Hacker and Experienced Security Executive Alyssa Miller, Author of Cybersecurity Career Guide

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda.

Loop.Com hello, I'm Bob Gourley, the Chief Technology Officer of OODA llc. And today on oodacast, Alyssa Miller. Alyssa is the author of the Cybersecurity Career Guide and she's also the Business Information Security Officer at S and P Global Ratings. Hello, Alyssa. Welcome to the oodacast.

Hey Bob, how are you? Thanks for having me on now.

Thanks for joining. I have really wanted to do this for a long time, Alyssa, because you're absolutely a key voice in the community and it's good being able to tap into some of your thoughts here.

I definitely appreciate it. I love to share whatever I can and I mean, I'm always about how we help our community grow. So yeah, let's dig in. What can I tell you?

Well, let's start with a little bit of your bio. You are a lifelong hacker and an experienced cybersecurity professional. As an executive, it's pretty clear that you have a passion for this field and you advocate for those of us in the community frequently. You've also written a book on this. But I noticed something in your bio that I found very interesting. LinkedIn says at a very young age of 12, Alyssa got her start taking a job as a paper carrier to save up enough money to buy her first computer. And I wanted to ask you about that early story, including what was that first computer?

True story. So, yeah, it was an Epson 8086. I think it was like apex one or something like that was the model. I don't even remember. All I know what I remember is I saved up about $1,000 and went to Best Buy, bought the computer. So it was an 8086 at 640k RAM, 10 megabyte hard drive. I made sure I had a hard drive that was important back then because they didn't always 4 color CGA display. So we were really rocking on the, you know, graphics capabilities.

Yeah.

And then a 24 pin color printer to go with it all. So, you know, because I didn't want nine pin, I wanted 24. I wanted that, that high quality, fast printing.

That's great. Yeah. Well then let's fast forward to today. You are the author of this book, the Cybersecurity Career Guide. And I've read it, I really enjoyed it because I have not seen a book like this before that really pulls so much together. And I wanted to start off by asking you, why did you write this book?

So that's always the question I get a lot of that, and it really comes down to. So, I mean, I grew up in hacker culture, right? So 12 years old, way back in 89, I bought that first computer. That was even before we had the Internet, right? Internet came a few years later, and when it did, I got involved in the. A lot of the hacker community in the IRC groups on Undernet. And so it was kind of a formative time in my life. Of course, my teens. And I grew up really loving the security community, and that love sticks with me. And so I see all these articles about cybersecurity, skills gap and talent shortage, yada, yada, yada. But then on the other side of it, I'm talking to people who are like, hey, I can't find a job. How do I get into cybersecurity? And it was this really weird dissonance right, between what the industry's saying and what people are saying. So I really wanted to dig in and figure that out. And so I did some research. And ultimately I had this research that I had done through surveys, through digging into job postings, doing interviews with recruiters and hiring managers. And, you know, when a publisher came to me and they said, hey, we see your presence in the community. We'd really like to have you write a book. You know, I was like, well, this is where I'd really like to go. They were totally on board with the idea. I mean, because my goal was, you know, I want. Whatever I can do to help bring more people into this industry, I want to do. You're right. I mean, we need people. You know, there's that part of the. This talent shortage or skills gap or whatever you want to call it is real. Like, we don't have as much people. We don't have as many people as we need. Now, the causes of that is where I. We can talk about, you know, where I beg to differ with some of the media articles, but ultimately, we don't have a good roadmap for how to get into this career. We. There's, you know, we're still cybersecurity, still fairly young, as, you know, a career path in general. And so there's not a good solid progression for how you get here. So my goal was really just to create a guide that people could use that, you know, would help them understand the field, get involved in it, get a job, and then really, you'll look forward to how do I. How do I continue to grow and progress?

Great. You know, I do see it relevant for a wide spectrum of people, including folks near the end of their career and older people like me. I use that book as I read it, and I thought, you know, this has messages for me as an individual. I need to continue to think of my own skills and how I differentiate for the things that I want. But also it's helpful to guys like me who like to mentor others. I still get asked a lot of questions, and now I have something that I can recommend people to buy to, you know, a much more authoritative source than my anecdotes.

