Security Confidential S8 E5 Zinet Kemal

Manoj Tandon
Hello everyone. This is your host, Manoj Tandon, with another episode of Dark Rhino Security Confidential. Today we are honored to have Zinet Kemal join us. She has a fantastic story. She’s a recent immigrant from Ethiopia. She’s also a cybersecurity professional; she’s currently a Cloud Security Engineer at Best Buy, also an award-winning children’s book author, and is currently working on her Master’s degree from Georgia Tech in Cybersecurity. She is a very talented person. In addition to all these things, she finds time to be the Director of Community Outreach at Black Girls in Cyber. That’s a full schedule. Thank you so much for being here.

Zinet Kemal
Thank you for having me on, Manoj. I appreciate it, and thanks for that introduction. Wow, was that me? I don’t think that’s me or someone else.

Manoj Tandon
No, that is most definitely you. That is most definitely you.

And you know, just looking at your background, I would have never guessed that you are a recent—and when I say recent, nine years ago, I believe—you immigrated from Ethiopia to the United States, correct?

Zinet Kemal
Yes.

Manoj Tandon
I would have never figured on that. But now I’ve got to ask you, knowing that background, how did that happen and why the United States? Why not—there’s so many places on this planet—why Minnesota?

Zinet Kemal
Yeah, why Minnesota? I always get it. I always get it.

Yeah, you’re right. So just to introduce myself—I mean, you already did the introduction—but just in case you forgot, I’m a mom of four and a wife. I try to always plug that in as a first set of credentials because they’re a lot of work.

But I’m glad that they’re not going to jump in. It’s still the summer; they might pop in here anytime. It’s okay, fun, right? Between the ages of 12 and a two-year-old toddler, I did immigrate from Ethiopia nine years ago. And the reason why we picked the U.S. is because we won a diversity visa lottery.

I think it’s a lot of—everybody fills it out from around the world to come to the U.S. I think every country has its own quota—from Ethiopia, from different parts of the world. So we got that opportunity.

At that point, I only had my son. He was less than three years old; now he’s 12. I don’t know how time flies, but I was also expecting my second one when we moved here, seven months pregnant. So we thought it would be a good opportunity for the growing family.

And the reason why we picked Minnesota is because this is the place where we know one person to come to the U.S. And that happens to be my husband’s old high school friend. She was living here, so we asked her, “We got this opportunity, can we come?” And she says, “Yeah, you can come. I’ll welcome you happily, but I’m only in Minnesota for four days,” because she needed to go back to Ethiopia after eight years of being away from her home country.

And it was like, that’s the best we can get. We needed somebody. We’ve never seen snow; we’ve never experienced the snow. And you know Minnesota is very, yes, very cold in the winter. So we could take anything we can get. So we came here; she showed us. I’m always super grateful for her and her family. After four days, we were on our own, figuring out—there’s a lot of stories in that, but that’s for another episode.

Manoj Tandon
That’s fantastic. And from what I’m saying, you came here and you went into law, right? You didn’t go—oh, were you in law in Ethiopia as well?

Zinet Kemal
Yeah, I had a law degree and I was working in the legal field for a few years, and then I came here and totally switched it up. I said I had to go back to school to do something else.

Manoj Tandon
But you practiced law here for a little bit? You were involved with that profession for a period of time as well, right? Now, why leave it?

Zinet Kemal
No, not in the U.S. Only back home. Yeah, I even got an opportunity for a scholarship to study a postgrad in Tanzania, in another African country. Because a lot of people think that Africa is a country, but it’s a whole continent with 53 countries. I always try to make a note of that. Ethiopia is just one country in the Eastern Horn of Africa.

But I was doing that in Tanzania, but when this opportunity came, I came. So it’s a complete revamp and switching career to go back to school from scratch, like going back to community college to do technology—you know, like computer programming, computer science. And all of that journey began after I moved here back in 2013. So, no tech background, no programming, no word of cybersecurity until, I guess, 2017 I should say.

Manoj Tandon
Yeah. So, why cyber?

