Meet the women behind the Wi-Fi and eduroam connections that millions of people use every day and never think twice about.
Women in Cyber Day exists to put names to the women who keep the internet's authentication and security infrastructure running - work that, done well, goes unnoticed.
We asked women in cybersecurity across the industry, on our team and off it, to describe the work in their own words: how they got into it, the part of the job that worries them, and what they would tell someone weighing a career in network security.
Eva Santos, CWNE #521, is a wireless engineer who has spent her career hardening Wi-Fi networks.
Mary Bull is the eduroam technical service manager at Internet2, keeping secure Wi-Fi working across more than 1,200 education and research sites in the US.
Between them, they cover two ends of the same problem: how you make a network easy to use and hard to break into at the same time.
Read the other profile pieces in the series:
Eva Santos, wireless engineer at Nile
Eva Santos, CWNE #521, is a Service Delivery Engineer at Nile with more than six years of experience spanning consulting, support, and product roles, including earlier positions at Cisco, Presidio, and CDW.
Outside her day job, she writes and speaks under the WiFrizzy banner, presenting at conferences including the Wireless LAN Professionals Conference (WLPC) and SharkFest, and contributing articles to CWNP and Informa TechTarget publications. She has also built practical tools for the wireless community, including a ChromeOS Wi-Fi troubleshooting utility.
Eva spoke at the RADIUS Conference on The Importance of RadSec post-BlastRADIUS.
Q: How did you end up doing wireless security, and how did security become core to the work?
I was an intern on my state government's network engineering team, then I moved into consulting for wireless networks in the private sector.
Security became part of the job almost immediately: I had to consider security concerns whenever I was deploying or changing a network.
Later, working as a wireless subject matter expert, it became apparent that a lot of people are leaving their Wi-Fi networks vulnerable compared to their wired ones.
Q: What's it like explaining a job most people don't know exists?
It's simultaneously really hard and easy to explain what I do. When I tell people, “I fix Wi-Fi” or “I bring Wi-Fi to new buildings,” they generally get it.
However, when I'm talking to even other IT pros about surveying and IEEE 802.11, I lose them a lot of the time.
Q: What's the Wi-Fi security problem that worries you but doesn't get enough attention?
Definitely the impending quantum-resistant cryptography concerns and using PKI to address that and other vulnerabilities like Dragonblood, BlastRADIUS, and AirSnitch.
I still have people who think WPA2-Personal is secure, or that they're secure just using transition mode, when the cryptography hygiene goes much, much deeper than that.
Q: What do you wish more people understood about wireless security?
That it's not just one piece: the surveying, the pcaps, the client devices. Good Wi-Fi engineering means considering all of those pieces together.
A lot of people think that because their survey is all green, or their pcaps aren't full of deauthentications, there isn't anything wrong with their environment.
Q: What would you tell a woman considering a career in network security?
More and more women are getting into these fields. I remember going to a particular conference where the first year I attended, it had four or five women. By my third year attending, there were over 20.
That's still a small share out of about 400 attendees, but things are actually changing, so I wouldn't feel discouraged if your particular job or team doesn't have many. Some big employers like Cisco and HPE have really diverse, balanced wireless and networking teams these days.
Worth subscribing to.
Worth reading.
Our weekly newsletter covers network authentication tips, how-tos, security vulnerabilities, free resources, standards updates, and industry news. (All stuff you should stay up to date on!)
Mary Bull, eduroam technical service manager at Internet2
Mary Bull is the eduroam Technical Service Manager at Internet2, where she supports secure Wi-Fi roaming across the US research and education community. Before joining Internet2, she spent seven years as a senior network engineer at William & Mary. She has volunteered with SCinet, the team that builds the network for the annual Supercomputing conference, since 2021, and in 2023 received a scholarship through Internet2's Inclusivity program, supported by Women in IT Networking at SC (WINS), to attend the Internet2 Community Exchange.
Mary spoke at the RADIUS Conference on When in eduroam: Site Data from Internet2’s Perspective.
Q: How did you end up running eduroam's technical service, and how did security become core to the job?
I got into computer networking through my local community college's Cisco Networking Academy program. I was interested in information technology, and I got lucky that networking was the most available certification course, because it was also the most interesting part of IT for me.
I liked the hands-on and dynamic nature of supporting infrastructure for live traffic. I was really lucky to work with a great team at William & Mary that let me do all kinds of different networking tasks, because we were a small team.
In my role now for eduroam, security is a core feature of the service: we want to make security easy for students, professors, and researchers, which usually means staff have to do more work to support them.
Note: For more on the mechanics of how eduroam works day to day, watch the InkBridge eduroam AMA session with Alan DeKok and Jonathan Eagan.
Q: eduroam touches millions of people who never think about it. What's that like?
Part of infrastructure work is that good infrastructure is taken for granted, and it's only noticeable when it's breaking down. There's also the distributed nature of eduroam: most of the work that goes into making the service function is happening at more than 1,200 locations across the US.
It's amazing that it works as well as it does. I hope I can celebrate that by drawing attention to the things that are working really well, which helps contextualize all the times we hear about broken pieces that need to be fixed or improved.
Good infrastructure is taken for granted, and it's only noticeable when it's breaking down.
Q: What worries you about eduroam's security and reliability that doesn't get enough attention?
One thing I've been thinking about lately is that in higher education, a lot of the heavy maintenance gets implemented when school isn't in session, so that slows down the deployment schedule.
If a problem is announced in August, the fix might have to wait until Christmas, or next summer. Understanding that network shops are limited in when they can implement new architecture and services is important.
I'm also convinced that most higher-education IT shops miss the opportunity to communicate strategically with students and faculty. There's a political aspect to implementing IT services, and I think talking to student government, for example, helps IT feel like an integrated part of campus life.
Q: What do you wish more people understood about the work you do?
For users of eduroam, I think they should know that when they experience a problem, it's more often than not connected to something structural, like bad documentation or missing deployment software.
I've seen many examples of people not reporting issues because they assume it's something personal to them, so they don't report it, things stay broken, and IT teams assume everything is okay.
Before I worked in IT, I had a variety of jobs where I was the “end user,” and sometimes it felt like the IT people I had to talk to didn't understand why what they wanted us to do was confusing. I try not to forget that feeling when I'm supporting people now.
Q: What would you tell a woman considering a career in network security?
I found a learning lab with a great instructor and actual routers and switches to work on at my local community college. If you're coming to IT from a different field, community colleges can be an overlooked option!
I also got great support from a post-baccalaureate program at my local four-year school (shoutout to Virginia Commonwealth!), and so much support from the Women in IT Networking at SC (WINS) program, which sends people to help build the fastest network in the world at the annual Supercomputing conference. I got to work with the most women engineers I had ever seen in one place, and learned the value of networking with other women engineers.
Next steps
If these profiles have you curious about roles in network security, see what's open at InkBridge Networks. We also encourage you to reach out to Jana Sedivy, VP of Customer Experience and Product, on LinkedIn - she's always happy to hear from people considering the field.
Related Articles
Is cybersecurity a good career? 30 years in the field
Jana Sedivy has spent 30 years working on technology that most people never think about. She has some thoughts on whether women should go into the field that builds it.
RADIUS security best practices: How to harden your deployment
RADIUS has several well-known security limitations, most of which are easy to mitigate once you know what to do. This guide walks through five common weaknesses in the RADIUS protocol and the practical steps you can take to harden your deployment against each. For a broader look at RADIUS protocol security overall, see our main guide on how the RADIUS protocol works and why it's secure.