Security Confidential S9 E10 Wendy Ng

Manoj Tandon: Hello everyone, and welcome to another episode of Dark Rhino Security Confidential. This is Manoj Tandon, your host, and today we are honored to have another brilliant guest join us. She is Wendy Ng—Dr. Wendy Ng—who is a brilliant scientist turned cybersecurity professional. To give you a little bit about her background, she’s a consummate consultant. She has worked at Cisco, PwC, and Deloitte. She is a Principal Cloud Security Architect and a keynote speaker. She’s been featured at Black Hat and has led the team at Experian in DevSecOps. She has really defined the strategy for that organization, especially when it came to their DevSecOps transformation initiative. She is regularly a part of the community and has had many appearances, most recently at Black Hat. We are just honored to have her on the show. Dr. Wendy, thank you for being here.

Dr. Wendy Ng: Thank you for having me. I’m delighted to be part of the show.

Manoj Tandon: Well, thank you so much. We have to start off with a very interesting thing. When you look back, we’ve had hundreds of guests on the show, and I’m coming to the conclusion that 90% of them did not start life in cybersecurity. They all arrived here some way or another, and you’re a geneticist and an honest-to-God real scientist. How do you go from that to IT cybersecurity?

Dr. Wendy Ng: When I was going through school, university, and postgraduate studies, there weren’t cybersecurity degrees. Sure, there were computer science, IT, or technology degrees, but cybersecurity didn’t exist. As for why and how, I trained in medical genetics at Oxford.

Manoj Tandon: Wow.

Dr. Wendy Ng: The background is that I came from a quite high-achieving family. My father’s a doctor, and so he was quite keen for me to do medicine. But honestly, I pass out at the sight of blood, so that was just not going to happen. It was like, “Next! What can I do?”

I was quite geeky anyway, so I did a genetics undergraduate degree and then did medical genetics. The issue is, I don’t wear much makeup because I have very sensitive skin. So when I was doing the lab work in a hospital environment, I had to do a lot in terms of hygiene, and I just got very bad eczema.

Manoj Tandon: Wow.

Dr. Wendy Ng: I just had to get out of the lab, basically. It was not good. Initially, I was going to go into something like the bioinformatics field because my PhD was quite analytical anyway. It was on complex diseases, so you need to generate a lot of data, number crunch, and run statistics on it to see whether the results are significant or not.

Instead, I joined Cisco as a technical consultant in internal consulting, which suits me just fine because I’m a quite geeky, social person.

Manoj Tandon: Cisco is networking, right?

Dr. Wendy Ng: Coming from a dramatically different field opened my eyes to things a lot. Even if you spend your entire career in one field, sometimes there are forces around you that you don’t notice. Because I came from a different field, I thought, “Hang on, everything was connected by the time I migrated over, and everything’s designed with connectivity in mind, but not security.”

Going forward, that was going to be an interesting field. I just felt like it was an area that was interesting because it was growing. It was a field that I could potentially contribute toward. I think I just looked at the opportunity and made a sideways step after my initial sideways step. So, it’s a very eclectic background.

Manoj Tandon: Well, do you think that put you at a distinct advantage? You came from such a different field, yet you had all the analytical training and none of the preconceived notions of what InfoSec was.

Dr. Wendy Ng: Yeah, thank you, that was the word I was trying to look for. I think it does help to have people from different fields, and in cybersecurity, that’s quite common anyway. Nobody in my generation or the generation above did cybersecurity as an undergraduate.

I think that is an advantage, and I think that may be the reason why it’s such a vibrant field. It’s a combination of geekiness and creativity that’s driving the whole ecosystem.

Manoj Tandon: The only other place we see that is in medicine. If you look at the entrance to medical school, there’s a large diversity of backgrounds. The number of engineers that go into medical school is staggering. Perhaps there’s something to be said for that, as opposed to just coming in from a pure computer science basis.

