CyberWire Daily - Stacy Dunn: My superpower and my kryptonite. [Engineer] [Career Notes]

Episode Date: May 28, 2023

Stacy Dunn, a Senior Solutions Engineer from the SANS Institute sits down and shares what it is like to work through her own adversity to get to be where she is today. Stacy shares some of her experiences as a woman with ADHD working in an IT career and explains her tips for other neurodiverse people in the field. After working in a wide array of positions in different fields, she wanted to go back to school to get her degree in management information systems and information assurance. Eventually she started working her way up the ladder, and became a very successful woman in the IT world. She shares her struggles with ADHD as she was making the climb and says "It's both a superpower and kryptonite because I think something that is a fundamental misunderstanding of most people, and maybe even some people that do have ADHD, is that it's not just the aspect of not being able to focus, it's also an aspect of focusing too much." We thank Stacy for sharing her story with us. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. and VPNs, yet breaches continue to rise by an 18% year-over-year increase in ransomware attacks and a $75 million record payout in 2024. These traditional security tools expand your attack surface with public-facing IPs that are exploited by bad actors more easily than ever with AI tools. It's time to rethink your security. Thank you. Learn more at zscaler.com slash security. Hello, my name is Stacey Dunn, and I'm a senior solutions engineer at SANS. I wanted to be a little bit of everything. If you were to ask me back then, I would tell you, well, I want to be a veterinarian, and I want to be an artist, and I want to be a little bit of everything. If you were to ask me back then, I would tell you, well, I want to be a veterinarian and I want to be an artist and I want to be a teacher and I want to be this and this and this.

Was cybersecurity or anything that had to do with computers or information technology on my radar back then? No, no, it actually was not, even though that's something that I frequently did. I just didn't know it was an option until later in life. I started to take a really, really big interest in a couple of different things, namely gaming online, such as things like StarCraft. And then also, I really liked just being online. I don't know if that's really a good way to put it, but I liked exploring different websites. I liked to see if I could get to places that I wasn't know if that's really a good way to put it, but I liked exploring different websites.

I liked to see if I could get to places that I wasn't supposed to be. And I also liked to be online whenever I was not supposed to be either, which is a whole other story in of itself. At the time, whenever I first got out of high school, I knew that I wanted to go to college because I did participate in a scholarship program that got me two free years of tuition at a community college. I did the thing where I kind of waited a little bit because I didn't know what I wanted to do by the time I got out. But eventually I did go back and I went to pursue, at that time, I think it was a degree in psychology because again, it changed a lot. I wanted to get in and go toward my fine arts degree, which I did eventually do, but it changed a couple of times throughout that process. I was working generally in different retail jobs. There was one I had for quite some time. I was a

store manager at a very popular gaming store that a lot of people probably know about. And at one point in time, whenever you're in a role like that, either you love it or you hate it. There's some in between, sure. But I was at the end of my rope. And I, one day as a store manager, we were doing a store reset. And it just so happened that our networking person came in and I wasn't able to identify them right away because they were wearing a muscle shirt and sweatpants and socks and sandals. And they just looked, you know, really, really relaxed, really chill. Eventually they came up to me and said, hey, I'm so-and-so, I'm going to be working on your networking. I'm a contractor. And the first thing that I thought

to myself after being so frustrated with being a video game retail store manager was, wow, I wish I could be more like that guy. Maybe I need to get into tech. So what happened next was, it was kind of a joke at the time. I went to my partner and I had expressed that interest to him. I said, I don't want to do this anymore. Maybe I'm thinking of going back to school. And at that time, he said, absolutely. I've seen you troubleshoot your own stuff.

When you had a tablet that you couldn't connect, you were able to find the legacy drivers that you needed. I've seen you hook up your computer to the printer before. He's like, I don't really have to help you with a lot of any of those things. I really seen you hook up your computer to the printer before. He's like, I don't really have to help you with a lot of any of those things. I really think you could be good at this. You have a knack for it. So what that turned into was I decided I wanted to go back to school and I started to pursue a degree in management information systems and information assurance. In the meantime, I got a part-time work-study role at school at

their information technology department. And at the same time, I also got a part-time job as a teller at a bank. And interestingly enough, the bank teller position is what elevated me into my first, I guess, more serious technology role, four months after being a teller, I was already promoted to help desk. And then for help desk, after four months of being at help desk and purposefully trying to solve information security tickets, I was in information security. At that time, the CISO that promoted me into information security was a SANS instructor and had familiarized me with the organization, some of the content, and just kind of more communities or organizations that are centric to information security in general. security in general? I would say my leadership style specifically, I try to be very collaborative. I try to definitely, you know, work alongside people and pull other business units together. So we're all on the same page. I like to create repeatable frameworks that way we don't have to do things from scratch over and

over again so that's that's kind of the style that I like to fall into I like to you know be very transparent communicate clearly and make sure that we all align with things that we're best at doing and then you know course, sometimes challenge ourselves as well. I have ADHD, so that adversity can be in a variety of different ways. It could be my own internal struggles, or it could be something that's external that's happening that's causing the adversity. I would say, in general, the way that I handle it is, depending on the circumstances,

but typically I do fall under some of the same patterns of trying to give myself space and really trying to, I guess, dissect whatever problem I have piece by piece. That way it doesn't overwhelm me. It's both a superpower and kryptonite. Because I think something that is a fundamental misunderstanding of most people, and maybe even some people that do have ADHD, is that it's not just the aspect of not being able to focus, it's also an aspect of focusing too much. There's two sides of it.

And those things can happen simultaneously. Most people will experience both of those things. And whenever it's a hyper focus on something you need to get done, well, that's great, right? But then there are other times where you might have some executive dysfunction, which turns into maybe working on things a little bit at a time or piecemeal. And then you find, like, I've started all these projects and I have just like 20% of each of them done. One of the fundamental tenets of ADHD is, in my experience of it, I guess I will say, is that sort of, I always call it a dopamine slot machine, where whenever you find something new or you figure something out, you just get this like, oh, that feels great. So it's this constant series of solving different puzzles or problems that just feels really good to do. And I think

that that's why a lot of us are attracted to it because it has a lot of that, or rather a lot of those troubleshooting or puzzle-like aspects that a lot of us seem to be drawn to. And now, a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform Thank you. discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io.