CyberWire Daily - In Their Own Words — The 2016 Women in Cybersecurity Conference [Special Edition]

Episode Date: April 7, 2016

The people we spoke to at 2016's Women in Cybersecurity Conference had a remarkable diversity of career and academic backgrounds, as well as life experiences. Many themes emerged from our conversations, including the importance of mentorship, willingness to try new things and take risks, and the importance of flexibility and communications skills. They also dispelled some myths, including the notion that you need to have a technical background for a career in cyber security. We sat down with a range of women, from students to industry leaders, for candid conversations about their personal journeys, their experiences as women in a male dominated field, and their advice to women considering a career in cybersecurity. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the CyberWire Network, powered by N2K. Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first

future together. Head to salesforce.com slash careers to learn more. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself.

Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. In this special edition of the Cyber Wire, in their own words, the Women in Cybersecurity Conference. Challenges, mentors, inspiration, and advice. The people we spoke to at the 2016 Women in Cybersecurity Conference had a remarkable diversity of career and academic backgrounds, as well as life experiences. Many themes emerged from our conversations,

including the importance of mentorship, willingness to try new things and take risks, and the importance of flexibility and communication skills. They also dispelled some myths, including the notion that you need to have a technical background for a career in cybersecurity. We sat down with a range of women, from students to industry leaders, for candid conversations about their personal journeys, their experiences as women in a male-dominated field, and their advice to women considering a career in cybersecurity. women in a male-dominated field, and their advice to women considering a career in cybersecurity.

We begin with introductions, giving our participants the opportunity to share a bit about themselves in their own words. Shelley Westman is Vice President of Operations and Strategic Initiatives in Cybersecurity at IBM. I have a very unique pathway into security. I call myself a recovering lawyer. I practiced law for five years before I came to IBM. I have a very unique pathway into security. I call myself a recovering lawyer. I practiced law for five years before I came to IBM. And just this April, I'll be 17 years at IBM. And I came in in the contracts group and really loved that, but decided I didn't want to be on the legal side of things anymore. So I moved around a lot into different parts of the business. I didn't know anything about security. I didn't know what a DDoS attack was. I didn't know what a phishing scheme

was. Nothing. I had to self-teach myself all of that and really, really fell in love with the space. Kathy Jordan is vice president of enterprise cyber security at Fidelity Investments. I took what is called the lattice career path and so I took a lot of career lateral moves throughout my career to get where I am. So what I looked for was my next opportunity had to have growth potential. So I would look for an opportunity that had capabilities and skills required that I didn't necessarily have so that I would see those as development opportunities. I would take advantage of those development opportunities to broaden and deepen my skill set. Tina Hampton is Assistant Vice President of the Cybersecurity Group at AT&T,

where she focuses on strategy and innovation. I came to AT&T by way of Silicon Valley. I spent 13 years in Silicon Valley, actually. I have an engineering background, both electrical science and engineering, mathematical and computational mathematical and engineering. Alicia Clock is a security engineer in privacy at Google. I started out, when I was in high school, I was going to be a screenwriter. That was the thing.

I was going to write for movies. And I actually have a screenwriting degree, which is not what you'd expect to hear from a security engineer at Google. But when I graduated with the screenwriting degree, that was around the time that Hollywood decided that it was only going to do remakes and adaptations, and they didn't really have much use for a whole bunch of new screenwriters. Alicia went on to get a degree in computer forensics,

and after impressing some Boeing executives at the collegiate cyber defense competition, was offered a job there in their cybersecurity division. From there, I ended up applying to Google. Honestly, it was mostly on a whim. I saw the job posting. I was like, you know what? I'm curious. I sent it out and didn't hear anything for a while, and then

kind of out of the blue, I got a call, and they were like, hey, we want you to work at Google. Alka Gupta is a program manager at Cisco Systems. When I got into the job arena, there was a lot of automation going on, programming, database around it. So I got into scripting,

Perl scripting, Unix, Linux, and I started to code. Even though in my engineering, I did not do much on programming side of things. So I learned pretty much on the job. Somebody said, oh, you're good at management of things, so you can do program management. And that's when I took my PMP certification, got into the program management side of things. I took my PMP certification, got into the program management side of things. And once I was a program manager, my mentor hired me for this role of security engagement manager.

