1
00:00:00,000 --> 00:00:11,660
We've long talked about gender and racial issue diversity in cyber security, but it would be a missed opportunity if we didn't talk about the Black Lives Matter movement and its relevance to technology in our field.

2
00:00:13,420 --> 00:00:29,320
Technology and social systemic issues have frequently been perceived as diametrically opposed, but in fact they absolutely overlap and technology can both be an accelerant, as well as an ability to fix some of these larger systemic issues that we're facing.

3
00:00:30,000 --> 00:00:48,420
So assuming that everything that we're working on, we're all trying to build the safest version of that for our communities, I posit that the absence of diversity or the homogeneity in thought is in fact an attack vector that has not been sufficiently mitigated in our ecosystem.

4
00:00:49,460 --> 00:00:54,540
So first things first, is diversity in cyber security really a problem?

5
00:00:54,540 --> 00:01:05,440
In a survey of 9500 US cyber security professionals, it was found to be that minorities represented 26%, which is slightly higher than the US national average, which is 21%.

6
00:01:06,140 --> 00:01:15,680
That same survey found that the ethnic and racial minorities are actually consistently not holding top managerial positions.

7
00:01:15,680 --> 00:01:21,680
And that pay inequity, especially for minority women, continues to be a real challenge.

8
00:01:22,120 --> 00:01:24,420
Now diversity comes in many forms, of course.

9
00:01:24,420 --> 00:01:28,060
It's not just race, gender, sexual orientation.

10
00:01:28,060 --> 00:01:42,680
But if we believe that talent is equally distributed across a population, any under-representation by one of these groups in our field means that we have less talent in our group than there is in the total workforce.

11
00:01:42,680 --> 00:01:46,040
And we deal with some really hard challenges in cyber security.

12
00:01:46,040 --> 00:01:49,560
We need that talent to actually build solutions.

13
00:01:50,780 --> 00:01:57,480
So maybe the first question we can ask ourselves, how do we broaden those that are attracted to cyber security?

14
00:01:57,500 --> 00:02:04,220
One of the interesting things about cyber security is that it's often perceived as this very technical field.

15
00:02:04,220 --> 00:02:10,000
But at the end of the day, it's about people interacting with technology and information.

16
00:02:10,000 --> 00:02:14,240
But that isn't always obvious to people looking at the field from the outside.

17
00:02:14,820 --> 00:02:25,260
This common misperception of a purely technical discipline means that in even more people-facing roles, we tend to have people with technical backgrounds.

18
00:02:25,360 --> 00:02:29,240
That seems like a missed opportunity to include more people in our ecosystem.

19
00:02:31,620 --> 00:02:40,360
Calls for diversity are frequently met with the argument that raising one group above others gives them an unfair advantage in society.

20
00:02:40,580 --> 00:02:43,560
So how can we actually make meaningful change?

21
00:02:43,560 --> 00:02:48,780
We need to focus on more than recruitment, even though that is absolutely important and critical.

22
00:02:48,820 --> 00:02:56,100
We need to think about how do we encourage a broader group of people to even consider coming to work in the cyber security.

23
00:02:56,100 --> 00:03:07,980
That requires thinking about the different ways into security, the training that we offer people coming into the field, and are we building tools that make it an accessible place for them to work and be successful.

24
00:03:08,060 --> 00:03:15,180
We need to find pathways into security where anyone who wants to be involved is able to get involved.

25
00:03:15,360 --> 00:03:20,880
Hiring for skill and passion and not just the right certification or a college degree.

26
00:03:20,880 --> 00:03:27,740
Salesforce and Google have recently shared technical training and it's free and available to all.

27
00:03:27,740 --> 00:03:35,160
It seems like an advanced step to try to change some of the systemic issues about access to technical education.

28
00:03:35,160 --> 00:03:40,260
And it also seems like an effort to change our definition of what is qualified.

29
00:03:40,420 --> 00:03:47,640
It takes effort to understand different backgrounds, different education, different experiences.

30
00:03:47,640 --> 00:03:58,660
But the unconscious bias that we're potentially placing on qualifications can be something that we aren't aware of because we just don't know it's a problem.