If you were going to make a career change, I mean, there’s a lot of careers out there. Why cyber, really?

Zinet Kemal
Absolutely. When I came here, especially when you’re making that pivot, it’s a lot of thinking that you have to do because, right, people will tell you, “Go to nursing school,” people will tell you something else. And then having a lot of opportunities sometimes can be very confusing—like you have everything.

We don’t have that option back home. If you came from a certain route in your high school, you can only go to specific fields. So, because I thought I wasn’t good at math, I chose the social sciences route. That’s when I get to pick—you know, law. You can pick business, economics, and those types of fields. But I picked law, partly because my family chose that for me too.

But after when I moved here, I thought I would go into technology—somewhere in technology. I still didn’t know how vast it is. All I know is that I have the opportunity now; I get to do something I want, not something my family picked. They picked it because they thought it was a good idea—that you would get money if you became a lawyer and a judge. At one point my mom must have said something like, “If you become a judge, a lot of people will bring you cattle and camels” and that type of thing. I’m like, “That sounds like corruption; it’s not right!”

Manoj Tandon
Well, you know, their heart was in the right place.

One thing interesting that I read about you online—so I won’t believe everything, but it was interesting—I think you had said that you shouldn’t ask your kids what they want to be when they grow up.

Zinet Kemal
Yeah.

Manoj Tandon
Does that come from this experience that you personally had?

Zinet Kemal
Ah, because it’s always changing, number one. Number two, I think we mold them into becoming something that we want, usually. And I don’t want to be that influenced because usually we have a set of things that we know. We’re shaped by the things that we know.

And I know my mom, her intention was really great because I think her father was like—traditionally he is the person that people go to for resolving conflicts growing up. She saw how much respect that he had and the money, and people would come with things. And I always say that’s not the right way. But I mean, I was even successful being in that field.

But for my kids, choose something that makes you happy. I think happiness comes first—what they like. I don’t want to be influencing them, but I could only as a parent open exposure to things. For example, if it’s cyber, like “You have this option,” or tech—you can be anything you want. Those are also the things that I try to mention in both of the books that I wrote for children.

But yeah, that is the reason. I don’t want to be influencing them. I don’t know if it has to do with my experience, but to answer your question that you asked prior to that—cybersecurity. I hadn’t heard about cybersecurity until probably the end of 2017.

It was mostly me going back to technology, trying to learn what I like. Is it intimidating? Absolutely, if you don’t have the experience and especially if you’re learning with people who are already from here, and you don’t have a lot of people who look like you within those classes. Not one class, but two, three, four across the program in Computer Science, in Computer Programming, and myself trying to figure out what I’m doing.

So, towards the end of 2017, I had this opportunity—I think I talked about it in a number of places—to participate in a cyber defense competition representing the university. I became part of that team somehow. It took a lot of work, but I think that was my first exposure into that world. And when I say that, now I know what I want to do.

Because that happened during my senior year of doing my Computer Science degree, and up until that point, I wasn’t finding my place. Yes, you’re doing a lot of projects, a lot of deadlines on top of taking care of three young kids at that point—the fourth one wasn’t there—but it’s a lot of work. So doing another activity, which is considered extracurricular—at the cyber defense competition—being able to self-teach and learn, I think kind of gave me that exposure to say, “I think I like cybersecurity; I’m going to explore that, I’m going to learn more, and see what happens.”

Manoj Tandon
Yeah. You have to be a very driven person, because you started off not so sure of yourself in math and science, and now you find yourself with a Computer Science degree, which is heavy in logic, and you’re doing a Master’s in Cybersecurity—that too from Georgia Tech, which is a very technically savvy school, to put it in an understated way.

Right? It’s quite a transformation and quite a journey, and I hope that’s an inspiration for people listening.

Zinet Kemal
It is funny; it is quite a journey, quite a transformation. I always say it’s been nine years, but it always feels like nine days. Because so many things happen, time flies so fast. Right? I mean, the kids—being able to raise a family while building your career on the side just feels like time really flies by so fast. And it’s a lot of change too.

