Unconventional Engineering Ep. 9 - Cyber Security & Data Protection with "CyberSecurityGirl"

This episode of Unconventional Engineering is brought.

To you by Tech street, your choice.

For smart standards management.

Hello and welcome back to ASME's podcast, Unconventional Engineering. I'm Tom Costabile, ASME's executive director and CEO. And today my co host is Kaitlyn Kubaugh, a mechanical engineer with Cosentini and Associates, a current ASME volunteer and also an alum of the same school that I went to, Manhattan College. Caitlin, good morning. Good afternoon. How are you?

Good morning, Tom. Thank you so much for having me. I'm so excited to be here with you today as we delve into another out of the box story about the world of engineering.

So Caitlin, before we meet today's guest, why don't you tell the audience a little bit about yourself?

Sure.

So as you mentioned, we're both Jaspers. I graduated from Manhattan College in May of 2020 with my mechanical engineering degree. While in school, I had a few different internships in the MEP design and build and construction consulting world in New York City. I decided to continue continue upon that journey and started my career in the unprecedented times. In 2020, I started working four days a week in New York City. So I was in the city while everyone was out of it and I got to experience the city completely empty and now completely full. I now work for Cosentini Associates. I do a bit of project management and a bit of mechanical design engineering, which is awesome. I love coordinating with architects and clients and other internal team members. I've done things that involve high rise residential buildings, high rise commercial buildings, tenant fit outs, brand new campuses that include hotels, food centers, convention centers, and a bit of work in Miami, Denver, New York City and California. So it's been a fun ride so far.

It's good. Great story by the way. You know the. So I graduated a few years before you did back in the 70s and Cosentini was a company that I worked for a different architect engineering firm. But what a great place to work and great experience. Caitlin, what a great story. And speaking of great stories, what's on the docket for today's show?

Well, Tom, today we're so fortunate to be joined by Caitlin Sarian and she's also known as cybersecurity girl. Welcome, Caitlin.

Thanks guys. I'm super excited to be here and share my unconventional engineering story. Cause it's definitely unconventional.

That's awesome. For some background, everyone, Caitlin is currently a global lead of Cybersecurity at TikTok. With almost a decade of international experience in cybersecurity, privacy and data Protection. Caitlin has led large scale privacy impact assessments, GDPR readiness assessments, high value asset assessments, and overall cybersecurity assessments. She has created and carried out privacy and GDPR remediation programs for numerous Fortune 500 companies in the commercial, financial and professional service industries and holds a Master of Science in Engineering Industrial Management from usc. As Cybersecurity Girl, Caitlin has become a widely followed and respected social media influencer who creates educational content in a fun and engaging way. What an awesome story, Caitlin.

Yeah, it's been a wild ride the last year and a half, I will tell you that, but it's been amazing and I'm so excited to be here and share this story. So thank you.

With two Caitlins on the call today, Caitlin Kubai, we'll call you Caitlin and Caitlin Sarian, we're going to call you Cybersecurity Girl. Is that okay?

That works? Works for me.

Well, Cybersecurity Girl, you attended USC University of Southern California where you were mechanical engineering students. You also served as secretary of the ASME student section at one time. What made you go from me to cybersecurity and how do you use your degree in your daily life? I mean, I'm intrigued with your background.

Yeah, it's kind of a funny story. So I love problem solving and engineering and actually before I even got into engineering, I had no idea what type of engineering I wanted to do, which is why I went mechanical because I knew that this is just a job that I could go get into any type of field or any job with. I did mechanical and I tried three different internships. I worked at Abbott Labs, I did like a supply chain engineering, I worked at ge, I did alternative energy and board mounted power devices. And then I worked at Chevron and oil and gas and I loved all those. But I really just couldn't decide which one I wanted to do for the rest of my life. I think it was a really big scary decision for me. And so I had a cousin that went into technology consulting and she had done so many different projects with so many different industries and companies and I figured that would be a good way to start. And so I was interviewing for a technology consulting career and they had actually asked me to do a cyber if I was interested in cybersecurity. And I told them I had no idea what that was, but they said I was going to be trained on the job. And so that's a little bit of how I got into cybersecurity. In terms of your question around, you know, how I use my mechanical engineering Degree. I always like to say engineering. We're just glorified problem solvers, right? With different. Different emphases on, you know, whether that's civil or electrical. But we're all just problem solvers in the end. And so I just use my degree as a problem solving degree. And actually, I think some of the stuff I learned being a secretary of asme, which is the soft skills I use every day more than my actual degree. So I actually really appreciated all the extracurriculars I did on top of my degree. My degree taught me hard work and problem solving, but all the soft skills I learned in college, I still use to this day as well.

