Threat actors don’t need certifications or a degree to be good at their job. So why do we keep trying to demand those from new cyber hires? And could a teenager’s online bad behavior taint their ability to enter the field of cybersecurity?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining us is our guest, Adam Arellano, former vp, enterprise cybersecurity, PayPal.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, ThreatLocker

Full Transcript

Intro

0:00.000

[David Spark] Threat actors don’t need certifications or a degree to be good at their job. So why do we keep trying to demand those things from cybersecurity professionals?

[Voiceover] You’re listening to Defense in Depth.

[David Spark] Welcome to Defense in Depth. My name is David Spark. I’m the producer of the CISO Series. You can find more of our programming over at CISOseries.com. My cohost for this very episode, you’ve heard him before. Whether you like it or not, you’re going to hear him again. It’s none other than Steve Zalewski.

Steve, say hello to the audience.

[Steve Zalewski] Hello, audience.

[David Spark] He seems excited to talk to you. Let’s see if that holds.

[Steve Zalewski] [Laughter]

[David Spark] Our sponsor for today’s episode is ThreatLocker. Huge thanks to ThreatLocker, a great supporter of the CISO Series. They are the zero trust endpoint protection platform. We’re going to be talking about just that a little bit later in the show. All right, Steve, I got a question for you.

Why is cybersecurity education such a tough nut to crack? We’ve seen various attempts to formalize this education, but you can’t teach curiosity. Threat actors don’t burden themselves with such requirements, as Yoad Dvir of IONIX pointed out in a LinkedIn post. He argued that these teenage criminals or cyber criminals showed technical chops.

Now, does this mean we need to look at cybersecurity recruitment differently to get more talented people into the industry? What do you think, Steve? And should we be looking at young teens who went astray when they were very young?

[Steve Zalewski] Yes. Short answer is yes. We need to open the aperture to an opportunity for diversity and bring more in. But the initial statement here, and I think what we’re going to talk about is to a certain extent, we have an apples-to-oranges conversation going on. And the fact that we’re trying to compare the two as equivalent, in a lot of cases, is simply creating more confusion than value-add.

[David Spark] Good point. Now, before I bring in our guest, I do want to make a comment about the comments you’re going to hear today. So, many of the comments are referencing Yoad’s post, that the threat actors that he mentions didn’t have college degrees yet, had the drive to learn and cause the damage.

And I should mention a lot of people get into cyber, the first thing you want to do is red team. So, there are a lot of comments here towards their not so savory attitude. So, I’m setting the stage as to what is being referenced in the quote. But somebody who has actually dealt with and has firsthand experience of dealing with this kind of audience is our guest today.

I’m thrilled to bring this person in. It is the VP of enterprise cybersecurity over at PayPal, none other than Adam Arellano. Adam, thank you so much for joining us.

[Adam Arellano] So happy to be here. I’m a longtime fan of the entire series, all the different shows. So, I’m excited to be on for the first time.

What kind of experience do you need?

3:11.805

[David Spark] Pieter Christiaan van Rooijen of KEMBIT said, “You can teach someone how to protect an environment, and that same person can be certified as well. But you cannot teach the natural determination and mindset that some of these teenagers in this case have. If a person with these qualities is guided in the correct direction, they may easily surpass even some of the industry veterans.

Re-evaluating the whole process might not be the solution, but perhaps amending it to account for the mindset and attitude may be beneficial in the long run.” And Jason Eicholtz of Google said, “When I used to hire people onto my team, I’ve held the belief that passion and curiosity were far more valuable than a college degree.

And if I had to choose between two candidates, the one that learned on his own usually won hands down to the formally educated candidate.” So, that comment, I would say a lot of our listeners and a lot of our guests would agree with. Yes, Steve?

[Steve Zalewski] They will. And this is where we’re going to start about the apples and oranges. If you look at the malicious side, what we’re doing, right, is it’s a survival-of-the-fittest type of mentality. And they’re looking for proof of proficiency. If you’re proficient at breaking in, you’ll succeed.

If you’re not, survival of the fittest is you’re not good at this. And when we look at it from our side, right, from the defense side, if we’re looking for proof of proficiency, that tends to be what I would look at as more of a vocational trade school, right? I need very specific skills to bring you in to do something.

Versus we’re looking at this as, well, you want a college degree because I want a well-rounded individual that’s capable of looking at the larger social impacts in the entire security program. So, this is where I’m opening the conversation to be able to go see the differences and see how what we really have to do is kind of understand not are certifications valuable, but how the two ecosystems determine success.

