As of writing, you, me, and all other people floating with us on Earth are living through some of the most tumultuous and chaotic times in known history. In the quarter century since Y2K, we have invented technologies and hardware that our grandparents and parents never could have predicted in their lifetimes. 

We have created and extensively expanded a global interconnected internet that allows for faster and more distributed sharing of information than ever before. Autonomous systems, vehicles, and language models are challenging the limits of supercomputing as well as our societies norms. Smart phones are connecting us all together while simultaneously dividing us into factions or echo chambers leading to every form of extremism. 

Governments are modernizing national systems to be interconnected, highly monitored, and secure from breaches. Not all of these systems are meant to keep citizens safe though, as the prevalence of surveillance states and totalitarian regimes are removing individual privacy and in some cases actively feeding citizens propaganda or misinformation to perpetuate false narratives.

Human shaped robots, drone swarms, rogue AI, and 1984 Orwellian levels of privacy invasion aside, we all just want to live our lives. Unfortunately, the powers that be are unable to keep ordinary folks out of this cyberwar that has been brewing quietly behind the scenes. If you own a smart phone, computer, tablet, smart watch, Alexa, wifi enabled cameras, or countless other devices connected to the internet, they are at risk of compromise from anywhere in the world for any purpose. 

You may think of hackers as teenagers with hoodies in their moms basements, and indeed this does have a term - script kiddies. But in actuality they are the bottom of the bucket and the least dangerous threat we must worry about when defending our digital privacy. Above them are professional hacking groups which conduct massive scale ransomware attacks, credential theft of elevated privileges, bricking of systems for profit - and they are not going away anytime soon. Above them though, are hacking groups known as APTs, or Advanced Persistent Threats. These syndicates are backed by nation states, whether that be China, Russia, North Korea, or yes, The United States. They have insanely strong skills to break into systems as well as treasure troves of zero day vulnerabilities and backdoors into hardware and software you may be using everyday. 

No matter your level of involvement on the internet for personal or business use, we are all vulnerable and everyday new exploits and hacks are being used to stay one step ahead of the firewalls, VPNs, and encryption we rely on to stay safe online. 

Professional cybersecurity experience 

I have been living and breathing cybersecurity for the last decade and whether you are a student with interest in the career field, already working in the industry in a related job such as networking, IT, or sales, or a normal everyday person with a computer, I promise you will find value in learning about the systems we use everyday. 

Now to get to the main purpose of this first video - who am I and why should you listen to me?

My start in cybersecurity began when I was 18. Not knowing what I would study in college, a little organization called the US Air Force was recruiting in my school and piqued my interest. I scored well on the ASVAB (Armed Services Vocational Aptitude Battery), well enough to have most jobs open to me, but the story changed when I went to MEPS (Military Entrance Processing Station) and we all discovered I set the world record for the lowest score on the Ishihara color vision test: I got zero correct besides the control slide. 

Because of this my dreams of being a pilot, or special operations airman were dashed. I did not let it deter me from this path that I put a lot of time and effort into. After MEPS my list of jobs I qualified for dropped from over 100 to maybe a dozen. This blessing in disguise led me to choose a job I knew absolutely nothing about. They called it Cyber Surety and at the time I didn’t know the difference between HTTP, FTP or DHCP - so I had some learning to do. 

I was accepted for this AFSC (Air Force Specialty Code) and left for basic training two months after graduating high school. I will save some of the more fun stories of basic training for another time, but after a quick and grueling few months in San Antonio Texas I was on a bus with my fellow airmen to Keesler Air Force Base in Biloxi Mississippi for tech school. This is where the cramming begins. At the time I wasn’t aware of just how accelerated our course was for cybersecurity, but quickly I found out I needed to go from knowing nothing to passing Comptia’s Security Plus certification in less than four months. 

Because of the breakneck speed of technology and computing in the last few decades, the Air Force in 2009 created 11 distinct cyber jobs that were much more specialized but lacked the foundational knowledge needed to understand the entire sphere of cyber operations. As a result, the amount of information the instructors crammed into the cyber surety training was great for passing Security+, but lacked the training for things like hardware implementation, networking, infrastructure, and architecture among other necessary skillsets in cyber jobs. Every test was an open book test as we essentially were being taught security governance, risk management, auditing, and blue team activities. They ensured us that most of our training would have to be OJT (On the Job Training), as the regulations and laws that governed our jobs changed faster than the weather when operationally necessary. 

