Girl Security
Ann Johnson: Welcome to "Afternoon Cyber Tea with Ann Johnson," where we speak with some of the biggest security influencers in the industry about what is shaping the cyber landscape and what is top of mind for the C-suite and other key security decision-makers.
Ann Johnson: I'm Ann Johnson, and today I'm joined by Lauren Buitta who earlier this year was one of 50 women making the world a better place by InStyle magazine. Lauren has dedicated her career to helping underserved communities. She began as a policy analyst with the National Strategy Forum, a nonpartisan think tank that is focused on a wide range of national and global security issues, including domestic terrorism, transnational threats and cybersecurity.
Ann Johnson: In 2009, Lauren launched her consulting firm Stele Consulting, which provided support to clients on local policy issues, including exclusionary land use policies and racial segregation in Chicago. Lauren is a former fellow with the Carnegie Endowment for International Peace, the Truman National Security Project, American Bar Association Standing Committee on Law and National Security law student liaison and a leader with Chicago Council on Global Affairs.
Ann Johnson: Today, Lauren is also the co-founder and CEO of Girl Security, an organization dedicated to advancing girls, women and gender minorities in national security through supportive pathways. I'm incredibly excited to welcome you to "Afternoon Cyber Tea," Lauren.
Lauren Buitta: Thank you for having me, Ann. It's a real honor.
Ann Johnson: So, Lauren, you have this incredibly unique story about how your career path in national security led you to actually launch Girl Security. Can you please share that with our audience?
Lauren Buitta: Yeah, absolutely. I had a pretty non-linear pathway, as is evident from my background, but it wasn't necessarily by design. I actually had the idea for Girl Security about 15 years ago when, as you noted, I was working as a national security policy analyst with a think tank in Chicago. And this was just after 9/11, and my brother was deployed to Iraq. And so I was really sort of focused on the idea that young people - the young people around me - had very little understanding of national security, no fault of their own.
Lauren Buitta: But I really wanted to create a space for young people especially to understand national security issues. And at the time for me, cyber was first and foremost because it was one of the most kind of dominant issues emerging out of 9/11.
Lauren Buitta: And so the earlier kind of understanding or beginning of Girl Security was really focused on creating a space for young people in national security. And then as a young woman in national security, I experienced what oftentimes - too oftentimes - young women experience, which was a balance of discrimination of different kinds. And, in fact, I had to resign from a job that I loved because an employer who had long misbehaved behaved in such a way that I had to leave my position. At the time, I was in law school studying to become a national security lawyer.
Lauren Buitta: So it was very much a departure from a pathway that I loved deeply, but it actually led me to work that I did for the last decade prior to starting Girl Security, focused on racial segregation in the city of Chicago arising from exclusionary land use policies, like zoning and historic preservation. And, in fact, a lot of that work has shaped the model for Girl Security. And I think the emphasis on starting with girls was very much the case that I felt as though girls were on the front lines of some of our most pressing national security issues, including cyber and disinformation.
Ann Johnson: So that is an unfortunate experience for you, and I think it gives you that really unique perspective about what women face in the workforce. And I know you focus today even in women or girls in the middle and high school level in the U.S. What led to focusing on, you know, those younger girls?
Lauren Buitta: Yeah, I think part of it was - well, first of all, there was really nothing for girls and young women focused specifically on security at the time. I think disinformation and cybersecurity brought home national security in a way that any other prior national security threat had not. And so I really just felt that those two issues were opportunities to bring girls into a dialogue that women had historically been excluded from.
Lauren Buitta: And I would say lastly, the data bears out, at this point, that if we really want to forge diversity of representation in pathway, we have to start sooner. In other words, that sort of adolescence point in a person's life is when they do what they call occupational identity. So they really start to think about what their career pathways may be in college or career. And so that kind of early intervention point became a priority for us, knowing that we're really committed to scaffolding that pipeline from the beginning of a girl's interest throughout her career as well.
Ann Johnson: OK. That makes a tremendous amount of sense. And, you know, we often over here say that our teams must be as diverse as the problems we are trying to solve. And, you know, we've seen a lot of studies - right? - including one from the World Economic Forum that diversity sparks innovations. Cities with large immigrant populations tend to have a higher economic performance, and businesses who have more diverse management teams also have higher revenues.