And I'm pursuing that for the last three years. Dr. Anne Cox is a mathematician program manager for the Department of Homeland Security in the Science and Technology Directorate Cybersecurity Division. I'm from the backwoods of California, up in the far northern part of the state. Dr. Cox went from learning grade school math in a two-room schoolhouse to earning her Ph.D. and becoming a college instructor, but that wasn't her original plan. Well, I have six children, and it was very difficult for me to leave my children and to go to school or to go to work. My plan had been to be a stay-at-home mom. You know, that just didn't work.

My husband got sick. We had to have money to live on. And so I looked at the government, and while I was an instructor, I'd had somebody from the National Security Agency come in to my classroom and talk about career possibilities. So I applied to NSA and went back and interviewed and was hired. So I was there for like 16 years.

Yael Kalai is a senior researcher at Microsoft. I went to terrible schools. I grew up in Israel. I got no education. I didn't know anything about math until I went to college, like zero. So I never went to math camps. Now my students, they all did math Olympiads. My daughter, my son, they do math Olympiads. I never did anything like that.

But personally, deep down, I knew I loved math and I knew I wanted to do math. Jessica Vallejo is a master's degree student at the Johns Hopkins University Information Security Institute. I've always liked computer science and learning the mathematics and the programming, and I took a network security course up at Mendoza College of Business within Notre Dame, which is where I did my undergraduate degree, and I really liked it. I saw that a different side of technology. I really like it because it's a little bit of everything. It's really broad, so you're not going to be just in one thing. You can easily jump to another area or, if you really fall in love with one aspect, go through it.

Michelle Miao is director of cybersecurity at Microsoft. I was a psychology major. My parents, I was the first in my family to go to college, and they said, you know, we don't care what you go for, just go. You have to go, we're paying. So I went for psychology because I was really passionate about that. I thought I wanted to be a clinical psychologist. And then I went and decided that maybe clinical psychology wasn't my path,

but I wanted to be a business psychologist, you know, do management consulting, things like that, work for the McKinsey's or Boston Consulting Group. So I got my master's in IO psychology. That led her to the DSD area and eventually to Booz Allen and government contracting. Andrea Little-Limbago is principal social scientist at Endgame. I was into math. So math is sort of my foothold into this area. I have a quantitative background, quantitative social science. So I do a range of things. I actually started off in academia teaching about international relations and conflict and so forth at the international level and foreign policy and those kind of things. And then I went into government and started

working a lot with engineers and helping build some of the applications that the analysts used in that domain. And then from there, I've branched out and I do a lot with engineers and helping build some of the applications that the analysts used in that domain. And then from there I've branched out and I do a lot with engineers to ensure that what they do actually sort of addresses the human dimension as well as far as user experience, user interfacing and so forth. But I also have a quantitative background

and so some of the data visualization and quantitative analytics, making sure that some of the things that they do more on the back end, both on the back end and front end, are actually applicable for what the analyst community needs and operators need in that area. Ambreen Siraj is director of the Cybersecurity Education and Outreach Center at Tennessee Tech University, and also a professor in their computer science department.

I'm originally from Bangladesh. I came to to United States because at that time we didn't have PhD in computer science there. So for me to do advanced study in computer science, I had to come here to do that. So that's what I did. And, you know, it was a coincidence that, you know, I took a course with this wonderful professor, Dr. Ray Ford Vaughan. And I really, really liked that course and the security concepts. And then it just, then I never looked back. You know, that was it for me.

So here I am. Kathleen Smith is the chief marketing officer at ClearedJobs.net. I've joked with several of my colleagues that, you know, I wish there was a club for us old-timers, people who have been in their careers for 30 years or more. I have a degree in biochemistry, a law and society degree, a master's degree in marketing, postgraduate degree, nonprofit development, and executive director. And I get bored, so I move around very quickly. This Cyber Wire podcast is made possible by the generous support of Cylance,

offering revolutionary cybersecurity products and services that proactively prevent, rather than reactively detect, the execution of advanced persistent threats and malware. Learn more at Cylance.com. So, we've got a broad spectrum of backgrounds, education, and experience. In our conversations, some common themes emerged. Some felt they had faced specific challenges along the way because they were women. Here's Alicia Clock from Google. You do it long enough and you stop noticing, but there's a sort of sense that nobody in the room looks like me. I didn't really think about it all that much, but it's always there. It's always,

there's that sense that I am the woman, and there's, sometimes that carries, like, a certain expectation. Like, you know, it's not as, like, mad men as, hey, Alicia, go make the coffee, or that kind of thing. But sometimes, you know, it's hard to say sometimes whether I was projecting that because I was aware that I was the only girl in the room and that if I didn't do it, it wasn't going to get done. Whether or not they were actively expecting me to, that was always the biggest thing was that awareness that I was the only girl in the room.

