we can all learn together as a community.

All right.

I'd like to now welcome to the show Joanna Gramma. Joanna, and I'll let her tell her story, but she comes to cyber from a unique perspective and has a unique opportunity to focus on education. And that sector definitely needs a lot of help as it's become a recent target for ransomware thieves and other sorts of attacks. So without further ado, Joanna, tell us a little bit about yourself and how you got into cyber and what you're doing now.

Sure, Aaron. Thank you so much for having me here today. You're right, I have an untraditional story. I didn't train in technology or any of the STEM fields. I'm actually an attorney by training. I practiced law for a couple of years after I got out of law school, and my area of focus was elder law, which is helping older adults plan their long-term care needs, their healthcare for the future, work on end-of-life documents, that sort of thing. And it was a great area of law to practice in. I made really, really close relationships with many of my clients, and I loved that part of practicing law. Unfortunately, because I was a little bit naive, it never really occurred to me that helping adults plan long-term care and end-of-life care meant that those adults may pass away during the term of your relationship with them. Tough, right? And, and that was, that was pretty traumatic for me. And I learned very quickly, while I loved those very, very close relationships with my clients, I wasn't particularly suited for after they had passed working with their families and working with their families through the estate portion of the practice. I'm not good at that and I don't like it very much. So I had an opportunity to sort of step back from my law practice, and it was during that break, if you will, that, um, I got a job at Purdue University in their information technology department. It was about the time when the HIPAA security and privacy rules were really getting on the radar, radar for institutions of higher education. We were seeing more and more enforcement of those rules against colleges and universities, which can really, you know, colleges and universities do a number of different treatment, payment, and healthcare operations that can pull them into HIPAA.

Nice.

And so what Purdue University needed at the time was not a lawyer to advise them, but someone knowledgeable in reading laws and regulations who could tell them what those laws and regulations meant from a technology perspective.

Right, that's an important aspect for sure.

Right, yeah, it's really important because legalese and technobabble don't often align. Um, so I found out I was really good at that and I really enjoyed that, and so Um, my, my short-term stint at Purdue turned into a much longer stint, and I was there for about 7 years working in their information security policy and compliance office on people, process, and technology issues.

Was there a point during that time where you, it kind of hit you like, ah, this is my calling, or you had that moment of, I'm not going back to the, you know, the lawyer practice side of things, but you just realized cyber was for you?

Yeah, it was maybe about 2 or 3 years into my tenure at Purdue, and one of my colleagues at the time said, "You know, when we learned we were going to get a lawyer on staff, we weren't that enthusiastic. We thought, you know, you'd sort of be like a houseplant and we'd water you every couple of weeks, but then you'd go away. And it turns out that we're better because you're here." And I thought, "Ah!" I think I've just been paid the best compliment of my career. Yes, yes.

The anti-lawyer compliment. You were much better than we expected.

Exactly, exactly. You're not nearly as offensive as we expected you to be.

And you're not billing us $700 an hour, so we appreciate that.

Even better. Yep.

Awesome. Well then, tell us what you did beyond Purdue and how you've kind of continued to evolve your career in cyber after that initial long-term opportunity that you had.

Sure, so Purdue was really great. After Purdue, I joined EDUCAUSE, which is a— think of it as the American Bar Association but for higher education information technology professionals.

Oh, interesting.

So EDUCAUSE's raison d'être is to bring higher education information technology professionals together in a forum that can help them improve their technology operations, whether whether it's academic technology, administrative technology, information security, enterprise infrastructure. They have a bunch of different communities for all of these different subsets of technology that you find in higher education institutions. And I was very, very fortunate to come on as the director of their cybersecurity and IT governance, risk, and compliance programs. And so I did that for a couple of years, and that just exposes you to so much. There is so much going on in higher education technology that you just don't think of at first glance.

Hmm.

What were some of those ahas? Maybe as Teddy and I have spent more of our career on the corporate side of things, like what are, what are some of the differences that we might, you know, our listeners could kind of learn from, from an education standpoint, from what corporate America might be funded for, or focused on?

