 Hi, everybody. This is probably a site you are not used to seeing at a cybersecurity and information security conference, a panel of all women. I'm Megan Garcia. I direct New America, California, which is based in San Francisco. And I lead our women in cybersecurity work. So most of the people in this room have a great idea of what cybersecurity is. But the average person out there in the world really just has the media to guide them. So they really are looking at stuff like what we have on this video. That's a nice score for a girl. Think you can do better? Be a bit of a moral gray area to use one of the few socially promoted bastions of free information to hack. Or it might be perfectly in line with the ideals of the librarians. Who knows? I don't ask. The point is, I'm not doing this from home. It attacks on application, planting of back doors, inside applications, which enable access by people who are not authorized to access those systems and applications from the outside. Because cybersecurity is all about knowing yourself and knowing your enemy, analyzing risks and vulnerabilities, and being one step ahead. So program or culture, it's not really as a prize that our field is steeped in it. If you think about bringing together the culture of the military with the geeky, male-dominated tech culture of Silicon Valley. So we're going to do something different for you in this session. And we are going to have three fantastic women tell stories about what it's like to be a woman amidst all the images, as you just saw, of cyber warriors and men in hoodies. So I'd love to introduce these three folks briefly. We have Adrian Allen, solution principal at Slalom Consulting, who works in particular on incident response planning. Betsy Cooper is the executive director of UC Berkeley's Center for Long Term Cybersecurity. And Jewel Timpey has been in the field for over 20 years, currently a senior manager at Hewlett Packard Enterprise Security. Come on here. My name is Adrian Allen and I'm actually chatting a little bit this morning about my experience writing my master's thesis. That was really my first run-in with imposter syndrome a few years ago. I was finalizing a chapter in the lead-up to my defense. And as a defense drew closer and closer, I was really crippled with fear that come defense in front of the panel that the hollowness of my research would be unmasked. It was something I constantly struggled with for about two months. And it really was very concerning to me that I felt like I had been pouring years of my life into a thesis that was about to become one of the worst nightmares come through in my life. So I finally worked up the courage to speak with an advisor of mine. And he said two words that really fundamentally changed the way that I thought about writing from that point on. He said, enjoy it. And it struck me that in all of my time writing this thesis, it never occurred to me as, it never occurred to me to enjoy writing my master's thesis. I don't know why. But that really did change the way that I thought about how I was approaching the problem. It changed the way that I thought about myself and what I was actually capable of providing. And it also gave me a better confidence to really stand before the panel itself when the day came. Obviously it passed, it did very well, but that's something that really stuck with me. Why didn't I actually enjoy it? Why was I so obsessed with sort of this idea of competition, of constantly trying to prove my adequacy to, within a field where there aren't a lot of women. And that really hit the nail on the head for me. I think that the security field is really interesting. We're kind of a rare breed of a mix of curiosity and a healthy dose of confidence. Even sometimes bordering on arrogance, everyone is very adamant that your opinion around what you're seeing is the right one. And I think that in and of itself can also be a barrier to entry for women in cybersecurity. All women are very different obviously, but there are many of us who are a little bit more reticent to say, well this is definitely the right way. It's my way or the highway. We're more inclined to look at trade-offs, more inclined to look at long-term implications. So one of the things that really became fun for me now sitting on the other side of the table is taking that same idea of enjoying what you do into interviewing and hiring women into the field. Women are often a little bit more slow, a little bit more kind of timid to really present the thrust of their work, to really kind of compete with the rest of the men that they see in their field because of that tendency to think through things. So one of the things that I really enjoy is asking women, what do you enjoy? And not even just leaving the question around that, but dig into that. What do you love? Where are you passionate about? Where do you see your gifts really matching your job and tell me more about that? And that really gets you into a conversation about competence and it also makes a discussion of inadequacy completely irrelevant because you're really engaging them on a personal level. It becomes much less about whether or not they deserve to be there and the fact that they love to be there. And I think that's really important for us to focus on as we continue to figure out what makes the most sense as we're bringing women on, as we retain them, as we really engage them from that first moment. Hi, my name is Betsy Cooper. I'm the executive director of Berkeley's