Dr. Wendy Ng: Interesting. I think so. I don’t know if my generation will ever get to retire. If you look at how long your career path is, the ability to change and move into a different field that you’re interested in is the most important thing. You need to be passionate about your work and interested in it for you to do well. That’s my personal feeling.

Manoj Tandon: I think that statement right there is worth the price of admission. That’s very true for anyone listening: if you don’t have a passion for what you’re doing, your chances of excelling at it are pretty much zero to none. Whereas with passion, much can be achieved.

Dr. Wendy Ng: Absolutely. I’m under no illusion that I’m in a very enviable position because I actually enjoy my chosen craft and my career. In that vein, it’s always good to give back, share with the community, and see how we can move everybody forward.

Manoj Tandon: Let me ask you this: as a geneticist or someone who’s worked with a lot of viruses, are there any lessons that compare between containing a virus and containing a breach or limiting damage? I’m just curious; it may be a really stupid question, but…

Dr. Wendy Ng: No, not at all. There actually are. I’ve been writing blogs since 2016, and I actually wrote a blog called “Herd Immunity.” The concepts are similar. It’s herd immunity in the sense of what we do using vaccines. You basically vaccinate the people you can. In the pandemic, you vaccinate as many people as possible, and through that process, you build up herd immunity, which slows down the rate of transmission of a virus in your population. One of the things it achieves is protecting individuals within your population that can’t elicit a good immune response. They might be on chemo or be immunosuppressed for other reasons. The concept of herd immunity really protects that population.

You can move that into the IT space—like mainframes, for example. It’s quite difficult to protect those because they are…

Manoj Tandon: Yeah, so that’s your immunosuppressed system.

Dr. Wendy Ng: I probably shouldn’t be saying this, but in terms of visibility and how you protect those, you just protect your ecosystem and wrap a protective sheath or layer around it.

Manoj Tandon: Interesting. I had never thought of it that way, but that’s a very interesting concept, and it seems logically correct that that’s how it would function.

Dr. Wendy Ng: I think conceptually there are a lot of similarities. With biological viruses, you’ve got different variants; with computer viruses, you’ve got different variants. The mode of spread is probably quite similar. The other thing that attracted me and was very useful is that in medical genetics, you deal with a lot of data. In security, there’s also a lot of data. You’ve got lots of logs. It’s about how you use tools to filter out what’s genuinely a signal from the noise of everyday activities in your organization. As a medical geneticist and a researcher, the analytical methods, the statistical methods, and the algorithms used are basically the same in both fields.

Manoj Tandon: The math and stats are going to be very similar. You’re still applying them to very large data sets and looking for deviations in the same manner. It makes a lot of sense, and the thought processes are going to share quite a bit of overlap. That’s very cool. I bet our audience definitely would never have equated training in genetics to cybersecurity. You were recently speaking on low Earth orbit constellations in Saudi Arabia. For our listeners that don’t know, what is a low Earth orbit constellation? I believe this is referring to satellites.

Dr. Wendy Ng: Essentially, yes. Most traditional satellites are geostationary or in medium orbit, positioned relatively high in the Earth’s orbit. They stay in the same relative position on Earth and are fantastic for things like satellite television. But because they’re placed so high, the latency for the signal is too long for real-time, high-speed situations.

Manoj Tandon: These are meant more for networking, then?

Dr. Wendy Ng: Yes. Because they’re positioned much lower in the Earth’s orbit, the latency for signal transmission is much lower. You can effectively deploy those for low-latency solutions and offerings, for example, the internet.

Even for developed nations like the UK, there are regions where they just don’t have internet access or they have very poor, unreliable, low-speed access. Having that satellite capability effectively aims to cover those areas, plus other use cases like when you’re on a flight, at sea, or in difficult-to-reach locations.

Manoj Tandon: It’s just everywhere.

Dr. Wendy Ng: Exactly, everywhere. Honestly, I think the internet is probably the start. You can actually piggyback a lot of other use cases on these satellites. So, it’s quite cool.