Alka Gupta. I mean, when I was a kid, I was very shy and I had the challenge of talking to guys and I grew up, I went to a girls' school only, so it was a challenge for me. But then once I was in this role, it really kind of opened me up and helped me to grow. Andrea Little-Limbago. It's really refreshing being at something like this, but then you go to RSA and Black Hat and all the cons and so forth. And you're treated very differently at those. And so you kind of have to deal with putting aside some of the comments of what people assume as far as what your position is or comments like, why are you even there?

So you kind of just have to push aside the haters, focus on the people who are there supporting you and who are mentoring you, or supporting you in a variety of different ways and focusing on that. Yeah, generally when you go to some of these industry conferences, there's usually one experience during it that you wish you didn't have. Dr. Ann Cox. I did my master's degree and then I taught full-time three years before I went to do the PhD. During that time that I was teaching, I was also a student. I was assigned an advisor who actually told me to go home and raise my children that I didn't belong there. At the time, I did not understand that that was sexual harassment and that I needed to report it.

And by the time I understood that, the time period had passed. At the same time, when that happened, there was another faculty member at that school who stepped forward who would work with me and encourage me, teach me how to do a little research and so on. And so although part of that was a bad experience, part of it was actually a very good experience. I'm still friends with that faculty member. He's a wonderful man, has done some great things research-wise, has mentored a lot of students. Kathleen Smith. I have been challenged at many different times as to why aren't you being more feminine?

Why are you being so forceful with your ideas? You are being very difficult, and I think that that has excluded me from several roles over my life. I remember very clearly one time I was working for one of the large insurance companies. And there were four men on the team and three women. And we were all given different contracts and accounts to follow up with. Even though I had just brought in one of the largest contracts that the company had sold. And I said, you know, wait a minute, why are all the men being

given these large contracts and the women are being given these smaller ones? And, you know, the response was, well, of course, you're going to get married and have kids soon. Kathy Jordan. The reason I started working at Fidelity was a manager that I had had at my prior company. It was a gentleman that I worked for. It was very discounting to me, and I felt very much so that it was because I was a woman, and the way he treated me was not the same way he treated the men on the team. And at first, you just kind of accept it and you don't realize what's happening and then the offenses build and and and all of a sudden you realize wait a minute i'm not comfortable i don't

like what's happening here and and kind of what what pushed me over the edge was um i had done an extensive amount of work to do research and after i did all that work and um i had sent it to him for a final review before i mailed it out to the executives, he says, oh, this is excellent, fabulous work. I just want you to change one thing. Put my name on it. Two weeks later, I gave my notice. Two weeks later, I was working at Fidelity Investments, and I've been there ever since.

It definitely is a struggle, but one has to have that strong core. It's that, yes, I am a woman. That's just one aspect of what I am. And it's an aspect that I can leverage because I can bring a different perspective to the table. If somebody brings that up, it's like that has nothing to do with us. You're derailing the conversation. Let's bring it back to where we are to not get into something that's outside of the scope that we were discussing. Tina Hampton. There were times I'd be in meetings and I'm expected to take notes or I'm expected to get coffee just because I'm a woman in the room. And I think that has been, I'm a woman in the room. And I think that has been early on, that was a struggle to kind of overcome. I am an equal. I am a peer. I'm here to contribute as you are. I am happy to get coffee

if I'm getting it, you know, for myself every now and then. But I didn't want it to become something that was expected. Amberine Siraj. You know, when I was a student, I was in a class where there was my male counterpart who just disliked the fact that I was a female and I did better than him, and he was always there to make things challenging for me you know but you know that just drove me more that just you know I didn't think of that as a obstacle I thought of that that's something I just have to deal with it's part of life and I just move on and I just

be aware of existence of such people out there and, you know, just have an experience in tackling them. Shelly Westman. I am very aggressive, I would say, and I tend to be very net. And I think that has a lot to do with my law school training. And I have had people actually tell me, you need to soften your emails a little bit. And one of the things I've also discovered is that you've got to take that sort of advice and figure out which advice you're going to listen to and which advice you're not. You can't please everybody all of the time. There's only so much that you can change about yourself.

