Episode 33

Skilling Up for Security Operations Center Roles

The Security Operations Center (SOC) is at the heart of an organization's cyber defense system. Highly skilled and motivated personnel must work in these centers. James Risler, Senior Manager, Cisco Learning and Certifications, discussed the roles of the security engineer and the security analyst and the hard and soft skills needed to be effective in those functions. While the ability to code, learn computer forensics techniques, and know how to operationalize MITRE attacks are top skills, the ability to communicate effectively is equally important. Jim strongly recommends that academic institutions partner up with industry to provide hands-on training opportunities and also engage in security solutions-focused research.

To access and download the entire podcast summary with discussion highlights --

https://www.dchatte.com/episode-33-skilling-up-for-security-operations-center-roles/


Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

Transcript
Introducer:

Welcome to the Cybersecurity Readiness Podcast

Introducer:

Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

Introducer:

the book Cybersecurity Readiness: A Holistic and

Introducer:

High-Performance Approach, a SAGE publication. He has been

Introducer:

studying cybersecurity for over a decade, authored and edited

Introducer:

scholarly papers, delivered talks, conducted webinars and

Introducer:

workshops, consulted with companies and served on a

Introducer:

cybersecurity SWAT team with Chief Information Security

Introducer:

Officers (CISOs). Dr. Chatterjee is Associate Professor of

Introducer:

Management Information Systems at the Terry College of

Introducer:

Business, the University of Georgia. As a Duke University

Introducer:

Visiting Scholar Dr. Chatterjee has taught in the Master of

Introducer:

Engineering in Cybersecurity program at the Pratt School of

Introducer:

Engineering.

Dr. Dave Chatterjee:

Hello, everyone, I'm delighted to

Dr. Dave Chatterjee:

welcome you to this episode of The Cybersecurity Readiness

Dr. Dave Chatterjee:

Podcast Series. Our discussion today will revolve around the

Dr. Dave Chatterjee:

security operation center (SOC), its role, challenges, success

Dr. Dave Chatterjee:

factors with a special focus on how to effectively skill up for

Dr. Dave Chatterjee:

the different roles. I'm delighted and honored to have

Dr. Dave Chatterjee:

James Ressler, Senior Manager, Cisco Learning and

Dr. Dave Chatterjee:

Certifications with me as the guest. Welcome, Jim.

James Risler:

Thank you very much. Appreciated it.

Dr. Dave Chatterjee:

So Jim, as we recognize the Security

Dr. Dave Chatterjee:

Operations Center (SOC) is at the heart of an organization's

Dr. Dave Chatterjee:

cyber defense system. At a high level, the primary role of the

Dr. Dave Chatterjee:

SOC is to protect the organization against cyber

Dr. Dave Chatterjee:

attacks. So it's imperative that highly skilled and motivated

Dr. Dave Chatterjee:

personnel are working in these centers. Before we get into the

Dr. Dave Chatterjee:

details of SOC operations and relevant skill sets, let's talk

Dr. Dave Chatterjee:

a little bit about you. Please share with listeners some

Dr. Dave Chatterjee:

highlights of your professional journey.

James Risler:

All right, so, thank you very much again, Dave.

James Risler:

Really appreciate it. It's great to be here. I started my

James Risler:

security journey back in the late 90s, early 2000s, when I

James Risler:

was a route switch and network server guy. And I was doing a

James Risler:

lot of instruction on networking, specifically with

James Risler:

Cisco solutions. I was asked to come up to speed on teaching the

James Risler:

old PIX (Private Internet eXchange) firewall. So I started

James Risler:

that. And then that started my journey down the road where I

James Risler:

got involved with different things like Voice-over-IP,

James Risler:

Contact Center security, and then just kept evolving from

James Risler:

there before in 2010, I joined Cisco and started leading the

James Risler:

efforts in the training development wrapped around

James Risler:

security. I spearheaded the cyber ops certification, been

James Risler:

focused a lot on NIST 800-181 and DOD 8570, which is now

James Risler:

transitioning to 8140. So those are the types of things I've

James Risler:

been working on, I'd look at cyber and I break it down into

James Risler:

there's network engineers, which is kind of how I was I came

James Risler:

along focused like on VPN technology, firewalls and

James Risler:

securities in VLan, etc. And then there's people that work in

James Risler:

a SOC, which I call them the gatekeepers, the castle has been

James Risler:

built, and now they gotta go find and protect the castle

James Risler:

against threats, both internal and external.

Dr. Dave Chatterjee:

Excellent. Makes a lot of sense. So Jim,

Dr. Dave Chatterjee:

for the benefit of our listeners, many of whom may not

Dr. Dave Chatterjee:

have a good insight on SOC. Let's give them a little bit of

Dr. Dave Chatterjee:

an overview of SOC. Why don't you start and if I want to plug

Dr. Dave Chatterjee:

anything in, I will

James Risler:

All right. Well, I think the SOCs came out of the

James Risler:

necessity of what a NOC (network operations center), and they

James Risler:

started pushing NOCs to do more and more specific security

James Risler:

skills that the NOC some NOC people were like, okay, I can

James Risler:

transition over to this, I can start developing and writing

James Risler:

tools to find these threats. I can take on snort, signatures

James Risler:

and start developing snort signatures and looking through

James Risler:

databases. So I think that they kind of eventually separated off

James Risler:

because of the necessity and the breadth and depth of attacks we

James Risler:

face today. So I look at a SOC today primarily there's really

James Risler:

two types of SOC, those that are threat-oriented that are looking

James Risler:

for threats and those that are oriented to policies and

James Risler:

procedures and risk management. So, you know, some companies

James Risler:

just want a SOC, so they can check the box off. Oh, we have a

James Risler:

SOC they follow make sure that we're follow our HIPAA

James Risler:

compliance and all of our compliances and boom check. And

James Risler:

then there's some SOC out there that literally go on the

James Risler:

offensive that are following other you know, leading threat

James Risler:

hunters out there finding the latest threats and then taking

James Risler:

those threats and going back and seeing if they've been

James Risler:

successful in their organization or not.

