Michele Chubirka

Michele Chubirka

Washington, District of Columbia, United States
4K followers 500+ connections

Join to follow

About

As an accomplished security architect with over a decade of experience, I specialize in…

Activity

Join now to see all activity

Experience

  • Google Graphic

    Google

    Washington, District of Columbia, United States

  • -

  • -

  • -

    Toronto, Ontario, Canada

  • -

    Global

  • -

    Global

  • -

  • -

    Washington D.C. Metro Area

  • -

    Washington DC

  • -

    Global

  • -

    Global

  • -

    Kernel Space

  • -

    Washington D.C. Metro Area

  • -

    Reston, VA

  • -

    Washington D.C. Metro Area

  • -

    Washington DC

Education

Licenses & Certifications

Publications

  • The Good and Bad of BYOD

    Dark Reading

    BYOD has very little to do with technology and everything to do with security, organizational politics, and human psychology.

    See publication

  • Exploring logical, physical access control systems integration

    TechTarget: SearchSecurity

    Because physical access control systems (PACS) -- electronic systems that organizations use to restrict and audit physical access to campuses, buildings, rooms and often physical IT assets -- aren't usually deployed and managed by IT. That leaves them as islands unto themselves: a necessary control, but without any integration with other digital access control systems and little oversight by security teams, even when they're in scope for compliance initiatives such as PCI DSS and HIPAA. But is…

    Because physical access control systems (PACS) -- electronic systems that organizations use to restrict and audit physical access to campuses, buildings, rooms and often physical IT assets -- aren't usually deployed and managed by IT. That leaves them as islands unto themselves: a necessary control, but without any integration with other digital access control systems and little oversight by security teams, even when they're in scope for compliance initiatives such as PCI DSS and HIPAA. But is this really the best way to approach a system that can easily be the Achilles heel to the best security program?

    See publication

  • In dog days of enterprise authentication, can FIDO Alliance help?

    TechTarget: SearchSecurity

    Early evidence has demonstrated that a number of factors set the stage for the recent Target payment card data breach, and one of them no doubt was poor authentication practices.
    Unfortunately, that's no surprise; many security researchers have been predicting an authentication epidemic for more than a decade. This leaves most wondering if it's finally time to rethink common online authentication practices.

    See publication

  • Wireless security options don't have to break the bank

    TechTarget: SearchNetworking

    As wireless network attacks increase, wireless LAN (WLAN) security becomes an exhausting proposition for most enterprises. Users and guests demand easy access, but corporate resources need to be protected from this high-profile attack vector. An enterprise could break the bank trying to maintain compliance and minimize risk -- even as it needs to know it's protected from malicious foes. The good news is that there are lots of excellent, well-documented open source (i.e., free) tools available…

    As wireless network attacks increase, wireless LAN (WLAN) security becomes an exhausting proposition for most enterprises. Users and guests demand easy access, but corporate resources need to be protected from this high-profile attack vector. An enterprise could break the bank trying to maintain compliance and minimize risk -- even as it needs to know it's protected from malicious foes. The good news is that there are lots of excellent, well-documented open source (i.e., free) tools available to test and monitor your wireless network. And they don't require a tin-foil hat.

    See publication

  • Web application firewalls may not fix Web application security issues

    TechTarget: SearchSecurity

    Attackers may target Web applications as much as they ever did, but there are increasing questions about how best to fit Web application firewalls into corporate defenses. Some security consultants have found they aren't worth the expense and effort needed to purchase, implement and manage them, given the disruption they can cause in enterprise network operations. Plus, without real attention to proper tuning, savvy hackers can often breeze past them.

    See publication

  • Will cloudification make enterprise IT jobs disappear?

    TechTarget: SearchNetworking

    It's no surprise that cloudification is sweeping IT infrastructures. There's Software as a Service (SaaS), Platform as a Service (PaaS) and even Security as a Service. We have public, private and hybrid clouds, with organizations demanding an increasingly faster spin-up of resources and services. What does this mean for in-house IT departments with large infrastructure teams, aging hardware and often-sluggish change management processes? Will the cloud make enterprise jobs evaporate?

    See publication

  • Agile vs. Waterfall development: Embracing each method appropriately

    TechTarget: SearchNetworking

    Agile or Waterfall development: It's the modern religious war of the information technology realm, leaving dead, bloody projects in its wake. While each model has its strengths and shortcomings, misconceptions reign over both. In practice, organizations with successful development cycles appear to employ a hybrid approach, taking a little bit from each methodology.

    See publication

  • Email Encryption And The Goldilocks Principle

    Network Computing

    Lamenting how similar problems often keep security measures from being fully successful, I conceived the Goldilocks Principle of Information Security. The effectiveness of a security control is judged by the following guideline: Is it too hard for the user, too soft for the security team, or just right for both?