Ann Johnson: We also know that a C-suite with more women is likely to be more profitable. So this bottom line tends to be the biggest driver for change yet, yet women are still only, you know, 20% of the cybersecurity industry. I would love to get your perspective on why you think we have that lag.
Lauren Buitta: Yeah, certainly. I mean, as I noted, you know, cybersecurity pathways are still just not on the menu for most girls and young people and certainly those from under-resourced communities from across the country. In most of the school districts and communities with which we work, many have never even had a computer science course.
Lauren Buitta: I would also note that, you know, at this point, as probably most of us know, schools and educators are really just trying to survive amid the pandemic and there's almost little room for learning that falls outside the scope of both state and national learning standards but also district - a particular district's priorities, which, at least at present, are focused on maintaining or making up missed learning and socialization as a result of the pandemic.
Lauren Buitta: I think we also need to consider that cybersecurity, as a career, appears to most outside of cybersecurity to be in its nascency. And I think this is actually a really good thing because it means there's still a lot we haven't tried to increase the representation of women and other marginalized populations in cyber. And I think the current fever pitch around the importance of cybersecurity as a workforce provides, at least for us, some exciting wind, you know, behind our sails.
Lauren Buitta: But I think separate and relatedly, cybersecurity kind of still suffers from a bit of an identity crisis. And I don't want to get too far into the weeds, but I think this is a question on our minds at Girl Security, which is, is cybersecurity a profession or a trade, or should cybersecurity be positioned as a profession or a trade, and what are the implications of that?
Lauren Buitta: And when we think of professions, you know, we think of doctors and lawyers and architects. And these types of professions, which have taken centuries to develop, have held, you know, a certain prestige, require a certain amount of schooling and learning and training and, at least historically, were assumed by more privileged groups.
Lauren Buitta: And I think at Girl Security, we believe, at least directionally, that cybersecurity should be more positioned as a trade, as something more accessible with respect to learning and employment. But actually, this is kind of where that thought process gets hairy, and this is why we're doing a lot of work as - work focused on family and community and girls' occupational identity, which is that parents and caregivers and community play a really significant role in a child's aspirations and pathways.
Lauren Buitta: And without a doubt, in every community we've worked with from across the country, we know that girls are being told to be doctors, lawyers and architects. So never mind what we know about the rising cost of education and student loans and cost of living. There is that generational, aspirational influence that plays a really significant role in girls' and women's aspirations. And again, there's a lot of great data from the Gates Foundation around this type of work.
Lauren Buitta: I think and then on top of that, you know, you have lack of diverse representation of role models in cyber. I think Director Easterly at CISA is doing an awesome job at shifting that at the federal level. But I think the field itself is also not doing enough to reach adolescence, which, again, is kind of when they start thinking about these pathways. And if we wait too long, you know, to reach girls and women, if we hope that they'll go to college and then on to grad school or if we hope for a series of variables that might lead to their early career entry, I don't think we'll hit the mark in shifting the representation.
Ann Johnson: No. And I think that it - to your point, I think it's really important to fill that pipeline early for the girls - right? - to give them that motivation. How do we influence the parents then and the community, right? How do you think about that influence that they're going to have on their daughters about these careers?
Lauren Buitta: Yeah, it's a really good question. And I think part of the way, at least at Girl Security we're approaching it, is offering either patch programs, like the one we created with Microsoft Security for the Girl Scouts of Chicago, where there's some type of community-oriented exercise or dinner table exercise, so to speak, where they're essentially using their own storytelling to express their interest or understanding of cyber and related pathways.
Lauren Buitta: But I also think direct parent and community engagement is a route that we've tried and we will continue to try. But I think at an industry level, there's a lot more work that can be done to educate parents about the pathways, about the sturdiness of the pathways. You know, I'm a first-generation college grad. I didn't have a choice. My mom said, you're going to be a lawyer. You need a job. You need health and benefits.
Lauren Buitta: And I think for many parents - and again, especially those that fall outside a community of knowing - they just want their kids to have a job that has - you know, that is steady and provides benefits. And cyber is just - it hasn't risen to that level yet with those parents and communities.
