Bridget Quinn Choi’s Journey to Cyber at Booz Allen

Cyber threats like ransomware attacks continue to intensify in scope and sophistication. To protect their networks, companies need multifaceted expertise across a number of fields: in-depth knowledge of the law, acumen for risk management, an appetite for learning, an understanding of the players in the ever-evolving ecosystem, and an embrace of change.

Principal Bridget Quinn Choi brings all of this and more to Booz Allen’s new Incident Response team.

After 9 years as a New York City litigator, Choi pivoted to a new career as claims counsel to a Bermudian insurance company, Endurance, now known as Sompo International. The job not only offered a better work-life balance after the birth of her first child, but it exposed her to unfamiliar fields of liability like complicated professional indemnity, catastrophic and high severity claims, and the emerging field of cyber risk.

“I was given an opportunity to handle a broad swath of high-profile cases from all around the country,” she said. A defining moment came when she joined the company’s large-loss committee, where she provided a litigator’s perspective on the biggest, most complicated cases within the company.

"The chief claims officer often said that if it is on the news or in the paper it is likely to cross our desks. The variety of legal issues, jurisdictions, and cultural approaches to law and negotiation was incredibly intellectually satisfying to tackle,” Choi said.

Her legal experience, coupled with her growing passion for cyber, privacy, and incident response, spurred Choi’s career forward. She joined Navigators (now a division of Hartford) to lead their cyber claims team, and later pivoted to global digital forensics and incident response firm Kivu Consulting, where she served as a managing director for strategy and general counsel.

“I offered Kivu legal and claims experience and they deepened my technical knowledge,” Choi said.

Her diverse perspective and privacy expertise, along with her deep knowledge of the insurance industry, led to a job offer from Booz Allen. 

Addressing ransomware is one of Choi’s priorities with the Booz Allen Incident Response team.

“Ransomware is now a societal scourge that happens to companies big, medium, and small, and it’s not just a money issue anymore,” Choi said. “Now attackers are shutting down operating systems, affecting supply chains, and even having an effect on human life, like when a hospital is attacked.”

Even enacting the simplest security measures can significantly reduce the risk of ransomware attacks, Choi said. Examples include:

• Managing remote access: Open remote desktop ports are like unlocked doors into the network. “Companies need to stop having such a low barrier of entry for attackers to gain access to their network,” Choi said.
• Patching programs: Focusing on a patching cadence is essential. Choi provided one example: “Many widely used VPN appliances have had CVEs and patches issues. Exploits are designed and sold to gain access to unpatched networks, particularly through unpatched VPNs. If you haven’t patched these, you’re leaving your company wide open for attack.”
• Data backups: Will your business be able to function after attackers have your data? Even if an organization pays their attackers, decrypting doesn’t solve for the access and may not clean the network completely, “Purchasing an attacker’s decrypter key should be a last resort and not a panacea to a ransomware attack.”

“These measures are essential elements to build a secure cyber foundation,” Choi said. Beyond securing their internal networks and external ecosystem, organizations can remain cyber vigilant by building and testing a ransomware resilience program, which should comprise of:

• Crisis management
• Business continuity
• Disaster recovery

A ransomware attack is akin to a hostage crisis. In such a high-stakes, high-pressure situation, preparation has its benefits. “Companies with a culture of ransomware resilience are least likely to have to pay,” she said.

A love of reading, learning, and change is the perfect complement to the demands of cybersecurity—which is why Choi feels at home there and, she said, others can, too.

“There’s a part in cyber for everyone,” Choi said. “Not everyone has to be a coder or debugger. You can go into legal, risk, consulting, as well as a myriad of highly technical areas. There are so many facets to cyber and it’s so fast-moving.”

This rapid pace of change makes cyber a great equalizer, she said.  

“You have to constantly evolve,” Choi said. “The field hasn’t existed long enough for anyone to claim tenure. Those who work to continuously understand the risk will be best positioned to succeed.”

Learn more about cybersecurity at Booz Allen, careers with Booz Allen’s Commercial team, and the firm’s Incident Response capabilities.