Center for Long Term Cybersecurity and I almost, go bears, and I almost did not apply for my job because I did not think I would fit in. A colleague handed me a job application in a folder similar to this one and he said, don't worry, you don't really need cybersecurity experience to apply for this. And I thought to myself, you know, I know he's trying to bolster my confidence, but it isn't really working and so I hesitated. I hadn't, you know, I'd heard of cybersecurity before. This wasn't an entirely new thing to me. In my previous job at the Department of Homeland Security, I had worked on a number of cyber related projects. I had helped with the Quadrennial Homeland Security review the cyber portion of that. And even before that, in law school, I'd worked very closely with our information society project. I'd helped to found a clinic that worked at the intersection of technology and privacy. And though I completely failed to put it on my job application, I'd even written an article about Watson, the Jeopardy computer. I had argued that Watson might be better than some judges at doing the particular types of statutory interpretation that they're engaged in. Even so, I wasn't sure that I wanted to apply for the job. After all, I was a political scientist and a lawyer. I hadn't taken a computer science class since high school. And frankly, I don't look exactly like the traditional cybersecurity professional. I was in a sorority in college. Yes, I admitted that out loud. I wear glitter nail polish. In fact, I'm still wearing glitter nail polish. And with apologies to Walter Parks if he's in the audience, my favorite movie is Love Actually. I don't watch sci-fi movies unless my brother makes me. So I decided to apply for the job, mainly to get the interview practice. I told my mom about it and she agreed. This is a good idea for you, but you're never gonna get that job. My friends watched on with bafflement as I took the train across the bay to interview in Berkeley. And they said to me, Betsy, why are you applying for this? You just got a smartphone six months ago. They were right, I did. And your computer, it's four years old. It is. So I didn't realize until the fifth round interview that I actually had a chance of the job. Yes, there were five rounds of interviews. Since getting the job and accepting it, I've learned that my experience is all too typical. We were at a new America gathering of women in cybersecurity and it's great to see some of the women that were there also here. And of the 40 or so young professionals, we did an informal survey and 38 of us had lateraled into this field from another field. Now, what that says to me is that if this is representative, and I can't prove that it is, many women will be coming to this field from a place that they're not necessarily comfortable and from a way that it's not inside their basic set of experiences. At the same time, women are bringing skills to the table that we need in this field more than ever. I was giving a talk at the RSA conference just a few days ago, and a cybersecurity luminary told me, I'm not worried about technology, we can get the technology part right. What worries me is what humans do about technology. And frankly, women can bring to this field a lot of the analysis and education to be able to understand better what humans do. For instance, in my current job, I've used my political science background to help develop a survey to look at how corporate counsel are engaging in cybersecurity practices. And I use my legal background to think about reasonable standards of care. Are we actually doing enough to make sure that companies are protected from liability? So in brief, I don't really fit in to the old cybersecurity world, and I think that's a good thing. Thank you. Hi, so over the last couple of years, we've seen a huge number of data breaches. Hundreds of millions of people globally are affected by these. The attackers are getting more sophisticated, and it's getting scarier. So it's a really hard problem to solve, and we need a lot of smart people to come help solve that problem. In 2015's Information Security Global Workforce Study, they quantify that talent gap. And while there's a general scarcity in security professionals as it is, there was an alarming decrease in the number of women in cybersecurity. We actually lost ground in 2015. So there's a lot of talk about why this may be and why the women aren't coming in the programmer culture. I tend to think that a lot of it has to do with my experience, in that we don't really know what a cybersecurity career looks like. And if you don't know what that career looks like, how do you know to go there? How do you know that you can do this job, or that you have anything to bring to this job? So for example, as Megan said, I've been in and out of this industry for about 20 years. My background is not engineering. I actually went to school before mobile phones were even a thing. There was no computer at my school, at my high school when I graduated. I went off to college to study accounting and business management, and I was in the workforce almost 10 years before I had a job where a computer was part of the work. That's a very different background than a lot of people today. So moving on through that, I ended up at a little known company up in Redmond, Washington called Microsoft. And the great thing about the technology industry is that they don't care what your background is. You're smart, you're passionate, you