Careers & People
3/15/2017
05:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Women Still Only 11% Of Global InfoSec Workforce

Career development and mentorship programs make women in cybersecurity feel more valued, increase women's success.

The global cybersecurity workforce remains stagnant at just 11 percent, according to the 2017 Women in Cybersecurity Report, co-authored by The Executive Women’s Forum on Information Security, Risk Management and Privacy (EWF) and the Center for Cyber Safety and Education, which partnered with (ISC)2. The report is based on survey responses from over 19,000 information security professionals in 170 countries.

Report co-author and EWF founder Joyce Brocaglia says the most important finding of the report is that "it isn't just one thing" causing the persistent shortage of women in information security, but rather a "confluence of events."

The findings, says Brocaglia, show that women are underrepresented, are paid less than their male colleagues, feel undervalued, and feel discriminated against. "That's what's leading to this stagnation." 

The shortage is severe in North America, with only 14 percent of the infosec workforce composed of women, but even more striking elsewhere; women only claim 7 percent of the workforce in Europe, 8 percent in Asia, and 5 percent in the Middle East, according to the report.  

"Common sense should tell you we should be doing more about this," says co-author and EWF executive director Lynn Terwoerds, noting that in order to solve the cybersecurity skills shortage, the industry must do a better engaging the female population.

In general, the underrepresentation extends to cybersecurity management, but women were beginning to fare better when it comes to obtaining positions at the very top: while men are nine times more likely to hold managerial positions, they are only four times more likely to hold C-level or executive positions. 

However, those high-level positions for women come at a price; the survey found that the higher a woman rises in an organization, the more discrimination she experiences in the workplace, rising from 35% at entry-level to 67% at C-level.( This could also be a result of respondents providing answers that reflect experiences accrued over the entirety of longer careers, as opposed to only answering about experiences of the past year.) 

Overall, 51 percent of female respondents reported at least one type of discrimination, as compared to 15 percent of male respondents. Of these women, 87% reported unconscious discrimination, 19% overt discrimination, 22% tokenism, 53% unexplained delay or denial of career advancement, and 22% exaggerated highlighting of mistakes. 

The wage gap also persisted, with women earning less than men at every level - $5,000 less at non-managerial positions, $4,630 less for managers, and $4,530 for executive management. Over the past two years, the gap has narrowed for senior positions, but widened for non-managerial positions.

"You look at all of these statistics," says Brocaglia, "and say 'well maybe that's why'" the number of women in infosecurity has not increased.  

The study also unearthed ways to better retain and encourage women in infosec. The report showed that women respondents who underwent leadership training, executive coaching, mentorship, or had "sponsors" who recommended them for high-profile projects, recommended them for promotions, or introduced them to people in their professional networks felt far more valued in their careers.  

"There's a huge issue of developing and advancing these women so they don't opt out," says Brocaglia. "We have to stop losing them mid-career."  

The report also found that while more millenial women are pursuing degrees in computer science and engineering fields, older women are highly educated, but in a wider range of fields. Brocaglia advises employers to remember that there are many, many influential roles in cybersecurity that don't require technical degrees.

Will the women in infosec needle not move upward, however, simply because women are not interested in the job?

"It's a very dubious comment to make," says Terwoerds, noting that throughout history women have "embraced and excelled in" other fields they were presumed to be uninterested in before. "I would consider that Exhibit A of an unconscious bias." 

Related Content:

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Ludivina
50%
50%
Ludivina,
User Rank: Strategist
3/20/2017 | 8:21:28 PM
Re: But?
True and false. The women are just a pure beauty. We should know and make comparasion at places where it can actually be properly done.
darkerreading
67%
33%
darkerreading,
User Rank: Strategist
3/18/2017 | 2:01:01 PM
But?
Did you know that less then 1% of miners are women? Less then 2% of garbagemen are women! This is unacceptable. Something has to be done about this because, well, it just does. #MoreWomenMinors
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
3/17/2017 | 11:57:57 AM
Wages/Salary
Worth noting, too, that historically, many women have been less comfortable with negotiating their salary than their male counterparts.  Studies suggest that this is the primary culprit for salary differences: Men ask and negotiate for higher salaries/compensation packages far more often than women do.

This, of course, goes to deeper sociocultural issues than workplace factors -- and such factors probably contribute to a great deal of other gender-gap issues.
JulietteRizkallah
67%
33%
JulietteRizkallah,
User Rank: Moderator
3/16/2017 | 5:04:35 PM
STEM and role models can help this complex issue
Before discussing the retention of women in cybersecurity, we need to look at the numbers of women entering the workforce in cybersecurity.  Without having specific data, i would guess the numbers also are low.  Programs promoting STEM with young girls cannot do enough to gear young girls and women in our industry direction.  We also need to start promoting Women in Cybersecurity as role models in our teaching and in the case studies around. The more success we can demonstrate among women in cybersecurity, the more women will venture in our industry. And then we will need to make it worth for them...
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio