start	end	text
0	11660	We've long talked about gender and racial issue diversity in cyber security, but it would be a missed opportunity if we didn't talk about the Black Lives Matter movement and its relevance to technology in our field.
13420	29320	Technology and social systemic issues have frequently been perceived as diametrically opposed, but in fact they absolutely overlap and technology can both be an accelerant, as well as an ability to fix some of these larger systemic issues that we're facing.
30000	48420	So assuming that everything that we're working on, we're all trying to build the safest version of that for our communities, I posit that the absence of diversity or the homogeneity in thought is in fact an attack vector that has not been sufficiently mitigated in our ecosystem.
49460	65440	So first things first, is diversity in cyber security really a problem? In a survey of 9500 US cyber security professionals, it was found to be that minorities represented 26%, which is slightly higher than the US national average, which is 21%.
66140	75680	That same survey found that the ethnic and racial minorities are actually consistently not holding top managerial positions.
75680	81680	And that pay inequity, especially for minority women, continues to be a real challenge.
82120	93900	Now diversity comes in many forms, of course. It's not just race, gender, sexual orientation. But if we believe that talent is equally distributed across a population,
93900	102680	any under-representation by one of these groups in our field means that we have less talent in our group than there is in the total workforce.
102680	109560	And we deal with some really hard challenges in cyber security. We need that talent to actually build solutions.
110780	117480	So maybe the first question we can ask ourselves, how do we broaden those that are attracted to cyber security?
117500	130000	One of the interesting things about cyber security is that it's often perceived as this very technical field. But at the end of the day, it's about people interacting with technology and information.
130000	134240	But that isn't always obvious to people looking at the field from the outside.
134820	145260	This common misperception of a purely technical discipline means that in even more people-facing roles, we tend to have people with technical backgrounds.
145360	149240	That seems like a missed opportunity to include more people in our ecosystem.
151620	160360	Calls for diversity are frequently met with the argument that raising one group above others gives them an unfair advantage in society.
160580	168780	So how can we actually make meaningful change? We need to focus on more than recruitment, even though that is absolutely important and critical.
168820	176100	We need to think about how do we encourage a broader group of people to even consider coming to work in the cyber security.
176100	187980	That requires thinking about the different ways into security, the training that we offer people coming into the field, and are we building tools that make it an accessible place for them to work and be successful.
188060	195180	We need to find pathways into security where anyone who wants to be involved is able to get involved.
195360	200880	Hiring for skill and passion and not just the right certification or a college degree.
200880	207740	Salesforce and Google have recently shared technical training and it's free and available to all.
207740	215160	It seems like an advanced step to try to change some of the systemic issues about access to technical education.
215160	220260	And it also seems like an effort to change our definition of what is qualified.
220420	227640	It takes effort to understand different backgrounds, different education, different experiences.
227640	238660	But the unconscious bias that we're potentially placing on qualifications can be something that we aren't aware of because we just don't know it's a problem.
238940	246900	It's built into our culture, but we need to expose these moments of unconscious bias and find new ways to think about it.
247060	254600	The formal paths that we follow for recruitment have historically not always created diverse teams.
254600	256520	So we need to think outside.
256520	269180	One way is to partner with organizations that are intentionally targeting diverse populations that are trying to get into the field, like the International Consortium of Minority Cybersecurity Professionals.
269460	278200	And if the oversubscribed women-only cybersecurity conferences are any indicator, there are plenty of women that are trying to get into the field.
278960	286340	So with all this discussion about attracting diverse talent, it would be remiss of me to not discuss retaining this talent.
286520	293440	How do we keep teams from burning out and protect them from the stress that comes with cybersecurity?
293820	300380	A significant number of security professionals seek to leave this field every year.
300840	310520	Security can be so demanding that one survey found that 50% of security professionals think about taking a lower paid job because it's so stressful.
311060	317260	Or two-thirds of people have considered leaving the field entirely because the demand is too high.
318360	327660	This means we need to change how we support each other, not just managing and mentoring each other so that we are continually growing and careers are progressing.
327940	339860	But we need to think about giving our people meaningful training so that they can understand how to be resilient and deal with the fact that they are on the front lines of trying to defend an organization.
340520	350740	So taking a page from threat modeling, how can we think about diversity or homogeneity of thought as a potential attack vector that we need to consider?
351340	356480	Every gap in a process where data moves from one team to the next.
356640	365500	Every assumption a developer or a defender makes about how a system will work or how a user will interact with that system.
365580	369420	Those are the cracks that an attacker can try to exploit.
370520	380320	And if everyone in the security team thinks the same way, has the same way of working, these attack vectors will continue to crop up.
380580	389760	Getting a wider range of people into cybersecurity is not just equitable. It's truly our best chance at doing something meaningful with security.
390340	394220	And we've seen how security can have a big impact on society.
394220	405220	In the 2016 U.S. presidential elections, the campaign trail brought to mainstream society something that this community has long preached.
405360	409550	Securing unstructured data, such as email, is critical.
410200	422410	The 2016 election further saw Russian disinformation that intentionally targeted Black communities, using fake accounts on every social media platform to share racially charged posts.
422410	429870	Whether such efforts had a significant effect on the election or not is hard to determine, and not the intention of this talk.
429990	438130	Instead, it seems like an opportunity to reflect and think, how did the authentication model fail on these social media platforms?
438310	450870	What aspect of spoofing was not considered? Or perhaps it was never a use case that would be thought of that charged racially political ideas would be shared on these platforms.
451870	459730	Unfortunately, we haven't seen it stop with these elections either, but it's continued in the targeting of BLM activists by cyber criminals.
459950	464150	This spring, we've seen DDoSers attack BLM groups.
464430	480130	CloudFare reported that those groups that identified as advocacy-focused saw a 1,120 times increase in attacks on their organizations just from May to April, and that's in comparison to the broader ecosystem.
480870	485310	Racism breeds distrust in systems and institutions.
485310	493020	We saw how technology furthered this problem in the implementation of the U.S. facial recognition protocol at borders.
493630	501350	NIST found examples of age, gender, and race bias in several widely implemented systems,
501350	518730	to the extent that all except the top performing ones had a 10 to 100 times higher likelihood of misidentifying African American, Alaskan Indian, Pacific Islander, and Asian American faces in comparison to their Caucasian counterparts.
519610	527830	Technology and policy mitigations need to be implemented where society, systems, and technology have weaknesses.
527830	542970	While the BLM movement has resulted in highlighting the need to dismantle systemic racism, technology is the accelerant that can take this from a city-by-city initiative and instead build anti-racism into our collective ecosystem.
543530	552070	The people in this community are at an exciting time in healthcare. Everything is getting connected. Insightful data is being gathered.
552070	558290	We're on the cusp of actually having true personalized medicine because of the treasure trove of data that we're getting.
558870	571830	But as you work to develop these systems and these amazing interventions, we also need to ask ourselves, what can we do to ensure that cybersecurity alleviates the systemic bias that exists today?
572890	584790	So true in threat modeling and true in thinking about diversity, here are 10 things to think about that might stop you from thinking about diversity, but they really shouldn't.
585350	595790	Number one, don't be afraid to ask questions. Try to build a community and an ecosystem where it's safe to ask questions and get engaged in a dialogue and to be wrong.
595790	605070	Number two, you're never going to be done. This is an ongoing process that will consistently change as technology evolves and as our community changes.
605990	618390	Number three, there is no one way to pursue this. It's a complicated issue that has evolved over a long period of time and will require a complicated solution in all likelihood.
618390	631530	Number four, this takes more than just one skill set. Just like effective security requires a wide variety of skill sets to be successful, this too will require variants and capabilities.
632310	638030	Number five, this isn't going to be easy. It's going to take time and it's going to take effort.
638770	646190	Number six, this isn't just for the experts to solve. We all have a role to play and can contribute in a meaningful way.
646190	654570	Number seven, accept that you're probably going to focus on the wrong thing at some point. And that's okay. That's part of learning.
655230	665770	Number eight, find an ally to help guide you. There are many in this community and outside of it that are willing to share and help us as we grow and change.
666010	672590	Number nine, don't dismiss the interplay of societal change and how it impacts cybersecurity.
672590	679310	And number 10, there's no right time to start this, but this certainly feels like a great inflection point.
679710	686090	So thank you for your time. I'd love to open up the conversation if that's something that we're able to do. Take care.