Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Lifelong Hacker Alyssa Miller Breaks Down Cybersecurity Barriers
Guest:
Alyssa Miller
Published:
Updated:
Duration:
40 min
Episode summary
Alyssa Miller, Business Information Security Officer at S&P Global Ratings and author of the forthcoming book, “Cyber Defenders’ Career Guide, is one of the most provocative, unfiltered and interesting voices in the cybersecurity community. She’s essential reading on infosec Twitter and a regular draw at conferences around the world. In this episode, she dives into all sorts of issues in the cybersecurity community, from incoherent job postings to a lack of diversity—she covers it all. Tune in to find out how you can best address these problems and also learn how to reach out of your comfort zone and forge your own path to success.
Figure out why most cybersecurity job postings “suck” and how the industry can help fix the issue.
Learn how to address key issues that come up during a cybersecurity job hunt.
Identify how to maximize opportunities for personal growth and realize your potential in the infosec community.
Understand how to be a better ally to underrepresented groups in the cybersecurity community.
Hear about the value of diversity and inclusion in cybersecurity.
Ignore the bullet points and apply Alyssa advises reading the narrative at the top of a job description and applying if it sounds like work you can do and grow into. The worst outcome is a no, and you may still make a useful connection.
Entry-level requirements often make no sense She cites research that 91% of job descriptions require a four-year degree and a certification, and that many entry-level roles ask for a CISSP, which itself requires five years of experience.
Luck and help are universal Everyone who succeeded had help and lucky breaks; Alyssa says the difference is whether you take those opportunities when they come and stay objective about your own successes.
Allies need to speak up She asks white cis hetero men in the industry to call out harassment when they see it, because hearing it from members of their own group is most effective.
Security must pave the road Shared responsibility in DevSecOps means security also owns delivery speed, so teams should bring automatable pipeline tools and trust developers rather than create gates.
Topics covered
Talent Gap
Notable quotes
I tell people I've been a hacker all my life and I mean it.
The very, very worst thing they can do is tell you no. Literally, that is the worst thing.
But you don't get diversity of thought by having 20 heterosexual white males sitting in a room talking about how to build cybersecurity defenses.
I mean, if you in security are not doing the things to pave the road, you're standing in the way.
Questions this episode answers
Why are cybersecurity job descriptions so bad?
Alyssa says the field is young with no clear career progression, hiring is hyper focused on specific tools and certifications, and organizations do not understand what makes a good security hire. Disconnects between hiring managers and HR teams make it worse. Read this section
How can I deal with impostor syndrome in cybersecurity?
Recognize that everyone, including well known names in the field, had help and lucky breaks. What matters is how you respond to those opportunities, and you should not be afraid to tell your manager about the good work you do. Read this section
How can male allies help make cybersecurity more inclusive?
Speak up when you see someone being abusive and do not worry about being called a white knight or virtue signaling. Alyssa says it matters when allies step into those conversations. Read this section
What is the most common mistake in security programs?
Not seeing how integrated security is with the business. Alyssa uses DevOps as an example: if security claims shared responsibility, it also has to share responsibility for shipping software fast. Read this section
About the guest
Alyssa Miller is a lifelong hacker, speaker, and mentor who began her career as a programmer on an electronic payment platform before moving into pentesting in the mid 2000s. At the time of recording, she was business information security officer at S&P Global Ratings and was finishing her book, Cyber Defenders' Career Guide, published by Manning. She gave the keynote Sparking Your Security Career at the Diana Initiative conference.
She's also so much more than that. She's a hacker, a speaker, a mentor, and an author of the forthcoming book Cyber Defenders' Career Guide, which we're gonna talk about in this episode.
We'll also talk about diversity in cybersecurity and how to improve representation across the industry and some really smart strategies for how everyone in the community can find their own voice. But first, here's a quick word from our sponsor.
WE'RE IN is brought to you by Synack, the premier crowdsource platform for on demand security expertise. Synack delivers 20 fourseven testing, intelligence, and vulnerability management from a global network of researchers whose work is enhanced by smart technologies to accelerate your critical cybersecurity missions. And now here are your hosts, Bella and Jeremiah.
There's so much to your background that's just exceedingly impressive. And, you know, just starting right off the bat, you know, maybe you could, you know, let us know how you got into the business in the first place. And I say the business, I mean, sort of what it is that you do, what drew you into the cybersecurity space, and everything that you participate in because for those listening, it's a lot.