come do the work, and opportunities abound, and you can do what you want. So as long as you're willing to put in the work and learn stuff, you have a career in cybersecurity. So I went through about 15 years on and off in and out of the IT world, not in security, went back to Microsoft, and ended up in a group called the Microsoft Malware Protection Center. And these are the security researchers behind Windows Defender, OneCare, their antivirus endpoint protection system. And the security research industry is actually very interesting. I call it a niche inside of the infosec niche, right? So it's really this small, even smaller little set of skills. They work in a very different world. You heard the panel talk earlier about that, right? The coordinated disclosure, the vulnerabilities, you've heard them talk about, other people talking about Wassinar and the effects against security research. So I spent a fair number of years learning a lot about their world, eventually going on to do, trying to quantify their work in business, right? In business terms and keep them funded to keep doing the great work they do, ended up as a chief of staff, eventually got to HP, ended up at Hewlett Packard Enterprise Now, that's HPE, have to remember all those new branding roles. And eventually got to build research teams and run the threat research strategy for Hewlett Packard. I'm not an engineer, right? So my point here today is that we have to raise that visibility of all the different skill sets and that it really just takes smart people wanting to solve the problem to come do this. So we need communications experts. We need legal, we need policy, we need privacy, we need analytics, we need everybody to come do this. So my point is to figure out what your passion is, bring it here and help us beat the bad guys because it's an asymmetric war and we're not gonna get ahead without you. Thank you, Adrienne, Betsy and Jewel. Those are all really great and for me at least engaging stories about what it's like to be a woman in this field. And I wanna tell you a little bit about some work that we're doing at New America and in particular three things you all in this room can take away from this session. So we are creating a toolkit for cybersecurity businesses that are interested in bringing more women into their companies and organizations, which having heard from you is pretty much all of you. We're hoping that this toolkit is really gonna provide you with implementable solutions and we're gonna debut it later this year. But I wanna give you three lessons thus far from our work going into the toolkit again that are tangible that you can take away. So number one, if you are in a cybersecurity business, take a look at your website and your advertising. So pretend you're your sister, pretend you're a female friend and with fresh eyes, take a look at what you put out there in the world. If you were a younger woman or a mid-career woman, would you feel welcome? Would you be excited about approaching your company for a job? Number two, get women in your leadership and on your board. So we know from social science research that if women and minorities see themselves in any field, if they see people like themselves, they're more likely to imagine themselves in that field and to apply for positions. So one, get women in your leadership and on your board. If they're there already, promote them. And if you need help with that, come to us. We will help you do that. Number three, get a sense of how much your employees are working. So going back to Elizabeth Popup, Elizabeth Weingarten's Popup, get a sense for are your employees working late nights all the time? Because that's more likely to mean that women and actually young people are going to leave your company. So if you're interested in investing in the people you have, take a look at your overwork and decide if it's really worth losing women and young people. So I'm sure you all have questions for this really interesting panel. I'm going to start with my own selfishly and then we'll open it up. So folks who have told these really interesting stories, you've shared such mostly challenges and we understand why we're talking about challenges, but you're all here and you're all doing the work. So what is it that keeps you in this field and what is it that has kept you in your job? I'm happy to start with that. So I transitioned from general homeland security experience. So I'd worked on a number of different homeland security issues, including immigration was where I most recently came from. And the interesting thing about the immigration problem set is that there's already a bunch of answers out there. There's ideas for how to do comprehensive immigration reform. There's existing legislation. There's lots of decisions that have already been made and there's a framework for it. In this space, there's really no framework. There's so much space to innovate and there's so much space to develop both new technological opportunities and on my side, the policy and legal challenges. So that's what moved me into it and that's what made me excited to stick with the field. Great. So part of why I'm still here is it changes every day, right? They're getting smarter, we need to get smarter. They're getting more targeted, we need to get better at defending, but we're not just defending, right? So while we're all out there trying to defend our world, our enterprises, we have to work and provide value for our company, right? So we have a