AWSN -amazing group of security professionals

Post by Guest writer Heide Young

Connecting

Supporting

Collaborating

Inspiring….

….these are the core values of AWSN and the standards of the members. That might sound a bit cheesy and like an opportunity to sell you on AWSN, but let me tell you my story…

A few years ago I started paying attention to news articles about how this company or that company was breached by hackers. It occurred to me that I am so dependant on technology, it’s pretty much attached to every aspect of my life and my home…even my home security is online and assessable from my mobile. And then it occurred to me that I have no idea how to keep all my and my family’s valuable information secure.

I wanted to learn how hackers hacked. My thought process was if I knew how they could ‘break in’ then I could secure it.

Now let’s back it up a minute…you should know I come from absolutely no technical background. Even my husband used to joke that I went from never backing up my tech gear to learning to hack haha ….so in my usual mindset to start with the end in mind, but I’m too impatient and tried to rush the process, which meant enrolling in CEH. I gave it a good go and it was eye opening all the tools and techs and how ‘easy’ it was to just download your hacking program of choice and voila off you go. Which scared the crap out of me even more!

I joined AWSN and started getting more involved in the Cyber Security community and was in awe of all the knowledge I was absorbing at every event and meetup. Now I have been to a ridiculous amount of full on technical, hacking, CTF meetups and I try, really try, but they are on another level. But everyone is so welcoming and excited by the challenge to explain it in layman terms for me J I feel like a kid learning new tricks at the playground every time I learn a little more on cyber security.

For me it’s all about learning to keep myself and my family secure and making it relatable to everyday life.

Now going back to me not being technical, my career has been relationship management and business development focused. I was fortunate enough to combine my career skills with my cyber security passion, taking on growing Greythorn recruitment’s cyber security capabilities. I was even more fortunate to have one-ups and two-ups who were the kind of people every professional dreams of reporting to.

I’m a full-time working mom, and I think it’s important to share that I didn’t experience discrimination till I became a mom. To be perfectly honest, I don’t think I fully understood the real meaning of feminism till I experienced discrimination. It was a very hard time and I cannot begin to explain how it affected my and my family’s life. Lucky for me I have an encouraging husband, who’s advice I finally listened to and left.

Since then, it has been my focus to assist others who are in difficult career situations by either advising or connecting them with other professional who can better advise.

AWSN membership base is incredibly diverse, both women and men, some parents, some not, experienced working professionals, and new grads. They span from technical to non-technical professions from entry level to CISO level. It is such an amazing way to connect with people.

For me, it has helped me personally and professionally by expanding my knowledge and growing my cyber security network. I have previously talked about from recruitment perspective women need a bit more encouragement and confidence to just go for it, even when don’t tick all the boxes – and I’m including myself in that statement. AWSN members have given me opportunities to have more confidence and just go for it, even when I didn’t have it in myself. I still remember a particular pep talk from a female member, and anytime I hesitate I remember her words of encouragement, empowering me to believe in myself and go for it. Because I listened to this wise woman and went for it, what it has done for my career has been phenomenal.

I recently relocated to Dubai, which was quite daunting at first, as I didn’t have many contacts here. However, as soon as I told AWSN members, nearly everyone had helpful advice and even referred me to people in their networks in Dubai as well as cyber security groups in the area. I was overwhelmed with the amount of support from AWSN members.

This wonderful amazing group of cyber security professionals is an incredible platform for empowering women through connecting, supporting, collaborating and inspiring. 

(c) AWSN 2018

Disclaimer: The views and opinions expressed in this article are those of the author/s and do not necessarily reflect the official policy or position of any agency, organisation or association.

Cyber Security Risk Management in Context

by Robyn Bailey

_____________________________________________

A good cyber security program requires good management of risk, usually in accordance with Risk Management Standard ISO31000, although there’s almost always one critical step that is overlooked.

Setting the context of a risk assessment is the first and one of the most important steps – if all participants of the assessment are not working and analyzing at the same context then there is bound to be a mismatch and incorrect risk ratings assigned. This can lead to over-application of controls (and a lack of return on security investment leading to reputational issues for the cyber security specialists) or under application.

The following diagram represents the multi layered approach to cyber security risk management and examples of key stakeholders for input to a risk assessment within each context.   

Each layer should then be further broken down into vulnerabilities and threats.

An example I often use to explain these layers and contextual awareness (or lack of) is the identification of a vulnerability in a browser on a server by an operational staff member. Whilst industry vulnerability ratings (eg http://cve.mitre.org/) may identify the vulnerability as High, the threat may be low (no or minimal human threat actors as there is very minimal use of the browser) therefore the risk, even at the Operational context, is not High. Once we “roll-up” the risk to the layer layers, this particular risk should get consumed within more important business cyber risks – the CEO and Audit and Risk are not concerned with one vulnerability on a server. 

