Simply Solving Cyber - Scott Shackelford

Welcome to Simply Solving Cyber. Thanks for all of our listeners coming back. And if you're new to the show, this is a show where we talk to up-and-coming and existing cybersecurity professionals from all different walks of life, from lawyers. We've talked to lawyers and technologists and CISOs and, and workforce awareness people that come from a training background. So the purpose of the show is to really explore careers help people that are getting into the field and really, most importantly, help to understand how folks use people and process to solve things versus just relying on only technology. Technology is always important, but if you don't have people and process, you just have a stack of tools. So without further ado, let's get into our guest. We are here today with Scott Shackelford, who is the Cybersecurity Program Chair at Indiana University. The university where Teddy and I are alums. So we're excited to have a 100% IU crowd. Not that we don't like the other crowds, but it's just a special type of nostalgia to, to have this opportunity of 3 for 3. Scott, welcome to the show.

Hey, so great to be here. Thanks for the invitation.

Yeah. So Scott, we usually start off talking about how you got into cybersecurity, and I know through your many accolades in academia, you have a number of different, uh, vectors with that, but Tell us a little bit of your journey and how you got into it and some key anecdotes of the perspectives that you have from that robust experience.

Yeah, honestly, it was pure random luck and chance.

Well, sometimes that, you go with it, right?

Yeah. You just go with it and you grab it. You grab that ring when it comes. So I do not have a first degree in CS or another technical discipline. I was a liberal arts guy. And it really wasn't until law school and I was looking for a project to write up an article on during my second year that I really started thinking deeply about cybersecurity. And it was just happenstance. A professor of mine back then said, "Hey, these cyberattacks just hit this country, Estonia, and not many people have written, you know, about this stuff, especially about how, you know, international law should apply to that kind of situation. Maybe you could look into that a little bit." So I took the red pill. I looked into it and dove in, and I've been swimming, I guess, ever since. That initial take just on the international law was just kind of the gateway drug, and it opened up like a world of all these different cyber issues that are incredibly interconnected and increasingly important, you know, and how we're living our professional lives and frankly our personal lives too.

So I know you have many degrees and you've worked at many different programs and are involved in a number of different initiatives. So once you got on the gateway drug and got into it through that law class, how did you expand from there? And what are some of those key aspects that you bring not only to the consulting work you do, but also, uh, the program that you run at IU?

Yeah, no, for sure. So from my standpoint, from the beginning, and in part because of that, just partly because of my background, I, I viewed cybersecurity not just as a legal question or a technical question or even a business question, but really All the above, right? And we've tried to structure our program at IU to kind of mirror the real-world nature of cyber threats, right? You really can't consider them in a vacuum. You can't consider them absent, you know, larger technological or regulatory or these days even geopolitical trends. So it's really important for current and future cybersecurity leaders, and that makes you even— you can include CEOs these days, right? To have a decent feel for the undercurrents, you know, the core technical issues, right, and the vulnerabilities that they arise, the core organizational challenges that we're facing, as well as of course these legal challenges. If you only have engineers talking to engineers or lawyers talking to lawyers about these issues, we're just not gonna get very far. So that's why our program at IU is structured in the way that it is to bring together 3 of our schools for the first time in the history of the university. So in this case it's our business school, our law school, Luddy School of Computing and Engineering to offer this integrated program. And, you know, it's been a lot of fun teaching because you have all comers participating in that. It can be a challenge, right, when you have law students alongside FBI agents in the same class, but it's also, it's also frankly a lot of fun and a great chance for some peer learning at the same time.

Yeah, no, great point. And one parallel I'd be curious to your vantage point on this, within big corporations, I've spent time at some of those, there, there can be a conflict between legal, privacy, cybersecurity. So I would think that bringing those programs together at the academic side and cross-training people would add some newness to that common challenge that the groups aren't playing nice together. Have you experienced that firsthand or do you have any thoughts on how IU is able to do that?

