Organised by Eskenzi PR in media partnership with the IT Security Guru, the Most Inspiring Women in Cyber Awards aim to shed light on the remarkable women in our industry. The following is a feature on one of 2024’s Top 20 women selected by an esteemed panel of judges. Presented in a Q&A format, the nominee’s answers are written in their own words with minor edits made by the editor for readability and where relevant, supplemented with additional commentary by their nominator.

In 2024, the awards were sponsored by BTThink Cybersecurity Ltd. and Plexal, with Eskenzi PR, Assured and Women in Cybersecurity UK & Ireland Affiliate as partners.

What does your job role entail?

So many different things – mostly talking too much 🙂 No two days are the same – one day I could be speaking at a conference, the next I’m in meetings helping define thought leadership topics, or coaching speakers, and helping our marketing team hone thoughtful honest messaging. I’m also part of the go-to-market leadership team so I work closely with so many people across the business, our customers, and our partners.

I also help out with organising a few BSides conferences in the UK, and I’m and advisor to the board for an AWESOME initiative called The Hacking Games, so work doesn’t stop when I close my Exabeam laptop.

How did you get into the cybersecurity industry?

I don’t expect anyone else will give this answer… I was a travel agent. Through a somewhat ‘sliding doors’ style chain of events, I ended up as the business travel consultant for a company then known as Network Associates, which became McAfee. They hired me to be their receptionist, on the premise that I would be able to find my path there. That was almost 25 years ago so clearly it was a great move!

What helped, without question, was my Mum realising in the early 80s that there might be something in these computer things, so she bought me one when I was four years old, and another when I was six, so I’ve been a self confessed nerd from a very young age. Chatting to the Network Associates team I got the bug for cybersecurity (there were the early days of mass mailers) and I now honestly can’t imagine working in any other industry.

What is one of the biggest challenges you have faced as a woman in the tech/cyber industry and how did you overcome it?

I used to say this was during the early days of working in support and form time to time I’d get a customer being weird about the fact they were talking to ‘a girl’ – I managed to win them over but it was a little frustrating. Nowadays as I’m navigating the joys of middle age, peri-menopause has kicked in, and this has been unquestionably more challenging on a personal level. I’ve got a great support network though, and I’ve learned a lot in the few years this has been part of life, so it’s manageable. What’s also helping me is just talking about it more – with colleagues, friends, and in interviews like this. There are a around billion people on the planet right now who are either in stages of the menopause, or have gone through it, so it really shouldn’t be a taboo subject.

What are you doing to support other women, and/or to increase diversity, in the tech/cyber industry?

It’s super clear how important the many flavours of diversity are to having a creative thriving industry – and it’s not just about which bathroom people use! At Exabeam I’m a member of some of our employee resource groups – Exagals, Pride, and Ex&ND, plus I’m on the overall Community Council that oversees the ERGs.

I’ve also started a women leaders group called ‘Embrace the Change’ which brings together current and future leaders to learn together and share stories. We’ve had two menopause speakers come to events, as well as speakers and panels on a host of other topics, and we welcome everyone – allies are vital to any cause.

My part time projects are very focussed on diversity too. Both the BSides where I’m involved on the call for papers, speaker line ups, and education programs we are hellbent on ensuring diversity is represented to ensure we inspire all sorts of people to join and flourish in the industry. It drives me mad when people say they can only find middle age white guys to speak at events – and I know some incredible middle aged white guys who are great speakers, but there are plenty of other awesome options when you’re building out a conference program.

And at The Hacking Games – which is all about bringing young people into the ethical side of hacking, we’re building out some awesome media and gaming project, plus I’m partnering with some incredibly talented young hackers to help build the industry of the future – watch this space for some announcements on this very soon! It’s a really exciting project.

What is one piece of advice you would give to girls/women looking to enter the cybersecurity industry?

Do it, do it, do it! There is a plethora of paths and roles available – it’s not just about coding! I haven’t written a line of code since 2006, and I wasn’t particularly great at it then! Creativity, passion, plus a desire to help the world be a better place, are vital to driving and advancing this incredible technological world in which we live.

Come to some community events, chat to people who are already in the industry and find out what the options are – I think you’ll be pleasantly surprised.

The post #MIWIC2024: Samantha Humphries, Senior Director of International Security Strategy at Exabeam first appeared on IT Security Guru.

The post #MIWIC2024: Samantha Humphries, Senior Director of International Security Strategy at Exabeam appeared first on IT Security Guru.

Organised by Eskenzi PR in media partnership with the IT Security Guru, the Most Inspiring Women in Cyber Awards aim to shed light on the remarkable women in our industry. The following is a feature on one of 2024’s Top 20 women selected by an esteemed panel of judges. Presented in a Q&A format, the nominee’s answers are written in their own words with minor edits made by the editor for readability and where relevant, supplemented with additional commentary by their nominator.

In 2024, the awards were sponsored by BTThink Cybersecurity Ltd. and Plexal, with Eskenzi PR, Assured and Women in Cybersecurity UK & Ireland Affiliate as partners.

What does your job role entail?

As the Head of SecOps for the largest greenfield technology transformation project in Europe, Lianne is building a leading edge security team from scratch to meet the needs of a modern retail organisation while empowering her team to think innovatively to create new standards in best practices.

Lianne has delivered talks across the globe to share her vision for a new type of security function.