And I did say that I used to think that I wasn’t good at math. It was more like the fear of it—I don’t know why. And then when I came here and decided to be in tech, there are courses that you have to face naturally, and I had to take a lot of math classes.

What I did was, if I’m going to be this, I’m going to face it. So what I did was—I wasn’t really bad at math. It might have been the teachers; some of the things that influenced you into thinking that you’re not good at it. And I think a lot of—I learned that when I did presentations and stuff, a lot of people relate, especially women. They say, “We thought we weren’t good at math,” but that’s not true.

And I had to do a lot of studying because I thought I was bad. I had to do it, and I ended up getting A’s in all of the math classes, like College Algebra, Discrete Math—you can think of all the math classes that you have to take to be in Computer Science or Computer Programming classes.

So yeah, I think that’s a lot of transformation, a lot of learning, a lot of being agile, I think. That’s what happened in the last nine years.

From that community college to transitioning to a four-year degree to do Computer Science, still trying to figure out what I’m supposed to be. I used to think, “Okay, so I finished this program, but who would want to hire me?” Because I’m just in an industry where I don’t have exposure.

And then once I found that cybersecurity field, before I even stepped into the real world, is when things started to happen. Because I did an internship part-time, I was doing security certifications on top of the degree. I wasn’t just relying on the degree because I had to complement it with a lot of things.

When I was interning, the interns were younger than me because they were coming out of high school, but for me, I was transitioning from another field. But I think those kinds of experiences—to get real-world experience, especially if you’re coming from another continent—I think you need to know the culture too, because it’s a whole different situation.

And if you’re coming from being just a mom and a student, not having that experience—I think I talked about it—you need to have that transition from just talking to kids to talking in meetings. That was a transition that happened from my internship experience.

Manoj Tandon
Yeah. So let me ask you a difficult question then. You brought up the question of culture, and culture is certainly—I mean, Minnesota has a very different culture than Ethiopia. Have you ever felt or experienced that you were being held back because of your culture or your heritage? Is that something that you’ve ever had to face, or has it been pretty much smooth sailing?

Zinet Kemal
No, because in Minnesota, we have a lot of immigrant communities, refugee communities. So I haven’t seen that, especially in the spaces I have been in, like the Twin Cities and that type of thing. I haven’t explored the whole of Minnesota because it’s a very huge state.

But in schools and classes, like I said, a lot of people used to ask me—even people who look like me—they would assume that I’m in nursing or other fields. And when I mentioned Computer Science or Computer Programming, they would say, “That’s different.”

And I get that; I’ve seen that encounter in schools, on school campuses and that type of thing. But at the workplace also, you know, it’s not diverse. I mean, we already know cybersecurity is not as diverse as we would like it to be.

But I guess for me, I see it as—I always talk about how it needs to be diverse. You need to be tapping into perspectives from people of different backgrounds to solve the problems that we’re facing within the industry. But I see it more like: if I’m not going to be in that space, if I’m going to be intimidated and go away, who’s going to be in that space?

Right? We need to occupy that space and say that we do belong, and then occupy that space and be able to thrive and show other people, inspire other people, and be inspired by other people as well so that we can carve that path or open that path for other people too.

No specific experiences, but I haven’t seen that there are people who look like me being in those spaces as much as I would like to see, which would have been great.

Manoj Tandon
Yeah, you’ve been true to your heritage; you’re very proud of who you are, you’re very proud of being a mom of four, and being an author and having accomplished all these things.

What is your message for people who may feel they are different, or they feel like they have to conform to a certain set of rules because there’s an expectation, and not be true to themselves, maybe?

Do you have any thoughts on that?

Zinet Kemal
Yeah, I mean, the one thing that we don’t know about ourselves is the unique thing that we bring, or the “special sauce,” or the special ingredient about any individual—it’s just the fact that you are being you. I can only be Zinet; I cannot be anyone else. And there are things that you get from me being Zinet, and everything that makes me me.

