Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Power and energy security strategist Emma Stewart is always on the lookout for what’s next in the U.S. electric grid, whether that be an influx of renewable energy or cyberattacks by malicious hackers. Her engineering background helps her understand how things work so she can break them to build them again, but stronger. Emma has announced she’s joining Idaho National Laboratory as Chief Power Grid Scientist and Research Strategist in the lab’s National and Homeland Security Directorate, putting her on the forefront of efforts to keep Americans’ electricity networks resilient in the face of cyberthreats.
Emma previously worked as Chief Scientist for the National Rural Electric Cooperative Association, which represents the nation’s roughly 900 non-profit electric co-ops. Because rural infrastructure can lack the same level of funding or support compared to bigger electric companies, she often had to puzzle over how to fortify distributed resources from nation-state cyberthreats.
Listen to this episode to hear more about:
How cyber mutual assistance programs can help level the playing field in the fight against adversaries
Emma’s cancer survivorship
Takeaways from the S4 industrial cybersecurity conference in Miami Beach, where Emma was a speaker
Listen to the episode
S2 E9 · Emma Stewart on the future of grid securityWE'RE IN! Podcast · 35 min
Key takeaways
Resilience means recovering, not withstanding Emma defines grid resilience as the ability to recover and keep the lights on during severe events, which is different from reliability. She adds a human dimension: protecting people from worst cases like a seven-day outage.
Manual fallback may not last Operators can still restore power manually today, but Emma doubts that will be possible in ten years as automation and communications on the grid grow.
Diversify components across neighborhoods A single installer can put the same solar component on every house in a neighborhood. Emma argues for product diversity and interoperability so one flaw does not affect 12,000 homes.
Threat alerts need actionable advice Warning people about threats they cannot act on amounts to crying wolf. Emma recommends leading with the immediate action to take.
Shared regional cyber teams for small utilities Small utilities cannot hire several security specialists, so Emma points to regional teams in places like Kansas and Arkansas with fractional ownership across entities.
Topics covered
Compliance
Conferences
Notable quotes
…you can tell people this threat is coming, but if they can't do anything about it, all we've really done is cry wolf…
If I know how I can break it, I know how I can probably stop someone else from breaking it.
If you've got a giant hole in your system that you didn't patch, what was the point in putting monitoring in place?
If you don't own your cyber team, there's a good chance you won't necessarily know what to do with them when the time comes.
Questions this episode answers
What does a resilient electric grid look like?
Emma said the various agency definitions roughly agree that resilience is about recovering from events and keeping the lights on when very bad things happen, not withstanding everything. She also includes protecting people from worst-case scenarios. Read this section
Can grid operators still fall back to manual operation after a cyberattack?
Emma thinks they can today, but not in ten years, because the grid will rely on so much automation and communications. Read this section
How can small rural utilities defend against cyberattacks with limited staff?
Emma pointed to regional communities that act as shared cyber teams with fractional ownership across entities, and stressed that utilities need some ownership of those teams to use them well. Read this section
Why can cyber threat warnings to utilities backfire?
If people are told a threat is coming but cannot do anything about it, the warning amounts to crying wolf and they may ignore the next one. Emma recommends putting the immediate action first. Read this section
How should resource-limited utilities choose security products?
Emma argued for decision support to help pick the right products and for getting the basics right first, since monitoring does little if an unpatched hole remains in the system. Read this section
About the guest
Emma Stewart is a power and energy security strategist with a PhD in electrical engineering and about twenty years of work on the electric grid. She was most recently chief scientist of the National Rural Electric Cooperative Association, and at the time of recording she was working as an independent consultant; the feed description notes she announced she was joining Idaho National Laboratory as Chief Power Grid Scientist and Research Strategist. She took part in DARPA's RADICS grid security exercises on Plum Island.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm Blake Sobczak, and I hope you're ready for some serious cyber real talk from our next guest, Emma Stewart. She's an independent consultant on power and energy security strategies. Emma was recently a speaker at the famed S4 Industrial Cybersecurity Conference in Miami Beach. We'll get into her experience there, her cancer survivorship, the risk of catastrophic cyber enabled power outages, and our shared appreciation for creative ways to get the word out about security threats. Emma has decades of energy sector expertise, including most recently as chief scientist of the National Rural Electric Cooperative Association. She also happens to hold a PhD in electrical engineering. We'll hear more from Emma momentarily, but first, here's a quick word from our sponsor.