    See publication

  • SDN promises centralized management, but we've heard this all before

    TechTarget: SearchNetworking

    At Interop in Las Vegas this year, there was a virtual deluge of vendors touting their respective Software Defined Networking-flavored products. I kept experiencing a vague feeling of déjà vu, of having seen this all before, but couldn't figure out why. Then as I sat in a product briefing I remembered why this all seemed so familiar: the wireless controller market.

    See publication

  • BYOD: Why You Will Lose

    Network Computing

    BYOD is the latest enterprise Boogie Man, bedeviling security and IT professionals everywhere. IT regards the management of personal devices as a simple issue of policy and enforcement, but we seem to be fighting a losing battle. Maybe it's because we misunderstand the real motivation behind a user's compulsive attachment to a smartphone or tablet. I blame Homunculus.

    See publication

Courses

  • Advanced Searching and Reporting with Splunk

    -

  • Aerohive Certified Wireless Administrator (ACWA)

    -

  • Aerohive Certified Wireless Professional (ACWP)

    -

  • Analyzing TCP/IP Networks with Wireshark

    -

  • Bluecat Proteus and Adonis Administration

    -

  • Bro Network Security Monitor

    -

  • CISSP Boot Camp

    -

  • Certified Wireless Network Professional CWNA/CWSP

    -

  • Cisco Security Configuration

    -

  • Foundstone: Investigating Cyber Attacks

    -

  • Managing Internet Mail: Setting Up and Troubleshooting Sendmail and DNS

    -

  • Mindfulness Based Stress Reduction Course

    -

  • Mindfulness in the Workplace

    -

  • Netscaler Basic and Advanced Administration

    -

  • Respectful Confrontation Workshop

    -

  • SANS Computer and Network Hacker Exploits

    -

  • Searching and Reporting with Splunk

    -

  • TCP/IP Weapons School 2.0

    -

  • Tactical Exploitation: Metasploit

    -

  • Troubleshooting and Securing TCP/IP Networks with Wireshark

    -

  • Using Cobalt Strike

    -

Projects

  • Cybersecurity's Social Problem

    The practice of information security seems to be stagnating, mirroring many of the problems of our criminal justice system, which is primarily focused on a reactive and punitive approach. We're stuck in a loop of identifying vulnerabilities and mitigating attacks after we fail to address those vulnerabilities quickly enough. What if this state of affairs is the symptom of a larger, social problem? Restorative justice, which focuses on repairing harm and restoring relationships, has seen…

    The practice of information security seems to be stagnating, mirroring many of the problems of our criminal justice system, which is primarily focused on a reactive and punitive approach. We're stuck in a loop of identifying vulnerabilities and mitigating attacks after we fail to address those vulnerabilities quickly enough. What if this state of affairs is the symptom of a larger, social problem? Restorative justice, which focuses on repairing harm and restoring relationships, has seen success in the fields of criminal justice, education and health care. Could these principles be effective in the realm of information security as well?

Honors & Awards

  • Program Committee: CloudNativeSecurityCon North America 2023

    The Linux Foundation

  • National Science Foundation Panelist for grant proposal review

    -

  • Interop Las Vegas 2015, Speaker and Instructor

    UBM Tech

    Workshop: The Mobile-Friendly Enterprise - From Apps to BYOD
    Session: Ending the Tyranny of Expensive Security Tools - A New Hope
    Session: Demystifying Wireless Security Using Open Source Options

  • Interop New York 2014, Speaker and Instructor

    UBM Tech

    Humans Aren’t Computers: Effective Management Strategies for IT Leaders
    IT leaders are expected to break down silos between different technology teams, get end users to understand and embrace policies, and forge productive relationships with their counterparts on the business side of the organization. This is harder than it sounds, because while people can behave rationally, they can also be governed by emotions such as frustration and fear of change. They can be driven by ego, a bad…

    Humans Aren’t Computers: Effective Management Strategies for IT Leaders
    IT leaders are expected to break down silos between different technology teams, get end users to understand and embrace policies, and forge productive relationships with their counterparts on the business side of the organization. This is harder than it sounds, because while people can behave rationally, they can also be governed by emotions such as frustration and fear of change. They can be driven by ego, a bad attitude, or simple ignorance. They can cause conflict that can disrupt professional relationships, drag down a team or even poison an entire department. Unfortunately for technical-minded leaders, there’s no Python script to program company-wide collaboration and harmony and get everyone to sing Kumbaya. We have to learn how to build healthy relationships with employees, drive engagement, and understand how to resolve conflicts using practical, effective strategies.
    ---------------------
    BYOD: Getting It Right
    BYOD is IT's Kobayashi Maru: a seemingly no-win situation. Users and executives want unlimited choice on devices and access, while IT has to protect corporate data and find some way to support a grab-bag of hardware and operating systems. Can IT really balance these competing demands, or are we being set up to fail?

