Breaking & Entering: A Look At How Women Get Into Cybersecurity

hello everyone I'm so wonderful introduction I'm Sammy and I'm here today to talk to you about how women and other people can enter the field of security so this talk is applicable to more than just women and a lot of what I'm gonna go over is kind of some of its common-sense stuff but like as soon as somebody lays it out for you you're like how did I not think about that before how is this something that I didn't look for or didn't try to to get into before so what I'm gonna present to you today is not all-inclusive so I want to encourage you to come and talk to me afterwards if you'd know about other

resources that I can add to this I would love to have it I go over on the next slide a little bit about what I currently do and how that will you know not only help me help others but it can help me help you so first I wanted to start with a little bit about me so that you can kind of understand how I came here to talk to you today so I was born and raised in a little town in the United States called Bethlehem and we're famous for only a few things and they're not stellar so one of them is Easter peeps if you've never heard of them definitely look up keep jousting they're

tiny marshmallows and they're just stupid delicious we're also famous for the Billy Joel song Allen town which is actually written about Bethlehem it's just Bethlehem rhymes with absolutely nothing and last but certainly not least Dwayne the rock Johnson so my grandfather was actually his principal in high school and so he's got a few regrets surrounding not keeping detention slips from him but you know I'm happy to talk to you about that afterwards so what makes me qualified to be in front of you here today to talk to you about how do you get into this field how do you learn more honestly along with probably a lot of people in this room not a lot I did not study this

so I have a degree in medieval history and I have a master's in Library and Information science so if you want to talk about how libraries are organized how you can develop curriculum how you can teach people to search databases I got you also medieval writ law I love talking about it so I'm happy to have that conversation later so currently what I do is am the education and information management lead for Cisco Talos and so a lot of what that encompasses is I do a lot of just information organization internally so that people can find what they need I helped do curriculum development so I help people that understand different things in cybersecurity how they teach that to

somebody else because you know you may have the expertise in something but actually understanding how to organize that to show somebody else is sometimes a little difficult so what I wanted to talk to you about today is how women enter this field what are support mechanisms that are available what are things that you can start looking for in your areas to understand more about what your interests are and what you can do in security so the first thing I want to talk about is actually how I develop this presentation so last year is anyone familiar with the Grace Hopper conferences yeah so these conferences were developed as mechanism for women in computing and so these conferences they

do boot camps they do different courses and they teach women different things about computing and they have a lot of women presenting about what it's like to be a female leader what it's like for being a woman in computer science pretty much but one thing I noticed was severely lacking was there was nothing for women insecurity which you know women compromise about 25 percent of the computer science field and somewhere roughly around 11 to 15 percent depending on what you're looking at are women insecurity and so I thought it was very interesting and you know a little saddening that that wasn't an area that was talked about there were talks about you know how do you get into different

tech days and careers how you get into if you're interested in C program Java they've got all of these things but you know I wanted to kind of talk more about and hear more about how women do that for security and so how many people in this room have a degree in cyber security one person anybody with a degree in computer science a few people okay so one of the things is actually just getting people into this field because a lot of people enter security through kind of non-conventional means I'm a prime example so when students ask me they're like how do you get here I'm like don't don't necessarily do what I did it's not really the best method to

get in there but a lot of people come in through kind of a related field so they come in through like IT networking a lot of people enter cybersecurity because they were part of the military some people come in through different support roles QA kind of stuff or they come in through sales sometimes and so you can see a vast increase in how people are entering the fields through other STEM related fields so I have worked with and talked to a lot of people that enter the field through they have a degree in chemistry they have a degree in mathematics they have we actually have somebody that I work with that has a PhD in philosophy so if you're thinking

about this it's you have to kind of think about how to get into this field in a way that might not necessarily be straightforward so one of the things that definitely needs to change with the low numbers of females in the field is that we need to start changing the pipeline because it's not necessarily you can say whatever you'd like about you know biases towards women towards other minority groups I think a lot of it is just a pipeline problem if you don't have the applicants coming in and you don't talk to people about different ways that they can get into this field you're just not gonna have the people to hire in those positions so recently

there has been a ton of support that has come out for women people of color other minority groups in ways of sponsoring trainings for them sponsoring scholarships for them for different programs giving them time off to take different types of boot camps and so there has definitely been a lot of good things that are happening in this area so in the last five years so a lot of what I do at work is I work with different universities on their curriculum I work with them on what they're doing with their students and so there has been an increase in seeing different types of programs available so about five years ago when I kind of started in this type of role I noticed a

