What is the best current trend in cybersecurity? LAURA WHITT-WINYARD shares her perspectives with IDG Connect.
IDG CONNECT: What was your first job?
LAURA WHITT-WINYARD: Movie theatre cleaner – midnight movies were always the worst.
IC: How did you get involved in cybersecurity?
LWW: By accident. I had only been in IT for a couple years when I was asked to join a company whose security architects had sabotaged the network and quit. I had to learn on the fly and be quick on my feet.
IC: What was your education? Do you hold any certifications? What are they?
LWW: Molecular and Cellular Biology, I wanted to be a Pediatric Oncologist. I hold CISM, CISA, CRISC and my CISSP recently expired by accident.
IC: Explain your career path. Did you take any detours? If so, discuss.
LWW: Early on I took many detours before I knew what I wanted to be when I grew up. Once I started working in technology, it became like an obsession. I could not get enough. I still can’t. I love that it is always changing and that I always have to learn. I never get bored. My passion truly lies in security. I like puzzles and cybersecurity is the biggest puzzle I have ever seen.
IC: Was there anyone who has inspired or mentored you in your career?
LWW: There have been many. I would not say one person over the other. I have learned from every person with which I have worked and taken those learnings and added them to my repertoire. More than anything, I have learned by watching what NOT to do. There is no one right way to lead or to be a cybersecurity professional but there are definitely wrong ways to do it.
IC: What do you feel is the most important aspect of your job?
LWW: Trust. Cybersecurity is difficult enough and time is of the essence. Too much time is wasted if the Security Team, me, the executives and the board do not trust that we are all doing the right things to secure the company and advance our cybersecurity posture.
IC: What metrics or KPIs do you use to measure security effectiveness?
LWW: Three-month trend reports. We must know are we getting better or worse.
IC: Is the security skills shortage affecting your organisation? What roles or skills are you finding the most difficult to fill? It affects every organisation.
LWW: The key to managing the skills shortage is to be creative in where you source and to be able to act quickly once you find your candidate. I am not a big fan of long-drawn-out interview processes. I prefer all interviews conducted on the same day so that a decision can be made the very next day. I often partner with recruiting teams by searching social media platforms, security forums myself as well as reaching out to my peer network to help locate qualified candidates. My own teams have been the greatest source of candidates. If they think someone is skilled and good cultural fit for the team, I trust them. Finally, take a chance on someone who has less professional experience. I once hired someone that had zero professional experience, no certifications, no degree in technology, but had competed in and won several capture the flag competitions and it turned out quite well.
IC: Cybersecurity is constantly changing – how do you keep learning?
LWW: I google everything. The word “google” was in my marriage vows 14 years ago. I also use a news aggregator service and filter by security. The security community is always sharing information and I happen to work for an awesome company of cybersecurity professionals. Our Malwarebytes Lab, Security Researchers, Security Team, Threat Intel, etc., are top notch and I learn from them every day. I attend conferences (Defcon is the best because it gives you an in-depth look at what threat actors are up to currently), take webinars, listen to podcasts, read twitter, reddit & discord.
IC: What conferences are on your must-attend list?
LWW: Defcon and B-sides.
IC: What is the best current trend in cybersecurity?
LWW: The worst? The Best: That the cybersecurity community, public and private sectors are coming to the realisation that we all must work together on cybersecurity. It is a puzzle that will never be solved and no one will ever “get ahead” of the threat actors, but collectively we can significantly reduce the gap.
The Worst: The fact that cybersecurity vendors are using Artificial Intelligence, Machine Learning & Deep Learning interchangeably and the cybersecurity professionals buying these tools do not know the difference.
IC: What’s the best career advice you ever received? Do unto others as they would have done unto themselves.
LWW: The way I want to be treated is probably not the same way you want to be treated. Everyone is different, get to know people and determine what they need.
IC: What advice would you give to aspiring security leaders?
LWW: Do not listen to those that will tell you if you want to be a security leader, you must “flip the bit” and stop being technical. You can do both. Personally, I have found being a technical security leader allows my teams to focus on securing the company using time that would otherwise be spent explaining certain technical aspects to a non-technical security leader.
IC: What has been your greatest career achievement?
LWW: Becoming a CISO was the pinnacle of my career. I am excited to strive for my next goal which will most likely be along the lines of cybersecurity charitable works.
IC: Looking back with 20:20 hindsight, what would you have done differently?
LWW: I would not have let fear hold me back. In the earlier days, I was always so worried about not knowing something and feeling judged. It was freeing to finally realise that there is not a single person in cybersecurity that knows everything. We are all learning every day.
IC: What is your favourite quote?
LWW: “Efficiency is intelligent laziness.”
IC: What are you reading now?
LWW: I am reading two books right now. The Coaching Habit by Michael Bungay Stanier, and DevOps and AWS by Yughi Chan
In my spare time, I like to… Garden. It keeps me sane. Cybersecurity is a very stressful career. Gardening lets me get outside, listen to the wildlife, get my hands in the dirt, focus on my flowers and destress.
Most people don’t know that I… Am 7th of 9 children.
Ask me to do anything but… Eat Mayonnaise.
- Whitt-Winyard is the Chief Information Security Officer at Malwarebytes.
