132: Solving Problems at Scale: Kenny Mesker on OT Cybersecurity Strategy, Risk, and Leadership

But yeah, that's an important one.

I think we do hear people who have listened to some of our 100-plus episodes and said that one or more speakers really spoke to them on the journey that they're currently on.

So I think, yeah, that's always, I think, a real valuable piece of these discussions.

Yeah.

I certainly like a good story about myself, but that being said, the thing I tell most people, because I'll have young folks come up to me and I've done some mentoring and I've done some college and university engagements and they'll say, how do I get into this? And my first piece of advice is you need to define what aspect of cybersecurity you want to get involved in, because I'm not trying to create an over equivalence here, but it's kind of like the medical profession.

it's one thing to say i want to be a doctor but that doesn't mean you necessarily know whether you want to be a neurosurgeon or you know emergency room doctor or pediatrician or whatever right and those are extremely different skill sets at the end of the day once you hit the professional level you're doing very different things from your colleagues that have the same you know the title and so it's the same with cyber so when people say i want to get into cyber i'm like well are you kind of interested in like the tv sexy version you know the you like the hoodie wearing hacker type and If so, then you might want to think about penetration testing or exploit testing or malware decomposition or those kinds of things.

Are you more of a, look, you know, a business degree sounds like a really good thing for me to have someday.

Well, then maybe you want to think about governance or policy and planning and those sorts of things.

And I'm only touching, you know, the barest little parts of it.

There's such a breadth of diversity in the cybersecurity realm.

And then you add the OT piece on top of it.

And there's some diversity even within that.

Not clearly as much, but nevertheless.

And so that's the first thing is you need to enter this knowing what you want to do.

And I don't want to scare people because you can't move around in that space, but you've got to find something you want to dedicate yourself to to get you through the door.

In my case, it was even though I was a very techie guy, it was risk assessment, risk management.

That sort of angle on things.

What would it be today if you told someone, if you sort of grabbed under risk assessment, which you said was incredibly immature, meaning lots of opportunity, right? Lots of things developed, templatized, done better, you know, systematized.

What would you say now? Would you say, hey, that's still, I mean, heck, go into assessment? Or would you say, you know, learn about the nexus of cloud or AI with cyber and industrial? I mean, what would be that thing now that you would seem to be akin to or sort of analogous to you picking that particular area back then?

There's easy and hard.

We definitely need more very, very qualified pen testers.

And by that, I mean, there are some pretty major certifications and things that I would expect a truly seasoned pen tester to have.

That pen testers come in all shapes and sizes, and there's definitely... a spectrum of experience and capability.

I personally think we're pretty shy on the high end of that scale.

So that's something, but you really have to dedicate yourself to that.