topic Re: Bridging the Gender Gap in Career Discussions

Bridging the Gender Gap

Lisav821 — Wed, 15 Nov 2017 20:24:23 GMT

It seems that every security event I attend, I hear the stats - females occupy only 11% of the cyber security jobs in the US. There's a whole lot of talk about bridging this gap, and there are also some pretty smart folks who are trying to make a difference. Let's keep talking about this, and let's fortify the talk by taking some action to "move that needle"! How do we get more school girls interested in cyber security? How do we help more mid-career IT gals transition to cyber security career? I'd love to hear your thoughts!

Lisa Vaughan, CISSP, PMP

Jackson, Mississippi

Re: Bridging the Gender Gap

CISOScott — Thu, 16 Nov 2017 12:10:15 GMT

I think one of the big stigmas is that the IT/cybersecurity field is and always has been thought of as a field for geeks and nerds. I have 3 daughters and they constantly call me a nerd/geek even though they use almost as much technology as I do! I think most girls shy away from it because of this stigma. They are already bombarded with ads implying they have to be sexy to be anything in this world and IT is not considered "sexy". If you can find a way to break this stigma then you have a good start.

Re: Bridging the Gender Gap

SeaCISSP — Thu, 16 Nov 2017 13:16:18 GMT

Hi Lisa.

I think starting early and active mentoring in the workplace are a good start for any anti-discriminatory activities but they are only the tip of a very large iceberg.

There is a lot more that organisations can do to demonstrate their active commitment to equality and diversity, to raise awareness and to dispel the confusion about what D&E actually mean. Also, in some cases,to demonstrate compliance against their country's D&E legislation.

For instance,Senior Managers and HR departments can:

- Ensure there is a clear D&E 'owner' at executive level (and that staff know who that person is)

- Clearly understand and document the business risks that can arise from *not* being "equal and diverse"

- Introduce Diversity Champion roles

- Elicit staff feedback about Diversity & Equality in their annual staff surveys

- Routinely collect metrics on the demographic of their workforce and routinely monitor and refine those statistics (within the legislative and regulatory frameworks that apply of course, such as GDPR!).

- Introduce explicit D&E training and awareness materials that 'go beyond the headlines' (eg by 'exploding myths' ;emphasising that D&E are "all about inclusiveness", for men and women of all backgrounds; highlighting the benefits of a diverse workforce; providing organisation-specific generic examples that demonstrate types of acceptable/unacceptable behaviour,etc)

- Introduce D&E "workforce representation" working groups, aligned to output from the organisations' HR and governance forums. (A D&E sub-group would have a particular interest in annually reviewing the organisation's recruitment, appraisal, acceptable behaviour and complaints procedures)

- Routinely include 'Demonstrate an active commitment to D&E' in all JDs, with additional responsibilities at the higher grades.

- Ensure their complaints, grievance and "whistleblower" policies are fit for purpose. (A 'hot topic', following the Harvey Weinstein allegations.)

All staff groups can:

- Introduce Diversity & Equality as a standing item on relevant meeting Agendas (eg team meetings)

There are also some less obvious actions individuals and organisations can take. For instance:

- Everyone could encourage organisations (like ISC2!!) to sign up to the Diversity Charter:

http://diversitycharter.org/

"All too often we see conference and event lineups full of the same or similar people, we don’t want that anymore. We want diversity."

As you can probably tell, I was a Diversity Champion in a former (work)life and am passionate about this subject!

Re: Bridging the Gender Gap

SeaCISSP — Thu, 16 Nov 2017 13:23:17 GMT

Hi CISOScott.

I agree that image and perceptions are very important. There is also still the stigma of choosing traditionally 'non-feminine' subjects such as science, maths and engineering at school.

Thankfully, 'Geeky' also has some positive connotations - there are some very rich and successful 'geeks' and it is good to see many confident 'geeky girls' at science fiction and fantasy conferences!