That's great. Way back when I was in school, keep in mind, we didn't have computers yet. Well, we did. We had an analog computer that was the size of a wall in the lab. But a lot of the. It was called at the time, design of experiments. And I still, to this day, almost 50 years later, still use design of experiments every. Every day. So it's. It's good. I'm glad to hear that.

Yeah.

Caitlin, thank you so much for explaining how you got into cybersecurity. Seems really interesting. The opportunity was just presented in front of you, and you just took it and ran with it. That's awesome. So how did your cyber security girl Persona emerge and what was the motivation behind that?

Yeah, so there was a few motivation that I had. One was I was really kind of tired of people thinking that they couldn't do it, especially during COVID times. I feel like there was a lot of. It was just a really hard time at the beginning for a lot of people. I really wanted to inspire and encourage people to start considering a career in cybersecurity because there's so many. There's a huge need for it. And I realized that there's a huge stigma around cybersecurity, like I need to know how to code, or people just didn't understand what it was and they thought I had, you know, had to be quote, unquote, smart, which we can get into a little bit later. Because I'm really passionate about this whole smart debate and whether smart is even a thing or if you're just passionate about certain topics, more. More so than others. But I really wanted to kind of squash all those stigmas around cybersecurity, and that's one of the main reasons why I started. I also wanted to start because I wanted to get. Encourage more women to get into cyber and into STEM fields in general, because I think it's Just from the outside looking in, it looks pretty scary. I don't know, Caitlin, when you first. First started with your mechanical engineering degree, was it scary to you or.

It definitely was a little scary, but I think there was more of an emphasis when I started out. It was just getting woman in STEM and just taking a STEM degree in general because it's just such a. There's such a need in our. In our industry nowadays. Like, you just need problem solvers and critical thinking and analytical thinking so necessary whether you decide to do engineering or you decide to go into a different industry altogether. So I definitely, I felt a good push and I felt supported, but there was a lot less females in my classes than there were males, for sure.

Yeah. Especially in the mechanical engineering degree area. There's not a lot, but yeah. So that was originally the reason why I started. And then it also kind of grew to overall just teaching people how to be safe online. We are given computers, but we're never taught how to be secure online ever. We're never really taught how it works, even like the basics. It's kind of like if we, you know, a lot of people compare this to when you go through school and we're not told how to do taxes right. We're just expected to understand how to do everything. But, like, that's like a big part of life and that can help you a lot if you actually understand. It's the same with, like, keeping your data safe online. We are giving computers immediately phones, like little kids have phones already. And we're not taught how to be safe and use them correctly. So I think that's the reason why my social. Social media kind of exploded. But the two main reasons originally why I started it was just to get more people into cybersecurity and into stem. STEM fields.

Well, I, for one, I'm glad that you did start at cybersecurity Girl, because it's. It's intriguing. So, Caitlin, I was just thinking as I was listening to you, to Caitlin speak in your, in your daily job with your working on skyscrapers, what have you, how often do you run into cybersecurity issues?

Honestly, there's been quite a few where we get phishing emails. That's. That's where I see it come into play. So I see it come into play a lot when we'll get a random email, a weird email name, domain name, and it says click this link for maybe financial professional services or something like you would think would be normal, but it really isn't. So that's where I see it come into play. Other than that, thankfully, I don't think there's been big data breaches or anything of our company. But there is some sort of just like little emails that. That kind of come in for phishing.

