Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

How to Build a Path Toward Diversity in Information Security

Hiring women and minorities only addresses half the issue for the IT security industry -- the next step is retaining these workers.

BLACK HAT USA – Las Vegas – Some 1.8 million information security professionals will be needed in the next five years worldwide, further driving home the need to expand the pool of potential candidates by bringing more women and minorities into the mix, speakers on the "Making Diversity a Priority In Security" panel said here today at Black Hat.

Not only are companies looking to fill vacant job openings, but they are increasingly seeking to add diversity to the workforce.

When you look at diversity, it goes beyond a person's gender and race and it brings to the table the benefit of a diversity of thought, says panelist Anthony Johnson, managing director and business information security officer at JPMorgan Chase & Co.

Panelist Aubrey Blanche, global head of diversity and inclusion at Atlassian, noted that empirical research has shown that when employees are working with people who are different than they are, they process information differently. As a result, one potential benefit may be coming up with ideas and innovation by studying an issue from a different perspective, Blanche says.

It's this potential benefit that prompts some companies to hire women and people of color for information security roles, even though their level of experience is less than other candidates, the panelists noted.

"You can say hire more people, but that doesn't solve the problem. You need to have a diversity program that gets the pipeline flowing," said Johnson.

Some of the panelists said their organizations are working on initiatives to encourage high school, middle school, and even elementary school-aged students, to learn about the cybersecurity field.

Palo Alto Networks, for example, teamed up with the Girl Scouts of the USA. Palo Alto Networks announced last month it would assist in delivering a national Girl Scout Cybersecurity badge for students in kindergarten through the 12th-grade.

"We partnered with the Girl Scouts to offer cybersecurity badges to K-12 girls, so all these girls will be exposed to cybersecurity," says Rick Howard, Palo Alto Networks chief security officer.

Another way to entice hiring managers, internal recruiters, and others involved in the hiring process to reach out and interview a diverse pool of job applicants, is to tie it to performance bonuses or some form of financial reward, says Mary Chaney, vice president of the International Consortium of Minority Cybersecurity Professionals (ICMCP).

Job descriptions often present a list of must-have and want-to-have requirements that preclude women and minorities. One way to bridge that gap is to write more approachable and realistic job descriptions that open the door for entry-level applicants as well.

"Women don't apply for jobs, even if they are 80% qualified. They won't apply because they don't meet the other 20%," Chaney says.

Maintaining a Diverse IT Security Workforce

Hiring women and minorities only addresses half the issue for the IT security industry. The next step is retaining these workers, according to the panel.

The number one reason women and minorities leave is because of mistreatment, Blanche says. One way her company sought to address attrition was by eliminating the subjective portions of performance evaluations, she added.

"Sometimes if a woman's voice is silenced during a meeting, after meeting after meeting, she goes silent," Chaney explained. She adds that women likely stay where they are valued and have a good support system.

Palo Alto Network's security team has marching orders from Howard that sexist jokes and comments will not be tolerated, he noted.

In the Black Hat keynote address here earlier in the day, Alex Stamos, CISO of Facebook, noted that two male engineers were treating a female security team member with disdain and disrespect. Stamos chastised the two engineers for it and was surprised when the female employee called him over to discuss the meeting and asked Stamos not to rush to her defense in the future. She explained it would be harder for her to gain respect and credibility with the two male engineers and the team if Stamos continued to rush to her defense.

Atlassian's Blanche said one way she dealt with finding her voice to speak up in meetings - after feeling she was frequently dismissed - was to call on a peer who created "space for her." In the meetings, he would ask Blanche what she thought, and over time she began to participate in the discussions.

"Over time I could say something and didn't feel like I would die," she said.

Related Content:

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
7/31/2017 | 12:29:59 PM
Long-term Effects of Gender Diversity
I've worked over a decade in an environment of deep diversity.  At all levels of management and labor, we have vastly diverse backgrounds in education, religious beliefs, nationality and gender.  As a techie I've worked at plenty of organizations that had what has now become the stereotypical view of software company employees on comedy shows.  Not here.  And after over a decade working with, under and over female employees I can say that the long-term effects of gender diversity are, in fact, not bad at all.  As the father of two daughters, I can finally assure my girls there is a place they can thrive, be seen as potential leaders and innovators and not be restricted by gender perceptions.  I hope for that throughout the whole tech industry.  Interacting with vendors across the industry, I feel that this is slowly changing; some of the most talented hackers I've worked with are women, and it doesn't take long after working with them to reach that "gender neutral" state because, big surprise, men and women in tech are ultimately different sides of the same coin.  Go figure.  
Carter25
0%
100%
Carter25,
User Rank: Apprentice
7/28/2017 | 9:15:19 AM
In Your Shoes
Currently as a woman, as the [only] security administrator, team of all men.. I face this every day. 

"Not being able to speak up becuase of always being dismissed." portion. My last two jobs. Im young. I'm blonde. I'm not taken seriously. And I'm shut down by others consistantly, from multiple teams. This is more frequent than people know.
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9308
PUBLISHED: 2020-02-20
archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.
CVE-2019-20479
PUBLISHED: 2020-02-20
A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning.
CVE-2011-2498
PUBLISHED: 2020-02-20
The Linux kernel from v2.3.36 before v2.6.39 allows local unprivileged users to cause a denial of service (memory consumption) by triggering creation of PTE pages.
CVE-2012-2629
PUBLISHED: 2020-02-20
Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator account via an addnew action to admin/administrators_add.php; or (2) c...
CVE-2014-3484
PUBLISHED: 2020-02-20
Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to (1) have unspecified impact via an invalid name length in a DNS response or (2) cause a denial of service (crash) via an invalid ...