How to Fix the Diversity Gap in Cybersecurity

all right okay how is everyone good morning I'm happy to be here in Rochester I don't know if you guys know this but my father actually is from Rochester so this is a big deal for me to be here and giving this talk because Rochester is another home for me and my family before I begin I'm just curious about my audience a bit raise your hands if you are a student cool I love this okay raise your hand if you are a hacker yourself okay nice this is good to note okay raise your hand if you work for an InfoSec company cool alright this is gonna be fun alright let's just dive in shall we so

my name is Chloe mr. Yee I know the long name is like you're just like how do I present it just miss doggy I have an MS in political research I use data and data analytics and also cognitive science to understand ways of doing diplomacy in a way that's fast tracked however then I switched over to the impact micro fans has on children's education rates in Guatemala I do work out by crowd how many of you guys have heard of bugcrowd I love this okay you guys are good audience I'm also Disco's IO supporter raise your hand if you've heard this goes out you I would give you a high five but I can't cuz I'm attached to this mic but I would

give you one afterwards or a fist bump you decide I'm also a board member for four nonprofits that are for education rates to increase in developing countries I'm also one of the founders of women and security and Technology whist has anyone heard of whist before sweet yeah by the way we're looking for people to start having chapters all around the US and the world we right now have over 60 chapters around the world in the last four months since we started so if you're interested let me know I also spearhead the SF chapter I am a mentor in tech so if you are someone who is looking again to InfoSec or in Infosys and you need someone to mentor you or

get where you need to go let me know I'm more than happy to help you guys out or connect you or someone you can I do speaking on diversity and inclusion also on bug bounty as well because I love bug bounty I'm a hacker at night as well and last but not least I am an activism sense I do believe in safe harbor and I definitely want to promote more ethical hacking in the field and I'm a founder drop labels and this is my Sherlock it's a Shiba Inu wearing a diaper not very happy it looks happy but she's not happy and feel free to follow me and whatnot on Twitter I love game DMS and I love helping

people out and I love to connect with you guys anyway alright let's dive into this so we're gonna dive into a few things first we can go into the background statistics our brains and labeling and we're gonna do an activity yes I'm forcing you guys to do something this is gonna be fun on a Saturday morning we're gonna do some obstacle storytelling where you get to hear some stories and then I'll give you some solutions perhaps so let's just dive into diversity statistics since 2013 and has remained unchanged 11% of women are in InfoSec and that's because there is a continuous rotating door of coming in and out minorities less than 12 percent in fo sec and that's been going for

quite some time now there is about a 1.5 million shortage right now in InfoSec so you guys they're always hiring you'll always have job stability underrepresented persons are more likely to be let go and fired also I should throw in there that is not on this slide but women and underrepresented other folks actually do about 2.6 times more work on paid hours than white males do underrepresented persons are less likely to also be promoted beyond a manager title that's right some of us are stuck in the manager role forever so clearly we have a diversity and inclusion problem here more companies are realizing that the only way to get great people is to invest in the workforce diversity and

social responsibility companies seeking to become more inclusive in their hiring should examine and question their own assumptions and unintentional biases in their hiring process so let's start examining and question our biases we're gonna just dive into our brains so it's broken into three parts so the first is fear we have this unconscious social constructed survival mechanism called the amygdala then make delay when it sees someone that they do not know or does not feel like they recognize the person doesn't look like me or something like that we are gonna automatically go into freak mode and by freak I mean flight versus fight but we're just going to go to the freak mode I like to go to

and what happens is that these are laws social constructed ideas of each other like in the news or from your peers or your family about other people but the good news it gets verified in the prefrontal cortex and the prefrontal cortex it acts like you're CEO it's basically like you need a chill or in my turn around and be like you know what you should totally freak out right now I'm freaking out right now in every single possible way so basically stereotypes and beliefs are questioned at this point and then it redirects to the amygdala saying whether to act on it that's a flight-or-fight way so just note you can always push in your biases and it's okay to be

uncomfortable because it's one we're uncomfortable that we start recognizing a thought pattern and we start questioning these things so the more we get outside our comfort bubble we learn more about the wonderful world that we live in because it does impact others when we don't work on ourselves and hopefully this video works or not oh there we go except the sound you can hear it yeah any better that was not a promo you guys I swear anyway where it was anyone able to hear that good wonderful if you want to see it again afterwards lovely now I'll show you all right so we're gonna do an activity I know I saw people taking and breast like now I don't have caffeine