Skip ahead four months, a lot of studying, and I managed to pass Security plus with a score over 800 (750 was the passing score with 850 being the max). Important to mention that without this industry certification I quite literally wouldn’t have been able to stay in the career and would have washed out to a different role - so the pressure was a great motivator! In my class over half of us did not pass. After a quick stop back home to celebrate with my family, I was shipped off across the pond to England, where I was stationed at a Royal Air Force base known as Croughton. 

RAF Croughton was a tiny communications base run by the US Air Force in coordination with the British Government, but little did I know at the time that a third of the communications that flowed from Europe to North America was passing through this base only a few miles wide, full of grassy fields, and over 500 sheep. What I also did not know was the amount of CIA agents that worked there as well. It wasn’t until I left the military completely that I learned the base was used for the NSA’s PRISM program as well as countless other surveillance missions that we only know about now because of whistleblowers like Edward Snowden. 

My role at Croughton ranged from the Unit Security Manager that in-processed new folks to the unit, admin tasks for ensuring least privilege and need to know for the sensitive information being processed, to something we called COMSEC, or communication security. This was the real deal. NSA grade equipment that encrypted data to unbelievably complex levels using a Tactical Key loader, Taclanes, and classified computer systems (SIPRNet [Secure Internet Protocol Router Network]) to avoid adversarial espionage. This was my first introduction to Secret information, as well as the potential consequences for not completing the job correctly or misplacing a document - mainly jail time in Fort Leavenworth. Intelligence is what wins wars, and I was thrust into a sector of it that most people didn’t even know exists. 

After a year and a half in England, and a six month deployment to Turkey in support of OPERATION INHERENT RESOLVE, I PCS’ed (Permanent Change of Station) to my next duty station, Spangdahlem Air Base in Germany. If Croughton was my come up to the world of cybersecurity, Spangdahlem was my warm up. What I have yet to mention was around this time in my career field, specifically in the Air Force, there were two unique roles. One being COMSEC, and the other being the WCO, or Wing Cybersecurity Office. If COMSEC was active, physical security of communications, the WCO was the audit and governance side of communications and security - and that is where I was sent for my second duty station. 

In this role I had a few more stripes on my sleeve and had a larger responsibility to the base itself. Unlike Croughton which was limited to securing a few golfball satellite radomes and the CIA (who protect themselves quite well already), Spangdahlem is an active F-16 base that was strategically located to prevent a Russian attack during the soviet cold war era to the present. In terms of personnel and potential cyber risks, it was a much larger attack surface. I started out handling DLP (Data Loss Prevention), which locked out countless airmen and officers that forgot they were not supposed to plug their cell phones into their NIPRNet (Non-classified Internet Protocol Router Network) machines. Soon I was upgraded to squadron cybersecurity inspections among other duties, which was a great way to test my skills and reinforce what I learned up to this point. 

It wasn’t until I was put in charge of eMASS (enterprise Mission Assurance Support Service), that I was fully introduced to the vast and complex world of cybersecurity risk management. Anybody who has had a governmental cybersecurity role in the US will be familiar with NIST (the National Institute of Standards and Technology), and specifically NIST’s series of Special Publications. The main one of which is NIST SP 800-53, titled - Security and Privacy Controls for Information Systems and Organizations. If you are curious I will link the document below, but without going into detail, the current version contains 20 control families, and 1,196 specific security controls. To say I was in a little over my head was an understatement.  

I was a fast learner though, and after two years of securing and auditing the bases security posture, I capitalized on a program called AFCOOL (Air Force Credentialing Opportunities Online) to take a CISSP (Certified Information System Security Professional) bootcamp soon after I was promoted to Senior Airman. To my own surprise more than anybody else, I passed my first attempt and because of the required qualifications for specific cybersecurity roles in the DoD, I was promoted from an ISSO (Information System Security Officer) to the base ISSM (Information System Security Manager). 

Around this time I was flirting with the idea of leaving active duty for a much better paying contracting job at Ramstein Air Base, but due to some odd requirements needed to be German tax exempt as an American contractor, I wasn’t able to get the role I wanted. Unfortunately for me I was already in the process of leaving Active Duty for the Reserves through a program known as Palace Chase and a little virus known as COVID-19 was going on during this period, which forced my hand to apply for roles around where I was planning on living when I moved back. 

I was accepted to an IMA (Individual Mobilization Augmentee) position at McGuire AFB in New Jersey, and after a few offers I accepted a role as a Lead Information Security Risk Specialist for Booz Allen Hamilton. In this role I worked at Hanscom Air Force Base in Bedford Massachusetts. The role was slightly different from my ISSM position. Instead of securing the base's unclassified network, I was put on a system known as BCS-F (Battle Control System-Fixed), which is a post 9/11 early warning system that tracked every plane in North America as well as Hawaii to ensure homeland defense. 

