CyberWire Daily - Karen Worstell: Keep your feet planted. [Strategy] [Career Notes]

Episode Date: April 9, 2023

Karen Worstell, Senior Cybersecurity Strategist from VMware sits down to share her journey and discusses her experience as a woman in cyber. Starting her career off as a chemist, after graduating with a bachelor's degree in chemistry and a bachelor's degree in molecular biology, she took some time off to be with her family, she came back to a science field that was far more advanced than before she had left. She decided to go in another direction which led her to cyber. She started teaching herself programming and found she was very good at it. Now that she works in cyber, she says "You, you have to know yourself, know what you want, and know where you're, know where you plant your feet. I used to use a phrase a lot that said, uh, don't be afraid to take a stand but know where your feet are planted." We thank Karen for sharing her story with us. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. and VPNs, yet breaches continue to rise by an 18% year-over-year increase in ransomware attacks and a $75 million record payout in 2024. These traditional security tools expand your attack surface with public-facing IPs that are exploited by bad actors more easily than ever with AI tools. It's time to rethink your security. Thank you. Learn more at zscaler.com slash security. Hi, my name is Karen Morstel, and I am a senior cybersecurity strategist for VMware. You know, when I was a kid growing up, the thing that I recall is cybersecurity and computers were really the furthest thing from my mind. Because I really believed that I would be a Barbie doll dress designer. I'm 98% right-brained, I think, in pictures. So, yeah, for me, technology, that was something that my sister was going to do, and I was going to kind of pursue a different track.

It just didn't work out that way. You know, as I was coming up through school, my father was always a tinkerer. My father was an inventor, as was my grandfather and both of my brothers. And so I was always exposed to science. We went out at night and we looked at the stars through the telescope. And I was very interested in all of that. My difficulty was that I didn't speak the language of science, which I have to say that that was something that I overcame later. And it really was thanks to the modeling of seeing, you know, people who were inventing things and

tinkering with things. And I think my first computer, my hacker brother was the one who brought that over. It was a TRS-80 Model 1. So that was really what got me started in computers. So that was really what got me started in computers. I was very dutiful about taking the courses in high school in science and chemistry and math and all of that. I was absolutely college bound. That was a non-negotiable in my family. So when I went to college, I was like, okay, I'll just keep doing this, not realizing that it was going to be an order of magnitude more difficult. I remember having the conversation with my father when

after the second quarter of school at the University of Washington, and I came back, said, hey, dad, look, I have an idea for you, a proposal. I'm going to switch over to, you know, for you, a proposal. I'm going to switch over to, you know, studying something in the social sciences. And he said, but who would pay for school? So I kind of acquiesced and I managed to finish a bachelor's degree in chemistry and a bachelor's degree in molecular biology. And I have to say, I am so grateful today that I did that. After I got my degree in chemistry is the day I found out I was expecting my first child. And so I was working as a biochemistry lab assistant at the University of Washington Medical School but I had to drop that job in order to be able to keep you know to care for my daughter and so I took quite a hiatus and when I was time for me to go back to school I knew I needed to get a job and I and, the whole biochemistry field had evolved in quantum leaps and bounds in the time, the five years that I was sort of out of circulation in the work world.

And that's when my brother came over and he said, sister, you need to learn to code. And I had never anticipated or ever contemplated doing any such thing. But with his help, I started teaching myself programming and found out that I was very, very good at it and really liked it. And that's what got me my first job. And I was hired as a security analyst into the Boeing company and it went from there. I developed a rule that I was allowed a pity party for 24 hours and then I had to get over it. hours and then I had to get over it. I'll let myself, if I've really had a really rough event, and there's been a few of those on the Richter scale, like a 10 out of 10,

I would give myself time to like grieve whatever it was I needed to grieve, to kind of assess and learn what I needed to learn, but didn't allow myself more than X hours to feel sorry for myself and eat a pint of ice cream or whatever it was I needed to do. I would just, I would dust up and say, all right, what are we going to do now? And that's served me pretty well, I think. So I have a pretty fantastic job right now at VMware because it uses all aspects of my skill set. That is probably my favorite part of my job is that I interface with other people. I'm a born people person. And hear what is going on with them, then internally to craft whatever it is that we need to bring to the table to help them achieve what it is they need to achieve. So there's that aspect of my job. I do a lot of media and a lot of talking to different people about the aspects of being a cyber pro that I think I really enjoy because I

get to talk about all the things that I've learned in my career, both as a cybersecurity professional and as a chaplain, and bring that to the table to say, here's how we're going to cope and how we're going to deal with some of the unique challenges that face cybersecurity pros. So yeah, I get to kind of be the people person, get to use my words, and I get to talk technology and it's all the best parts. There was a thing that happened that drew me back into the tech sector and into cybersecurity. And that was as I was, you know, a chaplain's role isn't only the patients and their families, it also is the staff. And I think it's fairly well known that burnout among

medical professionals is at an all-time high. And the more time that I spent really diving into the effects of trauma, of secondary trauma, of moral distress and all of that, and the burnout that came out of all of it was that I saw similarities between the symptoms of that kind of burnout and distress in the medical community and saw that it was the same as what I was observing when I worked in the technology sector and with the cybersecurity community. And there's a principle in chaplaincy, chaplaincy is something that was developed like in World War I, that the chaplain doesn't sit in their field tent waiting for the soldier to make an appointment. The chaplain goes and sits in the foxhole. And that's when I realized technology was my foxhole and that I belonged here. And in bringing what I had to bring to the table to make, you know, to help the cybersecurity professionals who are here already stay in the game because we need them.

And this is not an easy profession. So that's why I'm back. Anyone coming up in this field or interested in this field in cybersecurity, I would say a words of encouragement first, which is this is the best field in the world. As hard as it is, it is also the most interesting and has afforded me personally opportunities I would have never had otherwise. Know yourself. And I learned this as a chaplain. You have to know yourself. Know what you want.

The quality of your work life, the quality of your professional life is tightly wound around your inner life and make sure that you are paying attention to that. Know where you plant your feet. I used to use a phrase a lot that said, don't be afraid to take a stand, but know where your feet are planted. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners, today get 20% off your Delete.me plan when you go to joindeleteme.com slash N2K and use promo code N2K at checkout. The only way to get 20% off is to go to joindeleteme.com slash N2K and enter code N2K at checkout. That's joindelete.me.com slash N2K, code N2K.