[David Spark] All right, Adam, I’m throwing it to you. And when we start off, can you give a little background on your history of dealing with this sort of community of young kids who do bad things, but are showing some capabilities?

[Adam Arellano] Yeah, and I appreciate this topic, and it’s something that I’ve paid a lot of attention to. My first foray into bringing people into cybersecurity was as a Marine. The first bad decisions that those Marines made was joining the Marine Corps during wartime. And so they maybe don’t have the best decision-making skills, but when we did bring them in with almost no experience, gave them basic tools, they did quickly learn not just how to destroy, but also to build up.

And what I really think that we’re dealing with here with these, what we’re calling nefarious actors, is the same impulse that makes every middle school boy jump up and tap a doorway as they walk through it. It’s the same impulse that anybody who gets a computer for the first time has, which is, “I wonder what I can break.

I wonder what I can get into.” And really what it comes down to is finding this raw talent and directing it. So, we’re not saying that these kids that got into a protected space are immediately ready for the workforce. And we’re not saying that they’re immediately going to be great at what they do, but it is a great way to find out where there’s passion, where there’s curiosity and where they can move forward, even if they’ve done something and been caught doing something bad.

[David Spark] And I mean, are you always looking for the good, even though they’ve kind of proven themselves that they’re – and I’m using hyper simplistic terminology here – but they’ve proven themselves to “be bad.”

[Adam Arellano] Yeah. I think that’s almost always my intent. I have a lot of very specific feelings about the American justice system in general. Those aside, what these kids are actually demonstrating is a desire to get something done, and so I will always give the benefit of the doubt in those cases.

I’d also point out, to Steve’s comments about apples and oranges, if we really want to get down to it, the majority of fraud and cybercrime is not committed by youngsters or teenagers or people just getting into it. It’s by well-seasoned people. And some of the worst breaches in the world have occurred from people on the inside who fit every descriptor of what’s qualified and still chose to make bad decisions.

So, I don’t think that they’re quite correlated the way that people imagine that they would be.

Where does this effort fall flat?

7:51.174

[David Spark] Redi Shabani of INFOKOM said, “Are these teenagers able to develop a cyber-secure system for billion-dollar companies, communicate with customers and understand their needs and handle their security concerns? Sorry, but willingness to cause irrational damage and driving irresponsibly are not enough to reevaluate the recruitment process.” So, this is someone who’s not on board, clearly.

Prabhu Kiran Veesam of CyberOne said, “It’s not about skills, why we learn the bachelor’s or master’s or any other certification, but it’s about ethical consideration while using the technology. We all know a couple of scripts that can penetrate into the servers and do our work, but we don’t do that as our ethics stop us.” So, this is really interesting arguments, and we’ve all heard these before, so I definitely want to toss it to you first on this, Adam.

These are people just saying, “Look, someone’s proven themselves to be a bad egg. I can’t teach ethics. If that’s where their ethics lie, that’s where they lie.” Again, that’s their argument. I’m throwing that at you. I’m sure you’ve heard that before. How do you respond?

[Adam Arellano] Yeah. And it’s a very common argument that one action equals a lifetime. And I would counter respectfully to this comment that nobody who graduates from a master’s program in cybersecurity is capable of securing a billion-dollar company straight out of school either. This isn’t the point.

We’re talking about entry-level people here who have shown capacity for learning and shown capacity for creativity. Personally, I just don’t spend time at universities and colleges when I’m looking for talent. I spend most of my time at community colleges and certificate programs with non-traditional students.

The difference between the two groups in my mind, and this could be selfish because this is kind of my path to cybersecurity, is that they’re able to move left and right and not just up. So, the person that has to work at Starbucks for four years so they can get their college paid for is going to have a much different set of drive and a much different set of skills than someone whose parents paid for their entire college and who were kind of forced into the pipeline.

And so I spend most of my time looking for the ability to think around obstacles than just obtaining a certification or having a master’s degree.

[David Spark] Steve, hearing what Adam just said, this really sounds like a classic case of diversity. Like, yeah, you want the college students, and you want the ones at community college or certification programs, and you want the people who maybe broke into the school when they were a teenager, and they shouldn’t have done that kind of a thing.

What do you think?

[Steve Zalewski] Yes. As the dad of four children, including three boys, two of which couldn’t keep their fingers off computers and did some of the very things we talked about, so I’m being very transparent here, okay, there’s an adolescence exercise, which was, in my simple view, what we’re talking about here is no different than in the ’60s and ’70s.

