The Human Side of Cybersecurity

The episode contains substantive career insights and some actionable advice, particularly around authenticity in leadership and focusing on basics in OT security. However, much of the content is biographical narrative and soft leadership philosophy rather than dense, novel frameworks. The discussion of insider threat methodology and OT fundamentals (SANs controls, logging, removable media) provides value, but the pacing is slow with considerable throat-clearing and repetitive affirmations.

“Be authentic. If ever one. I felt like if I. If one time I was not authentic about something or you know what.”

“The five critical controls from SANs. And what's interesting is in OT cert, um, a few months ago I took a look at what are people accessing in our portal. Um, I can't see who accesses what, but I can see how many downloads of our data versus. And the top 10 is basic cyber hygiene stuff.”

The guest recycles familiar CISO wisdom: focus on basics, communicate business value, hire for passion, manage burnout through boundaries. The emphasis on authenticity is genuine but not novel. The insider threat research from CERT (2001-2013) is genuinely foundational work, but discussing it retrospectively lacks fresh perspective. AI commentary is predictable (don't use AI before basics), and the OT/IT segmentation issue is well-established industry knowledge.

“Just don't worry about AI until you get the basics down. The five critical controls from SANs.”

“Number one thing I would look for was passion. If they could answer all the questions right, and they had the technical ability, but they had no passion. Like, why do you want this job?”

Dawn Cappelli is highly credible: she founded the CERT Insider Threat Center, built insider risk programs at Rockwell Automation as a CISO, and now leads OT CERT at Dragos. She has executed at enterprise scale (Rockwell creates ICS) and in government (Secret Service, FBI collaboration). Her background is operational - not a consultant or thought leader - with concrete wins (catching Chinese embedded firmware engineer, establishing national standards). This is a legitimate practitioner.

“I started my career programming nuclear power plants at Westinghouse. From there, I went to Carnegie Mellon University, still as a software engineer.”

“So I became the founder and the director of the CERT Insider Threat Center. We went on to do a lot more work in insider threat with the government.”

The episode lacks concrete metrics, dollar figures, and specific attack examples. While the guest mentions 3200 OT CERT members in 73 countries and 75 resources, most claims are vague. The insider threat CERT study is referenced but not detailed. Rockwell's specific vulnerabilities, threat models, and metrics are absent. The bioterrorism portal project is mentioned but not analyzed. The AI and OT hype discussion contains no case studies or real incident data.

“We have 3200 members, and it's just a dream job.”

“We Caught a lot of insider threats, including a. Ah. Ah, senior embedded firmware engineer from China who stole all of our source code. But we caught him so fast that he wasn't able to do anything with it.”

The host asks competent but often softball questions with minimal follow-up depth. Questions like 'what made you realize cyber was where you wanted to be?' invite narrative rather than challenging claims. The host affirms frequently ('Amen,' 'That's great') without probing contradictions or specifics. When the guest makes claims (e.g., 'people aren't doing the basics'), the host doesn't ask for evidence or counterexamples. There are no sharp disagreements or pushback on AI hype, risk frameworks, or OT strategy. The conversation feels friendly but lacks intellectual tension.

“Uh, that is truly amazing. And isn't that what set the foundation for the whole, you know, the SEI inserts like Insider Threat Management Program?”

“Um, so Don, I'm going to ask you a question. You know, you've managed teams, and you've had teams, you've hired teams. Great teams. And how would you make sure, you know, if you're hiring folks that are like you, they're in it because they're passionate, they believe in the mission of what, what you're doing.”