for this yet so we're gonna get to know each other what I want you to do is look to your left and then to your right and say goodbye to the person you're saying next to all right next step now what you're gonna do is you're gonna go sit next to someone you've never talked to ever before you've never seen this person perhaps or maybe you have but you've always wanted to talk to them

all right now make sure you sit next to that person there's a fire hazard happening here are you guys all right if you can hear me clap your hands once if you can hear me clap your hands twice if you can hear me clap your hands three times welcome to kindergarten no okay so next thing everyone has a partner right this is super important everyone's got a partner you don't have a partner I can see everyone come on all right great everyone has one partner correct okay oh there's someone okay if there's no set of three you've got to be two people do you have a chair you're gonna need a chair okay good I couldn't

see on that angle because you're gonna hate me even more okay next thing I want you to rock paper scissor to the person

okay everyone got it it wasn't at a three it was only one time okay all right those that one you are a the ones that lost don't worry your be all right you're ready for the next part all right this is what we're and get even get to know our stranger friend next to us so what's gonna happen is is raise your hands all right ace you're gonna talk for five minutes please raise your hands excellent B's you're gonna listen you cannot talk back you cannot answer anything you cannot say a single word you can nod not not to keep yourself awake okay I just want to put it out there but you're gonna nod if you want

so what's gonna end up happening is this person is gonna talk for five minutes all right for five minutes they're gonna talk about anything all right ace you could talk about anything you could talk about like your personal life your work don't worry you're gonna dive into personal stuff no matter what and then B's you're gonna listen but you're gonna catch yourself in the act and what I mean by that is that when you're like oh yeah how do I respond to this oh yeah me too I want you to actually catch yourself if you're in that moment of judging because then you're not listening this is important and also it's a way for you to

realize how much thinking goes on in here so I'm gonna set the timer for five minutes so everyone ready wait wait I didn't say go come on all right I gotta work I gotta do this first okay and on ready get set aids enjoy telling your story B's enjoy telling your brain just shut up all right ready set and go

you can't take pictures of the audience

[Music]

[Music]

all right if you can hear me clap your hands once if you can hear me clap your hands twice if you can hear me clap your hands three times you're probably now know what's gonna be the next step here your guys are gonna switch roles yeah yeah okay but the one thing you should note is that you cannot respond to anything that they said you have to come with your own original content don't be copying people okay no one likes a copycat unless you do it in style but you're not doing that here so take a deep breath in take a deep breath out bees are you ready ace are you ready to listen excellent and wait for it wait for it

and begin

[Applause]

[Music]

[Music]

[Music]

[Music]

[Music]

[Applause]

[Music]

[Applause]

all right clap your hands once if you can hear me clap your hands twice if you can hear me stop your hands three times you can hear me clearly I come from an education background here alright so I'm just gonna open the floor I'm curious to know how do you guys feel about that and yes you have to raise your hand okay yes

yeah yeah I imagine doing this for 10 minutes yes love it what else yes back there I like this you know yourself so well you keep it you keep it going yes yeah yeah it's a little bit different cuz I don't know if anyone felt like wow I'm I think for the speaker it's a little bit harder because for them they're like are they actually still listening to me or have they tuned out and then for the listeners like oh my god I really want to react we have something in common I feel like I think we're like lost souls and and we're like alike each other like really I got to get this person's phone number what else

yes in the back

don't ever tell that to your mom or dad yeah what else yes yeah exactly I feel like we can all agree that we have been trained on like how to be with each other like to always be like I got pay attention to and listening or I just repeat what they say and agree and that's that's the thing is that this is a very different way of actually listening and talking how many of you guys raise our hands deep dived into your personal life oh yeah oh yeah now you're like you might leave this session feeling like I should have not told this stranger in any of it I the next thing I know I get a Dan for you guys saying

like really you made me share all this confidential information you're such a social engineer but honestly this is one of those moments where it brings us closer together as a community and InfoSec and more and more today we need that now what else anyone else don't be afraid yes right oh that's wonderful I love those stories and you know what did you guys all realize you got outside you're comfortable yeah and but you learned something because you would have never sat down next to this person or ever talked to them right unless you were forced by me early in the morning all right what else let's go all the way in the back first yes you