I did not stay in this role long though and I could get into more detail as to why in another video, but long story short I did not agree with some of the risk management decisions made by the leadership of the system. The nuance between the SES (Senior Executive Service) approving authority of governmental systems and active risk management by operational leaders running the system makes cybersecurity impossible in certain circumstances, including the one I was stuck in. Luckily though, I was not leaving without another role lined up and I was able to secure a job as an ISSM for the Air Force’s CloudOne program. 

During this transition between my initial and second civilian job, I had my first experience being in the Air Force Reserves but if anything it was closer to moving between active duty bases besides all the back end healthcare and payment complications. It was fun to see how a base utilized a short term Staff Sergeant, since I was there for an entire month to fulfill all my reserve requirements for the year. Unfortunately though, it was not enough time to really make much of a lasting difference. Being the ISSM in my previous Active Duty role did allow me to help their GS ISSM, but even more so than overseas bases, stateside bases were very slow to change. Maybe I will save the story when I went over my Lieutenant's head to discuss risk management with the squadron commander for another video.

Back to my next role I was starting after my IMA month. Being an ISSM for a cutting edge role such as cloud computing was immensely helpful for me to learn and grow. This job was much closer to my experiences as an active duty ISSM while still being a contractor, not a GS employee. The four main cloud systems we used you may be familiar with - AWS (Amazon), Azure (Microsoft), GCP (Google Cloud Platform), and OCI (Oracle Cloud Infrastructure). I was responsible for the AWS and OCI system deployments for any and all federal customers. Using multiple cloud systems helped keep our agnostic stance, but that did not stop drama from occurring between Jeff Bezos, Bill Gates, and Donald Trump who was president at the advent of the Joint Enterprise Defense Infrastructure (JEDI) program - which is definitely a story for another video. 

It was not long until I was being recruited for other cybersecurity roles that enticed me to leave CloudOne. Long story short, being a contractor embedded as an ISSM working with other active duty officers and a commander, it just reminded me of the reasons why I took my honorable discharge. So, after about a year, I decided to move to a role with very interesting systems at MIT (Massachusetts Institute of Technology) Lincoln Laboratory, which is a FFRDC (Federally Funded Research and Development Center) that has some of the best minds in the country working on very advanced technologies. From AI to space systems, lasers, quantum computing and much more, Lincoln Labs was definitely a more mentally stimulating role. 

The systems I was tasked to secure were a special level of classified known as Top Secret Sensitive  Compartmentalized Information (SCI) and Special Access Programs (SAP). The required protections for these systems are heavier on physical protection and lighter on active detection or management because they were known as Air-Gapped systems. In practice this means first you need to gain access to the military base, then access the building where the systems were held, then you need to enter a protected vault known as a SCIF/SAPF (SCI Facility/ SAP Facility) with two factor authentication. Then every room inside the SCIF is controlled with badge protection in addition to need to know access only. All cell phones and watches need to be kept outside the SCIF as physical emanations from the system can be picked up with a strong enough device as well as to avoid photographic espionage. 

During this time I actually transitioned from McGuire AFB where I was in the reserves, to a base much closer to where I live called Otis ANGB (Air National Guard Base). In this role I was still in the reserves technically, but this position was the standard one weekend a month and a few weeks a year. Seeing how an ANG base works, it was not greener grass unfortunately. Besides Fox News being played in every tv on the base, the mindsets of the leadership of the base just did not align with me whatsoever. Also the dorms they wanted us to stay in were decrepit abandoned army barracks that most definitely had asbestos and black mold. Suffice to say I did my year enlistment extension, did the job the best I could, and read the writing on the wall that being in uniform was no longer for me. 

At MIT Lincoln Labs I was able to really dig into unique types of cybersecurity as well as attending lecture style talks by visiting professors and sometimes special agents. I learned so much about Artificial Intelligence, Zero Trust, Quantum computing, and a lot of wild capabilities we now have in space. Once again though, cybersecurity recruiters are fierce and it wasn’t long until another offer enticed me to jump ship, only this time I was unaware the next role I would take quickly turned me against defense contracting, maybe for good. 

