Strengthen Your SecOps Team by Leveraging Neurodiversity - Megan Roddie

that's good I usually am all professional and have a clicker but I left it in my talk like two hours ago so will not be using a clicker and I apologize I got sick recently so my throat my voice is still gone but what's the other says so I'm presenting on strengthening your psyche out steam by leveraging neurodiversity I'm gonna start by talking about Who I am my name is Megan I recently got my masters in digital forensics I have a couple of security certifications that I worked on during my degree a lot of the people here have decades of experience I also have 21 years experience breathing so yes stay out there that 20 year

experience mark right now I'm working as a senior security analyst for a small start-up MSSP in Austin called Recon InfoSec my expertise related to the talk I'm giving today is I have Asperger's syndrome a couple quotes to start us off to get you in the mindset of that my talk is first ones by steve Silverman he's a former writer editor for Wired and he's an autism advocate he says that one way to understand neurodiversity is to think of the human think in terms of human operating systems just because a PC is not running Windows does not mean that it's broken furthermore CIP CIPD neurodiversity at work guide talks about neurodiversity in the style of sports teams are made up

of players with a variety of skills you don't just hire the fastest runner or the strongest person or the highest jumper best kicker you hire a diversity of skill sets and a diversity of different mindsets in order to make the strength of the team as a whole strong so I'm going to talk about individuals who have high productivity extreme attention to detail their logical calculated passionate individuals and can hyper focus on the work they do specifically I'm focusing on individuals with high-functioning autism so the problem I'm approaching and the reason I read this talk is about a high unemployment rate among high-functioning autistic s-- for the defined autism spectrum only about 8% of individuals on

the autism spectrum are below average intelligence and are unable to hold a full-time job 92% of individuals on the spectrum can hold a full-time job and many times are above average IQ yet we see a low unemployment rate the reason is most likely tied to social and behavioral disabilities more than anything is not about our capabilities to perform the work or to understand the technical details of things or how things work it's the social and behavioral interactions we have with our peers some examples for myself is I tend to speak very loud at an unnatural noise level I'm unable to control the volume of my voice you'll find this with a lot of autistic individuals some of them

will talk too quietly for me I talk too loud so it's great when I can use my voice loudly in a room presenting to a group but it tends not to be taken well when I'm one-on-one in a conversation in a tiny office and I'm speaking at the top of my voice I don't notice it it annoys people it makes them not care to be around me for long periods of time I'm also very blunt I say what I think and if I believe it's factual I don't really care about the impact it says that could get me in a lot of trouble because sometimes the thing I think things I think should not be said but I

will be very blunt and direct so that can get me in trouble social thing I don't have the filter that most people would have so it can get me in trouble I'm very particular when it comes to certain things such as my clothing I'm only comfortable in certain types of fabrics very particular forms of fabrics so I buy the same pair of pants five of them because when one gets holes in I'm gonna take three years to find a new pair of pants so I'm comfortable and so I just buy them up put them in the closet and every time one gets worn out I have a new pair to replace them so again that nothing that impedes my

capability to be a security analyst but something weird that people just as humans subconsciously judge and it's that one of those strange things other examples of how you might see this in other individuals is sensitivity the lights or sounds or other feelings in the environment that could have could affect their behavior but not impact their ability to perform a job this is a slide I added recently I think used to talk about this much but I share everything else now so I share this part of the autism I have is that I have to accept that no matter how old I my emotional maturity will never reach that of a full adult sometimes I do okay but

a lot of times the way I handle incident handle situations that make me uncomfortable or stress me out or upset I revert back to the maturity of a six to eight year old and it sucks it's something I have to do but it makes it hard for work one of the lessons I've added to this talk that I think not many people know is that when you get frustrated with your boss you can't give them the silent treatment it will not work out for you in the end and if you forget that and you do when they ask you if you're giving them the silent treatment don't say yes I had a had some bad experiences there because