Sure, I think there are probably— I'm holding up fingers and you can't see me— I think there's 3 big areas in which higher education might really, really differ from other organizations. And the first is that higher ed, you know, just core to the mission of higher education is this value of openness and transparency. And if you think about that value of the academy, and compare and contrast it with values that we hold dear in information security, like locking things down and keeping bad people out, those don't match up very well. And so the practice of information security in a higher education institution always has to have— you always have in the back of your mind this thought of, are the things that we're doing, even though they're protecting different types of data, are we still doing them in a way that allows the institution to achieve its mission? Because the mission of the higher education institution isn't to provide technology. It's not necessarily to keep certain types of data secure. It's teaching, learning, and research. And those are the things that need to be supported and enabled in higher ed.

Got it. So would you say it's more about preventing disruptions of those core initiatives or values?

I think it's present— preventing disruption of anything, any of those. You don't want to do anything that might keep those things from happening, and then it's also to actively promote them. And so there's really this balancing act that higher education information security personnel in particular are incredibly adept at. Okay. I think the other— the second thing that's really— that is a little bit unique from higher ed, and I'd be especially interested in hearing your thoughts on this because you and Teddy both do the corporate side of things, is higher ed institutions can be very, very decentralized. There might be centrally offered services like an ERP or email or CRM that are offered at the central level, but that doesn't necessarily prohibit a department or a unit from going out and rolling their own as well. And so there's always this sense that there could be shadow systems out there that are duplicating central services, that are actively competing with central services. Sometimes it can be very hard for information technology organizations to tell a popular department or a department that has to be technology savvy, like computer science or an engineering school, that they can't roll their own insert-X IT function, right? Because they have to provide some very specialized trainings to their students.

Yeah, yeah, definitely. I've— yes, so I've done some you know, penetration tests of higher ed environments and stuff like that. And I've noticed, well, like really what it comes down to is especially when you're talking about large universities, it's like the biggest BYOD organization you could possibly have. Right. So any companies that are that big usually aren't doing any sort of bring your own device. So it's really hard. Like you said, it's, it's, it's not very centralized. And so keeping a handle on all of those different computers, the programs, the applications that those computers are downloading, utilizing, makes it very difficult to oversee and to, yeah, to really secure at that. So I totally see where you're coming from with that being a large difference between big corporate America and big universities.

I do wish that it was true that corporations didn't have shadow IT. People doing their own thing. That is definitely a similarity in certain areas and companies. But I think you're right. It's probably like the extreme of, you know, different departments that are completely autonomous and students— like, I hadn't thought about the student angle, but Teddy's right. The students come and I brought my own laptop when I was in college and I did what I wanted and I didn't know too much about security policies, right? Other than the basic standards of like, here's your password.

I remember at IU, you got— the students got a notification or something, because everyone at that time was downloading torrented movies and stuff like that. And you get a, you get a notification. It's like, oh, you're 30-day suspension from the IU network or something along those lines.

So you guys are dating yourselves, because that would have been what, 2010, 2011, when that really, really became a huge thing that all the universities were having to do.

Yes.

If he's dating himself, I don't want to talk about graduating in 2001, but yes, we'll stay on the 2010s.

It's interesting you said that because my first year of college was 2011, so, and that was when all this was happening. So you hit the nail on the head there with the year.

That was a particularly interesting time in higher ed. I want to say though that I don't appreciate you bursting my bubble about the corporate IT environment because in my head it's top-down, it all works the way it's supposed to, and there is no shadow IT. So I'm going to pretend I didn't hear you say that.

I will not spoil you with my dystopian stories.

Okay, please don't. I have one more thing that makes higher education special.

Yes.

And that is, think of colleges and universities like mini cities. They often have the same functions that cities do. There's facilities that keep the power and the heating and the cooling and the life safety systems on. There are police departments. Right. There are infrastructures like airports and bus services, and there's just— there are hoteling services, right? And so, and there's research. So there's all these different components that are creating and using and shipping data all across this institution at crazy speeds and, and with crazy different kinds of data classifications and different uses. And so it adds a complexity to the environment sometimes we just don't think about when we, we think about going to college to get an education.