Drawing upon her expertise as a cyber-anthropologist (through her consultancy, The Anthrosecurist), her practical experience as a security-focused software developer and as a security practitioner; Lianne combines the human and the technical aspects of security to evangelise a cultural security transformation.

She is on the advisory board for a community enterprise aimed at encouraging diversity in tech, is a published author, podcast regular, and recently won Computing.com’s Security Specialist of the Year for her work on human-centric approaches to security.

In 2021 she won two awards for Security Leader of the Year 2021 and Woman of the Year in the Enterprise category and in 2023 she won ‘Cyber Personality of the Year’ in The Real Cyber Awards.

You can listen to Lianne talk about her human-centric approach every Thursday on her podcast Compromising Positions, in which she interviews non-cybersecurity people from the world of anthropology, psychology and behavioural science about cybersecurity culture.

She is doing a Masters in AI and Data Science in 2024.

How did you get into the cybersecurity industry?
Lianne was a wedding photographer for ten years before she decided to re-train as a digital anthropologist, studying the cultural complexities of a life lived online. It was in her first job as a digital anthropologist that she began seeing the pressing need to ensure that technology was build with a focus on being human-centric throughout the process, from build to the end-human using the product/service. It was this need that convinced her to study a technical trade alongside her anthropological skills, so she taught herself how to code using free online resources with the hopes to become a human-centric software developer. That ambition was realised when she got her first job in tech as a software developer on the NHS’ graduate training scheme. It wasn’t long before Lianne became interested in the outputs of pentest reports (and remediating them!) that she began to considering adding a further skill to her new tech chops: cybersecurity! After a year of persistence (begging) in convincing the cybersecurity team to take her on, she finally managed to get a job as a SOC analyst overseeing 1.5m endpoints across NHS sites in the UK. Since then she has had several roles in cybersecurity, and has established her own consultancy utilising her past experience as an anthropologist to deliver ‘cyber anthropology’ to organisations serious about changing the security culture of their environment, and hosts a top charting cybersecurity podcast called Compromising Positions, focusing on changing security culture.
What is one of the biggest challenges you have faced as a woman in the tech/cyber industry and how did you overcome it?

On Lianne’s first day in tech she overheard another team suggesting that recent cohort of graduates into the tech programme (the one Lianne was a part of) was merely a diversity initiative, and that the women who got a place on the scheme were ‘diversity hires’ and not there on merit. This obviously wasn’t true as there was a robust interview and technical element to being successfully offered a place on the scheme. Lianne reported the incident and the matter was dealt with but looking back, Lianne now feels grateful to have been faced with such adversity so early on in her career. It spurred her on to do talks, set up code clubs and be a very public advocate for career re-trainers and women in tech. Her aim with these talks is to raise awareness and ensure no-one will every have to have a first day in tech like she did.

What are you doing to support other women, and/or to increase diversity, in the tech/cyber industry?

Lianne is a big advocate of deeds, not words to encourage more diversity into tech and cyber. She is fortunate enough to lead a technical team with a 50/50 gender split which is almost unheard of in the industry. She does this by ensuring flexibility (down to offering all roles on a part time and job share basis – also rare in the industry), mentorship and advocating opportunities for others. The thing Lianne is most proud of however, is for the last two years, during International Women’s Day, she offers up her skills and expertise in coaching women on how to ask for pay rises. She has successfully coached 11 women who have had great success in negotiating for pay rises or promotions, including one woman who successfully managed to negotiate a £20K increase.

What is one piece of advice you would give to girls/women looking to enter the cybersecurity industry?

As a hiring manager, Lianne never expects anyone to meet the job spec 100%, so don’t be afraid to apply even if you only meet about 70% of the criteria! A good leader is always looking for potential, not perfection.

The post #MIWIC2024: Lianne Potter, Head of SecOps at ASDA and Cyber Anthropologist at Compromising Positions first appeared on IT Security Guru.

The post #MIWIC2024: Lianne Potter, Head of SecOps at ASDA and Cyber Anthropologist at Compromising Positions appeared first on IT Security Guru.

Organised by Eskenzi PR in media partnership with the IT Security Guru, the Most Inspiring Women in Cyber Awards aim to shed light on the remarkable women in our industry. The following is a feature on one of 2024’s Top 20 women selected by an esteemed panel of judges. Presented in a Q&A format, the nominee’s answers are written in their own words with minor edits made by the editor for readability and where relevant, supplemented with additional commentary by their nominator.

In 2024, the awards were sponsored by BTThink Cybersecurity Ltd. and Plexal, with Eskenzi PR, Assured and Women in Cybersecurity UK & Ireland Affiliate as partners.

What does your job role entail?

In my role, I’m responsible for all aspects of cyber security, that means making sure we are keeping up with the cyber landscape, we are operating in a cyber resilient way across the business and we have a positive security culture at all levels. Being a CISO is a daily balancing act that goes beyond the technical. The security of the company is at the heart of every decision I make but it’s important to ensure security is not hindering business progress, rather, ensuring the business moves forward and stays competitive in the most secure way possible.

How did you get into the cybersecurity industry?

I studied an Ethical Hacking degree in Dundee, and have worked in the industry since I graduated. However, I didn’t always want to work in cyber security, and I certainly didn’t want to work in IT when I was in high school! I loved science, particularly biology and I knew I wanted to help people in my job so I wanted to pursue a career in pharmacy. But I was rejected from all pharmacy degrees I applied to, and I had no plan B. I hated school computing but it was my strongest subject so with no other career options on the table, I decided to investigate how I could help people through IT instead of medicine. I had never tried to hack into anything so really didn’t know if Ethical Hacking was for me, but I loved the idea of helping people and businesses stay safe from hackers so I took a leap of faith and started my degree. I’ve had my ups and downs through university and my career but pursing cyber security has ultimately turned out to be the right choice!