No, and that's, to be honest, I mean, that's kind of how I tried to really set it up, was to be, you know, targeted more that audience. I actually love hearing that even for experienced people to continue to work on their careers. I hadn't really considered that as part of the audience, but I did try to leave it open to that. But yeah, definitely was hoping that this would be something that any individual who wanted to get into this industry could go out and purchase. But also that, yeah, mentors, educational institutions, these boot camp programs, whatever, where they could hand somebody something a little more tangible in terms of help getting a job than just, oh, we'll try to connect you with companies that we work with or whatever else. No, my goal was to give people really practical, solid advice, exercises, things like that that would really help progress them into, you know, landing that first job or advancing in their career.

I really think it does just that it does. And I do get pulled into some formal mentoring at places like BSides. And I see people that sometimes they're very junior and they want to break in. And other times I see people that might be very senior but in a different career path, and they want to examine coming to cybersecurity. Maybe they're a networking professional or something like that. I think this book would also help that kind of senior person.

Yeah. And that it's definitely targeted for. It wasn't meant just to be people coming out of college, but yeah, I mean, we hear it all the time of people pivoting from other careers, particularly in tech, but even outside of that. And you know, I gave a talk a couple years ago. Well, actually, I mean, it became my TEDx talk as well. You know, talking about like how even a barista or a retail employee have skills that apply to cybersecurity. Right. Like this idea that, oh, you, you have to be a developer or you have to be a network admin, or you have to work help desk. You have to do one of these things before you can get into cybersecurity. That that's kind of antiquated thinking at this point. And in fact, really we want that diversity of people with other thoughts and other experiences who don't just have that same tech background like maybe you and I did before we got into this industry.

Yeah, I think these are very good points. Now, I also want to back up a little bit and say you start off the book with a lesson in history, and I like that because I think we don't pay enough attention to the history of this field. And really, like any other domain, the further back in history you look, the more universal truths you can find that are relevant to today and tomorrow. So I like that you started with a good dose of history there. And I thought maybe I should ask you to tell us, where does the history of the cybersecurity career field really start?

So that's a hard thing to put your finger on. Right. Especially as a career field, I think we can think about information security as a function within businesses. We started to see that in the 70s and the 80s. It really started to grow. By the 90s, information security as a business function was pretty well established. But even then, it was like, I think early 2000s was where we really started to see this idea of people wanting to begin their career life by going into cybersecurity. Prior to that, it was always what we're all used to. Those of us that have been in this career field for a long time, like me, and I believe you as well, is we were all. Most of us were technologists. I was a developer for nine years before I got into security. I don't think we were all prepared for the idea of how do we bring in other people. We saw that. I mean, I remember those struggles in those early 2000s when we were trying to. We didn't have everybody saying, oh, well, we need academics to catch up, and they have cybersecurity programs. And now we lament that. We're like, oh, well, those programs don't work. We need something else. So I think we're still seeing even that evolution of cybersecurity just becoming something people think of as a career rather than sort of this little specialty of tech careers.

Right. Yeah, I think you're right. You're absolutely right. Something's different. But it is hard to say when it all began. Maybe because it's such a. It probably began when the first person realized they needed to defend a computer, but maybe we could say the first CISO in the mid-90s. Yeah, it's a new field.

If you want to look at, I mean, I think the birthplace, most people would point to the CTSS at MIT. So this is back in 61, you know, they had this massive IBM system that they wanted to allow multiple people to work on simultaneously. And so they created this. It was password protected and that allowed them to create like time quotas and things. And that's really the first time we know of passwords being used in computers. So I know a lot of people will point to as like, that was like the birthplace of information security in that sense, just because, you know, okay, that's where this, you know, we started using passwords. And of course, it only took a year before someone. In not even a year, it was like a few months before somebody broke the password system and, you know, was able to access everybody's passwords. So, you know, right there you had computer hacking pretty early on as well.

Well, Alyssa, you already mentioned the fact that there's room for a lot of disciplines in this field and also a lot of diversity of thought, but. And I think your book makes that clear also. But I wanted to ask for some more specific thoughts on this fact that really today, cybersecurity is a team sport and there are a lot of functions required and a lot of talent and experiences. But with that said, what are the most critical job functions in this career field, in your opinion?

Boy, that's a hard question, honestly, because there's so much. Right. I mean, I guess it all comes down to how do you prioritize it. Right? I mean, you look at our operations folks who are sitting in socks and doing, you know, the people are on the front lines just watching our sims and collecting event data. Obviously they're super critical. But then how do those systems get there? We need those, the security architects, the security engineering teams that are implementing those systems. And so you kind of think about them being critical, but, oh, boy, now I think, what about application security? So people are actually creating the stuff that's getting hacked. Boy, they're kind of important too. And so, yeah, I would say it's really, really hard to put my finger on one area versus another that I would say is super critical. I think at the end of the day, a lot of it does depend on your specific organization. So if I'm thinking in terms of, say, someone who works in critical infrastructure, some type of utility, certainly they're probably far more interested in those operational aspects because they're probably not creating a lot as software and products on their own. They're buying a lot of stuff. They're probably worried about their network security. And first and foremost is somebody monitoring that to make sure that they can detect and respond to situations. But, you know, say a software vendor may not have so much criticality in the operations. Sure, they might have a website with some E commerce stuff on it, maybe they have some other exposures, but if they're pumping out software that they sell as just off the shelf software, they may not be so worried about the operational environment as much as they are their application security. Then of course, now you get into things like SaaS and cloud providers and there it starts to shift again because now you've got that weird mix, especially as you dive into cloud native technologies. How does that fit between your operations and your development teams? And where do we implement the security there? So, yeah, it's really hard to put a finger on and say one is more critical than the other. And I think that's actually why in the book I go through a lot of that history and understanding, like, look, this is where this started. But it's not that it's evolved since then. And digital systems are no longer just the domain of large corporations who are processing data. Digital systems are everywhere. They're just part of our life. I mean, they're in your cars, some people, they're in your refrigerators. I just had to replace a water heater last night and now I'm hearing from all the people are like, didn't you get one that had all this IoT connectivity? I'm like, heck, no, wait. But that's all there, right? I mean, we're interconnected in so many ways that, yeah, everybody's threat model and criticality of different aspects of security shifts. It's all unique to each one of us and to each organization.

Great. Well, that's all very helpful. And really, as you say, it depends on the business and the business needs. But for a large organization, there's going to be a diverse need for different talents. But I also want to talk about diversity from another standpoint, and that is diversity of the people that you hire into your organization. We all know diversity is important for a lot of reasons, but in this case in cybersecurity, do you see this as a field where diversity can have an impact on outcomes 1000%?

Yes. This is something I'm trying to stress with people because a lot of times when we have these DEI discussions, people think about it in terms of like, well, you know, it's bad to discriminate. Discrimination is bad. And that's why we do DEI. Well, yes, that's a 1,000% true. Absolutely. Discrimination is bad. It's ridiculous that we do it. But we have to understand there's business value in diversity. And especially within cybersecurity, where we need people who think about problems differently, we need people who look at them in different ways. Because first of all, we don't have the luxury that all of our attackers that we're trying to defend against all look the same and think the same and act the same. So just as they're all approaching our systems and trying to break in to our systems in different ways, we need to be thinking about the defenses of our systems in very different ways. We need to be looking at those problems and considering them from people of a diverse set of backgrounds. The reality is those tangible demographic differences, the things that you can see or you know about somebody you know, so whether it's race, their sexual orientation, their gender identity, you know, religion, whatever, those characteristics of a person bring with them different life experiences and different backgrounds and different ways of viewing these things and that are important to us to have as a part of our team. So if I go out and I hire a bunch of white men who are all technologists before they got into security, and I build a team from that, that's a pretty myopic view of the world and how we solve computer problems. If I go out and I hire a very racially diverse, very diverse in all demographics team of people who come from all walks of life, some were former nurs or they worked in retail or they were coffee baristas or whatever. They have very different life experiences that they bring to the table when we sit down and try to solve a problem. And there's plenty of studies out there that talk about the increased ability to solve problems when you have that myriad of opinions at the table. So when you think about, from a business perspective, cybersecurity is about solving these problems. That's our job. So whatever we can do to make us more effective problem solvers, we should be doing. And that brings our value back to the business. So that's the very direct and often missed or misunderstood benefit of diversity.

Yeah, I'm just 100% with you on that. I really am. And I think those same kind of arguments are so applicable to the intelligence community as well. For all the reasons you just stated. We want, in the intelligence community, analysts who are looking at threats to bring all those different perspectives. And as you say that, it just sounds like the arguments that I hear taking hold in the intel community. But I really strongly believe this for cybersecurity?

