Guardians of Academia: Battling Cyber Threats in Higher Education

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about protecting higher education institutions from cyberattacks. And I get to talk with Donna Kidwell. Now Donna is the CISO, Deputy CIO, and Digital Trust Officer at the great University of Arizona. Welcome, Donna. Thank you for coming and talking with us.

Hey, Matthew, um, that's Arizona State University.

Arizona State, sorry.

Yeah, that's okay. I'm gonna send you—

sorry, sorry, my apologies. No offense, I'm sure I'm going to hear it in the comments.

Oh. That's okay. I know you've only had 2 cups of coffee, so you're fully forgiven.

You're right. We're talking about that. Okay. Okay. So now ASU, correct?

Yeah. Okay.

I mean, that's a sizable school. You've got what, over 40,000 enrolled students plus, well, all your previous students and then you've got all the faculty and everything.

Yeah. Matthew, we're at 177,000 students.

177?

Right, so your average R1 research institution, like my colleagues down at the University of Arizona, you know, they run about 50,000 students. I think there's something like 56,000 students at University of Texas Austin. That's about par for the course, somewhere between 50,000 and 60,000. And we're at 177 because we've got this mission of access, which causes some interesting opportunities in cyber. But that really does set us up with ASU Online, 90,000 students in ASU Online. And so it's a really interesting environment, but yeah, it's huge. You're not wrong. It's big.

So what kind of problems— I mean, not only you've got so many users, you've got so many systems, classes, labs, you have outreach programs, computing. What are the top things, right, as the CISO, that when you look at this vast environment of technology and people and all the processes that intertwine it together, what are the big problems that you see or face as an educational institution?

Well, it's— I love the way you describe it because it's really easy to underestimate all the things that go on on a campus. You know, everything from the campus has a museum and it's got these giant libraries. And so there are these places, oh, and athletics. So there are these places where the public are welcome and invited alongside their potential drone threats and their, you know, random USB dongles. So you've got that side of it, right, especially a large public research institution. And then you've got students, and the students have, of course, parents. All of them want different kinds of access to different kinds of data and have different expectations about everything from Wi-Fi in the dorms to— it's BYOD. So, like, I had this great conversation with the chief privacy officer at Apple, just trying to get some tips, like how do you, how does Apple think about protecting its environment, and I don't experience jealousy often, but I can't do what they can do. I can't say, hey, when your devices come into my environment, here are the rules, because our students are going to have iPads and Xboxes and maybe 2 or 3 different console games. Like, they're going to put all sorts of stuff on the network. So yeah, so that's the crazy part. The research side, and the research side gets really interesting, and we want that research side to be porous so that we can invite researchers from other institutions or from national laboratories. So then you've got this kind of really interesting space where you want to bring, I mean, talk about zero trust. I want to bring in the right environment, the right device, and understand what this person's doing on the campus, and then be able to actually get them into the ecosystem in a safe way. It is wonderfully crazy.

So you need to both be secure, but you also need to, as you said, be porous, allow these, ah, the BYOD. I mean, my brain is exploding right now because I mean, we all want to believe that our students, the people that we trust, the people that we want on our networks, they have good intentions, but we also know that, well, they make some mistakes sometimes. And then there's also a small community who are, let's say, more curious and want to do things on the network that may not be beneficial to others or the preservation of sensitive data.

Exactly, exactly.

Little things like that. I was— I'm trying to stay right, right.

No, no, no, no. I mean, but let's have some fun with it. We have one of the largest engineering schools in the world, 32,000 engineering students just in the School of Engineering. And we want to encourage them to be playful and to experiment and to learn something in class and then immediately go test it out, which may mean like we've got our own little version of Insider Threat. And so trying to, but that's what we want to do. We want to encourage inquiry. We want to challenge. We want an environment of an openness and welcomeness to being able to engage and then be able to say, oh, but maybe don't engage that way. Let's harness that activity for good and kind of create some really interesting boot camps or experiences on the campus where, you know, we can engage you in ethical hacking. So yeah, it is really, It's a lot of fun to try to stay on top of, but it's always moving. With that many students, that much creativity, that much inquiry, you just have to fundamentally think differently about what your baselines are.

Tell me more about this thinking differently because you say you wanna encourage play and that's great, but if people are trying to break things or get into things that they shouldn't, In normal business worlds, that's something that we draw very hard lines. We don't want you to play. We want you to work. We want you to be productive, but there's no playing. No, we don't want you to be doing port scanning or seeing what happens if you explode this malware. And so, I mean, in the business world, we're normally very clear-cut, dry, straight-laced. This is what you can do. And we're descriptive about that, right?

Right.

And you're conveying a kind of a different entirely viewpoint, so I want to know more about it here.

