Women in Cybersecurity 2017: A CyberWire Special Edition

Dave Bittner: [00:00:05] The 2017 Women in Cybersecurity Conference was held in Tucson, Ariz., and the CyberWire was on hand to cover the event. I had the opportunity to speak with a variety of cybersecurity professionals at different stages of their careers. We covered some of their career journeys and professional insights on our daily podcast. And in this Special Edition, we learn why a Women in Cybersecurity Conference is more important than ever, what they wish they knew when they were starting out, as well as some advice for the men in the industry. Stay with us.

Dave Bittner: [00:00:40] Time to take a moment to thank our sponsor Cylance. Are you looking for something beyond legacy security approaches? Of course you are, so you're probably interested in something that protects you at machine speed and that recognizes malware for what it is, no matter how the bad guys have tweaked the binaries or cloaked their malice in the appearance of innocence. Cylance knows malware by its DNA. Their solution scales easily, and it protects your network with minimal updates, less burden on your system resources and limited impact on your network and your users. Find out how Cylance is revolutionizing security with artificial intelligence and machine learning. It may be artificial intelligence, but it's real protection. Visit cylance.com to learn more about the next generation of anti-malware. Cylance - artificial intelligence, real threat prevention. And we thank Cylance for sponsoring our show.

Michelle Dennedy: [00:01:41] This is my first time at the WiCyS event, and I'm loving the energy from these young women in particular.

Dave Bittner: [00:01:49] That's Michelle Dennedy. She's chief privacy officer at Cisco. She was a keynote speaker at the event.

Michelle Dennedy: [00:01:54] They are so positive in their own ability to make change, of their flexibility to say, should I start here assuming that I'm going to go there and there and there? It's a very hostile work environment still and not always overt, and, in fact, I think the most pernicious problems are not overt. Like, you know that if somebody acts like a jerk, you know, maybe they won't do something right away. And we've seen that in some of our more popular things going on in the valley right now. But it's the things that people don't intend. It is the - I'm more comfortable talking with men and so I'm only going to go out to dinner with men. I'm not going to have dinner alone with a woman because, you know, there's some sort of implication that that's a sex thing, which is ridiculous. And then the only person who gets one-on-one time with those leaders has to be gender, you know, whatever matches. And I think that that hurts the men and it hurts the women. Those things exist whether they're overt or if they're in the back of our heads.

Michelle Dennedy: [00:03:00] And so I think that's just something to be incredibly mindful of and be very aware of our own biases, and make a point of - all of us, particularly us who are in the privileged position of leadership, to force yourself to go to that uncomfortable, awkward thing with someone that doesn't have a lot in common with you and say, you know, I'm still your leader, too. How do I help you? How do I help you succeed? What do you need? What are your dreams and aspirations? And it's fascinating because all the stereotypes are there for a reason. Like, you'll get the guy who's like, I'm ready to be CEO, and by gosh, he's been out of college for two years. You'll get the woman who's been doing a job for 20 years and she's like, do you think I need another graduate degree? And you're like, no. You should have my job. So I think, you know, it's not always easy, but it's very rewarding.

Dave Bittner: [00:03:51] Amanda Rousseau is a malware researcher at Endgame.

Amanda Rousseau: [00:03:55] So here, you know, I can give a workshop and break it all down to basic things, make things purple and pink so they're more interesting and try to get their hands dirty and see that it's not scary. It's not hard. You just need to slowly, you know, grasp at the idea.

Wendi Whitmore: [00:04:16] I think this event's awesome, quite frankly. So, you know, I mentioned to you on our walk over here that I don't get a chance to go to too many events like this. We're usually in business meetings, talking to executives, educating them on problems and solutions.

Dave Bittner: [00:04:29] That's Wendi Whitmore. She's a global partner and lead at IBM's X-Force Incident Response and Intelligence Services.