and the no just think of a training wheels right like someone just came by and like you were learning how to ride a bike but this was your first time on a bike and someone stole your training wheels that's literally what just happened for introverts and also for extroverts because you had to be quiet what else yes you yeah rules don't we all like to break them sometimes how many you guys actually broke the rules right now I like your honesty you guys because I know everyone in this room probably did at some point what else yes

love it anyone else yes

yeah yeah sometimes people they in this activity they not and they catch himself nodding but they also are trying to figure out how do I convey that I agree so then you start thinking well if I smile that means I agree if I live directly in your eyes that lets you know I am not sleeping anyone else yes yeah we're so driven and that's completely natural because we are kind of egoistic a bit sometimes we like to think of like how do I connect with saw the person also and that's the thing is that if you realize in this whole activity is that we are actually a lot more similar than you think and that's

the important part is breaking those barriers making us understand question our prejudices and make it us really dig deeper about what am i doing that's creating these walls between this stranger and myself and that's the important thing any last things before I start cool all right well let's go into some stories you heard some stories for about five minutes from the other person not being able to respond back so let's just dive into some so these are all stories that I have collected I have a lot more than these of course but these are the ones I like to pull out as much as possible so Rebecca all the names have been changed by the way you'll

never find these people Rebecca is a see so but she's not allowed on the board and the reason for that was that the other oh by the way I should mention she is a female and the other thing is that the board is all men white males of course and basically they Turner and said I'm so sorry you can't be on this board because you're not technical enough I don't know if you've heard this quite often it's just it's a phrase that women hear all the time and InfoSec and to be honest she actually has an engineering degree like she has a PhD in computer science and none of these people on the board have any security background not

even an engineering degree not even a computer science degree but she was still refused a seat andrew is an african-american male and they this is another common thing is that InfoSec company sometimes don't allow MLK Day Off and the issue with that is that that's not being inclusive so he had to work he was the only African American in the company and he had to work on that day and he felt and he knew right away at that moment he does not feel part of the company and they're not recognizing who he is the other thing is that they also decided you know what you guys will be a great idea we should throw a hip-hop party you know

cornrows and listening to rap music saggy pants and all that stuff and imagine someone being in that room and being like oh my god what is this that is why it's 12% still um Krystal is a security manager she has worked for a very well-known company I'll give you a hint I didn't say this out loud um and she has been a security manager for 20 years you guys 20 years that means she hasn't got director she's not an executive and she's incredible woman in the field Cleo a marketing manager so one day they're all decided you know what let's change the website around but we need to have some good graphics so they're like well

why don't we just do that and let's throw a woman in there now I'm gonna be standing in the way that this photo of this woman looked like this it's not what an executive woman stands like when she walks in the room she's gonna own that room the first thing you learn at McKinsey is if you're a woman you go into that boardroom you go large that means if you need take up to three seats you do that when you walk in the room you do this it's like animals like you just have to be bigger so then people will see you as an equal it's just not bad you know it's kind of fun when you walk in like all right you

guys let's go into this and now my story and the first time I went out in public about this story was actually during our essay and besides SF was anyone at RSA or besides SF oh we should connect we should so at besides SF I finally shared my story of how I almost left the field so what happened was that about a year ago for International Women's Day I decided I'm gonna call up a bunch of different women in InfoSec and hear their stories and I'm gonna write a blog about the shortage of women in InfoSec and why it's like that and they told me all their stories and I was really touched and it went through one ear and

just stayed in my brain but I never actually thought about it for a while and tell me what you are I say I go in this room and there's 300 people in there and yes you know they're all white males majority but the thing you should note is that there was only two other women in that room besides myself and the first thing I went through mine is like please say not an executive assistant please say no and they're both were executive assistants and I remember just like walking out that door then going down to the restroom down the hall and there's this line wrapped around for the male's restroom and then the female restroom no one was in line ladies