Absolutely. I mean, so if we're talking even government agencies, let's take a look at, you know, cisa, for example. I love the work that they're doing. You know, Chris Krebs kind of got it started, this integration of, you know, trying to bring voices to the table from the private sector to work with the public sector. You know, there's. And there's wonderful work now that, you know, Jen Easterly is doing. I absolutely. I'm in awe of what they're trying to do. And at the same time, I also have my frustrations with it, because when you look through their list, Safer, Jen and Eric Goldstein, everybody else in that list of leadership all comes from very government backgrounds, very little private industry. So it's like even there's an example of, wow, we could get better if we had more private sector voices in that space as a part of that organization. And so I know that that's something that they're definitely interested in. They've gotten some new programs going where they're able to even just pay and compensate people at levels that match the private sector so they can draw in more of that talent. And I think that that's going to be important as we consider. But it's a great example of just how much value that diversity can bring.

Right. No, I'm with you on that. I really am. And I'm with you also on the love for CISA and the stuff they're doing. That organization has matured under great leadership. But I noticed those diversity issues as well. And they just named a cybersecurity review board, which the nation needs. And it's some of the nation's greatest talent on that board. Not very diverse. And it is maybe two or three women, and only the majority of the people in there are either from government or very recently departed government. And also a large number of nsa, as you could expect, they're doing great work. And this is a wonderful board of incredible people. But I guess we all have a ways to go.

Yeah. And that's all we can do is keep working and make progress. Right. I mean, it's not one of those things that's going to change overnight. It's not something that we can just say, well, hey, we do this new tool or we create this new process and it all gets better. It doesn't work that way. It's a very, very cultural, normative sort of shift that we need to make. We continue to get better. Just like how we defend our environments. We know we're Never going to reach an end state. We're not going to like install that one magic bullet that fixes everything. So we just keep working on improving and that's what we need to do.

Right. Alyssa, I was going to ask you a question about do we all need to be coders to succeed in cybersecurity? But you have already made it clear to, to us in your comments that, no, we don't all need to be coders to secure in cybersecurity. So let me ask it a different way.

Yeah.

Does everybody in cybersecurity need to have an appreciation for the technology and appreciation?

Sure. Do they need to have deep technical experience in it? No. And, you know, so this, this topic comes up a lot in social media, right? And I'm sure, you know, you've seen it. I've definitely dove into it first, you know, head first. The reality is, you know, you don't need to have that deep understanding of all these technologies. I was a software developer. I have like almost no networking experience whatsoever other than playing around at home with my home networks. Right. I haven't really ever had to configure network devices in an enterprise environment. So a lot of this stuff like, you know, routing protocols and things like that, don't ask me. I'm not the expert at all. I can understand and appreciate it when people are explaining it to me how it works because I have some base knowledge and yeah, it makes enough sense that I can make some intelligent decisions. But as a security executive, I'm, I'm reliant on the people around me who have that skill set to help me understand. And then I'll help, you know, provide direction or whatever. That's my job. And so, you know, I think people get really hung up on that, that, oh my God, you have to have all this technical knowledge before you come to security, or if you don't, sure, you can come to security, but you need to go into grc, which, you know, trc. Now there's an interesting animal because, you know, governance, risk, compliance, sorry for those who don't recognize the acronym. You know, people look at that as a, that it doesn't require any technical knowledge. Well, you can do far, you do great things in GRC if you've got some technical knowledge. It's also one that a lot of the technical folks in cyber security tend to kind of, they do kind of other it, right? Like it becomes that thing. And there's even some, I hate to say it, but there's some disdain for grc, like that's not really part of cyber security. And I'll tell you what, the GRC people that I work with in my organization, whether it's my risk management teams, my governance teams, whatever, ever, I'm reliant on them every single day. Like, they do so much to drive our vulnerability management program, to align how we structure our organization. All of this stuff that's critical. You can't run a cybersecurity program without it. But yet we minimize its value or its role in what we do. But also to say that someone who doesn't have technical background, that's the only place they could go, is completely foolish and misguided. So, you know, that's one of those things. I really. That's why I like diving into those conversations, because I really like to get people thinking differently about that. And see, okay, first, don't diminish the value of grc. A lot of people really love that work and that's what they want to do. But also, just because somebody doesn't have a strong technical background doesn't mean that that's where they. They need to go, that that's the only place they fit.

Well. Thanks, Alyssa. And there's another thing that I think is a first in your book as far as I've seen. Never before did I see a cybersecurity book talk about the need for empathy and emotional IQ in cybersecurity. So I want to ask you about that. What did you mean when you said, when you talk about the role of empathy and emotional IQ and cybersecurity.