Re: Bridging the Gender Gap

jdquinitchette — Sun, 19 Nov 2017 13:43:09 GMT

"HELP MOMS LEARN!" Lisa, the best thing our country could do right now is run through every county DSS looking for likely single moms and TRAIN THEM for cyber-security careers. I've been working on an Information Systems Security designation for nearly twenty years. At the local community college, they fast-tracked men into certifications and jobs (VGCC!). I went to the Department Head (A woman) and she said "Well, that's just in there," meaning the designation as an official certification outlet. Six months later, she came into the classroom to present the guy seated next to me his CISSP certification documents. After she left, I couldn't help it; I burst into tears. "What do you mean, NO PROGRAM?" asked Jamal White. "THEY WALKED ME THROUGH THE WHOLE THING IN NINE WEEKS!" In the current climate, we need InfoSec professionals of long standing to take this thing out of the hands of government. The President's entire CyberComputing council QUIT back in August or September. NO ONE is minding the STORE.

Re: Bridging the Gender Gap

Early_Adopter — Mon, 20 Nov 2017 15:49:13 GMT

Thanks for sharing, more must be done in nurture. Sorry they were not championing you as well as they might.

Mulling it over there are parallels in what you are saying about empowering mothers in terms of a study that looked at getting the best ROI for aid in developing nations:

http://www.imf.org/external/pubs/ft/fandd/2012/03/revenga.htm

There is an quote here that could be pivoted to the Cybersecurity profession very easily:

'...eliminating remaining gender disadvantages in education; increasing women’s access to economic opportunity and thus earnings and productivity...'

It would be interesting to see what would happen if there was a systematic focus on this - It also makes a lot of sense to focus resources on underrepresented groups.

I would think that the ISC2 chapters and other organizations might be good places to start this. In addition perhaps an ISC2 Women's Chapter running parallel to others would make sense, and could fulfill some of the needs here. Not the same thing but I came into this profession from an unorthodox background, so having like minded individuals to sound off was very helpful.

In addition to all the great points I think CISOScott nails it in terms of the bigger picture - pointing out that most people get into Cyber Security from other feeder lines and that getting greater participation in IT, Coding etc is probably the way to have a larger pool of female representation in the group of people that will ultimately want to protect systems, information and people from those that would do them harm.

Re: Bridging the Gender Gap

jdquinitchette — Mon, 20 Nov 2017 18:02:25 GMT

There are some good starting points in this post! Thanks.

Re: Bridging the Gender Gap

Lisav821 — Thu, 30 Nov 2017 19:16:48 GMT

Newcomer III - I like your ideas! There is a new (ISC)2 chapter that has just been approved in my state (Mississippi), so I'm excited to be a part of getting it off the ground and having another platform to address the gender gap.

There are many targets when we're talking about "moving the needle" on this issue: single moms, mid-career women who are looking for a change, elementary through higher-ed young ladies. The often-overlooked under-served communities also need a chance to be exposed to the cyber security career options.

I am very intrigued by the idea of a Women's chapter or focus group. I'll reach out to my friends at (ISC)2 and see what they think of this. Since we didn't have a Women in Security track at this year's Security Congress, I want to provide all the support I can to see how we can get this started for next year's Congress in New Orleans. Anyone else interested in helping with this?

Re: Bridging the Gender Gap

Lisav821 — Thu, 30 Nov 2017 19:17:32 GMT

Great points!

Re: Bridging the Gender Gap

Lisav821 — Thu, 30 Nov 2017 19:18:59 GMT

All of these are such great points!

Re: Bridging the Gender Gap

Lisav821 — Thu, 30 Nov 2017 19:19:36 GMT

So true! We have to work on making cyber security more appealing to girls.

Re: Bridging the Gender Gap

dhouser — Fri, 08 Dec 2017 04:49:31 GMT

SeaCISSP -

Good list. I would add a review of job descriptions / postings for gender-neutral phrasing. It's pretty well-documented that InfoSec postings tend to be off-putting for women and are largely written by men with terms that men will find compelling.

-ddh

Re: Bridging the Gender Gap

agbenaza — Mon, 11 Dec 2017 13:44:06 GMT

A lot of ladies would consider a career in information security if they get mentored. One young lady I spoke to mentioned that, it is something she thought about, but she was not sure how it would work for her. Those of us already in the career can offer to help these interested ones. We also need to make them understand that information security is nothing more than any other field of study like Medicine or Engineering.