mentally I thought I was mad and so I didn't want to get in trouble for saying the wrong things so my solution was to not say anything also this picture is an example of why somebody should have figured out something was wrong with me a lot sooner because eight year old me is thrilled to have 30 days to multiplication mastery so there's something going on with that brain a long time ago that should have been found out sooner so the next part is talked about is there's companies that are already implementing this idea of autism at were employing individuals with autism and security and IT fields so the first example was tech companies in general typically bill autism at work

programs my favorite is sa P because they looked and at the statistics and it was shown that 1% of the world's population is diagnosed with autism and so since 1% of the world's population is diagnosed with autism they asked why shouldn't one percent of their workforce be diagnosed with autism so they have an autism at work program that they're aiming to recruit one per recruit enough employees that one percent of their population reflects the one percent of the world's population by 2020 Microsoft New Relic HP and many others have programs because they've realized the individual of the skills that these individuals possess but they've also recognized the adjustments that need to be made to help these individuals thrive

unit 9900 is the Israeli Army's visual intelligence division when you turn 18 in Israel you are obligated to perform military duty before going into whatever career path you choose the thing was that high functioning autistic individuals like I said have the the intelligence to perform tasks and jobs they were growing up alongside their peers and then when they turned 18 all their peers were sent to the military as they received letters in the mail saying sorry we don't need you but these individuals said but we want to help we can let us prove it so the visual intelligence division was formed they employed these individuals they put them in a role that they found that these individuals succeeded at it

was sitting in front of two computer screens 24/7 looking at identical high-resolution images taken at different time periods and seeing if they could spot any differences that could indicate enemy movement or IEDs or anything any other little objects that may be missed by someone who didn't have high attention to detail so the the great thing about this program is that after having it running for a while they realized that the individuals in this unit performed very very well gave gave a lot of had a huge contribution to the military and yes management managing them was slightly different but it wasn't unachievable and that they were finally able to bring these individuals in they taught the leaders how to manage

these individuals and we're able to integrate them into the units they wanted to be in other units is if it sees a spurt 'is there a company I got to talk to their founder it's really cool they say yeah they say that their company they're basically like a contracting MSP MSSP they contract out developers Quality Assurance big data security analysts and the individuals they hire almost their entire workforce is made up of individuals with high-functioning autism or Asperger's syndrome and I got to hear a bunch of cool stories about the culture of an organization that's basically flipped of what you usually see instead of few neurodiverse individuals with a lot of neurotypical individuals they have a

high population of autistic individuals with a few neurotypical x' and one of the neurotypical women who works in their office said that her favorite part is that people with autism they get to the point and they talk about what needs to be talked and they don't fill in the thing with any social intricacies so those one-hour meetings that would be booked on calendars like at other companies that would run for like an hour and a half two hours because people are chatting and like saying things they don't need to say would run for 30 minutes at a Sporty's she'd walk in cuz everyone would be like here's what we need to say now leave me alone and walk

off and so there's kind of that that those fun little benefits that you find and the other allistic companies there other companies that either hire autistic individuals and contract them out and then manage them kind of themselves under the other but let them out go to other companies or their programs that train and help employ autistic individuals and help the hiring company learn how to manage them so study in Australia actually showed that 59 employers who were asked about their autistic employees saw an increase in average they saw an above-average performance they saw that attention to detail and passion that I was talking about they saw new skillsets brought into the workplace because it's people

who think differently so you're gonna see different skill sets they saw that these employees adapted quite well in the environment and despite the stigma that if you hire an individual with disabilities your cost to employ them is going to go up they saw little additional cost to the employer JP Morgan specifically said that it only took three to six months to train an autistic worker to do the work that employees who were there for three years who took three years to train to do those same jobs and were able to do it with 50% more efficiency so we say that the issue is social and behavioral deficiencies the people have successfully done it and I propose that

the the solution here is one awareness understand it's that change of mindset of saying that autism is not a disability they it it has associated difficulties with it but you need to focus on the benefits that come with it when you're considering hiring an autistic employee the the things that I kind of have to deal with on my own the the social challenges I'm in a role where I sit at a computer all day I don't often interact with people so I may have poor social skills at times but like if my job requires it doesn't require me to interact with people like why why are you judging my social skills so it's focus less on the things that I

have to deal with at home my personal struggles and focus more on the benefits that I'm bringing by coming and applying to work with you and then also I say that it's not much it doesn't take much to hire these employees it doesn't you have but you do have to adapt I'm not saying to manage them just as you manage everyone else there's things to do but they're simple things and they're it doesn't take much so how do you do it do you adapt so the most of what I'm going to talk about is once you have an autistic employee or working with but I start off with just saying before you can have those autistic employees in we

need to fix the way our industry hires individuals right now we have very strict and our job postings are written one unrealistically telling you need 10 years experience in a product that's existed for five years requiring 10 years of education phd's for entry-level positions when some of the smartest people I've met in the security industry are people who did go to college but sat in their bedroom and studied by themselves and got hands-on time with the computer and taught themselves everything they know the other thing that's specifically that's specifically challenging with the way we'd write job posts in this industry specific to autistic individuals is we take things very literally and so if you have these solid

straight requirements that that say like X number of years X number of degrees X number of times doing this that's gonna be something that's I'm gonna struggle with because like a lot of people think like well I don't have three years but I've got two years and I studied a year in school so I could apply and you know maybe they'll consider that I have enough experience over all like what's the worst you apply you don't but someone like me will look at it and be like three years experience oh I only have 364 days plus two years so technically not three years so I'm not gonna apply so like those stringent requirements it's not as easy for me to

go well I'll apply that they might turn me away but I'm pretty close so maybe they won't so starting with a scenario before I dive into specific points is this comes from an actual challenge I faced at work was there's a limit of resources bandwidth available to work on projects I had a idea for a project I wanted to work on and I was told I was told what you would tell a narrative go like hey great idea let's reappropriation we we worked on it me and my manager and we found that that change helped is instead of saying remind me about it when we were less busy we'd say in about in a couple weeks the reason

for this is because I have trouble interpreting subjective statement because I don't think like you so what you consider to be less busy is it might not be what I consider to be less busy you may one I'm not in your role so how am I supposed to know logically when we as a whole are less busy if I don't know how busy you are too I typically take on a lot more and do a lot more faster than most people so my less busy is you're really busy so I need I mean a more of an objective approach to it a couple weeks a couple weeks is something I can put on my calendar I'll come back to you

and if we still don't have the resources fine just tell me another couple weeks as long as I have that strict kind of like that objective guidance because the other thing that happens when you say less busy I so like I've learned like that I might not understand what that means and I have this fear that if I come to you and I come back let's say in a week and you're a gap set you're gonna say I said when I'm less busy does it look like we're less busy and maybe I thought it was but you didn't so now I'm in this place where I've just I feel like I've upset you because I'm

bothering you again so I'm I won't bring it back up so that's why I kind of like to set those guidelines because it could be a couple weeks a couple months a couple years is it's not about the the time that you need me to return it's about knowing when I should return at a high level I need structure and routine I need clarity and I need patience and understanding for my manager but I'm willing to be your most productive employee I'm willing to produce the most thorough work I can and I'm willing to be your most dedicated and passionate boy so where I said the things that you may come across so as I said routine and structure is

important to me if I work an incident response no matter what's on my calendar what I wake up to may be different than what I planned there could be an incident that I'm responding to instead of going to my 2:00 p.m. meeting this is something I've learned to adjust to and part of the way I do this is I find something that I can keep the same in every day for me it's my breakfast every morning I'll go to chick-fil-a I'll order the exact same thing and then I'll go and I'll start work so despite not knowing how my day may have heard due to the sporadic nature of incident response and the unknowns associated with the role of a

