CEO of Women's Society of Cyberjutsu and Cybersecurity Leader Mari Galloway

Informing your decisions with intelligence analysis and insight. Brought to you by the team@oodaloop.com hello.

I'm Bob Gourley, the chief technology officer of OODA LLC. And today on the Oodacast, Mary Galloway. Hello, Mary. How you doing?

Great. How are you?

Doing great. I really appreciate the time today. I'm excited to talk to you about so many things, including the Women's Society of Cyber Jitsu.

Awesome. I'm happy to be here bright and early on this Thursday in Las Vegas. Women's Society of Cyberjitsu is my baby. Been around since 2013. It's an awesome organization. We do cyber security training for women. Our niche is technical, hands on. And so we want to make sure that those people that come through are our workshops, our classes, our courses. They can go directly from a class to work and use those same skills that they gained.

Well, you know, I got to see you guys in action up close and personal. About a year ago in August 2019, there in Las Vegas, you put on the Wicked Six Cyber Games at the HyperX Esports Arena. And that was awesome.

Yeah, that was our very first cyber security meets esports team type of event. It was, it was college students, you know, there was professionals there. It was during Black Hat and DEF con. What was exciting about it was we turned it into a spectator sport. We turned gaming into a spectator sport. You know, we made it fun. Everybody likes to watch basketball and baseball and all that. So it's like, well, why not cybersecurity?

Yeah. You know, I enjoyed it because, I mean, you look at these teams, these young people, and they're all so into it. And the way the cameras were set up, you know, you could look at the screens and what they're doing and. And you could also look at their faces and how intent they were. You know, I'm going to win this for the school. Just a great competition.

Yeah. 2021, Wicked Six will be back. Awesome.

And I want to talk more about what you do with the Woman's Cyber Jitsu Society, but I also want to talk about you and your background. You've been a technologist from the very beginning of your career, is that right?

Yes. Yeah. So I got my first job in IT back in 2009 with a company called Accenture. I was a network engine for that company. I came from retail. I was an armed security guard. What else did I do? I did door to door sales. I've done a whole lot of different things to get to this point, but to be honest with you, I hated that first job I wanted to quit like every single day because I wasn't getting the hands on, I wasn't able to dive in and get into that stuff. And so I'm glad I stayed. But I've gone from a number of different three letter agencies in the D.C. northern Virginia area and I eventually ended up here in Las Vegas in the casino world.

And your undergraduate degree is in a technology field, is that, is that right?

Yes, so. Well, technically yes, but it's actually a business bachelor's of Business Administration in Computer Information Systems. So while we talked about IT and information systems and those types of things, the underlying part of it was business. So everything that we did related to the business side of working in it, working in tech, strategic planning, those types of things. Before security was the thing. Yeah, way before.

A couple other things I can tell about your bio is you didn't stop with an undergraduate degree, you kept going back for more and more. You got a Master of Science in Computer Information Systems, right?

Yes, from Strayer. And I also have a cybersecurity technology graduate certificate from the University of Maryland Global campus now. And I plan to get my PhD, so hopefully in the next few years. I've been talking about it for a long time. I plan to get it soon, as soon as I find some money for it.

Well, you're a great example for all of us because in this modern world discontinuing education is so critically important. We just need to keep changing and growing and self educating. You're just a great example. Well, another thing you've been doing besides that is then your technical certification and continuous technical training. I know some people work hard, hard, hard and you'll get one certification. You've amassed a litany of those and I think you're a great example there of the continued hands on training and what's driving you to do that?

I like a challenge and the job pays for it. So if they're, if they say, hey, I need you to get this certification, then I have to get the certification. So like my cissp, somebody said, hey, if you get this, I'll hire you and you can come work for me. And I was like, okay, bet. Let me spend three, three months studying for this. Let me go take it. And then I failed the first time. But that's, yeah, you have to. So I was like, you know what, I have to get this because I know it's necessary, I know it's needed. And I went back and I knocked it out of the park. And that's how I Found Cyber Jitsu was actually because of the studying for the CISSP the second time.