Re: Bridging the Gender Gap

EIAKPKP452 — Thu, 14 Dec 2017 21:13:19 GMT

Very insightful post! I am a member of Charlotte Region SIM (Society for Information Management) and I am really proud of the work our chapter does to support local STEM programs and some programs and scholarships that specifically work to bring more young females into technology fields. I think this is a major component in achieving more diversity in our profession that will also help to strengthen the talent pool. It helps that there are starting to be more strong female technology leaders in top positions like Gini Rometty and I expect that will help a great deal also.

Adam

Re: Bridging the Gender Gap

Kate — Mon, 18 Dec 2017 22:28:16 GMT

I think there's something to be said for making the various meet up groups and professional organizations with a security (and IT) bend be more friendly to women as well, so that once a non-male person makes it past all the other hurdles to find their way to the group they don't get turned off by the atmosphere. The last infosec group meeting I went to (not ISC2), the during-meeting discussion was fine, but the mingling afterwards was dominated by several men going on and on about how technologically incompetent their wives were (and haha wives hate tech haha), along with a bunch of other commentary mildly degrading women. One or two guys chimed in with slight dissent when the topics got bad, but overall it was enough that I never bothered to make time in my schedule to fit in another meeting with that group.

Re: Bridging the Gender Gap

EIAKPKP452 — Wed, 20 Dec 2017 21:52:19 GMT

Yikes Kate! Good call getting away from that crowd. Hopefully there are better options out there for you to network and share information. You make a good point in the responsibility of everyone to speak up when people disparage others in a group setting. Absolutely necessary to maintain the quality and integrity of the organization. One thought is that you might consider becoming part of the leadership of the infosec group you mentioned to help it improve?

Adam

Re: Bridging the Gender Gap

SeaCISSP — Thu, 21 Dec 2017 11:13:40 GMT

Dhouser,

Thank you. Agree that using gender-neutral language is very important - and not well-understood.

Over the years, I've experienced some staff and manager expressing opinions that gender-neutral language as a trivial, media-driven subject of no consequence in the workplace. Other staff have just been confused about what is best to use/avoid, with little guidance from their organisations.

It isn't obvious to everyone that gender-specific terms can be potentially exclusive through ambiguity or unintentional bias ("The guys are ....") or overtly patronising ("Gentlemen - and, of course, the ladies ..."). Most times, the use of "guys" is intended to be neutral and inclusive but not always.

There are also expressions such as 'Don't get your panties in a twist', 'prima donna' and 'queen bee', which can be used passive aggressively in a workplace context.

As well as high-level statements, organisations can include specific examples of what they consider to be verbal/written good practice, in the training and guidance to accompany Codes of Conduct, Anti-Discriminatory Policies, Comms strategies and e-mail etiquette guides. Routinely using gender-neutral terms such as "Staff members must ...." in policies or "everyone/folks" in general conversation is inclusive and can avoid inadvertently communicating the wrong message.

It's good that this is also an area where anyone can take individual responsibility to stay aware of the terms and expressions they're using and the impact words can have, in the workplace and elsewhere.

Re: Bridging the Gender Gap

CISOScott — Thu, 28 Dec 2017 14:56:33 GMT

Another thing to consider is not to just force women (or any group for that matter) into a career "just to get more of them in there!". I have seen many people, of both sexes, who went into InfoSec because of the belief "that's where the money is..." only to find themselves hating to go to work because they don't like what they do. They only put in a half-hearted effort to keep abreast of the changes and do marginal work. Forcing people into a field they don't like just reinforces the stereotype that group X shouldn't be in InfoSec because they are incompetent. The key is to watch for a spark, and when you see it, nurture it and help it grow. If you see a girl/woman showing some interest, help them by engaging them in the field and see if they like it. If they like it, sell the idea of how exciting it can be as technology changes rapidly and there are always new things to learn. I keep gently nudging my daughters toward it but they are not interested. I have one that is on the fence, but she is undecided but leaning towards the medical field. I may yet win her over to our side. The other 2 have their minds set on becoming doctors so I don't think I will be able to nudge them into the field.

If you are in this field, please take time to mentor and help others. Look for a spark of interest and when you find it see if you can fan it into a flame.

Re: Bridging the Gender Gap

lincramp10 — Tue, 20 Mar 2018 14:53:36 GMT

Re-entry programs -- to recapture those who've been out of work for a period of time. Taking time off to take care of family (children, sick or elderly family members) usually falls on the woman. Re-entry programs are big in other tech areas, but I don't know of any in the info security field.