Yes, indeed. So in part, that's because we're, we're lucky at IU to have such a deep, not only research bench when it comes to cybersecurity from all these different disciplines and vantage points, but also on the operational side, right? Like a lot of folks don't realize that IU is home to the REN-ISAC, right, which is the Information Sharing Analysis Center for all of higher ed. It's the home of Internet2, right? It's the home of OmniSOC, which is this joint security operations center that's used by a growing list of leading organizations all around the world. So because of that, we have a lot of incredible staff and a lot of expertise in-house. To, you know, really dig into some of these challenges, including how to organize more effectively, to think about, you know, cybersecurity and who should be reporting to who. You know, we recently released the State of Hoosier Cybersecurity 2020 report, and that really showed that across the state, for example, we're really running the gamut. There's no consensus, basically, on how organizations should organize themselves to effectively respond to and manage cyber risks. In this study, for example, about 15 or so percent that responded said, you know what, it's the job of the CIO to deal with cybersecurity. Cybersecurity. Another 15 or so percent said, "Nope, that's the CEO's job." And a similar percentage said, "No, the Chief Privacy Officer." Then after that, it was all over the map, right? So there's really not a lot of consensus there, and we see the results of some of that confusion, right? Look at Equifax, and some of the breakdowns of communication that happened there resulting in part from the Chief Legal Officer not being on the same page as some of their staff and some of their coworkers. So it's clearly, it's a big problem, and that's why it's so important to have everybody at least starting on the same page as much as possible and thinking through these challenges.

Yeah. So are we going to start seeing cybersecurity being more present in B-school, maybe even undergrad classes, stuff like that, that's not necessarily just in the technology schools?

Oh, I like that question. Yeah.

Mm-hmm. Mm-hmm. Absolutely. Yeah, that is where we're headed. There's a whole digital citizenship initiative that IU is a part of. So students are getting some of this grounding throughout throughout the curriculum so you don't have to take, you know, an elective cybersecurity class as a senior. The idea is that you start to come across this information earlier on and then you can make some educated decisions about how far down that rabbit hole you want to, you want to go yourself. But I agree, we're not going to get very far if we only target folks who are passionate, who are keen about this topic, which I'd argue should be a laundry list because I think there's something for everybody when it comes to cybersecurity. But at the end of the day, we have to have all boats being raised here, right? We have to get the overall level of cyber hygiene and awareness at a much higher state than we see today. And we've already made some progress along those lines. Just this year at IU, we're launching the new BS in Cybersecurity and Global Policy, which is a partnership between our Hamilton Lugar School and the Luddy School for Mathematics, Computing, and Engineering. So that, that's a great partnership. It's similar to what we're doing at the graduate level. And frankly, I see that that's just the wave of the future, more of those multidisciplinary degrees. We're rolling out one on quantum information systems soon. So there's a lot of cool stuff that can be done. But I totally agree, if you don't bake it in across the curriculum, kind of like ethics in that same way, If you just have it be, you know, one or a couple of classes in a specialized track, we're just not going to get very far.

Yeah.

Yeah. I feel like in the past cybersecurity has been the ugly stepchild where people are automatically working from behind trying to get relevance in a business, um, and get funding and budgets and that kind of stuff. Just because it's, it's not baked into people's brains. They think of us as the, to be frank, kind of the creepy weird guys in the corner that wear the hoodies and—

Speak for yourself.

I am the hacker. But yeah, I feel like that's, that's part of where we find ourselves a little bit behind in priority is that it's, it's not really baked in and it's not really taught from a broad perspective from the beginning of higher education.

Yeah.

And Scott, to your point on the reporting structure, I mean, gosh, if you Google that, there's like 2,000 articles on who it should report to and like religious wars on it should be the CIO or the CEO, the buck stops there. You know, chief risk officer, there's more opinions than combinations, I would say. But I think what we're kind of alluding to here is it's really about the cultural change and whether the CIO can make that happen or they need to enlist their broader executive team. It really can't be an inside-out effort. It has to be an all-in company effort. And there's very few companies that probably, unfortunately, the ones that have been through a breach or an insider threat event that kind of have that awakening. But yeah, definitely a lot of opportunity to, you don't need to get the reporting consistent, but get the, the all hands on deck. How do we make this relevant for everyone is probably the biggest opportunity to unlock. Mm-hmm.