Yeah, yeah, yeah. Well, so part of it is, um, like all the practices that are best practices, like all 17— what is it, 17 parts of CMC Level 1? Um, uh, they, they all apply. Um, but we've got to think about how we architect and design the environment to be, because we've got this mission of access and we want to be welcoming and we want all of those things to happen, we've got to think about it in really different ways. So we are now, I think, 7 years on a journey of redefining our network, like from the ground up. It will be, and every year we get more momentum on it. I'm really excited about where we're going to be this summer with it, because we're just now getting to the place where we're past proof of value. We've got enough, this is an Arista-based network, software-defined network. We've got enough of an environment there that this kind of happy future state of observability on the network where I can actually observe something coming in and say, hey, this is the identity that's bringing into the network, this is the device that they've got, this is the fingerprint of that device, let's make some decisions about where in the network they should be, how we actually think about routing them if they need some, I don't know, maybe they're bringing in a vulnerability or they need to be patched. Like how do we start thinking about automation orchestration observation. Like, those are all things that any of my private sector partners are doing. I just have to step back and kind of think of who these constituencies are and then open up those workflows to make sure that I'm providing the right environment in the right places at the right times. Um, which in some ways is, is a really— it's a wonderful challenge because it means we get to role model, like, what does that transformation look like? How do you tackle the hard parts? How do you think about marching through the buildings? How do you get your network engineers and your cloud security engineers. How do you get all those teams convening in ways to actually make all of that possible? Because it's not obvious. It's something that takes really, really deep intentional work. And we're all on one way or another that like road to zero trust, right? We've all got our whatever that's gonna look like for each of us. Our landscape just has, I don't know, lots of different types of features on it.

That's a nice way of putting it. Sure, yes, lots of features, potential targets, and, and interesting participants, shall we say.

Yeah, let me— when I first came into this role, the first thing my teams asked me are, you know, what is our risk appetite? It's a very reasonable question. And ASU's been ranked number one in innovation 9 years in a row. We're repeatedly ranked number one in innovation, um, and we got that way not by accepting risks, but by taking risks. And so my answer to that is, okay, our risk appetite is voracious. Our risk appetite is take the risk and then be resilient. We use the word antifragility all the time because we not only want to be resilient, but we want to learn from it. So there's this foundational component of, yeah, we are going to do that vendor IT risk review, do that security review, recognize the risks. And now we've got to build musculature to actually very actively mitigate them, make sure that the enterprise teams are giving the right set of tools to the rest of the campus so that they can actually do the mitigation so that if they need help, they know how to raise the flag and say, hey, this isn't what we thought it was going to look like. Or I think the biggest challenge we have is like the risk evolves over time. So when you're starting something off, you're like, I got this, I understand what those risks are. And then, you know, 18 months into generative AI, you're like, whoa, whoa, whoa, whoa, there's all sorts of stuff here.

This is a new game. Wait, hold on.

Right, right, right. It's a new game that it turns out like everybody's playing. Yeah. You know, I've this time last year asked the team, you know, can you just go look in Splunk and tell me how many endpoints are checking out ChatGPT and its affiliate websites? You wanna guess last year what those numbers look like?

I'm gonna say at least 80% of your accounts that are resident on on-prem kind of, students are at least 80% of students and faculty within a 2-month period are checking out ChatGPT.

Yeah, so, so that's an— I love that you framed it that way, um, because our, our stakeholders are accessing us in all sorts of different ways. They're not all on my network, and of course I've only got visibility into the network, right? So from what I can see, it runs about 17,000 endpoints a week. And that's just what I can see just in our house. And of course, like, we're in the city of Tempe and we're ASU Online and we've got folks remote and hybrid and working from wherever else they're working that may or may not be using the VPN. So that's just the world as I can see it. It's that kind of thinking that led us to really early talking to OpenAI and saying, hey, let's figure out how a higher ed institution needs to work with you. You. So this, this kind of risk mitigation, everything from the approach to our networks to identity to data governance to vendor management, you know, we take all the things that, you know, all my CISO peers think about, and then we kind of have to say, okay, the lens is academic freedom, the lens is encouraging a space where people feel like it's okay to fail and that they've got support when they fail and that we've got them, we're resilient, and we've got to take all that kind of stuff into consideration. It's a lot of fun.

Well, you know, I see you now kind of at the end of the spectrum really when it comes to risk acceptance, that you're willing to go out on that ledge. You realize the value of that creativity and the access and fostering, you know, behaviors with your constituency there that's on your network or has access to your data, but you're not doing so blindly. You are putting the controls in there to be able to understand, well, who's doing this and Giving them the resource, hey, I need help, I did something wrong, right? And it sounds like you've got that oversight to say if something starts to go bad, you can intercede. You've got the tools for detection, you've got the response capabilities to bring yourself back up online or to contain. So you're managing those risks. It's just that risk acceptance is really far at the end of the spectrum that most companies would go, no, what are you thinking? And yet that is conducive to the environment and the learning environment that you're overseeing. So I think that's just, it's just amazing. I still, I still, it's, it's difficult for me to put my head around it at that far of the scale.

Yeah. Let me give you an example. Um, then I see you've got a question, so I can say, go ahead.

Yeah, but I'm just thinking what kind of tools, I mean, you've got, you've got SOC and certs and I mean, how do you teach digital ethics? What kind of training are you doing to say, Yes, we want you to do this, but if you have a problem or you need— I mean, the user training, what kind of policies and procedures? I've got 1,000 questions. It's not just one.

