I’ve got great news for you! My interview series continues. Last week, I spoke with Nicola Whiting, cyber hygiene specialist and Titania Chief Strategy Officer. This time, I had the privilege of speaking with defensive security expert Liz Bell. We talked about the 90s internet, blue teaming, sexism and transphobia in tech as well as what pen testing can teach you about defensive security. Kim Crawley: Please tell me a bit about yourself and what you do. Liz Bell: I work for a cybersecurity defense company that provides network monitoring and response tools for customers in the finance, government and energy sectors. I work on the internal monitoring team, which means I help keep our own networks safe. Before that, I worked in penetration testing punctuated with some time in academia doing research on applying machine learning techniques to attacking ciphers, and before that, I was a software engineer. I've been interested in security since I was little, though. Being lucky enough to have grown up with the web, I just caught the tail end of the BBS era, and so I got to see security start to become something people actually took seriously. Being curious, my general instinct was to find ways to circumvent limitations. Now I get to spot people trying to do those same things. KC: It sounds like you've been online since the 90s. I've been online since 1994. Is there anything about the 90s internet that you miss these days? LB: There are a few things that I'm kind of nostalgic about like MSN chat rooms, hearing my phone sing the internet song to the gateway, downloading Win32 viruses from Napster and Limewire, earning badges and posting angsty poetry on Bolt.com, but I think the main thing I miss is the openness and generosity of the web back then. These days, it feels like, if you're fortunate, you have a series of walled gardens, and if you're not, you're facing a never-ending stream of racist/homophobic/transphobic content and intrusive adtech. KC: You mentioned P2P malware, which is still a problem these days. How do you think online cybersecurity challenges are different now compared to back then? LB: I think a major difference between then and now, if not the main difference, is money. Once we started being able to shop and bank online, users became a good target for scammers, extortionists and other organized crime groups. Not to mention the environment is now extremely different; a lot of people now have a lot of their lives stored in phones, tablets and laptops, and some of those also end up connecting to corporate or industrial networks. For organizations, this means that just defining what your network perimeter is can sometimes be impossible. As far as national security is concerned, the public at large has become much more aware of the scale of state-level activities on communication networks, much more than when the ECHELON disclosures happened, as far as I can tell. I think that has also led to something of a change in what people's threat model looks like. KC: Echelon! I knew someone who worked at Lawrence Livermore back in the day, apparently on that particular project. LB: That's awesome! I work with a lot of former IC and .mil people who I understand have probably been involved in a lot of things that would make for extremely interesting conversations, but alas, I'm not cleared. KC: How has your penetration testing experience helped you with your blue teamwork? LB: It's a big help. Understanding the different kinds of techniques and tools used by adversaries to compromise accounts, intercept traffic or steal data means I have more of an ability to spot patterns or suspicious outliers in our sensor data. Likewise, seeing how blue teams operate makes me better at doing the offensive work or, at least, doing it in a way that's less likely to get me caught! I'm increasingly a proponent of getting red team and blue team members to trade sides occasionally or work together to have a better understanding of how the other side operates. KC: Has sexism ever been a challenge in your career? LB: Honestly, I don't know. When I first started, I hadn't transitioned yet, and so I was perceived as a (effeminate, not assertive) man, and so presumably I benefited from that when it came to getting my career started. At a previous employer, after transitioning, I was the only female penetration tester in the office, the only woman I knew of working in a technical role, and the only out queer person, and I started getting more complaints about my performance. I ultimately ended up leaving, and it definitely became harder to find work afterwards, but then again, what I was looking for was pretty specific. I'm lucky enough to have been hired by a woman, and be managed by a woman, in my current role, even though the team is still largely white cisgender straight men. KC: Well, you're not the first transgender woman I've interviewed in this series. I'm happy to see more transgender people in cybersecurity. LB: I actually applied to the place I'm working at now because a good friend of mine, who's also trans, worked there. It was an incredible privilege to go from this extremely homogenous environment to getting to work professionally in information security with another queer trans woman. KC: Is there anything you miss about your pen testing days? LB: I do miss the "let's be evil" feeling, sometimes and the interaction with external clients from all kinds of different industries. My job now has maybe a little less variety, but I get to stick with projects longer, and being an investigator definitely makes up for not getting to pretend to be a criminal anymore! KC: I have spoken to Defensive Security Handbook authors Ian Brotherston and Amanda Berlin, who believe that defensive security is underrated in our field. Do you agree? LB: I think that offensive security gets a lot of the glamor, but penetration testing is really only a small piece of what keeps users safe. Blue team folks definitely don't get nearly enough credit or support; offensive security people need to only find one problem, but defensive security practitioners can't make a single mistake. KC: Do you think a lot of organizations overlook defensive security? LB: In my experience, a lot of organizations tend to maybe focus on the wrong things: or rather, they optimize for meeting regulatory requirements. Rules say they need a firewall and quarterly penetration tests, so they buy a firewall and contract the tests out. Security should be baked in everywhere; into the software development lifecycle, the monitoring and maintenance of the corporate network, training of new employees and continuous training of your existing staff and even how the organization interacts with suppliers. The line between 'defensive information security' and 'physical security' gets fuzzy, and I don't know if many organizations prioritize either at sufficiently many levels of the stack. KC: I've learned a lot from you. Do you have anything else you'd like to add before we go, Liz? LB: I think it might be worth mentioning that machine learning is increasingly something people are exploring in both the defensive and offensive information security space, and in order to both defend against robot hackers and defeat Skynet, or build either, it helps to have that blended blue and red team exposure. Otherwise, thank you so much for your work here boosting not-male voices! Previous Interview