Dr. Dave Chatterjee:

Absolutely. And thank you for saying that.

Dr. Dave Chatterjee:

I'm so big, even in my in my book, as well as in the talks

Dr. Dave Chatterjee:

that I give that we have to go beyond checking the box, we have

Dr. Dave Chatterjee:

to be very substantive in our approach to security, we have to

Dr. Dave Chatterjee:

be proactive, whatever we do, we have to do it well. So you know,

Dr. Dave Chatterjee:

coming back to SOC operations, as you said, security operations

Dr. Dave Chatterjee:

center function to monitor, prevent, detect, investigate and

Dr. Dave Chatterjee:

respond to cyber threats around the clock. There are lots of

Dr. Dave Chatterjee:

challenges in the SOC role; I had a guest speaker, a couple of

Dr. Dave Chatterjee:

episodes back, who talked about a high level of burnout, because

Dr. Dave Chatterjee:

a lot of the work is highly manual and tedious. So there are

Dr. Dave Chatterjee:

new platforms that are emerging to automate some of the tedious

Dr. Dave Chatterjee:

work, so the SOC analysts can stay excited and can find fun in

Dr. Dave Chatterjee:

their jobs, I can see why he would talk about the excitement,

Dr. Dave Chatterjee:

because I think it's exciting to analyze and see what kinds of

Dr. Dave Chatterjee:

threats are coming or what kind of threats could happen. So

Dr. Dave Chatterjee:

there are various aspects to the role that could be an attraction

Dr. Dave Chatterjee:

to future security professionals. And, Jim, when we

Dr. Dave Chatterjee:

were having our planning meeting, we kind of agreed that

Dr. Dave Chatterjee:

we want to focus this discussion on the skill sets that need to

Dr. Dave Chatterjee:

be in place for effective SOC operations. So why don't you

Dr. Dave Chatterjee:

talk a little bit about that?

James Risler:

Well, I mean, let's just talk about the first

James Risler:

frontline of a SOC out there. Yeah, these are what we call

James Risler:

eyes on glass. They're sitting in imagine a room with a bunch

James Risler:

of screens, they have screens on their desktop, they're looking

James Risler:

at the organizational screens, they're looking at third party

James Risler:

screens that are providing them intelligence, and they're

James Risler:

literally generating tickets all the time. So inbound event comes

James Risler:

in, trigger something off the they basically have to go triage

James Risler:

that they have the clock starts right there, they are frontline.

James Risler:

So the clock starts, they have to capture the 5- Tupple

James Risler:

information, what's the source, what's the destination, IP,

James Risler:

what's the protocol, etc, they have to basically start logging

James Risler:

this, have they seen this before, they have to go back and

James Risler:

look through their database, instead, they seen it before. If

James Risler:

they haven't, then they open up a ticket, and they probably get

James Risler:

it to the next tier up. So as you start your journey into the

James Risler:

SOC, you're gonna do time on the front line where burnout does

James Risler:

happen. You're in there looking at events all day, it's kind of

James Risler:

tedious, but you're thinking about the future of learning and

James Risler:

mastering skills, that you can jump from device device, whether

James Risler:

it be IoT device, to a switch, depending upon the vendor, be

James Risler:

able to capture data, look at the data and understand how that

James Risler:

vendor, brings that data together, and then turn it in

James Risler:

and normalize it into your system. So your skills have to

James Risler:

continue to grow and grow and grow. You're not necessarily a

James Risler:

guru in networking, but you're what I call a Jack of all

James Risler:

trades, master of none. You have a little bit, you're an inch

James Risler:

deep and a mile wide, because you can jump on to different

James Risler:

devices and be able to handle this. And as you get you build

James Risler:

up those skills, you get to the next level, you're now doing

James Risler:

research, you're now basically taking that threat that's been

James Risler:

opened up and then saying, Okay, well, not only are we seeing

James Risler:

this, but who else has seen this? What does it look like?

James Risler:

What is its end goal? And what are the defenses against it? Is

James Risler:

this just a distraction? Is there a secondary thing? Has

James Risler:

somebody actually executed this attack inside of our network? If

James Risler:

so, do we have to notify management? So as you said,

James Risler:

those different levels there they the response, you know,

James Risler:

always think of it before, during and after the attack. So

James Risler:

is the attack going on now? Or is that already occurred? What's

James Risler:

the triage that needs to occur? Who needs to be involved? And

James Risler:

what do you need to communicate out to the organization? And

James Risler:

sometimes you might have to bring in outside resources to

James Risler:

help you.

Dr. Dave Chatterjee:

Absolutely! talking about notifying

Dr. Dave Chatterjee:

management. I have a question for you. So you know, when we

Dr. Dave Chatterjee:

read about major breaches, and why they happened, often the

Dr. Dave Chatterjee:

reason put forward is that the company that was breached their

Dr. Dave Chatterjee:

personnel received the threat intelligence, but did not react

Dr. Dave Chatterjee:

to it promptly, did not send it on to the appropriate people. In

Dr. Dave Chatterjee:

other words, I'd like your thoughts on how should threat

Dr. Dave Chatterjee:

intelligence be managed, be governed, from logging it to

Dr. Dave Chatterjee:

acting on it? What are some best practices out there?