lot of jobs we have to do and it's never ending and there's so much you can do. It's like the opportunities are endless. Yeah, I would just add to that. I think building on what you just mentioned, the pace of innovation is mind-boggling and I think that one of the things that's most interesting to me too is that roles are really changing. So really the user is becoming so much more involved. We heard this morning about possibly consumer security reports, other types of product education that will help everyday users to understand what appliances they're putting inside their homes and inside their offices. I think we're going to see that much more too in how companies start to market their products in terms of how companies start to really construct their businesses. So I think we're on the tip of great change and great innovation and I see it in almost every single sector and that's really exciting. Great. Well, I have more questions but I'd love to open it to the audience. If anyone has questions, we've got one right here and I was just gonna say as the mic comes to you, you can ask questions about their experience in the field, their recommendations for how to bring more women in the field, anything that, anything is in bounds. And can you please introduce yourself as well? Hi, yes, Robert Bateman. I'm one of the New America Foundation cybersecurity fellows and so to give some background, I have a 25-year-old daughter, a 23-year-old daughter, a 22-year-old daughter, and a two and a half-year-old daughter. Oh wow. The oldest three didn't go into science or technology. Despite the fact that I deliberately bought each of them a computer of their own when they each turned six in an effort to try and get that STEM thing going, I always felt bad for my father, a physicist, a research physicist that his son ended up a historian and a soldier. My question to each of you, it's a big internet meme, what would you tell your 15-year-old self? Screw that. What would you tell your seven-year-old self? Or better yet, what would you have told your dad to do when you were seven? No, I probably can't influence a two and a half-year-old quite yet, but I think maybe when she gets to seven, so you've all interacted with women who, even if you're in law, but you interact with a lot of probably the women who do coding, who do the hard stuff, not the hard science stuff. All of you, what would you tell your seven-year-old self or what would you tell your dad if you could move back in time, if you wanted to become a scientist based upon your interactions with other women in the field and in the industry? So I think it was interesting, we were all talking in the green room earlier about how we tend, art scares us, it didn't do well in school and art, right? Really, that's an indication that maybe the STEM field is more your forte, which would get you into this. As I said, computers weren't a thing when I was growing up, so I can't go back and tell my dad what he should have done, right? So that's fine, and I ended up with three boys, and none of them went into technology either, so this idea that it's more to one than the other. But I have a granddaughter, and so I'm looking at her to say, is she scared of art? Does she tend towards the math and science? And then just give them the opportunities and have a lot of conversations with them as they grow up about what they're seeing in movies, in TV, in ads, on the internet, right? You talk about that program or culture and how is your website portrayed, and tell them it's not, they have to go there and change it. If they don't like it, change it, right? And there are opportunities to do so, and there's a lot of people already there doing that. And I would say there's this fantastic long-term study called Draw a Scientist, so for the past 55 years across the world, we've gone out and asked people to draw a scientist. That's it, that's the whole study. People overwhelmingly draw a middle-aged white man in a lab coat, sometimes with glasses, everywhere in the world. So just assume that that is probably your two-ish-year-old daughter's image of what a scientist is and engage with that reality, right? So say, hey, you probably think you have to be like this in order to do all this cool work, but you don't. And the other thing I would say, we also know from research that examples are incredibly important. So, you know, find some people like this and have them spend some time with your daughter, and that might help too. I'd also add, so I loved computers when I was a little kid. I had a Commodore 64, it was my favorite thing ever. Woo! Olympic Games, still love that game, play it on the avatar. But nobody ever told me, hey, you could make a career of this, and so I didn't consider that path until much later. And I do think, though, that the video games that were available then, the King's Quests, the Mists, those things made, they were accessible to everyone. And I don't know of any games like that. In fact, I still have King's Quest installed on my computer, and I'm trying to beat number three. But so, I'd also add that it's not too late for your older daughters. As I mentioned, most of the women who are coming into the field, lateral into it. So it's not too late to encourage them to still do that. So if you think that they potentially have the passion for it, encourage that. You're right, I've never been a dad. That's true. We have another, oh, I'm sorry. I was just gonna add to that, I think it is really interesting when