Manoj Tandon: How about securing them? I would imagine that even the control rooms would be secured with layers of physical security. Where is the chink in the armor?

Dr. Wendy Ng: I said this at Black Hat, so I think I’m allowed to say this. With traditional geostationary satellites, the physical security is really quite effective. The thing with low Earth orbit satellites is that because of the number of satellites, you need many ground stations. You need to connect them to a local area network or a wide area network. You have user terminals which send and receive signals between the satellite and your position. Effectively, it takes an attack profile similar to the Internet of Things. Essentially, I don’t think the satellites themselves are the most vulnerable part because they’re in the air.

Manoj Tandon: That’s good, right?

Dr. Wendy Ng: Because they’re so low in orbit, they whisk around the surface very quickly. If you’re an attacker on the ground trying a brute force attack, you have a very limited time span before that particular satellite whisks past you. At the moment, I don’t think anyone is flying over them yet.

Manoj Tandon: Not yet!

Dr. Wendy Ng: So, the most vulnerable parts are probably the areas where an organization has the least amount of control and the most amount of kit. You can probably guess where those are.

Manoj Tandon: It seems like that would be similar to what we see. As an organization, we do a lot of work in the infrastructure space. For us, it’s usually the human interface elements to the OT systems that we’re very concerned about.

Dr. Wendy Ng: Exactly. OT systems traditionally weren’t designed for regular updates. But there’s more knowledge out there now. Once a vulnerability is discovered, you have the same timeframe to remediate it before an attacker finds it. The thing about attackers is that they’re very collaborative. Once somebody knows something, it’s out there. They’re much more collaborative than us, I think.

Manoj Tandon: And they’re very innovative. They’re not under the same constraints.

Dr. Wendy Ng: You’re absolutely right. It’s a group of people that is quite intelligent. Maybe they’re using their efforts in a misdirected manner, but it is a very intelligent group of people to be able to do some of these things. We should never lose sight of that and dismiss them as average. If you’re a hacker, you can be a white hat or a black hat. If we can try and bring them over to our side, they’re actually fantastic at protecting your organization. We actually use hackers. We’ve been running a private bug bounty program for over a year. They provide a lot of information about our infrastructure—what’s secure and what’s not secure. If you can bring them over to the white side, they are fantastic.

Manoj Tandon: Talking about Black Hat and your keynote speech regarding these human interface points located all over the place: Is Zero Trust the best approach to securing it? Or at least elements of Zero Trust?

Dr. Wendy Ng: Zero Trust is fantastic for getting people’s attention. But at some point, you’re going to have to trust somebody. You have to have some trust, otherwise you can’t do anything. Nothing comes for free. If you’re going to have a control, there’s going to be overhead. If you have overhead, people are going to find ways around it. Regardless of how clever machines are, sometimes I think we are far cleverer. You have to be quite pragmatic about where your trust boundaries are. You want to have it so that if there’s a breach, the attack radius is minimized as much as possible, but without adding so much overhead that people resort to Shadow IT. That is every security professional’s nightmare.

Manoj Tandon: You pick up a newspaper every day—or open it on your iPad—and not a single day goes by where you can’t find a story of a major breach event.

First of all, let’s bust a myth: Is there such a thing as 100% security where you can stop everything?

Dr. Wendy Ng: No. People think that if we spend enough money, we’ll solve all our problems. You mentioned blast radius and limiting it. I’d like to gather your thoughts on how this applies to what we’re seeing in the world on a daily basis.For somebody who’s very motivated and has limitless resources, it is almost impossible to protect everything. Also, we’re in the light and they’re in the dark; we don’t know what they’re actually doing. Some tools can now detect some of those signals, but the safest thing, if you want 100% security, would be to grab your server, put it in six feet of concrete, dump it in a hole, and cover it with another six feet of concrete.That’s completely not practical.Everything comes with a risk. It’s not just cybersecurity. When you go out, you might get hit by a bus, but you calculate that risk and decide whether to go out or stay in your house.