Mm-hmm. I know I couldn't agree more. And, and that was shown in the report too. Just the fact that too many organizations are reactive, are still reacting when it comes to these threats rather than being, you know, proactive to build in those processes and, and cybersecurity best practices from the start rather than, you know, scurrying and trying to bolt them on after the fact. We even see that still in how many organizations have taken the time to put together an incident response plan. In this report, it was less than 20% of our respondents said they put together an incident response plan, which should be a giant red waving warning flag for us that we clearly need to do a better job of describing why that kind of preplanning is important, and also putting together some models and templates, especially for small businesses that just don't have the time, given everything that's going on right now, to really focus on that.

My quick line on that I talk to a lot of clients about is you can protect and detect all day, every day, and spend hundreds of millions of dollars on tools to do that. And you can still get compromised. Look at FireEye.

Oh yeah.

You know, one of the best companies with one of the most deep nation-state potentially correlated event there. And I think to me, like on incident response plan, that's the one thing you can control. How do you respond? Are your executives ready? Are they going to be the CEO of Equifax type example? Are they going to be one of the more polished CEOs or pick your leader that has a nice response? Everything's calm because they've practiced it, or as calm as can be. Definitely lots of opportunity for companies to get more prepared regardless of the amount of money that they have to spend to defend and protect.

For sure. I don't want to paint it as all a bleak picture either, because there was a lot of good news in that report as well. We found that 95% of the respondents said, "Yeah, cybersecurity is really important," and 80-plus percent had taken some affirmative steps to get a better handle on the threats that they see themselves as facing, at least. It's certainly not all bad news. There's certainly areas to improve.

No, that's great. How do you get to this report for those listeners that may want to go find it?

It's housed a few different places. It's a report for the Indiana Executive Council on Cybersecurity. And it was the Kelley School of Business, our Indiana Business Research Center, along with the Indiana AG's office that really facilitated it. So if you, if you go on the IBRC, the Indiana Business Research Center site, the report is there and it's also housed on the Indiana AG's site. Hoosier Cybersecurity 2020.

Awesome. Scott, on all of our guests on Simply Solving Cyber, we ask them, and I know you're a unique perspective because you're from the academic world, so maybe your answer will be more of how you, how you prep students for this, but we like to focus on people and process and technology is super important, but sometimes it gets 99% of the focus, media focus and credit, but no program that I've seen that's been successful has worked without solid people and clear processes that are repeatable and sustainable. So maybe two-part question. Is there, is there an example or story within your career where people and process shined? From something you were working on? And then secondly, how are you prepping the IU students to make sure that they're not 100% technical focused and missing the broader perspective that they probably need to drive in their careers?

No, that, that, that, these are just fantastic questions. And what at first comes to mind, you know, for me is, um, we, we try to do a lot of cybersecurity service learning in our classes. So we try to take this really interdisciplinary, pragmatic, applied approach to this stuff. And that historically has been through kind of one-off classes, but within this last year, thanks to some generous funding from the Hewlett Foundation and the Indian Economic Development Corporation, we're able to put together this new IU Cybersecurity Clinic, which is really unique. It's the only clinic that we're aware of in the country that focuses on protecting local critical infrastructure. And we've interpreted that to basically encompass a wide range of organizations, mostly though local governments, school corporations, community foundations, small utilities, small businesses, kind of soft underbelly that don't typically get the attention or the resources they deserve. And, you know, the students basically dive in to help out these clients, right, whether it's the, you know, the City of Bloomington or IU Health as we've done so far or, you know, WonderLab, even some more sophisticated clients beyond that like the Indiana Health Information Exchange. And it's just such a great opportunity because you see exactly what you're describing. It's not just one facet of this, right? If a town like Speedway that we did a project for is concerned about ransomware or, you know, ensuring a high level of security to their remote access and some of their SCADA systems, yeah, that's a technical issue, right? But if you don't have— if you don't have the policies in place to really support that and the people on the same page and a communication strategy to get, you know, leadership and other members of your organization to come along, you're not going to get very far. So we do a lot of that, not only baked into the projects, but, you know, we try to do a lot of simulations, simulate boardroom scenarios, right? Do a mock press conference. So we do that. We do one of those modeled after the Equifax breach and how you would respond, learning from how some other CEOs have handled similar types of breaches in the past, as well as get you out of your comfort zones, right? Because it's really easy to think about this as either a private sector issue or a national security issue. It's really all of the above. That line between public, private, and critical blurry in this context, so we try to put the students through looking at this through the lens of kind of both perspectives. Like for example, we use a National Security Council simulation that involves a lot of cyber attacks on different types of critical infrastructure providers to get them thinking about what should the role of government at various levels be in helping out organizations, as well as from the CEO's perspective or the CISO's perspective about what help do they feel like they need and what are some of the constraints that they're facing. So I totally agree. you can't have one without the other. People, processes, procedures all go hand in hand here. We're not going to get very far if we can't think holistically along those lines. That's easier said than done. We all can't be experts in all facets of cybersecurity. It's just impossible, right? But at least knowing the playing field, picking your niche from there is really, really helpful and vital.