James Risler:

I think every organization has its own

James Risler:

perspective on best practices. I've actually worked and sat on

James Risler:

our frontline of our SOC and I've seen inbound incidents come

James Risler:

in, and organizations basically said, "that's not critical to

James Risler:

us." And that was back related to the SQL attack. And yet, as

James Risler:

the organization that I was working with was basically

James Risler:

trying to notify them, this is important to you, you do have

James Risler:

these devices. But the management team didn't really

James Risler:

consider a high priority. If you look back at one of the most

James Risler:

successful attacks that impacted a lot of people with their

James Risler:

credit cards, that retail organization was getting alert

James Risler:

about the intrusion on their network, but somebody went and

James Risler:

investigated and said it was a false positive. So I think that

James Risler:

my point is, you have to get down and find out really what to

James Risler:

your organization is a false positive and what's not a false

James Risler:

positive, but what's a true positive indicator, and the

James Risler:

dividing line about in your tracking database, in your

James Risler:

logging system, in your communication process, about

James Risler:

what's critical to communicate. I think I'd rather err I'd

James Risler:

rather over communicate and be wrong than under communicate,

James Risler:

and that for it to be successful. And I think in that

James Risler:

large retail organization, they decide not to communicate, and

James Risler:

it was a true attack going on. And nobody was aware of it. And

James Risler:

they didn't have the defenses for it. So I guess on false

James Risler:

positive, I would say that in that attack, you would say,

James Risler:

Okay, here's the potential outcome. If this was a real true

James Risler:

event, here's what it could look like. And to the organization,

James Risler:

here's the risk to the organization. So having that

James Risler:

risk indicator, and risk flag, even when it's a false positive,

James Risler:

allows the leadership and the executives to make a decision.

James Risler:

Yes, we don't want to research this or yes, we want to know

James Risler:

more, we want to put somebody on this. And it's just the time and

James Risler:

the events that are going on right now. It's we're all under

James Risler:

such a lot of pressure to to do these investigations, and

James Risler:

limited resources, there are truly not enough people working

James Risler:

in these Socs, they are overworked. And that's why

James Risler:

you're seeing burnout.

Dr. Dave Chatterjee:

Yes, that's exactly what I'm hearing. Going

Dr. Dave Chatterjee:

back to that episode I was talking about where I had Thomas

Dr. Dave Chatterjee:

Kinsella of Tines who worked in the SOCs operations for 12

Dr. Dave Chatterjee:

years, then he developed a platform that is helping

Dr. Dave Chatterjee:

automate some of those jobs that the SOCs folks do. So I'll share

Dr. Dave Chatterjee:

with the listeners, some stats that came out of a study that

Dr. Dave Chatterjee:

company did, it's called the Voice of the SOC Analyst, the

Dr. Dave Chatterjee:

top five time consuming tasks came out to be reporting,

Dr. Dave Chatterjee:

monitoring, intrusion detection, detecting, and finally,

Dr. Dave Chatterjee:

operations. But going back to what you were talking about,

Dr. Dave Chatterjee:

Jim, about the different roles and, you know, to kind of

Dr. Dave Chatterjee:

generalize, you know, you have to do the analysis very

Dr. Dave Chatterjee:

carefully. The threat analysis, you have to communicate, you

Dr. Dave Chatterjee:

have to communicate effectively. And effective communication is

Dr. Dave Chatterjee:

really about clearly laying out why you'd consider this to be a

Dr. Dave Chatterjee:

threat for that particular organization, because you're

Dr. Dave Chatterjee:

trying to in a in a, in a way, convince the leadership, so they

Dr. Dave Chatterjee:

would analyze further, take necessary action. So at one

Dr. Dave Chatterjee:

level, you need to have very good communication skills at the

Dr. Dave Chatterjee:

other. At the other end, you need to have very strong

Dr. Dave Chatterjee:

technical skills. Often, as an educator, I have found these two

Dr. Dave Chatterjee:

skills don't go well together. People who are strong

Dr. Dave Chatterjee:

technically, often are not the greatest communicator, and vice

Dr. Dave Chatterjee:

versa. What are your thoughts?

James Risler:

Oh, 100%. So one thing I didn't think about, it

James Risler:

just kind of came to my head. So I apologize, but upfront to the

James Risler:

listeners out there, but playbooks, playbooks inside of

James Risler:

SOCs are critical, because that tells you the quality assurance

James Risler:

of your process. How do you go through analyzing that attack?

James Risler:

How do you go through this deciding whether that attack is

James Risler:

something that you need to communicate up, and analysts

James Risler:

have to develop those playbooks and then refined and it's a it's

James Risler:

a kind of reiterative process, you kind of kind of got to keep

James Risler:

tweaking it and learning and reading about attacks. So there

James Risler:

you write to you what you're just saying, not only your

James Risler:

technical skill, but you also got to think about how to

James Risler:

communicate that out to the business, how to take that

James Risler:

streamline of technical jargon, and turn it into risk, business

James Risler:

processes, and long term impact to the organization. and think

James Risler:

about that. And that all starts in my mind with the playbook.