All of the kids that were not designed to sit in the classroom were excellent students, right? They were intelligent. Where do they tend to go? You find them in the shop classes, you find them around automobiles, okay? They’re building the street rods, they’re racing, right? They’re finding a natural outlet for their skills.

Well, this is 40 years later, and it’s just computers now is the equivalent outlet of cars back in the ’60s. And so, we had to acknowledge back then, right? A lot of those motorheads made mistakes, motorcyclists, but as they matured their thinking, their expertise, right, that intelligence, that genius, if focused, right?

We have to acknowledge adolescence is about learning, it’s about making mistakes, it’s about a second chance and bringing that forward. So, to me, what I see here is this great opportunity where if we look at it that way, that’s what we’re realizing is mistakes on the computer side are not mistakes, it’s adolescence, and let’s take that intelligence and channel it into the initial job classifications that make the most sense for these types of individuals.

[Adam Arellano] I love that point, by the way, Steve. I love the comparison that you’re drawing with the way that motorheads and car freaks like myself really took to those kind of classes and not to the traditional academics. It’s a great point and a great comparison.

Sponsor – ThreatLocker

12:41.474

[David Spark] Before I go any further, I got to tell you about ThreatLocker. They’re our awesome sponsor, a great supporter of the CISO Series. Let me ask you a question. Do zero-day exploits and, probably more importantly, supply chain attacks keep you up at night? Of course they do. You work in cybersecurity, why wouldn’t they?

You don’t have to worry anymore because you can start hardening your security with ThreatLocker. Listen to what they do.

Imagine the following. You’re taking a proactive, deny-by-default approach to cybersecurity. I know you think that might upset your team. It doesn’t. Listen. They block every action process and user unless specifically authorized by your team. And there’s ways they can request the access should they get blocked.

So, ThreatLocker helps you do this and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation is fully supported by their U.S.-based support team. You can stop the exploitation of trusted applications. This is what happens. You want a trusted application to do one thing, but the hackers and the criminals want it to do something more that you don’t want.

So, you only want that within your organization to keep you running efficiently and secure, protected from ransomware.

Worldwide, companies like JetBlue, they trust ThreatLocker to secure their data and keep their business operations flying high. To learn more about how we can throw in a silly pun for your business, contact us. But really, if you want to deal with the threats and building out your zero trust environment at the endpoints, you got to trust ThreatLocker.

They can mitigate unknown threats and ensure compliance for your organization. Go to their website. Visit ThreatLocker.com.

What’s the motivation to fix this problem?

14:36.737

[David Spark] Tue Jagtfelt of Globeteam said, “Attack is so much easier than defense. Any teenager can throw a rock at a passing car from the top of a highway overpass, but this doesn’t mean that they have the engineering skills to actually build societal infrastructure across the country.” And this goes back to the earlier quote, yes, nobody out – what Adam just said – nobody right outside of college can all of a sudden lead security for a billion-dollar program.

We’re talking about entry-level positions. So, I don’t think this person could either right out of college. But Andrew Wright of Frontier Technology said, “It’s a thankless industry. Organizations make concessions every day and Security is told to sit in a corner. These teenagers were incentivized. Cybersecurity professionals need to be incentivized.

We need to be energetic and adaptable, creative.” So, this last quote is quite interesting. Like maybe we’re not creating the right incentives for cybersecurity and that it’s more fun to throw a rock at a car over the overpass. What do you think, Adam? Like you deal with this, so what incentives do you see working?

[Adam Arellano] It’s an interesting point that’s being made. The incentivization conversation, especially around this particular quote that we’re dealing with in this post, is basically that these kids were not actually incentivized by anyone. They were incentivized by the reputational gains and the basically kudos that they would get from their friend group or their online friend group, which is extremely powerful.

[David Spark] Right. And we’re seeing this very much in just generic social media. There is a sake of flexing muscles here. And by the way, this is more difficult than throwing a rock from the overpass.

[Adam Arellano] Much more difficult. We won’t go into comparisons, but it is much more difficult.

[David Spark] [Laughter] And we’re not recommending our audience challenge those too.

[Adam Arellano] Correct. But this is why we have bug bounty programs that show scoreboards. Because yes, we do pay out bug bounties, but we also show who’s doing what and who’s doing it well. And the entire psychology behind this is that if you’re able to show to your group of friends or peer group that you’re doing something cool, you’re incentivized to continue to do so.

So, my teams, what I incentivize is that they spend time outside of our team, talking about their wins, talking about their challenges, and talking about the cool things they did to overcome them, which is a huge incentive that goes well beyond any kind of monetary compensation, especially for the younger groups or the less experienced groups.