31
00:03:58,940 --> 00:04:06,900
It's built into our culture, but we need to expose these moments of unconscious bias and find new ways to think about it.

32
00:04:07,060 --> 00:04:14,600
The formal paths that we follow for recruitment have historically not always created diverse teams.

33
00:04:14,600 --> 00:04:16,520
So we need to think outside.

34
00:04:16,520 --> 00:04:29,180
One way is to partner with organizations that are intentionally targeting diverse populations that are trying to get into the field, like the International Consortium of Minority Cybersecurity Professionals.

35
00:04:29,460 --> 00:04:38,200
And if the oversubscribed women-only cybersecurity conferences are any indicator, there are plenty of women that are trying to get into the field.

36
00:04:38,960 --> 00:04:46,340
So with all this discussion about attracting diverse talent, it would be remiss of me to not discuss retaining this talent.

37
00:04:46,520 --> 00:04:53,440
How do we keep teams from burning out and protect them from the stress that comes with cybersecurity?

38
00:04:53,820 --> 00:05:00,380
A significant number of security professionals seek to leave this field every year.

39
00:05:00,840 --> 00:05:10,520
Security can be so demanding that one survey found that 50% of security professionals think about taking a lower paid job because it's so stressful.

40
00:05:11,060 --> 00:05:17,260
Or two-thirds of people have considered leaving the field entirely because the demand is too high.

41
00:05:18,360 --> 00:05:27,660
This means we need to change how we support each other, not just managing and mentoring each other so that we are continually growing and careers are progressing.

42
00:05:27,940 --> 00:05:39,860
But we need to think about giving our people meaningful training so that they can understand how to be resilient and deal with the fact that they are on the front lines of trying to defend an organization.

43
00:05:40,520 --> 00:05:50,740
So taking a page from threat modeling, how can we think about diversity or homogeneity of thought as a potential attack vector that we need to consider?

44
00:05:51,340 --> 00:05:56,480
Every gap in a process where data moves from one team to the next.

45
00:05:56,640 --> 00:06:05,500
Every assumption a developer or a defender makes about how a system will work or how a user will interact with that system.

46
00:06:05,580 --> 00:06:09,420
Those are the cracks that an attacker can try to exploit.

47
00:06:10,520 --> 00:06:20,320
And if everyone in the security team thinks the same way, has the same way of working, these attack vectors will continue to crop up.

48
00:06:20,580 --> 00:06:25,480
Getting a wider range of people into cybersecurity is not just equitable.

49
00:06:25,480 --> 00:06:29,760
It's truly our best chance at doing something meaningful with security.

50
00:06:30,340 --> 00:06:34,220
And we've seen how security can have a big impact on society.

51
00:06:34,220 --> 00:06:36,080
In the 2016 U.S.

52
00:06:36,080 --> 00:06:45,220
presidential elections, the campaign trail brought to mainstream society something that this community has long preached.

53
00:06:45,360 --> 00:06:49,550
Securing unstructured data, such as email, is critical.

54
00:06:50,200 --> 00:07:02,410
The 2016 election further saw Russian disinformation that intentionally targeted Black communities, using fake accounts on every social media platform to share racially charged posts.

55
00:07:02,410 --> 00:07:09,870
Whether such efforts had a significant effect on the election or not is hard to determine, and not the intention of this talk.

56
00:07:09,990 --> 00:07:18,130
Instead, it seems like an opportunity to reflect and think, how did the authentication model fail on these social media platforms?

57
00:07:18,310 --> 00:07:21,290
What aspect of spoofing was not considered?

58
00:07:21,290 --> 00:07:30,870
Or perhaps it was never a use case that would be thought of that charged racially political ideas would be shared on these platforms.

59
00:07:31,870 --> 00:07:39,730
Unfortunately, we haven't seen it stop with these elections either, but it's continued in the targeting of BLM activists by cyber criminals.

60
00:07:39,950 --> 00:07:44,150
This spring, we've seen DDoSers attack BLM groups.

61
00:07:44,430 --> 00:08:00,130
CloudFare reported that those groups that identified as advocacy-focused saw a 1,120 times increase in attacks on their organizations just from May to April, and that's in comparison to the broader ecosystem.