lot of schools had a lot of policy programs surrounding cybersecurity which that's not necessarily a bad thing if that's what you're looking for but there has been a big explosion in making more technical types of degrees degrees that focus on things like I was just reviewing a program that has an ICS and skate a portion of their cyber security master's program so there's lots of things that are changing and so even on a low level grade schools are now requiring not only typing which when I was in Middle School and they told me I couldn't look at the keyboard I thought was ridiculous but they're requiring a lot of programming and you're seeing things in

high schools where students are you know being on part of red teams or there's like cyber programs where they're teaching kids how to you know do CTF sand-like how to reverse things and look at things and so it's interesting to see how that's going to change the demographics of the applicant pool in a few years so even with those types of programs in place there's still a disproportionate number of female graduates with computer science degrees and so even though you know those numbers are still pretty low so you can see that there's still a little bit higher than what's in cybersecurity and so some of the reasons for that could be that you know the ways that people enter

the field so the disproportionate amount of female graduates to the women in the field you know if you come in through different means it just might not be tracked necessarily so a lot of schools are now putting forth a great effort to recruit and retain women to get them into their programs to kind of diversify what they've been doing and so a big part of that and a big help in that effort has been a lot of schools are now offering programs in formats that are a lot more flexible a lot more online programs evening programs so I kind of go through a little bit more into detail about what's actually being offered a little bit later but it's that kind of

flexibility that's kind of helping push forward women to be able to learn a little bit more in this field again recruitments really important because you know from the show of hands you can see that not a lot of people are either coming into this field through you know ABCD they're not you know going to school getting it degree doing this a lot of people are learning hands-on they were doing things on their own so we kind of have to take that into consideration when we're targeting getting more women into the field so this slide is just gonna be a lot for you I am going to give everyone my slide so you can look these up later

so these are a lot of organizations that have been doing a lot to help women in the field so these organizations so Girl Scouts of America I'm sure there's other international organizations that support young girls as well so they recently put out an entire cybersecurity program so when I was in Girl Scouts when I was a young girl when I was in Girl Scouts when I was a young girl you know they didn't have any of that available there wasn't even a STEM program at that point so even in the last 15 years they have advanced so far to have different types of badges for girls to learn about chemistry badges for girls to learn

about programming and so I think that that's been a pretty great push there girls who code is an excellent organization that supports young women it puts generally high school and middle school girls through boot camps it lets them kind of explore was out there and what they might want to be doing and some of these organizations one of the some of the best ways that they're supporting women is they are putting through mentorship programs and so anyone can apply for those programs and I encourage you to go to some of these websites to kind of understand what they're doing and you can see the tandem programs that they do they link you up with mentors where you get to have like

one-on-one conversations with them about you know how did you get here what is you like what did you want to do different what can I be doing so it's really fascinating and you know really encouraging that these these companies are doing doing this work and so they're also putting on different types of seminars for women and for others to be able to learn to do things so if you're trying to learn you know you want to learn how to do a CTF they're doing one-on-one kind of things where you they bring you in they teach you about it and then you actively start doing it and so it puts women in a situation where they can do more of a

hands-on kind of learning some of the other things that I wanted to talk about were some of the online programs so a lot of these are free tour paid and so one of the the biggest pushes recently has been for massive open online courses and so MIT is one of the biggest ones that pushes out content that they actually teach in their school but it's completely free and MIT is the massachusetts institute of technology and their computer science program is actually one of their bigger MOOCs that they offer and you know if you just kind of google around like you'll start finding more and more of these there are some that they offer some other stuff

for free some of it's extremely affordable so if it's just something that you're trying to look at and trying to figure out if it's something you want to do those are great places to start another big one that I know a lot of people have been using it is a fantastic resource if you're trying to learn either something very specific a lot of people will put out the m's they'll put out their curriculum and they'll kind of walk you through what to do and how to do it and so you can kind of go through your own pace learn a little bit more and so that's a pretty great place and at least so I'm based out of Baltimore

