Power and energy security strategist Emma Stewart is always on the lookout for what’s next in the U.S. electric grid, whether that be an influx of renewable energy or cyberattacks by malicious hackers. Her engineering background helps her understand how things work so she can break them to build them again, but stronger. Emma has announced she’s joining Idaho National Laboratory as Chief Power Grid Scientist and Research Strategist in the lab’s National and Homeland Security Directorate, putting her on the forefront of efforts to keep Americans’ electricity networks resilient in the face of cyberthreats. Emma previously worked as Chief Scientist for the National Rural Electric Cooperative Association, which represents the nation’s roughly 900 non-profit electric co-ops. Because rural infrastructure can lack the same level of funding or support compared to bigger electric companies, she often had to puzzle over how to fortify distributed resources from nation-state cyberthreats.
Power and energy security strategist Emma Stewart is always on the lookout for what’s next in the U.S. electric grid, whether that be an influx of renewable energy or cyberattacks by malicious hackers. Her engineering background helps her understand how things work so she can break them to build them again, but stronger. Emma has announced she’s joining Idaho National Laboratory as Chief Power Grid Scientist and Research Strategist in the lab’s National and Homeland Security Directorate, putting her on the forefront of efforts to keep Americans’ electricity networks resilient in the face of cyberthreats.
Emma previously worked as Chief Scientist for the National Rural Electric Cooperative Association, which represents the nation’s roughly 900 non-profit electric co-ops. Because rural infrastructure can lack the same level of funding or support compared to bigger electric companies, she often had to puzzle over how to fortify distributed resources from nation-state cyberthreats.
----------
Listen to this episode to hear more about:
* How cyber mutual assistance programs can help level the playing field in the fight against adversaries
* Emma’s cancer survivorship
* Takeaways from the S4 industrial cybersecurity conference in Miami Beach, where Emma was a speaker
Blake: [00:00:00] Well, thank you so much for joining us, Emma. Really appreciate having you on the show.
Emma: Hello. Nice to be here. Hope Paul as well.
Blake: Yeah. All as well. So, uh, you delivered a talk recently at the, uh, S four Industrial Cybersecurity Conference. That is one of my all time favorite info set conferences, uh, industrial cybersecurity focus based in Miami Beach. I guess what can you tell me about that experience?
Emma: It was actually a really great experience. I've spent a couple years, or more than a couple going to the conference. I've never actually spoken, so finally I, I got, they got to actually stand up on the main stage and say what I wanted to say. So it was a great experience. Um, all of the providers, all of the different people are there.
It's really, it's a great community to be in, um, just to share information with people and, and. Walk around and even just more comes from just walking around the corridor half the time than, uh, even going to a lot of the talks. Not that the talks aren't wonderful, but yeah, there's a lot to learn there.
Blake: There's a lot to learn and I'm sure there's a little bit of, uh, relaxation happening too. On the side of Miami Beach. [00:01:00] I'm a little jealous, uh, being based in DC Sometimes around the time S four happens in the winter, it can look like a pretty nice destination to get down to and talk about cybersecurity issues.
Emma: Oh yeah. A conference at a beach is never gonna be that bad, especially in Miami. So, you know, it's, it's a good place to be. It.
Blake: Now at, at, at the time you were, uh, you were chief scientist at, uh, the National Rural Electric Cooperative Association. I guess first of all, chief Scientist, that's a pretty interesting title. What, what is that about?
Emma: I'm actually joking at the moment that I'm currently the chief of the house of Emma. Um, I recently left N R E C A, but I'm uh, I'm still the same person. Still the same. I like calling myself a chief scientist cuz it's a really cool title, to be honest. Um, it's pretty much what I've been building to most of my career in that I really like looking at what happens in the future and how to help people get there.
I've worked in grid security for a long time. I've worked in resilience. I've always focused on the electric grid, and I think there's so many interesting things [00:02:00] happening, and it's a cool place to actually be to see the future and the future. We always planned when I worked in research and development as well, so.
Blake: Now that, that notion of resilience I find so interesting. I feel like you asked 10 different people what they think resilience means, and you might get 10 different answers. So, uh, what do you feel like a resilient grid looks like?
Emma: I mean, we have I think, three different definitions right now from three different agencies. So that's always interesting. But a resilient grid, yeah, no, there's, there's three, but they're all means roughly the same in that we're able to recover from events. It's not necessarily, um, being able to essentially like always withstand everything.
It's not reliability. It's really how do you. Recover and remain with the lights on, essentially when really bad things are happening. So it's a different scale of event. So from my perspective, there's also an angle of human resilience in the definition as well, and that resilience is really where we protect the humans from worst case scenarios happening as well [00:03:00] be that the lights being off for seven days or something along those lines.
Blake: I hope that doesn't happen anytime soon because, uh, I definitely need electricity both for my job and just for, you know, things like water and whatnot. From a, from a cyber perspective, what does that worst case scenario look like? I mean, I, I know obviously it's, it's pretty, you know, kept under wraps in some of these different, Examples that, uh, the utility industry is rehearsing around, but like, generally speaking, uh, what is the cyber threat facing the electricity industry today?
Emma: I mean, threat and vulnerability are two things that I think we talk about daily. Um, I was actually part of the, the radi work previously with darpa, which was where we essentially ran through, and I'll call it an emulation, a physical set of exercises where I assume the lights have been off for 30 days.
Where are we gonna go from here? How do we restore everything? And I think that's, um, that's the scenario. We all kind of plan for that big worst case day where nothing is good actually. Worst case [00:04:00] therapy days, from my perspective, there's other futures in there that may be more likely versus, um, consequence versus reality of things happening.
Um, we're spreading out our attack surface just now. We're doing distributed resources. We've got lots of things being added to the grid all at the same time. From my perspective, um, not being able to have that future because something disrupts the, the forward movement of it is, is a little scary for me.
Um, I'm fully believing that we need to change our energy system to be clean and more reliable at the same time. And, uh, if we don't get there, there's a, a bigger future in 20 years that's not gonna be great. So, long term and short term, there's two different issues I think from the cyber perspective at the moment.
Blake: I'm, I'm glad you mentioned the Radix program in, in darpa. I, I remember years back joining a, uh, reporting trip to this remote island off the coast of New York, plumb Island, where DARPA was doing some really fascinating research around grid security. Um, were, were you, did you ever. [00:05:00] Make it out to Palm Island.
Can you talk about any of that research? It's, it's this really isolated, interesting spot that just is like, you almost feel like you're in the hound of the bas or something roaming around it. A government controlled island. Um, were you involved in any of that?
Emma: I was, yeah, I'm actually a really big fan of the sort of apocalyptic world type scenario. So going out to Plum Island was actually pretty cool. Um, I actually grew up in a country that benefited from the work Plum Island did previously in Scotland. Interestingly, we had a a foot and mouth disease problem for a long time, and so I happened to actually know what it was.
Um, but we went out there and I was actually there. Yes, I was spent most of the time sitting in a white quarter Conex. I was hiding. I was the one that was some of the time making the grid wobble and annoying people. Um, it was a pretty cool scenario. Um, I was looking at things to do with, uh, how we, um, how oscillations might happen on the grid, um, and what that might mean to things like diesel generators and distributed resources.
Um, at the time I was [00:06:00] also leading one of the follow-on projects where we were looking at, um, things like large scale storage being out there and if it could help balance oscillations as well. So that was my life. Um, I generally went there a couple times and ran around in circles with a lot of people, and I think most people weren't sure if I was Ginger right, or Emma Stewart at the time.
So
Blake: Ginger Wright being affiliated with Idaho National Labs for listeners who may not, uh, may not recognize that name, but, uh, Virginia's great as well also, and I know the, the National Labs have had a huge hand in some of that research and yeah, it was really interesting. Yeah. You mentioned Plum Island has, you know, renowned for its research into, um, uh, animal diseases and I guess like has a level three biocon containment facility or some such.