James Risler:

And then out through the communication process of the

James Risler:

organization. So yeah, that's the challenge, too, is finding

James Risler:

people that have those specific skill sets that can that can

James Risler:

wear many hats. That's why I said inch deep, mile wide. And

James Risler:

we don't know today, what that SOC analyst or investigators

James Risler:

going to look like tomorrow, because it's the game is

James Risler:

changing so fast on us. So today, you're playing Monopoly

James Risler:

tomorrow, you could be playing another game risk or something

James Risler:

else.

Dr. Dave Chatterjee:

Yep, the game is changing, the

Dr. Dave Chatterjee:

technologies are evolving. So the ability to, you know,

Dr. Dave Chatterjee:

quickly ramp up your skill sets, the ability to adapt to new

Dr. Dave Chatterjee:

technological platforms, plus having a very good sense of the

Dr. Dave Chatterjee:

business sense of the organization. So it is all

Dr. Dave Chatterjee:

leading to something that I once again, I emphasize a lot is a

Dr. Dave Chatterjee:

holistic approach to cyber, cyber education, there is the

Dr. Dave Chatterjee:

technical side, there is a managerial there's the

Dr. Dave Chatterjee:

governance side, there is the people side. And we have to find

Dr. Dave Chatterjee:

a way of instilling these different knowledge areas within

Dr. Dave Chatterjee:

students. So let's talk about students. And in that context,

Dr. Dave Chatterjee:

again, going back to our planning meeting, you you made a

Dr. Dave Chatterjee:

distinction between the analysts, and the engineers, the

Dr. Dave Chatterjee:

security engineers, versus the security analysts, how should

Dr. Dave Chatterjee:

somebody decide whether they would like to follow the track

Dr. Dave Chatterjee:

of an engineer or the track of an analyst? Maybe that's, that's

Dr. Dave Chatterjee:

the starting question. And you can take it from there.

James Risler:

Oh, great question. I think interest and

James Risler:

where your passion lies. Because if you're doing something that

James Risler:

you're passionate about it, you're not really showing up to

James Risler:

work, you're getting paid for something you love to do.

James Risler:

Engineers like to think about the design problems, the

James Risler:

providing the services and solutions out to the customers,

James Risler:

aka the people that work in that corporation organization on the

James Risler:

network and the ability to provide them with with what they

James Risler:

need at that moment. And then as technology deploying new

James Risler:

technologies, and migrating them to or which I've done hundreds

James Risler:

of times. Now, if you transition to somebody who is in a SOC,

James Risler:

they're taking something that's completely already built, and

James Risler:

then thinking about it as Okay, did the engineer do all the

James Risler:

pieces necessary when they set up the site to say VPN? What

James Risler:

encryption scheme did they use? Is that encryption scheme

James Risler:

vulnerable? How do they have it deployed? Do they have secondary

James Risler:

authentication on there? What's the pre shared key length, etc?

James Risler:

And they're, they're thinking about, is that vulnerable to

James Risler:

attack? And what can I log off of that event in that VPN tunnel

James Risler:

to make sure that that VPN tunnel is not susceptible to

James Risler:

attack? So they're taking and looking at a house that's

James Risler:

already built? And looking at all the vulnerabilities to that

James Risler:

house? burned down? Is it susceptible to a flood, where

James Risler:

are all the risk points in that organization? And where do we

James Risler:

have to monitor keep that organization secure? So I think

James Risler:

both are interesting challenges. And it just where your passion

James Risler:

lies, both require two sets of different sets of skills that

James Risler:

you got to develop, one, you're learning new skills, to deploy,

James Risler:

to engineer and design and the other side, you're basically

James Risler:

taking a design that's already done, and then trying to find

James Risler:

all the potential weak spots in it that the attacker can do. So

James Risler:

you're out researching the latest and greatest attacks, and

James Risler:

then taking that mindset and coming back and saying, Okay, if

James Risler:

I were an attacker coming back at this organization, what have

James Risler:

we not done in this organization that has making us more

James Risler:

vulnerable? Do we have one flat network where our POS system is

James Risler:

sitting on the same network as our servers? No, or, Yes. You

James Risler:

know, we know an organization that did that. But at the time,

James Risler:

were they asking questions like that, and challenging the

James Risler:

organization to think differently about security. So

James Risler:

it's a completely different mindset in my take. But both,

James Risler:

you know, if you're passionate about the finding puzzles and

James Risler:

undoing puzzles, both of them can be very valuable,

James Risler:

interesting careers.

Dr. Dave Chatterjee:

Excellent. In fact, let me share another

Dr. Dave Chatterjee:

interesting finding from the Voice of the SOC Analyst report.

Dr. Dave Chatterjee:

The top three skills needed to succeed as an analyst, they came

out to:

number one, learning to code, number two, learning

out to:

computer forensics techniques, and number three, knowing how to

out to:

operationalize MITRE attack. So, those were the three things that

out to:

came out at the very top of the list. Jim, reactions, thoughts

out to:

you'd like to add to that?

James Risler:

Yeah, so 100% agree with those. Those are

James Risler:

definitely up there. Because As, like I said, back to the

James Risler:

beginning of the thing, your frontline, now you're moving to

James Risler:

different roles inside of the SOC. And as you move up, you're

James Risler:

taking on more and more challenges, you're going to need

James Risler:

the ability to develop and code and code to basically go find

James Risler:

those threats, to scan through databases to scan through

James Risler:

systems to generate things that can help you find those attacks.