Ann Johnson: Yeah. And so there's work for us to do there, and that's interesting. Because cyber, to your point, is still a very nascent industry, right? And it's not a very large industry. And, you know, we - I think this is a right inflection point because there's a ton we can do to influence at this point, as the industry builds and grows.
Lauren Buitta: I agree with you. And I think parents would be heartened to know - or caregiver I should say as well - would be heartened to know that there is a clear series of pathways. You know, there's some other nodes as well - you know, school counselors, guidance counselors, teachers and educators. And there's been some really great work there. I think there's just more we can be doing. And as I said, I think we're at the front end of this challenge, which is actually very exciting to me because I think there's a lot of innovative strategies we can still employ.
Ann Johnson: Excellent. You know, when we think about this secure workforce - and I've been - by the way, I've been doing a lot of work on the intersection of cybersecurity and disinformation and our - you know, Microsoft has done research on that with our Microsoft Digital Defense Report. What do you think about, though, the opportunity we have not only to engage these young girls in, you know, security conversations but also talk to them about disinformation and how that's shaping society?
Lauren Buitta: This is a passion issue for me, mostly because, as I noted, it was really the kind of catalyzing threat that pushed me to start Girl Security after, you know, a 15-year incubation period. But I think for girls, especially in the digital domain, there's a couple of different variables at play. You know, we know that girls' self-esteem is measured by four domains, one of which is personal security. And the data around the likelihood of girls, as well as people of color, to be target onlined (ph) for things like doxʹxing, or receiving or disseminating of illicit images, is growing exponentially. So we just have this, you know, direct impact to their personal security, which has a connection to their self-esteem, which can have implications for all kinds of things, including their career aspirations.
Lauren Buitta: I think a second point - and we have seen the impact of this with girls and young women in our program, in our organization - is the impact of disinformation, as well as online harassment, to their civic voices. You know, they're spending 10 to 12 to 18 hours a day on social media. It's where they, you know, reaffirm their identity. It's where they express their ideas. It's where they express their political opinions. And for many, they're being shouted down or essentially scared offline. So it does have that kind of civic - I think, civic suppression piece as well.
Lauren Buitta: And I would just say lastly - and not to sound that this is all scary, because I think these spaces provide a lot of opportunity and again, I think we're at the front end of it - but, you know, what we're starting to see, because girls and women are spending so much time online, they're normalizing behavior in the digital domain that in the physical domain we've spent decades, if not centuries, trying to educate girls and young women to not tolerate with respect to that kind of physical and mental abuse.
Lauren Buitta: And so there are these domains in which I think, just from a personal security perspective, we have to be doing more to empower girls and women in the digital space and online in social media to simply ensure that their voices aren't tapped out by some of these challenges. And then again, I think, as noted, it's an issue area that girls and women can get behind in cyber because they're witnessing it every single day. They're experiencing it every single day.
Lauren Buitta: And I would say for fellows in our fellowship program, as well as mentees in our program, we have seen the increase in girls taking this on as a capstone issue or kind of a passion project, wanting to create public education campaigns for their peers and communities on disinformation. So their interest is growing alongside the growing threat posed by disinformation. And so I take that as a positive, that not just our work but I think the aggregate of other - others in this space is having an impact on them.
Ann Johnson: That's an incredibly important topic, right? Online safety is such a huge issue, and it's another thing that I will say, we're fairly nascent in, right?
Lauren Buitta: Yeah.
Ann Johnson: Social media as a construct hasn't been around 50 years - right? - as we know it today. There's a lot of opportunity to do there, and I'm glad to hear that you're taking on that challenge as a personal passion. Because the one thing I've learned about you is when you want to do something, you do it. You find a way, and you just get it done. So...
(LAUGHTER)
Ann Johnson: ...On that, you have a lot of irons in the fire, and it's all hugely impactful work. And I probably should have said this earlier, but I'm just - I'm really effusive about the work you do, right? You just do this tremendous amount of work that's high-impact and relevant. Can you share a little bit with our listeners? Tell us a little bit about - more about Girl Security, but also on the other passion projects you're working on today.
Lauren Buitta: Yeah, absolutely. I think what I always try to share with people is, you know, this organization is really led by the girls we serve. And we learn from them as much as we hope they learn from us. And I don't know if that sounds precious, but it's actually quite true. And so a lot of the new special projects emerging are from girls and young women in our program.