Ah, so one other question I want to get back to Cyber Jitsu and that is, you know, I talk to a lot of leaders who wonder how do I find the best technical talent. Certifications is one way. Or you find someone who has education in that background or you find someone who has that hands on experience. Well, you're kind of the triple threat. You've got all of that, you've got the hands on experience in the real world leadership, you've got the certifications and you've got the academic background. So I just think that's the perfect example of someone who's taken command of their own career. And I just wanted to call that out.

Well, thank you. It's important, you know, those things are very important. I love certs, I love education. I think they're both important to have and the experience is very important as well. I think networking is also very important in that, in that trifecta of learning and growing and trying to get into the industry and move around in the industry. It's always, always you got to make those connections so that people can see who you are and can bring you in.

All right, so this gets us back to the Woman's Society of cyberjitsu. You're a co founding board member and you've been leading it for years. So would you tell us about the Early Days? How did this organization get started?

The Early Days? So our founder, Lisa Jiggets, she, she started the, she started Cyber Jitsu because she wanted to have a place where she could go and learn and get hands on experience. She was out of the Northern Virginia area and she went to a few meetups at the time and they either fizzled out or they weren't fulfilling the needs that she was looking for because she's a pen tester by trade. And so she said, let me just do this event and see who shows up. And she did a backtrack and Linux workshop back in, I think the fall of 2012. And to her surprise, a lot of people showed up, a lot of women showed up. She was like, oh, there's something here. And so she started doing a few other workshops. She started the study groups. And in 2013 it just kept growing. Right. My, my first encounter with cyberjitsu was the study group for cssp. But my first workshop was reverse engineering. And I had no clue what that was because that wasn't my field. I wasn't on that side of things. And so I went And I was like, wow, there's a lot of women here that want to learn this. And that's, that's how we got started. We launched our Girls program in 2014. So for middle school and high school girls to get them introduced to school STEM products or projects, it's like a nine month program. They get to go from anatomy of a computer to building wearable tech. And so it's kind of just explore expanded from there. Right. We're nationwide. We've got chapters all over the country. We host workshops. We hosted our first conference this year. We do a lot of gaming. It's basically, it's a community of women and men in cybersecurity trying to, you know, navigate the waters and make their way through this, this thing we call the industry and be successful.

Right. And I noticed, I mean, you do have different tiers of memberships corporations can sponsor to align themselves with these great virtuous things. And I think corporations would also want to do that because every company, it seems, is hungry for new talent. And that must be a great way for them to network.

Yeah. So we just, we actually just brought Recorded Future on as a sponsor. And with that, you know, they get to do webinars with our members. They get to have personal connections and conversations with our members. They get access to our job board that's pretty robust. And they get to meet the folks that are hungry for these jobs that have these technical skills that are trying to get in and advance in the industry. There's something else I was gonna say and I just forgot.

Well, I'll remember it later. You say Recorded Future and I smile because I just love those guys. They're so forward thinking and they've always been at this cutting edge of, you know, how do we figure out what the bad guys are doing it, are doing before they do it. And I think it must be a great place to work. And I'm glad they're aligning with you guys.

We just did a webinar with one of their members or one of their employees. It's on a bright talk channel. She talked about a day in the life for someone that works at Recorded Future. So that's a great place to go and learn a little bit more. I love them. I've seen a lot of the stuff that they do. I'm on their mailing list. But there's plenty of ways for companies and organizations to get involved, either monetarily or through donations of like, equipment or, you know, sponsoring certification vouchers or sponsoring a course or things like that there's plenty of ways and we're happy to bring everybody in together and just build that community even bigger.

Yeah. And I know it's a community with a mission of helping women and girls succeed in the community, but you let me join as I think it was an associate membership or.