So how many of us in cybersecurity have heard us refer to in some fashion as the department of no? Right? How often does infosecurity, cybersecurity get regarded as the people who stand in the way, who tell you you can't do the cool thing with the technology that you want to do, where that extra overhead. And you know what? We did that to ourselves. Seriously, how many of us went out there? Here's a perfect example from recent history. How many of us with log 4J, we looked at that and we said, oh my gosh, we have this vulnerability in log 4J. Then we start to find out, okay, it only exists in the big scary RCE that everybody was worried about. Exists only in versions 2 point. I think it was like 2.9 or something and up, but let's just say 2x, right? All the version twos. So how many of us went out there and we're screaming at the top of our lungs that people who had version 1 something of log 4J. So I've got version 1.7. How many of us were sitting there telling you, you got to replace that. You have to fix that. It's a critical vulnerability. It's a perfect example of where we come in and we have no understanding of what we're saying. We just throw out these big requirements without understanding the value behind it and how it applies to the business. So when I talk about empathy, I'm talking about the ability to understand those that we're trying to influence. So if I want devs to help me fix things when they're critical, I can't make everything critical. They just simply don't have the time to do that. They have other aspects of their job. When I'm speaking to executives, I need to understand that if I'm in a board meeting or I'm sitting at an executive committee meeting, no one else in that room thinks cybersecurity is the most important thing in the organization. News flash, it's not. I can run an organization tomorrow. We see this with startups. I don't need a ciso. I don't need a security team. I need to make money. That's what a business does. And so understanding that and understanding that, we need to communicate to them not about what technology we're using and what we're doing and all that. We need to talk about the whys and talk about it in terms of, here's how it's helping improve the business. And it's not just, oh, well, we're reducing risk, that's great. Yes, we do that. But how am I actually making the business better? How am I making it faster? How am I making the business stronger? How am I giving us better market visibility or position? How am I helping us innovate through what we're doing in security? So all of that comes into play. And the last thing I'll say about that is we do best in security. Our job is to be the experts on how to secure systems, how to secure our networks, how to secure our critical assets. But our job is to be able to communicate that to others and influence them to make the decisions we want them to make. That's going to help secure us. And we can only do that if we understand them. We understand the business, we understand their roles, their motivations, and we're able to speak to it in those ways. So that's where this idea of emotional intelligence and empathy comes into play, is that we need to be doing more of that part of it. And traditionally, we struggle with that in cybersecurity. We're technologists, by and large, and we want to talk about all the cool toys that we're bringing in, all the new tools and the things that they're going to let us do, but we never really connected to the why in terms of what the business needs to know.

Yeah, Alyssa, that is so well put. When I was a Chief Technology officer back in government, I would tell people that I like technology and people in that order. And of course, we would all laugh. But really, we have this issue that you just described. So many technologists like me neglect this emotional IQ and it causes damage. And I think your writings in the book make it clear that this needs to be part of your career plan. Is growing emotionally and having a good emotional IQ and developing empathy. It's also a good leadership trait to have good empathy.

And that's the thing. Right? And this is why I tweeted out a while back and I think it was in response to someone had asked me a question privately. But if you want to get into cyber security leadership, you want to get into higher levels of leadership in cybersecurity, what's the one skill that you should focus on? On? And I said, go out and learn the content that they teach in the mba. Like learn business administration concepts. I'm not saying go out and get an mba. Right. I don't think you have to do that, but learning that side of it, because we're the only ones that speak cyber speak, if you will, like your cfo, your CEO. They look at the business in a very different light than we do because we're just this small little subset of a subset in the overall scheme of the business landscape. And so learning how to use the terminology, learning what they've learned, because a lot of them do have MBAs, those people you're going to be dealing with and trying to get to support you, learning how they look at the world, because this is how they were taught. This is what. These are the business concepts that are fairly universally used to run a business. Knowing that makes you so much more valuable as a security leader, because now you can communicate so much more effectively.

Right? All right. Speaking of communication, you are one of these people who has a reputation for giving back to the community in a lot of ways, including speaking at conferences. And you talk about things like this in the book. You talk about conferences that people can attend and engaging on social media. And I wanted to say, I think you set the example there personally as someone who gives back to the community Quite a bit. And the book is proof of that, frankly. But I wanted to ask your recommendations for those that really, I mean, they don't want to speak at conferences or can't speak publicly or don't like to write. Are there other ways that people can give back and contribute to the community?