Attackers scan your systems daily. You just don't get the report. Synack Security Testing Platform stands by drawing on a trusted network of global security researchers. From web apps to headless APIs, our platform helps you find and fix gaps in your security posture. Learn more at synack.com. That's synack.com.
Yeah. All is well. So you delivered a talk recently at the S4 Industrial Cybersecurity Conference. That is one of my all time favorite InfoSec conferences, industrial cybersecurity focused based in Miami Beach. I guess, what can you tell me about that experience?
It was actually a really great experience. I've spent a couple years or more than a couple going to the conference. I've never actually spoken. Finally, got the guts to actually stand up on the main stage and say what I wanted to say. So it was a great experience. All of the providers, of the different people are there. It's really, it's a great community to be in just to share information with people and walk around and even just more comes from just walking around the corridor half the time than even going to a lot of the talks. Not that the talks aren't wonderful, but there's a lot to learn there.
There's a lot to learn, and I'm sure there's a little bit of relaxation happening too on the side of Miami Beach. I'm a little jealous. Being based in DC sometimes around the time S4 happens in the winter, it can look like a pretty nice destination to get down to and talk about cybersecurity issues.
Now, at at at the time, you were chief scientist at the National Rural Electric Cooperative Association. I guess, first of all, chief scientist, that's a pretty interesting title. What is that about?
I'm actually joking at the moment that I'm currently the chief of the House of Emma. I recently left NRECA, but I'm I'm still the same person, still the same. I like calling myself a Chief Scientist because it's a really cool title to be honest. It's pretty much what I've been building to most of my career in that I really like looking at what happens in the future and how to help people get there. I've worked in grid security for a long time. I've worked in resilience. I've always focused on the electric grid and I think there's so many interesting things happening and it's just a cool place to actually be to see the future and the future we always planned when I worked in research and development as well.
Now that notion of resilience, find so interesting. I feel like you asked 10 different people what they think resilience means and you might get 10 different answers. So what do you feel like a resilient grid looks like?
I mean, we have, I think, three different definitions right now from three different agencies, so that's always interesting. Nice. Resilient grid. Yeah. I know. There's there's three, but they all mean roughly the same in that we're able to recover from events. It's not necessarily being able to essentially like always withstand everything. It's not reliability. It's really how do you recover and remain with the lights on essentially when really bad things are happening. So it's a different scale of event. From my perspective, there's also an angle of human resilience in the definition as well. That resilience is really where we protect the humans from worst case scenarios happening as well. Be that the lights being off for seven days or something along those lines.
I hope that doesn't happen anytime soon because definitely need electricity both for my job and just for, you know, things like water and whatnot. From a from a cyber perspective, what does that worst case scenario look like? I mean, I I know obviously it's a... It's pretty, kept under wraps in some of these different examples that the utility industry is rehearsing around. But like, generally speaking, what is the cyber threat facing the electricity industry today?
I mean, and vulnerability are two things that I think we talk about daily. I was actually part of the RADICS work previously with DARPA which was where we essentially ran through an, I'll call it an emulation, a physical set of exercises where I assume the lights have been off for thirty days, Where are we gonna go from here? How do we restore everything? And I think that's the scenario we all kind of plan for that big worst case day where nothing is good. Actually worst case thirty days. From my perspective there's other futures in there that may be more likely versus consequence versus reality of things happening. We're spreading out our attack surface just now. We're doing distributed resources. We've got lots of things being added to the grid all at the same time. From my perspective, not being able to have that future because something disrupts the forward movement of it is a little scary for me.
I'm fully believing that we need to change our energy system to be clean and more reliable at the same time. If we don't get there, there's a bigger future in twenty years that's not going to be great. So long term and short term, there's two different issues, I think, from the cyber perspective at the moment.
I'm glad you mentioned the RADICS program and DARPA. I remember years back joining a reporting trip to this remote island off the coast of New York, Plum Island, where DARPA was doing some really fascinating research around grid security. Were you... Did you ever make it out to Plum Island? Can you talk about any of that research? It's it's this really isolated, interesting spot that just is like... Almost feel like you're in the Hound of the Baskervilles or something roaming around it, a government controlled island. Were you involved in any of that?
