A Day in the Life
WHAT WE ASKED…
What do you enjoy about Information Security?
How do you balance the workload between your security job and personal life?
As a security practitioner, how do you protect your personal data?
Q: What do you enjoy about Information Security?
A: “What I like, basically what my mother taught me to do through her volunteer work, is helping people. In the end, it really is about your mother, your brother, or your father, or your son, when we talk about information security it gets a little abstract at times – but last year I had the occasion to help a woman who was a famous actress whose identity was compromised, and I spent several days talking with her about her experience. How she was worried about her mortgage or the fact that her actual name and address were out in public, and I began to realize how very impactful, when somebody’s personal information is compromised, how very impactful that is on their actual life. She was worried about whether her car would be stolen, whether she would be raped, whether her mortgage was going to be compromised, or her credit line destroyed by simply SIM swapping out her personality. Well, that really did impact me and very deeply and it was a wonderful thing to live to realize that the work that I do is not abstract it really does have an impact on individuals, and that is what I love about information security.”
Neil Schwartzman – Neil is the executive director of Coalition Against Unsolicited Commercial Email. https://ca.linkedin.com/in/spamfighter @spamfighter666
A: “What do I enjoy, is that information security is a never-ending puzzle. You have small bits of information available to you, but you can never see the full picture. You have to build it yourself and it takes a lot of time and effort but at the end when you see it, when it forms in front of your eyes, it’s like you discover something new. That’s something I always liked, so that’s one thing. The other thing is that it’s the never-ending pursuit of knowledge, you never know everything, you always need people to help you, new information techniques, and it always keeps you on your toes and that’s fun.”
Dror Avrahami – Dror was born in Israel and moved to Tel Aviv, which is one of the world’s largest cities, Dror has been working for ThreatSTOP for three years now. https://www.linkedin.com/in/droravr/ @oldmanonaporch
A: “One of the things that I really enjoy from this business of information security is the impossible thing of being bored or being just stuck with some things because every single day there are new things, new technologies, new threats, new problems you need to face off…. so being in movement and trying to get better every single day and training to be out of your comfort zone are the things I really like about this business.”
Cesar Lorenzana – César is from Spain; he works for the Guardia Civil in the Cyber Crime Central Unit. He has been there for the last 15 years fighting against cyber-crime.
A: “What I like about the information security area is that everybody working on security is very passionate about what is happening, and we can help to have a safer world for our companies, our communities, our societies, and of course the world. I think that tech is day by day more important for all businesses and cyber security should be embedded in it. So, from my perspective, working with cyber intelligence and incident response, I believe that we have the responsibility to help victims get results and to get safer and not being a victim again. That’s very interesting.”
Sandro Suffert – Sandro is the CIO of Apura Cyber Intelligence. Sandro has been a digital forensics and incident response practitioner for 25 years. linkedin.com/in/sandrosuffert @suffert
Q: How do you balance the workload between your security job and personal life?
A: “I love my job. I think I have the coolest job in the world, but I also love having a social life and I also love having hobbies. So, for me, when I’m in the office I’m focusing on my job. I love my job and I’m reading and I’m talking to people about it and when I leave that’s where I leave it. I might talk to people about my work in the evening but I’m focusing on myself as well. I think for me making sure to kind of have a split between my work life and my private life. And, yes, I have friends that are coworkers and yes, I’m always going to talk about my work and my research but having that separation has really helped me maintain my work-life balance.”
Liv Rowley – Liv is a Threat Intelligence Analyst at Blueliv which is a Barcelona Threat Intelligence-based company. A lot of her research is based around the dark web and how cybercriminals are using that to interact with one another and what they’re talking about. https://www.linkedin.com/in/livrowley/ @OLRowley
A: “Working with security, you never really shut off. It’s like a 24/7 position most of the days. How I manage is that I try to rest when I can, and I also try to delegate my responsibilities. When I’m out of the office, I do not necessarily pick up the phone all of the time. I have people that I trust. People that I’ve trained that will act in my stead. I think it’s important that you empower your peers, and you trust them, and you need to have good processes in place. It definitely is a challenging line of work especially if you are the one with the responsibility but being pragmatic, flexible, and making sure that you have a good team that can share the burden is how I do it.”
Bjoern Watne – Bjoern is Norwegian, UE2019 was his second Underground Economy conference. He is a computer engineer by profession and has been working in information security for almost 20 years. Bjoern is employed as a CISO at a financial services company. http://linkedin.com/in/bjornwatne
A: “From my perspective, I typically try to keep work between hours that I work so that’s between 8 and 5 pm. And social life outside of that, if there are events that happen outside of that, I am ok with picking up those responsibilities so long as it’s constantly shared between the team. If it’s not being actively shared and everyone is responding in a similar fashion, you become jaded and feel like you have no actual social life. So, for the main part…working when I am told to work and not working when I am not actively working.”
Josh Carney – Josh is a software developer from Alabama. Josh currently works for Shadow Dragon and has been doing infosec and software development for the past five years.
A: “You never know when the next intrusion will happen, or in which time zone, usually the affected service team is under a lot of stress and pressure. And, we have a lot to process in a very short time. So of course, for me, physical activities keep to level stress relief and crisis management. I am fortunate enough to go running and cycling in the mountains during lunch breaks and I am a lot more social after that.”
Romain Wartel – Romain has worked at CERN, the European Organization for Nuclear Research, is one of the world’s largest and most respected centers for scientific research for the last 14 years. https://www.linkedin.com/in/romain-wartel-659b0a3/
Q: As a security practitioner, how you protect your personal data?
A: “Well, I wish I had some clever innovative advice to offer on that, but I’m afraid a lot of it’s the same old stuff. I mean for me one of the most important things is I don’t reuse important passwords; I will admit I have a whole bunch of random sites that I don’t care about that I use the same password for. But for things I care about like my bank, my email accounts where things get sent for recovery, for my accounts for logging in for the national health insurance, those all have strong separate passwords. Also, I do a lot of two-factor whenever it is available, it’s a pain but I do it particularly the time-based security–the one where there’s an app on your phone or an app on your PC that generates the six-digit code. That’s actually quite secure and actually turns out you get used to it. I realized some tricks like when they give you the code you need to put it on at least two devices so if you lose one of the devices, you don’t lose access to your account so if I get nervous, I put it on two or three. Once I do that, and then for the ones who insist on sending codes through SMS, I talked to Allison Nixon who’s thought about this a lot and she says that if you have a Google voice number to get your SMS, that is much more resistant to SIM swapping than a regular phone would be. So that’s basically it, and then also there’s a lot of stuff that I just don’t put online. I have a Facebook account that I never log into and I never talk about anything of any importance on it. And I try to be sensible. I don’t send stuff around to the people who don’t need to know it and I try to keep my personal data reasonably personal.”
John Levine portrait, IETF 96 at Intercontinental Hotel, Berlin, Germany.
John Levine – John is the president of CAUCE North America, which is a grassroots anti-spam organization, He is also a member of the ICANN stability and security advisory committee. John is a senior technical advisor for MAAWG and is on the board of the Internet Society, and manages to manage to get a little bit of work done between all those things… https://www.linkedin.com/in/johnlevine @spamvikktim