CyberWire Daily - Omer Singer: The offense and the defense of cybersecurity. [Strategy] [Career Notes]

Episode Date: November 20, 2022

Omer Singer, Lead Cybersecurity Strategist from Snowflake, sits down to share his experience getting into the cybersecurity field. Growing up, he knew he wanted to work with computers, but he just didn't know what he wanted to do within the field. His college gave him great hands-on experience to then transition into the workforce. He's played both on the offense and defense of cybersecurity, and he says that experience showed him and he "kind of saw firsthand, uh, what a well funded and motivated, uh, team of cybersecurity experts can do and it's pretty scary." In addition, Omer is a big advocate for encouraging other security professionals to learn data skills, and strongly stands by the belief that the future of cybersecurity is in borrowing from modern data analytics tools and techniques that enable consistent risk reduction. He also makes it a priority to invest in his people, believing that this unlocks intrinsic motivation that enables a ton of personal growth and accomplishment, and is a big believer in the OKR system for enabling security operations and avoiding burnout. We thank Omer for sharing his story. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. and VPNs, yet breaches continue to rise by an 18% year-over-year increase in ransomware attacks and a $75 million record payout in 2024. These traditional security tools expand your attack surface with public-facing IPs that are exploited by bad actors more easily than ever with AI tools. It's time to rethink your security. Thank you. Learn more at zscaler.com slash security. Hi, my name is Omer Singer, and I lead cybersecurity strategy at Snowflake. For me, it was always going to be about computers. My dad was a pretty early engineer at Intel, and he got me hooked from a very early age. I remember playing computer games

when single-person was kind of the only option, and then also getting started with programming, learning BASIC, then doing some C programming, and just really falling in love with the power. I knew I wanted to be in computers, but I didn't know what I wanted to do within the field. When I went into college and started studying computer engineering, I still didn't know what I wanted to do within the field.

So it just started broad with general computer classes and everything that they make you learn around computers, most of which I haven't used since. But USC saw that cybersecurity was going to be a really important field, and they opened up a kind of certification. You could take classes with actual practitioners, people whose day job was in cybersecurity. But a few times a week, they'd come by the campus and teach cybersecurity kind of one-on-one. And that's where I got my exposure to cybersecurity. Really fell in love with it.

Really fell in love with it. So for me, it was actually kind of a direct line from school to work. You know, I mentioned that these were courses led by people that were practicing in the field. Actually, one of my professors at USC had his own cybersecurity consulting company, kind of a boutique firm. And I was his first hire. We started helping companies to protect themselves. Back then, you really needed to convince companies to care about cybersecurity. So it was kind of a different reality. And the way that we built that awareness, we actually extended a kind of a

free service where with their permission, I would plug in in the morning to the network. And for the afternoon, we had a presentation set and a blank PowerPoint presentation. And I would proceed to hack into the network and break into the servers with permission again, right? This was all authorized. But then in the afternoon show, you know, Mr. or Mrs. CEO, here's a coat that you insured and here's kind of the value and here's how I got it. And here's screenshots from your computer. And people were shocked that back then people didn't realize how vulnerable their networks were. And so through that, we built a business

and I got to experience cybersecurity also from the attacker's perspective, which is really a fun place to be. Kind of bounced back and forth between the offensive and defensive sides. I spent about four years in the IDF serving as a cyber intelligence officer and kind of saw firsthand what a well-funded and motivated team of cybersecurity experts can do. cybersecurity experts can do. And pretty scary, I think,

when you then you go back to the defender's position, especially for companies like Snowflake, where I ended up, you know, it's really a zero tolerance for breach kind of environment. But before I got to Snowflake, I just had more experiences in protecting networks. And one of the things that really stuck with me was how little measurement happens in cybersecurity. So we were doing all the security work, but our customers really didn't have a sense for how good or how bad of a job we were doing.

And that kind of got me going on an entrepreneurial path. I was going to start my own startup. Co-founder ended up dropping out. So I found myself in Silicon Valley with a pregnant wife, no health insurance, and really kind of a predicament, but I had this background in cybersecurity and went and applied for security engineering roles. And I didn't know what a data warehouse was, but when I learned about Snowflake as a company and how it has this mission to be kind of this infinitely scalable database in the cloud, I was very intrigued by that.

When I joined Snowflake, I was in the internal security team. And our mission was to protect Snowflake as it went from kind of a crappy startup that is kind of moving fast and breaking things to a publicly traded, very well-known enterprise business. So we built a security program to protect that. My experience in doing that and building that security program with a data-driven approach led me to just talk to more and more customers. And I actually switched over to the product side. So these days, I'm helping security teams across Snowflake's customer base to take a data-driven approach to cybersecurity, apply some of the lessons that we've learned, that others have learned.

data-driven approach to cybersecurity, apply some of the lessons that we've learned, that others have learned, and I'm working with a lot of partners in the space as we're building this ecosystem. I'm helping kind of those two sides come together and have more successful security programs across all these thousands of customers. My leadership style is to give people a lot of credit.

I think you kind of need to choose early on, are you going to trust the people you hire? And to a fault, I trust people that they're going to do what's right and that they're going to do a good job. I'm a big fan of OKRs, objectives and key results. Setting explicit objectives for the people on the team, then those need to roll up into the team's OKRs, objectives and key results, setting explicit objectives for the people on the team. Then those need to roll up into the team's OKRs, which need to roll up into the company's OKRs. Everybody's clear on where we need to get to.

And the key results represent how progress is measured. So giving people a lot of kind of faith up front, but then also giving them transparency into these are our objectives, these are the key results, and how you'll be measured, I found builds a team that is intrinsically motivated and gets results. And I do hope that people look back and that I will have made an impact. I think there are people out there who I see doing amazing things in cybersecurity. There are people out there who I see doing amazing things in cybersecurity. And I know that my team back in the day in different companies where I worked,

was there kind of breaking into the field because I took a chance on them. And even though they didn't have any skills that were directly relevant to the role, I saw that they had passion and they had ability and that they would focus themselves. We could train them up to be successful SOC analysts or to be successful in the role. I saw that they had passion and they had ability and that they would focus themselves. We could train them up to be successful SOC analysts or to be successful in the field. And after that initial role, they really have gone on to do some amazing things. And hopefully they remember back to kind of how they got the start and that I played a role in that.

I think you need to stick to the mantra that this too shall pass. When things are going great and everything is just working the way you always dreamed it would, well, that will pass. But also when everything is going wrong and not according to plan, well, that will pass too. And for me, that was really the case, you know, when I just stuck to the things that I was passionate about, about cybersecurity and this kind of interesting intersection between cybersecurity and data. Stuck with that,

and things did turn around. And, you know, it was all for the best. This too shall pass. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Thank you. special discount for our listeners. Today, get 20% off your Delete Me plan when you go to joindeleteme.com slash N2K and use promo code N2K at checkout. The only way to get 20% off

is to go to joindeleteme.com slash N2K and enter code N2K at checkout. That's joindeleteme.com slash N2K, code N2K.