It's, uh, and then also doing all this, You know, plain host because it's isolated grid, uh, to all these really interesting projects and, and research, uh, elements around cybersecurity. Um, and, you know, you, we talk about the worst case scenario, 30 days. Uh, you know, just assuming that that's happened and not.
Not really [00:07:00] dissecting the likelihood of something like that. You know, I guess day to day, uh, what are some of those more prosaic cyber threats that the electricity industry is facing? Cuz I know, okay, not everything's gonna actually cause a, cause a blackout. In fact, there never has been one in the US that we've known to be tied to a cyber attack.
Emma: One of the, the really interesting things that came out of all of that work, um, that I, what I found most interesting was, again, from a human perspective, I was watching sort of the cyber teams work with the grid operator teams, and at some point I remember them yelling each other and somebody wanting to put the system onto manual and get the lights on. And they weren't understanding that there was something set up there that was gonna brick everything at the time they did that. And so everyone was running around and yelling at each other. And I think that was a really cool thing on that island is you kinda isolated people and their emotions. And so you started to see how things were gonna play out, um, from things that might happen more in the, the short term world at the moment.
Um, [00:08:00] I am seeing a lot of sort of software challenges and hardware, especially from the, the software supply chain issues at the moment. Um, the number of Patchs that are released on a daily basis. Um, I think that's one of our growing issues is people, I agree with some of the statements that have been said recently.
Things that are in the national cyber strategy, also around vendors of products, um, from the software side, absolutely need to start working on secure development processes. And start to take some responsibility for it, cuz we're not gonna live without software at this point. So let's assume it's part of our infrastructure that needs to be improved.
Blake: Yeah. And it's getting so complicated too. You mentioned that tendency to wanna flip back. Okay. Too much is going on. We don't understand what's happening on the grid. Let, let, let's, let's go back to this manual process, right? Like, let's. Let's go flip switches by hand. Let's make sure the lights are on. You know, it's interesting cuz I know grid operators in Ukraine did that back when they suffered their first, uh, sort of first of a kind cyber attack on Ukraine's grid in 2015.
Uh, later [00:09:00] linked to Russia, uh, perhaps unsurprisingly, and the. Distribution utilities were able to just actually flip things on, get everything back on online and running manually. Now when you mention all the integrating all these distributed resources, solar renewables, complex software processes going into running the North American grid, you know, I just wonder how much can we really rely on that manual backup anymore?
Emma: I think to a degree, well, at the moment I think we can, there's a good degree of we can just get rid of things and get things back online at the moment, um, I don't think we'll be able to, in 10 years, um, I think we'll have so much automation and again, I think automation and these resources are a great thing.
Um, the interesting, I've seen the sort of Venn diagram separating of we need the communications, we need the automation to make this grid actually be reliable. But while we're doing that, we're also growing the amount of communications and the size of the attack surface. It's this Venn diagram has now separated in the best way.
We keep things secure in the best way. We keep things operating as [00:10:00] well. So it's, it's definitely an interesting challenge. Um, I will add one of the, um, things that came up recently was about. Is an outage actually the best thing that could happen from a resilience standpoint. Um, they've done it a lot in California.
Um, they turn off distribution lines when things aren't great because a certain wind condition and a certain fire condition coming together, it's not great for the electric grid and the grass underneath it. So, um, I do think there's new definitions of resilience and reliability that will need to come from our future grid as well.
Blake: That I didn't even think of that. That's a really good point. Maybe it's actually a net benefit to have suffer that outage and deal with the consequences, and it would be to deal with a devastating wildfire that resulted from down lines or, you know, uh, overheated lines running into vegetation or whatnot.
That's, that's a really good point. Um, now we've talked a lot about threats and, and risks so far, but, you know, I know S four, especially as a conference, is very focused on solutions and how do we get to where we need to be. Um, [00:11:00] I'm wondering, you know, what can be done? And I, I guess as I understand it, you talked there, touched on some of the uh, uh, potential solutions for getting defensive tools into the hands of people who need them.