I was. Yeah. I'm actually a really big fan of this sort of apocalyptic world type scenario. So going out to Plum Island was actually pretty cool. I actually grew up in a country that benefited from the work Plum Island did previously in Scotland. Interestingly, we had a foot and mouth disease problem for a long time and so I happened to actually know what it was. But we went out there and I was actually there, yes. I spent most of the time sitting in a white quarter connex. I was hiding. I was the one that was some of the time making the grid wobble and annoying people. It was a pretty cool scenario. I was looking at things to do with how oscillations might happen on the grid and what that might mean to things like diesel generators and distributed resources. At the time, I was also leading one of the follow on projects where we were looking at things like large scale storage being out there and if it could help balance oscillations as well. So that was my life. I generally went there a couple of times and ran around in circles with a lot of people and I think most people weren't sure if I was Ginger Wright or Emma Stewart at the time.
Ginger Wright being affiliated with Idaho National Labs for listeners who may not recognize that name, but Virginia is great as well also. And I know the national labs have had a huge hand in some of that research. Yeah, it was really interesting. Yeah. You mentioned Plum Island has renowned for its research into animal diseases and I guess like has a level three bio containment facility or some such. Then also doing all this playing host because it's isolated grid to all these really interesting projects and research elements around cybersecurity. And, you know, we talk about the worst case scenario thirty days, just assuming that that's happened and not not really dissecting the likelihood of something like that. You know, I guess day to day, what are some of those more prosaic cyber threats that the electricity industry is facing? Because I know, okay, not everything's gonna actually cause a cause a blackout.
One of the really interesting things that came out of all of that work that I find most interesting was, again, from a human perspective, I was watching sort of the cyber teams work with the grid operator teams. And at some point, I remember them yelling at each other and somebody wanting to put the system onto manual and get the lights on. And they weren't understanding that there was something set up there that was going to brick everything at the time they did that. And so everyone was running around and yelling at each other and I think that was a really cool thing on that island is you kind of isolated people and their emotions and so you started to see how things were gonna play out. From things that might happen more in the short term world at the moment, I am seeing a lot of sort of software challenges and hardware, especially from the software supply chain issues at the moment. The number of patches that are released on a daily basis, I think that's one of our growing issues as people.
I agree with some of the statements that have been said recently, things that are in the national cyber strategy also around vendors of products from the software side absolutely need to start working on secure development processes and start to take some responsibility for it because we're not gonna live without software at this point. So let's assume it's part of our infrastructure that needs to be improved.
Yeah, and it's getting so complicated too. You mentioned that tendency to wanna flip back, okay, too much is going on. We don't understand what's happening on the grid. Let let's let's go back to this manual process. Right? Like, let's let's go flip switches by hand. Let's make sure the lights are on. You know, it's interesting because I know grid operators in Ukraine did that back when they suffered their first... Sort of first of a kind cyber attack on Ukraine's grid in 2015, later linked to Russia, perhaps unsurprisingly. And the distribution utilities were able to just actually flip things on, get everything back on online and running manually. Now when you mentioned all the integrating all these distributed resources, solar, renewables, complex software processes going into running the North American grid, I just wonder how much... Can we really rely on that manual backup anymore?
I think to a degree. Well, at the moment, I think we can. There's a good degree of we can just get rid of things and get things back online at the moment. I don't think we'll be able to in ten years. I think we'll have so much automation. And again, I think automation and these resources are a great thing. The interesting, I've seen this sort of Venn diagram separating of we need the communications, we need the automation to make this grid actually be reliable. But while we're doing that, we're also growing the amount of communications and the size of the attack surfaces. This Venn diagram has now separated in the best way we keep things secure and the best way we keep things operating as well. So definitely an interesting challenge. I will add one of the things that came up recently was about is an outage actually the best thing that could happen from a resilience standpoint? They've done it a lot in California. They turn off distribution lines when things aren't great because a certain wind condition and a certain fire condition coming together is not great for the electric grid and the grass underneath it.
I didn't even think of that. That's a really good point. Maybe it's actually a net benefit to have suffer that outage and deal with the consequences than it would be to deal with a devastating wildfire that resulted from downed lines or overheated lines running into vegetation or whatnot. That's a really good point. Now we've talked a lot about threats and risks so far, but I know S4, especially as a conference, is very focused on solutions and how do we get to where we need to be. I'm wondering, you know, what can be done? And I guess, as I understand it, you talked there, touched on some of the potential solutions for getting defensive tools into the hands of people who need them.
Yeah. There's a lot of things I think we can do. We've been going a certain direction recently on how do we monitor and see what's happening on the system. I think that absolutely has a role. We just need to work out what we're actually looking at. And from the Electric Grid perspective, that's my expertise. I've worked on electric for twenty years. But from that perspective, I think we're somewhat missing context of what's actually operating. Like do you know if this fault is actually a cyber fault? There's a number of things that could happen from the household perspective that you could then see blowing up a fuse. You have no idea that that was to do with a cyber attack in your house. So there's some context that we could build in there. Basically speaking with operators more and having them be part of building these solutions, I think is a huge opportunity. They want to help. They absolutely do not want to be in the situation where they have to deal with this. So people do want to help build that as well.
So the communities of practice coming together I think is going to be a good thing in future. One of the things I've been thinking about recently has also been interoperability and diversity of components. When, say, you install solar in a neighborhood, there's an interesting thing that happened in the last I think five years that one installer comes in and you end up with the entire neighborhood having the same component. I think there's a lot we can do there from the simple side of let's not have the same component be on every single location all doing the same thing. So think as the market's building, there's a good diversity in products and neutrality in products coming up as well. But in the end, it'd be really nice to just be able to spread things out and not be worried about one component on 12,000 houses. So there's a lot to do there, but interoperability of those components is going to be vital. Data standards, basically allowing everyone to work together in a way to defend the system.
So you talked a little bit about some of your background, but as I understand it, you quite an engineering background. How does that come into play in some of the work that you've done?
Oh, my title has changed from engineer to scientist, and at some point, I was a scientific engineer. I've varied between them both. My favorite part is essentially I'm very good at breaking things, and I like rebuilding them after that and working out how things could be done better. I have a small history of knowing how things go on fire which is quite helpful. It comes from my dad's a forensic scientist and he used to call me frequently to ask me how things went on fire especially in the electric system and going back to fundamental physics, I could usually work it out. But that helps me with the work I do now. If I know how I can break it, I know how I can probably stop someone else from breaking it. And that's kind of the engineering mindset more than the science. But then it gives me the future where the science will fix some of these problems in the future.
Nice. Nice. This is fine. This is fine. Well, you know, it it is it is interesting that, you know, we hear so much about lurking Russian malware implants, China linked cyber espionage of oil and gas infrastructure, you know, really scary sounding stuff just day after day menacing our our energy infrastructure. And, you know, I don't doubt that some of these threats are are are all too real, but sometimes it strikes me that the risk can seem a little bit exaggerated. Again, when when we've never really seen that impact, we haven't seen a US power outage attributed to a cyber attack. I guess, how do you communicate that urgency of needing to find solutions and deal with this when... I mean, I think rational people could look at it and say, hey. What's the big deal?
I think that's been an interesting challenge recently. It's been a hard challenge. People are being flooded with information. And, I mean, rightly so, there's been a lot happening, obviously with the Ukraine, with Russia. Things have been spinning up pretty seriously. So these... A lot of the threats aren't unfounded. But we have had a little bit of issue with actionable advice, as in you can tell people this threat is coming, but if they can't do anything about it, all we've really done is cry wolf and they potentially might not do anything in future when it comes again or not see it. So we definitely need to think about how we provide people actionable information in future or just stand at the top of this. Here's the action you need to take immediately. Then the rest can flow from that. I'm used to sending people emails that say that. Here's what you should do now. But yeah, do think the actionable information needs to improve as well.
And definitely how do we help people that have one cyber staff, one IT staff that are trying to hold things together? How do we get more people around them when something is really bad and we know the right threats? So I do think there's a pretty solid community that needs to build around these entities to really help them at this point.
Right. And that harkens back to some of your work at the National Rural Electric Cooperative Association, I guess, representing hundreds of smaller electric energy providers throughout The US. And as you just mentioned, some of these entities might not have designated, you know, crack cyber teams ready to leap in at the first sign of a threat. And, you know, maybe they're... Maybe they have one IT person allocated for a geographic area that spans multiple towns in rural Wyoming or who knows? I guess who protects these companies and utilities? I I feel like that's... It's not like the threats just diminish just because you're a smaller entity. We've seen ransomware target everybody from tiny schools to fortune 500 companies.
Yeah. There's... I've seen ransomware target 7,000 person locations that can come in with a ransom of $3,000,000. I think I worked out on a parameter basis where I was like, this is gonna cause everyone about $400 if they have to pay $3,000,000. Because then that's like a direct cost to customers. Obviously it's more difficult than that but I was doing some of the math. Interestingly in rural communities, I think it's not just the electric side. They also have the hospital problem. They have water for example. There's definitely a whole of community approach that potentially can be considered here. It's something we were working on. How do you look at all these different providers? Because half the time I don't actually think there's two or three more cyber people hanging out in the town waiting for a job. There's a good chance that that community has a limited number of people that have really got that expertise or desire to stay in a rural community with that expertise because I'm not going to lie, you can get paid a lot more moving into a city to do that kind of work.
So it's a big challenge. Think it's going to be a long term challenge as well. We need to build communities around this. I think there's regional approaches that are coming up. I've seen some really cool work coming out of places like Kansas, Arkansas. They're building communities that are essentially not tied to any one particular entity. They can come in though and be a sort of crack cyber team that we're looking for but they can spread it out or have fractional ownership across an entity. Think ownership is a really important piece. If you don't own your cyber team, there's a good chance you won't necessarily know what to do with them when the time comes. So taking ownership or partial ownership of those kind of regional approaches is great and important. I think it's really starting to come together just now though that a 10 person utility serving a small water entity isn't going to hire four people with four different skill sets to just do cyber security.
The chemical engineer might have a problem with that at that point. So I think there's a lot that can be done there. If you get one chemical engineer who's keeping the water clean every day but you've got four cyber people who are helping patch your software, they're not going to be very happy people. That makes sense. And also they can't necessarily afford it.
Right. And you know, with this specialty that's involved in cybersecurity, you know, that sort of approach does make me wonder almost... It feels a little bit like parachuting in. Right? If you have these regional teams even and suddenly something happens on a network you might not be familiar with, I can see how that would be challenging if you don't have that ownership or that preexisting relationship of having the tools needed to actually resolve and respond to that and understand what's going on. But I guess that's where maybe engineering kicks in. You can always fall back to the fundamental physics of the problem. Right? And if something's happening on the grid or in the water, you can hopefully fix it.
I'll I'll let listeners in on a little secret in the interest of transparency. Emma and I are coin carrying members of a very highly elite BIER Information Sharing and Analysis Center, the BIER ISAC. It's a classified top secret cadre of just hackers and cyber professionals. Okay, I'm sort of kidding, but on a serious note, how do you make sure that cybersecurity information gets to where it needs to go in critical infrastructure industries?
One of the great things about the BIER ISAC effort and all the other type of information sharing is I've noticed in the last year, the community is really built to, we don't really care where you work. We will be able to work with you and share information. We're really all there for the same purpose. I don't think a lot of people are there for... Well, some people are there for the money. A lot of us really aren't there for the money or doing it because our paychecks are great. We're doing it because we actually believe in what we're doing. So I think the community is really starting to understand that there's this information sharing that has fixed problems that was nothing to do with anything official. And it happens a lot and it's good. I think we need to find ways to make that spread because I think The US itself is a huge giant community of people who really want the same thing and everybody's trying. But the information sharing in that community is fantastic and I think it's got some real potential to be a natural thing that people think about.
The Electric Subsector Coordinating Council you're referring to there just for the acronyms. Yes. I know this. In the DC area, we're used to the acronym soup a little bit.
Well, my initials are EMS. How'd you think I got here? My initials are Emma Mary Stewart. So I... That was it. They gave me a name that was bound to end up doing this.
I... It's wonderful. I love it. That's... And my parents did not think this one through. The community is really the community is really growing. You can see people coming in who are brand new and they definitely there's a like a special woman in cyber that there's different groups that help people get ahead, work out what to do, work how to work through the system that is still predominantly a male system as well. So working your way into this is not always easy. So I think the community is really helping at that point.
Well, I noticed watching from afar, I guess the S4 conference, it sounded like there was an event that's been quite a success geared toward just that issue of elevating the networking opportunities and entry and career advancement possibilities for women in cyber that takes place at that conference. Were you able to participate in that?
One of the things that happened at S4, which was wonderful. I get a little claustrophobic when I'm around too many people. I walked into the Women in ICS event, Industrial Control Systems, and it was too busy for me, which is one of the best things I think I saw at that conference. I felt like there was so many women there that I shocked and happy to stand back and watch it because it was a wonderful thing to see. I was actually happy to be claustrophobic at an event for once in my life. So I think it's been a really great initiative from Dale and the S4 crowd to keep pulling people people in. I've definitely made new contacts and got new friends out of that who are all working in the same industry. I think it's a great way to keep encouraging it. Think his 100 sponsored tickets that come to the event as well, you could definitely see the enthusiasm there as well. So I've always said one of the biggest things you need to do to get ahead in this industry is to show up.
Well, to your point earlier about fostering this community and just how many problems end up getting solved by some of those serendipitous connections and people who know each other and, Oh yeah, I can call Emma up and share this or whatever. And you just have all that built You know, I guess the one concern I have with that approach is, is it something that can really scale? And as we're tackling these global problems that cross international borders and state levels in The US, how can we really move the dial on the cyber threat?
I do think Cyber Mutual Assistance is coming around to that model as well. There's new initiatives that are starting to partner with, say, local guard units, other different entities that could be helpful. I think that is starting to grow. Just... Scaling is difficult but on a state by state and state local level, I think there's real potential there that's coming. We just need to potentially move faster at this point because we can only negotiate so much before something actually happens. So, think they're really trying to grow at the moment. I think there's ways the community can help as well. Potentially getting rid of this whole sort of vendor critical infrastructure entity split as well could be helpful. If you're more willing to work with different vendors, then there's more people available to you as well. So we'll get there eventually, though. It's just going to take a bit of negotiation.
We've talked a little bit about these companies that just might not be able to afford the cutting edge technology and super sophisticated cyber capabilities and free trials might not really cut it to defend in the long run. So what else can be done to address that issue of limited resources for some of these entities?
The resources are generally... I don't see a world where those resources suddenly are available. Like we can't necessarily increase people's electric rates to cover all these new products that are sort of flying around the system at the moment, Especially when people can't necessarily define with a decision support tool what they actually need. It's easy to follow some of the news and be like, Oh, I absolutely need this tool right now. They told me everything is bad. It's similar to going to take a vitamin because you heard it was the latest thing that was going to stop you getting a disease. In the end, I think there's a decision support that the community can help with building how you pick the right products. Even just getting the basics right at this point. We could put the most advanced measurement tool in place. We could put 10 people standing around it. If you've got a giant hole in your system that you didn't patch, what was the point in putting monitoring in place?
Because you just see it coming then, that's all. Like so... I think decision support is really important. There is quite a wide gulf that's forming just now between the entities that can't afford this and the ones that can. I think that gulf might be getting bigger the more products that hit the market. So reliance somewhat on these vendors, these sorry vendors, but reliance on people that are essentially creating new products is hard.
Switching gears to a little bit of a more personal note, you've been open about your cancer survivorship. I guess What has that path been like for you both personally and professionally?
So yeah, I diagnosed with breast cancer when I was 32 years old. I was working at one of the national labs. I had... It was a complete surprise. Talk about retirement cybersecurity and events popping up from nowhere. That was definitely one of those for me. I have no family history so it was a kind of a giant surprise suddenly. I'd just done an Ironman as well and I was pretty much about as fit as any human can be. So that's probably why I'm so open about it is I like to make sure people know that these things can happen. I also do believe that we should be bringing our whole self to what we're doing and people understanding that everyone is human and things happen is really important to me as well. I've heard too many friends hiding bad things that are happening to them while they're in their employment because they might be concerned that everyone judges them. I think people need to talk more about the things that are impacting them because it's a stressful environment to work in to begin with.
