CyberWire Daily - Encore: Selena Larson: The Green Goldfish and cyber threat intelligence. [Analyst] (Career Notes]

Episode Date: December 27, 2020

Cyber threat intelligence analyst Selena Larson takes us on her career journey from being a journalist to making the switch to industrial security. As a child who wrote a book about a green goldfish who dealt with bullying, Selena always liked investigating and researching things. Specializing in cybersecurity journalism led to the realization of how closely aligned or similar skills are required from an investigative journalist and a cyber threat intelligence analyst. Our thanks to Selena for sharing her story with us.  Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. and VPNs, yet breaches continue to rise by an 18% year-over-year increase in ransomware attacks and a $75 million record payout in 2024. These traditional security tools expand your attack surface with public-facing IPs that are exploited by bad actors more easily than ever with AI tools. It's time to rethink your security. Thank you. Learn more at zscaler.com slash security. Hi, my name is Selena Larson. I am a cyber threat intelligence analyst at Dragos. We are an industrial cybersecurity company. So when I was a kid, I really wanted to be an author. And I remember writing in maybe second grade, a book, quote unquote, called The Green Goldfish. It was about, you know,

the story of a goldfish who was green instead of orange and some of the struggles that he had faced and bullying with his peers and stuff. And as I kind of got a little bit older, I was like, I don't know about a writer, but I'm thinking more maybe like a journalist because that sounds exciting. You know, you can like investigate things. You can do research. You can, you know, meet lots of different people and travel the world and have some cool stories. So I ended up going to journalism school. I took my undergrad at

Arizona State University and I became a journalist. And I kind of bounced around, actually, a little bit. And then when I moved to San Francisco seven or eight years ago, it was like, oh, well, technology is the news here. Like, I am a news reporter. In fact, that's what I said in my interview. I said, I am a news reporter and San Francisco technology is the news. And I got super lucky because I, you know, was thrown into tech at a very exciting time. exciting time, certainly as cybersecurity and privacy issues were, you know, becoming a lot more sort of mainstream, I feel like, especially when we're talking about a lot of these like social networks and platforms. So I ultimately became a cybersecurity reporter at CNN. And at the time,

you know, I liked my job. I thought it was interesting, but I felt that as a journalist, unless you have like, you know, a very specific sort of defined beat, you kind of have to be like a jack of all trades and a master of none, if that makes any sense. And cybersecurity isn't just, you know, a beat in and of itself. There's a lot of different sort of subsectors in security. And of course, there's industrial cybersecurity. course, there's industrial cybersecurity. So I became particularly interested in that after writing about it and kind of decided that, you know, this is something that really interests me. I feel like I could, you know, really dive in here and become, you know, subject matter expert on industrial cybersecurity. I feel like the skills that I have as a journalist would be, you know,

applied really well in this field. And so I kind of, you know, just decided to sort of make the switch. So in my role as an analyst, I do a lot of, you know, research and reporting. In fact, it's kind of interesting how, you know, closely aligned or, you know, closely aligned or similar skills required from an investigative journalist slash reporter and a cyber threat intelligence analyst, right? So there's a lot of reporting. There's a lot of reading. There's a lot of investigating in different ways, finding patterns in information, finding patterns in data. The role of cyber threat intelligence analysts honestly varies depending on who you're talking to, what their background is, what companies they have worked for, what different intelligence shops look like. But I thought that my eight-year-old nephew

described it perfectly. He said, when I was attempting to explain my job to his parents, he said, it sounds like you're an internet cop. And I was like, that's actually a pretty good description of it, right? You know, like an internet cop? I don't know. Like, we're, you know, looking for bad guys and, you know, trying to help people keep themselves safe. When I came to cybersecurity or threat intelligence from journalism, I felt like a fish out of water. I had the biggest imposter syndrome you could possibly imagine because I was very early on at my company. And I soon realized, eventually I realized that me not being someone who comes from a long history of doing cyber work or Intel work, like not having

that background gives me a different perspective on the work that I am doing. So I would say that like for people that are getting into this field, like don't be intimidated by people whose backgrounds are exclusively tech or, you know, have been coding since they were, you know, small or playing with computers. And, you know, they had built their own machine at, like, 15, right? Like, I think it's getting better for sure, but there's still sort of this expectation that people who work in cybersecurity and information security are, you know, the highly technical people with these like very technical backgrounds. You have to have a computer science degree. And I'm here to tell you that you don't.

As a journalist, I have a journalist background. Provides me with kind of a different and unique perspective as opposed to, you know, a lot of folks in the industry. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with

detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. Today, get 20% off your Delete.me plan when you go to joindeleteme.com slash N2K and use promo code N2K at checkout. The only way to get 20% off is to go to joindeleteme.com slash N2K and enter code N2K at checkout. That's joindelete me.com slash N2K code N2K.