Emma: Yeah, there's, there's a lot of things I think we can do. We've been going a certain direction recently on how do we monitor and actually see what's happening on the system. I think that absolutely has a role. We just need to work out what we're actually looking at. And from the electric grid perspective, that's my expertise.
I've worked on electric for 20 years, but from that perspective, I think we're somewhat missing. Context of what's actually operating. Like, do you know if this fault is actually a cyber fault? There's a number of things that could happen from the household perspective that you could then see blowing up a fuse.
You have no idea that that was to do with a cyber attack in your house. So I think there's some context that we could build in there. Basically speaking with operators more and having them be part of building these solutions, I think is a huge opportunity. They want to help. They absolutely do not want to be in the situation where they [00:12:00] have to deal with this.
So people do want to help build that as well. So the communities of practice coming together, I think is gonna be a, a good thing in future.
one of the things I've been thinking about recently has also been interoperability and diversity of components. Um, when say you install solar in a neighborhood, There's an interesting thing that happened in the last, I think, five years that one installer comes in and you end up with the entire neighborhood having the same component.
I think there's a lot we can do there from the simple side of let's not have the same component beyond every single location, all doing the same thing. So think is that the market's building, there's a good diversity in products and neutrality in products coming up as well. But in the end, it'd be really nice to just be able to spread things out and not.
Be worried about one component on 12,000 houses. So there's, um, a lot to do there, but interoperability of those components is, is gonna be vital data standards, um, basically allowing everyone to work together in a way to defend the system.[00:13:00]
Blake: So you, you talked a little bit about, uh, some of your background, but as I understand it, you haven't, you have quite an engineering background. How does that come into play in some of the work that you've done?
Emma: Oh, my title has changed from engineer to scientist, and at some point I was a scientific engineer. Um, I've varied between them both. Uh, my favorite part is, uh, essentially I'm very good at breaking things and I like rebuilding them after that and working out how things could be done better. Um, I have a small history of knowing how things go on fire, which is quite helpful.
It comes from my, uh, my dad's a forensic scientist and he used to call me frequently to ask me how things went on fire, um, especially in the electric system. And going back to fundamental physics, I could usually work it out. Um, but the, that helps me with the work I do now of if I know how I can break it, I know how I can probably stop someone else from breaking it.
And that's, that's kind of the engineering mindset more than the signs. But then it gives me the future where the signs will fix some of these problems in the future. So,
Blake: [00:14:00] I'm, I'm, I'm picturing that meme of the, the dog sipping coffee surrounded by fire. Is that so you could, you, you could reverse engineer what happened there, basically.
Emma: I'll, I'll send you a picture for this of my dog sitting around me as everything's on fire, as I'm drinking coffee. You'll be totally fine.
Blake: Nice. Nice. This is fine. This is fine. Well, no, it, it is, it is interesting, uh, that, you know, we hear so much about, Lurking Russian malware implants, China linked cyber espionage of oil and gas infrastructure. You know, really scary sounding stuff just day after day menacing our, our energy infrastructure.
And, you know, I don't doubt that some of these threats are, are, are, are all too real. But sometimes it strikes me at that the risk can seem a little bit exaggerated again when, when we've never really seen that impact. We haven't seen a US power outage attributed to a cyber attack. I guess how do you communicate that urgency of needing to find solutions and deal with this?
When, I mean, I think rational people could look at it and say, Hey, what's the big deal?[00:15:00]
Emma: I think that's been an interesting challenge recently. It's been a hard challenge. People are being flooded with information and I mean, rightly so. There's been a lot happening. Um, obviously with the Ukraine, with Russia, things have been spinning up pretty seriously. Um, so these, a lot of the threats aren't unfounded.
Um, but we have had a little bit of issue with, uh, actionable advice. As in you can tell people this threat is coming, but if they can't do anything about it, All we've really done is cry wolf and they potentially might not do anything in future when it comes again or not see it. Um, so we definitely need to think about how we provide people actionable information in future, or just send at the top of this, here's the action you need to take immediately.