Yeah, I think it's incredibly important for us to get to the point where everyone kind of understands that cybersecurity is more than just the hands-on keyboard type of work. And that's something that I feel like we might be getting there closely. You know, you start to see BISOs and stuff like that at companies that are more, you know, business-oriented, but still overseeing the governance and the processes that are happening. But how do you feel like we can preach that to the students coming in so that they understand? Because I feel like when a student is coming into IU, right, or to another school, and they hear, okay, I could major in something like cybersecurity, how do you change the message from hands-on keyboard to, you know, this is a general problem and it's problem solving?

You're asking how do you protect the non-hoodies? Is that what you're saying?

The people that don't wear hoodies.

That's right. No, that's right. Because I feel you're going to get a certain type of folks regardless, right? So yeah, I think it's that outreach that is so critical. And part of the answer I feel like is just being more transparent about all the different roles, you know, that cybersecurity professionals can fill, whether it's more on the privacy side, you know, the ledger, whether it's going into more different, you know, consulting or defense contractor roles, working in various capacities for the government. You know, one of our most popular combined degree programs is the JD cybersecurity MS just because there's so many opportunities in that space. Way more of our students are doing that than even the JD/MBA program at this point. Wow. So it really is a— I think that's part of it is just being clear. And we try to do that through a monthly cybersecurity career roundtable. Just reach out if you'd like to be featured in that. That's a great opportunity to get different sectors, different organizations in front of the students just to show them just this huge breadth of opportunities that awaits. We talk about that workforce shortage, but as you said, it's not just everybody, you know, hands on keyboard and hoodies doing that. That's a relatively small percentage. Of all the different types of roles that need to be filled. So that's a piece of it. And I think another piece is really giving them the opportunities, as we just talked about, to really apply this stuff and see why it matters in the real world. We're doing that partly, you know, through the clinic. We're also launching a new initiative this coming spring called Hacking for Defense. And there's a lot of universities around the country that have started to do this, and we're thrilled to basically join the club. And this is going to give IU students the chance to work on real-world DOD-curated cybersecurity projects, and we're going to be doing, it looks like 6 of them for this spring for a wide range of organizations like Crane and the National Guard. It looks like potentially the Coast Guard Cyber Command, and it's just such a great way for the students to get a feel for, you know, not only how, you know, what the types of cyber risks and issues that governments are facing, but how we also see that playing out in even the private sector context as well.

So that's great. One thing you've not mentioned yet and I want to bring up is continuing education, or let's say you're a company head or, or somebody that knows that their business is at risk of cyber and want to get smart. You're probably not going to do it all yourself, but I know you guys have some continuing education programs for those that are actively practicing other professions or already in industry. So tell me a little bit about that. How would somebody learn that's maybe not in the field?

