Bob Turner, Chief Information Security Officer, University of Wisconsin-Madison
For Bob Turner, life is one big adventure. Just five days after his 18th birthday, Turner found himself on an airplane bound for Naval Training Center San Diego, where he would undergo his basic military training. Soon after that he was assigned to submarine school in Connecticut. But before heading off to the East Coast, he married his high school sweetheart in their hometown of Spokane, Washington.
“We drove across the country after being married for just a few days, and that was the start of a big adventure for us,” says Turner. “We got to Connecticut and I got settled into my technical training. About five weeks later the Navy decided to send me to Pearl Harbor to complete my technical school. So, my wife and I drove back to Spokane. She stayed there for a while until I got settled in Hawaii and then she joined me on Oahu.”
Turner trained to be a submarine radioman. His first assignment was to the USS Omaha. “The submarine force was fantastic. Due to space limitations, we had a small crew that performed multiple jobs. I was the one who operated the communications equipment as well as repaired it when necessary. I was solely responsible for the communications on and off the ship, and that was a heavy weight to put on a 19-year-old kid’s head, but it was exciting and I ended up doing two submarine tours,” says Turner.
On his first tour of duty, Turner was a radioman and an operator and technician. By his second tour, he was the chief radioman and communications officer for the submarine. In the three years in between tours of duty, Turner taught submarine communications systems to new radiomen.
Turner was commissioned as an officer and sent to Iceland. “I called my wife and told her we had another adventure ahead of us,” he says. “We loved living in Iceland. It was a great place for family bonding, as well as an easy launching point for travel to England, Germany, Norway and other places. Iceland is a beautiful country. One of the highlights was watching the Northern Lights. One night, pretty much everyone on the base came outside to watch the amazing greens and blues and reds dancing across the sky. It was awesome.”
After 23 years in the Navy, Turner decided to separate from the military to start his next career, and something to do with security seemed to be a logical choice. “A lot of what the submarine force and surface ships do – and just the Navy in general – involves measures of information security,” says Turner. “I learned the fundamentals of security back in the days before the Internet, when encrypting the links was usually good enough. I grew into information systems as they became more important and we had to encrypt not just the links, but also databases and other elements. We had to have access controls to get in and out of the systems. I grew into understanding how the communications path worked, and understanding the information, the information systems, and the security controls that were necessary.”
As a civilian, Turner took a job at the Joint Battle Center in Suffolk, Virginia. “It was an extension of the Joint Chiefs of Staff organization and they had me working in a laboratory that was designed to test new command and control systems and new technologies,” he says. “My job in the lab was bringing the systems back to a baseline configuration. That’s a fundamental of cybersecurity—understanding the starting point before you begin adding things to the system.”
Then Booz Allen Hamilton called with an opportunity to assess application portfolios for transition from the many Navy networks into the Navy Marine Corps Intranet, which is the largest intranet in the world. He did that for a while, and then his next assignment was with the Navy’s Office of the Designated Approving Authority. “When a system was ready to go live, they would review the results of security testing to make sure that all of the controls were met,” says Turner. “I worked in that office for about eight years. I went from being one of many contractors in the shop to being the lead project manager on site for a contract that had up to 45 contractors at one time, all supporting this office.”
Turner’s job eventually took him into a senior management role where he found himself getting away from the security work that he really liked to do. “Booz Allen was a great place to work, but there came a time when I felt I needed to do something different,” he says. “I had spent some time as an adjunct professor at ECPI University in Newport News, and I thought that higher education might be something fun to pursue. In talking with others, I thought that being a CISO of a university would be a really good position that would allow me to use my technical background and experience as well as my ability to navigate political waters.” This led him to his current position as Chief Information Security Officer at the University of Wisconsin-Madison.
“When I interviewed for the CISO position, the university’s CIO said something that stuck with me. He said he wanted the University of Wisconsin-Madison to be the place where the best practices begin, and I thought, ‘I can help make that happen.’ Obviously the university agreed because here I am!”
Turner is very happy in this latest adventure. “My job is to make sure that the program is effective and running smoothly. A lot of my time is spent in thinking about what adjustments need to be made to the people, the processes and the technology that are the center of the university’s networks and systems,” he says. “I probably spend a fourth of my time thinking about process and policy and administrative type stuff, and another fourth of the time making sure I’m keeping in sync with what the teams are doing. A third quarter of my time is spent in understanding where the risk issues are and communicating with the rest of the university. We have a large population here and a lot of groups who would love to either hear from me or have me explain why we’re doing what we’re doing. And then probably the last quarter of my time is used to think ahead and look down range. Strategy is a big deal. If you don’t have a strategy, you’re bound to fail. I think, what do they say, ‘Tactics without strategy is the noise before defeat.’”
In addition to being responsible for securing the university’s information systems, Turner does a guest lecture for students every now and then. He simply doesn’t have the time to be a full-time CISO and teach an entire course, but he does relish the opportunity to do a lecture once in a while. This gives him the chance to share his real-world experience with students who are aspiring information security professionals.
As for a home life, after moving 21 times in 23 years and living all around the world, the Turner family can finally unpack their moving boxes and settle into the Madison, Wisconsin community.