[David Spark] Steve, what say you? And specifically around incentives. Like maybe you can describe some incentives that you have either seen or tried yourself.

[Steve Zalewski] So, one of the incentives is patience because what you’re really saying here is you’re going to fail. And I need to have a support network for you to fail while you’re maturing, not just your skills, right? And so I’m proud for what you did, but let’s have a conversation around some of the unintended consequences in your enthusiasm to hyper-focus on one piece.

And so it’s not so much that I have to incent them as that I have to put them into a bubble of protection to let them fail fast and mature as fast as they can, so that we can get to the stage where they’re not just a really good pentester, but they’re understanding the business responsibility of that pentesting and not the impulsiveness of adolescents to just do something because they think they can, that they have that extra moment to think.

And that’s what good management is, right, is letting these individuals come through.

And the other aspect of that from a diversity perspective, and it’s why I’m so passionate about this is, and if Adam’s okay, I’m going to use the military again, right, which would, look, if you have a military and all we do is graduate officers out of college and they go in and run the military, okay, we need the privates who have been on the front lines, who have been promoted through, to know how things actually work and to be the disruptors to address the things that are getting the front lines really damaged, okay, and let’s get that right.

And if we don’t have that feedback loop, we have people that are intelligent, but don’t necessarily have the field experience to correct the things that intelligence isn’t doing intelligently. And that’s where I’m so passionate about the adolescents here is we get them in, and we let them fail and we focus them.

And what we’re thinking about here is we are a vocational trade school at that stage until they become excellent motorheads and they’re building the cars.

If you looked at the problem this way.

19:40.327

[David Spark] So, this last quote, I think, hits our theme right on the head. Evelyn Huang of Amazon said, “Down the road, you can go to school, get certified, learn about ethical hacking, but the basic ingredients are willingness to learn and a drive for success. If a candidate possesses those qualities, everything else is teachable.” I want to land on that one in a second, but “And they should therefore be considered worthy even if they don’t yet hold the proper credentials.” So, I love this comment, but I think a lot of people may have arguments on the “everything else is teachable.” Now, yes, tech skills are teachable, but ethics – are those teachable?

And that’s where I think there’s two parties and there’s a lot of rubs and a lot of debate. I throw this to you, Adam.

[Adam Arellano] Yeah, it’s a great question. And it’s basically the nature versus nurture question in the professional world. And I would happen to agree strongly with Evelyn’s point here that everything else is teachable, and that includes the ethics of things. I would be terrified for everybody to know everything I did when I was a teenager and have that used against me as an adult.

[David Spark] Can I just pause for a second?

[Adam Arellano] [Laughter]

[David Spark] Everyone my age or around my age thinks that social media wasn’t around when we were children because to think that any of this could be recorded and exist for eternity horrifies all of us. I don’t think there’s anyone that has not said that comment. So, Adam, you are also that person too.

[Adam Arellano] Oh, very much so. I mean, I won’t go into stories, but everything that I’m paying for with my oldest children, I did to my parents, and I deserve it greatly.

[Laughter]

[Adam Arellano] Back to the discussion, it is teachable. Everything is teachable. And it really comes down to what kind of leader, what kind of organization have you built. To Steve’s earlier point about the way that the military brings people in – it has a very large funnel at the top and very many opportunities to ask people to step out of said funnel as they grow.

And that’s fine. There are people who can enter into this industry, find out it’s not exactly what’s for them and move out of it, and there’s nothing wrong with that. But until we give people the opportunity to include people coming from very nontraditional spaces, whether that be people who come from a community college, people who are incarcerated, who take training while incarcerated, all of those people can enter into this industry and become amazing powerhouses.

I personally, again, potentially because it’s the path that I came through, I prefer people that have come from nontraditional backgrounds because they have the ability to move around obstacles and keep going when things are difficult.

[David Spark] Let me pause you at that moment. I don’t think that makes anything wrong. It’s just because you can relate better to that audience and that audience can better relate to you. So, that seems like the two of you are gravitating towards each other. I don’t think there’s anything wrong with other audiences.

It’s just like, “This is my clan. This is my tribe, my people. I connect better with this audience.” And correct me if I’m wrong, that’s really what you’re saying here.

[Adam Arellano] In a lot of ways it is. And I was enlisted as a Marine before I was an officer. So, I spent five, six-odd years as an enlisted person in the Marine Corps learning about what it was like on the ground. And as I joined, that was a very intentional choice. I wanted to be enlisted first to understand what was happening, become an officer, and run things better as a result.