All right. Well, I'll try to condense it because it's really a lifelong story. Right? I mean, I go back. I tell people I've been a hacker all my life and I mean it. I was that four year old kid that took apart her toys to figure out how they work, to see how she could make them work differently, stuff like that. And it was also that early in my life that I got introduced to computers. My dad was an accountant and he worked for this little HVAC company. They were changing over their accounting system from one year to the next. And the holidays, they never had anyone in the office anyway. So rather than go into the office by himself to close out the books and do this conversion, he brought home this gigantic Zenith computer and kind of pioneered working from home back in the 80s, right? And so when he wasn't working on it, he let me play with it.
And from there I was fortunate enough that we had computers when I was in elementary school. First it was the TRS-80s, then later on they got an Apple lab. And around that same time when I was 12, I got myself a paper route of all things. Saved up a bunch of money. And you know, most kids, this is probably not what you would have expected.
Definitely. It had its moments, especially in Wisconsin winters. Yeah. But most kids, last thing you're gonna expect, especially then we're talking late eighties here, the last thing you expect them to do is go out and buy a computer. That's exactly what I did. Saved up about a thousand bucks, went to Best Buy with my dad and bought myself a computer. And that led to kind of my first hacks where I started messing around with this little community software. Some people might remember called Prodigy back in the day. But honestly, it's still even then, there was no idea that this could be a career path for me. In fact, when I went to college, was pre med. I was all set to be a doctor.
Yes. So I was like scramble, holy crap, I gotta find a different career path, a different major. And I go through the course catalog and they add computer science. I'm like, well hell, I already know how to program. This will be easy. That was not the wisest of assessments. I mean, I'm still glad I went there, but definitely it was not the easy path. But what did work out well was that was during the .com boom. And so I got my first job as a programmer while I was still in school. Because I mean they were just dying to hire programmers wherever they could find them. And I had programming experience. I was going to school to get my degree. I got hired into this financial services company programming on their electronic payment platform. And it was after about nine years of doing that, that the security team, one of the managers I've worked with plenty of times on different projects came to me and asked if I wanted to a pentester on her team.
It was not like we think about it today. I it was mid 2000s, I think. Yeah. Yeah, I mean, people were hiring pentesters, but it was not the norm. Definitely not for just general industry. Obviously financial services kind of led the curve a bit on stuff like that as they still kind of do today. But yeah, it was not something that you saw everywhere. So it was interesting too, when I started working in that field, people had asked what I do for a living and I would tell them, break into people's computers and tell them how I did it before the bad guys can do it. That And was like the easiest way to explain it. Because how do you tell somebody you're a pentest or an ethical hacker? They don't... Most people don't even know what that means.
I do. So it's interesting because honestly, and I hate to say this, but some of it was just because I had a couple of publishers reach out to me. So it worked out well because they came to me at a time when I was doing a lot of research on this supposed skills gap, right? We hear about it a lot. I've seen estimates anywhere from 800,000 to 4,000,000 open jobs in cybersecurity. But on the flip side, as someone who's been here for a while, I certainly try to help mentor other people. And I'm hearing from all these people who are coming out of degree programs or trying to pivot from other areas of technology into cybersecurity. And they're telling me, hey, can't find jobs. People won't hire us. There's no entry level jobs. These job descriptions are ridiculous, etcetera, etcetera, etcetera.
And so I was doing some of that research anyway. And so like I said, I had a couple different authors who came to me. And finally it was Manning, my publisher that came to me finally and was like, all right, yeah, I wanna do this now. I at that point had been through a lot of different things. I was really ready with the research I had done to start putting it down on paper. And I really just... Mean, there's details of just how... What they offer in terms of the book. I mean, like you can go out today, the book's not even published in print yet, right? I mean, in fact, I just turned in my last chapter earlier this week.
But you can go out, you can buy the book now and you can actually start reading it now. So you can read the chapters I've submitted that aren't even final edits yet. This is really something that's needed in the industry, right? Like there's books on how to get into pentesting. There's books that have talked about how to get into a cyber career, but they're all really focused on here's all the talent and all the different tech knowledge you need to build up and how to do that. It wasn't something that looked at the industry holistically and acknowledged that sales is a part of cybersecurity, right? Social engineering, threat hunting, threat intelligence, all these huge map of all the various roles and the diverse personalities that are needed for those roles. There really isn't a book out there that talks about it in that sense. So...
Something that's really important to me is encouraging more folks to join the cybersecurity industry. And so I've been in sort of mentor positions with folks. And the questions that I often get are, okay, cool. Like, I've read the books on how to hack. I understand the tools. That's great. But how do I get a job? How do I approach the industry? What jobs are even out there? And I've had so many conversations just talking about like, okay, well, there's so many more jobs beyond pentesting. Let's talk about what this field really is. And I've never had a resource to be able to have those conversations with. So I'm very excited to plug your book because it will answer all the questions that I've been asked, it sounds like.
I hope so. I mean, that... That's the goal. Right? I mean, right away, chapter one, we're talking about what is cybersecurity? Chapter two is talking about here's all the roles you can do. And chapter three is where it all begins, because it's all about like, how do you find your way in? You probably run into this, if you're mentoring people, I'm sure you've heard people or had them come to you and they say, Hey, can you help me get into cybersecurity? My first answer to that always, that's like a really broad question is, Well, what do you wanna do in cybersecurity? And so many of them are, I get that answer either, yeah, one, they wanna just, pen testing is the only thing they've ever considered. Or they're just like, well, I just want to know all of it. Okay. Woah.
Really realistic. So let's dig into this deeper and how can you explore yourself and figure out, okay, this is what's really interesting to me about cybersecurity. So this is where I wanna go in cybersecurity, right? And that, I think that piece alone is so important for a lot of people, either the ones who only see pentesting as a cybersecurity path or they just don't know. And they just know that, hey, cybersecurity is a hot field. It sounds really cool. I want to do it.
Part of that issue of how do I get into the the security the security field is an issue that you've talked about, which is that a lot of cybersecurity job postings suck. And so why do you think that is? And also, could you give us some examples
I mean, so first of all, why do job descriptions suck? There's a few reasons. One, cybersecurity is still young and it's exploded really quick. Technology is growing super fast. So cybersecurity is growing super fast. We don't really have a good career progression map for anybody. I mean, you think about like, if you wanna be a doctor, it's really simple. I mean, very specific, you go through schooling and you go to specialty school and you get into your residency, blah, blah, blah, all the way up, right? Very structured progression.
We don't have anything like that in cybersecurity. So you've got that piece. You have the fact that we're like really hyper focused then on, well, you've got to know all the tools and technologies that we use in our organization. And so what you see then are these job descriptions that list out this myriad of tools and things that you have to know in order to be qualified for this job.
Oh, I'm getting there. Wait, we're getting there too, right? So those are challenges in and of themselves. And we don't really understand well what makes for a good cybersecurity hire, right? What are the characteristics I should be looking for? I did this survey last year that included hiring managers and I asked hiring managers, what is the one piece of advice you'd give to somebody coming in? And they all say predominantly I think it was like 60% of the answers were passion, have passion, you know some variation of passion. What the heck does that mean? How do you hire for passion? How do you put that in in a a job description so somebody knows if they have passion or not or they know how to demonstrate it? You can't.
So how do we actually start to look at that? What are ways that people can demonstrate that? What are the things, not technology skills that we can send people the training for and they can learn how to use, you know, Security Onion or they can learn how to use some SIEM tool or some cloud security tool. We can send them the training to do that. What are the things I should be looking for in that person that are gonna tell me that they're the right candidate? So because of that, because we don't know really what we're doing quite honestly, we've kind of created this unsustainable model of everybody we hire has to have this high level of skill. So now we, how do we measure that? We try to put all these bullet points in there. We become hyper focused on certifications.
91% of job descriptions call for a four year degree and at least one certification. What's really interesting, 71% of entry level roles that call for a CISSP or equivalent. You know that 5% of the entire cybersecurity workforce right now, or actually less than 5% of the entire cybersecurity workforce has a CISSP right now. And if you're entry level...
Right, you gotta have five years of experience to get it, right? How is that an entry level requirement? So some of the examples that I've seen are like that. Some of the others, one that I use quite often is this three page job description and it's three pages just the way I happen to screen print it and you can barely read it if I throw it on a slide and it's up on the big screen, right? I mean you can't still can't read these bullet points. There's something on the order like 50 bullet points of responsibilities and technologies for this position. Who's that unicorn, right? Like you're not gonna find that. It just doesn't happen.
Where is that disconnect coming from though? Right? Because I know like I I didn't write the job. Like, we've hired more people in my team and I'm not writing the job description for, you know, the teammates that that we hire. But, like, who is? Who's making this mistake? How does that happen?
So that's another interesting thing, right? It is a disconnect between usually the hiring manager and the human resources team. You have organizations that have gone through normalization, they call it, right, a lot of times, where you're trying to set very standard job descriptions for specific titles. And that can be problematic. Now there's reasons that they do this, right? And I mean, there's, you know, especially if you're dealing with federal contracts and things, there are very specific requirements you have to meet. But sometimes that gets done to a flawed level and it causes problems. A lot of times, if you've got your recruitment or your HR team doing that in a vacuum, they can lose perspective or they just simply don't have the knowledge or the wherewithal for how to get that into a job description.
And a lot of times even hiring managers just, you know, they don't take the time to sit down and really go through a job description or they don't know how to write a good job description for a cybersecurity role because who gets training in that? You don't, typically. And all of that's problematic.
There was a gentleman that I was speaking with and this very topic came up and this individual felt like they didn't have the particular skills that was necessary to you know, apply for this role. And as we were talking, I I said, you know, these kind of things happen. Just just apply. Just apply. And submit a resume, submit a cover letter sort of explaining why you think you can do this gig and just apply.
And that's what I tell people too. Always tell them forget about all of the bullet points. Don't look at the bullet points. Read that narrative at the beginning that tells you what the job does. And if that sounds like something you can do and something you can learn and grow in, apply. The very, very worst thing they can do is tell you no. Literally, that is the worst thing. So if that's the worst, what do you got to lose? Apply, put your name out there, get seen. If nothing else, maybe you get to speak to somebody. And even if you're not a fit for that job, maybe you're a fit for something else. Or down the road, they remember your name because you made a really good impression on them. And that creates an opportunity. It never hurts to at least apply to a job.
I want to talk about your recent keynote talk at the Diana Initiative Conference, which was awesome. The talk was called Sparking Your Security Career. For those that don't know, the Diana Initiative is an organization that focuses on increasing diversity in cybersecurity. And I have been able to attend their virtual conferences for the last two years in a row. And both times, I've, like, left the weekend just feeling so excited and inspired and proud. And it really... Like, that conference reignites my passion for security. Anyways, though, I wanted to ask you about, you know, in that talk, you speak about your career trajectory and your drive to take on more leadership roles. And I'm wondering, how did you go through that process to put yourself out there more, assert yourself in the industry, and have a bigger voice in this community?
Wow. You ask tough questions. God, don't even know for sure. So I mean, I got started speaking at conferences kind of just sort of by happenstance. Again, serendipitous events throughout the course of my career, it's really bizarre. But no, as well as working at Fishnet, we were sponsoring a conference in Grand Rapids, Michigan called GrrCON. And GrrCON was looking for more submissions. They had had their CFP out there. They didn't get as many submissions as they had hoped for or whatever. And they reached out to us as a sponsor and said, Hey, do you have anybody who could throw in some more submissions? We wanna get a deeper pool. And I submitted, it got accepted. I gave this talk and I found, honestly, one of the biggest things about it for me that was great was, believe it or not, I'm socially awkward as all get out.
And so what I found was that public speaking at these conferences was a great way to meet people, because now I had an icebreaker. Now I can have a conversation. So that kind of got me started. And it was in 2019 that I got asked to do my first keynote. And ended up, it was my keynote was immediately following the opening keynote that was given by one of this term, but I'll say it, heroes in cybersecurity. Her name is Keren Elazari. And I'd seen her speak at DEF CON, I'd seen her TED Talk. So, okay, I'm already super excited. And we got talking, after sharing a stage, of course we got the chance to talk before and after. And really she just inspired me to get my butt out there and really make something of it. But then the other piece of it really is, I mean, that's kind of the selfish side of it, but I love this community, right?
I tell people I grew up in hacker culture. I was in the IRC rooms on, Undernet way back in the day. And I just, this has always been my place. So as I start seeing opportunities to help make our whole community better, those are things I wanna chase. And that's kind of where that keynote I gave at Diana initiative came from was like, I see the challenges, especially for non males, but even just across the board within cybersecurity of people when they go, being talked out of chasing their dreams, being talked out of just negotiating for what you want from your next job, things like that. And it was like, all right, it's time to use my successes and failures from my career progression in that regard, the lessons that I've learned and give that to some other people and see if I can help them maybe skip over some of those steps I had to go through.
I consider myself an introvert. I have a really hard time meeting new people, speaking in public, recording podcast episodes. Oops. You know, it's... But I feel like I've I've really been inspired by the folks that I've seen in industry, that includes you, that have pushed me to kind of see beyond just my own nerves and realize, like, there's a purpose for this. We're making improvements within the industry. And so you used the word serendipity earlier, and I've also heard a lot of us use words like luck and oh, it just happened to work out this way. So I wanna ask you about something that I think a lot of us in the industry, especially folks starting out struggle with, which is impostor syndrome, which for me, I think I'm connecting those because I I think the way that I see myself having impostor syndrome is by saying that a lot of the reasons that I've gotten places are because of luck.
I wrote a whole chapter on it. Yes. I have lots of advice on because it is that important and it is one of those things that holds people back. And what you just described is a perfect example of it, right? The oh, I just got lucky or so and so really helped me make that happen that wasn't me or things like that. Those are all symptoms of imposter syndrome. And so specifically to that, what I tell people is, look, you need to recognize every person who's gotten where they are today, whether it's me, whether it's Katie Moussouris, Dave Kennedy, Jayson Street, whatever big name you can think of from the security industry. All of these people, they didn't get there by themselves. Somebody helped them out. They had lucky breaks that occurred at some point, fortunate things that happened.
The fact that you had someone helping you, that's like a duh moment. Yes, everybody did. The fact that lucky things happen to you, of course they happen to everybody. The difference between experiencing success or not in regard to that at least is, it's how you respond. Do you take those moments and go after them? Or do you kind of not recognize them or whatever and you let them go by the wayside? Perfect example, from my life, that manager that came to me and said, Hey, do you want to join my pentesting team? I didn't know anything about pentesting. And I told her that. And she's like, Well, you're smart, you'll figure it out. But it was a hard decision for me. I'm like, Do I really do that? I don't know anything about this. I'm a programmer.
I've never thought about working in security before, but I took a leap. It was kind of a leap of faith, but it worked out. It worked out big time. The role I'm in now, it popped up. It was literally somebody who was in my network, the former CISO of our organization, who she had showed up on a CISO panel, I moderated at one point. And so that was how we connected. And I'd seen that on LinkedIn, had posted this position was available. And again, it was like, boy, am I really qualified for that? I don't know. But I took the leap and I asked her. Talked about it. She got me connected with the hiring manager here I sit. And so that is a big thing is just understanding those fortunate opportunities just come up for all of us.
You have to go after them. And then the other piece of it is just being objective in how you look at your own successes. There's that line between humility and conceitedness. Don't cross too far the other side, but don't be afraid of bragging. Don't have to be the super humble person who never admits they did something cool. If you did something cool, tell people about it. Be proud of it, especially tell your employer, your manager, make sure they know that you're doing these really cool things that are bringing value to them. And yeah, I know it's easier said than done, but just recognize that.
So I wanted to ask you about something and you touched on this in your talk at the Diana Initiative, but I think it's worth talking about here. What are some unique challenges that women or I guess non men and underrepresented groups face in this industry? And also how can the industry do a better job of making this field more welcoming and approachable to those folks?
The biggest challenge is that we are underrepresented, right? I mean, so you're looking at, you talk about things that feed imposter syndrome. How about not seeing anybody that you can identify with at high level positions that you aspire to get to? I mean, that alone is huge. That's why Diana Initiative is so important to me. It's like, here's an opportunity for women, non binary, whomever, to see a greater focus put on that representation, to see you know, people who are in high level roles out there speaking, sharing and knowing that, hey, you can do this too. You can get here as well, right? I think that is a big thing that really is a challenge if you're underrepresented in some way. I think it's also very challenging in that there is just toxic behavior that exists toward people from those underrepresented groups.
In particular, and I know anybody who follows me on Twitter, you've seen me thousands of times take on the level of misogyny that exists in a certain subset of the males that are the predominant demographic in this industry. And yeah, it's a small group, but they're a very loud group. And that can be very daunting to take that I mean, just talk to any woman who's gone to a cybersecurity conference and the chances are quite likely. And I saw somewhere numbers like 80% of them will tell you that they've experienced some form of physical harassment. They've been assaulted, they've been touched in inappropriate ways, whatever, myself included. And that's an unfortunate reality.
It's getting better, but from an industry perspective, we have to do better at recognizing A, that those things do happen to people. There is racism, there is sexism, it does exist. We can't deny that it's still there. We have to call it out when we see it. And quite honestly, my white cis hetero males, dudes, we need you to speak up. Because when it's this subset of that predominant group that is responsible for a lot of this behavior, it's hearing it from other members of their own group that will be most effective in helping them understand that look, this stuff isn't acceptable anymore. There might've been a time and a place, not anymore. And so I think that is one thing the industry can do. The other is just embracing the reality that there is a business value in diversity.
If we wanna be better at cybersecurity, having diversity matters. And don't throw that dog whistle at me of, Oh, well we want diversity of thought. Of course we want diversity of thought. But you don't get diversity of thought by having 20 heterosexual white males sitting in a room talking about how to build cybersecurity defenses. It doesn't happen.
I've got I've got really two two questions around that. And and I wanna kinda focus on this area if we can, because it is so important. So there's a lot of toxicity in sort of the Twitter Twitterverse, and I think maybe all of us can can point that out. And so in that toxicity, both in the Twitterverse, in the workplace with diversity, You know, how do you how do you address that? And in the process of addressing that, how do you, you know, if you happen to have any male allies or heterosexual male, white male allies that are in that realm, How do we jump into that and help out there?
So, oh my God, I could go on for days about this, but first, how do I address it? Right? I mean, personally, I call it out when I see it. People are not unfamiliar with me sharing screenshots of really horrific tweets from other people. Some of you might've seen myself, an inverted geek, and a few others take on a certain certification organization in our industry that published some really awful stuff. I mean, that's step one. The other thing though, and this is where I think everybody can start. If you can't come up with any other way to get started in helping, understand this cliche of a rising tide raises all ships. The more you do to raise up other people, the more you're going to elevate yourself. And I think a lot of the toxicity that we do see is people who feel threatened by other entrants into the community.
It's not that they inherently hate women or they inherently hate black people. I mean, in some cases it is. Understand that if you raise up other people that raises you. And I think that happens. Now, when you are one of those allies of which I have countless hundreds that I could name off in a heartbeat. When you see that, when someone, again it's see something, say something. You see that white male or whoever, I mean it doesn't even have to be a white male, it could be anybody. Whoever it is that is being abusive in that way to somebody else. Speak up. Don't be afraid there's this... You get called a white knight or you're virtue signaling...
God, who gives a shit, right? I mean, come on, seriously. Speak up. Know that what you do matters. Know that when I and others are out there arguing with these people or fighting back against the toxic behaviors, that when one of you steps up and steps into that conversation and says, yeah, I agree with these women. You are acting the fool, knock it off. That's meaningful.
Something that I hear all the time when someone says something bad to me, which inevitably happens, I'm a woman in this industry. A lot of times when I when I speak out and say, hey, that's not cool. We don't... We're not accepting that. I hear people say like, that's just how cybersecurity is. That's just like, if you don't like this culture, leave. And I think this conversation reminds me of how important it is for folks to speak up because this is not the culture. It does not have to be the culture. We in this industry set the culture. And I don't know. I guess this is a mini rant. I'm sick of hearing people say this is just how the culture is because it's not.
I just I just wanna rehighlight something. I'm so sorry, Alyssa. There was a quote there I loved. Actually, Bella just said, and I love that. We in this industry set the culture. That's that's that's pretty that's pretty powerful, I think. I don't, you know, just me.
It is. I mean, it's our industry to make and shape how we want it to be. It's our community. I love this community. This community means the world to me. This community, the hacker culture was there when I was that awkward teenager and I had nothing else. I didn't have a lot of friends. I didn't have a lot of anything. I had hacker culture that brought me along. They were my safe place. And I love this community. I want to see it be that for so many others. So you can't... Every one of us has to recognize where we have a certain level of privilege. Yeah, I'm a woman in this industry, so I'm highly underrepresented, but I'm also a white person. So literally today, not two hours ago, I saw an email at work, we were putting together some information and someone mentioned putting together a white list. Now they're white list blacklist.
There's a terminology that we are starting to really try to push out of this industry for the reasons of inclusion and so forth and making people more comfortable just getting away from that idea of white is good, black is bad. Right? I mean, Was that person who wrote it inherently racist? No, I doubt it, But understanding the impact of language and what that means in terms of that, my immediate email response was, Hey, I like what you wrote here, but can we take this term and change it? Just a simple thing. Know, I mean it's day to day corporate environment. It's not always that you see somebody attacking someone else. It's just, hey, you know what? Here's this thing I saw happen. Could we just change it? Could we just, you know...
Yeah. And and obviously not did I come after him in some woke sense and attack him or anything. No. It was very simply just, hey, you know what? The industry's kinda trying to get away from that terminology. So could we change that to say allow list instead? Done. Everybody took to it fine. They understood it and they're fine with it. Okay, moving on. And that's all it has to be. And now you know that that person, the next time that they're thinking about that, that little moment there will come back and instead of writing white list, they'll like... They'll write allow list.
Yeah. I think, like, this kind of... This topic is what I... Is kind of one of the biggest things that I've really wanted to talk about in this podcast. It's something that is so important to me. I truly could probably talk about it for hours, but I wanna switch back to kind of the more technical side of things. You have so much experience working as a consultant, the business side of things, the business side of security programs. And so I have a question for you about all of that. What is one of the most common missteps that you see in organizations security programs?
Honestly, and this is gonna sound really ethereal, but it's not seen how integrated we are with the business and our role in that sense. The example of this I use is think about the idea of DevOps or DevSecOps, right? I mean DevOps shows up on the scene in 2008, 2009 and security scrambling, how do we get involved? DevOps is out there preaching this idea of shared responsibility. That was the whole point of DevOps. How do we make operations and developers equally responsible for getting software delivered efficiently, quickly, stable. Security comes to the door and we say, well, we're gonna force our way in here. And what happens when security starts talking about shared responsibility?
We destroy the message. We come in and we say, yeah, shared responsibility. Everybody's responsible for security. There's a certain arrogance in that. Like what about security being responsible for software getting out the door fast? If we're gonna say, the dev, you're responsible for security. Hey, guess what? That means you're taking on the part of that responsibility then to make sure that the software goes out the door fast. Which means you better come to the table with tools that can be automated in a pipeline, that can be a part of the development phase. You're going to trust your developers with a certain level of enablement and accountability that says, hey, we're gonna give you these tools and we're gonna trust you to run them. We're not gonna sit here and hover over you. We're not gonna create gates that hold you up or keep you from moving.
And that's really what it comes down to. I mean, if you in security are not doing the things to pave the road, you're standing in the way. Get out of there. Get out of the way.
If any of our listeners would like to get in touch with you, learn more about you, hear more from you, read more about some of the views that you've posted, and also read your book, how can they go about doing so? What's the best way?
So you can follow me on Twitter. That's an easy one. Alyssa m underscore info sec. Probably the lamest Twitter handle ever in the history of mankind, but hey, it happens. That's a different story for a different time how that ended up as my handle. My website as well, alyssasec.com. Again, Alyssa Miller was taken because there's some model Sports Illustrated, I don't know, whatever. She's not important. No, seriously check out the website.
And then our final question for you, which is the question that we ask everyone at the end of the show. What is one thing that we wouldn't know about you just from looking at your LinkedIn profile and your online social media?
Well, let's see. My social media has all the pictures of everything behind me, like my guitars and photos, you know all that. Let's see. The fact that I'm a soccer referee. In fact, fall soccer season spinning up. I'll be working lots of college games this fall, four or five for the big 10. So there you go. That's something most people don't know.
honestly. Alyssa, thank you so much for talking with us today. And if you enjoyed this discussion as much as we did, please be sure to subscribe, share, and leave us a five star review on Apple Podcasts.
Cloud cybersecurity is a large penetration point for malicious actors. See how your organization can be protected at synack.com. That's synack.com. Check out the show notes to learn more.