Then the rest can flow from that. Uh, I'm used to sending people emails that say that, so it's a, here's what you should do now. Um, but yeah, I do think the actionable information needs to, to improve as well. And definitely, uh, How do we help people that have one cyber staff, one IT [00:16:00] staff that are trying to hold things together, um, how do we get more people around them when something is really bad and we know the right threats?
Um, so I do think there's a pretty solid community that needs to build around these entities to really help them at this point.
Blake: Right. And that hearkens back to some of your work at the National Rural Electric Cooperative Association, I guess, you know, representing hundreds of smaller electric energy providers, uh, throughout the US and. As you just mentioned, you know, some of these entities might not have designated, you know, cracked cyber teams ready to leap in at the first sign of a threat.
And, you know, maybe they're, maybe they have one IT person allocated for a geographic area that spans multiple towns in rural, you know, in, in rural Wyoming, or who knows, I guess. Who protects these companies and utilities? I mean, I, I feel like that's, it's not like the threats just diminish just because you're a smaller entity.
We've seen ransomware target everybody from tiny schools to, fortune 500 companies.[00:17:00]
Emma: Yeah, there's, I've seen ransomware, target 7,000 person locations that can come in with a ransom of 3 million. And I think I worked out on a perimeter basis where I was like, this is gonna cause everyone about $400 if they have to pay 3 million. Um, then that's like a direct cost. The customers obviously it's more difficult than that, but, um, I was doing some of the math.
Um, interestingly in rural communities, I think it's not just the electric side, they also have the hospital problem. They have, uh, water, for example. Uh, There's definitely a whole of community approach that potentially can be considered here. It's something we were working on. Um, how do you look at all these different providers?
Because half the time I don't actually think there's two or three more cyber people hanging out in the town waiting for a job. Um, there's a good chance that that community has a limited number of people that have really got that expertise or desire to stay in a rural community with that expertise because, I'm not gonna lie, you can get paid a lot more moving into a city to do that kind of work.
Um, [00:18:00] so it's a big challenge. I think. Um, it's going to be a long-term challenge as well. We need to build communities around this. I think there's regional approaches that are coming up. I've seen some really cool work coming out of places like Kansas, um, Arkansas. They're building communities that are essentially not tied to any one particular entity.
Um, they can come in though and be a sort of, Crack cyber team that we're looking for, but they can spread it out or have fractional ownership across. Um, and nc I think ownership is a really important piece. If you don't own your cyber team, there's a good chance you won't necessarily know what to do with them when the time comes.
So taking ownership or partial ownership of those kind of regional approaches is, is great and important I think. It's really starting to come together. Just now though, that a 10 person utility serving a small water entity isn't gonna hire four people with four different skill sets to just do cybersecurity.
The chemical engineer might have a problem with that at that point. Um, so I think there's a lot that can be done there. Again, if you got one chemical engineer who's [00:19:00] keeping the water clean every day, but you've got four cyber people who are helping patch your software, they're not gonna be very happy people.
Um, so, and also they can't necessarily afford it, so it's.
Blake: Right, right. And, you know, with, with this specialty that's involved in cybersecurity, you know, that sort of approach does make me wonder. Almost, it feels a little bit like parachuting in, right? If you have these regional teams even, and suddenly something happens on a network you might not be familiar with, uh, I can see how that would be challenging if you don't have that ownership or that preexisting relationship of having the tools needed to actually resolve and respond to that and understand what's going on.
Um, but I guess that's where maybe engineering kicks in. You can always fall back to the fundamental physics of the problem, right? And if something's happening on the, on the grid or in the water, you can hopefully fix it.
Emma: Hashtag physics. Yep. Physics can usually get us somewhere.
Blake: So I'll, I'll let listeners in on a little secret in the interest of transparency. Emma and I are, um, coin carrying members of a very, uh, highly [00:20:00] elite beer information sharing and analysis center. The beer isac, it's a classified top secret cadre of just hackers and cyber professionals.
Okay. I'm, I'm sort of kidding, but, uh, on a serious note, how do you make sure that cybersecurity information gets to where it needs to go, uh, in critical infrastructure industries?
