Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Women In Security Speak Out On Why There Are Still So Few Of Them
Threaded  |  Newest First  |  Oldest First
RetiredUser
RetiredUser,
 User Rank: Ninja
5/11/2015 | 5:53:59 PM
Father-Daughter Nerd/Geek Day
As the father of two daughters I know the responsibility I have to make sure I don't look at them as "girls" in the stereotypical sense is an immense one.  My eldest is a true scientist and absorbed more knowledge about animals and nature before she was six than I had learned in forty years of life.  She created her own database on sea life somewhere between five and six years of age on an old laptop I gave her with gNewSense GNU/Linux, using LibreOffice Calc.  I encourage everything in her that longs for scientific engagement. 

My youngest is a brute and quite the hacker.  I suspect she'll be the one with eyes on the software industry as a career, and probably she will enjoy InfoSec since breaking into things is her passion, clearly, and she's not even two.   

I think a major part of this deficiency across the board in tech industries of women in various roles has as much to do with the parents as with the schools the kids go to, or the tech culture in general.  I had to discover the world of electronics and computing on my own with absolutely no encouragement on the home-front – exposure is also half the battle won.  For my daughters, I plan on making sure they get every opportunity, and hope that - as they learn - it isn't once pointed out to them that because they are female, some employers might not want to hire them, or that some schools might not think they will be interested in certain classes, or that some of their friends might look at them funny when they break out their sticker-covered laptops to write some code between classes instead of doing whatever it is girls who don't do that do... 

For me, I try to balance it all out, but every day should be Father-Daughter nerd/geek day, as far as I'm concerned, since the daughters need to hear from their Dads that "it's perfectly OK to want to crawl under a car with a set of tools, to build your own robot or Arduino cluster, and certainly OK to be interested in InfoSec and enjoy breaking into systems to make them better."
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
5/11/2015 | 8:41:24 PM
Re: Father-Daughter Nerd/Geek Day
Love the Father-Daughter Geek Day mention! And your point about exposure and encouragement are key. I am constantly talking to my daughter and son's female friends about this industry. One of these days I'll get a recruit.
AvaxaS781
AvaxaS781,
 User Rank: Apprentice
5/12/2015 | 8:50:12 AM
Women In Security Speak Out On Why There Are Still So Few Of Them
I think forcing more women to be involved in InfoSec for the sake of more women is not a good idea. Good ideas can come from anyone and gender should never be a qualifier or disqualifier. One of the women quoted in this article stated we need to change what is needed for the job to less relevant skills to just get them in. I think this is a very bad idea and we need to focus on weeding out the ones in the industry whom do more harm than good. I think the best way to get more women involved in InfoSec is to start at the schools and colleges. Title 9 stated off being a good idea, but its implementation in recent years has done more harm than good. Right now women make up the majority of college students. With this pace, most jobs requiring a college degree will be filled by women simply because the pool of candidate will be mostly women. The oppressed have become the oppressors in US Universities. To make changes in a positive way, we need to show young girls in school more than just solving math problems, but how solving those problems helped create all the technological marvels we have today. Not just teach to a test or to regurgitate information. Kids today do not learn how to learn. I know that sounds odd, however kids today; including my own, do not understand how to figure things out on their own. They cannot function outside of what is told to them. This is sad and in my option, a huge reason why other countries are surpassing the US in education. Just my 2 cents as a Information Security Subject Matter Expert.
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
5/12/2015 | 8:59:28 AM
Re: Women In Security Speak Out On Why There Are Still So Few Of Them
The comment that I believe you are referencing wasn't about downgrading skills for infosec jobs--it was about embracing the wider array of skills needed for the field today, such as psychology, linguistics, a broader world view of the issues in the field. We're actually already seeing a lot of this in the industry. Here's the section I believe you're referring to: 

Matsuda says girls often don't see themselves fitting into the computer science and cyber security stereotypes, so the industry needs to do a better job selling the career options here. Plus security entails a variety of skillsets: "We have linguists, psychologists, and computer scientists," for example, she says. "That's a diversity of disciplines" and security benefits from different types of people from different backgrounds that provide a broader insight into the issues, she says.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
5/12/2015 | 3:01:50 PM
Re: Women In Security Speak Out On Why There Are Still So Few Of Them
Totally agree, Kelly. Obviously STEM skills are important to security professionals who are entering the field, But I think a lot of women who can do the math & science would by equally attracted by some of the other disciplines that are critical to the profession. The industry -- and schools at all levels --  need to do a better job of explaining what the job is  all about. 
RyanSepe
RyanSepe,
 User Rank: Ninja
5/12/2015 | 8:52:20 AM
Professional Stigmas
I think the biggest hurdle for this is getting over the professional stigmas. The "that's a man's job" or "that's a woman's job"; those statements are still woven in the fabric of our minds to some extent and you can see it in the numbers. InfoSec is not the only career path that sees this.

You have the 10%F and 90%M denoted by this article.-2015

For Nursing you have 88%F and 12%M-Economic Modeling 2010 (Gap has probably decreased since then but not by much)

The overall point is your can do this for many career paths. Until those professional stigmas are eradicated it will be difficult, no matter how much data is divulged, for those metrics to change. This will take time. Constant reiteration is very helpful in this matter and will hopefully decrease the time gap.

 
PrincessMariam
PrincessMariam,
 User Rank: Apprentice
8/23/2016 | 11:56:49 AM
Re: Professional Stigmas
Thank you for pointing that out. There exist jobs that are male dominated and jobs that are female dominated. The problem is - nobody complains about the jobs that are female dominated. Why? That's not the agenda.


The previous article I saw on this site was an article about "diversity" - but in the pictures were 100% women?!?!? Cleary, diveristy has less to do with including everyone and more to do with eliminating men, and even caucasions in some cases.

When I was at university, the history department's hiring practives were being investigated since almost all of the professors were white males. In my department - engineering - all of the professors were Indian males. Guess what?? No investigation.

 

You tell me.

 

As a woman, I recognise that there are simply going to be professions that are mostly women, and others that are mostly men. That has been the case since the beginning of history. Oh yeah and about not getting resumes from women - notice how it wasn't even questioned? The one time I heard a male manager state that he wan't receiving resumes from women the immediate response was that he is clearly a liar and in reality didn't pay attenion to all the resumes he received from women.

Why the different responses to the manager based on their gender?

 

Again, you tell me.
rasoolirfan
rasoolirfan,
 User Rank: Apprentice
5/14/2015 | 9:29:03 AM
diversity
its vital to empower women security professionals at all levels and orgarnizations should find ways to have the mix of gender at all roles

nicely articulated. kudos


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1142
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
CVE-2023-1143
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
CVE-2023-1144
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
CVE-2023-1145
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
CVE-2023-1655
PUBLISHED: 2023-03-27
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.