So when something is happening, think it's important. But I think that was my lesson in human resilience eight years ago was, Okay, I'm gonna power on through this one. I was really lucky in that was as fit as I was. So my fitness declined obviously but I came back pretty strong. Not everyone gets that luxury so I understand it can be really hard. But I'm lucky human and I found it and survived it. So here I am, a lot of it's luck. But do think that there's a lot of lessons on the resilience side that I apply to my work every day. I'm a really resilient human. I can come back from a lot of things pretty quickly. I usually have a role now that I take a day to recover from something bad and then that day can be my worst day. Can eat all the chocolate but the next day, get to wake up and put back on my shoes and keep going. That's it. Get back up and keep moving forward is generally my approach.
I was very lucky though. I kept working. The first day I turned up on a phone conference with bald head because I was in chemo, I made a running joke that I, Look at me, you made me tear all my hair out with frustration just to get everyone past the moment of, my goodness. So yeah, I got used to the sad face and then I would generally... My sense of humor is dark and ridiculous. So I make jokes to get people over it. But it was important to me to show up as well because I look how I look and I think that's important also.
No. I think that's a valuable lesson. And your point on human resiliency is so powerful. I think it's really impressive that you navigated that challenge and continue to work. And I guess, what would you say to listeners who may be battling cancer or have loved ones undergoing treatment?
It's never going to be easy. I don't want to pretend or minimize how hard battling these things are. I think some people are like, Well, you were fine. I was like, Well, no, I still went through 16 rounds Chemo was still pretty hard. I do like to say to people like opening up and saying what's going on is really important. Your family listening to what's going on is also hard. It's really hard to accept that somebody in your life is going through something that might kill them. And people do tend to be like, Oh, yeah, you'll be fine. I do think sort of accepting that you're going through something hard and finding a way through it. It will be over eventually. You will. It will be a horrible period of time but at some point you'll get back up. And that's important for people to see. Some people do get back up, some people don't but it's a factor of life that you can't really control at this point. So if it hits you, just keep moving forward.
That's my just keep swimming to reference a movie as well is what I say fairly frequently when things are bad. But just keep moving forward is important.
Well, it sounds like if you were competing in Ironman competitions, you were quite the adept swimmer as well or still are. I don't know, are you still on the tri circuits?
No. I hung up my, I don't know, three sports a couple of years ago. I decided it was time. I wasn't enjoying it quite as much as I used to. I'd I'd gone to world championships for half Ironman and I... That was my goal. And after that was gone... I actually did that after cancer just to self promote a little bit.
After I got to do that, I I decided to take up more... How how do I put this? Less safe sports, as it turns out? Decided to take up things like downhill mountain biking. I decided to take up downhill mountain biking and a few other things where I raced competitively for a while. But right now, I'm just focusing on being fit and enjoying my life as well.
Downhill mountain biking. One of our recent guests, Nicole Perlroth, was talking about heli skiing, and now we have you downhill mountain biking. What am I? Am I going to have to take up, like, deep sea cave diving or something? Or I I I don't know. But in any case, it's really impressive stuff. And I guess you've kind of already answered this. I don't know if you put your world champion Ironman competition on your LinkedIn, but we ask all of our guests this question, which is, you know, what's something we wouldn't know about you, Emma, just by looking at your LinkedIn profile?
Well, probably related to that, I obsessively collect bikes. I've got bikes in three different states and some have motors, some are for downhill, some are for triathlon. Because I've done so many weird sports, I started to collect all these bikes all over the country. And I love them. I'll go ride anything with two wheels on it and I'm kind of known for that at this point for various people but I probably haven't put it on LinkedIn because that's... You know, one day I might just post a picture of a bike but I think it's became known I might turn up at any meeting with a bike bag in hand.
Love it. Are are we counting e bikes as part of this distributed electric future that we discussed earlier? Is that is that maybe not enough of a load right now on the grid?
I think e bikes are pretty cool. I haven't quite got there yet. That might be the next purchase. The danger is I get far too far up a hill and then because my fitness didn't stop me, I am way high up now. Gotta come down somehow. That's the danger. That's why I don't have one. So it's
That's fair. That's fair. There there is that temptation there. Well, thank you so much, Emma, for joining us. Really appreciated your insights on the nature of the cyber threat and grid resilience and just some of your own personal, stories there. So thank you so much, and hope to catch you soon around the beer ISAC secret table.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little infosec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