that's right you'll always have the opportunity to use the loo without a line which is fantastic and so I walk in there there's no one in there and I'm like huh this is very strange and then I was like walking to the hotel and I get in the hotel room and I remember for some reason something just hit me like a tidal wave and I just broke down crying I mean not like cute crying you know like fall out like in a ball like mascara running and all of a think it was like oh my god why was there no women in this bathroom but also the fact that there's a serious problem there's no women in this room I

don't feel comfortable and then certainly all the things that these other women were sharing with their stories silly it hit me even harder because I suddenly realized a blindfold was lifted and everything that they were sharing with me I actually was experiencing it and I never knew it just was there inside and silly this raw emotion comes out so during this time I was really contemplating about leaving InfoSec I was like you know what I don't feel like I belong here no and I I can't I can't keep fighting this fight and so then I decided you know what I'll give myself two months and then I went to day of security conference how many of you guys have

heard a of security okay so it's a conference just for women happens in San Francisco and they just hide one in Boston and I walked in this conference and there's no men men are not allowed to attend you're a lot to volunteer but it's for women to feel included for once I walk in this room and I kid you know there's 200 women right in there there was a line for the restroom there was no line for the male's restroom and it just really I was like oh my god I belong here and it was the first time I didn't feel alone and that was this situation I felt very much alone and I was like you know what I'm gonna stay

here I'm gonna give myself an extra three months but I'm gonna fight for it so then what I did was that I rolled up my sleeves and I started contacting those women again and then I also contacted other men in the field yes because men are allies too they do a lot of great things for the women community and so then I connected with them and I was like you guys I had a talk that was accepted in Las Vegas I really want to go and they're like don't worry I got you covered next thing I know I checked my email and I have passes to black hat besides Las Vegas go volting and then I

got into you know queer con I got into hacking diversity Dianna and I went to six conferences within seven days and I had everything you paid for an expense and whatnot because if people believed in me and this was men and women okay that's I really want to push that out there and they believed in me and I gave a talk and next thing you know I started booking more talks and then I social engineered to get into every single bugcrowd party so then I could actually go and meet the team because I was curious about working for them I really like by batiste and vulnerability disclosure so I walked in and this one party it was the queer calm

party there was a giant pool and there I did I met some of my future colleagues but most importantly I had a talk with Casey the founder at 1:30 in the morning in Las Vegas after doing the three to one rule if anyone knows just you know three hours of sleep two meals a day and one shower a day for about five six days and him and I were just standing by the pool and we were just talking about diversity next thing I know that I was getting there like we like you would come in we're interested in you coming to work for us and I was like yes and ever since then I now get to work at but

crowd and I love the people there they include me and they're always open to inclusion and diversity measures and I wouldn't be here today if it wasn't for them and the people in my network and that is also why created wist with some other colleagues of mine because we know the importance of not feeling alone I want to reiterate that because that's the issue we are facing right now in InfoSec we feel alone so that is my story so what can we learn about stories they change our perspectives our beliefs it can remove blindfolds can bring awareness and they can make us really uncomfortable but that's when we're learning so how do we apply stories and

cognitive science to solve this gap well one is volunteering start early to promote InfoSec that means getting out in the community go to a high school or go to middle school and just try to get out there and see if you could mentor them get involved in outreach and mentoring because hashtag it takes a crowd because you can always find okay there's another video so this is gonna be funny guys because there's a lot of great things you can do when you recruit people all right can anyone hear that okay they know which mic it was again yep that's okay so I will show this actually tell my Instagram so if you're on my Instagram

it's exact same with my Twitter you can find it or I'll just show you guys come up here later basically it's this guy who I talked to he was a real rebellious kid in high school and everyone kind of gave up on him but because of his rebellious streak I was like have you ever thought about being a hacker because that's what we do and he's like yeah I'm kind of curious and then I started mentoring him connecting with this really awesome hacker and now trains him which is absolutely fantastic so you never know get out there start spreading the word early because a lot of people especially those that feel like they're outsiders are really great

for the community because we're all Outsiders in this one community all right networking forum support groups in and out of the office that's right and the other thing is when you do want to speak up on something of inclusion make sure you never do this solo I want to reiterate that because I know too many people who are underrepresented that went up to their boss and next thing they know they got fired within a week or two because they brought it up go in groups form a collective organization also there's great supports called a whist for women if you're out there but yeah and if you have slack in your office create a little channel like that