Right. So with all that, I mean, I have spent time in pharma and, you know, I like to, I like to say pharma had research and manufacturing and commercial sales and it was kind of like the trifecta of risk. But when you think about a city of hotels and credit cards and students and population of the bursar and payments, and I mean, it's even maybe even a more complex ecosystem of challenges. How do you and administrators of those universities prioritize? Because it seems like there'd be tons of risks and tons of things you could do, but not enough time in the day and budget, let alone to conquer everything you'd want to do.

Right, that's probably the challenge for pretty much every organization or industry, and I don't think higher ed is immune to those types of things. It probably sounds trite, but when thinking about information security priorities in particular, I like to go back to the good old-fashioned risk assessment and thinking about, you know, what's my data, where is it located, what do I need to do to protect it, and if something bad happens, how fast is it going to hit me? And just really looking at prioritization through that lens. And it's hard in any industry, and it's hard in higher education because there are so many competing interests.

Right. So kind of in the balance between people, process, and technology, how— I mean, I would say in general in cybersecurity, there's a lot of the focus in the industry is on tools and the next whiz-bang tool that you can buy to solve yesterday's breach. How much of that pressure is there? I mean, tools are great, but also tools without people and process or tools without the right scale and scope don't necessarily live up to all the marketing hype. How does that, how does that whole balance affect the universities and education in general?

Sure. So I feel like I should issue your listeners a caveat. I am definitely a people and process person, and so almost everything I do is framed through the people and process angle. And so what I see when you, when you talk about implementing solutions or implementing the next coolest tool is the difficulty that we sometimes have in higher education is first getting money for the coolest tool.

Right.

Um, because funding is so limited, um, in many instances you want to make sure that that tool is going to work in your environment before investing a lot of funding in it. And you want to make sure it's a proven tool. And then once you bring the tool in your environment, one— the next big thing to figure out is how is that tool going to work in an environment that's so decentralized where you know, pick, pick your favorite logging tool or SIEM. How are we sure that we're getting the appropriate data feeds into this tool to use it appropriately? And do we know the cleanliness of those feeds? Do we know, you know, all of that underlying stuff that you make sure that your technology is working appropriately? And sometimes those are really hard things to figure out in higher ed.

Right, right. That's a great point. So kind of In this show, we always pick a— we ask you to think through one of the tougher challenges that you solve. And I know you mentioned you're all people and process. That's, that's the focus. And actually, I would say that brings diversity to this space because a lot of the historical cybersecurity experts and career people were— that did come up through infrastructure and technology. So thank you for joining us and having a diverse line of thought, because I do believe that is needed in this field. So kind of back to our challenge that we always give all of our guests is tell us about a time where you had a tough challenge and where the human element, you know, people and process saved the day, or it really provided a solution that wouldn't have been there if you would have been tool-focused.

This quiet sound is the sound of me thinking. I think one of the places where I have seen sort of the tool discussion and the people and process discussion come to a head is when we're looking at technology security services at an institution, and we're going through our service catalog, and we're realizing, oh my gosh, we are offering the same service in 4 different areas from 3 different vendors, and we're purchasing licenses from 2 different vendors, and we're overpurchasing because we don't need that many licenses if we combined these 2 instances. And so what we see and what we try to help institutions with from that perspective is going back to the fundamentals of information security governance. Have you put processes in place, usually people-driven processes, to look at your, your information security program and the different components of that program and making sure that you as an institution are spending those dollars wisely? And whether that means eliminating duplicate services or finding instances in which those duplicate services really are necessary. And, you know, we forget sometimes to go back to the basics of governance, making sure that our programs are chartered, making sure that we have goals and metrics, making sure that we've got people who are, you know, focused on the continuous improvement of our activities, not necessarily from a technology level, but from a people and process level. Are we doing things that make sense for the university at the particular moment in time? And that's the sort of conversation that I like to have in my work is thinking about information security in that way.

Yeah.