  • Instructor, Rocky Mountain Information Security Conference 2014

    ISACA and ISSA Denver, CO

    Advancing Organizational Security Through Peacebuilding Workshop
    Why is the security industry so full of fail? We spend millions of dollars on firewalls, IPS, IDS, DLP, professional penetration tests and assessments, vulnerability and compliance tools, but at the end of the day, the weakest link is the user and his or her inability to make the right choices. It's enough to make a security professional cry.
    The one thing you can depend upon in an enterprise is that many of your users, even…

    Advancing Organizational Security Through Peacebuilding Workshop
    Why is the security industry so full of fail? We spend millions of dollars on firewalls, IPS, IDS, DLP, professional penetration tests and assessments, vulnerability and compliance tools, but at the end of the day, the weakest link is the user and his or her inability to make the right choices. It's enough to make a security professional cry.
    The one thing you can depend upon in an enterprise is that many of your users, even with training, will still make the wrong choices. They will violate BYOD restrictions, click on links they shouldn't, respond to phishing scams, open documents without thinking, post too much information on Twitter and Facebook, use their pet's name as passwords, etc. But what if this isn't because users hate us or are too stupid?

  • Interop Las Vegas 2014, Top Ten Ranked Speaker and Instructor

    UBM Tech

    Humans Aren’t Computers: Effective Management Strategies for IT Leaders
    IT leaders are expected to break down silos between different technology teams, get end users to understand and embrace policies, and forge productive relationships with their counterparts on the business side of the organization. This is harder than it sounds, because while people can behave rationally, they can also be governed by emotions such as frustration and fear of change. They can be driven by ego, a bad…

    Humans Aren’t Computers: Effective Management Strategies for IT Leaders
    IT leaders are expected to break down silos between different technology teams, get end users to understand and embrace policies, and forge productive relationships with their counterparts on the business side of the organization. This is harder than it sounds, because while people can behave rationally, they can also be governed by emotions such as frustration and fear of change. They can be driven by ego, a bad attitude, or simple ignorance. They can cause conflict that can disrupt professional relationships, drag down a team or even poison an entire department. Unfortunately for technical-minded leaders, there’s no Python script to program company-wide collaboration and harmony and get everyone to sing Kumbaya. We have to learn how to build healthy relationships with employees, drive engagement, and understand how to resolve conflicts using practical, effective strategies.
    -----------------
    Adventures in PCI Wonderland
    PCI DSS can be one of the most infuriating set of standards on the compliance landscape. While it seems simple--six domains and twelve requirements--the art of interpreting PCI can lead to full blown war in an organization--with the security team at the center. In this session we’ll demystify some of the more difficult and misunderstood aspects of PCI DSS. We’ll cover the important changes from recently announced PCI DSS 3.0. We’ll also discuss the best practices for starting (and maintaining) a PCI DSS initiative in an organization and how to avoid battles with the QSA.
    http://www.informationweek.com/interop/top-rated-speakers-from-interop-las-vegas-2014/d/d-id/1234877

  • Instructor, LISA '13

    USENIX LISA '13

    A New Model: Advancing Organizational Security Through Peacebuilding
    Humans are wired to be emotional beings. Emotions influence most of our decisions, good and bad. In failing to understand how this is at the root of user non-compliance, no matter how much money we spend on expensive hardware and software, we will fail to achieve the goal of good organizational security.

  • Interop New York 2013, Speaker and Instructor

    UBM Tech

    Beware the Firewall My Son: Nothing strikes fear into the heart of an engineer more than the installation of a firewall to achieve the laudable goal of defense-in-depth through network segmentation. Security teams demand the implementation of firewalls telling everyone, “It’s for compliance!” But the addition of firewalls and other security appliances (aka chokepoints) into an infrastructure infuriates network engineers who design to optimize speed and minimize latency. Sysadmins and DBAs are…

    Beware the Firewall My Son: Nothing strikes fear into the heart of an engineer more than the installation of a firewall to achieve the laudable goal of defense-in-depth through network segmentation. Security teams demand the implementation of firewalls telling everyone, “It’s for compliance!” But the addition of firewalls and other security appliances (aka chokepoints) into an infrastructure infuriates network engineers who design to optimize speed and minimize latency. Sysadmins and DBAs are equally frustrated, because of the increased complexity in building and troubleshooting applications. So it’s down the rabbit hole we go trying to achieve the unachievable with everyone waxing rhapsodic for those bygone days when the end-to-end principle ruled the Internet. Is it really possible to have security coexist with operational efficiency?

  • Speaker, B-Sides DC

    Security B-Sides DC

    BYOD, it's the new enterprise Boogie Man, striking fear into the heart of security professionals everywhere. We think this is a simple issue of policy, but if a recent study is correct and 20-somethings will risk their jobs to use their own devices, it's clear there’s more going on. One explanation for the attachment to our smartphones and tablets can be found in neuroscience.

  • Interop Las Vegas 2013, Top Ten Ranked Speaker

    UBM Tech

    Beware the Firewall My Son: Nothing strikes fear into the heart of an engineer more than the installation of a firewall to achieve the laudable goal of defense-in-depth through network segmentation. Security teams demand the implementation of firewalls telling everyone, “It’s for compliance!” But the addition of firewalls and other security appliances (aka chokepoints) into an infrastructure infuriates network engineers who design to optimize speed and minimize latency. Sysadmins and DBAs are…

    Beware the Firewall My Son: Nothing strikes fear into the heart of an engineer more than the installation of a firewall to achieve the laudable goal of defense-in-depth through network segmentation. Security teams demand the implementation of firewalls telling everyone, “It’s for compliance!” But the addition of firewalls and other security appliances (aka chokepoints) into an infrastructure infuriates network engineers who design to optimize speed and minimize latency. Sysadmins and DBAs are equally frustrated, because of the increased complexity in building and troubleshooting applications. So it’s down the rabbit hole we go trying to achieve the unachievable with everyone waxing rhapsodic for those bygone days when the end-to-end principle ruled the Internet. Is it really possible to have security coexist with operational efficiency?

  • Speaker, RSA Security Conference USA

    RSA

    As infosec professionals we are swimming in prodigious amounts of data, but it isn’t making us better at our jobs, it seems to make us worse. In Verizon’s 2012 Data Breach Investigations Report, it was found that across organizations, an external party discovers 92% of breaches. We continue to desperately grasp at that straw of, "more data,” but what if this is simply information gluttony.

  • Speaker, Shmoocon Firetalks 2013

    NoVA Infosec

  • RSA Security Bloggers Award

    RSA

    Finalist in category of Most Entertaining Security Blog.

  • Speaker, Appsec DC 2012

    OWASP DC

    AppSec DC is Washington DC’s premiere Application Security Conference.

  • Delegate, Networking Field Day

    Gestalt IT Tech Field Day

    Tech Field Day events bring together innovative IT product vendors and independent thought leaders to share information and opinions in a presentation and discussion format. Independent bloggers, freelance writers, and podcasters have a public presence that has immense influence on the ways that products and companies are perceived and by the general public.

  • Speaker, Shmoocon Firetalks 2012

    NoVA Infosec

    Security Is Like An Onion, That's Why It Makes You Cry:
    Why is the security industry so full of fail? We spend millions of dollars on firewalls, IPS, IDS, DLP, professional penetration tests and assessments, vulnerability and compliance tools and at the end of the day, the weakest link is the user and his or her inability to make the right choices. It’s enough to make a security engineer cry. The one thing you can depend upon in an enterprise is that many of our users, even with training…

    Security Is Like An Onion, That's Why It Makes You Cry:
    Why is the security industry so full of fail? We spend millions of dollars on firewalls, IPS, IDS, DLP, professional penetration tests and assessments, vulnerability and compliance tools and at the end of the day, the weakest link is the user and his or her inability to make the right choices. It’s enough to make a security engineer cry. The one thing you can depend upon in an enterprise is that many of our users, even with training, will still make the wrong choices. They still click on links they shouldn’t, respond to phishing scams, open documents without thinking, post too much information on Twitter and Facebook, use their pet’s name as passwords, etc…. But what if this isn’t because users hate us or are too stupid? What if all our complaints about not being heard and our instructions regarding the best security practices have more to do with our failure to understand modern neuroscience and the human mind’s resistance to change?

  • Nomination, Staff Choice Category for the 2011 GW Service Excellence Awards

    George Washington University

  • Thwack Ambassador

    Solarwinds

    Key thought leaders share their insights and concerns with the Solarwinds Thwack community. Each month, a new Ambassador is assigned to a section of the forum. http://thwack.solarwinds.com/people/networksecurityprincess/content

Organizations

  • National Association for Community Mediation (NAFCM)

    -

    - Present

    The National Association for Community Mediation supports the maintenance and growth of community-based mediation programs and processes, to present a compelling voice in appropriate policy-making, legislative, professional, and other arenas, and to encourage the development and sharing of resources for these efforts.

  • National Association of Community and Restorative Justice (NACRJ)

    -

    - Present

  • NoVA Hackers

    -

    Northern Virginia DC Area Infosec Group

Recommendations received

26 people have recommended Michele

Join now to view

More activity by Michele

View Michele’s full profile

  • See who you know in common
  • Get introduced
  • Contact Michele directly
Join to view full profile

Other similar profiles

Explore more posts

Explore collaborative articles

We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.

Explore More

Add new skills with these courses

See all courses