Well, we've got plenty of time. Okay, let's talk about some of the standard tools. Endpoint protection, CrowdStrike Proofpoint, you know, the arsenal, defense-in-depth arsenal of tools. One of the things, because we're a public institution, that we're always trying to do is figure out, like, How do we make sure that we've got best in class, that we're not only using those tools, but we're using them in a way that develops a stronger workforce? We can talk about that a little bit later too. Trying to think really smartly about what we're deploying, how we're deploying it. And in an environment like ours, that often means, because we're so highly distributed, that you've gotta build trust. 'Cause I don't have the same mechanisms if I had a unified environment where I could say, here's your machine and here's your image and it's the only one you're gonna have. Instead, I've got to say, oh, you've got—

I feel warm and I sleep well in this environment. It doesn't always happen, but I like those. But okay, continue, because I want to know this flexibility. I love this.

Yeah, so, so I've got to work with my teams to understand the— let's, let's say endpoint— to understand the challenges where they face, where they're like, hey, there's this entire part of our ecosystem that's really not comfortable with this particular agent that we'd like to use for endpoint protection, and here's why they're uncomfortable. And then we kind of dig in and say, okay, well, what are the root causes there? What is it about their research or their environment or their lack of comfort level with having an agent installed? That's, you know, means on a regular basis I'll sit down with the dean and then a set of researchers and say, okay, talk to me about what you're doing. What's important to you? Why do you have an environment and kind of what are you trying to aspire to achieve with that? That's their motivation., and then matching that over, um, figuring out, okay, well, what's the long road to get us to a standard and a policy and a set of procedures that have, um, I call them empathy pathways that, that recognize what they actually are trying to accomplish and then give us the path towards having the right set of controls or an, an, an agreement, kind of a considerate consideration amongst the two of us that they're gonna do it differently and here's why, which is fine. Um, like, why have a policy if you don't have exceptions? Um, but then let's kind of figure out what are those exceptions, how are they documented, how do we have transparency into the decision-making, um, how do we make sure that it really is a consensus-based decision, that folks are coming together. So it's— that's new governance models. It's a whole set of kind of thinking about engaging the community differently, which kind of comes into training, if you want to talk about training a little bit.

I do, but, but, but this deep partnership that you are fostering with your community to say, what are your needs? Why can't, you know, our preference would be to drop an agent. You have resistance to that. Help me understand, right? As a security professional, let's work together. Let's find alternate. It doesn't have to be my way or the highway. Let's find a way that suits us both. I still want to protect your environment and your assets. You want to get your work done. Okay. If the standard doesn't fit, let's write a new standard for you.

Right? Right. Inform the standard so that the standard becomes antifragile. You know, that's— we hit resistance. We're like, okay, why are we hitting the resistance? Let's figure out, you know, what is— what's in the spirit of that control that actually matters to the reason that we'd have that control and then kind of work through it. Or what is, you know, what's your risk tolerance? You know, or maybe in a lot of the cases it's how are we thinking about creating a space for them where that risk tolerance can be whatever it needs to be and the blast radius is exactly what it needs to be to be able to control the kinds of work that they're trying to do. That's a lot of the driver of something like a software-defined network so that we can say, ah, this is something that you have the opportunity to research. It's going to be a defense contract. It's going to require that you have CMMC Level 2. OK, great. We can do that for you. And here's the set of affordances that we can give you. Here's the basic framework that we can spin up for you, as opposed to what most universities have inherited, which is decades of bespoke kind of snowflake environments that were created for these fit-for-purpose, and then you've got an entire campus that's a patchwork quilt of very different environments. Almost all R1s have some really interesting stuff going on. Like one of my favorites are a researcher that maybe is doing space work. I'm not gonna be too terribly specific. Please don't. And maybe got grants for that during the time of Windows 7. And maybe has hard-baked some of that project to require that operating system. And so now we've got an environment where there are, there are legitimate reasons for needing to have completely end-of-life environments, um, until the science and the research gets funded in such a way that they can rebuild the architecture to match a more modern environment. But that's not a fast process, I promise.

So there are real reasons. An OT environment, it's going to stay that way for 30 years, right?

Yeah, right, right, right. Because it's, you know, it's, it's, uh, tied to things that we put out in space that long ago.

Okay, so you build and you foster this partnership with your community, and huge dividends there, obviously.

Oh yeah.

But that's got to translate into some very interesting obstacles when it comes to training, because one environment may be a lot different than another. How do you effectively train and understand those policies and enforce them with these various communities?