So how do you help simplify? I mean, a lot of times with tools that everyone has their baby and their preference and their own budget that they want to fight to preserve. How do you, how do you help bring that to a head to make the right decisions and go back to that core mission? And it's, it's really fun to be in a project to build something and turn something on, but it's sometimes tough to, be on a project to take something out or retire something to make space for something else or even to make space in general for productivity.

And haven't we all been there? Like some of us held on to Lotus Notes way too long, right? Because we just didn't want to switch over to something new and it's hard. It's easy to come in as a consultant sometimes and say, "Information security governance, have a charter, have a process, do these things." It's very hard sometimes to help an institution have the fortitude to prioritize information security culture and being proactive with respect to information security. And so when we consider those things, you know, we talk about what is your return on security investment and how thin are you willing to spread your security teams? Because no security team in the world, unless it's the best resourced and the best skilled, and I don't necessarily know who that might be, you know, they can't, they can't be always in a reactionary mode. They can't be reacting to 5 different systems that may or may not have been hacked. They can't be, you know, conducting forensics and rolling out a new service all at the same time, or assessing cloud vendors and making sure that the products that they offer are secure. So where do you want to make sure that your skills and your expertise and your money are being spent to help the institution? And if you, the institution, don't have the fortitude to look at it and don't have a sense that security is everybody's responsibility at the end of the day, then you are never going to beat the security problem. You are always going to be chasing your tail.

Right. How do universities find talent? What do they look for? Is it in-house? Is it external? Is it a combination? How do they get things done with that budget limitation and focus on many other priorities across this whole city or ecosystem that you talked about?

Well, I think that, um, is the hard part for higher education. And EduCause, the organization that I worked at previously, has done a ton of research on salaries and roles in higher education IT. And we have this perception, right, that people leave— let's not, let's not be negative— people stay in higher education IT not necessarily for the salary. There is something very, very satisfying about working for an organization that has a mission that is so much larger than you are. Colleges and universities are usually on the bleeding edge of technology and research, and you sometimes get an opportunity to be part of that, or at the very least you're not hindering it. You are educating tomorrow's students, tomorrow's rocket scientists and brain surgeons and Nobel laureates, and that— it is awesome to be part of that. And it's pretty great to work on campus and to have a staff discount to it. Union for your lunch.

There you go. Well, I feel like here in Indiana, like, don't Purdue and IU both have like— aren't they competing for the biggest supercomputer? They both recently have acquired some really incredible quantum technology or something. So I think your point—

I think they're—

yeah, we're competing on something. They're always competing, right? Yeah, the rivalry.

They're always competing.

Even during the summer.

So, I mean, you work in higher ed not necessarily for the salary, and there's this perception that people leave when, when that mission is no longer fulfilling to them, and they go elsewhere because they can get better salaries. And you're incredibly well trained if you're a higher education IT professional because you're just exposed to so much.

So in terms of, for those people that are looking to start their careers, would you say higher ed would be a good spot? And if so, like, you know, do you— when you were, when you were at EduCause, or even now, do you look for students that are just leaving college that, you know, they've just been exposed to all these potential risks and like see whether or not their brain works that way, whether they're already thinking about risk and that kind of stuff. Does that make sense?

Yeah, that does make sense. And it's a very interesting question because I was reading an article just the other day sort of about how it's harder for newcomers to break into information security because all of the job descriptions say experience required. And that always cracks back me up because to some extent information security is a relatively new field, right? Um, you're not— you won't necessarily find a person of our age, and I'm going to assume we're all about the same age for the purposes of this conversation. Um, you know, you people aren't going to have 30 years of experience in information security because it didn't exist the way it does now. 30 years ago. So I, you know, because information security evolves so rapidly and because technology evolves so rapidly, I sort of think we have an obligation to be helping newcomers to the field get the experience that they need. A lot of our, a lot of our discipline, I think, can be taught on the job. It's not necessarily, um, you know, something that you need to work your way up, if you will. Well, I like seeing if people can think with a security mindset. You don't have to be wearing a tinfoil hat or suspicious of everything, but you do have to be inquisitive and curious and have conviction about what you're learning and be a great communicator. And those are some skills and characteristics that we really need information security professionals to have.

