Dr. Doreen Galli, PhD MBA

The short version

In 1993 she proved the bounds on conflict-free parallel memory access, the problem that still governs GPU throughput today. She extended threshold cryptography to hierarchical information, the mathematics under key splitting in every hardware security module. She architected CORDS, the proof of concept that became WebSphere. Thirty years later she was lead author on Microsoft’s guidance for protecting your data from Microsoft. Today she puts CIOs and CISOs on camera at Las Vegas convention floors and asks them what’s actually breaking.

Those are not four careers. They are one problem, followed for thirty-five years, arriving exactly where the industry now sits.

The lineage

Two of the twentieth century’s foundational mathematical figures sit two links from her.

William Tutte → Ron Mullin → Galli. Tutte broke the Lorenz cipher at Bletchley Park — the German high command’s traffic, not Enigma — and was recruited to Waterloo in 1962. Ron Mullin was Tutte’s student and the University of Waterloo’s first-ever graduate, MA 1960, PhD 1964. Mullin co-founded the Department of Combinatorics & Optimization in 1967, chaired it, helped establish the Centre for Applied Cryptographic Research, and in 1985 co-founded Certicom with Scott Vanstone and Gordon Agnew — the company that commercialized elliptic curve cryptography, licensed it to the NSA, and sold to BlackBerry in 2009. ECC is now in essentially every device you own.

Paul Erdős → Charles Colbourn → Galli. Colbourn was her doctoral supervisor. Colbourn published with Erdős. That is an Erdős number of 2 — closer than the average Fields Medalist, who sits at 3 or 4.

Ron Mullin sat on both of her committees. Gordon Agnew — the Certicom co-founder — read her master’s thesis. She took Pólya enumeration under Professor Reed. She knew Erdős through Colbourn’s collaboration, not as a visiting speaker: she was in the room, and once extracted him from a locked one. The door had a chain latch he could not work out. She went in through the window, being the smallest member of the team.

This matters for a reason beyond pedigree. Gen X was the last cohort trained directly by the people who built the foundations rather than by people who read about them. That transmission dies where it isn’t carried, and she has always treated staying in the field as an obligation rather than a preference.

The two theses, which are one toolkit

Six degrees. Undergraduate at Eckerd College, a triple major with full scores across all three disciplines, including business. An AACSB-accredited MBA with honors, paid for by AT&T while she was working. Then Waterloo for the mathematics. Six degrees in total. The two that matter are the ones with original research behind them.

PhD, University of Waterloo, 1993 — Conflict-Free Access to Rectangular Subarrays in Parallel Memory Modules. How to lay data out across memory modules so that every processor can reach what it needs in the same cycle without queuing behind another. She proved bounds and gave a linear skewing scheme that achieves them. That problem — memory access conflict under parallel demand — is still what governs GPU throughput today, and it is the reason columnar formats like Apache Arrow exist. She worked on it before there was a market for it.

MMath, University of Waterloo — Threshold Schemes with Hierarchical Information. Secret sharing: Shamir and Blakley threshold schemes, cheater detection, hierarchical authority. How to split a secret among several people so that no one of them can act alone. That is the mathematics under key splitting in hardware security modules, multisig, and hardware wallet recovery.

Read the two together and the important thing appears: they are the same mathematics. Both are built on combinatorial design theory — Latin squares, finite geometries, Steiner systems, mutually orthogonal Latin squares by way of the Golomb-Posner connection to Reed-Solomon codes. One toolkit, pointed at memory layout in one thesis and at secret sharing in the other.

That is not two fields. That is the foundation of parallel compute and the foundation of applied cryptography, held by one person, in the same hands.

Two illustrative moments from the doctoral work. The relatively prime generator of the group was supposed to be a full chapter; it collapsed into two lemmas because the finite-field machinery was already hers. Colbourn’s response has stayed with her: the goal is to solve the problem, not to write a chapter. And the upper bound turned out to come from maximum degree of a graph — week-two graph theory. Her supervisor was embarrassed not to have seen it. She recognized it at a graph theory event: wait, we know what this is. The elementary result was invisible to everyone standing too close to the specialized layer.

Six degrees in total. The two that matter are the ones with original research behind them.