Well, oh, there, there's a lot to unpack there. Uh, one of the things that my team spent the last 2 years on is really rethinking our training entirely. And, and part of that's because, um, because we're ASU, because we have 300 degree and certificate programs online. You, you can get, uh, online degrees in physics and astronomy. Um, anything you want to study, you can study at ASU online. And so that kind of gives us a different level of expectation for how good that should be. Like, your experience should be really good. Um, and we're pretty opinionated about instructional design and learning objectives and the efficacy of learning. 'Cause it's kind of our jam. So I'm not gonna pull kind of standard voiceover PowerPoint compliance training, ugh. Instead, we've worked really hard to try to be as proactive as we can about either finding vendors that have really engaging cyber training, and then figuring out how do we deploy that in ways that pursue something that looks like, we're not there yet, but our goal is to get just-in-time training, so that you are actually accessing, hey, I've got PII data, I've got HIPAA data, I've got data that's sensitive for X, Y, and Z. How do I get to that library of the kinds of things I need to understand to protect that data? And we've been building out that library for a while. Our latest offering is an AI safe cyber safety course around generative AI. And that took— that was pretty rapid. We recognized pretty quickly that we needed specific training on it. Took about an 8-week cycle. A lot of work with our general counsel, which is also another interesting piece. Like, who do you bring to the table for that training, and how do you make sure that you're— that you're— and it's part of your community building, right, that you've got the right stakeholders there? Because it might be in the creation of the training that you discover a thing that you need to go to a standard or a policy or procedure around, um, which is always fun. But we try to be really rapid about that. We've got a pretty strong learning community, um, again because we're a university. And so it's, I think it's really more a question of like content strategy, which, you know, something about, right? You're creating a lot of content, being really intentional about that content strategy, really intentional about discoverability. A lot of what frankly looks like marketing. We have an entire team we call creative and comms that's inside of enterprise technology and they do nothing but really incredible LinkedIn campaigns and really incredible social campaigns. Um, We've been doing a series of podcasts in Waymo vehicles, and in a couple weeks we'll launch one with Wendy Whitmore from Area 42, where she talks a lot about the kinds of threat intelligence that she's seen, and we sit in the back of a Waymo and drive around. It was delightful. Or myself and Ryan Murray, who's our state CISO. So these are different ways of kind of trying to get education out there, where I know that Ryan Murray's going to talk about some best practices for MFA, 'cause he and I have colluded, that this is a good thing for us to discuss. So it's— so you've got your kind of your compliance training that happens on an annual basis, your new employee training, and then thinking really creatively about a content strategy for training that's discoverable and that people can kind of find as they need it. And then these more, I would say, kind of broader community engagement periods and really thinking about, okay, what episodes do we want to queue up for Cybersecurity Awareness Month in October? And thinking about that now so that we've got the right messages that we can be sending out, and we've got, you know, frankly, small, small teams trying to do heroic work and make sure that they've got normal lives in the process. Yeah, I love that you asked though, because that kind of— the ability to find different ways to tell the story, to make it engaging, to really then hope that, that you see better adoption in your community for the practices we need them to have. It's all, uh, really important stuff.

That's amazing, but it occurs to me it's entirely unfair. Wait a second, your community is by design wired to learn, to want to learn.

Oh yeah, we love it. It's our chance.

Open to this training instead of being resistant to it. And, and Also unfair, you have a tremendous resource pool. You've got communication majors, you've got marketing majors, you've got all these other things. Wait, this isn't fair. I thought you had a magic wand and you were pixie dust making things happen. No, no, no, no, you've got all these resources in an audience that My dear child is open to that.

I love that.

You're leveraging every opportunity, every resource you have, and that's amazing.

That's the only, the only way to survive. But here's, here's the untapped opportunity. Um, and I, I talk with Ryan Murray, my state CSO, about this a lot. Um, while they're at the university, we can create a, uh, student worker position for them or a fellowship or a really interesting project that kind of works into a capstone. And hopefully also learn from them, like engage that. And we have quite a few projects where we're working with researchers directly that are looking at our networks for a variety of different things that they're trying to inquire about, and we want to learn from that too. That's all great. What's really interesting is when we do that in partnership with industry, when— and that's kind of an open call. And I don't think that our partners who are struggling with these same challenges because they don't have the culture of learning and they don't have these incredibly enthusiastic students who also want a great portfolio piece out of it. But they could, they could partner with us for that. There is absolutely no reason that we should not be embracing industry partnerships to then create a, I'm just gonna make something up, a State Farm fellowship. State Farm is figuring that out too in the umbrella for how our machine is trying to do it. Maybe even using some of the same tools. One of my aspirations is to build a lot of this with K through 12, because they're heavily hit and they have a learning community, but they don't have the resources that we do. So in the last couple months, I've been spending a lot of time with leadership in various school districts asking, okay, what realistically do you need? Like, how creative could we get about partnering with teachers getting teaching certification in STEM fields and then bring them into cybersecurity clinics where they could start understanding what vulnerabilities look like in the school district and then deploying cohorts into the school district to do very targeted vulnerability management and awareness campaigns. So, and I like— universities get to cross every sector. There's no reason we shouldn't be doing that with our same partners from any industry who's trying to tackle this. It's more a design challenge, right? It's more kind of saying, okay, how much time would it take to do that? What's our will to try to put something together? You know, here in the state of Arizona, we're missing about 13,000 cybersecurity professionals. So the only way we're going to solve challenges like that is thinking really creatively. So yeah, I've got those resources. I'd love to share them.

Well, that's amazing, the type of outreach that you're doing, especially to public schools and everything, and then that just feeds in to the general knowledge base, not only of the teachers and the staff, but of the students too, as they start getting more integrated and knowledgeable about this. And that's promoting more STEM, that's promoting more awareness of, uh, social potential risks online using technology and, and everything. That's fantastic. How is it with ASU in collaborating at the collegiate level with your peers and partners, not only within the United States, but do you also collaborate overseas, international education and academic institutions?

