Security Confidential S6 E2 Dr. Joseph J. Burt-Miller

Manoj Tandon:
Hello everyone, welcome to another episode of Dark Rhino Security: Security Confidential. I’m your host, Manoj Tandon, and today we are joined by a very special guest, Dr. Joseph J. Burt-Miller. Dr. Joseph has an impressive background and recently earned his PhD—he was just down in Florida last week receiving his degree, so congratulations to him. He has had a diverse career path, including time in the U.S. Air Force, work in HVAC, and service within the federal government. Today, he brings deep expertise in cybersecurity infrastructure, particularly as it relates to critical systems. We’re honored to have him here. Dr. Joseph, welcome to the show, and thank you for joining us.

Dr. Joseph J. Burt-Miller:
Thank you. I’m excited to be here and appreciate the opportunity.

Manoj Tandon:
I have to ask—how was Florida?

Dr. Joseph J. Burt-Miller:
Florida was great. The weather was beautiful, and I had a really good time.

Manoj Tandon:
That’s fantastic, and congratulations again on your degree. Let’s start with your background. You spent time in the Air Force—did that’s where you first got into cybersecurity?

Dr. Joseph J. Burt-Miller:
No, actually my first career field was HVAC—heating, ventilation, and air conditioning. That’s what I learned while serving in the Air Force. I spent four years in the military before being honorably discharged. After that, I worked various jobs before returning to government service as a civilian at a VA hospital in New Jersey, still working in HVAC.

During that time, I was studying for my bachelor’s degree in Computer Information Systems. What really motivated me was seeing coworkers come into work dealing with physical ailments—limping, taking medication regularly. I remember one coworker showing me a pill organizer and explaining he needed it for daily pain. At that moment, I realized that wasn’t the future I wanted. So I became very focused on transitioning into IT. I would bring my books to work, study during lunch breaks, and stay committed to that goal. My supervisors even nicknamed me “Professor” because I was always studying. I was determined to make that transition.

Manoj Tandon:
That’s a great story, and it highlights something we tell our audience often—there’s no single path into cybersecurity. We’ve had many guests with unconventional journeys, and yours is another great example. So how did you get your first break into IT?

Dr. Joseph J. Burt-Miller:
My first opportunity came while I was still at the VA hospital in East Orange, New Jersey. While studying, I applied to multiple IT roles and faced a lot of rejection—seven or eight times, at least. There was a point where I almost gave up. But eventually, I got an opportunity, and I credit my first IT supervisor, Gary Giordano, for taking a chance on me. I think he saw how motivated I was.

Once I got in, I volunteered for everything. Any project that came up, I raised my hand. To me, every opportunity was experience. That built a strong relationship with my supervisor, and he gave me room to learn and grow. He encouraged me to pursue certifications and develop my skills. That experience really set the foundation for my career.

From there, I moved to Nebraska to work at another VA hospital, then later became a system administrator at Offutt Air Force Base. Eventually, I returned to the East Coast and worked at the DoD Cyber Crime Center, which was an incredible experience.

Manoj Tandon:
I have to ask—can you share any memorable cases from that time?

Dr. Joseph J. Burt-Miller:
There are limits to what I can share, but I can say that I really enjoyed the daily threat briefings and analyzing different threat actors. At the time, North Korea was very active, and we spent time tracking those activities. I wouldn’t say they were the most advanced actors, but they were certainly part of the threat landscape.

Manoj Tandon:
That’s fair. Let me ask you this—looking back at your journey, is there a moment that felt like failure at the time but turned out to be pivotal?

Dr. Joseph J. Burt-Miller:
Absolutely. One example goes back to after high school when I was accepted to Penn State. I was excited, but when we reviewed the financial requirements, it simply wasn’t feasible for my family. That was disappointing, but it forced me to find another path.

That’s when I leaned into my experience with Air Force Junior ROTC in high school, which ultimately led me to enlist. That decision provided structure, discipline, and opportunities that I still benefit from today. It turned what felt like a setback into a defining moment.

Manoj Tandon:
That’s powerful. Let’s shift into cybersecurity and infrastructure. One major concern is the U.S. power grid. Is there meaningful legislation or progress being made to secure it?