It’s questionable how successful I was at running things better, but I did everything I could to make sure that I ran things the way that I thought they should be with that experience in mind.

[David Spark] Steve, I throw this to you. And I double down on this. Is everything teachable?

[Steve Zalewski] Everything is teachable. It’s not necessarily learnable, right? I can teach you…

[David Spark] That’s a good point! [Laughter]

[Steve Zalewski] …not to touch the stove, okay? But that doesn’t mean you’re going to learn the lesson other than the hard way. And that’s all this is, right? This is no different than any other industry or anything else. This is how we tend to learn, right? And we have to acknowledge all of the learning styles and everything else.

What I find so fascinating or so great is the melting pot in Security was like the melting pot of the United States 300 years ago. Everybody come in, okay? It’s not going to be all easy, but there’s tremendous opportunity to succeed. And if you have natural talent, you’ll find a way to succeed.

Well, I feel like the cyber industry, we’re 30 years old. We’re like that. We’re a young country and everybody in, okay? Because if you look at, even today, how many people are physicists or were artists or were security people or were any other, sociologists, literary people, we have all those kinds of people that have found success in security.

There’s no reason why you can’t succeed as long as you have a natural determination, a willingness to learn. There’s huge value. And so the pipeline is wide. Let’s get it all in. And to Adam’s point here is let’s give people the opportunity to get out, but we should have that funnel as wide as we can because we need all that diversity because ultimately, like I said, there’s the survival-of-the-fittest mentality.

There’s the proof of proficiency and there’s what I call the molding of the mind, right, to solve societal problems. We need all of that at all of those stages. Come on in. The door’s wide open.

Closing

25:43.648

[David Spark] All right. Right now we come to the point of the show where I ask you which quote was your favorite and why? We have a lot that I think you would agree with the sentiments, and a bunch that you would disagree with the sentiments. But Adam, I’ll start with you. Which quote was your favorite and why?

[Adam Arellano] I’d have to go with Jason from Google’s quote that when he used to hire people onto his team, he held the belief that passion and curiosity were far more valuable than a college degree. That doesn’t discount the value of a college degree, but it does say that the value-prop of passion and curiosity were much higher, and I really like that quote.

[David Spark] Excellent quote. And I agree as well. Steve, your favorite quote and why?

[Steve Zalewski] Oh, I struggled on this one, and I like the one from Jason. Not that Adam is right. Here’s what I’m going to do. I’m going to go with Prabhu Kiran Veesam of CyberOne where he says, “It’s not about skills, why we’ll earn the bachelor’s or master’s or any other certifications, but it’s about the ethical considerations while using the technology.

We all know a couple of scripts that can penetrate into the servers and do our work, but we don’t do that as our ethics stop us.” And it’s this conversation of ethics. Ethics is maturity and we can nurture to be able to establish the ethics. And then we monitor, and we have huge upside potential because I believe most people want to do the right thing.

So, let’s go ahead and assume trust and assume success rather than assume failure and demonstrate that you have to earn my trust. Wrong way to go. So, I think ethics is inbred for us. I think huge potential. So, what I say is, yes, let’s not worry about the people that are going to do the wrong thing, that is in essence going to happen, but it’s a small percentage and let’s not let that ruin the larger opportunity of growth that we’ve established.

[David Spark] Very good. Well, that brings us to the very end of this show. I want to thank our sponsor, and that would be ThreatLocker. Zero trust endpoint protection platform. Let them help you build out a deny by default approach to cybersecurity that actually works for your business. Go to their website, visit ThreatLocker.com.

Adam, I will toss to you last. Steve, any last words on our topic? Although you gave the last words in our basic discussion. Anything else to say?

[Steve Zalewski] No, thank you for the opportunity, Adam. This was a great conversation. This is one I’ve been wanting to have. And so to the audience, I say thank you for the great opportunity. Really great conversation.

[David Spark] And Adam, you get the final words. Are you hiring over there at PayPal? And how would they go about… Can they reach out to you specifically? And by the way, can they reach out to you whether they went to college or not?

[Adam Arellano] Yes, we are hiring, and they can reach out whether or not they’ve gone to college. I’ll encourage you to go to our Careers page and look for security roles or you can reach out to me.

[David Spark] All right. And we’ll have a link to Adam’s profile on LinkedIn on our page as well. Thank you so much, Adam. Thank you so much, Steve. And thank you, audience. We greatly appreciate your contributions and for listening to Defense in Depth.

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.