Yeah. You know what I was thinking about too, is that I don't know how much work you're doing with building management systems or actual controls, you know, within. Typically, the experience that I've had with large commercial properties owners, banks, hedge funds, they like to understand what's going on in the building to save costs. So how does that. How does it all get connected? How do you protect that? You know, do you have to go back up to the grid to do it? The. The average person doesn't think about that when they turn a light switch on, but a lot of that's built in right, right behind it. Go back to what cybersecurity girl was telling us about. It works. But, you know, that's the engineer in me coming out, so.

Absolutely.

Yeah. And you're only as strong as your weakest link. Right. So just because you have all the infrastructure and it all set up on the back end, like, if you click a phishing email and you enter in your credentials, there's no point. They already have. They're in like.

Yeah, they could just easily take the weakest link that a new hire, like a kid fresh out of college, and just take his profile and they're into the company network.

Yeah. And I don't know if anyone has followed any of, like, the Lapsis group stuff, but there's. There's been a lot of really big data breaches. And the way that they get in is, like, oddly enough, very unconventional. They'll get like, one person's credentials and they'll, like, scan and do a bunch of searching to find other credentials, whether that's like, located in screenshots that were sent through that person's messages back and forth to the company, and they somehow kind of weasel their way into, like, highest security areas and then they share with the world. And so again, it's. Even if it's one person that might not have access to a lot of things, a lot of people will find a way if they want to get in. So it's just making sure that you're as secure as possible and doing the right things. So there are a few things that you can do just from being home, like vpn. You can make strong passwords.

Well, even with that thought, I've seen some news and articles on the fact that with multi Factor authentication. Some companies are looking into limiting passwords altogether and using maybe a combination of biometric capabilities or anything like that rather than a user created password. Have you seen that at all yet?

I actually haven't seen that in practice in any of the companies that I used to work for. But I know that I've definitely read about that and I'm very intrigued to see how that would roll out to larger companies. But it could work for smaller ones, I think for right now. I mean, the other issue with passwords is, you know, you have a really long one and you set it. There's a lot of actually debate on passwords. So a lot of people say, oh, just have a really, really long one. That's like complicated. And I keep that for. And then there's a lot of people that say, you know, maybe don't have that long of one, maybe like 12 to 13 and change it every couple months. I think the longer is the best option because so much harder to crack. And if you remember that one for a year, then it's, it's not as bad than us changing it, you know, every month.

So I have a dear friend of mine who's in the music business and his password has been the same for years. It's ABC 123. So it's crazy.

Did you work for Michael Jackson? Because I feel like that works with the song.

I'm sure you got tons of comments and feedback on your various posts. What does that do for you? Like does that affect and shape your content? Does that kind of affect how you go forward thinking throughout the rest of your TikToks and other media?

Yeah, so a lot of the comments ask, you know, more follow up questions and I usually use those comments to create more videos. So it actually helps with content. And I love when people comment like questions because if one person has a question, I guarantee you a lot more people have questions, similar questions. And so I try to answer them as much as possible. Obviously as, as I've gotten bigger, it's really, really hard to answer. Like the amount of messages, direct messages I get on Instagram of just like, I have a question, can you help me? And it's like the amount of time that I have pretty much goes into making videos to help you. But that's like the extent that I can help you outside of my normal day job, which is really hard. I was thinking about, you know, hiring someone to help me answer questions and stuff. But yeah, I mean any, I see a majority of the comments on there. I mean, unless it was like a viral video. And then you know, I'll see like the top comments and I'll try to respond with answers to help people as much as possible.

Cybersecurity girl, you mentioned that little four letter acronym GDPR in your consultant role. I understand that you've been heavily involved in helping implement GDPR programs for a variety of companies. Tell us a little bit for the audience's benefit. How has GDPR evolved since being introduced in 2016?