Yeah, yeah. So while we are focused on women, our membership is open to anybody. It doesn't matter if you're a man or woman, non binary, whatever you identify as, it doesn't matter because we understand the importance of we can't do this by ourselves. We have to have the community, we have to have, you know, the advocates and the allies a part of the conversation. And so we welcome all of the men, all of the folks that identify as women or men or whatever to be a part of the community and share their experience and share their knowledge and you know, collaborate and do all those great things.

Then would you tell me in your words, what is the mission of the Women's Society of Cyber Jitsu? What are you trying to accomplish?

We are trying to empower women to enter and advance in cybersecurity through networking and leadership. And we do that through hands on training, networking events, professional development, leadership opportunities. So, you know, our volunteer team has a number of opportunities for people to come in and start leading and leading initiatives and leading projects because that's important stuff. Right. And a lot of folks don't know that, hey, having a leadership role in an organ as a volunteer is really good for your resume. And so we want to make sure we're giving our members and our supporters enough resources to build out their resume and become better people all around.

Great, thanks. And I have noticed you have a lot of resources for people at all stages of their career, whether they're just starting out or they're mid career and they want to learn how to write a better resume or get some technical training to help advance them. So it seems like you offer a lot for the community.

Yeah, people come to us from at various phases, so fresh out of college or what we call the boomerangs, you know, they left the industry and they had to come, you know, take care of family or whatever issues. And they came back and they're trying to navigate and even to some senior level women. But again, our focus is going to be the technical because we like the technical, we like to play and we like to do stuff on the computer and just get involved that way. Yeah.

Great. I have a couple other questions for you. I wanted to ask about you as a leader. So we talked about you as a someone who's continually educating herself and you continually get certifications and you continue to get hands on experience, but now you're also leading and you're a founder of this incredible entrepreneurial organization. And so part of me wants to say, how do you do it all? But maybe more important, how do you. What's your decision making process?

I rely on others. No, it's called balance in the early stages. So I, when I found the organization, my goal was not to be on the board. My goal was not to be in this position that I'm in. My goal was just to meet other people, learn, grow. And Lisa was like, hey, I like how you think. Come join this. I want you to help me build this out. And to be honest, I was just like, oh, it's just a cute little club. We're not gonna go anywhere. And then like two years later, we're huge. And it's like, wow, people know who we are. And it's like, whoa, what's going on? So in the early stages, there was a lot of, a lot of work. I worked all the time, you know, weekends, every day after work. It was just constant, constant, constant. And part of that was because my husband was in the army and so he was always deployed or in other states. And so I had the time to do it. As I've gotten further in, I've had to learn to balance. I use a calendar for everything. I have specific hours that I work, so I don't work on the weekends anymore because this has been a volunteer role the entire time. So I'm not getting paid for it. So I don't do weekend stuff anymore unless I absolutely have to. And I have a lot of post its. I write a lot of notes on post its. So there's a lot of post its in my little drawer over here of what to do. But whenever I make decisions for the organization, it's. I have to take myself out of it and I have to think about, okay, what's going to benefit our members, what's going to benefit my team of volunteers. None of the stuff that we do would ever, ever be possible without the amazing women that trust me to help guide them. And they have some amazing ideas. They are so supportive. They are so energized. They take the initiative to do things. And I really just believe in having a good team. Behind you is what makes you successful.

Awesome. That's great. Good advice, I think, for anybody in any organization. And it works for you. That's good.

Yeah, they keep me in check and they keep me accountable. And that's what. That's what I like. And they do it respectfully, obviously. But I swear, I think this year alone, we've had the best group of volunteers to come across our platform in all the years.

Yeah, that's great.

And they stay, you know, like, they stay for years on years on years, you know? And so if y' all are watching. Thank you.

You know, I hope some of them will be. You know, one of my favorites is Jessica Gulick, who introduced us. What a champion, a great leader, thinker, entrepreneur.

Also, I learned a lot from Jessica. Jessica's like my informal mentor. We have conversations all the time. But I learned. I've learned so much from her and what she does and how she. How she does things over the last few years. It's. It's amazing. She's an awesome lady.

She really is. And she's one of these people that she gives more than she takes. She's so helpful to everybody else. I think she's just a wonderful leader.

She is. Very much so.

Well, Mary, if it's okay with you, I want to shift and ask a few other questions about your overall perception of the community before doing that about your career. You have some changes coming up, is that right?

I do. So for the last almost four years, it'll be four years in December. Go figure. I've been working out here in Las Vegas in the casino world at one of the largest casino companies around. And my last day is tomorrow, and in the middle of November, I'll be going over to Palo Alto to do architecture for their Soar platform. Previously Demisto, now Cortex. So this should be a fun change, a fun experience. My first time at a product company, so I'm really excited about that.

Yeah, congratulations. It's really one of the greats, so I think. Congratulations. That'd be a perfect fit. But up to this point, I mean, you have been so directly engaged with the community, both in your day job, you know, what kind of attacks are occurring in your work with the Women's Society of Cyber Jitsu. You talk to people broadly about the community and about the attacks and defenses. And I just want to ask your overall opinion on the state of the cybersecurity community. For example, what will the bad guys do next? What do you think of the future cyber threat?

So, honestly, I think the stuff that we've been seeing, we're going to continue to see. So ransomware. The phishing. Phishing, I think, is the number one thing above all anything else, because it plays on Your emotions. Right. I get a million emails from Apple and Netflix and all these companies, and I'm like, y', all, those aren't even my email. Like, I don't even have an account with you with this email. What's going on? Right. But for those that. That don't know, they may fall victim to that. And then, honestly, ransomware is going to be a big one. They're still going to continue to use that because they still need the money. And right now, people are bored because we can't really go anywhere. We can't do a whole lot of things. What else? I think insider threat's gonna be an issue. I mean, we kind of. We kind of see it here and there. There's the trainings on it, and people talk about it a little bit. But I see that ramping up over the next few years because, because of the climate we're in right now, people are getting fired, they're getting let go, they're losing their jobs. And that plays on your emotions. And, you know, if you're fired for the wrong reasons or you think you're fired for the wrong reasons, you may start doing stuff you shouldn't, right? Yeah. If you feel like you're not being treated right at work, you may start doing stuff that you shouldn't do. And so I see that as something that's up and coming again as well. Right.

Mary? In the cybersecurity community, I have found there's so many negative things. We deal with cyber attacks, we deal with cyber criminals, we're with miscreants, with nation states, we deal with technological surprise. If you dwell on that and you let it get to you, you can become a pessimist. But on the other hand, there's so much hope and good things happening and wonderful positive improvements around that. I like to dwell on one negative thing just in the press today. Department of Homeland Security issuing alerts about ransomware targeting healthcare facilities. What kind of malevolent. Malevolent actors would do that? We're in the middle of a pandemic, so that's. If you dwell on that, it can make you pessimistic. I want to ask then this way, how do you stay hopeful? What keeps you hopeful about the future that is in front of us in cybersecurity?

This next generation of people coming in, they're. They're. They're hungry to do this. They want to be in the mix of cyber security. And I feel like everybody that I see, they're hustling hard, they're trying to learn they're trying to get engaged and I, that gives me hope that we'll have a much better group of cyber talent protecting, you know, our critical infrastructure, protecting, you know, what we need protection of. Right. And then, you know, as technology changes, it helps bring, it helps bridge that gap and so it'll help us better see, okay, let's, let's use some automation here so that our analysts can do more, you know, analysts work and not have to worry about the low hanging fruit and actually dig in and see what's really going on. How can we protect the environment? So yeah, the future gives me hope.

Good, Great.

I see a lot more collaborations going on and that's important in this industry no matter what. Right. We've gone from very little collaboration to a lot more. Right. Working with everybody, having everybody at the table, having the conversation of how do we better secure and support our organizations, how do we better secure and support national security? And that gives me hope. Right. The whole diversity and inclusion thing, yeah, it's great, I get it. But if you're not actively inclusive and having inclusive conversations, it's not going to do anything. So I see a lot of that changing and that gives me hope that future technologies and future organizations and future goals are better, you know, defined and understood and they encompass a wider variety of areas versus just one or two things. Got to have that collaboration and that's collaboration not only with, you know, the diversity piece, but that's collaboration with the public, the private, the nonprofit, the academic, all of those sectors as well. Right. Because one organization can see something that may affect another that's in a different industry altogether. We have to continue to build that collaboration and I see that going forward as something to look forward to.

Yeah, I think that is a bright spot. And in some ways that's the good news, the silver lining to the fact that the bad guys are attacking everyone. It's raised the awareness of everyone.

Exactly. I mean, schools get attacked, like local schools. I'm like, why? They don't have any money. What are you trying to get from them? But you know, having, having that understanding and having the, the know how and the experience and the knowledge from the different players is only going to help all of us.

Right? Yeah. So I think that does give me hope too, this fact that we're all. We need to keep improving how we do this. But we've seen some good, positive steps on the broad collaboration across organizations. I remember a day when, I mean, it used to be if a company got attacked, they'd want to keep that Secret. Don't tell anybody.

Like, no, you got to tell us so that we know to protect ourselves from this too. You know, they may already be in our environment. We don't know. And if you don't have enough talent, you know, trained professionals in your organization, you may never, ever know.

Yeah. And there's also this major mega trend towards getting external help, so cloud services or managed security service providers or those kind of capabilities to help organizations that can't have their own soc.

Exactly. Bug bounty programs to help with that as well. That's another open, open source type of thing where people from all over the world can come in and hack your system and let you know, hey, go fix this. You know, it's an awesome way to get things fixed without having to pay a lot of money without. And without having to fear that you're going to lose talent because somebody else is going to come in and poach them.

Yeah. That is another major virtuous trend and a lot of innovations there with Bugcrowd and HackerOn and companies like that, delivering that as a service.

Yeah, it was smart. Smart move on their part.

All right, any other thoughts for us? Thoughts about the future?

Let's work together. We're better together. Right. We have to secure our environments, our world, and we can't do that alone. We have to work together. We have to share information. If you want to share it anonymously, share it anonymously. But we have to get in the habit of communicating and sharing that information because the bad guys have all day to hack and figure out how to do this stuff. We all don't.

Yeah.

And so we have to be able to react quickly and more. So be proactive when it comes to this kind of stuff.

Well, Mary, I tell you, one good piece of this that gives me hope is what you're doing with the Women's Society of cyberjitsu, because that's a great way to keep people bringing more people into this field and helping them pursue their dreams of a career in cybersecurity. And I just really, really think you give me hope. So thanks.

Well, thank you. That's our plan. That's our goal. Like we want to. I mean, if we could reach every single woman and girl in the world, that'd be awesome. Right. But if we can, if we just reach one or two, you know, when I get the stories of, you know, I took one of the workshops and I met these people, I got this job and, you know, thank you so much. That. That keeps me going. That keeps me saying, okay, I can continue to do this. You know, I don't need to get paid the big dollars to do it because guess what, I'm helping people figure out their path, figure out their plan and for me that's good enough. Great.

Well, thanks very much, Mary for joining us today. I really appreciate it and I just look forward to seeing what's in the future with you.

Definitely. Thank you for having me. It was a pleasure and hopefully we can have you on one of our webinars. I would love that about your career and the day in the life of your job and all that good stuff. So we'll put you in touch with our webinars team.

Great.

Thanks.

Mary. Thank you very much for joining us today on the oodacast. I really, really appreciate it.

Thank you.

Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.