Shelley Ma: The mystery behind cybersecurity. [Response Lead]

Shelley Ma: My name is Shelley Ma. I am an Incident Response Lead with Coalition Incident Response.

Shelley Ma: Whenever I talk about the inception of my interest in the field of digital forensics and incident response, I always feel like the story is generally incomplete without my mentioning of Neopets, because Neopets is really what started it all for me. It's this virtual pets website primarily for kids and teens and maybe some adults, um, where users can own virtual pets. Beyond the whole pet part, which was great fun. It has its own little economy and marketplaces that, for me, was a fantastic introduction to the fundamentals of capitalism. I'm like 11 years old at this point. I didn't know anything about social engineering or phishing, hacking, um, website manipulation, and those words were nowhere close to entering my vocabulary. But that's, What I was doing effectively, and I'll spare you the details of my short-lived hacking career, but suffice to say I was driving that proverbial Ferrari in Neopets.

Shelley Ma: I had a lot of time on my hands, so I became obsessed with crime and mystery shows on TV. My favorite shows were like Law and Order, CSI and Forensic Files, and I really enjoyed the mystery. That curiosity spawned an interest in forensic science. Basically, fast forward several years, I came face-to-face with a university application and I discovered that I couldn't find forensic science as a course anywhere in my country. I never gave up that dream of pursuing forensics. So one day, there was this guest lecturer that came in to do a presentation and he was considered a celebrity forensic scientist in South Africa. So I attended this lecture hoping to, I guess, live vicariously through his stories and at the end of the talk, um, I raised my hand and I asked him for his wisdom on how I can become a forensic scientist, and his response was, go to America. So it wasn't the advice that I expected. Um, so the prospect of going to the United States to pursue an education was a far-fetched reality for me, but I still held onto, you know, a glimmer of hope, and I kept looking for gateways and opportunities that would take me a step closer to forensic science, and that's when I discovered the Fulbright Scholarship.

Shelley Ma: This was a scholarship program that sponsored international students to study at a United States graduate school, and my attitude back then was to apply to everything under the sun. By some miracle, stroke of luck, good juju, whatever you wanna call it, I was selected as a scholarship recipient. So what happened after that was, on the very first day of the semester, all of these, um, new students were advised to attend the forensic department's orientation. And I remember like sitting there in the front row and watching and listening to the heads of all these forensic programs do their presentation, I had no idea what digital forensics was, but I was hooked. And I was so excited because I knew that's what I needed to be doing for the rest of my life, and that day I put in a transfer to the digital forensics program and how I ultimately ended up where I'm today.

Shelley Ma: So the first thing I had to accept was that I was making a pivotal change in my life, it was pretty drastic. So the first thing I needed to do was, um, actually, get approval from the, the scholarship folks and try and get into the program in the very first place. And I remember, um, when I spoke with the program coordinator, she asked me if I had any ties to China and Russia and the Middle East and I said, I didn't. And then she said, okay, well that brings you one step closer. A lot of the university professors were in government, like from the DOJ and the FBI and the DEA and so I think there was a lot of like, um, concerns around the sensitivity of the stuff that they were teaching us. I ended up moving to Virginia to be closer to that campus. Um, and then there was a lot of groundwork and a lot of foundational work that I had to do to learn the um, basics of technology and then from there, you know, it was a pivot into an internship and a career ultimately.

Shelley Ma: I would advise that before you invest significant time and or money on a new career trajectory, to first do a deep dive into the topic by yourself. I don't just mean reading Wikipedia articles, I mean really doing the research into the granularities of the subject matter. So I tend to say that doing a solo deep dive and tinkering is warranted before, um, taking a bigger step. If something tickles you're fancy and you're interested in it more than just a hobby, um, but as a possible career, then look into what you need from an accreditation or education standpoint to get there. I also recommend speaking to as many people as you can who are already in the career that you're interested in, and ask them about not only things that they love about what they do, but also the things that they find challenging and difficult, and see if there's an opportunity for you to work shadow them so that you can get an accurate glimpse of what their day-to-day is like. 

Shelley Ma: Oftentimes in my field, I come across adversity in the form of, um, entities or people who want to sway my opinion or sway my conclusion. The advice that I always carry forward with me is if you want to sleep well at night, always tell the truth. My forensics one professor had imparted that advice onto me, and it's one that I repeat very often to my peers. We are analysts and we live and breathe data. The evidence is in the data, and any professional opinion that we give has to be backed up by the evidence. In our industry, there are so many opportunities for our opinions and testimonies to be coerced and swayed. I refuse to do that and every time I come back to what my professor said, if you don't want to spend the rest of your life looking over your shoulders, just simply tell the truth.

Shelley Ma: A very rewarding aspect of my career, um, is teaching others. I feel like so many of the world's problems could be solved if we just shared more information with each other. The fact of the matter is that hackers and their techniques are continuously evolving, technology is continuously evolving, and so in our industry, being in a constant state of learning is not just a nice to have, but an absolute necessity and the last thing I want to be is surprised or blindsided and immobilized when we, when we receive those outlier cases. There's no place for stagnancy in my career and I hope that I could continue to teach others, um, and leave behind knowledge into the world.