GDPR is the general data protection regulation. And for those of you guys that don't know what it is, and it was really rolled out in Europe and it gives a lot of power to us as consumers with our right to data. So whether we're able to request to see what data the companies have on us, whether we're able to have the ability to ask them to delete it or update it or fix it, that's a California thing because now we have the CCPA or CPRA eventually. So fun acronyms. It's pretty much companies nightmare. It's really, really hard to do because in the 90s and early 2000s we were all about collecting data because the more data companies had, the better they can push out, better marketing, the more data people had. Data was king back then and data is still king. But the issue now comes to be if you have this much data, what are you doing with it? What protocols are you taking and safety precautions are you taking to make sure that you're keeping your consumers data secure, updated, accurate and giving them the right to use it and delete it? GDPR was one of the strictest privacy regulations that came up and now it's ccpa, cpra, they're both pretty strict in different ways. But basically companies had to kind of get their act together to understand what they could do with the data that they have for you specifically. And that even included making sure like if, if I, Caitlin, wanted to request my data from a company, they one, needed to make sure that I was the person I said I was and then two, they needed to figure out all the data they had on me. So large companies like Google obviously had a lot of, a lot of issues with this. You also, you know, there's certain regulations where you can't send data over country lines. And so it was really making sure that the data for us, our data is protected and kept safe. But for companies it's still very hard to say. A lot of people are still trying to make sure that they're compliant with it. And then with most laws a lot of times it's not as clear as you want it to be. So a lot of the things in GDPR are also up for interpretation on how it's run. So my job was really helping decipher what GDPR actually meant and what companies need to do in order to be compliant and how they need to kind of handle consumer requests.

And I'm intrigued with your answer because it's not something that's easily described or a short conversation, but let's jump to.

The other Caitlin as a follow up to that. It seems like GDPR has created a whole line of work with cybersecurity, with the data protection officers. Do you see yourself almost as a data protection officers? And have you seen a lot more of people running into the industry as data protection officers?

Yeah, so they're actually. GDPR does require data protection officers now if you're a certain size company with a certain revenue. But I used to think that that was something that I would want to go into because privacy is a big deal. So within cybersecurity, there's a lot of different focus areas, right? There's not just the coding and the ethical hacking. There's privacy, which is a huge part of cybersecurity now. And that's really these new privacy regulations or data protection. Oddly enough, data protection and privacy are slightly different. A lot of people group them together, but they are different. And you're right, there are a lot of new jobs that have been created because of these privacy regulations. I used to think, especially when I was helping companies with gdpr, that I was kind of like a makeshift DPO for them until they kind of got their stuff up and running and. Or assigned their own dpo, which is a data protection officer. I am definitely not one now for TikTok and more for cybersecurity advocacy and, and kind of awareness. So just making sure not only our employees, but our users and our businesses are safe while using the app. And also we are safe internally at TikTok. But yeah, I mean, DPO is definitely a route that you can go when you're in cybersecurity.

I've also heard there's been a lot of discussion about quantum computing in relation to digital security. How do you think quantum mechanics can play a role in future applications of encryption systems? And what does it mean for both the corporate world and even for us as individual users?

So for me, because I am in like more of the data field of quantum computing, and so all I think about is all the amount of data that there. It's going to be crunching and I think more of, like, AI stuff as well. As the computers get smarter, it's obviously going to be a lot harder to protect data because they can guess passwords in milliseconds at that point. And it's a blessing and a curse, right when. When things keep expanding and growing. But that's, again, Caitlin, what makes cybersecurity such an interesting field, Right? Because there's so many different areas and pathways that you can go down in the cybersecurity journey. Like, there are people that are literally just encryption specialists. It's never going to just be the same thing every day. You are always going to have to adapt and change to the landscape that you're in. And computers, we are in the technology age, and they're not stop. It's not going to stop for a really long time. So that's what I love about being in cyber is even if I got bored one day of doing data protection or cybersecurity as a whole, like, you know, overall awareness and transformation, I can really dive deep into certain areas of cybersecurity and learn so much more. And I think that's the coolest part about working in this kind of field, is just constant knowledge. And if you're passionate for certain things and you can learn more about it and just dive deeper into those areas, that's great.