Maryland in the US and so they're it's a pretty big hotbed for cybersecurity and so a lot of companies kind of use these things that recruiting tools but they're having these free large events where you know they're having people come in look at software kind of put pieces together do kind of hackathon things or one that our University nearest recently did was they did you know women's only first CTF so they wanted people with no experience to come in to learn to do these things and so it's really encouraging that you know these places have started to do that another great way to get interested in this is you know you're already here to b-sides that's a great place to start

and so you can actually you know it's more intimate setting so you're not going to this giant conference with tons of people the talks are a bit more curated and you can actually you know talk to people learn about what they're doing learn more about what you could be doing and talk to people about your interests and how that might fit somewhere or you know if they know about something that again you don't know so that's a wonderful place almost every city that I have been to has some sort of security meetup they've got some sort of like data science Meetup one of my friends found one in Baltimore recently and she went there and ended up

talking to I don't know how popular baseball is here but she ended up talking to the lead data scientist for the Baltimore Orioles because baseball is literally all math so just start looking you know just kind of start digging around start trying to figure out what it is you like to do you know do you enjoy solving big problems do you enjoy writing code do you enjoy you know kind of taking something apart figuring out how it works those are the types of questions you just need to start asking yourself and you know I think a lot of it is like encouraging people to start doing that and so there's tons of things for absolutely every level it doesn't

matter what you're interested in or you know how little or much experience you have there's all kinds of things I've mentioned CTF sand hackathons check around in your area wherever it is that you are there's all kinds of seminars and workshops that are available to you one of the the more boring ones but a very important one is career fairs and resume workshops so I've done a whole bevy of interesting jobs in my life and working in HR is definitely one I don't recommend however it's it was extremely informative and so I can't say enough good things about potentially going to a resume workshop because it'll teach you how to look at your skills and how to

apply them to what you want to be doing because you can kind of figure out how that would apply to any position in cybersecurity and like I mentioned before mentor programs just start talking to people here's a great place you're gonna start to learn how people came into this field what they've been doing what they're interested in now and so sometimes you'll build the friendships you build the relationship networks that are going to help you kind of figure out how to learn more and to do more and one of the things that I cannot cannot stress enough is whatever it is that you're doing evaluate it make sure that what you're trying to learn what you're trying to do it's worth your

time and your effort because even if something is free it's still costing you you know whatever time you've got to try to learn something and so not all programs are created equal and so like I mentioned earlier a lot of degrees probably about five years ago we're focusing a lot on policy however that's shifted a lot and though policy is not a bad thing in cybersecurity you know if you want to do something you know like if you're interested in ICS and SCADA you know a degree that's gonna teach you how cybersecurity policy is written isn't gonna help you get there and so you just need to make sure that you're looking through whatever it is

that's going on that you're reading course descriptions you're talking to other students you're looking at what kind of graduation looks like for those types of programs and so that's a very important place to start so in so far the future looks really bright there's been a significant increase in women in the field for the past five years and so with that type of change with that type of diversity being added to the field you know it's kind of creating this really good support network for newcomers and so security has been one of the most welcoming fields that I have ever been in and so people are very willing to accept the ways that you come

in because you know in this field not a lot of people you know some people don't have degrees some people have degrees in different things some people came through military so people come to this field in vastly different ways and so I think that that makes a nice melting pot of you know just inclusiveness and so a big increase in these availability of all of these like online courses the different types of programs that you can get into both in person and online the different trainings that are available to you locally internationally going to conferences those types of things and so with that type of diversity comes you know really good high quality programs because they're now competing with a lot

of other programs a lot of places are also starting to really focus on training internally so they're taking people that they're working with and they're kind of moving them towards you know investing more into those people having them doing trainings based on the company paying for them to go elsewhere and so you know whatever position you're in now like start looking through your current place start talking to people start learning you know what is the type of reimbursements that I can get what programs are available to to women so I work for Cisco and there's different types of like internal training programs from women there which you know it's pretty wonderful and one of the bigger

ones that I've come across in the last year which has been pretty wonderful for me and I try to tell everybody else about it if you've never heard of no starch press they put forth a lot of books that can help you learn what you want to be doing in the field they can teach you how to do things and they do kind of these things called humble bundles will they'll put together kind of these basic sets of books where you can go forth and you know you can pay you know sometimes it's whatever you want and sometimes they're pretty cheap fifteen to twenty dollars us and so that you know definitely kind of helps level

the playing field a little bit because you can start to learn all of these things at a fairly cheap price so the key takeaways that I wanted to make sure that you got today is you know pipeline invisibility the more that we are talking about the types of trainings the types of things that are available the support mechanisms for women if those are out there and we are you know kind of pushing it through you know people are going to start to get more interested we're gonna start to have that background and they're gonna start to you know start applying for jobs and so if we can kind of start fixing that pipeline we can start getting more

people employed and increase the number you know the diversity of programs like I said I don't want to go through all the lists of universities and things that I know in my head but you know if that's something you're interested in like come and talk to me because I've got all of these things you know that I would like to share to people because I want people to know what's out there I want them to know you know what they can be doing and that you know if you are interested in you know Electrical Engineering there's still things for you to be doing if you're a linguist there are things for you in this field and so

I think is the more that we talk about those types of things and the diversity of people that come into this field the better I think we'll be able to make it you know make sure you look for support groups look around figure out what you want to be doing and then just start going down that path I think you'll be surprised if you can just start looking through things and going that way you know evaluate everything don't take anything just because somebody says this is the best program make sure it's the best program for you I think some people get too caught up in you know what they think is going to be better rated but

you just need to make sure that you're going to be learning what you want to be learning like I said ask around people I have found have been generally very nice and supportive you know every time I can't do something on a on the computer I've got co-workers that you know they don't just do it for me every time I ask for help I'm given the help they show me how to do it they help me make sure I can do it and so there's a lot of stuff that I have been able to do now that I could have never have done before so that's about it you know if anybody has any questions I'm happy to take them or

yeah slow down I'm too eager too eager to hire women what what advice can you give to hiring managers to encourage more female applicants when we do advertise positions we only get men applying how can we make our job adverts more more appealing so okay this is a little bit of some sociology but typically sometimes when you put the degree requirements or you put specific job requirements on it those types of things sometimes people are less likely to apply for them if they think that that doesn't apply to them so sometimes those like minimum requirements can deter people so I think one of the best things you can do is kind of keep it as open

and broad as you can and so generally that will help you know bring bring more people to the table yeah I think that that would be my recommendation there I also have a recommendation if you want to iron because we see a lot of job offerings that say we are looking for a core who can break into doors can break into windows can break into Linux from bring into everything and it doesn't work that way because we usually focus on one little piece so try to keep it also as narrow as possible for expertise any more questions for Sammi and like I said come come and talk to me I've got all kinds of resources that I would like

to share to people but I also like to learn as much as I can so a lot of what I do I go out and I talk to to students and try to like put these resources in front of them because I just recently did a career fair and I was talking to a young woman who was just starting out in the cyber security program at a university in Maryland and you know I kind of started the conversation with what are you interested in and you know she kind of looked at me and I was like what do you like to do and then let me give you what I can and she told me

she's doing a computer science degree and also an electrical engineering and she really likes you know playing with the pieces and you know I kind of told her I was like if you're interested in security there's tons of things out there for you like tons of people that are pulling apart devices and you know they're not only trying to understand how the programming behind those devices works they are understanding how it physically works and so they can like reroute things and do things I had a co-worker that he bought a camera for his dad's house and he thought oh like maybe this isn't the best camera let me try this and he found a bunch of exploits on it and was like

oh wow like this this was not a great camera so that's what I always try to tell people and start that conversation with what do you like what can I do to help you [Music]

so advertisement is by sending basically the emails and positions to like projects that support and cooperate and collaborate with women's like maybe limits women Delian women women in knapsack and so on normally whenever we get these kind of like opening positions you feel more like yes they want women here I can be one of them so I think that's something important to us or maybe advertising their positions within like I don't know women initiative broad yet some may the least I I would agree with that yeah so where I work were actually 26 percent women at Telos which you know is probably the one of the bigger numbers that I've seen and it's very encouraging that you know the

people that I work with they you know they encouraged us to be able to you know they say you're just you're everybody else you can do this like talk about what you're an expert at talk about what you like to be doing and so the reason why like I said I really wanted to create this presentation was to kind of lay out some of those paths that you can go forward and some of those organizations that can support you because you know people can talk about being a woman in security however if you don't start giving those tools to people to be able to do those things you know it's not going to go very well so there are no more questions

Englishness I know I went a little fast but I will be at the Telus booth for the rest of the day you know come see me thank you guys so much look [Applause]