There aren’t many people in the security industry that are more fascinating or more delightful to meet than Wendy Nather. She’s known the world over for her knowledge, insight, thought-leadership and, perhaps above all, her wonderful sense of humor and willingness to give anything a go (I’ll never forget seeing Wendy singing her heart out onstage as part of a security choir at RSA 2019!).
She is quite the inspiration, not just because she’s led an amazing career in the tech industry that has seen her fulfill various roles in both the private and public sectors, but also because she’s overcome challenges and difficulties that many of us can only begin to imagine being faced with.
I, like many others in our industry, will always have a real soft spot for Wendy – she’s always been warm and welcoming to me personally, and has also been an invaluable source of support and knowledge for Infosecurity Magazine for many years. She will probably be slightly bashful when I say it, but she really is one of a kind, with one hell of story – and it’s high time we tell it!
Wendy’s career has steered her to her current role of head of advisory CISOs at Duo Security (now part of Cisco), but she reflects that, long before she took even her earliest steps in the tech industry, it was the extraordinary occupations, talent and life of her father that had a big influence on her own trajectories.
“My father was an English Major in college, and he ended up becoming a nuclear physicist,” she says. “Well, originally he wanted to be a science fiction writer. When he was doing research for a book idea he had, he was talking to the director of a nuclear facility. The director told my father: ‘you know, you can be a nuclear physicist and you can write science fiction in your spare time, but you really can’t do it the other way around’ – and so he offered my father a job.”
That man’s name was Charles Wende – “I found out later, that’s where my name came from,” Wendy says with a smile. “It wasn’t from Peter Pan! My mother may have thought it was, but it was actually in honor of this man who gave my dad a job as a nuclear physicist, just out of the blue.”
Wendy’s father, Ed, does sound like quite the intriguing individual. He wrote one of the very first FORTRAN compilers, and based on his work in early computing, wrote The Story of Mel (a tale about the beauty of programming that went viral in the early 1980s and is still available on the internet today). He invented a lab machine that featured in the opening credits of the movie Fantastic Voyage, before waking up one day in his 40s and deciding he wanted to become an astronomer – which he also went on to do.
“He was successful going from job to job, in various different places, with little formal training,” Wendy explains – a trait, as you’ll soon learn, Wendy would inherit herself. Wendy’s father also introduced her to her first computer when she was 12 and the family was living in Tel Aviv, Israel (this is after stays in both Austin, Texas and Cape Town, South Africa), all places in which Wendy’s father worked and explored various academic pursuits.
“It was he that taught me programming,” Wendy explains. “I had told him I was bored – which is a mistake, you should never tell your parents you are bored,” she laughs. “He gave me this book and told me write a program that would make the bell on the teletype ring. He taught me that really to just give me something to do.”
“I think there are probably few people who have stayed as much of a generalist as I have”
A Language Lover
It wasn’t just a proficiency in programming that Wendy would develop though. Thanks to her father’s jobs being located in some pretty exotic places, she was able to learn some Afrikaans while living in South Africa, and some Hebrew while living in Israel. “I became very interested in foreign languages,” Wendy says. “In high school I took German, French and a little bit of Russian. I majored in Liberal Arts in College [University of Texas], concentrating on languages and history, spending my junior year abroad at the University of Würzburg, in Germany.”
By my count, that’s five different languages (six if you count English) learned whilst living in four different countries – all by the time Wendy was in her early-20s. That’s impressive stuff! So what led Wendy to the technology sector when she had such a passion and aptitude for foreign language?
Again, her father played an integral part, setting her up with an account on a PDP11 minicomputer when she was at university. “That’s when I learned Unix and I used its nroff and troff utilities to write my papers,” Wendy explains. “At that time, you usually had to type everything out and if you made a mistake, you’d have to go back and start the page again. For me, being able to type everything up, format it nicely and print it out, it felt like cheating! I became very good at formatting languages and I got jobs helping other people format papers whilst I was at college.”
Wendy found that the job offers, and the money, kept coming, so she made the decision to drop out of university and enter the full-time working world.
A Rolling Stone
Wendy moved to Indiana and worked as a typist and formatter before taking a job in New Jersey as a technical writer for Unipress, a software company, where she documented Gosling Emacs. She then headed to Virginia and found work at an interactive videodisc startup, in 1986. Are you keeping up? Good – because Wendy was soon on the move again a year later. This was when “things really started to come together,” Wendy tells me.
“I moved to Chicago and I was working as a technical writer and system administrator at a private options trading firm called O’Connor and Associates,” Wendy says. “They announced they were being acquired by Swiss Bank Corporation – which at the time was the second or third largest Swiss bank. I knew German and French [both widely spoken in Switzerland], and Unix. Suddenly these three things came together in a way that I did not anticipate. They needed somebody, located in Zurich, to help deploy and manage the trading infrastructure they acquired us for. I spoke German, I spoke French, and I knew the technology, so I volunteered to move to Zurich.”
Wendy lived and worked there for three years, managing the Unix systems O’Connor and Associates deployed to Swiss Bank as part of the takeover. “I never would have thought that my Liberal Arts education and my languages would have come in handy, together with the computer work I was doing, but it just serendipitously became a natural fit.”
When the company decided to outsource its IT operations in 1995, Wendy was put on a task force to figure out how that could be done without violating Swiss banking laws. “The company then sent me to London to head up the security team for the EMEA investment banking division – and that’s how I got into security.”
Wendy smiles as she tells me how much she enjoyed spending two years in London. “I had a very well-appointed ‘broom closet’ in Chelsea!” she laughs. She headed back to Chicago after that two-year spell to work as part of the global security team, before taking some time off work and moving back to Austin to care for her parents and have the second of her two children.
A Public Servant
After that time of hiatus, Wendy’s career journey took another new turn when she began working at the Texas Education Agency, overseeing its security program. “That was very different from Swiss Bank,” she explains. “When I was at Swiss Bank, I was helping to manage a budget of around $50m. On my first day at the Texas Education Agency, I walked in, and I was the only security person, and they wanted my budget request by the end of the day. I asked for a logging server and a couple of books – like $2000 – well, the person I was reporting into scribbled it out and said ‘where do you think you are, the private sector?’ – so I had a budget of zero and zero people when I started there.”
That must have been quite an experience, and Wendy recalls that her five years at the Education Agency taught her a great deal about security. “The attitudes towards security were very different. Back then it was difficult to make the case [of the importance of security] in the public sector. Luckily, I ended up with a new CIO who very much appreciated the need for security. He supported me and got me the people and budget that I needed.”
That’s where Wendy got her appreciation for companies that are below what she calls “the security poverty line.” There are certain things that they simply can’t do, she says, “and it’s not just a matter of giving them free software. There are a lot of other dynamics involved in that kind of poverty and the constraints that you’re under in the public sector.”
You have to be very creative; you have to borrow, beg and barter, Wendy says fervently. “You do whatever you can to put in as much security as possible, regardless of whether you have budget for it or not.”
Wendy clearly developed a real passion for working to make the public sector more secure, and her decision to leave the Education Agency in 2010 was no doubt a difficult one to make. “I was talking with Nick Selby, who founded the security practice at 451 Research,” she says. “I’d gotten to know him through Twitter, and we were hanging out at a conference in Dallas. He turned to me and said ‘why don’t you think about becoming an industry analyst?’ I initially thought I wouldn’t be able to do that, but Nick said ‘well you have the practitioner experience, why don’t you give it a try!’ By that time I had met Josh Corman [also originally of 451 Research] and he hired me into his team, as an analyst.”
So once again, Wendy embarked on a new position, with new challenges and new goals. I do truly admire not only Wendy’s ability to keep doing that, but also her fearlessness to do it. Nonetheless, I also can’t help but ask if there’s a reason why she’s moved around quite so much?
“I have no idea where I’m going to end up, but I’m enjoying the waves!”
A Fearless Fighter
“Well,” she says, “in my forties I was diagnosed with attention deficit hyperactivity disorder (ADHD), which explains why I always bounced from one thing, to another thing, and why I was really happiest when I could switch jobs, countries and states. I was always looking for the next challenge or the next opportunity.”
Ah! That does go a long way to explaining her tendency to constantly be on the move, although it’s a real credit to Wendy that she’s been able to use her condition to her advantage and experience a wealth of different jobs and opportunities. However, ADHD would prove to be only one of the conditions that had a big impact on her life.
Unfortunately, in 2011 and after she took over as director of the security practice at 451 Research, Wendy was diagnosed with breast cancer. A tough diagnosis to say the least, but Wendy was determined to forge ahead in her work.
“I continued to work, and I was really worried that if people in the industry or our research customers found out that I was ill, they would lose confidence in me, in my team and in the company” she says.
“I didn’t tell most people – some friends knew,” Wendy says, and she reflects on how she would sometimes work from her bed throughout her treatment, which continued into 2012. “There were a lot of medical emergencies during that time,” she adds. “The treatment itself made me very sick, and there were times when I ended up in the hospital for a few weeks.”
Wendy was pronounced to be in remission in 2012 and was able to go back to working and travelling with 451 Research full-time, something that came as a huge relief to her, but also saw her faced with ongoing challenges that still affect her today. “The thing with chemotherapy is that it leaves a very long tail – it affects your body far after it’s done. For example, I developed rheumatoid arthritis, which is something that can happen with the therapies. Chemotherapy resets your immune system, and I spent the next several years dealing with the lasting effects of chemotherapy; I’m still dealing with those.”
She faced those difficulties head-on though, also continuing to care for her parents through their own periods of ill health until they passed away in 2014 and 2015, and raising her two children. She was lead of the security practice at 451 Research until (yep, you guessed it) she took on a new challenge once more. She joined the Retail ISAC (now called the Retail and Hospitality ISAC), which was just launching in Austin in 2015, and led the company’s research team.
It was while Wendy was in this role that Duo Security invited her to its newly opened office in Austin, in 2016. “I had gotten to know Duo whilst I was at 451 Research, alongside all the other security companies,” she explains. “As soon as I saw Duo’s product, I thought wow this is amazing!” she says. “I got to know Dug Song and Jon Oberheide [Duo Security’s founders] and I really liked their vision. They had invited me to come and speak at one of the Tech Talks they were hosting. I came into the office there, I met the people and I really loved the atmosphere. So, I said, ‘would you happen to have any room for me at Duo?’ – it turns out they did! So that’s how I came to join Duo,” Wendy beams. “Now that Duo has been acquired by Cisco, it’s like having a whole new job all over again!”
Wow – so that, if you like, is Wendy’s career journey (so far) in a nutshell. It’s been a whirlwind (to say the least), and I wonder, having achieved so much in so many different roles in so many different places, what Wendy is most proud of in her career?
A Wave-Riding Surfer
She ponders for a few moments. “I think there are probably few people who have stayed as much of a generalist as I have,” she says. “Usually, people will pick a specialty and go very deep into it. I’ve tended to go as deep as I’ve needed to at the time to learn something about a technology, especially so that I could write about it as an analyst. So going both deep and wide is something that not too many people do anymore.”
So, no regrets? I ask. Again, Wendy takes a few minutes to think her answer over. “I think that, in some ways, people have regrets if they have a goal that they were working towards, and if they do something that doesn’t get them closer to their goal, it becomes a regret. However, since I didn’t have a goal, I actually don’t have those sorts of regrets.
“I admire people that have a goal and they work towards it – they pick a spot on the horizon and they just steer towards it and nothing will get in their way – but I’m more like a surfer. I‘ll look at the waves and think ‘hey, that one looks good,’ and then when it peters out, ‘hey there’s another one coming along, let’s take that one.’ I have no idea where I’m going to end up, but I’m enjoying the waves!”
That’s why she’s found security such a fulfilling career, Wendy adds, because “there’s always something new to learn. Either in the technology itself or in the application of security. It is very intellectually challenging, and there’s a huge difference between theoretical security and applied security. So much of the challenge is figuring out how to make the theoretical solution work in a real environment. That’s both the challenge for me, and the frustration. I love hearing stories of how people have been able to do that.”
There are so many different ways to view security, she adds, “so if I ever get bored of looking out of one window, I can go look out another window.”
I think whichever way you look at it, the security industry would not be the same without Wendy Nather!