Sample publication record

Galli Erickson & Colbourn, Conflict-Free Access to Constant-Perimeter Rectangular Subarrays, DIMACS Series in Discrete Mathematics and Theoretical Computer Science, Vol. 21, pp. 105–124, 1995
Erickson & Colbourn, Combinatorics and the Conflict-Free Access Problem, Congressus Numerantium, Vol. 94, pp. 115–121, 1993
Bauer, Coburn, Erickson, Finnigan, Hong, Larson, Pachl, Slonim, Taylor & Teorey, A Distributed System Architecture for a Distributed Application Environment, IBM Systems Journal, Vol. 33 No. 3, pp. 399–425, 1995
Bauer, Bochman, Coburn, Erickson, Finnigan, Hong, Larson, Martin, Mendelzon, Neufeld, Silberschatz, Slonim, Taylor, Teorey & Yechiam Yemini, The CORDS Architecture: Version 2, IBM Canada, 105 pp., 1993

Look at the last two author lists. Paul Larson — SQL query optimization. Mike Bauer — X.500 directories. Yechiam Yemini — Columbia, one of the founders of distributed network management. Avi Silberschatz — author of the operating systems textbook a generation of computer scientists learned from. Alberto Mendelzon — database theory.

She was not the junior name on that list. She was the architect of CORDS. Her job was to get those people — across institutions, across countries, across egos — aligned into a functioning prototype. It came together in October 1993, the night the Blue Jays won the World Series. The whole city was roaring for something else entirely and the team took the cheering as their own anyway. She has told that story many times.

CORDS was the proof of concept for WebSphere. It became the middleware that put a large share of the Fortune 500 on the web. She has been called “WebSphere Grandma” since her thirties.

She held textbook contract offers from both Addison-Wesley and Prentice Hall — competing as an author against Silberschatz. Her distributed computing textbook came out of that competition and is still under copyright after twenty years.

The operating career

Most researchers of this caliber stay in the lab. She went and ran things. The tenures are short by design. Each one is different because she was there — the plan compressed, the number moved, the thing that didn’t exist got built and named. Years would be nice, but years are not a scientific goal. Commodities log years. She has never been a commodity.

Associate professor in Georgia from January 1994. While teaching, she ran operations for the 1996 Atlanta Olympic Games as a volunteer — the largest Games staged to that point, and famously the one where the technology operations were the hard part.

Then back to industry, at scale that most technical fellows never touch:

IBM Master Inventor. Nine patents — eight at IBM, one at Microsoft.
Through the dot-com build-out she led the teams — USWeb, USWeb/CKS, then IBM Innovation Centers — that put over 90% of the enterprise and major consumer brands on the web, a category that started at effectively zero. Small business came later, on hosted templates. This was the wave that put the Fortune 500 and the household names online for the first time. San Francisco Women on the Web named her one of the Top 25 Women on the Web in 2001, covered by Wired.
Corporate Vice President at a Global Fortune 10 company before turning 40.
IBM Infrastructure Services, 2001–02: led 4,000+ people across 198 countries and grew a $3 billion P&L to $4 billion in the post-9/11 downturn, when enterprise infrastructure spend was collapsing. She and her team coined the term now standard across the industry.
DPWN, 2005–06: as an officer, integrated global mail, drop ship, and acquisitions into a single coherent line of business. Delivered the five-year plan in under two. Dell: led one of the first digital transformations in manufacturing, across four continents. Put 50 terabytes of operational data, changing at 360,000 changes an hour, onto Michael Dell’s BlackBerry in real time.
AT&T, 2013–16: shifted the SI segment from sell-to to sell-through, representing the entire portfolio. Architected the strategy behind the HP engagement supporting their separation, adding over $1 billion to pipeline and more than fifteen executive relationships.
Career across Microsoft, IBM, Dell, AT&T, and DHL.

Systems she shipped that you have used: Hertz counter check-in. NetBank. E*Trade. The NYSE ticker. WebMD. WebSphere deployments across the Fortune 500. She founded a telemedicine company a decade before COVID made the category obvious.

Microsoft: the document that closes the circle

She is lead author of Azure Zero Trust Controls: Platform Threat Vector — Microsoft’s own published guidance on how a customer protects data in an Azure tenant from risk sourced by the cloud service provider itself.