You do enough so that it’s as mitigated as possible. When you’re driving a car, you wear your seatbelt, you don’t speed, and you don’t drink. You mitigate those as much as possible, but it’s impossible to have something that’s 100% secure. It’s not realistic.

I also think it’s not a fantastic frame of mind to get into because it scares people. People think they have to get to “100% secure,” whereas actually, it’s a continuous process. You just need to take a step at a time. You move from a very dark place to a lighter place, but it’s shades of gray, not black and white. Getting that across to our colleagues and the industry is important. You basically need to start taking steps in the right direction. It doesn’t matter if you don’t get exactly where you want in the end, as long as you keep moving.

Manoj Tandon: I’m so glad you said that. Hopefully, people listening are going to understand that. It’s about levels of security. It’s not a switch you throw where on day zero you’re not secure and on day two you’re completely secure. To do what you are suggesting, you have to have a consummate understanding of your risk and how much of it is acceptable. There’s a big gap between cybersecurity professionals and the executives running the business who may not have that deep interest in cybersecurity itself because that’s not what they’re paid for. How do we bridge that gap? Do we get them an understanding of the risk, or have them articulate what they believe are the riskiest parts of the business and secure those?

Dr. Wendy Ng: Both directions are better. As part of my consulting career and my last role driving the DevSecOps initiative at Experian, I did interact with the board. There is a certain level of translation required. Boards do have access to external consultants and experts. It’s not like they’re sitting in an ivory tower not caring. They honestly do, and they’re talking about it. I think the main gap for every organization and industry is finding the person who’s able to bridge the two.

On one side, you have those who are highly technical and understand how their system or product works inside out. Then you have execs who ask, “What does this mean for operational costs? How do we maintain this? How do we ensure we’re operating within regulations and safeguarding our stakeholders?” That interpreter role is quite crucial. When what you’re dealing with day-to-day is so different, it’s sometimes difficult to get a message across. The execs I’ve worked with are interested and want to learn; it’s just about how the message is translated from the folks who know the system inside out.

Manoj Tandon: So, effectively, what you’re saying is that the communication skill set is almost as important as the technical skill set.

Dr. Wendy Ng: Absolutely. Communication is massively important. You can be the most brilliant technical person in the world, but if you cannot articulate the problem, the risk, and the remediation path to the people who control the budget and strategic direction of the organization, then it’s very difficult to get traction.

At the same time, the executives don’t necessarily need to understand every technical detail. They don’t need to understand packet captures or memory forensics. What they need to understand is business impact, operational impact, financial risk, and reputational damage.

You need translators in the middle who can bridge both worlds.

Manoj Tandon: That’s a fascinating observation because historically cybersecurity people were not always known for communication skills.

Dr. Wendy Ng: No, not always.

Manoj Tandon: It’s changing though.

Dr. Wendy Ng: It is changing because the field is evolving. Security is no longer an isolated IT function buried in a basement somewhere. Security now impacts every aspect of an organization.

It affects legal. It affects compliance. It affects operations. It affects finance. It affects public relations. It affects customer trust.

So naturally, the people who are successful in the field now are often those who can collaborate cross-functionally.

Manoj Tandon: You mentioned DevSecOps earlier. That’s another area where there’s often friction because development teams want speed, operations want stability, and security wants controls. How do you balance those?

Dr. Wendy Ng: Very carefully.

Manoj Tandon: [Laughter]

Dr. Wendy Ng: The reality is security historically has often been perceived as the “Department of No.” Developers want to deploy quickly because the business wants new features. Security comes in late in the cycle and says, “No, you can’t do that.” That creates friction. The whole point of DevSecOps is shifting security left—embedding security earlier in the process so that developers can actually build securely from the start rather than having security appear at the end like a roadblock.

If you integrate security tooling and guardrails into the developer workflow, then security becomes an enabler rather than an obstacle.

Manoj Tandon: That’s much easier said than done though.