Emma: Uh, one of the great things about the Bry psych effort and all the other type of information sharing is I've noticed in the last year, the community has really built to, we don't really care where you work. Um, we will be able to work with you and share information cuz we're really all there for the same purpose.
I don't think, uh, a lot of people are there for, well, some people are there for the money. Um, a lot of us really aren't there for the money or doing it because we, you know, our paychecks are great. We're doing it cuz we actually believe in what we're doing. So I think the community is really starting to understand that there's this information sharing that has fixed problems that was nothing to do with anything official.
And it happens a lot. Um, and it's good. I think we need to find ways to make [00:21:00] that spread. Cuz I think the US itself is a huge giant community of people who really want the same thing and everybody's trying. Um, but the information sharing in that community is, is fantastic. And I think it's got some real potential to be a natural.
Thing that people think about. Cyber mutual assistance is fairly similar as well, um, out of the e scc. Um, that's a
Blake: That's the electric sub-sector coordinating council you're referring to there. Just for the acronyms. Uh, I know this, uh, in the DC area, we're, we're used
Emma: just love working.
Blake: a little bit.
Emma: Well, my initials are ems. How'd you think I got here? My initials are m Mary Stewart. So I, that was it. They gave me a name that was bound to end up doing this,
Blake: Emergency management system, energy management system. You've got all sorts of options there with ems. Huh?
Emma: I, it's wonderful Gull. Love it. That's, my parents did not think this one through, but the, uh, the community is really, the community is really growing. They, uh, You can see people coming in who are brand new [00:22:00] and they def definitely there's a, like, especially woman in cyber, that there's different groups that help people get ahead, work out what to do, work, how to work through the system.
That is still predominantly a male system as well. So, um, working your way into this is, is not always easy. So I think the community is really helping at that point.
Blake: Well, I noticed, you know, watching from afar, I guess the S four conference, it sounded like there was an event that's been quite a success geared toward just that issue of, uh, elevating the networking opportunities and entry, uh, and, and, you know, advancement, career advancement, possibilities for women in cyber that takes place.
At that conference, were you able to, uh, participate in that?
Emma: One of the things that happened to S four, which was wonderful, I, I get a little cross claustrophobic when I'm around too many people. I walked into the women in, uh, i c s event, industrial control systems, and, uh, it was too busy for me, which is, uh, one of the best things I think I saw at that conference.
I, I felt like there was [00:23:00] so many women there that I was, I was. Shocked and happy to stand back and watch it cuz it was a wonderful thing to see. I was actually happy to be claustrophobic at an event for once in my life. Um, the, so I think it's, uh, been a really great initiative from Dale and the S four crowd to, to keep pulling people in.
Um, I've definitely made new contacts and got new friends out of that who are all working in the same industry. So I think it's a, a great way to keep encouraging it, I think is um, hundred. Um, sponsored tickets that come to the event as well. You could definitely see the enthusiasm there as well. So, um, I've always said one of the biggest things you need to do to get ahead in this industry is to show up.
And so helping people show up is, is really important. So,
Blake: Well, and to your point earlier about fostering this community and just how many problems end up getting solved by some of those serendipitous connections and people who know each other and, oh yeah, I can call Emma up and share this, or whatever. And you just have all that built in. Uh, you know, I guess the, the, [00:24:00] the one concern I have with that approach is, is, is it something that can really scale?
And as we're, you know, tackling these global. Problems that cross international borders and, you know, state levels in the us uh, you know, how can we, how can we really move the dial on the cyber threat?
Emma: I do think cyber mutual assistance is coming around to that model as well. There's, uh, new initiatives that are starting to partner with say, local guard units, um, other different entities that could be helpful. I think that is starting to grow. I just. Scaling is difficult on a state by state and state, local level.
I think there's real potential there that's coming. We just need to potentially move faster at this point cuz we can only negotiate so much before something actually happens. So I think they're, they're, they're really trying to grow it at the moment. I think there's ways the community can help as well.