There's so many ways. So, so many ways. I mean, just being. You can be a public advocate just in terms of social media, if you're, if you're in social media. But let's remember too, there's lots of people who are not represented on social media. I mean, we look at social. We look at like, you know, infosec, Twitter, and we think that that's like the infosec world. We forget that we're only about 10% of people that work in infosec are on Twitter. But, you know, just even being there as like a mentor, and I'm not even talking like joining like a mentor program, but just informally mentoring people. Who else is there with you that you work with, who you can help them understand a little bit more about what you do or help them get into a job or, you know, all of these various ideas, just ways that very privately you can work with people. You know, I mean, helping the, helping the community grow happens in so many ways. You can produce content maybe, you know, maybe if that's easier for you, you write, you know, writing a blog or if you're into it, creating videos or you know what, even what you post on social media can be great. Or do you volunteer your time somewhere? I mean, all of these things, you don't have to be in the public eye to, you know, to be giving back to the community. And in fact, I, I would say a lot of the best things, in my opinion, that I do to give back to the community most people don't even know about because you don't see it it. And that I prefer it that way. Right. I mean, that's because to me, that's a check on myself as well. It makes sure that I never reach that point where I'm doing things because I want to be more visible. I'm doing things because it helps the community. And I think that's the biggest key is just as long as that's your desire, your desire is to help the community. I think you're well aligned to find those ways. Just find the thing that you're interested in. If you're not interested in public speaking, don't public speak, that's fine. You don't have to be out on A conference stage to give back to the community. You can be creating new standards. You could, you know, innovate, create some new technology, share it through the open source community. All this stuff, anything you can think of, is all stuff that helps make us better.

So thanks, Melissa. I wanted to say a couple other things I took away from your book. One, I thought it was a great examination of the role of sort certifications in our community. I knew there were a lot. I had no idea how many until I read your book and you laid them out very well. And I think you give good guidance in there that can help people decide which path of certifications are good for me. So that's one reason I want to strongly endorse this book to everybody, because certifications do have a role. But other things you talk about are the role of academia. And I think getting degrees that relate to your career field is also extremely important. I saw on Twitter you were commenting, someone else had said something like, all just agree that cybersecurity should be a discipline of computer science. And you kicked off an interesting discussion where I thought, well, that doesn't make any sense. It would be like saying all physical security has to be subordinate to physics. But anyway, I wanted to say you do hit that very well in the book also. You also hit topics like imposter syndrome and how a lot of us need to get over that and live up to the role that we're in. You also talk about burnout in cybersecurity and how we all need to avoid that. And you give good tips, I think, for avoiding burnout. And then you talk about gatekeeping. And here's where I wanted to ask some personal advice. What is gatekeeping? And how would I know if I'm demonstrating gatekeeping behavior? And how do I avoid that?

Yeah, so, oh boy. How do I define gatekeeping? I mean, the easiest way to say it is just when we place those arbitrary requirements on somebody to limit access to, in this case, the cybersecurity career field. Right. So you see, people say, well, you must be a coder to get into cybersecurity. Well, that's gatekeeping, because you know what, you don't have to be. And in fact, there's a lot of roles where knowing how to write code wouldn't help you at all. It wouldn't be useful to you. So that alone those types of things, and you see it in all different forms, people pick all sorts of different arbitrary ways to try to suggest that somebody doesn't belong or to try to limit the access Provide hurdles that you must overcome to be here at the end of the day. Really what I ask people is how can you make such a general when you find yourself making that generalization. Right. Saying a general thing as a rule. If there's one thing I've learned in cyber security, it is that there is no hard and fast rule for anything. And so when you find yourself saying must you making those must statements or have to statements or. That's where I see, you know, that's the easiest way to detect that you're, you're gatekeeping like, think about that for a minute and challenge yourself. When you make a statement like that. What are possible exceptions to that? If there's exceptions, then don't make a must statement. That. And that's the thing. That's why. Yes. Is it helpful to have coding background? Absolutely. Can that, can that help you, you know, do your job in a, in a better way?

Perhaps.

But let's not ignore the value of somebody who doesn't have coding background. And the perspectives that they bring can be equally as valuable. And that applies whether it's coding, network management background, you know, sysadmin, all of that stuff. It's all, it's all great. It's really good to have that and it can be helpful, but it can also be helpful to come from a high pressure environment. I'm going to keep going back to my barista there. Someone who sat there and worked in that type of environment and doesn't have these preconceived notions that come from having a tech background. We need to learn to value that a lot more than we do. And so telling someone like that, well, you have to go work as a programmer for three years before you can get into cybersecurity, or you have to go, you know, do network administration or work on a help desk before you.

