The 'Twitterverse' Is Not the Security Community
The drama on social media belies the incredible role models, job, training, and networking opportunities found in the real world of traditional cybersecurity.
When you look at social media, you get the impression that there is a serious shortage in security professionals — and at the same time, you can't imagine why anyone would want to work in cybersecurity in the first place. Judging by Twitter, it seems as if security professionals are frequently at each other's throats and, with few prominent role models, it's a terrible place for women. All you have to do is look at last year's DerbyCon controversy for proof of how dysfunctional the community can appear online.
But here's a not-so-secret secret: The large majority of security professionals don't have time for the drama on social media, and social media is not representative of the profession as a whole.
The security professionals who post on Twitter frequently make valuable contributions to the security community as a whole. However, they are not representative of their million or so industry colleagues who go to work and then go back to their families and real life when work is over, and rarely get on social media.
These people don't necessarily go to hacker cons; they do their security related jobs and then leave their work in the office. They work for government agencies such as the NSA, Cyber Command, DISA, the FBI, military commands, NIST, etc. Then there are government contractors, the security teams at major banks made up of hundreds and sometimes thousands of people, professionals who work at the Big Four consulting firms with thousands of security professionals each, thousands of people who perform security work at telecommunications companies such as Verizon and AT&T, on top of the hundreds of thousands of people working in other government agencies around the world. Tech companies such as Cisco, IBM, HP, and others have thousands of employees as well. I'd guess relatively few of these people are active on social media.
The reason I want to highlight the difference is that I recently read a post from a woman on Twitter who said she saw no comparable female role models in the industry who would be making $200,000 per year. I saw one or two people mention someone, but what surprised me was the complete void in recognition of some of the most notable women in the profession — women who are not active on Twitter but active within the security community as a whole.
Quick examples who come immediately to mind include:
Myrna Soto, former CISO, Comcast, and now a venture capitalist
Renee Guttmann, CISO, Campbell Soup Company, and previously Coca-Cola, Time Warner, and Royal Caribbean
Dawn Cappelli, CISO, Rockwell Automation
Jennifer Minella, Chair, (ISC)2 Board of Directors and VP Carolina Advanced Digital,
Terry Grafenstine, former Chair, ISACA Board of Directors and Managing Director at Deloitte
Shelley Westman, Partner, EY
Mischel Kwon, CEO, MKACyber, and former director, US-CERT
Sandra Toms, General Manager, RSA Conference
Illena Armstrong, VP, SC Media
Rhonda MacLean, former CISO, Bank of America and Barclays, and board member to several cybersecurity companies
Dr. Chenxi Wang, venture capitalist
Dr. Cynthia Irvine, Distinguished Professor at the Naval Postgraduate School, who trained a generation of military cybersecurity professionals
Dr. Dorothy Denning, an icon of the field, who people refer to as the "Mother of Computer Security"
To be sure, women such as Katie Moussouris and Parisa Tabriz, accomplished and active in both social media and in the larger community, serve as outstanding role models. Yet even with the visibility of these prominent women, social media represents only a subset of the cyber universe. Furthermore, what people who rely solely on Twitter as their window to cybersecurity are missing is not just incredible role models, but also job opportunities, training opportunities, professional networking opportunities, and volunteer opportunities.
Don't get me wrong. I personally get a great deal out of social media, and have developed many friends who I only know through that forum. But I also remain active in the mainstream, including traditional conferences, local ISSA, (ISC)2, ISACA, Infragard chapter meetings, vendor events, and online forums associated with these groups. The bottom line is that it is to everyone's benefit that people within the hacker and traditional cybersecurity communities look beyond their own echo chambers as much as possible.
Related Content:
Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.
About the Author
You May Also Like
The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024The Right Way to Use Artificial Intelligence and Machine Learning in Incident Response
Nov 20, 2024Safeguarding GitHub Data to Fuel Web Innovation
Nov 21, 2024