Um, Potentially getting rid of this whole sort of vendor critical infrastructure entity split as well could be helpful. Um, if you're more willing [00:25:00] to work with different vendors, then there's more people available to you as well, so we'll get there. Eventually though, it's just gonna take a bit of negotiation.
Blake: you know, we, we, we've talked a little bit about these.
Companies that just might not be able to afford the cutting edge technology and, you know, super sophisticated cyber capabilities and free trials might not really cut it to defend in the long run. So what else can be done to address that issue of, of limited resources for some of these entities?
Emma: The resources are generally, I, I don't see a world where those resources suddenly are available. Like we're, we can't necessarily increase people's electric rates to cover all these new products that are sort of flying around the system at the moment, especially when people can't necessarily define with a decision support tool what they actually need.
Um, it's, it's easy to follow some of the, the news and be like, oh, I absolutely need this tool right now. They told me everything is bad. It's similar to going to take a vitamin cuz you heard it was the latest thing that was gonna stop you getting a disease. [00:26:00] Um, in the end, uh, I think there's a decision support that the community can help with, um, building how you pick the right products.
Even just getting the basics right at this point, um, we could put the most advanced measurement tool in place. We could put 10 people standing around it. If you've got a giant hole in your system that you didn't patch it, what was the point in putting the monitoring in place? Um, because you just see it coming then that's all like, so, um, I think decision support's really important.
Um, there is quite a wide gulf that's forming just now between the entities that can't afford this and the ones that can. I think that golf might be getting bigger the more products that hit the market. Um, so reliance somewhat on these vendors, these sorry vendors, but reliance on, uh, people that are essentially creating new products is hard.
Blake: Switching gears to a, a little bit of a more, uh, personal note. You've been open about your cancer survivorship. I guess, what has that path been like for you both personally and professionally?[00:27:00]
Emma: So yeah, I was, I was diagnosed with breast cancer when I was, uh, 32 years old. I was working at one of the national labs. I had, it was a complete surprise talk about, we're talking about cybersecurity and events popping up from nowhere. That was definitely one of those for me. Um, I have no family history, so it was a kind of a giant surprise.
Suddenly I'd just done an Ironman as well, and I was pretty much about as fit as any human can be. So that's probably why I'm so open about it, is I, I like to make sure people know that these things can happen. Um, I also do believe that we should be bringing our whole self to what we're doing and people understanding that everyone is human and things happen is really important to me as well.
I've, I've heard too many friends sort of hiding. Bad things that are happening to them while they're in their employment, cuz they're, they might be concerned that everyone judges them. Uh, I think people need to talk more about the things that are impacting them because it's a stressful environment to work in to begin with.
So when something is [00:28:00] happening, I think it's important, but I think that was my lesson in human resilience, uh, eight years ago was, okay, I'm gonna power on through this one. Um, I was really lucky in that I, I was, I was as fit as I was. Um, so my fitness declined obviously, but I came back pretty strong. Um, not everyone gets that luxury, so I understand it can be really hard, but I'm a, I'm a lucky human and I found it and.
Survived it. So here I am. A lot of it's luck, but I do think that there's a lot of lessons on the resilience side that I apply to my work every day. I'm a. I'm a really resilient human. I can come back from a lot of things pretty quickly. I usually have a, I have a role now that I take a day to recover from something bad, and then I'm, that day can be my worst day.
I can eat all the chocolate, but the next day I get to wake up and put back on my shoes and keep going. That's the get back up and keep moving forward is generally my approach. But I was very lucky though. I kept working. Um, the first day I, I turned up on a phone conference with, uh, a bald [00:29:00] hair, bald head cuz I was in chemo.
I made a, a running joke that I, uh, look at me, you made me tear all my hair out with frustration just to get everyone past the moment of, oh my goodness. Um, so yeah, I got used to the sad face and then I, I would, generally, my sense of humor is dark and ridiculous. So I would, I would make jokes to get people over it, but it was important to me to show up as well.