Wendi Whitmore: [00:04:35] And to get to kind of speak to college students - young women who are embarking on their careers - is really exciting for me personally because you can sense kind of the energy that they have, the excitement, the motivation. And just thinking about - these are things that - not only did they not exist - like, this group, for example, I believe was created three or four years ago. It certainly didn't exist when I was in college, but it didn't even exist five years ago. So seeing the growth and the conference continue to grow in numbers year over year is really exciting because more young women are going to hear about it, hopefully get involved and, you know, corporations will continue to sponsor and, even more so, help grow the event, which is pretty neat.

Dave Bittner: [00:05:17] Something that came up over and over in my conversations with women at the conference was the importance of good communications. So often, it's just not there, and that can be a big barrier. So I asked, what do you wish the men in cybersecurity knew about the women in cybersecurity? Svetla Walsh and Deja Baker are midshipmen at the U.S. Naval Academy. We hear from Svetla first.

Svetla Walsh: [00:05:39] Give us a chance. Like, I know everyone's going to come in a room with maybe some assumptions but, you know, you don't know what you don't know, and I think you should go in with an open mind. Like, an open mind is, like, the big thing. It's like, I love solving problems, and that's the thing that I love about programming is that we don't care who's working to solve the problem. The word collaboration means anybody that can help give their input to help solve the problem. When we're looking at a problem of some - in a program, looking for the bug, the whole idea is, like, I want to be able to contribute and I want you to know that I want to help solve the problem, too.

Deja Baker: [00:06:11] Yeah. And I think that relates to, like - just to realize that diversity is important because we all have different experiences, and these experiences allow us to problem solve in different ways that will help solve the problems that we face in the world today. And I think just to be open-minded, like Svetla said - to be open-minded to realize that people - that we're not just - we're just not a part of a big group. Just don't label someone as just being a woman. Maybe I have - I'm a person, and I have my own skill sets, and I want you to see me for the abilities that I have.

Svetla Walsh: [00:06:40] That she can create algorithms, that she's efficient at programming, that I am well communicating the problem, that if somebody isn't as technical but they're the one pushing the policy, that I know how to speak to them in a way that they would understand. And just looking at the skills - and I've always been taught - my dad has always told me to look at the strengths of somebody. You know, we talk about, like, when you're working with a team, you know, it's easy to pick out the weaknesses or who's the weak link. But he said, no. Look at the strengths of the person. And then you find out their strengths, and then you take those strengths and put them together. And the thing is cybersecurity is all about solving problems, solving malware exploits. And, like, we need to be open-minded and be ready to solve these problems, and that's just - coming in with a, hey, who can help contribute to the problem-solving? And then going from there.

Amanda Rousseau: [00:07:24] You know, we are on par with everyone else, so it's just one of those things where you can't take someone for granted.

Dave Bittner: [00:07:31] That's Amanda Rousseau from Endgame.

Amanda Rousseau: [00:07:33] And that's the kind of belief that I have. Even though I know some people are not socially able to communicate their ideas properly doesn't mean I'm going to, you know, judge them right away, right? I have to assume this person is my equal, and they have to tell me what they bring to the table. And it's not about, you know, me having to change myself socially. It's me having to gain trust and respect based on the evidence and data I provide to support my arguments or claims or any type of research. I mean, it's the same with everyone else. If you're a guy between a guy, you're going to support your claims based on evidence. It's the same with a female. Sometimes, we might try a little bit harder to get past our gender bias.

Michelle Dennedy: [00:08:22] I think that if you think that this is a women problem, you're part of the problem.

Dave Bittner: [00:08:28] That's Michelle Dennedy from Cisco.

Michelle Dennedy: [00:08:31] If you think that women are trying to threaten your job, they're not. Life is threatening your job. Innovation is threatening your job. Globalization, polarization, socialism, nationalism - those things - all of these great forces are threatening your job. It's not because someone is gendered. I think that if every single person - and we have a program at Cisco right now called Multiply Diversity, and it just came out of, like, a cocktail conversation that people had at Mobile World Congress, which I think is excellent. That's how things are supposed to happen. And they said, what if every single person, men and women, picked one diverse candidate from whatever diversity you feel most passionate about - race, ethnicity, economic circumstances, geography, gender - and if every single one of us picked one person not to mentor but to sponsor, to push that person to take those next risks or pull them up when you see them lagging - if every single person did that, it would only take half a generation to get to the place where we have enough competent people working in a respectful environment where all we're doing is innovating and creating and sort of bringing our best selves to work.