What is one of the biggest challenges you have faced as a woman in the tech/cyber industry and how did you overcome it?

In my experience, I’ve been underestimated, undermined and disrespected on far too many occasions and I’ve considered leaving the cyber security field more times than I’d care to admit. I’ve found particularly in leadership roles I’ve had to be more confrontational than I would naturally like just to be heard, and to set my professional boundaries.

Having worked in several toxic cultures, I used to feel quite angry and disheartened but I’ve realised how essential it is that I continue to fight against this, both for myself and for other women. I’ve grown as a cyber leader, developed a thicker skin and know how to deal with poor attitudes and exclusionary behaviour quite quickly. Yes I am often underestimated, but it doesn’t tend to be for long.

What are you doing to support other women, and/or to increase diversity, in the tech/cyber industry?

In my day-to-day work I will not tolerate behaviour which is exclusionary and disrespectful of women. Having worked in toxic cultures, I always strive to foster an inclusive and welcoming culture in my teams. I want to attract the most talented people to my team, from a whole range of backgrounds so we have different approaches, different thought processes and ultimately different and unique ways to stay cyber secure.

I have been involved in the women in tech community since university and have spoken at many events, hosted my own events and mentored some exceptional women. I’m a trained STEM ambassador and have went into schools to help inspire the next generation of girls to choose cyber security, but I’ve also spoken at events for women returning to the workforce, and women already at university who may want to consider cyber security. I also had the privilege of being the keynote speaker at IT’s Not Just For the Boys twice.

What is one piece of advice you would give to girls/women looking to enter the cybersecurity industry?

Own the space you have, know you have every right to be there and constantly remind yourself that you have the skills, knowledge and background which allows you bring something unique and invaluable to your work.

The post #MIWIC2024: Chelsea Jarvie, CISO and Director at Neon Circle first appeared on IT Security Guru.

The post #MIWIC2024: Chelsea Jarvie, CISO and Director at Neon Circle appeared first on IT Security Guru.

Organised by Eskenzi PR in media partnership with the IT Security Guru, the Most Inspiring Women in Cyber Awards aim to shed light on the remarkable women in our industry. The following is a feature on one of 2024’s Top 20 women selected by an esteemed panel of judges. Presented in a Q&A format, the nominee’s answers are written in their own words with minor edits made by the editor for readability and where relevant, supplemented with additional commentary by their nominator.

In 2024, the awards were sponsored by BTThink Cybersecurity Ltd. and Plexal, with Eskenzi PR, Assured and Women in Cybersecurity UK & Ireland Affiliate as partners.

What does your job role entail?

I am a knowledge management subject matter expert, with a primary focus on the ingestion, standardisation, verification, documentation and publication of critical indicators and threat intelligence. My goal is to ensure such critical information is searchable and accessible to the varying teams, tools and community members who need it. I am a proud member of Secureworks Counter Threat Unit and an advocate for DE&I activities in my workplace.

How did you get into the cybersecurity industry?

I got my first job in Cyber Security after being headhunted for a Personal Assistant role at Secureworks. But I *really* got into the field when I took up my subsequent roles in Secureworks as a Change Manager and Coordinator. This was the role where I really begun to understand the needs and concerns of organisations from a cybersecurity perspective, ranging from compliancy checks, to red-teaming, to threat hunting, to compromised networks and beyond. It was my first role directly communicating with customers during their time of need, and inspired me to think ‘What could I do more to help’.

What is one of the biggest challenges you have faced as a woman in the tech/cyber industry and how did you overcome it?

Still to this day, I struggle regularly with self-doubt. I have always been someone who wants to jump in and support, but always questioned ‘Am I the right person?’ and ‘Can I do this?’. I’m not sure where it comes from but I do know I am someone who needs reassurance and affirmation to know I am pleasing my leaders and organisation. As I said, this is still something I feel to this day, but I am embracing it and have spun the self-doubt to actually be that I care deeply for what I am doing, that the concerns and nervousness is just because I simply care that much. That helps me feel more at ease with it all.

What are you doing to support other women, and/or to increase diversity, in the tech/cyber industry?

I am an active mentor and have push myself both in and out of work, to reach as many people as possible. In 2023 alone I undertook more than 30 initiatives to drive diversity and inclusion with an outreach of 2000+ people. This included presenting on many occasions on threat intelligence and industry specific knowledge, offering coaching, supporting STEM and female-focused events, working alongside SENCO and neurodiversity programs, as well as creating various blogs and podcasts.

What is one piece of advice you would give to girls/women looking to enter the cybersecurity industry?

You can do it! There is a space for you. It can be hard when you look at a cyber security organisation but cannot see anyone like you and so therefore aren’t sure to apply. But the fact is in industry we are there and we see you and we want you! My second piece of advice is to not be hung up on the need to be technical. Yes there are roles which require technical skillsets, but cybersecurity isn’t all coding and hacking. As long as you are keen to learn and ultimately want to help keep people safe, then there can be a place for you in Cyber Security.

The post MIWIC2024: Rebecca Taylor, Threat Intelligence Knowledge Manager at Secureworks first appeared on IT Security Guru.