Get here, or get a cissp.

Well, you're just trying to light me up now. Don't get me started on the cissp. The, you know, certification you have to have five years of experience to get. But people put it on entry level job descriptions. Right? Come on.

Yeah. Yeah. Well, Alyssa, the book was full of great advice. I really liked it because I think it's, it will help all of us grow in this field. And it kind of makes a point directly that all of us need to keep growing. So I wanted to end with this question. What do you do to stay current and keep learning?

That's such a broad question. I mean, honestly, it's hard to answer because it just sort of happens natural now, right? I mean, working in the industry as long as I have and being now in the role that I am, I mean I'm leading cybersecurity for this massive enterprise division of S and P. And so, you know, just having that, that exposure to all of that quite honestly helps being connected, the involvement that I do with the community, being at conferences, you know, just interacting with people, even on social media can be really effective. I learned about stuff, stuff like technologies I didn't know about all the time on social media. Where the heck do you think I learned about NFTs? First it started popping up on Twitter because everybody was looking at it saying this is ridiculous, you know. And so then I started to dig into it. Deep fakes. You know, I've done a lot of studying and going through the research that's out there about deepfakes. I've given a number of talks on it. That's another one. I found out about it through social media. You know, there were so, yeah, some of that. And so, yeah, it's just I find those things that just sort of pique my interest and then just go out and dig into it. You know, that, that's kind of, I don't, it's not that like I set out to learn about, you know, like I have some map of things I want to learn about. Some people do. And that's awesome. Like if you've got that. I wish I was that organized. I'm not. For me it's more just, you know, state of mind. What, what's driving my curiosity. And that's the thing I'm going to dig into. I mean that, that's how I got here. I go back to the 12 year old with that computer and you know, I was using Prodigy and Prodigy had a subscription cost and I was 12 years old. My parents weren't going to buy it for me. So after I used up the whatever, 50 free hours or whatever I got with that, that, that disc that I think came with the computer, you know, I dug in because I wanted to still access it. I learned about modem communications. I, you know, I got into things like uarts and all that. Like, oh my God. You know, and so, you know, and used that, used all of that information I gained on serial comms and all the rest to figure out how to break into that Prodigy. You know, it was, that was the thing that stood out to me, you know, and so that's just sort of of, you know, it's, it's that curiosity and that passion to dig into things that drives. What do I learn? How do I stay current? Just. Yeah, what, what's topical at the moment that. That's catching my interest. And let's go dig into it.

Yeah. When I hear you describe it that way, it comes across as, you know, okay. It's that hacker mindset. You're just continuing to learn by your curiosity and driving yourself to explore more and more things.

And that's where that whole. The line you quoted from my bio about being a lifelong hacker, I mean, from as far back as I can remember, as a little kid, I was always taking things apart because I wanted to figure out how they worked. My parents weren't real thrilled at 8 years old when I took apart the VCR, but you know what? I put it back together and it worked. I figured out kind of how a VCR worked. I didn't know every detail of, you know, every component, but I could see. Okay, this is how the tape gets fed. It goes across. Oh, here's the. The read head. Okay. And here's the record head that pops out when you hit record. All that kind of stuff, like, things I would have never understood until I opened this thing up and watched it function. And that's exactly what we do as hackers is. Yeah, we take things apart, we look at how they work, and then we create new stuff. We make other stuff based off of that knowledge, or we modify the thing that we just took apart to make it work different. That's like the hacker ethos right there. And so, yeah, that's why I say that's been me as long as I've been alive, even before I was working on computers. That's what I love to do.

Right. Well, Alyssa, thank you very much for the time today, and thanks especially for writing the book, the Cybersecurity Career Guide. I think it's going to make a tremendous contribution to the cybersecurity field.

Well, that would be wonderful. I mean, that's. That's certainly best case scenario if this, if the book ends up helping a few people get into a cybersecurity career a lot easier than they would have otherwise. I mean, that. That means more to me than anything. So fingers crossed. I'm pretty confident in what. What I've got there, that people find it useful. But, yeah, that's. That would be best case scenario for sure.

Great. Well, thanks, Alyssa.

Yeah, thank you.

Thanks for listening to this. Ooda Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.