Katie Nickels doesn’t want you to panic.
She knows organizations face a seemingly overwhelming volume of digital attacks — in most cases while understaffed and under resourced — on a daily and weekly basis. She knows the reality of the danger: that companies are not unlike Odysseus and his crew, their ships perpetually caught between the threat of two monsters: the six headed Scylla (or the many headed cybercriminal underground) and the gaping maw of Charybdis (nation-state hacking groups) that can swallow businesses and governments whole.
But panic offers no help and no comfort. Information helps. Guidance comforts.
For instance, ransomware is big news, and it’s clear the broader public are hungry for more information from threat intelligence companies in the media, but what kind? Should analysts and reporters studiously track each breached company, something that can play right into the business model of cyber criminals? Should they focus on the groups themselves and how they’re structured, or their victims and the impact?
Nickels said while these attacks are legitimately frightening, when the next big hack or campaign inevitably hits, she tries to focus her team’s time and efforts not on alarming rhetoric about the potential impact that can feed a larger sense of hopelessness, but rather developing actionable, rapid response — technical guidance to companies and IT security teams that they can use right now, today, to reduce their exposure and mitigate harm.
“When talking about ransomware … we lean towards the massive impact and how scary and harmful it can be, which it is, but what I’ve tried to emphasize in the work that my team does, in talks and conversations with the community is that there are things you can do to prevent it or detect the precursors early on to prevent it from getting so bad,” she said.
Click here for full coverage of the 2021 SC Media Women in IT Security
Nickels made a big career leap in the middle of the pandemic, going from Mitre, a large not-for-profit corporation with an established profile to Red Canary, a smalll threat intelligence startup that had about 160 total employees when she joined (today it’s closer to 300). Ever the analyst, she studiously examined her past posts, what new experiences she was looking for and the different possible paths her career could take before taking the plunge.
“I found that I had sort of reached the point at Mitre where I felt like I had made a big impact. I’m really proud and still proud of the work I did with the Mitre ATT&CK team making that framework useful for the community and really helping it catch on and be adopted by so many organizations,” said Nickels. “But I had felt like I was at the point where I was ready to grow in a different way, and so I was looking for a smaller team where I could come in and be part of a growth period.”
Nickels also takes her role as a mentor seriously, particularly for young women in the industry. She has served as a program manager for the Cyberjutsu Girls Academy, pushing others to adopt more informal, less awkward forms of mentoring relationships and crafting career guidance for young threat intelligence professionals who are less certain about their place in the community.
“The biggest way that I’ve confronted self-doubt is by finding people who believe in me and will kind of hype me up when I need it, to the point where I believe in myself. I try to carve out a different leadership style for myself that feels authentic, and part of that for me is just being honest that sometimes I don’t really know what I’m doing or I don’t know if a decision is the right one. But I’ll deal with the consequences as they come.”