by card we have this one called hashtag ladybugs it's really cute and we all just support each other attend conferences like this and TED conferences that you see on the speaking list hey there's all different types of people giving talks this is fantastic also push for a diversity of people because when you have a CFP board they're more likely to accept more of these type of talks but before I say that also there's a lot of confidence than you should attend you should definitely go to Vegas I kid you not I hate Vegas with a passion but DEFCON blackhat queer con all them are fantastic if you want to be a volt for b-sides Las Vegas let me know if you

ballin tear for more than 18 hours you get a free place during your stay which is fantastic so you're able to go but I just want to reiterate that the most important thing really starts between you and me so keep listening to stories inter SPECT yourself and keep an open heart because it's important that we never feel alone so I'm just going to start with this any questions I may have answers this is not Sherlock this is the imposter any questions yes right yeah so there's various different organizations usually nonprofits that do it oh yeah so the question was where do they pull the data from correct how do they find these statistics of underrepresented

persons in security there's a collection of different organizations and agencies I'm more than happy Tuesday on me on Twitter and I'll send you those articles and those research papers 30% that's interesting I wonder if that's including the turnaround rate - I'll look into it for you but just do do DME and I'll look into it for you yes I want you to just check in with yourself make sure that you listen to these conversations and take the stories that are shared today to the rest of the office and when you feel like someone Oh great example if you're in a meeting room and there's someone who's under represented in that room and it's the only person make sure that they have the

time and the comfortable feeling to speak up - in that meeting I think that's really important because what happens is that sometimes people talk over each other and they're not seeing that this other person might have something to say it's a lot harder for them to speak up usually - if they don't feel empowered so they're disempowered they're going to be quiet and that's not and that's when you're gonna have people leaving most likely yes yeah I think one of the best ways you could possibly do is get get make sure that that board itself has invited other folks from other organizations that represent underrepresented persons to at least sit in to make sure all

those measures are being taken care of that'd be my fastest response for I know there was one more question in the back yes

exactly right and that's why that activity is so important so what you could do is take it back to your office and be like hey you guys want to play a little activity today at lunch we're gonna be quiet for five minutes and you're gonna listen to me talk next thing you know they'll be like oh my god what did I get into any other questions before I wrap this up

and that's very much true there's been times for like in my personal life not a buck route but also for other people that I know that what happens is that they actually say something and they turn it down right away and what they do is they get a male colleague to actually put it in there to be like hey we should be doing this and they're like oh that's a fantastic idea great risk job I love that promotion and that is a very common occurrence unfortunately yeah right yeah I know Matt some company is what they do is they make sure that there's always a male colleague in the room with the underrepresented person to reiterate

their points so then they're like okay I trust you that seems to be one of the things that they've been doing that seems to be are pretty helpful but there's definitely some other ways how to go about it I know I have to wrap this up right I got one more question yes I will be honest what you just did they will listen then and the reason for that is like we're always like very buff oh so the question is how do I get someone to listen to me as someone who's underrepresented I'm sooo mean how do I have them actually respect that I actually know what I'm talking about and honestly it's going in their room and

like really just being straightforward like for me it's also this this fear factor right that you always feel like well do I know what I'm talking about oh yeah wait hold on yeah I totally do know what I'm talking about and I think that's one of the issues right there the other issue is that how do you get people to see not this and more like what's coming out of your mouth and to be honest is taking up more space more room and then also if you're getting frustrated say that just like no you are not listening let me give you the facts here that's when you get their attention it's just to be very calm about it but

also being very direct and I think honestly that is the one thing I've learned is don't be that person who's quiet and just gives up be direct if they were problem with you they'd have a problem with you that means that that company is not good for you and there will be other companies and if you ever need to find another company let me know I know plenty that are always hiring overall I just wanted to say thank you guys for being here thank you for existing and feel free to reach out to me I have plenty of stickers Grace Hopper stickers she's fantastic and also if you are interested in learning about vulnerability disclosure

bug bounty Disco's IO or anything about diversity and inclusion I'm around just swing by say hello I'll be walking around and most importantly I also have another surprise for you if you whoever is the first person to DM e to let me know what is my favorite book you will get a special gift in the mail so have fun you guys and thank you so much once again [Applause]