Oh, oh, we could talk for hours. Okay, so in some ways we're very, very good at it. REN-ISAC, that's our research ISAC, is really strong. It's really vibrant. There's plenty of conversations that happen in it. That being said, it's not always the best way for my teams to understand threat intelligence or to understand the nature of how these things are happening. So we've spent a lot of time trying to figure out, like, how do we create better connections? And one of the mechanisms is I've pulled together over the last year CISOs from, basically, we're the CISOs of the West. And there are CISOs from R1s. Actually, this is kind of funny, Matthew, we used to call ourselves the Pac-12 CISOs, and then we kind of became the 2Pac CISOs, and that wasn't working. So for right now, we're the CISOs of the West.

Get those marketing and branding students on this. Come on, you can do better than this.

I know, I know, right? We desperately need help. So now we've gotten to the place where, and this is kind of leadership coming out of David Maurice, who's over at Oregon State, um, he said, hey, let me bring in my SOC teams that have been doing some experimentation and some really neat tooling, and let's talk about what they're seeing and what that pilot's look like and how they've undergone it, how they're engaging students, where the stress points are with the operations. So that's knowledge sharing, like a community of practice. Um, there's a long way to go, I think, for developing that, you know, the The other really solid community of practice is an organization called EduCause. And EduCause has a— well, they've got a number of big conferences. There's a big one in the fall, and we're about to go into a cybersecurity one that's a lot of really wonderful professionals. The cool thing about meeting up with other folks in higher ed is, you know, we've all signed up for the same crazy journey. We all know that that's true. Most of them go to meetups. For, I don't know, Splunk meetups or whatever else in their communities, right? We're all engaging locally with practitioners that are using this in what might look like more sane environments than ours. And so we are constantly reminded about the chaos that we agreed to, which makes these conversations a lot of fun. But I don't know, I don't think anyone in cybersecurity can learn as fast as they need to without having these communities. It's, um, and so we've got our own, our own flavors of them.

That's great. I mean, the way not only the education community, but every, every sector on the planet, right, if we're not communicating and collaborating, we're not going to be able to keep pace with those, those emerging threats. Which kind of leads me to, given your visibility, given, um, you have a, a good intimate understanding of your users and your environment, and you're collaborating across the world, what are those emerging threats that you're worried about? What are those risks that you see or that are coming ahead? They're not here yet, but you know, you have to see that, that truck coming at you, uh, on the freeway. What are your big concerns?

You know, I, oh man, where to start, Matthew Rosenquist?

I mean, everyone's talking about GenAI. I mean, we're talking about quantum computing.

There's distributed computing. There's all those.

Nation-state attacks.

Yeah, let's break them down. We've got a little bit of time. I'm going to start with supply chain attacks. That's a good one. Yeah, and that's a fun one because universities are especially designed to have these trusted partnerships. So almost every ERP system is one with a really trusted partner. All of the data that we have in one way or another is through these trusted partnerships. And so we are really struggling there because my— and I, in terms of looking in the future, I think there's lots of really interesting opportunity for us to get stronger, but stronger with the set of partners that aren't the typical ones that we talk to. Because the teams that we have for cyber are designed to protect the fortress. Like, what they're looking at and the visibility they have is for the campus. And now these threats are actually happening with our trusted partners that are working with student data. Um, last summer with the MOVEit, like, we pretty quickly, like, looked through our environment. Does anybody have MOVEit? No, the university doesn't have MOVEit. Okay, fine. And that takes a while to percolate, right, before you actually find out, okay, who do we trust that had MoveIt? Oh, the National Student Clearinghouse. That's almost 4,000 institutions in the United States, and for whom 97% or something of those actually use it to use transfer data, transfer data for transcripts for FAFSA. So it is the clearinghouse, it is the mothership of all of of the student's transcript data, which is kind of special stuff.

Yeah.

And I found out about the MoveIt with the National Student Clearinghouse because I've got a great relationship with my registrar. And so she gets the email that says, hey, you should change your password. And she's like, Donna, what's up? And I'm like, oh, nope. Yeah, that's OK. I call up the CSO of the National Student Clearinghouse and I'm like, hey, can we have a chat? What's— tell me what's going on. Um, what are you allowed to— let's take this off the record, talk to me, please. Um, that's a good example though, because I immediately then go out to my network and say, hey, we know the steering house was— or the Clearinghouse was hit. Um, how are your campuses handling it? And your mileage may vary. Um, if they had strong protocols for the registrar to report it, then they heard. If the registrar reported it to an email address, then it was sitting someplace in a queue until— and then maybe you have like a tier 1, tier 2 who may not have ever heard of this clearinghouse and may not know to escalate it faster. So that's a place where I think we're going to have more and more complicated navigating challenges between zero days, You didn't ask, but boy would I like a software bill of materials.

Oh, that's a four-letter word. It is. Those are a beast. Hold on, I want to get back to this whole point of supply, right? So it sounds like your environment is especially susceptible to the third-party risk because you are collaborating, you are sharing so much data, you're working in and you're pulling in vendors and you've got all these connections with community and okay, that's great, but now you've got to almost extend your visibility umbrella to include them as well. I really want to call out something here and you blew past it really quick, so I want to put that in. You called a fellow CISO. You just didn't wait for the standard memo, so you've got a level of collaboration. Fostered that, which means you've intentionally gone out to your third parties to build a relationship, not only in probably contractually, right? Hey, you have to notify us. And that's one thing. That's why you got the email or the, the wonderful notification that's sitting in some queue somewhere. But you've also fostered a personal relationship that you felt comfortable enough to call them on and say, hey, let's have a quit quick off-the-record chat so I can gain the necessary insights in a timely manner, right, to help protect my environment, which actually then helps protect it. It reverberates back. It protects your environment and everything downstream from me as well.

Yeah, 100%.

That is something that is just so crucial. I love to hear that when people and, and, you know, thoughtful CISOs are going, no, I understand there's policy There's the official and then there's back channels, right, that we do foster that.

Right. And they're, and they're human relationships. Like they're perfectly legitimate because part of what, part of the thing, especially early on, right, we don't know what we don't know. We have no idea if this oftentimes is an operational hiccup or an actual attack or if there was something to worry about or not. But if you've got leadership that are worried, my peers, like my registrar or my CFO, then one of the quickest things I can do is try to de-escalate a thing we don't need to worry about, especially because these love to happen on weekends. But right, so I think that's, that's part of it, like help me get sense-making, talk to one another and say, how worried are you? What's, what's giving you confidence? What's, what's keeping you up at night? And be really, really willing to have conversations with one another. And that way, if we're like, oh no, we should be worried, okay, let's lean in. What is it that we can help you with? What kinds of stuff can I do on my side to understand what we've been doing with you for the last 6 months that might help me inform what my blast radius would look like? All kind of in anticipation of understanding if there's a need. I don't want to pull that trigger if there's nothing to worry about and they already, they're like, yeah, we're, I want to pull that trigger if we're actually collaborating together to try to understand, you know, what the impact could actually be and how to respond. Yeah, it's, um, it's actually fun though, right? Because in our community, most, uh, most of our colleagues are really motivated towards this really interesting problem solving.

So, well, and you're building credibility, right? You're not screaming the sky is falling every weekend. You're leveraging that communication in those relationships to be able to filter out the noise before it becomes, you know, too burdensome. And then when you do raise the flag, you're going to get more response. You're going to be taken more seriously. You're going to get probably what you need when you need it. And so it becomes a win-win. But it leads me to the, to the conclusion, you must have an amazing security team, your, your SOC, your crisis response team, your policy people. You're communications experts. And again, we know you probably have— you're pulling resources and students and interns and everybody else into it. So it's completely unfair. But let's talk about for a moment your fantastic security team, because everything you've talked about, the willingness to accept risk, the efforts to do that end-user training and work with third parties, that takes time, energy, and effort. And there's only 24 hours in your day. Tell me about these great people as part of your teams here.

Oh, they're so great. You know, one of the things that's really lovely about cyber teams in higher ed is that they are here for the mission. Now, ASU's charter talks about how we hold ourselves accountable for who we include, not who we exclude, and how they succeed. And it's that mission of access that draws the most just the most incredible people. They're kind, they're often hilarious, they are brilliant, they tend to be really eager learners. So I, I should know this and I don't know this, um, just rattling off the top of my head, um, a huge percentage of my team are getting degrees while they're also doing this work, um, because they're in an environment—

totally unfair, but okay.

Yeah, yeah, okay, well, I'm going to temper that a little bit by saying I also am deeply appreciative of all my team members that I have lost to industry over the— like, I am very— and I kind of design for the expectation that somebody's going to stay on our team for a few years and then they'll go in because I don't pay them anywhere near— like, we just— we're a public institution, so it's great that they can go double their salary the moment they leave our environment. And, and I hope that some of them stay for a variety of reasons that works for them. But the reality is that there's a lot of need for talent. So if I can create an environment where they actually get to start their career out, understand really complicated situations, protect things like cameras on Mars, like these really wonderful things that they get to do, and then they go off to industry and maybe at some time later, you know, come back and circle back around, or maybe, you know, send other of their own network to ASU, then it's— that kind of creates this nice virtuous environment. They are amazing though. Let me brag on them a little bit. When I started as CISO, we had an outsourced SOC, a team in Romania, because we wanted 24/7 and, you know, we were building up a lot of these capabilities. So this time last year, we were in the throes of insourcing that SOC, and that was not easy. We didn't have 24/7. We had a lot of runbooks that were kind of built on reliance for what that team was doing. And then bringing that in-house meant rethinking all those things to understand our own environment better, understanding what our tooling did afford us to do and what we needed it to get to. Like, that's just— I just cannot say enough about how much work that team did with some deliberate intention to think through not only how do we do that in a silo, but how do we do that and make other teams stronger, which was a really beautiful thing to see these conversations between network operations and our experience center, which is, you know, there's one phone call that you can make, and regardless of what you need for technology support at ASU, you call that place. So we embedded cyber teams into that group, which then meant, oh hey, let's create new training for the experience center so that if they get a call— this actually did happen last summer— if they get a call from the FBI saying something might be up, they understand how to vet that call. They understand how to determine whether or not it's legitimate. They understand how to escalate it. They understand how to help me have visibility as to why that call didn't go through the normal channels so that we can learn quicker and get different kinds of patterns and different kinds of protocols in place. So that's, you know, like, this— I've got a team that's willing to kind of rethink how we do business when we have this opportunity to kind of shift, um, I don't know, the way we've always done things or something that's kind of not serving us as much as it has served us in the past. My, uh, Nate Corwin's my executive director of cybersecurity, and he's just got such an operational insight into the machinery that is the university, so he can offer some really keen insights as to where's the place where we have been trying in one way or another, and here's a path to success. That kind of problem solving, oh, the team's amazing at that. We've also got a group we call Working Group Cyber Fusion. So I've got a cybersecurity team, and I say I like, it's, it's a whole community. Um, we've also got a working group that includes cybersecurity professionals across the campus. So that's the cyber team that's working and doing the hard work inside of or inside of our research apparatus, or inside of, say, the business school. And they were very distributed, so they all have their own technology teams. That working group is the one where the contact sport of our standards and protocols actually happens, because they can come in and say, hey, there's friction here. We're just not going to do that because it doesn't make sense in our environment. That conversation we had earlier, that working group is where that stuff really gets gets hashed out. And, and they're amazing too, um, all of which, you know, are employed by their colleges or by their units. So they've got completely different sets of both hierarchy and, you know, politics and dynamics and priorities. It's really neat to see how they all come together.