Dave Bittner: [00:09:51] Kathleen Smith is chief marketing officer for cybersecjobs.com and clearedjobs.net.

Kathleen Smith: [00:09:57] I've been very fortunate that I'd say 95% of the men that I've met in cybersecurity have really been very supportive and respectful. Just like there are women who are not that very great, there is a small percentage of men who still, you know, don't see the need to treat women with respect. There is a big movement on that. I really appreciate the family and community feel that I feel at any of the Bsides events that I've gone to and that I've been part of. I think that reinforces in my mind that it's not that bad. There are a lot of bad apples, and I think that there are enough of us women who know who the bad apples are that we just warn other women, you know, stay away from them. But there are so many phenomenal men in the cybersecurity community. What's interesting is that so many of them are very supportive on Twitter, and I really do appreciate @SushiDude and a variety of others who have been raising the importance of making sure that women are treated with respect and that they do take center stage when they have something to say that's of value to the community.

Wendi Whitmore: [00:11:12] There are certainly things along the way being a woman that, you know, you're going to get lewd comments made or inappropriate remarks, but I don't feel like I've ever been discriminated against because I'm a woman. And I feel like I've had a lot of fantastic mentors, and most of them have been men.

Dave Bittner: [00:11:26] Wendi Whitmore from IBM.

Wendi Whitmore: [00:11:27] I've been in some leadership groups where they send, you know, executives at my level and bring us in from all over the world to go through leadership training. And as part of that, I've kind of shared my upbringing and how I got to where I'm at. And every time I've done that, I've had so many men that have come up to me who I wouldn't have necessarily thought, you know, that's the audience I'm kind of speaking to, but have said, hey, you know what? Now that you told me the impact that your dad had on you growing up - I've been coaching my son's baseball team, but you know what? I'm going to get more involved in my daughter's sports team as well because I see the impact that it had and the positive influence that I can be on her. And I think that's one of the things that's really resonated with me that I've felt really surprised by and very positively encouraged by, and that's probably one of the things that I would encourage more men to realize. You know, just how much of an impact - it's not just about necessarily the women that are in the workforce with you now, but what impact can we have on future generations?

Andrea Little: [00:12:26] Too often, the women in cybersecurity issue becomes something that is - a problem for women to solve. It's also a problem for men to solve.

Dave Bittner: [00:12:33] That's Andrea Little Limbago. She's chief social scientist at Endgame.

Andrea Little: [00:12:37] Especially in this field, most of the executives are men. So in addition to being supportive vocally - you know, that's just basically - it's almost the lowest bar that I have is sort of vocal support in that area. We need men at all levels to be more - to be allies. And that's sort of a hokey phrase - it's male allies. We need many, many more of the men to be male allies, which doesn't mean just saying, OK, we support it. We support diversity. We support women - and kind of stopping there. You need actually do more than that. So it's not just on the women to actually help increase the diversity and the representation. And being an ally can be anything from - you know, on social media, like, you know, retweeting something that someone else does as far as helping show their expertise in that area, so being a sponsor of them. When you're in meetings - you know, all the data shows that, you know, when women have an idea, it usually tends be taken over by someone else, and they get the credit for it. Instead of that, if you see that happening, step in and say, well, you know, that idea that, you know, Lindsay said, she's the one who actually - you know, and be vocal in that area in helping sponsor and promote the women.

Andrea Little: [00:13:36] And that doesn't mean - you know, we're not lowering the bar. We're not expecting to be treated differently. But just help - be a much more explicit sponsor in that area. And it really - it's amazing. Just the little aspects like that can really go a long way to help elevate and amplify the voice of the women. And that's really what we need because, again, we're only 10% of the workforce. We can't do it alone. We need that 90% to also help advocate, and I think that's, in many places, where we've been lacking so far. There are a lot of male allies, a lot of great male advocates. We need more.