you take a look at small children, the way that developmental patterns go for the most part in the US. Young girls do often show, more early on, a predilection to communicate well, to express themselves in ways that boys struggle to do for the first couple of decades. I'm not gonna say a couple of years. Well, really throughout the end of high school, it takes a little bit longer, there are just different paths. And so I think one thing is not to necessarily equate a strength in communications with taking on a humanities career path. Strong communications can be a massive asset in harder sciences and computer science as well. So build on those strengths that you see early on, same thing with boys on the other side as well. But keep both paths open. Don't necessarily close those doors too soon and start directing them more so to a humanities path. Before, really, it's time. And we have a plethora of question-askers. So whoever has the mic. Good morning, this is Tom Reism with US News. I agree, video games are a gateway drug to technology, totally. I wonder, how can we influence the men in the tech industry? Because I think that women have social groups and they coordinate if you're in the industry. But because when a company tries to build a culture that is inclusive, it doesn't always work, because you don't always do what your boss tells you to do. But how can, if you're a CEO, if you're running a company, how can you try to promote a culture that is inclusive of women, and is, you know, that kind of gently tells the guys, hey, you're supposed to take them out to drinks with you, or are you supposed to, if you're networking, you're supposed to take them with you, or how can you do that without being a nanny boss? How can you make them actually listen to you? Well, your toolkit. Yes. So first off, then we're gonna do it. Because we get that question so often, we are developing this toolkit to help companies think about all of those issues in a sophisticated way. And I would say, one, it depends on the size of the company, the location of the company. So if you're a company in Silicon Valley, you probably have a different culture than here, for example, and exactly what you're doing. So all those things matter. But in brief, I would say there are some examples of fantastic companies where leadership, male and female, is taking the lead and setting the tone, and that has shown itself to be very important and influential. So not only do you have to think about if you're running a company, you know, what are our policies on, maternity and paternity leave, you actually have to then model the use of those policies, right? So it's about if you're a male founder of a cybersecurity company, walk the walk. You know, leave at 6 p.m. Use your leave policies. Make sure you are inviting everyone to all of your social gatherings. Make sure your website doesn't look like Rambo designed it. You know, those things are all really important. And then we can get into a lot of other detail about kind of setting culture and just being aware is step one. I think a lot of people who, and you know, I live and work in the San Francisco Bay Area and Silicon Valley, it's very easy to forget that it's abnormal to have a foosball table and beer in your office all the time. So I think just, you know, taking a step back and sort of thinking about culture from different perspectives and really asking people, you know, if you have women in your company already, have engaged in a conversation that's non-threatening with them about why they're there and what they like and don't like. And I don't know if you all want to add other things. My only thing is don't tread lightly around this. Don't treat us differently, right? We are humans with ideas and smart trying to solve the same problem you're trying to solve. So don't tread lightly. Don't treat us with kid gloves and don't treat us differently and make us stand out as the exception. You should be the norm. Yeah, you know, definitely increasing the numbers of women in leadership has a huge impact. Again, to the point earlier, you see yourself in the example before you, right? So the more that you're able to provide these examples, the more that your younger employees can see themselves in these people. And at the same time, you know, if you have a new woman coming into leadership, don't call her a woman leader, call her a leader. And then she shows up as a woman. That's one of my biggest pet peeves is that we kind of, you know, specify that this is a woman leader and well, maybe subconsciously there's something different about that. She's a leader. One other small point, in terms of treating people equally, doing social events during work hours actually really helps build the bonding relationships. If it's after hours, oftentimes there's childcare issues, et cetera, or there's who's inviting who, it's a friend's thing. If you do it at work, that helps to build the bonds between people. Yeah. Yeah. Hi, Sharon Bo, that voice of a moderate. I was a 50-year-old who tried to learn programming. It's very difficult. But it's very easy for people with fresh brains. I have a teenager who, she lives with her dad in Chicago and she just signed up for German in high school as an elective. I do not understand why coding is not an option if we have French, Spanish, German. I think we had Latin when I was a kid. But why don't we have coding as an option to get the girls in early into this field? Yeah, so I would say there's two problems