When the Anduril recruiter first contacted me it felt too good to be true. Not only could they match my salary at MIT but added close to double in equity for me to be one of their first Mission Assurance Leads. For my first two weeks I was sent to their HQ in Los Angeles which was quite different than all my past roles. On the surface the company seemed just like another defense contracting company, but underneath the hood it was trying to be the next Apple or Amazon but for autonomous military systems. The technology was fascinating. Their AI system Lattice was cutting edge, but looking back I see its Palantir origins. The autonomous submarine and drones had interesting capabilities but this was around the time I started to question a lot of the things the government was doing and whether I wanted to continue to support it. 

It was not long though for the friction of being a cybersecurity liaison between a bleeding edge silicon valley company and multiple federal agencies such as the Marines and CBP (Customs and Border Patrol) to burn me out. Much like the Air Force, bureaucracy and rigid command structure got in the way of turning over documents, signing formal approvals, and getting the job done with any due diligence. Being stuck between federal procurement managers and civilian tech managers quickly forced my hand and I knew I had to leave. I don’t even have time to talk about the CEO of the company ranting about other tech companies such as meta or apple (which were his competitors when he was creating the first VR headset) as well as his MAGA donations.

After this I wanted to move into a fully civilian role or one that did not require me to work directly with the government if at all possible. This was my intention for a few years now but the salary I was able to command working in classified spaces was hard to match in fully civilian industries. It did not take much time for a recruiter of a newer Manufacturing company that did not secure governmental systems, but did process government data, to reach out to me asking if I would be interested in being their Director of Cybersecurity Compliance. The key difference between all my former jobs and this last role, the security framework was not NIST SP 800-53, but instead NIST SP 800-171, which we call CMMC (Cybersecurity Maturity Model Certification). The total number of cybersecurity controls in this framework that is mandatory for companies that process FCI (Federal Contract Information) and CUI (Controlled Unclassified Information) data is only 110, about a tenth of the full requirement required for governmental systems. The nuance between all CMMC controls being mandatory versus the ability to tailor out controls in federal systems is a whole video in and of itself. 

Where CMMC lacks in number of controls though, this specific role made up for it in the fact that this manufacturing company consisted of over a dozen other companies acquired by them. Some of the companies were decades older than others. Some still used BYOD (Bring Your Own Device) policies. Others were software heavy and tried to bully the IT team into giving them local admin for their own software installs. My rude awakening to a fully civilian company was what I thought I wanted - less guardrails, more freedom to configure systems how the engineers wanted, and a larger ability to discuss change with the C-Suite, still did not happen in these companies either. 

As I write this script trying to consolidate my entire cybersecurity career into a 15-30 minute video, I have realized literally every role I’ve had deserves its own dissection and deep dive. If you are still watching to this point and want to know anything else about any of these jobs please let me know and I will discuss it more. Not only do I enjoy talking about it, but any chance I can get to help you understand cybersecurity for your personal needs, your next role, or your own business, I will do all I can to make it happen. 

Anyway, cybersecurity for manufacturing. This role was totally fine at first. My boss was both the VP of security and IT when I was hired, but the company did not have a CISO (Chief Information Security Officer) or CIO (Chief Information Officer), making my boss the highest in the company for technology at the time. We had a lot of the same struggles companies have between phishing attempts, employees trying to exfiltrate data after leaving the company, improperly securing sensitive data in cloud systems, skirting around system protections, among many, many other situations you will run into doing this job. 

By the end before I quit, we had successfully been audited by a C3PAO (Certified Third Party Assessor Organization) to achieve one of the first 1000 Level two Certifications under the new rule. While that accomplishment was even more impressive than some of the systems we authorized in the Air Force, it led to way more back end work than before for one very specific and controversial new advancement in technology known as AI. By the end, the majority of my role was reviewing new AI software for the company. But to ensure we were only allowing software that met our now active CMMC certification, we had to determine whether the company was processing our data, which was actually the government's CUI data, in the cloud or locally on the machine. If the system was cloud based, it had to be FedRAMP (Federal Risk and Authorization Management Program) Moderate approved, which called back to my CloudOne days. If it was not authorized to process government data, we had to ensure the data never left the machine it came from. While the work was important, I knew I could set my sights higher. 

This brings us to today… AI is changing the landscape of technology and computing second by second. Quantum computing threatens to render all asymmetric encryption on the internet broken. Surveillance systems orchestrated by the most militarized governments on Earth are successfully ensuring our privacy rights are eroded more and more daily. Autonomous systems between water, land, air, and space promise a future of totalitarian control from a central location at the press of a button a la 1984. 

I would like to maximize awareness of these looming threats that have the potential to benefit us all in the right hands. If you or your company is beginning to feel the stress of cyber risk, Karma Cybersecurity can assist you in securing your digital privacy as well as navigating you through some of the more complex aspects of staying safe online.