sock analysts I do know that every morning I'll have the same breakfast and that same part of my routine ever since I was young I've struggled with getting bored really really easily it made the summer times difficult for my parents because I would get so bored in adulthood I've kind of leveraged that because I like to learn so when I get bored I kind of find those find things that I wanted to learn at some point and wanted to do and fill my time and in the workplace the thing is so most employees they'd run our stuff to do hey boss what do you want me to do oh now it's cool we don't have anything right now just Hance

so something comes up and they'll go on Facebook or Twitter or whatever's popular right now and they'll they'll just chill out my thing is like in my mind like when I think about work those eight hours are time to like work on work like I don't take a five-minute break to go look at Twitter or whatever so this at first became kind of like an annoyance to a nuisance to my managers because it was like well she blazes through work fast she so she's done everything on the list and now she's just sitting there asking me what to do repeatedly they eventually learned that instead they can leverage this they can have a stack of things ready to go because when

I'm in those like mindsets where I'm bored I will literally do anything I became the requisition order writer for our office I filled out my boss's travel reimbursement requests because I just wanted something to do where I felt like I was producing work for the company and so that's that's kind of things if if I really need something you all did everything so take advantage at that time if there's any projects you wanted to do but you haven't really had the manpower the time to do yourself like maybe set those off to the side and when that employee comes to you hey what do I do be like well it's not high priority but since there's nothing else what

about this like I said kind of similar to the subjectivity objects have anything I do better with specifics despite thinking that academia is corrupted and terrible and I hate that degrees are required for jobs a lot of the time I kind of enjoyed school I think a lot of it was the clear nature of homework they didn't teach you anything with the homework but I like that the directions were like click here then click here like I realize that didn't teach me anything but just my nature I love that kind of like clear guidance on what to do yeah in the workplace I enjoy a similar thing I'm more likely to excel at a task if I'm

given more clear direction than just having paper thrown in from me I try to learn how to enable myself I've been working on that learning how I can take what I've done in previous times and adapt it's in my situation rather than asking for step by steps but sometimes I still do need that go click this this this and this and you'll be done also get obsessed with things previously one of my larger sessions with Doctor Who I some other obsessions in the past and it consumes my brain my time my thoughts my google searches everything I do will center around that object as I'm older I've been able to wean myself off those intense obsessions I kind of regret not

having them anymore because it was kind of it was like a thing I had and so I've kind of lost that but I still I still get hyper interested in things and that's another thing that an employer can kind of leverage is the fact that my obsession and interest in things means like if I get interested in something I'm going to pursue it and we have become an expert so if you have an employment you can encourage me so like let's say our team is lacking someone who's interested in memory forensics if you can get me interested or somebody who's good at it you can get me interested in memory forensics I will study it outside of work I'll practice

it I'll do everything I can to learn those things and I'll become your expert so that that obsession while it may seem annoying I'm that person who talks to you about thirty four three hours about something you don't want to hear about it can also be leveraged to become an advantage and they a quick way to have a skillset developed the last thing that I tell managers is to like be a mentor communication is difficult sometimes for me and other individuals with autism what what works well is having one-on-one time because and talking with your employee it's it should be a bi-directional conversation you should ask them what they've been struggling with because sometimes I might not come

to you directly just because I'm uncomfortable like bringing things up and I think it's my fault but if you say like what do what can I do to help you I'll be like well this thing I was struggling with could you like phrase that differently next time so let me tell you what I need help with so that we can improve that situation but also things like the talking loud I don't notice I'm doing that so I also appreciate when my manager tells me I did something because I may not have noticed it and so if it's pointed out to me I'm more likely to in the future or just what I'm doing so that I'm doing it

more appropriately so time of mentorship can be a time to have bi-directional communication and help improve improve a working relationship and the other thing about like telling me what's like what I'm doing wrong that I may not notice it's very important to me because right now I work with someone who's understanding and takes and like if I do something that's probably not super appropriate for an employee to do or that it would usually require disciplinary action my boss is much more understanding but the thing I like is he comes to me and he tells me what I did wrong he doesn't just kind of like and that's just her shrug it off and leave because