62
00:08:00,870 --> 00:08:05,310
Racism breeds distrust in systems and institutions.

63
00:08:05,310 --> 00:08:09,610
We saw how technology furthered this problem in the implementation of the U.S.

64
00:08:09,610 --> 00:08:13,020
facial recognition protocol at borders.

65
00:08:13,630 --> 00:08:34,510
NIST found examples of age, gender, and race bias in several widely implemented systems, to the extent that all except the top performing ones had a 10 to 100 times higher likelihood of misidentifying African American, Alaskan Indian, Pacific Islander,

66
00:08:34,510 --> 00:08:38,730
and Asian American faces in comparison to their Caucasian counterparts.

67
00:08:39,610 --> 00:08:47,830
Technology and policy mitigations need to be implemented where society, systems, and technology have weaknesses.

68
00:08:47,830 --> 00:09:02,970
While the BLM movement has resulted in highlighting the need to dismantle systemic racism, technology is the accelerant that can take this from a city-by-city initiative and instead build anti-racism into our collective ecosystem.

69
00:09:03,530 --> 00:09:07,770
The people in this community are at an exciting time in healthcare.

70
00:09:07,770 --> 00:09:09,850
Everything is getting connected.

71
00:09:09,850 --> 00:09:12,070
Insightful data is being gathered.

72
00:09:12,070 --> 00:09:18,290
We're on the cusp of actually having true personalized medicine because of the treasure trove of data that we're getting.

73
00:09:18,870 --> 00:09:31,830
But as you work to develop these systems and these amazing interventions, we also need to ask ourselves, what can we do to ensure that cybersecurity alleviates the systemic bias that exists today?

74
00:09:32,890 --> 00:09:44,790
So true in threat modeling and true in thinking about diversity, here are 10 things to think about that might stop you from thinking about diversity, but they really shouldn't.

75
00:09:45,350 --> 00:09:48,710
Number one, don't be afraid to ask questions.

76
00:09:48,710 --> 00:09:55,790
Try to build a community and an ecosystem where it's safe to ask questions and get engaged in a dialogue and to be wrong.

77
00:09:55,790 --> 00:09:59,110
Number two, you're never going to be done.

78
00:09:59,110 --> 00:10:05,070
This is an ongoing process that will consistently change as technology evolves and as our community changes.

79
00:10:05,990 --> 00:10:10,190
Number three, there is no one way to pursue this.

80
00:10:10,190 --> 00:10:18,390
It's a complicated issue that has evolved over a long period of time and will require a complicated solution in all likelihood.

81
00:10:18,390 --> 00:10:22,790
Number four, this takes more than just one skill set.

82
00:10:22,790 --> 00:10:31,530
Just like effective security requires a wide variety of skill sets to be successful, this too will require variants and capabilities.

83
00:10:32,310 --> 00:10:35,410
Number five, this isn't going to be easy.

84
00:10:35,410 --> 00:10:38,030
It's going to take time and it's going to take effort.

85
00:10:38,770 --> 00:10:42,490
Number six, this isn't just for the experts to solve.

86
00:10:42,490 --> 00:10:46,190
We all have a role to play and can contribute in a meaningful way.

87
00:10:46,190 --> 00:10:51,970
Number seven, accept that you're probably going to focus on the wrong thing at some point.

88
00:10:51,970 --> 00:10:53,070
And that's okay.

89
00:10:53,070 --> 00:10:54,570
That's part of learning.

90
00:10:55,230 --> 00:10:58,830
Number eight, find an ally to help guide you.

91
00:10:58,970 --> 00:11:05,770
There are many in this community and outside of it that are willing to share and help us as we grow and change.

92
00:11:06,010 --> 00:11:12,590
Number nine, don't dismiss the interplay of societal change and how it impacts cybersecurity.

93
00:11:12,590 --> 00:11:19,310
And number 10, there's no right time to start this, but this certainly feels like a great inflection point.

94
00:11:19,710 --> 00:11:21,270
So thank you for your time.

95
00:11:21,270 --> 00:11:24,750
I'd love to open up the conversation if that's something that we're able to do.

96
00:11:25,070 --> 00:11:26,090
Take care.