I've got to ask both of you a quick question here. So great conversation, by the way, but I was wondering, could each of you share with us your perspective on why someone should consider an ASME membership? I heard a little bit about that from both of you all. And, you know, I too, when I was in college, I served as the secretary of ASME's local chapter and then went on to be the president for two years. So, cybersecurity girl, why don't you start first, then we'll jump to Caitlin.

Yeah, I mean, like I said kind of at the beginning of this, I truly believe that the soft skills that I learned in college, especially through asme, really, really helps me throughout my career. Just, you know, being organized, staying on top of things. There's. That's not even. Those aren't even good examples of the soft skills I've learned. I'm trying to even think about them. But, like, literally everything I learned through all the soft skills I've learned through, you know, being the secretary at asme, because I was also the secretary has been extremely helpful in, like, my consulting career and then in my current career as well. Um, so there's Also the networking aspect. Right. I'm a pretty social person, and when I originally started engineering, I didn't think engineering was that social because I had no idea what it was, to be completely honest. I really just signed up because I was good at math and science and I love problem solving. And so when I started it, I really had that network of people that I relied on and just kind of helped get me through my college degree. Because being an engineering major is. I mean, I don't know, I'll speak for myself. Was really hard. Like, it was. It was a lot of work, and I couldn't have done it without the people that I met through asme. So it was kind of a twofold one. I'm. I learned a lot of soft skills, and you can learn tons of soft skills. Especially, especially if you take leadership positions. Like, I always encourage people. Like, even if you think that you don't have time, just try it. Just try to take it. Learn what? Like, just embrace everything and learn as much as possible. And for me, when I'm like, most stressed and busy is when I learn the most. I love drinking from a fire hose sometimes isn't the best thing. But, yeah, so I say take a leadership role. You'll learn a lot. And then also just the networking and just the mentoring, too, knowing people that you're going to be potentially even working with, and also the job opportunities. There's a lot of great companies that actually hire from asme, so there's literally no reason to not join. I don't know. And I. Yeah, that's my opinion, but.

I'm going to quote you on that, but thank you for that.

Yeah, quote. Do it.

Quote me. Well, Tom, you know, there's a wide variety of reasons and there's different levels. Being a student member, professional member, a volunteer. But I think starting young and starting as a student is so important. And getting on your board is just beneficial to no extent. Like, I learned so much as an ASU member, I met so many different people. And I got to meet you, Tom, at an early age and got to go to, you know, our last IMECI and student Leadership Training conference that was in person. You just get to meet a huge network of people. And even as Karen Olin said, you can meet your next best business partner. You can meet the person you go work for or go work with and create your own new product, new business, whatever it is. You meet so many different people. And as a professional member and volunteer, you get to stay up to date with different mechanical engineering trends. That you might not hear about if you're just kind of working your day to day job. So you definitely hear a lot more about what's really out there in the mechanical engineering world. And you stay up to date with your other colleagues and other people and kind of see what other people are working on and working with and maybe you develop a new interest, a new career path with your membership with asme. So I definitely recommend ASME membership for ages from, you know, high school to up until, you know, you're in your retirement.

They have high school now.

They definitely. Yes, we're going down to high school and we're actually mentoring high school students to get them involved in STEM early on.

So, yeah, we actually, we actually have a program that we partner with discovery and our K through 12, K through 12 STEM education. Uh, I've done a couple of these events. Absolutely. Come out of this classroom completely. I could, you know, light the city of the, of Dallas the last time I did one. It was just a great, great experience. Caitlin, thank you for that.

Absolutely. So, Caitlin, as a, as an individual user, if I, you know, let's say I got a couple texts from some friends. They're like, hey, you sent me a weird message on Instagram and I realized, oh no, my Instagram's probably been hacked. What do you think I should do? Who do you think I should contact? How do you think I should proceed when this type of thing happens?