Yeah, that's a good point. That passion for learning. And continuous learning is important because like you mentioned, what was a hack 5 years ago or something we were defending is not what we're focusing on today. And then the other point you mentioned is kind of the diversity of age group or the way you think about it or generational thinking can help you just like earlier on we were talking about you're not a technologist, but you focus on problem solving from a different perspective. More focused on people process. So I think diversity in general, thought, race, age group, all of that can help because our adversary is likely of a diverse background as well. So we need to find different ways to think like they think or solve for problems that may be evolving faster than one group of people can think of.

Absolutely.

And you brought up a good point about the experience level. So I, I spent some time advising a local nonprofit, a cybersecurity boot camp here in Indy, and that's the exact feedback that I'm getting from the students. And we've all seen those job postings on LinkedIn, right? That's like, you know, they want a PhD or master's, they want their CISSP, 10 years of experience, and they want to pay them— it says entry level and they want to pay them $50 grand a year. And it's, you know, it's, it's not obtainable. And it's frustrating because it also, it hinders people from wanting to join the workforce, the cybersecurity, the, the cyber workforce in general, because it's, it, it makes it seem like it's impossible to join. So I think that's something that us as an industry need to, to work on. And I feel like everyone's saying it, but no one's actually done anything to really kind of shift that and change it to be more of a welcoming community, especially for one that's so open source.

So that's a really good point. One of the things EduCause has going on right now is a diversity, equity, and inclusion initiative because we're realizing, you know, in higher ed we're potentially going to have a pipeline problem in a lot of years as the boomers and Gen X ages out and the new groups come up. And, and we have to make sure that that pipeline of technology professionals interested in higher education IT is solid, that it's diverse, and that it looks interesting, and it can confront problems in new ways. The thing that I like the best about information security amongst all of the other technology disciplines— and, and I'm just gonna go out and say it— is this isn't a technology discipline that is multidisciplinary. You've got lawyers working in it, you've got accountants working in it, you've got technologists working in it. I don't think that you're gonna find too many other places in information technology writ large where there is that multi, multidisciplinary perspective, and, and it's just because cybersecurity is so broad and there's so many opportunities within it.

Yeah, that's, that's very true there. And there's new sectors and everything coming up every day, every year, that there's, there's something new. That's— it's always interesting because someone, if someone says they're in cybersecurity, someone will naturally say like, oh, like, if this or this happens, am I going to get hacked?

Hacked.

And like, for, for people that aren't technical security assessors, right, they don't understand necessarily the intricacies of a hack, but they understand maybe the law or the, the regulation behind it or something. So it is so— it's so broad. And we were talking the other day about this actually, just how it's— there's room in it for everyone in every discipline. And the misconception is that you have to be able to be able to type 300 words per minute on a black screen and just kind of go to town on the keyboard, which is so, so off. So yeah, no, I'm glad you brought that up.

I always introduce myself and say I work in information security, but I'm not a hands-on keyboard information security professional. Now I can write you a 20-page report in the blink of an eye, but I'm not gonna do code review. I can't, I can't program your, your MFA system, and none of these things can I do, and, and I wouldn't want to. But I can tell you how long you're going to go to jail for. I can I can help you put your policies and procedures in place so that you can pass your next technology audit. And if you want to become ISO certified, I can help you get there. And, and there's room for all of that. Can you imagine how tired a person would be if they had to do it all? Information security wouldn't be possible, right?

Now that's true. So how do people get a hold of you that are maybe in education or want that diverse skill set? Are you on LinkedIn, or what's the best way to get a hold of you if people want to learn more?

So the good news is Joanna Gramma is not a common name. I am indeed on LinkedIn. You can even find me on Twitter. My social profile is probably entirely too promiscuous for an information security professional, but I'm highly introverted and I like being able to connect with people via technology. And so I— you won't have to look too hard to find me.

All right, well, thanks for that, and thanks for joining us. It's been a great conversation. I learned something, and definitely have not spent much time in education, so really appreciated connecting some dots and learning some new things. So thanks again for joining us, and hope you have a great rest of the week.

Cool, thank you so much. Have a great afternoon. Thanks, Joanna.