if he were to do that and then I move on to a new manager who is not as a nurse and not as understanding and I keep doing the same thing over and over again wrongly I'm eventually I be fired when I could have learned how to correct the actions I didn't know I was doing months ago so I completed it kind of short today my throat's killing me so I kind of sped through it I apologize but that's all I have I think and I'm happy to answer questions if anyone has any questions questions [Applause]

folks that are in like penetration testing and in that room um why will sell say surveys show that a lot of so so the US doesn't do much research until like the statistics of the president of autism in the US but the UK does in the UK does have a lot of statistics about hackers and those who have been arrested or fined for attacking computer systems there's a high percentage of those individuals who have autism so that it's so kind of related that mindset of attacking things is is prevalent I was left cyber yeah I always challenge oh I always struggled with group group projects in school typically I just did all the work and then handed it to my

group it was like I don't even care just it's done cuz I didn't like working in groups that's kind of a skill that the individual is gonna have to learn to develop over time a lot of encouragement and feedback that helps me I know it's it's kind of that reward thing when I like do something and like if I were to do something in a group that the thing that keeps me going and motivated and is I'm like a dog like give me a treat and you'll reinforce my behaviors so kind of that encouragement that constant reinforcement like you shared that is great like awesome job so that's something that at least helps me and

like I left out my disclaimer at the beginning that I usually do is like I was not voted like Almighty Speaker of the autistic people of the world I'm speaking on my experience other people are gonna have different experiences also SEC Ops and autism that's a subset of autism I am NOT saying every autistic individual should be a security analyst I'm saying there are autistic individuals who want to be a security analyst who are unable to at this point

to be understanding yeah is a real challenge yeah yeah and in that in that situation I've mentored CyberPatriot so I kind of have the feel for how the competitions go I think like trying to find him a role that's kind of isolated but within the team so like you sit here focus you complete that task and bring us what you have as opposed to constantly communicating cuz that's not gonna be easy a struggle with that more whereas if you like to sit there and say one like this is your task run with it I've then come back and tell us what you found yeah exactly yep and then you perfect oh yeah yeah so thanks yep yep

you have citations for studying a default and the listing of companies do not find it at some of they had since shut down oh I should probably go update I've been giving this talk for a year and I haven't had I'm actually revamping the content soon probably in August I'm gonna redo my entire slide deck I can give you my business card and send you the links to all my studies and the names of the companies here you go these are the companies that I have listed I know a Sporty's is still up but yeah yes it was um that's a hard one you so the first thing is you have to be willing to go

through more resumes the issue is a lot of times companies like well I'm gonna say these specific instructions so I only get the best of the best whereas you need to be more open with your job posting so that you can attract those individuals who don't fit inside the square box and yes that means you're gonna get like a whole bunch of crap resumes that you don't want to look through but you're doing that so that you can find that one spectacular employee who didn't meet that exact requires specific requirement so being more focused on the the skill sets kind of and the mindset rather than the specific degree okay super specific degree or X number of years experience

so especially my main thing is like entry-level like I think everyone's expectations for entry-level right now a lot of companies that are way too high you're looking for someone with a PhD to come fill your entry-level Saki analyst job and there are highly qualified people to do that job and there there are people who want to be Saki analysts and want to break into security but they don't have that seven year degree and they don't know how to hunt for jobs because they type in entry-level and they get someone wanting ten years experience so as being a little broader and focusing more on the skills of the person as opposed to their credentials that said that my wish is that

interviews would be technical hands on interviews and set question based interviews that's a culture change thing that's something I cannot change personally but if I were running my own company I do technical hands-on interviews prove to me your skills not your piece of paper that says you know the stuff who else thank you okay I think I'm done