Dr. Wendy Ng: Oh yes, absolutely. Technology is usually the easy part. Culture is the difficult part. Changing organizational behavior is difficult because every group has different incentives and different KPIs. Developers are measured on feature velocity. Operations are measured on uptime. Security is measured on reducing risk. Those incentives don’t naturally align unless leadership aligns them intentionally.

Manoj Tandon: So this becomes more of a people problem than a technology problem.

Dr. Wendy Ng: Most cybersecurity problems are people problems. Technology is usually neutral. The implementation, the process, the governance, and the behavior around the technology are often where the real issues emerge.

Manoj Tandon: That may be one of the truest statements ever made on this show.

What concerns you most about the future? When you look out five or ten years, what worries you?

Dr. Wendy Ng: Complexity. Everything is becoming interconnected. We have cloud. We have IoT. We have operational technology. We have AI systems emerging. We have satellite networks. We have supply chain dependencies. The attack surface is expanding dramatically, and organizations often don’t even fully understand their own environments anymore. If you don’t understand your environment, it’s very difficult to secure it.

At the same time, the pace of innovation is accelerating. Organizations are under pressure to innovate quickly, and security sometimes struggles to keep pace.

Manoj Tandon: That’s a scary thought because if organizations don’t fully understand their own environments, how can they defend them effectively?

Dr. Wendy Ng: That’s exactly the challenge. Visibility is foundational. You cannot protect what you cannot see. Asset management sounds boring, but honestly, knowing what you have is one of the most important parts of cybersecurity. People always want to jump to the shiny things—AI, machine learning, autonomous detection systems—but often organizations still struggle with the basics.

Manoj Tandon: The blocking and tackling.

Dr. Wendy Ng: Exactly. The fundamentals still matter enormously. Patch management matters. Identity management matters. Logging matters. Backups matter. Network segmentation matters. Those aren’t glamorous topics, but they are incredibly important.

Manoj Tandon: And yet organizations consistently struggle with them.

Dr. Wendy Ng: Because they’re difficult operationally. It’s not because organizations are foolish. It’s because modern enterprises are very complex.

Large organizations may have tens of thousands of systems, multiple business units, legacy infrastructure, cloud-native infrastructure, third-party vendors, mergers and acquisitions—all of these things contribute to complexity.

Manoj Tandon: So, if you were giving advice to someone young entering cybersecurity today, what would you tell them?

Dr. Wendy Ng: First, stay curious. Cybersecurity changes constantly. If you enjoy learning, you’ll thrive. If you want a static career where you learn something once and repeat it for 30 years, cybersecurity is probably not the field for you. Second, build communication skills. The ability to explain technical concepts clearly is incredibly valuable. Third, don’t be afraid to come from a non-traditional background. Some of the best people I’ve worked with came from physics, biology, mathematics, psychology, linguistics—you name it. Different perspectives are valuable because attackers don’t think uniformly either. And finally, don’t get discouraged. Everybody feels imposter syndrome in cybersecurity because nobody can know everything. The field is simply too broad.

Manoj Tandon: That’s reassuring for a lot of people to hear because imposter syndrome is very common in cybersecurity.

Dr. Wendy Ng: Extremely common. You can walk into a conference like Black Hat and feel completely overwhelmed because there are so many brilliant people there. But the reality is everybody specializes. Nobody knows everything about reverse engineering, cloud security, application security, cryptography, hardware hacking, malware analysis, governance, and OT security simultaneously at expert level. It’s impossible.

Manoj Tandon: That should probably make a lot of listeners feel better.

Dr. Wendy Ng: I hope so. The field is about continuous learning, not perfection.

Manoj Tandon: Dr. Wendy, this has been a phenomenal conversation. Thank you so much for taking the time to join us today.

Dr. Wendy Ng: Thank you for having me. It’s been lovely speaking with you.

Manoj Tandon: And thank you to all of our listeners for joining us for another episode of Dark Rhino Security Confidential. We appreciate you tuning in, and we will see you next time.