James Risler:

So right there, that's back to your coding there. So that's a

James Risler:

unique skillset; engineers in the future, they're gonna need

James Risler:

to code as they deploy things, routers, no more command line

James Risler:

stuff that's rapidly disappearing, you're gonna see

James Risler:

more DevOps in the engineering environment. So both are going

James Risler:

to need to have coding skills, and those abilities. You

James Risler:

mentioned two other things, coding skills. And what else did

James Risler:

you mention?

Dr. Dave Chatterjee:

Yeah, the second one, I said was learning

Dr. Dave Chatterjee:

computer forensics techniques.

James Risler:

Yeah, again, that's changing as these

James Risler:

platforms change, and these attacks get more and more

James Risler:

sophisticated. You know, attacks today, I think, you know, this,

James Risler:

and a lot of our listeners know this, but when you put an attack

James Risler:

into a sandbox environment, that the attacker knows that they're

James Risler:

listening, let's go back and look at the attack that Georgia

James Risler:

Tech was involved with in 2005. The name is on the tip of my

James Risler:

tongue. But once the attackers figured out Georgia Tech

James Risler:

engineers that were watching this attack, were pre

James Risler:

registering the domain names, what did the attackers do, they

James Risler:

immediately went in and changed the encoding on this, it was

James Risler:

Conficker, they immediately went in and changed the encoding. So

James Risler:

instead of generating 256 domain names, they went generate 2048

James Risler:

domain names a day. And so the Georgia Tech guys were like,

James Risler:

they know, they saw that we were pre registering those domains.

James Risler:

So they took this out of the equation for us. So that would

James Risler:

be a perfect example of, okay, so they're actually watching,

James Risler:

you have to think that these attackers today are well funded.

James Risler:

They have all these solutions that your organization's have,

James Risler:

they go out and buy Cisco, Palo Alto, you know, the Zscalar

James Risler:

solutions, whatever they generate, they create mock

James Risler:

networks. And how do we know this because when Microsoft

James Risler:

releases their patches, the next day, we see a big change on the

James Risler:

internet. When Snort releases its signature update, the next

James Risler:

day on the internet, we see a massive change; signatures that

James Risler:

use did not fire start firing, and signatures that fire before

James Risler:

don't fire anymore. So they're making changes to their attacks

James Risler:

that are constantly and these are teams of people with

James Risler:

different skill sets. So think of it SOC engineers are

James Risler:

different skill sets, developers at different levels, different

James Risler:

skills, different mindsets, teaming together to solve this

James Risler:

problem. It's like, I think the best solution to think about

James Risler:

this, and I have you ever been to one of those escape rooms?

James Risler:

Like in different towns they have, I'm sure Atlanta, they

James Risler:

have one here and in a Tampa Bay area? Oh, yes. Go, you go. You

James Risler:

go into the room with a team as the hours locked, and you got to

James Risler:

find a way out, you gotta solve puzzles, yes, I've done that

James Risler:

twice with people. And the team is really what makes the escape

James Risler:

room successful, right? Having different mindsets and different

James Risler:

skills, because some people can solve a problem. And others look

James Risler:

at it. And they, they're coming at it from the wrong

James Risler:

perspective. And they're just stuck. And it's amazing how

James Risler:

teams, that's how I look at SOC teams, that these organizations

James Risler:

need to lead, you need to hire for different people with

James Risler:

different skill sets to create that unique team that can then

James Risler:

go and solve the problem, because you're going against

James Risler:

attackers that are coming together because they see

James Risler:

riches, they see the ability to make a lot of money.

Dr. Dave Chatterjee:

Excellent. So you need the knowledge and

Dr. Dave Chatterjee:

skills that security engineers bring to the table, you need the

Dr. Dave Chatterjee:

competencies that analysts bring to the table, and then the

Dr. Dave Chatterjee:

organization should be able to pull them together into very

Dr. Dave Chatterjee:

cohesive teams that will develop their own dynamic and, you know,

Dr. Dave Chatterjee:

turn out to be very effective based on working together being

Dr. Dave Chatterjee:

exposed to different types of training opportunities, and so

Dr. Dave Chatterjee:

on, so forth. Very true. So, as you said, the challenge lies in

Dr. Dave Chatterjee:

getting folks trained and hired; tremendous gap out there,

Dr. Dave Chatterjee:

shortfall. So under the circumstances, institutions are

Dr. Dave Chatterjee:

trying to ramp up their programs. Some are offering

Dr. Dave Chatterjee:

certifications, some are offering degrees. Many of the

Dr. Dave Chatterjee:

programs are housed in the computer science slash

Dr. Dave Chatterjee:

engineering department. Many are housed in the business school,

Dr. Dave Chatterjee:

so it differs from organism addition to organization, but at

Dr. Dave Chatterjee:

the end of the day when you're producing, when are you

Dr. Dave Chatterjee:

generating the product, will go on to fill these different

Dr. Dave Chatterjee:

roles, what advice do you have for the directors of these cyber

Dr. Dave Chatterjee:

security programs? Whether it's housed in the business school or

Dr. Dave Chatterjee:

its house in the engineering school. What advice do you have

Dr. Dave Chatterjee:

for them?

James Risler:

Number one, and Dave, this is why I'm so

James Risler:

thankful that you reached out to me, because I'm looking forward

James Risler:

to the journey of you and I partnering together, so my

James Risler:

number one recommendation is partner with corporate America,

James Risler:

find companies that want to give back that want to partner with

James Risler:

you that want to create a pipeline of communication, and

James Risler:

work with them to understand and see the problem you've got. The

James Risler:

problem is multifaceted. It's, you know, corporate America sees

James Risler:

it from one perspective, you know, the universities and

James Risler:

business schools and engineering school see it from a different

James Risler:

perspective. They're both right, but they're both wrong. And you

James Risler:

got to bring them together, to mitigate the wrong and enhance

James Risler:

the right and then allow them to be incubating back and forth

James Risler:

ideas that helped both, I think they can absolutely help both.

James Risler:

But we can't take the old approach, and just have these

James Risler:

separate silos out there working, you actually have to

James Risler:

work with corporate America today and have relationships

James Risler:

with those SOC teams and have those engineers come and give

James Risler:

back and teach back. Use those organizations like Bsides that

James Risler:

come in universities like University of South Florida,

James Risler:

Bsides was on that campus that day, this year, every year it

James Risler:

should be on the campus to encourage students to get

James Risler:

plugged in to Bsides and Bsides should be encouraging the

James Risler:

university to get plugged into it. And businesses need to plug

James Risler:

in to the university, and then find a way to where you guys can

James Risler:

work together to solve that common common challenge.

Dr. Dave Chatterjee:

I couldn't agree with you more means I

Dr. Dave Chatterjee:

can't imagine an effective cybersecurity education without

Dr. Dave Chatterjee:

industry involvement, there has to be a strong partnership. And

Dr. Dave Chatterjee:

the training, or the learning has to be hands-on plus

Dr. Dave Chatterjee:

classroom, it has to go in parallel. Like you said, every

Dr. Dave Chatterjee:

institution has their share of challenges. They work through

Dr. Dave Chatterjee:

their strengths and constraints. The Master of Engineering,

Dr. Dave Chatterjee:

master of cybersecurity, Master of Engineering and cybersecurity

Dr. Dave Chatterjee:

program at Duke, they run the program they have started, it's

Dr. Dave Chatterjee:

a new program, they're doing a good job of it. And the CISO of

Dr. Dave Chatterjee:

that university, he offers internship opportunities to

Dr. Dave Chatterjee:

students, those who are not able to go and work, get internships

Dr. Dave Chatterjee:

with companies, and he creates different types of projects

Dr. Dave Chatterjee:

where they get hands-on experience, seeing how SOC

Dr. Dave Chatterjee:

professionals work, they are probably embedded in those SOC

Dr. Dave Chatterjee:

teams doing different things. And the feedback that I've

Dr. Dave Chatterjee:

received from many of the students is they have found

Dr. Dave Chatterjee:

those to be very enriching. So it is imperative that we are not

Dr. Dave Chatterjee:

only partnering to for training for teaching, but we are also

Dr. Dave Chatterjee:

partnering to conduct research, because industry brings a

Dr. Dave Chatterjee:

certain perspective, certain very practical, pragmatic view,

Dr. Dave Chatterjee:

I'm kind of aligned in that direction. That's why I like to

Dr. Dave Chatterjee:

connect with practice more. And the universities do both. They

Dr. Dave Chatterjee:

do good theoretical research, which is important. But you also

Dr. Dave Chatterjee:

have to translate those theoretical findings into

Dr. Dave Chatterjee:

actionable recommendations. So it is really about leveraging

Dr. Dave Chatterjee:

the synergies. It's not about you or I'm better than you or

Dr. Dave Chatterjee:

you are better than me. It's about we all have our strengths,

Dr. Dave Chatterjee:

how do we come together and help each other because cybersecurity

Dr. Dave Chatterjee:

is a global problem, and we have to fight it together as a global

Dr. Dave Chatterjee:

team, if you ask me, just like what we are having to do for the

Dr. Dave Chatterjee:

pandemic. We just can't leave it to a group or a small network or

Dr. Dave Chatterjee:

a certain community. Everybody has to do their part. So I I

Dr. Dave Chatterjee:

couldn't agree with you more Jim.

James Risler:

Well said Dave, the hands-on capabilities. I

James Risler:

didn't mention this to you yesterday and we were talking

James Risler:

but UNC Pembroke, University of North Carolina Pembroke Campus

James Risler:

did something that I think all universities should highly

James Risler:

consider. They created a SOC that is run primarily by the

James Risler:

students. The students are brought in, the cybersecurity

James Risler:

students then come in, learn the skills as part of their training

James Risler:

to protect the organization, to protect the university, to

James Risler:

protect the other students. I think that's brilliant right

James Risler:

there. Now you've got a practical experience. And I've

James Risler:

seen other universities do this for other things like University

James Risler:

of Tampa where I got my MBA has a room dedicated to finance. So

James Risler:

you go in there and you study stocks and how the trends of

James Risler:

stocks. Just do the same thing for a SOC. Now you have students

James Risler:

coming in there, the students are doing the research, they're

James Risler:

seeing threats on the campus, and then they're researching

James Risler:

those threats and reporting them out to the campus leadership.