So your unfair advantage is what I'm going to call it, of using—

you like that?

I am. It's, it's It's totally unfair. But it sounds like it's not just a one-way street where you're using them. And there's, you know, there's upskilling and a rich environment for them to learn and to prepare and to be able to then go forth into their career and earn fortunes and glory in the incredible world of cybersecurity. I was reading a story about some amazing women., as part of the upskilling and internship programs. And I think I know the, uh, you know, the group that I'm talking about.

Yeah.

Yeah. Can you kind of elaborate for our audience what this was and how it helped the women? Not just you and your group and, you know, yeah, you know, your tyranny in, in, in, in using all resources. No, no, no tyranny.

Um, can nobody's ever accused me of that one before.

A fun tyrant though. You were a fun, personable tyrant. Can you tell us a little bit about the Upstanding program for these women?

Yeah, yeah, it's— it is so inspiring. Um, okay, so one of the things that a campus has, um, because universities are going to be here forever and have been around since the 12th century, and so we're kind of this unique, weird an institution that gets involved in things like, um, how do we act as a change agent for, um, for in this case a group of refugees from Afghanistan. So this group of women come to Arizona. Um, you know, as a refugee you don't necessarily get to pick where you're going to go. You don't have a whole lot of agency towards what that experience is going to look like. You're stepping into a world that's very different from wherever you came. And one of the things that, that is so lovely about ASU and that mission of access is that we really are welcoming. And so when those women came, my CIO— and we've been working for a while, I keep talking about our Arista network, that's been a really deep partnership for us— it was easy for us to go to Arista and say, we think we've got a really unique opportunity. These women are all interested in engineering and cybersecurity. Security backgrounds. They, they're all telling us that they want to go get master's degrees in those spaces. What if we created a, a program specifically around what's happening where they could come in and actually help us build that network? And so they are, and it's— oh, they are working so hard. Like, one of the young women, I think she told me she's taking 21 credit hours this, this spring while she's actively working to build our network. Talk about a work ethic. But she is so— and she's representative of all of them. They are so excited to be able to not only pursue a graduate degree, which isn't something that was afforded to them in the country from whence they came, but also do it in a way that is building the infrastructure for the university, working in tight mentorship with engineers on our team. Todd Simmons is hilarious. He has nicknames for all of us. He doesn't call me Tyrant. I don't want him to hear that you said that.

No, no, no. Todd, don't call her Tyrant. I'll hear about it.

She'll call me. You will, you will.

And complain.

He dubbed me Sentinel. So hopefully he sticks with that. Okay. But his work with them is really incredible. You can just see the amount of energy, the amount of enthusiasm, the amount of, "Hey, we need a Lambda function that's going to do X, Y, and Z to be able to handle this challenge and then the amount of just pure enthusiasm they have in figuring that out. Bouncing that then off of the senior engineers to kind of figure out, okay, if I wanted to try that in Python to do this, how would that look? What are— oh, it's beautiful. It's just amazing. They also— and we can share some resources so you can go learn about them because hearing their voices talk about this is is, uh, is, is really, really, really wonderful. But they each have a different set of goals and aspirations for the kinds of things that they would like to do with the things that they're learning, and that's beautiful. They have, because of their experience, a very unique appreciation for the challenges of access to education, the challenges for access to learning a new skill. And so by creating this with them, creating this opportunity with them, we also get to learn, okay, so if you wanted to create an international experience, if you wanted to reach people who are otherwise not able to get access to the kinds of experiences that they're having, what would you need to do? Like, what would have worked? And then, like, from that we can experiment and pilot and say, okay, well, we've got— you know, ASU's got fantastic programs that have gone for years with MasterCard in Africa. Like all over the world. By working that closely with someone like these young women, Yeshiva can actually say, hey Donna, I've got an idea, and we've got proving grounds, places we can experiment, and that's our mandate. That's, that's actually what we're here to do.

That is both heartwarming and hugely impressive. I'm gonna put that link in the comments section so people can see that story and hear the voices there. And again, it's impressive that you're building, you're bridging international resources for mutual benefit, right? For the benefit of those people coming over, for the benefit of your network and your ecosystem. And then as they go out into the world, they've got an entirely different perspective and viewpoint that they're contributing to our cybersecurity community.

Right. And likewise, we're learning from them.

Yeah.

That's a, talk about a poignant way to build real empathy, to really understand why something would be as hard when it kind of like on a rational level seems like it should be like you could get a technology to fix that. And there are real reasons why it's challenging. So we learn as much from them as vice versa.

Well, that's awesome.

The other thing.

That helps everyone.

Right. Right, that's— I love that you brought that up because that's, you know, we're only going to get diverse thinking if we bring divergent voices. Like, we've got to bring that in. And so we get the opportunity through programs like this to like change the face of the teams, like quite literally, by bringing in and finding and really orchestrating, very intentionally inviting channels of individuals that, you know, might not be obvious to bring in Afghan refugees. Um, or we've got a program that we do with the business school called AZNext, and its, its goal is to find individuals who are over the age of 17, don't have a degree, are underemployed, but are eager to learn. And so we bring them in, they get a variety of industry certificates, they kind of do a clinical rotation model where they get to experiment with different types of technology. If they show an interest in cybersecurity, some of them have spent up to a year in our environment just in cybersecurity. Ah, thank— frankly, they, they single-handedly helped me with some really nasty vulnerability management challenges when I just needed, you know, resources to help us understand where— who owns that thing? Help me find out who owns that thing. Um, really incredible, incredible work. The neat thing about that is, and I love my team. I got to take my team, we rented the theater to see Dune, the second Dune movie.

Haven't seen it yet, I want to.

Oh man, yeah. So we just rented a theater and decided, hey, let's go.

Of course you did, of course you did.

Because you got to have some fun too. It's intense, it's intense work. We need some downtime and some good science fiction. But I got to sit next to one of the gentlemen who's been with us for about 9 months.. And he explained to me how he had always kind of thought maybe he'd want a degree, but he didn't really see a path by which he could go get one. Well, when you're employed by ASU, you get this incredible tuition benefit, which is fabulous. And so he's now getting his degree, not because that upskilled program includes a degree, but because the design of it and taking advantage of all the things that we can do as to university creates this kind of unique opportunity that he can step into, which is great. Like, we're not forcing people to go get degrees. Um, in that program, you are asked to go get industry certifications. And with the Arista program, they're getting Arista certifications. You know, what's really amazing is when you can say, okay, there's lots of opportunity, there are lots of ways that you can lean into things. Which ones are going to work for you, and how do we help you get there? Of course we love of folks getting degrees. So that's kind of our thing. Um, but we, we don't have to enforce that. We don't have to make that mandatory. Like, those worlds can coexist in, in ways that we learn from too. Um, our faculty will kind of come and sit down and say, hey, what's happening with that? How could that inform the way that we might teach this course differently in the next, next round? It's— yeah, it's great.

So let's finish up here and What message do you have to those prospective students that may be coming to ASU, maybe going somewhere else, right? Somebody that's in grade school, high school, that's potentially thinking cyber sounds interesting. What's your message to them?

It's even more interesting than it sounds. You know, I, I think we're just on the tip of the iceberg of understanding what cyber careers are. And because of things like— I mean, we didn't talk about quantum threats, um, or generative AI threats, right? So if you think about how much of the world is changing and how quickly it's changing, what we really need are inquisitive minds that are very interested in understanding the nature of a problem and then tackling that problem, convening communities that you wouldn't expect together to do that. And so the faces, the kinds of roles in cybersecurity are greatly informed by anyone who's curious. It's not necessarily what, you know, you watched a few episodes and seasons of Mr. Robot and that's what you think cyber looks like. It does look like that sometimes, but it also looks like all sorts of other things. We're on the precipice of new professions in human risk. And new, very, very different ways of thinking about the human side of how people work together. A lot of my work's in digital trust. Those are whole new roles, digital trust roles, that sit somewhere in this really lovely intersection of risk, of understanding psychology and how people work, of organizational dynamics and understanding how to build healthy cultures inside of organizations. Communications. You know, those are disciplines that are happening inside of the liberal arts, inside of management schools. They're not— they're sitting side by side alongside the same set that are doing STEM. So I would say, you know, if it sounds intriguing, that's because it really is. And it's changing so quickly, it's opening up so many different opportunities that if you're even a little bit curious, it is worth kind of saying, okay, what you got for me, cyber? What kinds of things are available? And then like offering yourself into that. And it might surprise you. I think today is the— we're filming on this on the day that WISESS is meeting and talking about the 24% or whatever of women in cyber. The only way that we're going to increase and be more welcoming is by understanding that the kinds of skill sets that we need are vast, um, and that there's room for everybody in solving these problems.

That's amazing advice. Thank you so much, Donna, AKA Sentinel, for all that you do to protect ASU, its, its family, its community, um, and as a leader in just the university community itself. So thank you very much.

Well, and thank you for providing an opportunity to, to share the work these amazing teams are doing. They, they really are just incredible. And so I, I appreciate the chance to, to get to share some of their work.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.