Dr. Joseph J. Burt-Miller:
There have been efforts, such as Executive Order 13800, which aimed to strengthen cybersecurity for federal networks and critical infrastructure. Additionally, the Infrastructure Investment and Jobs Act allocated significant funding—about $27 billion toward grid-related improvements.

However, the grid is complex. It’s essentially a patchwork of systems, and upgrading it isn’t easy because taking parts offline has real-world consequences. It’s a balancing act between modernization and maintaining continuous service.

Manoj Tandon:
Why do you think cybersecurity often gets underfunded?

Dr. Joseph J. Burt-Miller:
In many cases, organizations think, “If nothing is wrong, why invest?” It’s reactive thinking. Unfortunately, by the time a breach happens, it’s already too late. Cybersecurity should be treated as a business risk, not just an IT issue. But often, it falls under IT budgets, where it competes with other priorities.

Manoj Tandon:
That’s a key point. Let’s talk about vulnerabilities—especially with smaller companies connected to the grid.

Dr. Joseph J. Burt-Miller:
Smaller organizations are often the weakest link. They may only have one or two people handling security, and they’re stretched thin. Attackers will naturally target those entry points rather than larger, more secure organizations.

These companies need more support—whether through training, external partnerships, or improved awareness. They don’t necessarily need to build everything internally, but they do need access to the right resources.

Manoj Tandon:
Let’s talk about real-world attacks. The Ukraine power grid attack is often cited—what happened there?

Dr. Joseph J. Burt-Miller:
Russia, through a group known as Sandworm, launched a coordinated attack in 2015. They used tactics like DDoS attacks to overwhelm operators, disabled backup systems, and manipulated industrial control systems to shut down power. It left over 200,000 people without electricity during winter.

They followed up in 2016 with another attack, this time targeting Kyiv. They attempted to disable safety systems, which could have caused catastrophic damage. Fortunately, part of that attack failed due to a configuration issue.

These attacks demonstrate a high level of coordination and expertise, likely supported by state resources.

Manoj Tandon:
Could something like that happen in the U.S.?

Dr. Joseph J. Burt-Miller:
Parts of that strategy could work, but it would be much more difficult. However, if a nation like China were to collaborate with Russia, the risk would increase significantly. A coordinated effort between major powers could pose a serious threat.

Manoj Tandon:
At what point does a cyberattack become an act of war?

Dr. Joseph J. Burt-Miller:
That’s the big question. If an attack caused widespread, prolonged disruption—like taking down the power grid for months and leading to loss of life—it would likely be considered an act of war. At that point, a military response becomes a real possibility.

Manoj Tandon:
What can be done to reduce risk to the grid?

Dr. Joseph J. Burt-Miller:
At the national level, improving coordination between government and private utilities is key. There’s also ongoing research into strengthening interconnections between regional grids to improve resilience.

At an individual level, people need to be aware of their own risk exposure. Smart devices—thermostats, cameras, voice assistants—add convenience but also increase attack surface. Every connected device is a potential entry point.

It’s a balance between convenience and security, and right now, convenience often wins.

Manoj Tandon:
That’s a great point. As we wrap up, how can people connect with you?

Dr. Joseph J. Burt-Miller:
The best way is through LinkedIn. I enjoy connecting with people, especially those entering the cybersecurity field. I’m always open to mentorship and conversations.

Manoj Tandon:
Any final thoughts?

Dr. Joseph J. Burt-Miller:
Yes, I’d like to highlight my wife, Hadassah Burt-Miller. She is a full-spectrum doula and Lamaze educator, and she’s passionate about improving maternal and infant health outcomes in the Black community. She’s currently working toward becoming a certified professional midwife in the DMV area.

I’d also like to mention Dr. Lisa Marie Lee, who does incredible work helping veterans transition into civilian careers and maximize their skills and earning potential.

Manoj Tandon:
That’s fantastic. Dr. Joseph, thank you again for your time. This has been a great conversation, and we look forward to having you back.

Dr. Joseph J. Burt-Miller:
Thank you. I appreciate it.

Manoj Tandon:
Take care.