Dave Bittner: [00:14:11] What's in it for them?

Andrea Little: [00:14:12] That's a great question. For companies or groups that actually want to innovate more and get more creative, you need different perspectives coming in, and so that for sure is something that comes along with it. When you get - when your entire team is trying to come up with some new solution and you all have the exact same background, y'all do the exact same things and all look the same, you're probably going to come up with the same idea. So you need diversity across - and I always talk about - it's across the board. It's different disciplines. It's different ethnic groups or religious groups, gender - it's all those kinds of diversity that's important. And so for one thing - so they'll come up with better solutions, and so if you actually care about the work you're doing - which I think a lot of us - most of us in cybersecurity do because it is so important - you're going to find more creative and more innovative solutions.

Andrea Little: [00:14:58] For the corporate level, why you should care - it's ROI. Companies that have better - that have more diverse representation on the boards, on teams, have managers across the board, tend to do it better. And so companies will do better. Teams will be more innovative. And I'll say, if you look at the cybersecurity challenge, we're - the attacks are going on daily. We see this going on. Clearly, we're not doing our job yet as far as helping provide better defenses in that area. So let's bring in the entire population and help solve that problem, and maybe we can really leapfrog into some much more innovative solutions.

Deja Baker: [00:15:34] I think I would tell my younger self to believe in yourself more. Like, listen - I'm going to use this conference as an example. So Svetla went to the Grace Hopper Conference. I didn't even apply to that because I was like, I'll have to write an essay. They're going to look at my credentials and everything. I might not get accepted. And then I had a talk with a professor. My professor was like, Baker, why didn't you apply for this? Why didn't you do this? And I was like, well, you know, I might not get it. He's like, well, the worst thing they could tell you is no. And I wish I could tell my younger self that because I feel like I missed out on opportunities I could have had if I - just because I didn't apply to things. I didn't apply. Like, now, I apply to everything. I'm like, OK, opportunity opens up, I'm going to try for it because worst thing they'll tell me is no.

Svetla Walsh: [00:16:20] I would say - tell my younger self that you're doing just fine. I was very insecure, and I still - like, the decisions I make going forward, I still kind of get scared, but it didn't really help when people would think that - when there's not a lot of support from your peers that say that, wow, you seem really ambitious that you want to go to college, and you seem really ambitious that you want to go pursue technology. And, like, I felt like I was always questioned - why, why, why? Why are you doing this? And if I spoke up, it was perceived as being annoying or talking too much. But I really wanted people to understand that I really have these goals and dreams that I want to accomplish and just to tell myself, keep doing what you're doing because the thing is, you're going to - you will get them because I'm keeping myself out there. And people see that, and they want to give you opportunities. And that's the thing. It's like, I was doing just fine - and not to be as insecure as I was growing up because I was really insecure.

Michelle Dennedy: [00:17:12] Don't worry about what other people think. Just keep doing what you're doing because all what matters is what you do and more so than, you know, what you're saying at that point in time. Your actions speak a lot louder than what you're wearing or what you say that may hurt you in the end.

Andrea Little: [00:17:32] You know, part of the reason why I come to this conference is I talk to a lot of the younger women here and help encourage them because we do need women to keep pursuing this field and to want to stay in it because the mission is essential. Getting back to the geopolitical aspect of it, this is one the most challenging fields of our time and impactful. So the thing that - probably, you know, own your experience and own your expertise. I think that women especially, even if they've gone through, you know, however many years of education, they will still portray it like other people may know more in the room. And so own your expertise. Be more vocal about some of those aspects of it. Do all the things - you know, sit at the table, some of the basic things that we hear - but also, you know, reach out and network more, and don't be afraid to do that. That's especially hard for introverts, which a lot of us in this field are. It's not natural for us to just naturally, you know, go up and talk, but networking is almost underrated.