Lauren Buitta: For example, we're doing a lot of work focused on unpacking the historical narrative of national security as it relates to Native American and Indigenous communities to create a foundation upon which girls and women from those communities can not only share their perspectives, but also, again, start to see themselves in pathways such as cyber within their respective communities as it relates to tribal national security.
Lauren Buitta: And relatedly, because we have many girls in our program who identify as neurodiverse, as ADHD or on the autism spectrum, we're doing a lot of work right now to develop frameworks and approaches to ensure that those participants in our program feel supported, whether it's from a learning and training perspective or a mentoring perspective.
Lauren Buitta: And I think what we learn from these populations is how important it is to disrupt the status quo and how much value there is in really listening to those diverse perspectives beyond just checking the boxes. You know, we really see equity as a strategy that can yield tremendous innovation and especially in cybersecurity, where we know so many of the challenges in the digital domain will require this kind of multitude of skill sets.
Lauren Buitta: And then in addition to that, we continue our nationwide mentoring program. So for folks listening, we're always looking for practitioner mentors who are willing to spend some time with some amazing adolescents and share insights about their careers. We are also growing our stipended (ph) fellowship program, which is sort of a 15-week apprentice-like program where girls, women and gender minorities spend 15 weeks working with amazing instructors across the national security industry and doing a balance of skill-building, a capstone project and then also a community-driven project as well.
Lauren Buitta: And then we have some - you know, some long-term goals, which is, of course, to be able to accommodate more girls and young women in this space but also expand the number of partnerships we have with companies and government and industry to provide more opportunities to create that pipeline effect for participants in our program.
Ann Johnson: That makes perfect sense. And I know we're working with you.
Lauren Buitta: Yes.
Ann Johnson: We're really proud to be working with you. The Girl Scouts' effort is a tremendous effort. Can you talk about - a little bit about how you think about online privacy? You know, and I'll talk about this in context of a blog that I wrote several years ago. And talk - thinking about my - I have a 20-year-old daughter, and their concept of online privacy is very different than ours. They put everything out in that public domain - right? - whether it's Instagram or Snapchat or whatever it is - right? - that they're using today. And how do you think about privacy and how it intersects with the safety of these girls and also just about, you know, their self-esteem and building into future careers?
Lauren Buitta: It's one of the most challenging issues, and it is such a generational - you know, the generational kind of gap and understanding of privacy, I think is - to me, it becomes increasingly pronounced especially as we engage with more, let's say, middle-school girls, for example. And so I think, again, we really try to take the lead from girls in our program around how they're thinking about privacy and what they share. And to your point, Ann, they share anything and everything.
Lauren Buitta: And so what we're trying to balance right now is not perpetuating a disempowering message around the digital domain. In other words, we don't want girls and women to be afraid to express themselves online and to share in a way that's productive for them. But I do think that's also why we need that kind of in-school discourse piece, that community-based discussion, that parent-caregiver-based discussion.
Lauren Buitta: And then I think it's also something that - you know, this is something we talk a lot about at Girl Security which is if girls and women see that industry does not necessarily take girls' and women's security seriously, you know, specifically around issues like online harassment, we're not setting a great example as to why they too should value their privacy or why they, too, should value their own self-respect in a digital domain. So I think there's many different things we can be doing on many different levels to change the narrative around privacy.
Lauren Buitta: I think - you know, one of my mentors, Suzanne Spaulding, who's had a long and wonderful career in cybersecurity, which continues - you know, we talk a lot about this from the national security perspective. And her message has always been kind of fighting in the light - in other words, accepting that there's no such thing as privacy, essentially, and that all data and all information is somehow accessible. And so I think, for us, we try to have a conversation with girls more about, you know, what happens if, how do you respond if, what can you do to protect, without trying, again, to disempower them from expressing themselves and connecting online.
Ann Johnson: Yeah. And I think that's - I like the way you said Suzanne Spaulding said it, which is, you know, the internet is forever, right? And anything you put online is forever. And by the way, even what you don't put online is discoverable.
Lauren Buitta: Exactly (laughter).