James Risler:

And then they're getting skills and hands on. And now the

James Risler:

university has a tool, that SOC that they can go to industry and

James Risler:

say, hey, we have a SOC, we would like to put your tools in

James Risler:

there to highlight, and then have your leaders from your

James Risler:

organization come in and lecture and talk and train and teach

James Risler:

about it. There's your synergy you're talking about right

James Risler:

there,

Dr. Dave Chatterjee:

We need to do that extensively. That's so

Dr. Dave Chatterjee:

important. And that reminds me, I get to talk to a lot of cyber

Dr. Dave Chatterjee:

training service providers, and I'm sure they all provide great

Dr. Dave Chatterjee:

service. One particular service provider that comes to mind is

Dr. Dave Chatterjee:

Circadence by Project Ares, and I was looking at their offering,

Dr. Dave Chatterjee:

pretty extensive, they address each of the four or five

Dr. Dave Chatterjee:

elements in the NIST framework. And I'm looking at their list of

Dr. Dave Chatterjee:

skill sets and knowledge that they try to impart through their

Dr. Dave Chatterjee:

program. And it's a pretty hands-on gamification oriented

Dr. Dave Chatterjee:

program, it is AI driven. So essentially, students are

Dr. Dave Chatterjee:

learning the skills interactively. And then they are

Dr. Dave Chatterjee:

in the battlefield, engaging in simulated battles where they're

Dr. Dave Chatterjee:

trying to fend off attacks, thwart attacks. And the

Dr. Dave Chatterjee:

interesting thing here is, if they, during the actual

Dr. Dave Chatterjee:

simulation, when they are engaging in defense, if they

Dr. Dave Chatterjee:

have to access the tips, the helps, they lose points. So you

Dr. Dave Chatterjee:

learn as much as you want. But when it is test time, battle

Dr. Dave Chatterjee:

time, better, you know, remember what you learned, or you can

Dr. Dave Chatterjee:

talk to your team members, and see how well you perform. So I

Dr. Dave Chatterjee:

think that's a great model. I'm sure many other service

Dr. Dave Chatterjee:

providers do the same. So I just don't want to highlight one and

Dr. Dave Chatterjee:

say, you know, this is the best or anything like that. But I'm

Dr. Dave Chatterjee:

just putting forward an example, that some really good work is

Dr. Dave Chatterjee:

happening. It's a matter of institutions, stepping out and

Dr. Dave Chatterjee:

making the connection. Cisco is the absolute leader, somebody

Dr. Dave Chatterjee:

like you, I'm sure it's a highly sought after personnel. And I

Dr. Dave Chatterjee:

look forward to partnering with you, as well. So So yeah, this

Dr. Dave Chatterjee:

is this is wonderful, wonderful, Jim, I have thoroughly enjoyed

Dr. Dave Chatterjee:

the discussion, we're kind of coming towards the end of our

Dr. Dave Chatterjee:

program here. So I'd like to give you the remaining time to

Dr. Dave Chatterjee:

sum it up for us maybe share some key messages, some final

Dr. Dave Chatterjee:

thoughts with the listeners.

James Risler:

Final thoughts, that's a, that's a big Bosu ball

James Risler:

right there, as things are changing all the time. So

James Risler:

there's a lot of opportunity out there, there's a lot of places

James Risler:

to start to get this information, you can start as

James Risler:

simple as basically getting Wireshark and going in and

James Risler:

finding PCAP files from known attacks, and replaying those

James Risler:

into Wireshark. And looking at the PCAP files. And you can go

James Risler:

so far as to you know, get time on third party, Cyber Range,

James Risler:

like range for us and others out there, where you're actually

James Risler:

working through the different skill sets required for a

James Risler:

security operational professional, whatever, whatever

James Risler:

role you see in your future, and then working through different

James Risler:

case analysis. So the world's your oyster, you know, how do

James Risler:

you want to tackle that problem? And then where do you where do

James Risler:

you go from there? There's a lot of ways to, you know, go out and

James Risler:

create your own learning journey, and start learning and

James Risler:

exploring it. And we didn't even cover IoT security, did we, you

James Risler:

know, interesting enough, here's a final thought. One of my

James Risler:

hobbies is brewing beer. And I was at a friend of mines

James Risler:

manufacturing facility, and they build large scale brew systems.

James Risler:

And I was looking at this keg cleaner, and you plug these kegs

James Risler:

into this keg cleaner, and you basically program it, and it

James Risler:

starts cleaning these kegs out. And I look down, and I see, wow,

James Risler:

that's a piece of technology in that keg cleaner right there.

James Risler:

Imagine if I hack that device. And of course, I went on the

James Risler:

internet looked up that device, it's got a default IP address.

James Risler:

Imagine if I hacked that device and coded it so that the last

James Risler:

part going into the keg cleaner was the chemical rather than the

James Risler:

rinse agent. Can you imagine if they filled that beer container

James Risler:

up with beer, And there was that chemical in there people will

James Risler:

get sick, you know, could cause brand awareness problems for

James Risler:

that Brewing Company. So IoT security is a huge space that is

James Risler:

real rapidly coming. And if you look at people from IT, trying

James Risler:

to get into IoT, they don't understand that IoT is a

James Risler:

different mindset. So those two mindsets are trying to come

James Risler:

together. But there's that there's that gap of jumping over

James Risler:

and bridging it. And nobody has solved that problem today. And

James Risler:

yet the security risks are increasing, increasing,

James Risler:

increasing. So I guess that's the best example they could sign

James Risler:

off with is the future of IoT security is a risk to all of us.

Dr. Dave Chatterjee:

What an example. And what a way of

Dr. Dave Chatterjee:

signing off, that prompts me to say a few words, I apologize if

Dr. Dave Chatterjee:

I'm bucking the trend here, I talk about contamination of

Dr. Dave Chatterjee:

water supply. And when you give that example, that brings to

Dr. Dave Chatterjee:

light how these kinds of contaminations can happen, the

Dr. Dave Chatterjee:

more digitized we get. And we connect with smart devices

Dr. Dave Chatterjee:

everywhere, especially our healthcare sector, I've done

Dr. Dave Chatterjee:

research with those organizations. And they are

Dr. Dave Chatterjee:

very, very apprehensive, tentative, nervous about the

Dr. Dave Chatterjee:

kind of security that these IoT devices come with. And that's a

Dr. Dave Chatterjee:

huge vulnerability for them. But from my end, to wrap things up,

Dr. Dave Chatterjee:

I'd encourage listeners that there are a variety of roles

Dr. Dave Chatterjee:

that you can play in a security operations center. Some are

Dr. Dave Chatterjee:

highly technical, some are analytical, and there is the

Dr. Dave Chatterjee:

communication aspect. So even if you don't have a technical

Dr. Dave Chatterjee:

background, don't let that scare you away. There are needs for

Dr. Dave Chatterjee:

motivated people, people who are willing to learn people who are

Dr. Dave Chatterjee:

passionate. So there are some fundamental behavioral traits

Dr. Dave Chatterjee:

that will be highly valued. And then the training will provide

Dr. Dave Chatterjee:

you with the skill sets. And I want to emphasize here what Jim

Dr. Dave Chatterjee:

mentioned several times, it's the mindset. And so at times, if

Dr. Dave Chatterjee:

you haven't had any prior engineering, computer science

Dr. Dave Chatterjee:

training, that's not necessarily a bad thing, because you go in

Dr. Dave Chatterjee:

with a very clear head without any kind of biases, and you get

Dr. Dave Chatterjee:

trained to, to learn to think a certain way. And that often is a

Dr. Dave Chatterjee:

help. So without taking anything away from the security

Dr. Dave Chatterjee:

engineers, who do, uh, you know, who play a major role, from the

Dr. Dave Chatterjee:

analysts who play a major role, and then there are others from

Dr. Dave Chatterjee:

the business side of things, who can also be a major contributor.

Dr. Dave Chatterjee:

And that role is not to be undermined in any way. So

Dr. Dave Chatterjee:

everyone needs to have some level of awareness if we have to

Dr. Dave Chatterjee:

really be effective in defending ourselves against the hackers.

Dr. Dave Chatterjee:

Again, Jim said they are constantly on the prowl, they

Dr. Dave Chatterjee:

are innovating at a speed that's hard to match. So it's not a

Dr. Dave Chatterjee:

battle or a war that we can win. But we have to keep our eyes on

Dr. Dave Chatterjee:

the ball and stay as alert as possible. So that's my two

Dr. Dave Chatterjee:

cents. But since Jim, I said you will have the last word, we

Dr. Dave Chatterjee:

still get to have the last word. And after that, we'll pack it

Dr. Dave Chatterjee:

up.

James Risler:

I loved what you just said right there, the

James Risler:

different mindsets back to the escape room analogy, we used,

James Risler:

that one person coming into that room that may have a philosophy

James Risler:

background, or may have been an accountant or a lawyer coming in

James Risler:

and looking at the problem completely different, might be

James Risler:

the key to solving that puzzle that gets you out of that

James Risler:

escape. So we'll sign off there. I think that's a great way to

James Risler:

close out.

Dr. Dave Chatterjee:

Thank you very much Jim for your time.

Dr. Dave Chatterjee:

It's been a pleasure.

James Risler:

Thank you. Likewise Dave, it's been a

James Risler:

pleasure.

Dr. Dave Chatterjee:

A special thanks to James Risler, for his

Dr. Dave Chatterjee:

time and insights. If you like what you heard, please leave the

Dr. Dave Chatterjee:

podcast a rating and share it with your network. Also,

Dr. Dave Chatterjee:

subscribe to the show, so you don't miss any new episodes.

Dr. Dave Chatterjee:

Thank you for listening, and I'll see you in the next

Dr. Dave Chatterjee:

episode.

Introducer:

The information contained in this podcast is for

Introducer:

general guidance only. The discussants assume no

Introducer:

responsibility or liability for any errors or omissions in the

Introducer:

content of this podcast. The information contained in this

Introducer:

podcast is provided on an as-is basis with no guarantee of

Introducer:

completeness, accuracy, usefulness, or timeliness. The

Introducer:

opinions and recommendations expressed in this podcast are

Introducer:

those of the discussants and not of any organization.

Next Episode All Episodes Previous Episode

About the Podcast

Show artwork for The Cybersecurity Readiness Podcast Series
The Cybersecurity Readiness Podcast Series
with Dr. Dave Chatterjee

Listen for free

About your host

Profile picture for Dave Chatterjee

Dave Chatterjee

Dr. Debabroto 'Dave' Chatterjee is tenured professor in the Management Information Systems (MIS) department, at the Terry College of Business, The University of Georgia (UGA). He is also a Visiting Scholar at Duke University, affiliated with the Master of Engineering in Cybersecurity program in the Pratt School of Engineering. An accomplished scholar and technology thought leader, Dr. Chatterjee’s interest and expertise lie in the various facets of information technology management – from technology sense-making to implementation and change management, data governance, internal controls, information security, and performance measurement. His work has been accepted and published in prestigious outlets such as The Wall Street Journal, MIT Sloan Management Review, California Management Review, Business Horizons, MIS Quarterly, and Journal of Management Information Systems. Dr. Chatterjee’s research has been sponsored by industry and cited over two thousand times. His book Cybersecurity Readiness: A Holistic and High-Performance Approach was published by SAGE Publishing in March 2021.