All of the things, like the experience that I have being in another field, or me being an immigrant, the challenges that I face not being in tech, and then being able to transition all of those skills and the transferable skills that you bring. And then me as a person—a visibly Muslim hijabi, black immigrant woman, being in an industry where it’s considered male-dominated and less diverse.

I think showing up—showing up pays off a lot. I think even on those hard days, it is very helpful. And I’m not going to lie, sometimes it can be exhausting. Sometimes there are self-imposed things that we go through. People, when they see us, the first thing that they see are some of the stereotypical things that they face. But I think you can only debunk that by just showing up and showing people that you can be in such spaces and you do belong, and you can also achieve more than anyone else can.

So I think it’s up to that person’s commitment; it’s the mindset. But it can be a burden sometimes. I face people and then I feel like I have to achieve more, always have to do more to belong in those spaces. And that would bring us to another conversation on imposter syndrome, which everybody else experiences—which I do.

I think recognizing that and saying, “I’ve done things and I should own it and I do belong,” and just pushing through are some of it, absolutely.

Manoj Tandon
Let’s see; that’s an inspiring story, and thank you for shedding some light on that because there are a lot of stereotypes.

I think the more people get to recognize that people are more similar than they are different, the world would be a better place.

So let’s switch tracks a little bit and go to your profession. Let’s enter the world of cybersecurity now.

We’ll talk about the enterprise and securing cloud and whatnot here in a minute. But you wrote a children’s book, right? Oh No, Hacked Again! I love the title.

In fact, I love that title so much that I might actually send that off as a gift to some professionals in the industry. They keep getting hacked again and again in spite of all the things that they keep doing. But as a parent, give all the listening parents some ideas on what they should do to keep their children safe in cyberspace, since you wrote the book on it. Yeah, I’d love to hear it.

Zinet Kemal
I did, and it’s my second children’s book. The one that I started writing first was titled Proud in Her Hijab. I think it’s in the background as well. Okay, that relates to the topic we talked about, to your earlier question about embracing your own identity.

But the second book—I have it here as well—Oh No, Hacked Again! That got published this year. It came about from the experience of my own kids being hacked during the pandemic while doing online gaming. But the concepts really translate to our experiences as an adult: how we click phishing links, or not having the right password, or not using MFA, and how we end up getting hacked.

So, to go back to your question, some of the tips that are touched on in the book—it’s a story, and it’s a transitional chapter book with five small chapters.

The story has some themes that are driven from the story: how you should be protecting your password, not sharing that—I’m just looking at some of the lessons here that are shared within the book at the end of it—it’s not to share your password with anyone, and also listening to your parents. Because we don’t do that as much; we give them gadgets and tablets, but I don’t think we think about whether we teach them about how to have a secure password, a complex password, or not to share it.

Manoj Tandon
Will a child understand that consciousness?

Zinet Kemal
Exactly. And I mean, if you don’t build that and model that behavior to the kids—if we do that and have those conversations within the home, I think they get used to that and build that security mindset and culture.

We as a family and parents are responsible for cultivating that culture, I think. And that’s the reason the book is meant to be a conversation starter between a parent, a grandparent, and a kid so that they know the importance of being safe online.

Like, okay, we tell them how to cross the street—look left and right, don’t talk to strangers—but do we do that in the digital world? Because those two seem to be blurred, especially after the pandemic, right? All the education is happening online; the games are happening online.

Especially these online games—that happens to be the only social networking that they do. My kids don’t have social media yet because they’re young. But the conversation grows even when you’re involving social media. This is—we’re only talking about chats while you’re gaming. They use chatting platforms, and then how do you protect them from online predators that are actively targeting children?

Manoj Tandon
So what can parents do for that, though? I mean, the password I get, but if they’re in a game, one of the biggest things is that these games—the interactive nature of them, where you can play with other unknown players from around the world, is what makes them so much fun. But that can also make them a little dangerous as well.

Zinet Kemal
Exactly.

Manoj Tandon
So how do you prevent a child, short of playing Big Brother and seeing who they are chatting with, or exactly what’s going on?