Cause. I look how I look, and I think that's important also. So,
Blake: No, I, I think that's a, that's a valuable lesson and your point on human resiliency is, is so powerful. I think, uh, I think it's really impressive that you navigated that challenge and continue to work. And I guess, what, what would you say to listeners who may be battling cancer or have loved ones undergoing treatment?
Emma: It's, it's never gonna be easy. I, I don't want to pretend or minimize how hard battling these things are. Um, I think some people are like, well, you were fine. I was like, well, no. I still went through 16 rounds of chemo. It was still pretty [00:30:00] hard. Um, I, I do like to, Say to people, like, opening up and saying what's going on is really important.
Um, your family listening to what's going on is also hard. It's really hard to accept that somebody in your life is going through something that might kill them. And, uh, people do tend to be like, oh yeah, you'll, you'll be fine. Um, I do think sort of accepting that you're, you're, you're going through something hard and finding a way through it, it, it will be over.
Eventually you will, it will be a horrible period of time, but at some point you'll get back up and that's. Important for people to see. Um, some people do get back up, some people don't. But it's, it's a factor of life that you can't really control at this point. So if it hits you, um, just keep moving forward.
That's, that's my, just keep swimming to reference a movie as well, is what I say fairly frequently when things are bad. Um, but just keep moving forward, which is important.
Blake: Well, and it sounds like if you were competing in Ironman competitions, you were quite the adept swimmer as well, or still are? I don't know if, are you still on the, uh, on the [00:31:00] tri circuits?
Emma: Oh no, I, I, I hung up my, I dunno, three sports, uh, a couple years ago. I, I decided it was, it was time. I wasn't enjoying it quite as much as I used to. And I'd, I'd gone to World Championships for half Ironman and I, that was my goal. And after that was gone, I actually did that after cancer, just to self promote a little bit.
Right. Um, but I, uh, After I got to do that, I, I decided to take up more, um, how, how do I put this, less safe sports. As it turns out, I
Blake: Less safe sports.
Emma: mountain biking. I decided to take up downhill mountain biking and, uh, a few other things where I raced competitively for a while, but right now I'm just focusing on being fit and enjoying my life as well.
Blake: Downhill mountain biking. One of our recent guests, Nicole Pearl Roth was talking about hella skiing. And now we have you downhill mountain biking. What am I, am I going to have to take up like deep sea cave diving or something or I, I, I don't know. But uh, in any case, it's really impressive [00:32:00] stuff. And I guess you've kind of already answered this.
I don't know if you put your, uh, world champion. Uh, Ironman competition on your LinkedIn, but we ask all of our guests this question, which is, you know, what's something we wouldn't know about you, Emma, just by looking at your LinkedIn profile.
Emma: Well, probably related to that, I, uh, obsessively collect bikes. Um, I've got bikes in three different states and some have motors. Some are for downhill, some are for triathlon. Um, because I've done so many weird sports, I started to collect all these bikes all over the country. And, uh, I, I love them. I. Go ride anything with two wheels on it.
And uh, I'm kind of known for that at this point for various people, but I probably haven't put it on LinkedIn cuz that's, you know, one day I might just post a picture of a bike, but I think it's became known. I might turn up at any meeting with a bike bag in hand. So,
Blake: Love it. Are, are we counting e-bikes as part of this distributed electric future that we discussed earlier, or is that, is that, uh, maybe not enough of a load right now on the grid?[00:33:00]
Emma: I think e-bikes are pretty cool. I haven't quite got there yet. That might be the next purchase. Um, the danger is I get far too far up a hill and then, uh, because the, my fitness didn't stop me, I am way high up. So gotta come down somehow. That's the danger. That's why I don't have one. So it's.
Blake: That's fair. That's fair. There there is that temptation there. Well, thank you so much, Emma, for joining us. Really appreciated your insights on, uh, the nature of the cyber threat and grid resilience and just some of your own personal, uh, stories there. So, uh, thank you so much and, uh, hope to catch you soon around the beer isac, uh, secret table.
Emma: Thanks for having me. I will see you at the magic table.