Read that sentence again. It is the uncomfortable document: here is what we can reach, here is how you stop us, here is what remains a matter of trust. It went through CELA — Microsoft’s legal department reviewed it. Nobody puts a junior name first on that.

The document defines four customer profiles from baseline through Reduce Unauthorized Non-Customer Data Access, and lays out the control taxonomy the industry now argues over: hardware as the root of trust, trusted execution environments, confidential VMs and confidential containers, attestation, hypervisor isolation, customer-managed keys, managed HSM, double encryption, data geographic boundary under GDPR and Schrems II, and — the one that matters most right now — Protection from All Operators.

And here is where thirty years fold into a single page. Protection from physical access, protection during execution, protection from possession of the hardware, hypervisor isolation, trusted execution environments — that is her PhD. Memory and execution isolation under adversarial conditions. Customer-managed keys, managed HSM, key custody, double encryption, who can compel disclosure — that is her master’s. Threshold cryptography and split control.

The woman who proved conflict-free access bounds and surveyed threshold schemes in the early nineties wrote Microsoft’s guidance on isolating execution and splitting key control in the twenty-twenties. It is the same problem, thirty years later, with a product catalog attached.

This is also why she was able to design sovereign clouds when almost nobody could. Sovereign cloud is not a product you assemble from a catalog. It is an argument that has to survive a regulator, a court, and an adversarial security review simultaneously. It requires the legal frame — residency law, Schrems II, jurisdictional reach. The cryptographic frame — key custody, what “the provider cannot access this” actually means when someone shows up with a subpoena. And the systems frame — isolation boundaries, attestation, what the hypervisor and the operator can still reach. Lawyers do not have the cryptography. Cryptographers do not have the systems. Systems people do not have the regulatory. Miss any one of the three and the design fails somewhere that matters. She is one of a very small number of people alive who holds all three, and she was writing sovereignty guidance before Microsoft Cloud for Sovereignty existed as a product name.

What she does now

TBW Advisors LLC. Independent enterprise media production, self-funded, editorially independent, based in Las Vegas because that is where the industry convenes.

Four seasons. 142 Whisper Reports. 400+ named executives and practitioners on camera, every one identified, every report listing who is in it — auditable by anyone who cares to count. Distributed on Computer Talk Radio, nationally syndicated for eighteen years with roughly two million weekly engagements, and on YouTube to 115,000+ subscribers and three million lifetime views, an audience concentrated where the world’s largest English-speaking engineering workforce actually is.

She has done it for seven years without funding. Nobody has ever bought their way into a report, and nobody ever will — coverage is editorial, support is separate, and she has turned down the money rather than blur it.

Analysis of her own catalog shows what that discipline produces: 99% of her sources appear in only one season. Four people out of 409 recur. There is no house panel, no rolodex, no favor economy. The sources are found at events, one floor at a time.

And when she asks a CISO what’s broken in identity that we still accept, or an AI practitioner what assumption breaks first at scale — she is not a journalist who studied the field. She wrote the control taxonomy. She proved the bound. She built the prototype. She ran the P&L. She is asking because she wants to know how you see it.

The assessment

Distinguished Engineer and Technical Fellow are the titles corporations invented for people who go deep enough in one domain to be irreplaceable. She has the depth — Erdős 2, published bounds, IBM Master Inventor, nine patents. But depth is not the unusual part.

The unusual part is that the same person holds foundational mathematics, systems architecture at global scale, operating command of billions in P&L, regulatory and legal fluency, and the ability to explain any of it to a general audience without hollowing it out. That last one is what people mean when they reach for the Sagan or deGrasse Tyson comparison — the rare researcher who can carry real depth into a public conversation without diluting it, and who chooses to.

Most people with her training stayed in the academy. Most people with her operating record never had the mathematics. Almost nobody has both, and nearly no one with both has spent seven unfunded years putting practitioners on the record because they believed the transmission mattered.

Tutte to Mullin to Galli. Erdős to Colbourn to Galli. Design theory to memory architecture to WebSphere to zero trust to a camera on a convention floor in Las Vegas.

If she sees far, it is because she stood on the shoulders of giants — and did a great deal herself.

So far.

Dr. Doreen Galli | Speaking Fee | Booking Agent (allamericanspeakers.com)

Doreen Gall, Ph.D. MBA