Zinet Kemal
Exactly. I always say that having conversations—the main thing is having open communication to make them feel like they’re safe to come to their parents whenever they’re running into issues. I think that’s the biggest one.

You can apply content filtering, you can do parental controls—all of those things, which I discussed in the book. But mostly it’s having that open communication. Like, if you get hacked for whatever reason, how do you come back and prevent that? Do you have that open communication with your parents to know it’s not okay to share your password, or how to secure your account?

All of the people that you talk to online—they may not be that 12-year-old boy that you think. It might be an adult who’s doing that, to avert those online predator dangers. So coming to a parent—and all of these things that I touched on in the book actually happened in our life. And if it happened in one home, it’s likely that it’s happening in another family.

So I think it’s meant to teach kids through the story that it’s important to have that conversation with the parent to build that security culture. And when you’re talking to people, to be kind because cyberbullying is another issue that’s happening. And the words that you put out on the internet matter. It’s going to affect your life.

Knowing all of those things is very important. But to answer your question, I think having open communication, and then you do apply to some extent those parental controls from your end, because you have to block certain things from their end so that you can protect them. But then I’m heavy on having that open communication so that they feel like they can share things with you.

Knowing what apps they’re using, what software they’re using, just getting involved in your kids’ life, in their gaming life. I know nobody has time. My kids always ask me—they even created an account for me to play with them, but I never logged in. I know what they’re talking about.

Whenever I’m cooking or something, they talk about something and then I’m always listening. I interject something like, “Whoa!” You know, and they’re like, “That mom?” And I’m like, “Yeah, I know!” It’s a few things that I picked just to show them that I know what they’re talking about, what apps they’re using.

And then just controlling their exposure as well—like how much time are they spending on a day on that device—and then just limiting that time. We lock it after a certain point, and they have to come and get an exception; otherwise, they’re limited on how much time they could spend.

Those are some of the things that are mentioned. Especially in the pandemic, people were not moving, just playing games. So encouraging kids that they should be doing other activities as well that don’t involve being online, such as reading books or doing activities. Because the book is meant for kids aged 6 to 14, and that’s the age group where you start talking about these small things that are going to be a huge thing when they grow up.

Manoj Tandon
Zinet, one thing while I was hearing you speak that you’ve said indirectly is something that we’ve said on the show many times: that cybersecurity is not an IT problem, it’s a business problem.

And when you talk about having that openness of communication, you’re kind of highlighting that in a big way—that it is very much a people issue. It’s an issue of process, of knowledge, of people.

Technology can help with parental controls and things like that in the world of children, but ultimately, if you don’t have a place where a child can come to a parent or an employee can go to an employer and tell them of things that have gone wrong, or an employer doesn’t share with an employee why certain policies are in place and how it makes them safer—it’s not there to restrict them, but to give them more freedom to go do the things that they want to do without the fear of somebody with malicious intent harming them.

Those are all business exercises; those are all process exercises; those are not technology exercises per se.

Zinet Kemal
Exactly, it’s a combination of all of those things. Right? Even the awareness piece—if we’re not training them. Because in the story, after she got hacked, she panics. She feels embarrassed to share that with a parent.

The siblings have this conversation about: “Our mom tells us about not sharing these things; she’s very serious about this.” And our parents always encourage us to come to them. It’s not only the training part, but also whenever something happens, come to the parents so that they can do something about it the right way, not you dealing with it for fear of that thing that you mentioned.

Yeah, a lot of the concepts for sure translate to our business experiences, enterprise-wise or to adults. And they even talk about how these things happen to adults too.

Manoj Tandon
Oh, they happen all the time. All the time.

Zinet Kemal
Yeah, absolutely. And that’s the main message of it.

And the other is—and we know that cybersecurity isn’t that diverse, and I talked about it earlier—is to spark interest for young readers to consider cybersecurity as a career option. Because in the story, the mom who is saving the day after all that had happened, the chaos after the hack of that gaming platform—a major gaming platform that kids love—it looks like me. The mom looks like me, and it’s encouraging people to consider that option.