And I think that's really where a lot of women tend to go wrong by trying to make everybody happy. You can't do that. So you have to soften your style somewhat. You have to take into account feedback, but you have to stay true to yourself. Only when you're true to yourself and your own capabilities will you succeed. This Cyber Wire podcast is made possible by the generous support of ITProTV, the resource to keep your cybersecurity skills up to date with engaging and informative videos. For a free seven-day trial and to save 30%, visit itpro.tv slash cyber and use the code cyber30. Another recurring theme was the importance of mentorship and providing support for each other. Alicia Clock. I'd say my biggest inspiration was, at the time,

the head of the computer forensics program at my university. When I was in her classes, that was the only time that I wasn't the only girl in the room. Having her as a teacher and seeing that she was respected and highly sought after in the field, that's somebody that looks like me and she's doing what I want to do. In Cisco, I was working for six to seven years. I was really struggling to go up the ladder, you know. I would ask for raises. I would ask for promotion. Didn't get much traction on that.

But the moment I started to mentor with two or three folks in Cisco, but this particular mentor who really helped me, so she was kind of guiding me through. really helped me. So she was kind of guiding me through and then she herself started the security team and of security engagement managers. It was a benefit because I knew her, she knew me because I was mentoring with her for a few years. She knew my plus and she said yeah come join my team. Dr. Anne Cox. I also professionally professionally, when I was at National Security Agency, I went into the Office of Weapons and Space. I did not know anything about celestial mechanics.

I had the math background. I had the willingness to learn, but I had no skills. However, there was a person on the modeling team there who was my mentor and taught me a lot. And I did a lot. And I did a lot of models for them, and I think they're still using some of them 10 years later. What I find is some of the best mentors I've had were when I was in a very difficult situation, when I was having conflict on the job. And I'd go in, and I'd be either angry about how this person bad me, you know, dissed me.

And, you know, this person did something to me and I'm the victim. And, you know, or I would be upset that maybe I did something wrong. And so but those kinds of conflict situations, it was good to have that objective third party to talk to. It was good to have that objective third party to talk to. And often, often I found that I was making a mountain out of a molehill. And I was really letting my perception of a situation boil over into something that it really wasn't. And I was making a much bigger deal out of the situation. So I found that what I really enjoyed with that was was that reality check you know and and so that I found was a really valuable thing that I got out of my mentor Tina

Hampton I've always gone out to seek a mentor I think it's important that the mentor have certain attributes that you're looking for at the time, whether it's to advance your career, whether it's to learn more about the company. Whatever you're trying to learn about the company, that you pick a mentor that has some expertise in that area, is willing to share, and that has always worked for me, having a mentor at every company I've worked. Yael Kalai. I think having mentors is extremely important. I got so much out of my mentors.

I really, I feel so endowed, grateful to my mentors. And still, it's not just as a PhD student I have mentors. I still have mentors. And every single point in my career or my personal life by now, any difficult moment, whatever it is, I use this resource, so to speak, or this friendship that I have and it's very useful for me, it's extremely important, I feel it's so beneficial for me. The fact that I learned to write and I learned to speak as part of being a screenwriter has

really helped me in my career because presenting to people, presenting my ideas to people, being able to write down things in a way that other people can understand is a hugely valuable and dramatically underestimated part of being an engineer. I think women are going to really step up and become a much, much more, a much bigger part of the privacy and security industry. It's there. We're here. There's so many jobs that need filling, and we can do it. No matter where you are, whether it's cybersecurity or program management or anywhere at all,

speaking skills, communication skills is really important. Another tip is to record yourself. Have a speech ready on any topic, maybe two minutes, three minutes. Record yourself and then watch yourself and see how good you did. One very good thing I learned from my advisor is the power of encouragement.

