Operations // Careers & People
6/9/2014
12:00 PM
Lysa Myers
Lysa Myers
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Women in InfoSec: Building Bonds & New Solutions

Learning, camaraderie, and fighting the good fight are just three reasons these women are trailblazing careers in InfoSec.

There have been a lot of articles lately, suggesting a variety of ways to get young women involved in tech. Some of these ideas sound like fantastic and creative ways to make the true appeal of a career in tech more broadly tempting. Some of them.... well, not so much. It got me thinking: What was it that actually drew women who have careers in InfoSec into this industry?

As a woman working in InfoSec for over a decade and a half, I’ve had the pleasure of becoming good friends with a number of other women in the field. It has occurred to me over the years how similar many of our stories are, both in terms of what attracted us to this industry, and of what we like and dislike about it now that we’re here. 

For all of us, a career in security was not something we had planned; it was simply something we fell into and found it fit our skillset nicely. Each of us had an interest in computers long before joining this industry.

 “For as long as I can remember my father preached that computers were the way of the future. I think I was writing programs and reporting defects in other people’s code long before I learned how to write in cursive,” one of my female colleagues told me. “By the time I was an adult, looking for flaws was second nature. Once I was given a chance to dabble in security I found I loved playing in that space as the ‘flaws’ were much more interesting.” 

Our reasons for staying here have a lot of common themes too. Learning is a big part of that. Jeannette Jarvis, director of product management at McAfee, explained:  "You always get to learn something new, there is always something compelling to understand or address.  You can be really stretched in addressing some of the challenges you encounter."

There was also an element of helping others, as Shawna Turner, who leads a team providing information security for Nike, added: "At the end of the day you are helping build new solutions and helping people protect their valuables, which is always a good feeling."

Source: Wikipedia
Source: Wikipedia

As you might expect, an industry full of people who are motivated by learning and helping others is one that is full of altruistic and creative people, which is a draw in and of itself.  Jarvis described it this way:  

“You would be hard pressed to find more passionate and committed people than those working in InfoSec. It is truly a community, and they are all willing to share and educate each other. While folks may work for competitors, they can still break bread and be friends. I am privileged to have friends all over the world thanks to this industry. How priceless and cool is that?”

My own experience has been very much the same. It has been exceptionally heartening to be surrounded by such obsessively philanthropic people who will stick with a problem until they come up with an imaginative solution. We have all spent personal time, working nights and weekends, or even traveling around the world at short notice to help others when it’s needed. This sense of all "fighting the good fight" together leads to feeling that our colleagues are like an extended family.

But this obsessive fight against the "bad guys" can be its own sort of downside to working in the industry: “My least favorite aspect to the industry is that you never disconnect. There is always work to do. Additionally, it can be frustrating that you never seem to get ahead of the bad guys. It is very much a cat and mouse game. Oftentimes it seems like we are fighting a losing battle,” Jarvis noted, but “these least favorite aspects are far outweighed by the pros of working in InfoSec.”

As the technology industry struggles to draw in new talent to meet the ever-growing need for people who are security savvy, we will need to attract people from varied backgrounds. There are certain things that will draw people in, regardless of their genders, nationalities, or economic status.

The existing view of computer science and security focuses mainly on logic and problem solving, but this appeals only to a small subset of people. A career in InfoSec can offer the promise of a job that is not only stable and lucrative, but also one that offers camaraderie and the opportunity to help others. And all this happens in an environment that is dynamic and exciting, which is something most people can appreciate. 

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
6/11/2014 | 6:08:34 PM
Re: Awesome Women, Awesome Future
@Lysa, it was great to hear your comments and insight today on Dark Reading Radio. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
6/11/2014 | 7:00:41 AM
Re: Great to hear some the pluses of a career in IT secrity
Kelly, our panel (self-included) will be very interested to hear your views as an InfoSec journalist who has covered this industry for many years. Glad to hear that you will be taking part in the live chat following the broadcast.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
6/10/2014 | 5:43:09 PM
Re: Great to hear some the pluses of a career in IT secrity
This topic is so important. I am eager to tune in tomorrow to hear and join the discussion. 
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
6/10/2014 | 8:32:18 AM
Re: Awesome Women, Awesome Future
That's great to hear! It's so cool to see more and more folks encouraging women and other tech-minorities to enjoy science and tech from such an early age. I suspect that will be the key to dealing with the shortage of security people. It will be great to see what the future of this industry brings!
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
6/10/2014 | 8:28:43 AM
Re: Great to hear some the pluses of a career in IT secrity
Thank you! I'm really looking forward to the show, it promises to be a lot of fun!
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
6/9/2014 | 6:23:32 PM
Awesome Women, Awesome Future
Lysa, I definitely have a great deal of respect for your work and what you do.  As I raise my daughters, I ignore completely any baggage I might have gathered growing up and encourage them to do everything, from playing with Barbies to hacking on GNU/Linux.  If it makes them happy (within reason of safety and the law, of course), I help them get there.  It's not just about equality, but as any hacker know, it's about new vision and different ways of thinking.  InfoSec gets more and more interesting every year the more diversity appears, from gender to age to race – though, hackers have always been pretty divers, but I think the community as it sits now has never been more vibrant.  Awesome women in the industry – any industry for that matter – equals and awesome future.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
6/9/2014 | 12:32:57 PM
Great to hear some the pluses of a career in IT secrity
Lysa, Thanks so much for sharing  your personal and positive experiences as a woman in InfoSec. It is refreshing to hear what a cool and supportive community you belong to. I can't wait to hear more during the Dark Reading Radio broadcast this Wednesday at 1 p.m. ET. Here's the link to the show for those of you who want to bookmark it.

And in case you were wondering, men in security IT -- managers and staffers -- are encouraged and welcome to attend. We're eager to hear your thoughts too. 
More Blogs from Commentary
InfoSec’s Holy Grail: Data Sharing & Collaboration
Despite all the best intentions, cooperation around Internet security is a still a work in progress. Case in point: Microsoft’s unilateral action against No-IP.
Phishing: What Once Was Old Is New Again
I used to think the heyday of phishing had passed. But as Symantec notes in its 2014 Internet Security Threat Report, I was wrong!
Dark Reading Radio: Data Loss Prevention (DLP) Fail
Learn about newly found vulnerabilities in commercial and open-source DLP software in our latest episode of Dark Reading Radio with security researchers Zach Lanier and Kelly Lum.
The Perfect InfoSec Mindset: Paranoia + Skepticism
A little skeptical paranoia will ensure that you have the impulse to react quickly to new threats while retaining the logic to separate fact from fiction.
Weak Password Advice From Microsoft
Tempting as it may seem to do away with strong passwords for low-risk websites, password reuse is still a significant threat to both users and business.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-6651
Published: 2014-07-31
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.

CVE-2014-2970
Published: 2014-07-31
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5139. Reason: This candidate is a duplicate of CVE-2014-5139, and has also been used to refer to an unrelated topic that is currently outside the scope of CVE. This unrelated topic is a LibreSSL code change adding functionality ...

CVE-2014-3488
Published: 2014-07-31
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

CVE-2014-3554
Published: 2014-07-31
Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.

CVE-2014-5171
Published: 2014-07-31
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

Best of the Web
Dark Reading Radio