Delving deeper into individual risks, as a risk practitioner of many years, I often see a lack of contextual alignment in the likelihood and impact. For instance, using a basic risk of Weather event causes data centre outage, we can assume that a weather event may be Possible and a data centre outage could have a Severe impact when the factors of the risk are treated separately – perhaps giving a Very High risk rating. However, when the full context of the risk is documented – for example, Weather event causes data centre outage beyond 3 days, we can see that the likelihood is probably Rare, the Impact remains as Severe, giving a Medium risk rating (depending on your risk matrix of course).

Robyn has worked as a technologist and strategist in the cyber security industry for over 20 years. She established the first Australasian Chapter of the Information Systems Security Association (ISSA) around the year 2000, and bought the first CISSP exam to Australia in 2002. She has worked for Business Aspect for the past 10 years as a Principal Consultant and she also leads their Security Testing team. A quiet achiever, Robyn constantly challenges the status quo through analyzing and asking the right questions.   Largely self-educated, she has a passion for learning about technology and has extensive technology knowledge including communications, app dev, databases, cloud and integration platforms. In her “spare” time, Robyn is a mother of two teenage boys and a pre-teen girl and also volunteers for code.org (teaching coding to teachers and students in Primary schools); Mensa (co-ordinating events for, and teaching technology and cyber security skills to gifted children); CSIRO STEM Professionals in Schools (explaining Comp Sci to teachers); Tech Girls are Superheroes; and various other non-profit organisations.  Robyn’s experience of 25 years as a female technologist drives her to especially provide support to other analytical girls and women with outstanding capacity to succeed as a technologist.

(c) AWSN 2017

Disclaimer: The views and opinions expressed in this article are those of the author/s and do not necessarily reflect the official policy or position of any agency, organisation or association.

The best way to land your next role in Security…

This post has been written by Claire Fulford an active supporter of diversity and the AWSN.

An old friend recently remarked that I always know what I am going to do next, what my next job will be and how I am going to get it.  Apart from my recent decision to start my own business (call me if you need a coach!), I felt like I had mostly just been in the right place at the right time.  When I reflected more closely on his comment, in reality, opportunities come to me because I network.  Alot. Mostly because I enjoy meeting people and hearing their story, both of us not realising the value of our connection until later. 

Without networking, I would not have known about any of the jobs I have held since leaving university (and I wouldn’t have some of my great friends either!).  Every one of my jobs has been suggested to me through people I have known or those I have made it my business to know.  So many people out there hate networking and do everything in their power to slip out sidedoors or check email to avoid the coffee break at conferences and corporate retreats. 

The old adage…’its not what you know its who you know’ only became an old adage thanks to networking.   There are people whose life purpose is to bring others together.  Malcom Gladwell called them Connectors in his book “The Tipping Point”. They are "a handful of people with a truly extraordinary knack [... for] making friends and acquaintances" thanks to "…something intrinsic to their personality, some combination of curiosity, self-confidence, sociability, and energy".  We are certainly not all connectors…but we all need one now and then and the only way to find them is through networking.

I implore you next time you get the opportunity, make the effort to network. Accept an invite to lunch, hang around the sandwiches (not in a creepy way) at the next conference you’re at and strike up a conversation over egg & lettuce or find the person in your organisation who you can help and ask them out for coffee.  If all of this seems a bit daunting…try to prepare in advance.  Consider a topic to discuss with others and decide on your purpose for networking at that event…are you looking to meet new clients or understand more about industry challenges you might be able to solve. You never know who you might meet (it could be me!).  

What are some of your networking success stories?


Claire Fulford is an accomplished security professional. She recently started her own business after seeing the need to consult and guide organisation's on their security professional team needs.

 This post has been written by Claire Fulford & coded by Mandy Turner on behalf of AWSN. 

(c) AWSN 2016

The AWSN pathways programme.

Pathways Programme

Introducing an initiative by the Australian Women in Security Network (AWSN) to support young women seeking a career in the security sector, the AWSN pathways programme.

The AWSN PATHWAYS PROGRAMMEis a professional development dual programme designed to prepare a select group of young women for a career in the security sector.  The AWSN aims to build a talent pool of high school and university graduates to fill, forge and create existing and new security sector workforce requirements.  The Pathways Programme will provide opportunities to partner with industry and other business environments to provide students and graduates with broad exposure to a variety of roles, and relevant training and development in preparation for a career in various fields which require security specialists with appropriate skill sets.  Admission to the programme will also enable participants to develop networks across the sector in addition.

This provides an amazing opportunity for students and graduates to be exposed to a broad variety of interesting roles, training and preparation for a career in various fields requiring security specialists.

Admission selection for the first programme to be run in 2017 will begin on December 2016. Please register your interest by liking our page 'Awsn cadets'

 This post has been created by A Turner on behalf of AWSN. 

(c) AWSN 2016