Yeah, so Instagram has been very popular. Instagram and Facebook have been very popular to get hacked. I think the first thing before that even happens is turn on two factor authentication and have a strong password. Like don't reuse your passwords. Because the thing that people don't realize is that there are a lot of data breaches, obviously. And whenever there's a data breach, those passwords get published with your email online. Some like in the dark web. And it's very easy to find for hackers if they really want to find out your password to get them. And they also, there's a whole algorithm behind it. It's a long story. But basically if you're using old passwords or reused passwords, especially passwords that have been in a data breach, which honestly most likely at this point, if this had a password for over a year, it's probably been in a data breach at this point. So don't reuse passwords because it's really easy for people to hack in using your old password. So don't have the same passwords across platforms and make sure your passwords are secure and then also turn on two factor or multi factor authentication. And what I mean by that is like if there's an option to say, oh, can you text me every time I sign in to confirm or you know, email me an extra link, then do it rather than just do, you know, username and password like a normal login. So those are the two things that you should definitely do before. If you are already breach or you think you already got hacked, I would immediately. If you're, if you're already still logged in, I would immediately change your password again. There's also ways on Facebook, I don't know, it's not the same on Instagram, but on Facebook there's a way to tell who's logged into your account if you go to your privacy settings and you're able to kick people out or like log people off. So I would immediately go to that too if you're talking about Facebook. But yeah, I mean, the most you can do at that point is change your passwords and, and then kick people off. I actually, there's like a way to recover your Instagram. I like posted a video about it. It went pretty big, but I can, I don't know if you can share that, but I posted a video about it on how to recover because my mom's gotten that too. And just for the people that are listening, there's a lot clever, a lot more clever ways to hack into people's Instagram now. So if someone asks you for a screenshot of a weird text message, don't send it to them, just don't. It makes sense in your head, but just don't ever send anything.

Well, how do you recommend users keep track of all of our different passwords? And how often do you recommend changing maybe your password?

Yeah, that's a great question, Caitlin. So there's really, really popular password managers, which is basically like a secured vault on your phone. It's an app that you can have and you can literally have them generate a secure password, however many, like however long you want with different special characters, numbers, etc. And that it will save it onto your phone. So like in that own app. So it's like a little vault, basically. It's very secure. There's a lot of different ones. One password is one of them. LastPass. There's a lot of really, really good password managers on your phone. And that's what I have. And I have a different password now for almost every. Unless it's like a dumb account that I just don't care about but any like social media or email. I have a different long password, like 20, 24 characters long because I don't have to remember it. It's all on my phone. And as long as you remember the password for that one, then you're okay. So make a really strong password. What I always suggest people because people are like, oh my God, it's so hard to remember. I think about a sentence, like a sentence that you say all the time or like four or five word sentence and I would replace the S's with dollar signs or the I's with ones or exclamation points or something and it will be a long password and it will be complex and only you will know that sentence. Make it a weird one. And that's how I kind of remember. I do the weirdest sentences that make no sense. Um, but that's kind of how I if I were to do not not using my password manager, that's how I would do it.

So you wouldn't recommend ABC1 2 3, right?

I definitely would not. I would probably tell that person like immediately change your password. Like I'm nervous for them, whoever that is.

I was recently at a an event that we were doing and the AV guys were setting up and the temporary password to get in there was very simple. 1, 2, 3, 4, 5, 6.

Yeah, that's the most used fun fact by the way. Or admin is also used a lot.

Well, I'm afraid we're out of time everyone, but I want to thank you so much for listening. And also special thanks to my co host, Tom Costaville, and to the cybersecurity girl herself, Caitlin Sarian. As always, if anyone out there would like to suggest a topic, a guest, or just say hello, be sure to reach out to our unconventional engineering production team or email us directly@mediasme.org if you're interested in becoming an ASME member, which you should be, log on to asme.org or consider donating to the ASME foundation at asmefoundation.org Take care everyone.