After the mom helped her, the child says she wanted to be in cybersecurity, helping other people, protecting people from this type of theft, that data loss, to become a “cyber hero” type of thing. So it’s also to encourage young leaders to consider fields such as STEM and cybersecurity through those illustrations and representations that are portrayed within the story.

I just want to mention that this is the page that I’m talking about: that is the mother. Some people say that she looks like me, but when I do the read-alouds, when I get invited to schools and talk about this, the kids really—they do play such-and-such games, and everybody raises their hand, everybody plays the game. That’s how you get their attention to listen and impart some of the messages that you share.

You ask them, “I play for eight hours.” “No, no, that’s not a good idea; you should be limiting your time.” And then, instead of just saying “Play for two hours; don’t play this,” give them the reason how you should be protecting yourself online. I think that’s really important when you’re communicating with children.

Manoj Tandon
So, let’s switch gears here a little bit and go to the business world, the adult world.

You’ve spent a lot of time in cloud security. Give us some things that companies or businesses generally miss when it comes to cloud security—things that they should be looking out for.

Zinet Kemal
Yeah, so I started my journey, my cloud security work, after I joined Best Buy. Prior to that, I was working in Information Security and IT Auditing when I joined the world of cyber and the security space.

But from my limited experience that I had in cloud security, I think a lot of the conversation happened with not knowing the Shared Responsibility Model—thinking that security, once you’re up in the cloud, is the responsibility of the Cloud Service Provider.

I think having that mindset can be very tricky and allows for misconfigurations to happen, which is the main—I think every year a report comes out—it always comes up at the top of the list for cloud security risks, like misconfiguration.

So I think understanding the Shared Responsibility Model—or the Split Responsibility Model, I’ve heard that word too—what is the Cloud Service Provider responsible for, and then what am I responsible for as a client or as a user of those cloud services? I think it makes a huge difference in knowing what you’re responsible for and making sure that you’re configuring things the right way and protecting your data.

Manoj Tandon
I’m so glad you said that. I’m so glad. We’ve had several guests on here that have had this chat, and invariably when we go out into the field and talk to clients or prospective clients or give talks, it’s still all-pervasive that “If I use Microsoft, Microsoft is taking care of my security; if I use Amazon, Amazon is taking care of all my security; why the heck do I need to do anything?”

And your choice of words is very apropos: it’s a misconfiguration issue. You are responsible for your own data, for configuring your system, and configuring access to it and ensuring the identities that go to it are in fact the correct identities. Amazon’s not responsible for any of that.

Zinet Kemal
Exactly, and I always say anything that you’re seeing on your console, that’s something that you’re responsible for. There are things that are shared, there are things that are shared, there are things that you’re offloading to the Cloud Service Provider. But there are things—I think it begins from that.

Knowing that responsibility helps you define what you’re supposed to be doing as an organization and prioritizing that according to your business goals.

Manoj Tandon
Are there configurations or things that you have seen typically that get skipped over? I’ll put one out there: one thing that we’ve seen is that people who use S3 buckets a lot of times don’t secure the passwords on them.

Zinet Kemal
Yeah, that’s the main one; that’s usually what’s talked about. I think there might be real-world breaches that happen as a result of that, coming up in a lot of the reports.

But the other one is embedding credentials, and those credentials being accessible to public repositories. Those types of things are all huge things, getting embedded in those things.

I think there are a lot of things like that; those are preventable with the right knowledge. I think having the right skills and knowing that responsibility and being focused on that, instead of just—I don’t know what the word is, but—proactively prevent those things before you try to remediate things afterwards. Those are some of the things that I can think of.

Manoj Tandon
Yeah. Well, you’ve been a Blue Teamer as well. So tell us a little about some of the learnings from that experience. What was it like being on the Blue Team as opposed to the Red Team?

Zinet Kemal
I mean, we’re all defenders in a lot of the organizations that, at least in the spaces that I’ve been since joining the industry. But the CCBC competition that I mentioned back in school—that’s when I got to experience for the first time being on the Blue Team, representing the university to participate in that simulated act.

We have the Red Teamers sending us attacks, and how are we defending that simulated organization from attacks and reporting that accurately? That was my first line of experience, being a Blue Teamer in that CCTC competition.

Manoj Tandon
So, was there a—translating that to real-world experiences—are there things that you see, attack sorts that happen regularly that you have to defend against on an ongoing basis that you have seen come up?

Zinet Kemal
Not directly. I mean, I haven’t worked in incident response or those types of teams. But I’ve worked as an IT auditor, I’ve worked as an Information Security engineer—that’s on the defending side of things, right? And then now in cloud security, advising how to best securely use cloud services or how to configure them, working in collaboration with the business or the cloud security engineers, the cloud security operations, and architects.

But I mean, cybersecurity is diverse. You can choose the side of Red Teaming or the offensive side of it, and the defensive side of it, and you have so many options within those spaces and categories.

Manoj Tandon
So, you’re a certified CISA auditor, right?

Zinet Kemal
Yeah.

Manoj Tandon
When you’re going in to audit a company or looking at their profile, are there things that you would advise them to prep for before you even come into the business to take a look at it?

Zinet Kemal
Yeah. Like I mentioned, my first role within the cybersecurity industry when I joined was IT auditing. That’s when I explored this certification, the CISA. I was the internal auditor, part of internal auditing. We were auditing mostly the cybersecurity practices of that organization within a local government.

And we were checking—we have certain frameworks. That’s when I learned about the NIST Cybersecurity Framework or the CIS. And based on that, how are we ensuring that it’s complying and that the controls that we have internally are effective, to make sure that the cybersecurity practices are being followed or the policies have been followed? More like a compliance and internal auditing type of role.

I worked there for about two years before transitioning to the state government to work in Information Security engineering spaces.

I’d say you need to have a framework that you’re using, and then making sure that based on those accepted industry practices, how are we complying with that? And how are we ensuring that and testing those controls, making sure that the compliance is achieved, or if things are operating effectively from a security policy and control perspective.

Manoj Tandon
Now, since you have government experience and you’ve done this audit role, what are your thoughts? Do you think most government entities—whether at the state level or federal, as the case may be—have gained a lot of awareness on cybersecurity, or do they still have a long way to go?

Zinet Kemal
I don’t have experience with the federal level; I worked in state and local government for a couple of times. It depends on the organization’s maturity level. I mean, they’re all doing the best that they could based on the maturity level that the security programs are in.

I think that they’re doing their best, but I think it’s a question for every organization, right? I think it’s a matter of: how are you taking security as a priority?

So, based on the experience that I have, I think they do their best and try to achieve what they can—be it protecting their citizens’ data, or if it’s a private one, how are we protecting our reputation and maximizing profit without ending up on the news for the wrong reasons, right?

Manoj Tandon
Yeah, right. Oh, the media has probably done more to awaken knowledge on cyber than anybody could have possibly done. Because this problem is not new; it’s been there ever since the dawn of computing. It’s just now it’s come to the foreground, right?

Zinet Kemal
Yeah, I think it’s important to talk about that too. More priority, because the leaders and the executives now—probably because things are showing up—they might take things seriously to act upon things proactively versus to counteract something after it happened.

Manoj Tandon
Well, there’s a lot of reactiveness in there, that’s for sure. So, I know we’re getting towards the end here, but I did have one last question. And then I want to open the floor to you to talk about some of the things that you’re doing.

If you were addressing the people back in Ethiopia that may be looking for a way to better their careers, would you have any advice for those folks?

Zinet Kemal
For anybody—immigrants or folks everywhere—if you have that vision or goal of achieving, or you feel like you have to do something about it, or if you want to—if you’re not doing something that you love or like, something you’re passionate about, it’s never too late to do it or to redo it. I think if I’ve done it, I think anybody can. When I do this whole transitioning, I mentioned earlier there were a lot of people that I was doing an internship with when I started who were very young, from high school. And I’m redoing it from scratch. Whether you say, “I’m already too late” or not, time is still going to fly. Time is still going to go, either you decide to embark on that goal or not. So I would say, have the goal and embark on that journey. Once you start it, you never know—you don’t know how time flies—and you’ll be able to achieve those things with the right focus and the right mindset.

You’re capable of achieving whatever you set your mind to. If I can do it while raising four young kids, you can. I am always a continuous learner. You mentioned the grad school that I’m doing; I’m hoping to complete that by the beginning of next year. I have three more classes. Yay to that! It’s been a long journey. Whether you take it slowly or fast, it’s all about having that goal and knowing why you want to do it. It’s always critical. If you have that “why,” I think it gets simpler. Even on those hard days, I think it gets easier to achieve those things because you’re thinking about your why. And for me, I think I mentioned that a couple of times, I want to show my kids—especially my girls—that I could be the right role model for them if they want to embark on such things. If they want to rebuild or build their career, if they want to transition, it’s possible because they’ve seen that. Kids see and believe what they see versus what you tell them.

So I think I’ve shown them that with the career rebuilding and restarting, and then how to be able to thrive within that industry. Not only through education, but if you want to pursue that certification—because they’re involved. I tell them what I do, and then it’s a sacrifice too, right? So they needed to know it’s a sacrifice of time when you’re rebuilding something.

And then even when writing the books, because I knew nothing about self-publishing or writing a book. But just teaching myself and being able to walk with them through that journey: “Okay, now we need illustrations,” “Oh, now how do things fit in? Does it make sense? Does it become a book?”

Showing them, and then when the books won an award, they say, “Oh mom, you know, we have a book!” Can you believe that six months ago it was just an idea, and now we have a book? Sometimes they talk about it in disbelief, and I love the fact that they’re saying “we” have a book because I get to involve them.

The characters within the book are them; the names used are them intentionally, because they need to see themselves represented in the literature that they read. They need to see and hear their names and characters that look like them within those things.

So, if you have a goal, I think you can achieve it. You’re not defined by what your parents say you should be; you’re not defined by what society says you should be, or that you have to stick to one career just because you are deep into it. If you have another ambition and you’re not pursuing that because you think you’re old—those things are getting old themselves.

Manoj Tandon
You see that? That’s a very nice message. Thank you for sharing that; actually, that is a very, very nice message.

Tell us about—you have two minutes left. We’re grateful for your time; we don’t want you to use up more of your time than we should. But last two minutes: any new books, talks, anything that you’re getting involved with, any place you want to—anything you want to plug?

Zinet Kemal
Yeah. I think in the beginning before the show started, I mentioned that I achieved another certification just yesterday, and I just found out this morning that I passed. I was super excited about that one.

Continuous learning—that’s what I want to say. Continue, especially in cybersecurity. You can never say, “I have a degree and I’m done; I just work and go home.” You always have to be continuously learning. I think that’s the challenge of it, and that’s the exciting part of it too—both ways.

But I’ll say thank you so much for bringing me on this show to talk about these really interesting topics that we chatted about. I want to say: check out my books, my children’s books.

Manoj Tandon
Where can they find them? If people want to buy them, where can they be bought?

Zinet Kemal
Yeah, so it’s Amazon. It’s on Amazon, Barnes & Noble, and if you’re looking to get a signed copy, you can get it from my website: www.zinetkamal.com. I also have a website.

And yeah, check out the books. I’ve recently been featured on GMA, Good Morning America, to share some of the tips for parents on how to stay safe online based on the story of the book and the lessons from the book. So check that out as well. And just go ahead and be great! Everyone who’s listening: already you’re doing all the right things. Go ahead and be great.

Manoj Tandon
Well, Zinet, it’s been a pleasure to have you. Don’t be a stranger here when you write your next book or you do your next major accomplishment in the world of cyber. We’d love to have you back to talk a lot more.

Zinet Kemal
Thank you so much. I appreciate that.

Manoj Tandon
This has been fantastic, everyone. Zinet Kamal, thank you for joining us.

Zinet Kemal
Thank you for having me.