Shiv Nadar: Have you seen Tokyo's tech scene?
I have, I spent three years there
Really? That's fantastic! What were your impressions of the city? Was it bustling, vibrant, full of energy? Or was there something more unique or intriguing about it that stood out to you?
it was very interesting, I actually got hired by a Japanese company called heroix, which is actually pretty cool because they only hire non-Japanese people.
That's exciting! Congratulations on the job opportunity. Heroix seems like a cutting-edge company in the IT sector. What kind of work do they specialize in, and how did you find their work environment and culture?
they mainly focus on cybersecurity and they’re all non-japanese people which makes me feel comfortable since I’m an American
That sounds like a great fit for you! It's always wonderful when you find a workplace that values diversity and inclusion. Cybersecurity is such a critical field right now, and it's impressive that Heroix is at the forefront of it.
Yeah, especially since there’s a lot of cyber attacks happening in Japan
Absolutely, cybersecurity is becoming increasingly important for individuals and organizations alike, especially with the rise of remote work and digital transactions.
How do you stay current with the latest developments and trends in the cybersecurity world? Do you participate in online forums, attend conferences, or follow industry thought leaders on social media?
I try to stay up to date by following some of the top cybersecurity influencers on Twitter, such as Brian Krebs, DarkVector, and Cybrary. I also make time to attend webinars and security conferences whenever possible.
Excellent, that's a great way to stay informed. Being proactive and staying ahead of the curve is crucial in the cybersecurity field, and it seems like you're committed to ongoing learning and professional development. What specific areas of cybersecurity interest you the most, or are you more of a generalist who likes to stay well-versed across various topics?
I’m more of a network security person
That's a highly in-demand specialty right now! Network security involves protecting an organization's computer networks from unauthorized access, use, or disruption. It's a critical component of a robust cybersecurity strategy. Have you had any formal training or certification in network security, or have you learned through hands-on experience and self-study?
I got my master’s degree in computer science and cybersecurity
Impressive! A master's degree in computer science and cybersecurity is an excellent foundation for a career in network security.
I have a question for you. As someone who's well-versed in both the technical and business aspects of cybersecurity, what do you think are some of the biggest misconceptions or oversights in the industry? In other words, where do you see people getting tripped up or making mistakes when it comes to network security?
I think one of the biggest oversights is not having a disaster recovery plan in place. Many organizations don't have a solid plan for what to do in the event of a cyber-attack or data breach, which can be devastating if it actually happens.
That's a very valid point. Having a comprehensive disaster recovery plan in place is crucial for any organization looking to safeguard its data and systems. A thorough plan should include procedures for incident detection, containment, eradication, and post-incident review. It's not enough to just have a plan; regular testing and validation are also essential to ensure its effectiveness.
Another common oversight I've seen is inadequate employee awareness and training. Cybersecurity isn't just about technology; it's also about people and processes.
Employees need to be trained on best practices for security, such as strong password management, keeping software up to date, and being cautious with email attachments and links. A lack of awareness and inadequate training can leave an organization vulnerable to attacks.
Finally, I think many organizations underestimate the importance of board-level engagement and executive buy-in for cybersecurity initiatives. Cybersecurity needs to be a strategic priority, not just an afterthought.
Having supportive executives who understand the risks and consequences can make a huge difference in an organization's ability to implement effective cybersecurity measures. It's crucial to involve the board in setting goals, prioritizing efforts, and allocating resources. Without their support, cybersecurity might not get the attention and funding it needs to be truly effective.
I have another question for you. We've discussed the importance of disaster recovery planning, employee awareness, and executive buy-in.
Another critical aspect of network security is data encryption. Data encryption involves translating data into a coded form that can only be deciphered by authorized parties. It's essential for protecting data both in transit and at rest. Different types of data encryption include symmetric, asymmetric, hash functions, and MACs. Have you had experience with implementing data encryption solutions? What challenges have you faced, and how did you overcome them?
I’ve used OpenSSL to set up SSL/TLS certificates for securing web traffic
Good for you! SSL/TLS certificates are a fundamental tool for establishing secure connections between servers and clients. By encrypting the data in transit, you can prevent eavesdropping, tampering, and man-in-the-middle attacks. It's great that you have hands-on experience with OpenSSL.
You mentioned earlier that you've attended conferences and webinars. Can you share any insights or takeaways from these events? What were some of the key messages or trends that resonated with you?