Well, thank you for teeing it up so nicely. Happy, happy to, yeah. So we've tried to fashion a variety of on-ramps, recognizing that everybody's, you know, time is limited, coming from different starting points with different needs. So it really runs the gamut. We do plenty of, you know, short-term cybersecurity boot camps that have run anywhere from a day to a special 3-week boot camp that we've been doing for the Army for the last couple years now. We also have a cybersecurity digital badge program I'm happy to share the link with, but if you do a search for cybersecurity digital badge and Kelly, this is through the business school, that'll pop up, and it's a 10-week interactive cybersecurity foundations course that you earn a badge for at the end as well as the opportunity to earn academic credit if you would like to, that you can apply toward any of our cybersecurity certificates, like the certificate in cybersecurity management, as well as secure computing, cyber law and policy, data privacy. And then all of those credentials are stackable to this integrated cybersecurity risk management MS that I mentioned earlier on, which is 30 credit hours, but there's a fully online option. You can take it at your own pace, and it's only a couple years old, but it's really taken off. We have 100+ students in the pipeline already with a huge, you know, array of backgrounds, and happy to say 100% job placement in that first cohort right off the bat. So that was, that was great to see. I'm so happy, in other words, to brainstorm and just know that we're at— IU is very excited to partner at a lot of different levels there depending on what the needs are.

Scott, one more question for you. What would you say to someone who maybe is interested in the field but they're a little bit anxious about getting into it? You just mentioned a couple of those programs. What, what would you say to someone that's, that's hesitant, that doesn't think that that's— that maybe they're not cut out for the field?

Too technical?

Too technical?

Daunting? Yeah. What— talk them off that ledge for us here right now, live.

Absolutely happy to. I mean, for what it's worth, some of our most successful graduates already of this program were, were music majors, right, or history majors. They did something completely different than cybersecurity before they jumped in to this particular graduate program. But even if you're still at the undergrad level, I mean, you— it's fine if you really want to specialize in the technical aspects of cybersecurity, go the CISSP route and don't look back. There's a wealth of opportunities there, but I don't feel like that's the only route, right? As we've been saying, there's There's so many opportunities within this, you know, field of cybersecurity. When you look at the millions in terms of the global workforce shortage, in some ways, depending on the stats you use, it actually dwarfs even the nursing shortage at this point, right? I mean, it really is a helping profession of the 21st century that you can do a ton of things with. And even if you don't wind up going and becoming, you know, a full-time cybersecurity professional in some capacity, having that background is just so vital in thinking through and being successful in a lot different roles these days, right? So I don't think you're going to look back on it at all as time wasted. So hopefully that helps a little bit, but like I said, I'm— the reason I keep— I'm still doing this as many years later as when I started is because it's such an exciting, such a fast-evolving field on the technology side, even on the regulatory side. Yeah, you name the major event or issue these days, there's a cyber component to it. So it's just a fascinating time to really dive in if you're keen on this stuff similarly.

Yeah, and it's in such an infancy, I feel like you can kind of paint your own canvas. It's kind of a blank slate there. You can create your own path. So it's definitely a field that I think that people should look into, especially it sounds like IU's got a phenomenal program now going on. I wish we would have had some more of this when I was there. That would have been great.

That's always the way, isn't it? Timing's everything. But no, I mean, it's still growing and there's a lot of entrepreneurial different activities happening in this space. And I'm really excited about even the new cybersecurity startups and the new exchange and hub that's planned around the Dimension Mill in Bloomington. There's a really cool tech scene that's developing. So, it's wonderful to see so many opportunities across the state, you know, for grads and for others who are keen on this.

Very cool. Well, we're so excited of what IU is doing and building the workforce of tomorrow. So, happy to help stay plugged in and help support your mission and really appreciate you talking to us and telling your experiences and stories to maybe those future students that that regardless of what age they are, what point in their career, they may wanna invest in themselves. So really appreciate you taking the time.

Hey, no, the pleasure is all mine. Thanks so much again for the opportunity, guys. And yeah, for anybody who's interested, just feel free, check out cybersecurity.iu.edu, and there's a ton of information about all of our research and operational and educational offerings there.

Awesome, thanks so much, Scott.

Awesome, Scott, see ya.

Hey. Thanks again. Happy holidays. Aah!