embedded in your question. One is that many schools don't have coding as an option. The other is that the ones that do, which tend to be, frankly, wealthier or more exclusive schools, they tend, it tends to be the male students who opt into the coding option. And I don't know if anyone wants to speak to either of those questions or problems. I just think that the coding issue, it's not just about coding. It's also about speaking the language of computers. So one of the biggest things that I've found in this field is that the concepts aren't that complicated, but it's just like the law in a way. There's a different language and people in the language speak it in people who don't, don't. And so one of the things that we're talking about doing with New America is to try to develop a training to help people who want to lateral into the field to speak that language. So I would push even further and say, yes, we need to teach people coding from a very young age, but we also need to teach them to speak the language of computers so that they can engage in whatever field they end up in, because this issue will spread across all fields. And I will say we're working on developing some experimental, experimental curricula for use in schools. And that's something that we're, because the way education works in the United States and that it's very piecemeal, we're probably gonna start a pilot to do that in one place and see how it goes. But we do hear demand from teachers as well that they wanna be able to offer computer knowledge and coding literacy to kids. And they just don't really have great tools for that. Again, kind of outside of the magnet charger system. So maybe one to two more questions. And I know we have a lot. So feel free to talk to us afterwards or tweet to us as well. Folks with mics. Hi, my name is Stephanie Goldberg. I work at Microsoft right now. As a recent graduate with a degree in electrical engineering, I can absolutely say that this culture permeates academia. How do you feel like we can address that so we're ensuring that we're bringing in talent from the start, not just people laddering it, which is also important. But I think we need to really drive it from the onset as well. Well, as the representative of the university on the table. So one of the things that we're trying to do is build educational programming that has cross disciplinary appeal. So you would learn coding and have the technical knowledge, but you'd also learn about policy, about law, about social science ways to approach these problems. And I think that's one solution. We're also trying to reach out within the computer science departments to try to engage people and understand that there's a broader field besides the specific academic disciplines that they're focusing on. But I think it's absolutely a problem of beginning even earlier. If we don't get people into those university majors, we don't actually get to touch them. And so we're trying to think about ways to do that, but we're certainly open to more ideas. And I would just point you towards Stephanie, towards some really interesting research that we're trying to sort of think about how to deploy from Mary Murphy at Stanford, that the cues in a classroom are really important in determining which students succeed and fail in things like entry, CS 101. So that standard thing that professors often do in technical classes where they say, look to your left, look to your right, one of you is not gonna be here at the end of the semester. So if you are an obvious minority in any way, you are more likely to think that that means you. So things like that, and then just kind of the posters on the wall, if there's no women, those cues actually have a systemic impact on who does well. So getting to the level of, there's so many questions here, right? How do we get women and girls at a young age engaged in computers, and that has a lot to do with how toys are branded and what kind of the conversation we had earlier. Getting girls in to CS 101 in college in the first place, making sure that experience is the least biased experience possible. And then again, making sure that the transition to the job market works well for them. So there's a lot of things to try and work out there. Yeah, sure. Here, grind stuff. The role of women in cyber roles in television and film, there's very few of them. So how would you say, are you talking to Hollywood? So Hollywood has not come banging down our door quite yet. But I think it's incredibly important, as you saw in this little reel we put together, the dominant images are either of the pixie chick hacker or guy in a hoodie. Neither of those really serve us well, right? So thinking about having more normal women and normal men in media is, I think, really important. And thus far, not something we are tackling. I don't know if you guys have thought about this or had any interaction with the entertainment industry about it. We haven't spent much time on that yet. I think it's an important problem, but it requires, it's almost a chicken and egg problem. Do you need to shift the culture first so that the Hollywood will pay attention or do you need to go to Hollywood directly? And I know, I hope the culture panel later today addresses some of those questions. Yeah, exactly. Great, well I think we're gonna wrap up here. Thank you everybody for your really engaged, thoughtful questions. Thank you guys for being willing to come up here and tell stories. Thank you. And we will adjourn for lunch.