That has been a big part of who I am. That's something I learned from him, that a little pat on the back goes a long way. I feel that if anybody really just wants to be a woman in cyber, they can totally do it. Because once you get at least a little bit of experience, especially if you're an American citizen and can get the SFS, the scholarship for service, most of the big universities that have cybersecurity degrees have that. Vario highly encouraged them to find that balance between the technical and also the communications. And so one of the biggest challenges I've seen on both sides is on the technical side, not necessarily being able to communicate what it is that they're doing, what the research has done, or the implications of what they've done.

On the other side, the people who have more of the either business or legal or policy backgrounds don't get the technology at all. Being able to major in one of those areas, but take a few courses outside of that, so you have either the communication or the writing skills, Those go a very long way in the workplace. And then for people who are doing the other realm, take a computer science class. One or two or three even like that. You're going to need to know how to do that. So if you can speak across those areas I think that that would make you a very very strong candidate. It would help you stay engaged and also probably help you move up the

field a bit faster. My personal experience in doing the PhD is that you do have to have some basic ability, but it's just a lot of hard work. Many people, I think, they think that it's something magical, you have to be this genius person that can do anything, instead of just recognizing that you have to have some basic ability and then it's a lot of hard work. The analogy I would use is it's like playing the piano. You don't sit down at the piano the first time and play the Moonlight Sonata. You start with, you know, this is ABC, these are scales,

this is, you know, and you work your way up to it. Math, computer science, it's the same way. I would love for people to understand that and to know that this is a skill that can be learned. You're not born knowing it. Nobody expects you to be. Find something you love. Follow your heart.

Build relationships. I have discovered that it's more important for me to the people that I work with rather than exactly the technical tasks that I do. Now it turns out that I have a flair for program management, I love doing it. I'm with a really great group of people right now and so it's like fun time when I go to work.

It's great. Finding a job is a constant networking and development process. And a lot of people only think about their career when they're, you know, thinking that they're going to get the pink slip or that they do get the pink slip and they go through, you know, serious shock and then they start up again. And, you know, we always say the best time to find a job is when you have a job. One thing that I have noticed is that people early in their career tend to look at what is the most exciting career at that time. And then they try to create their studies and their career development based on that. Find out what you really enjoy doing and what you do well. And then stick with that because that is the only way that you're truly going to be happy. You know one of the things I tell

the people that work for me is you can drive the train, you can ride the train or you can get run over by the train. So change is the train and so you have to look at what's going on around you and do you want to be in control or do you want to sit back and let other people determine your destiny for you? You know, develop your skills and your knowledge, your organizational awareness and be flexible. Be willing to embrace change, not only for your own career development, but for what's best for the team and for the company. Because in the long run, it'll pay off. You'll be seen as a team player and

you'll be seen as flexible and versatile and people that are flexible and versatile they keep you around. They need you. If there's something that you want to go after and you want to do, a goal you have, do a little bit of research, practice, prepare, and then just go for it. Take a look at folks who you admire, who are in positions that you aspire to, and then go ahead and plan and prepare for it. But I think one of the myths that still perpetuates today is that you have to be technical to be in the field of security.

My advice is to find something that you love to do. Also, you've got to take risks. Don't sell yourself short. If someone asks you to do something, say yes. Don't say, I'm not sure I can do that. Learn how to do it. Ask people. And my third big tip is, ask for what you want. People have to know that you want to be promoted, that you want this next job. Without that, it's not going to happen. So it's okay to tell people what it is that you want to do. So my advice, my recommendation for young women, if your goal is to just become a great researcher, just focus on it.

And don't let small things on the way, small politics, good, bad. Just try to be blind to it and just focus on your goal. Don't sweat all of the small stuff. You know, there are going to be times when you struggle, but you got to, you know, keep through it and ask for help. I tell people, you know, be happy, take time out, you know, not grinding all the time and studying, take time out to read or take a walk, balance your stress, balance what you have to a walk. Balance your stress. Balance what you have to do as far as your school. And if you're working to your personal life, keep being weird.

And it's okay if you like video games and you like being in the lab. It's okay. You know, just be true to who you are. And that's the Cyber Wire. Our sincere thanks to everyone who took the time out to talk with us at the Women in Cybersecurity Conference. We hope to see you all there next year. Our editor is John Petrick. I'm Dave Bittner.

Thanks for listening. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant.