My Love Letter to Cybersecurity - 2025
I've been in cybersecurity since the early 2000's. It's difficult, frustrating, and thankless. And I still love it 20+ years later.
Maybe it was when I got my Novell CNA certification in a world of Microsoft Domain Services (Active Directory didn't exist yet you yongins!) and I learned the concept of default deny (Novell Netware) vs. default allow (Microsoft, well, everything really) and the security power of that "least privilege" starting point. Maybe it was when I got my hands on my first PIX 515 HA pair of firewalls and had to write those goofy FTP allow rules. Maybe it was when our CISO's trusted advisor told me I wasn't being paranoid enough with the protections in our production environment, and we should make additional changes. Maybe it was configuring my first WiFi network with a passphrase (one that, it turns out, was laughably pointless given that WEP was a joke of a security solution in practice) so I could "borrow" my neighbor's Internet connection.
I'm not really sure what kicked off my love of this field, frustrating and demanding as it can be, but this has been my professional passion since I got laid off from a telecom gig in 2001. I'm sure it wasn't one singular thing either, it was a combination of attributes: the challenges, the feeling of being helpful and providing protection, the carryover from my professional life to my personal life, and others. These drew me to this field.
A large part of why I love this field is the feeling that I'm doing something valuable for society. I was the kid whose imagination made getting through first-aid classes difficult - I would get light headed imaging a compound fracture or other wound I was supposed to show proficiency in treating. So clearly medical school wasn't going to be my thing. I had aptitude for all things digital and electronic, so this made for a fantastic way to marry my desire to serve and my technical aptitudes.
But this can be a cruel and heartless career area as well. Various combinations and permutations of over-the-top security goals and underwhelming prioritization from leadership, the dreaded experience of a breach, never ending compliance hoops (that often have only tenuous impact on actual security), and other challenges aren't for the faint of heart. I've even penned a post on just what a tough road it is for CISOs out there. I wouldn't wish this industry/career on anybody who isn't sure they're ready for it.
As an industry we're so focused on the assumption that new technology will solve all our problems that we often overlook how many tools we already have and how we're not using them to their potential. We also tend to focus too much on the CSF function "Protect" at the cost of the rest of those valuable and meaningful functions. Finding a well balanced security program can be a challenge, but helping build one is rewarding.
Cybersecurity does community in a way I haven't seen in any other industry. Our conventions are, well, they're different. Neon colored hair is expected. Kilts occur - without bagpipes! Strange is commonplace, and there's underlying currents of harmless mischief everywhere. Something about it reminds me of the way live theater creates communities. There's room for people who are more comfortable interacting with the digital world than people, and room for the people with larger than life personalities who take over a room merely by existing. None of which is to say we're immune to prejudices, racism, and misogyny. But I see a community that works to overcome those.
Perhaps most of all I love how doing our jobs well can impact real people. Protecting their data, protecting their communications and interactions, and even educating them so they can make good decisions about cybersecurity (and privacy) for themselves is a huge part of what makes me feel good about this work. I hope we never lose that focus. I hope we all have that sense of value and usefulness in this industry. Because for me this is what makes the whole struggle and challenge worth it.
So while I'll be focusing on my spouse this Valentines weekend, I figured I should drop a little love letter to this crazy, wonderful, and whirlwind industry I've given most of my adult life over to. Here's to many more good years together!