Ann Johnson: So balancing your privacy but thinking about online safety, it's a whole - it's like this whole brave new world that we've entered into. And I think education and education from groups like yours are so unbelievably important.
Lauren Buitta: You know, I think there's not a day that passes that we don't hear from one of our school social workers or school partners about a girl sharing images of herself or having images shared about herself or being bullied online through anonymous social media accounts. And so I would also just add to that point is - again, is doing the work of after the fact because it can and does have these significant not just immediate mental health impacts on them, but long-term impacts because, as you noted, it's one thing to tell girls, this will never go away, but until it happens - which is not unusual. You know, they're adolescents, right? They're going to test boundaries and take risks and that sort of things. But I think it's sort of the what happens after the fact that is most poignant oftentimes.
Ann Johnson: Agreed. And I think that the work you do and hopefully this - even this podcast - right? - will - can reach parents - as well as the girls, reach parents, reach those school social workers, reach people that actually have influence on girls' lives. You and I both grew up as girls, right? So we know how hard it is. I can't imagine - I remember high school as not being a pleasant experience. I can't imagine what the online aspects would've amplified that, had that been the case when I was in high school.
Lauren Buitta: I don't know that I could've persevered from just the experiences that we observe, which again is why I think they're - this generation is adapting in ways that we really can't even imagine. And it's another reason why having the kind of intergenerational sharing or intergenerational learning, I think, becomes even more crucial with respect to cybersecurity.
Ann Johnson: Agreed. I really appreciate you joining us today. We try to set our listeners off with some key takeaways, so I would love to know what your, you know, two to three key takeaways are with regard to what we saw this year and what you're optimistic about in terms of the cybersecurity field.
Lauren Buitta: Yeah. I mean, what I think I take away is - I always try to make the point that I think there are still norms around the role that girls and women play in security that need to be shifted. And I always like to leave people with the reality that girls and women are and have been agents of their security every single day and that they provide unparalleled insights in a world that often fails to secure them. And we need to harness and embolden and advance those insights in cybersecurity and every other pathway.
Lauren Buitta: I think as an organization, what we've seen this year is, as I noted, some exciting movement and emphasis both on cyber as a series of pathways, but also around diverse representation. And I always have to give a shoutout to Camille Stewart and Lauren Z. at #ShareTheMicInCyber. We've seen some really exciting movements that I think are going to coalesce in real impact. And what I've seen is girls and women across the country who have adapted to such extreme conditions and continue their interest in a space that, frankly, isn't doing a whole lot to necessarily proactively value their contributions.
Lauren Buitta: And so for us, most, if not, you know, more than half, of the girls and women in our program come into Girl Security with a directional interest in cybersecurity and tech. They're already on the pathway, which means that we have to do a lot, but we don't have to do as much as we thought to make sure that they stay in the space, you know, at least through their early career and that there's so much more opportunity to do some really cool and innovative things, some of which, you know, we haven't even explored, to really advance the numbers and representation in cybersecurity.
Lauren Buitta: And I'm personally really excited for a world - a future of cybersecurity and related fields, like AI and quantum computing, where girls and women are bringing their experiences to bear on solutions and innovations. I'm really excited for that world not just for myself or the organization, but for my own kids as well.
Ann Johnson: That's fantastic to hear. And I always try - you know, I wake up every day and want to be optimistic about this field, right?
Lauren Buitta: Yeah.
Ann Johnson: And there is a lot to be optimistic about. There's also - we've made progress for women and girls in the field, and we just need to keep going. It's an everyday, intentional and deliberate conversation.
Ann Johnson: Lauren, thank you so much for joining me today.
Lauren Buitta: Thank you so much, Ann. I really appreciate the opportunity.
Ann Johnson: And many thanks to our audience, as always, for listening. Join us next time on "Afternoon Cyber Tea."
Ann Johnson: So I chose Lauren Buitta, who is the CEO of Girl Security, because the work that she has done throughout her career, including the work with Girl Security, is so impactful for the national security and cybersecurity industry. She has such an empathetic and broad view of what the needs of the industry are and all the way from - girls all the way, you know, from the U.S. middle school and high school through college and really getting them interested and invested in cybersecurity careers and their online safety. She's an amazing guest, and I look forward to, you know, this tremendous episode.
