Never Waste a Breach

Virginia Tech students are securing the digital world, guided by some of the founders of modern cybersecurity

When people ask Randy Marchany how he became a cybersecurity expert, they get a starkly pragmatic answer: “Because I got the crap hacked out of me multiple times, and you learn from your mistakes.” As CISO for Virginia Tech, Marchany applies his knowledge and astonishing list of accomplishments in the cybersecurity discipline to educate and inspire, preparing new generations to succeed in an ever-changing digital future.

In August, Marchany will celebrate his 49th year working at Virginia Tech, a testament to an educational culture defined by a passion for research and hands-on exploration. “We were involved in a lot of cutting-edge research and our central IT group, where I was, had a hand in a lot of that.”

The university ranks 54th in the National Science Foundation’s Higher Education Research and Development Survey in the U.S. and is in the top 6% of research expenditures of all the universities in the nation.

“We have a lab associated with the office that we created in 2003 to provide a way for graduate and undergraduate students to do research on any cybersecurity topic. We don’t care what major you’re in as long as you want to do something with cybersecurity,” he said.

In addition to computer science and computer engineering students, political science, business, history, and sociology majors have researched topics such as privacy issues and social media abuse. “My office collects a lot of data on traffic patterns in and out of the university and the lab students have access to anonymized records,” he explained. “It’s been pretty successful for us.” Marchany is co-holder of three cybersecurity patents generated through the lab, which has produced 14 PhD students and 15 Masters students and a host of SANS® Institute members.

Formed in 1989 as a cooperative for information security thought leadership, cybersecurity professionals around the world rely on SANS for the training, certifications, and degrees needed to protect their assets and data.

At present, Marchany is overseeing an ambitious IT transformation that has ties to his own history. He was a member of the Center for Internet Security (CIS) development team that produced and tested the original CIS Solaris, HPUX, AIX, Linux and Windows2000/XP security benchmarks and scoring tools and was instrumental in the development of Critical Security Controls (CIS Controls), described by CIS as “a prescriptive, prioritized, and simplified set of best practices” that are used by thousands of cybersecurity practitioners across the globe.

There are 18 CIS controls, and the CISO’s team is implementing them across the entire university. “It’s a multi-year project, changing the culture of an organization and changing attitudes. That’s a real big challenge and a people skill, not a technical skill,” he said. “I think it’s a worthy thing, and I say this not because I was involved closely with the CIS controls project, but because they provide a way to defend yourself.” The need for a strong defensive posture is one of the defining aspects of the digital age.

“Let’s face it, 90% of the cybersecurity jobs out there are to defend a company. You have the pen testers, you have the government, nation states when they want to attack somebody, and firms that specialize in cyber penetration testing,” he mused. “If I went to work for a Fortune 500 company, my task as the CISO wouldn’t be not to attack somebody, it would be to defend our assets. That’s where the majority of the market is.”

Out of the blue

A random invitation to attend a cybersecurity conference held by the SANS Institute would change the trajectory of Marchany’s career. In the early ’90s, Marchany and a tight group of colleagues formed a support network for the university’s three UNIX sysadmins and a few item level specialists. A hack that took months for them to resolve propelled them to find a way to guard against future attacks.

“We researched every book that mentioned computer security. At that time, it was nothing more than a book on cryptography. And then we found one or two authors of books that were looking at UNIX security and things like that,” he said. “Gene Spafford from Purdue was one of the early guys who had written some articles on how to secure your UNIX systems.” The conference announcement included a partial list of speakers, all of whom had written articles or books on the subject.

His department couldn’t afford to send Marchany to the event, but shortly thereafter he received an outreach for conference speakers. He and colleague Ron Jarrell, another UNIX system analyst, put together a proposal despite not knowing anything about cybersecurity. What they did know about was their experience in dealing with UNIX hacks.

“I always say ‘never waste a breach,’ because whoever got hit remembers all the pain they had to go through, just like I did.”

At the time, revealing an attack was verboten by corporations afraid that details would be an invitation to get hacked again, not realizing that the exact opposite would happen. The duo proposed “Anatomy of an Incident,” an examination of the hack and its resolution, which SANS accepted. The standing-room-only crowd loved it; similarly impressed, SANS founder, the late Alan Paller, asked if they would work on some projects for the institute. “We said, ‘Sure, let’s learn some more.’”

Much later, Marchany and Jarrell discovered they had passed a critical test of Paller’s. “He told me, ‘I know if you say you can’t do it, I know that you can’t do it, but I also know if you say you can do it, that you will do it.’” When the institute began teaching programs, Marchany was the second instructor they hired. He still teaches four or five times a year, with most of the classes focusing on CIS controls.

To this day, Marchany chalks up his brilliant career to a series of lucky breaks. “If I had said no at any point in time, I don’t know where I’d be.” We’re sure he’d learn from that mistake and still show up to change the cybersecurity practice for the good of all.

—

Dedicated to its motto, Ut Prosim (That I May Serve), Virginia Tech takes a hands-on, engaging approach to education, preparing scholars to be leaders in their fields and communities. As the commonwealth’s most comprehensive university and its leading research institution, Virginia Tech offers 215 undergraduate and graduate degree programs to 31,000 students and manages a research portfolio of $450 million. The university fulfills its land-grant mission of transforming knowledge to practice through technological leadership and by fueling economic growth and job creation locally, regionally, and across Virginia.

—

Corporate Office

Phone Number: 540.231.6000

Homepage Link: https://www.vt.edu/