The post MIWIC2024: Rebecca Taylor, Threat Intelligence Knowledge Manager at Secureworks appeared first on IT Security Guru.

Organised by Eskenzi PR in media partnership with the IT Security Guru, the Most Inspiring Women in Cyber Awards aim to shed light on the remarkable women in our industry. The following is a feature on one of 2024’s Top 20 women selected by an esteemed panel of judges. Presented in a Q&A format, the nominee’s answers are written in their own words with minor edits made by the editor for readability and where relevant, supplemented with additional commentary by their nominator.

In 2024, the awards were sponsored by BTThink Cybersecurity Ltd. and Plexal, with Eskenzi PR, Assured and Women in Cybersecurity UK & Ireland Affiliate as partners.

What does your job role entail?

I founded Cyber Security Unity Limited (formerly the UK Cyber Security Association) to help bring the cyber security industry together to go some small way towards combatting the growing cyber threat. My role involves working on key initiatives and projects in various workstreams including for women in cyber, stress/burnout/mental health in cyber, neurodiversity in cyber security (I neurodivergent myself and diagnosed with autism in 2018 and ADHD in 2023), combatting bullying and abuse in cyber security, our “Generation Cyber” campaign, our AI and Security workstream and more. I’m also responsible for our community channels, strategic partnerships, content hub/events and ensuring our members and partners are happy with the direction that Cyber Security Unity Limited is going in, and I I love the large variety of things I get to work on. Community and awareness in cyber security is very important to me; I see a lot of siloes in our industry and my aim with Cyber Security Unity Limited is to break down some of those siloes and get the industry working together more effectively. We talk a lot about the same challenges and frustrations in cyber security, and I aim to bring about some positive change and progress for those challenges.

How did you get into the cybersecurity industry?

I spent many years working in the entertainment industry at the management company of leading TV and radio personalities in the UK, and I worked predominantly with Chris Tarrant of “Who Wants to be a Millionaire” fame before Jeremy Clarkson took over as the host of the show. My ex, however, was very high up as a ethical hacker/penetration tester and she did a lot of penetration testing work for the government and the MOD, much of which she couldn’t tell me about as she was bond by the official secrets act. I was always fascinated with the psychology of hacking and cyber psychology though, and the human elements of cyber security. To help her do her day job quicker, my ex invented a software tool in her spare time that scans routers, networks and firewalls and looks for vulnerabilities in the config files that need fixing. I joined the business in 2009 to help with her increasing workload, and suffice to say I never looked back. Once I was in cyber security, I was hooked.

What is one of the biggest challenges you have faced as a woman in the tech/cyber industry and how did you overcome it?

I entered the cyber security and tech industry in 2009, 15 years on and we are still talking about many of the same challenges. These are things like the gender pay gap, the cyber skills gap, the lack of women in the cyber security industry and the lack of diversity at conferences and events when it comes to speaking opportunities. Things are getting better, and some progress is being made, albeit slowly. I’ve also never been afraid to call things out when I see them, for example, in 2019 I attended the annual Infosecurity event when it was at Olympia, and on the Wednesday of the event I was walking around the exhibition. It was only 10am in the morning when I saw some trolleys loaded up with beer bottles being wheeled to some of the booths. I thought maybe they were for Happy Hours later in the day, but it turned out that some exhibition stands were offering bottlers of beer out to the men to entice them into their stands, but ignoring women completely! I didn’t want a beer but as an exercise I deliberately walked past some of the booths that were doing this, and sure enough, not once was I offered a beer, but plenty of men were offered one! I wrote about this and called it #BeerBias, and raised it with the organisers at Infosecurity. Today they only allow beer and alcohol to be offered on stands at the end of the day and during designated Happy Hours.

Another thing that happened to me was when I was working at a leading not for profit cyber security organisation a couple of years or so ago. I was offered a “Head of” role by the CEO who said that the position came with a £5k salary increase. But in real terms it didn’t, as I had already taken a salary cut of £4k to go there, so the increase was only £1k. But I believed in them and what they were trying to do at the time, which is why I took the slight drop. I then found out that the CEO had offered a “Head of” equivalent level role to a male counterpart that came with a £15k salary increase for him. I was so horrified I resigned straight away. It went against everything I believed in, and I was lucky to find something else relatively quickly. I appreciate not everyone can just leave when they find out things like this like I did, but I could not continue at this organisation after they had shown a huge amount of contempt and disrespect for women in the industry, it was so wrong.

These are just a couple of examples, I’ve seen many others where women have been treated less favourably or singled out.

What are you doing to support other women, and/or to increase diversity, in the tech/cyber industry?

I’m currently working on a range of initiatives to support other women in cyber security and to increase diversity. These include:

– the creation and launch of a campaign called #GenerationCyber which aims to get more women into the cyber security industry, as well as those from minority backgrounds and those who are neurodivergent into the industry. We are all #GenerationCyber, and cyber security is something everyone should have on their radar.

– I am a coach and mentor for women looking at getting into the industry, and regularly give up my time to support those who I coach and mentor into careers in cyber security. I also provide resources and help for tackling bullying and abuse in the workplace (something I have lived and first-hand experience of)

– the release of the third volume of my book “The Rise of the Cyber Women”. I launched this 2 years ago as I wanted to showcase some of the amazing women in the cyber security industry with a view to inspiring the next generation into careers in cyber. I also wanted to shine a light on the many different pathways into the industry and dispel some of the myths to getting into cyber security. The next volume will be released on Friday 8 March 2024 – International Women’s Day. [Editor note: the book can be found here]

What is one piece of advice you would give to girls/women looking to enter the cybersecurity industry?

You will come across bullies and abusers not just in cyber security but in life who nine times out of ten will also have narcissistic personality disorder or narcissistic personality traits. Sometimes women will also target other women, which is very disheartening as we should supporting each other, not tearing each other down.

If you find yourself targeted by one of these unfortunate individuals, my advice is to disengage as much as you can and deploy what is called the “grey rock” method, which is to give these individuals responses that are as benign as you can make them. When they realise they can’t get to you or manipulate you, this makes you less interesting to bullies and abusers.

Please don’t take it to heart if you are targeted though, although I know having been targeted myself by bullies and abusers many times, it is easier said than done. It says MUCH more about them than it EVER will about you. You are more than enough, please don’t let bullies and abusers dull your shine, keep being authentically and unapologetically you.

The post #MIWIC2024: Lisa Ventura MBE, Founder of Cyber Security Unity Ltd. first appeared on IT Security Guru.

The post #MIWIC2024: Lisa Ventura MBE, Founder of Cyber Security Unity Ltd. appeared first on IT Security Guru.

Organised by Eskenzi PR in media partnership with the IT Security Guru, the Most Inspiring Women in Cyber Awards aim to shed light on the remarkable women in our industry. The following is a feature on one of 2024’s Top 20 women selected by an esteemed panel of judges. Presented in a Q&A format, the nominee’s answers are written in their own words with minor edits made by the editor for readability and where relevant, supplemented with additional commentary by their nominator.

In 2024, the awards were sponsored by BTThink Cybersecurity Ltd. and Plexal, with Eskenzi PR, Assured and Women in Cybersecurity UK & Ireland Affiliate as partners.

Andrea Cullen, Co-Founder of CAPSLOCK Education Ltd.

What does your job role entail?

CAPSLOCK is a reskilling bootcamp that supports people with no experience in cyber into a role in industry. Helping to run the business alongside my fellow co-founder. This involves wearing many hats from strategy development to practical day to day jobs in the classroom, and everything in between.

How did you get into the cybersecurity industry?

I used to be a software engineer. I was then a stay at home parent and did a degree in computer science as a mature student with 4 children. I then did a PhD in operations and got a role a a lecturer, developing an MSc in Cyber. This was 2004. I have been in cyber ever since.

What is one of the biggest challenges you have faced as a woman in the tech/cyber industry and how did you overcome it?

Being ignored and talked over can be a problem. I used to go very quiet when this happened but I now make sure I make myself heard. One of the biggest problems is a lack of diversity. We tackle that every day at CAPSLOCK but for me the biggest way to overcome this is through role modelling and making yourself visible.

What are you doing to support other women, and/or to increase diversity, in the tech/cyber industry?

It is part of everything we do. It is key to our strategy at CAPSLOCK. I also get involved in many events and talks at conferences and trade shows. I spend time with hiring managers and also work with businesses to see how they can hire diverse talent.

What is one piece of advice you would give to girls/women looking to enter the cybersecurity industry?

Do it – there is so much scope and opportunity. Get a mentor, identify your role models, join a community, find the right company, see yourself as a role model for others (this is sometimes a great way to overcome imposter syndrome and grow confidence).

 

The post #MIWIC2024: Andrea Cullen, Co-Founder of CAPSLOCK Education Ltd. first appeared on IT Security Guru.

The post #MIWIC2024: Andrea Cullen, Co-Founder of CAPSLOCK Education Ltd. appeared first on IT Security Guru.

Today, Eskenzi PR are proud to announce that nominations are open for the 11th annual European Cybersecurity Bloggers Awards. The 2024 event is sponsored by KnowBe4, Keeper Security and Coro and supported by our media partners, Infosecurity Magazine and the IT Security Guru.

The awards aim to celebrate the industry’s best blogs, podcasts, and vlogs, as well as the exceptional talent who contribute to these forums. This year, the award will feature a brand-new category celebrating new and alternative media, The Visionary – The Best Use of Alternative media, including TikTokers, Substack champions, YouTube short creators, Instragrammers and LinkedIn Newsletter writers.

Another new category for 2024 is The Conversation Starter – Best Blog/Podcast/Vlog that Champions Diverse Voices and New Perspectives. This category aims to celebrate a blog, vlog or podcast that champions diverse voices and tackles pressing, yet often underdiscussed, topics. This could be anything from menopause to mental health.

Alongside these new categories are popular returning favourites, including The Vlogger – The Best Cybersecurity Video or Video Blog, The Corporates – Best Cybersecurity Vendor Podcast, and The Newcomer – Best Blog or Podcast Less Than One Year Old. 

Nominations will close on 30th April 2024. A shortlist will then be revealed, and a public vote will open. The result of this vote will be combined with picks from an esteemed judging panel to determine the winners. So far, this year’s judging panel includes:

  • Darren Guccione, CEO and co-founder, Keeper Security
  • Rachel Cheyfitz, director of product marketing, Coro
  • Javvad Malik, lead security awareness advocate, KnowBe4
  • Yvonne Eskenzi, Co-Founder and Director of Eskenzi PR
  • Brian Honan, founder of the European Cybersecurity Blogger Awards and CEO of BH Consulting
  • Beth Maundrill and James Coker, Infosecurity Magazine

The nomination form can be found here: https://docs.google.com/forms/d/e/1FAIpQLSc-qrL_CcUGtAnl6jZ3fbugkAOP4UhlwYvZcO0iBWupzHN5fQ/viewform

Finally, the process will culminate at a live, in-person event at Tapa Tapa restaurant, next door to the ExCel Conference Centre, on the second evening of Infosecurity Europe (5th June 2024). Registration for the event can be found here.

Yvonne Eskenzi, Co-Founder and Director of Eskenzi PR, said: “We’re thrilled to be bringing back the European Cybersecurity Blogger’s Awards for the 11th year! There’s so many incredible podcasts, blogs and vlogs that make the industry a more accessible, engaging, and entertaining one. Over the years we’ve celebrated some industry household names, like Graham Cluley and Carole Theriault, and we can’t wait to continue celebrating more!”

 

The post Nominations Open for 2024’s European Cybersecurity Blogger Awards first appeared on IT Security Guru.

The post Nominations Open for 2024’s European Cybersecurity Blogger Awards appeared first on IT Security Guru.

Recently 23andMe, the popular DNA testing service, made a startling admission: hackers had gained unauthorised access to the personal data of 6.9 million users, specifically their ‘DNA Relatives’ data.

This kind of high-profile breach made headlines globally, and naturally highlights the need for stringent security measures when handling organisational data – especially the type of sensitive genetic information that 23andMe is responsible for. Further, although the hacker appears to have to use a tactic known as credential stuffing to access 23andMe’s customer accounts, it does pose wider questions to organisations, IT managers and security experts about the security measures that are used more generally to keep organisational and consumer data safe from threat actors? With a key question for many organisations today surrounding that of where and how they host their data – especially when you consider 23andMe’s data has reportedly been stored solely on cloud servers?

Mark Grindey, CEO, Zeus Cloud explains that one way that organisations can mitigate similar risks is by implementing on-premises and hybrid cloud solutions. He covers how these technologies can play a vital role in safeguarding organisational data – such as 23andMe’s important genetic data – and shares insights about the key steps organisations can take to be more secure.

Achieving direct control of data

In 23andMe’s case, its compromised ‘DNA Relatives’ data holds immense value and is extremely sensitive. This is because it enables individuals to connect with potential relatives based on shared genetic information.  However, this kind of valuable data often becomes a target for cybercriminals, who are seeking to exploit it for various purposes: including identity theft, fraud, and other nefarious activities. Therefore, to protect this type of information, organisations need to implement robust security measures that ensure the confidentiality, integrity, and availability of the data.

 On-premises solutions enables part of this protection to take place effectively and involves hosting data and applications within an organisation’s own physical infrastructure. This approach gives organisations direct control over their data and allows them to implement rigorous security protocols. For instance, by keeping genetic data on-site, an organisation like 23andMe is able to secure it behind multiple layers of firewalls and intrusion detection systems, reducing the risk of external breaches. Additionally, access to this data can be restricted to authorised personnel only, minimising the potential for internal data leaks.

Another school of thought that is worth considering, for many organisations, is to use hybrid cloud solutions. This approach combines the advantages of on-premises and cloud-based services. Organisations can use public or private clouds appropriately to store non-sensitive data while keeping sensitive information – like genetic information in 23andMe’s case – on-premises. This method provides organisations the flexibility to scale resources and accommodate fluctuating user demand, while still maintaining strict data control. When set up and configured correctly – using encrypted connections and robust authentication mechanisms – hybrid cloud solutions ensure that secure data transmission between the on-premises and cloud environments takes place.

Steps Towards Preventing Data Breaches

While implementing on-premises and hybrid cloud solutions can significantly reduce the risk of data breaches and unauthorised access to data, there are several other crucial steps and techniques that organisations can take and make use of to secure and protect data from breaches.

Obvious as it may seem to many in the industry, today it is vital to encrypt data during the storage and transmission thereof. This renders compromised data meaningless to unauthorised users, even if threat actors manage to gain access to it. Implementing multi-factor authentication is vital too. It strengthens access controls and adds an extra layer of security. Users trying to access data should, effectively, be required to provide multiple forms of verification, such as passwords, biometrics, or smart cards to access their data genetic data. In 23andMe’s case, while they do offer this approach to their users, perhaps the use thereof should be made to be mandatory given their recent breach?

Aside from this, it is recommended that organisations conduct frequent security audits to identify vulnerabilities and ensure compliance with industry standards and best practices. This involves testing the effectiveness of security protocols and promptly addressing any discrepancies.

Finally, no robust security framework is complete without equipping employees with proper training and awareness about their responsibilities towards securing data and protecting it. Regular security awareness programmes help staff understand their roles and responsibilities in protecting data.

Even though 23andMe claims that it exceeds industry data protection standards and has achieved three different ISO certifications to demonstrate the strength of its security program, and that it actively routinely monitors and audits its systems, an incident like this, along with the PR and media attention that it has gained, will undoubtedly have caused its team to evaluate all of its security parameters including the further training of its team in order to ensure this doesn’t occur in future.

Conclusion

23andMe’s recent data breach serves as a wake-up call for organisations handling data, especially sensitive genetic information provided by consumers. This kind of incident will have naturally caused it to reconsider its security policies and approach towards securing organisational and customer data. Today, as other organisations consider their approach towards security and protecting data, many will review where and how their data is stored, managed and accessed.

This is especially true of banks, telcos, insurance companies and many other kinds of firms. On-premises and hybrid cloud solutions provide powerful and effective options here too. They enable organisations to fortify their security measures and protect against potential data breaches.

The combination of direct control over data provided, along with tools and tactics like encryption, multi-factor authentication, security audits, and employee training creates a comprehensive defence against unauthorised access of organisational data. All of which the likes of 23andMe, along with many other organisations, will be considering and prioritising as they strive to adopt more robust security measures that ensure the privacy and integrity of organisational, and consumer, data.

The post 23andMe sparks rethink about safeguarding data: on-premises vs. hybrid cloud strategies first appeared on IT Security Guru.

The post 23andMe sparks rethink about safeguarding data: on-premises vs. hybrid cloud strategies appeared first on IT Security Guru.

Organised by Eskenzi PR in media partnership with the IT Security Guru, the Most Inspiring Women in Cyber Awards aim to shed light on the remarkable women in our industry. The following is a feature on one of 2024’s Top 20 women selected by an esteemed panel of judges. Presented in a Q&A format, the nominee’s answers are written in their own words with minor edits made by the editor for readability and where relevant, supplemented with additional commentary by their nominator.

In 2024, the awards were sponsored by BTThink Cybersecurity Ltd. and Plexal, with Eskenzi PR, Assured and Women in Cybersecurity UK & Ireland Affiliate as partners.

Zinet Kemal, Cloud Security Engineer at Best Buy

What does your job role entail?

As a cloud security engineer I help design and implement security measures to protect an organisation’s cloud-based infrastructure and data. This includes identifying and mitigating risks, implementing security controls, and monitoring for security breaches.

Collaborate to support a secure and scalable transformation and migration from the data centre to the cloud.

How did you get into the cybersecurity industry?

So I came to the US 10 years ago and I had a law degree and career in the legal field prior to my cybersecurity life. My journey into the cybersecurity industry began late 2017, during my undergraduate studies. At that time, I was pursuing a Computer Science degree and chose an elective course titled “Introduction to Information Security,” which was an elective class to the program. This course, and particularly the professor teaching it, became the gateway to my career in cybersecurity.

The professor, recognising the potential in his students, offered to coach any interested candidates for the upcoming Minnesota Collegiate Cyber Defense Competition (CCDC). The opportunity was too good to pass up, so I, along with several classmates, signed up. Preparing for the CCDC was a significant commitment. Over five months, I dedicated my Saturdays to self-study for the competition. This was alongside my full-time class schedule, a part-time IT internship, and the responsibilities of caring for my three young children at the time.

The hard work paid off when I was selected as one of the eight students to represent our university at the MN CCDC. Participating in the competition was an eye-opening experience. It provided me with a practical glimpse into the cybersecurity industry, from understanding the roles of blue, red, and white teamers to learning how to defend against simulated cyber attacks in a business environment.

Our team’s effort and dedication were rewarded when we secured 3rd place among Minnesota colleges and universities in the 2018 competition. That achievement marked a turning point for me; I was hooked. Motivated by this success, I dove deeper into the field through continued education, earning certifications, and gaining experience through internships. By 2018, I had landed my first professional role in cybersecurity. My entry into this industry was a blend of academic curiosity, competitive challenge, and relentless pursuit of professional growth, setting the foundation for my career in cybersecurity.

What is one of the biggest challenges you have faced as a woman in the tech/cyber industry and how did you overcome it?

Navigating being a mom of 4 and rebuilding my career in a whole new continent in a male dominated field from scratch is one. But I witnessed and continue to witness how women are assumed non-technical no matter the degree, security certifications and credentials I built, folks don’t even know these biases sometimes. Not getting the proper respect and getting ignored or not being included in important meetings or work intentionally or not being considered.

However the way to overcome it is to build your brand and be your best advocate. Champion yourself before anyone does then no matter what you know where you stand you are grounded. You will then have a whole tribe built that is your advocate on your behalf. Your brand will speak for itself because you consistently built that with patience and hard work.

What are you doing to support other women, and/or to increase diversity, in the tech/cyber industry?

I’m deeply committed to supporting women and increasing diversity in the tech and cybersecurity industries, using my journey and achievements as a springboard to inspire and empower others. Here’s a glimpse into how I’m contributing:

  • Writing Impactful Children’s Books – My children’s books, such as “See Yourself in Cybersecurity” and “Oh, No … Hacked Again!”, are crafted to encourage young minds, especially girls, to envision themselves in cybersecurity roles. These stories foster empowerment and introduce online safety, aiming to spark curiosity about cybersecurity careers from a young age by intentionally including girls as the main characters. I am also the author of “Proud in Her Hijab” teaching about girls empowerment.
  • Authoring Significant Works – As a co-author of “Securing Our Future: Embracing The Resilience and Brilliance of Black Women in Cyber”, I’ve had the honour of contributing to a work that highlights the accomplishments, challenges, and untapped potential of Black women in the cybersecurity field.
  • Educational Initiatives and Speaking Engagements – Through my role as a TEDx speaker and LinkedIn Learning instructor, I share valuable insights and experiences with a broader audience. My aim is to demystify the field of cybersecurity, making it more accessible and inviting to women and underrepresented groups, and demonstrating that a fulfilling career in cybersecurity or Tech is within their reach.
  • Advocacy and Recognition – The numerous awards and recognitions I’ve received, such as the 2023 Minneapolis/St. Paul Business Journal 40 under 40 and the 2023 SANS Difference Makers Award for Best Book of the year etc allow me to use my platform to advocate for diversity in cybersecurity.
  • Community Engagement & author visits – By participating in cyber podcasts and engaging with the community, I offer insights, encouragement, and mentorship. My involvement in these activities is geared towards supporting those entering the field, fostering a sense of community and belonging.
What is one piece of advice you would give to girls/women looking to enter the cybersecurity industry?
Drawing from my own journey and the lessons I’ve learned along the way, my advice to girls and women looking to enter the cybersecurity industry is; Find your unique voice and let it guide you. Starting out as an immigrant from Ethiopia, transitioning from the legal field to cybersecurity, and balancing the demands of being a mother of four, my path was anything but conventional. Each step of the way, I learned the importance of embracing my own story, my own struggles, and my strengths. This industry thrives on diversity of thought, background, and approach. Your unique perspective is not just valuable; it’s essential. Cybersecurity is vast and multifaceted, and there’s a niche for everyone. That’s why i also wrote “See Yourself in Cybersecurity” for our youth. Whether you’re drawn to the technical aspects, like ethical hacking, or the strategic side, like policy development, there’s a place for you. Use your voice and your experiences to carve out your space in this field. Don’t shy away from challenges or opportunities to grow and learn, even if they seem daunting at first.
The path into cybersecurity is as unique as you are. Embrace your journey, stay curious, and never stop pushing the boundaries of what you can achieve. Your voice has the power to inspire change and innovation in tech or cyber.
Links to my books & TEDx – https://zinetkemal.com/

The post #MIWIC2024: Zinet Kemal, Cloud Security Engineer – Best Buy first appeared on IT Security Guru.

The post #MIWIC2024: Zinet Kemal, Cloud Security Engineer – Best Buy appeared first on IT Security Guru.

API security professionals Salt Security have released new threat research from Salt Labs highlighting critical security flaws within ChatGPT plugins, presenting a new risk for enterprises. Plugins provide AI chatbots like ChatGPT access and permissions to perform tasks on behalf of users within third party websites. For example, committing code to GitHub repositories or retrieving data from an organisation’s Google Drives. These security flaws introduce a new attack vector and could enable bad actors to gain control of accounts on third party websites and allow access to Personal Identifiable Information (PII) and other sensitive user data stored within third party applications.

ChatGPT plugins extend the model’s abilities, allowing the chatbot to interact with external services. The integration of these third-party plugins significantly enhances ChatGPT’s applicability across various domains, from software development and data management, to educational and business environments. When organisations leverage such plugins, it subsequently gives ChatGPT permission to send an organisation’s sensitive data to a third party website, and allow access to private external accounts. Notably, in November 2023, ChatGPT introduced a new feature, GPTs, an alike concept to plugins. GPTs are custom versions of ChatGPT that any developer can publish, and contain an option called “Action” which connects it with the outside world. GPTs pose similar security risks as plugins.

Yaniv Balmas, Vice President of Research, Salt Security, said: “Generative AI tools like ChatGPT have rapidly captivated the attention of millions across the world, boasting the potential to drastically improve efficiencies within both business operations as well as daily human life. As more organisations leverage this type of technology, attackers are too pivoting their efforts, finding ways to exploit these tools and subsequently gain access to sensitive data. Our recent vulnerability discoveries within ChatGPT illustrate the importance of protecting the plugins within such technology to ensure that attackers cannot access critical business assets and execute account takeovers.”

The Salt Labs team uncovered three different types of vulnerabilities within ChatGPT plugins. 

The first of which was noted within ChatGPT itself when users install new plugins. During this process, ChatGPT redirects a user to the plugin website to receive a code to be approved by that individual. When ChatGPT receives the approved code from a user, it automatically installs the plugin and can interact with that plugin on behalf of the user. Salt Labs researchers discovered that an attacker could exploit this function, to instead deliver users a code approval with a new malicious plugin, enabling an attacker to automatically install their credentials on a victim’s account. Any message that the user writes in ChatGPT may be forwarded to a plugin, meaning an attacker would have access to a host of proprietary information. 

The second vulnerability was discovered within PluginLab (pluginlab.ai), a framework developers and companies use to develop plugins for ChatGPT. During the installation, Salt Labs researchers uncovered that PluginLab did not properly authenticate user accounts, which would have allowed a prospective attacker to insert another user ID and get a code that represents the victim, which leads to account takeover on the plugin. One of the affected plugins is “AskTheCode”, that integrates between ChatGPT and GitHub, meaning by utilising the vulnerability, an attacker can gain access to a victim’s GitHub account.

The third and final vulnerability uncovered within several plugins was OAuth (Open Authorization) redirection manipulation. Similar to pluginlab.ai, it is an account takeover on the ChatGPT plugin itself. In this vulnerability, an attacker could send a link to the victim. Several plugins do not validate the URLs, which means that an attacker can insert a malicious URL and steal user credentials. Like the case with pluginlab.ai, an attacker would then have the credentials (code) of the victim, and can take over their account in the same way.

Upon discovering the vulnerabilities, Salt Labs’ researchers followed coordinated disclosure practices with OpenAI and third-party vendors, and all issues were remediated quickly, with no evidence that these flaws had been exploited in the wild.

 

The post ChatGPT Extension Could be Exploited to Steal Data and Sensitive Information first appeared on IT Security Guru.

The post ChatGPT Extension Could be Exploited to Steal Data and Sensitive Information appeared first on IT Security Guru.