Andrea Little: [00:18:25] Like, everyone talks about networking and the importance of that, and I feel like they think about it that way more from, like, a sales or something like that. But networking is really important for just building a community so that when you do struggle or when you do hit some roadblocks, you've got that community to actually help build you up and help keep you within the field. And so for me now, over the last year, one of the things I've been focusing on is expanding out and building up my network of both men and women that I know who work in various domains - industry, academics, government - so that when any of us do actually start - you know, hit one of the challenges that we're all going to hit - and, you know, we heard that the keynote - you have a community there to support you. And so that's really, really important. But we need to be more vocal, and that's - I wish I started going out speaking and writing a lot sooner.

Wendi Whitmore: [00:19:12] One of the things that I did when I was younger - and I think a lot of people do - is kind of underestimate themselves. You know, you might sit in a room in college, and you don't quite understand what the professor's communicating, but you don't really want to ask the question because you're kind of looking around and you're like, well, everyone else must get it. They're not asking these questions, right? And I would do that in my early days in my career, too, where I felt like, oh, man. Everyone around me - you know, they know what's going on. I'm the only one who doesn't quite understand this, so I'm not going to ask a question. I'm not going to, you know, give my perspective on this because maybe it's not right. And as I have gotten older, I've realized how important it is to share your voice.

Wendi Whitmore: [00:19:55] It's certainly important to not speak up when you know that you don't know what's going on, right? But as you get older, I think your perspective can change and realize that, wow, my voice is actually important. I do have something to add to this. And I've stopped underestimating myself so much, and I think that's important, especially for young women, to really understand and realize that - you know, hey, you should have a voice at the table. You know, as long as you're working hard and doing great work, make sure that you're not hampering your own abilities and your own potential by underestimating yourself.

Kathleen Smith: [00:20:25] I was very involved with the hard sciences, and I had a lightning bolt go off, and I did complement that with social science - so law and society and biochemistry. But like many stories you hear, I would have a voice in the room, and people would not listen to my voice. And people would - and then I would then distrust my voice, that I was not saying the right thing even though I knew I was saying the right thing. And I have learned that I have a good voice. I have a strong voice and I have something to add. I have value to add to a conversation - not that I'm cocky, but that I can really change the conversation. And I think that that is something I wish I had maintained throughout most of my younger career. There were too many times when people told me that I couldn't say anything, to shut up, to - I didn't know what I was thinking. I obviously wasn't smart. And having the conviction and the confidence that my voice did have value and to keep talking - and that was both in personal relationships and professional.

Michelle Dennedy: [00:21:35] I think if you knew everything that you learned over the course of a lifetime, you'd be kind of shocked at your own audacity. I never dared to dream as big as I've lived so far. It's been kind of a trip. I think I would just say - you know, first of all, I'd be like, OK, sunscreen, honey. That is a thing (laughter), you know? And you should probably jog more. And that guy in '96, you probably shouldn't have gone out with him. But other than that, I think I would say the same thing of, like, just stay curious. Keep your eyes open. My grandmother died when she was 96, and my grandfather preceded her four days earlier. We went to the funeral. My older daughter was maybe 10 at the time. I'll never forget it because Grandma just kind of, like - you could tell in her mind she'd already decided to, like, go with him. And she reached out and she just put her hands on my daughter's face and she said, I've lived almost 100 years. I've seen so many wondrous things. Just keep your eyes open. And I think if I could have that advice, that's all I would do - is just continue to have that wonder and continue to keep my eyes open.

Dave Bittner: [00:23:05] My thanks to Svetla Walsh and Deja Baker, Amanda Rousseau, Wendy Whitmore, Kathleen Smith, Andrea Little Limbago and Michelle Dennedy for taking the time to speak with us and to everyone who organized and attended the Women in Cybersecurity Conference for being so welcoming.

Dave Bittner: [00:23:21] The CyberWire podcast is produced by Pratt Street Media. Our editor is John Petrik, social media editor is Jennifer Eiben, technical editor is Chris Russell, executive editor is Peter Kilpe, and I'm Dave Bittner. Thanks for listening.