Magazine menu Close Magazine menu

Author

Sherry Jones

Sherry Jones, an award-winning journalist and author, is CEO of CyberSmart Writing and Editing, specializing in cybersecurity, privacy and technology writing and executive ghostwriting.

Get in touch with Sherry

Latest stories by Sherry

cybersecurity diversity gap

With cybersecurity skills in short supply, why are women struggling in this career?

  • Opinions
  • min read
    • Cybersecurity needs people badly. In the US, there is twice as many cybersecurity jobs as there are people qualified to fill them.  The number and severity of cyberattacks continue to grow, so does the skills shortage: employers won't fill an estimated 3.5 million cybersecurity positions worldwide in 2021. But with a closer look, the talent gap is unsurprising. Cyber, even more than tech more broadly, is largely a man's world. "When you leave women out of the process and conversation, you're leaving a host of incredible security solutions on the table," says Fareedah Shaheed, founder and CEO of the security and safety trainers Sekuva. "Diversity of thought is so important," says Mollie Chard, cybersecurity manager at tech consultants, Capgemini UK. "When you're problem-solving, if you've got people from minority groups present, or people from another gender, you can attack a situation from angles you might not have thought of." I interviewed five women from different backgrounds with successful careers in cybersecurity. I asked for their insights into why women are still the exception rather than the rule in this lucrative and interesting field. Women can help release the sector from the talent trap, but the industry must change. It must make meaningful, even revolutionary changes in its attitudes, culture and practices. Women excel in the skills cybersecurity says it needs In 2017, women made up only 14 percent of the US cyber workforce. Globally, the numbers are even more dismal: In Asia-Pacific, Latin America and Europe, it's 10 percent or less. Travel up the power ladder, and the disparities only grow. Only 11 percent of security managers at the US Fortune 100 companies are women, and just one percent of women in cybersecurity are in top leadership positions. Business leaders keep saying they appreciate so-called "soft skills," and cybersecurity is no different. According to PwC 2020 survey, top business and social skills that  managers want for new cybersecurity hires are analytical skills (47 percent), communication (43 percent) and critical thinking (42 percent.) Technical skills are easier to learn than soft skills, and even though studies show women are generally better at using soft skills, the shortage of people with them didn't help women in cybersecurity. Even seven years ago, a study co-sponsored by Symantec showed that women have more "desired skills" than men.  The survey  places a great emphasis on training employees in cybersecurity awareness. Why cybersecurity needs diverse perspectives While leaders consider soft skills as the most-wanted attributes in cyber hires, some girls still shy away from tech-related fields, having become persuaded that boys are better at science and math. "This perception is reinforced when women who pursue tech careers turn out to be the only one in the room," Abro says. "In almost every engineering team I've been a part of, there has been only one or two women." Many groups and educators are working to change the perception that science, technology, engineering and math (STEM) are for boys. Cybersecurity packs an added punch: The term, like the field, hails from the military. The sector is rife with borrowed military jargon and aggressive, adversarial language – potentially off-putting to many women, Abro points out. However, women in the industry claim they are  often misunderstood. "People don't know what we do," Mollie Chard says. "Most people don't even know this field exists," says Shaheed, who learned about cybersecurity careers from her father. "We don't explain cybersecurity in a way that lets people understand there's more to it than programming or even hacking." Assumptions about what's needed to get a job in the field can be intimidating, says Noureen Njoroge, cybersecurity threat intelligence engineer at Cisco Systems and president of North Carolina Women in Cybersecurity. Common misunderstandings she's heard include  that one has to have many certifications to enter the field, has to know how to code and has to have many years of experience to get a foot in the door. Chard has a Bachelor of Arts in English language and a Master's in philosophy. She doesn't know how to code. "You need a passion for technology and to understand the technology a bit," she says. But for many cyber jobs, "you don't need to be a developer. You don't need to be a coder." Education is the best way to change these misperceptions, but cybersecurity often isn't mentioned as a career choice in schools, Shaheed points out. Discrimination is a real problem While changing perceptions of the field may help close the gender gap, changing perceptions in the field could do more. Women face barriers "from recruitment to career development and performance management, culminating in their leaving the industry," Abro says. Those I interviewed cite a long list of obstacles, including inflexible long-hours culture, lack of role models and the traditional "glass ceiling" – finding they cannot progress into more senior roles in their organization. Abro tells the story of a female friend who arrived at an interview for a government cybersecurity job to find half the all-male panel had left. Her interview was a mere formality. The man who got the job was less qualified than her. Women who do get hired often find their problems are just starting. "Many leave the industry due to burnout, lack of career progression and toxic work culture," says Lisa Ventura, CEO and founder of the UK Cyber Security Association and author of Rise of the Cyber Women. "Women are still paid less and promoted less, and deal with discrimination and harassment, which leads them to pursue other career paths away from cybersecurity," she says. In a 2019 study, international cybersecurity professional membership association (ISC)2 found that globally, women in cybersecurity earn 21 percent less than male counterparts. Getting ahead can be tougher for women too, because of the lack of women in the upper echelons of cybersecurity firms. For career advancement, having a mentor is key. Many women don't even realize that they need one. For those who do, finding one can be hard. Women can be part of making change Every woman I interviewed was optimistic that more women will enter cybersecurity in future. The aforementioned (ISC) study found more millennial women entering the field and more women rising to top management positions. One reason may be more networking and educational organizations aimed at helping women. Each of my interviewees is a volunteer with a women-in-cyber organization. They all see education and mentoring as vital for improving equality in the profession. "To create change, one of the best roles we can play as women is to mentor other women and be publicly visible, so we're not hiding in the shadows," Shaheed says. Abro says, "To bring equality to the cybersecurity profession, women should not be intimidated, shouldn't shy away from assuming responsibility and should take advantage of their opportunities. "Women should network and look out for mentors who can encourage them to pursue and progress in their careers. Women should have confidence in their capabilities and get out of imposter syndrome. They should embrace learning and gaining skills without fear of failures." "Do your research," Chard advises. "Talk to people, even within your company, and find out what they do. Decide what your goals are and go for it." Chard recognizes the imposter syndrome Abro mentions too, and knows how to overcome it: "When you don't feel confident, fake it until you make it." With rising numbers of women in cybersecurity and greater awareness of the value of diversity in organizations, the future looks bright. Nevertheless, cybersecurity has a dire skills shortage today. The number of women coming into the career is still not enough, and they're not being promoted fast enough. While the industry as a whole should address the many barriers women report, such as discrimination, long-hours culture and harassment, women can also take action to give themselves the best chance to get a foot in the door and get the promotions they deserve. Invest in your skills and knowledge with education, get yourself a mentor and realize you're no imposter.

Corporate boards need more members who ‘get’ cybersecurity

  • Business
  • min read
    • Do the boards that oversee many organizations know enough about cybersecurity risk to make the right decisions? Most said "yes" in a recent National Association of Corporate Directors (NACD) survey. Meanwhile, data breaches keep going up. The past year saw a record number of cyberattacks. There were more than five thousand cybersecurity incidents reported worldwide in the first nine months, a one-third increase on the same period in 2018. The number of records exposed more than doubled, to near eight billion. Cost is rising, too. Kaspersky's 2019 survey found the average price tag of an enterprise cybersecurity incident is now 1.41 million US dollars. It increases each year. Lawmakers and regulators are noticing the rising risk. So are investors and shareholders – in 2019, former directors and officers at Yahoo! settled with shareholders for 29 million US dollars. The shareholders had sued them for failing in their duties after a breach of three billion customer accounts. Boards have come a long way from the days when cybersecurity was just the IT department's concern. But if, as the NACD survey suggests, 60 percent of boards know enough to govern their company's cybersecurity, 40 percent don't. That's a lot of boards who admit to not knowing their endpoint from their elbow. Cyber knowledge should be the rule, not the exception As cyberattacks and data breaches become more frequent and cause more damage, the need for effective cybersecurity governance becomes more business-critical. Professional associations now recommend cyber knowledge as the rule rather than the exception, and regulators are starting to require it. Take, for example, the popular risk management model "three lines of defense," from the Institute of Internal Auditors (IIA). It outlines who's in charge of keeping entities digitally secure. For 20 years, the three lines were operational managers, risk and compliance management and internal audit. A 2020 update to "three lines of defense" will specify a role for the board: "Governance, organizational success and value creation." The same thing's happening at the Federal Financial Institutions Examination Council (FFIEC). Last November, its updated Business Continuity Management guide, assigned the board and senior management ultimate responsibility for minimizing disruption to critical business functions. Malicious threat actors often cause these disruptions. The same organization's Information Security guide says the board should "reasonably understand" the business case for information security and the implications of security risks, and guide management accordingly. But are these expectations realistic? Companies with digitally savvy boards do better Knowing boards need help in their role as security watchdog, organizations like the World Economic Forum (WEF) and the NACD have advice. WEF has devised 10 cyber resilience principles for boards. Two principles speak directly to cybersecurity roles and responsibilities: "Responsibility for cyber resilience" and "command of the subject" through cybersecurity training and updates. The NACD has also issued a list of five core principles for boards' cybersecurity risk oversight. Number one: A thorough understanding of cybersecurity and risk mitigation. But it seems boards need help making sense of cyber. Only 24 percent of US boards of companies with more than a billion US dollars in annual revenue are "digitally savvy," according to a 2019 Massachusetts Institute of Technology (MIT) report. The report also says the companies with the digitally savvy boards had 38 percent higher revenue growth and 34 percent higher return on assets. It's easy to misunderstand or fail to listen to one tech-savvy director. For real change, there must be a critical mass. The remaining 76 percent of boards in the study lacked expertise in even common digital technology. For them, getting up to speed on cybersecurity will be hard. But it's possible, if they're willing to ask for help. Start recruiting cybersecurity and tech experts to boards "Every board, no matter the industry, status or size, should include at least one cybersecurity expert among its membership," says William Killgallon, Executive Head of Security Risk and Crisis Management at GE Digital. A surprising number of boards fail this test. Independent corporate governance consultants Farient Advisors found, of companies in the S&P 500 (an index measuring the stock performance of the top 500 US companies,) only 16 percent had a technology or cybersecurity expert on their board. Killgallon is on several boards. He says his expertise made the difference in one startup's fundraising: "Venture capitalists asked pointed questions about security and privacy, especially data protection," he says. Company leaders had done their homework and recruited Killgallon to the board. They got the funding. "The money wouldn't have come without investor confidence that the leadership teams had, at the very least, done due diligence on cybersecurity and risk. Cyber-proficient board members who are also excellent communicators can teach the rest what they need to know," Killgallon points out. Today, cybersecurity expertise has become as essential to boards as understanding business requirements. Kaspersky CISO Andrey Evdokimov says having both is a win-win: knowing how the business functions and how IT and security work in the context of business. "Too often, management hasn't identified the organization's critical business functions – those that must remain up and running for the business to work. The organization's own CISO or cybersecurity managed service provider may not be able to put a dollar figure to the cost of a debilitating cyberattack. "Many enterprises don't have a resilience plan. These should set recovery time goals for key functions and map network interdependencies, making sure critical systems can be restored fast, in the right order. To govern effectively, boards must hold its cybersecurity management accountable for the answers to these questions", Evdokimov says. "The cybersecurity talent gap means it can be hard to recruit those in-the-know to boards," Evdokimov acknowledges. He also points out struggling boards can always hire a cybersecurity adviser. How boards can go from cyber-questioning to cyber-smart New regulation will keep driving boards' shift from cyber-questioning to cyber-smart. Nowadays, 58 percent of countries have data protection and privacy laws. The European Union's General Data Protection Regulation (GDPR) required strict data privacy practices in EU nations and those doing business with EU residents. The US state of California's Consumer Privacy Act (CCPA) followed suit in 2020. All include boards in the chain of accountability. And in the US, the Cybersecurity Disclosure Act of 2019 awaits debate in the Senate. If enacted, it would require every publicly traded company to disclose whether any board member has expertise in cybersecurity. If the board includes no such experts, the company must explain why. Why, indeed? In a time when everything and everyone is becoming digitally connected, boards must too. Bringing a cyber-expert (or three) to the table – or having closer connections to experienced InfoSec professionals and the board – may do much to protect your organization's systems and your customers' data. When it comes to cybersecurity, a little knowledge goes a long way. This article reflects the opinion of the author.
privacy history laptop

Privacy is dead. Long live privacy!

  • Cybersecurity
  • min read
    • Every year news headlines warn a new technology means privacy is gasping its final breath. But doomsday scenarios predicting privacy's death are nearly as old as the notion of privacy itself – which, it turns out, isn't that old. In this article, I'll explore western society's relationship to privacy through the years, and the implications for us all in the digital age. Dreaming of privacy from a communal bed The idea of privacy began in 19th-century England, writes Georges Duby in the series, A history of private life. The word "privacy" came from the French priver – to tame or domesticate. The classical Latin privatum, similarly, refers to what happens in the home or within the family circle. In the Middle Ages, Duby maintains, time alone was a rare commodity. Beds were prohibitively expensive. All but the wealthiest families shared one. And although royalty and aristocrats might have had their own beds, their bedrooms were hardly solitary. Servants and guards always remained at hand. Sharing sleeping quarters wasn't unique to western societies. Anthropologists studying the Trobriand Islanders, an ancient hunter-gatherer culture living off the coast of New Guinea, reported families lived and slept in one-room huts. When the parents wanted to be intimate, they told their children to cover their heads with mats. Having an ale, and someone else's mail Privacy in mail delivery was also once spotty. Even a wax seal didn't guarantee an envelope would arrive unopened, its contents unread. In The right to privacy in American history, David J Seipp describes how in the 19th century, letters from England arrived on merchant ships. The British government's Post Office Act established an official postal service in America in 1710 forbade opening someone else's mail, becoming the United States' first privacy law. By establishing a postal service, the government aimed to protect individuals' privacy. But not everyone used it. Some preferred the convenience of merchant ship delivery, despite its risks. When telephones came to the party Likewise, when the first telephones appeared in the US, some predicted this new technology would be personal privacy's death knell. They had good reason. The earliest phones were in public locales like general stores. People heard everyone else's calls while they lined up to make and receive their own. Calls went through a central switchboard, where operators made manual connections while overhearing conversations. When phones became common in the home, many were on "party lines" – several households sharing one line. When someone wanted to make a call, they picked up the receiver and checked for a dial tone. If others were using the line, the caller heard their conversation. Despite concerns about privacy, people kept using the telephone. It let them share information in real-time rather than sending costly telegrams or letters that took days, weeks or months to arrive. Perhaps people were willing to sacrifice some privacy because they trusted technology could solve the problems it created. In time, private phone lines became increasingly available, and party lines disappeared. Hackable yet desirable The digital age has presented its own set of privacy challenges. An internet designed to facilitate the free and open exchange of information is also one that lets information be used in ways we don't always like. Governments conduct "digital surveillance" of citizens using facial recognition technology. Digital personal assistants – such as Amazon's Alexa and Apple's Siri, "smart" television sets, and other internet-connected home devices have been hacked. Yet sales of internet of things (IoT) devices keep rising. One report predicts the number of voice assistants in use will more than triple by 2023, to eight billion. Protecting us from ourselves Some might say privacy is already taking a back seat to the convenience the internet affords. At the same time, people and organizations clamor for ever-more-stringent personal data protection. Governments globally are beginning to impose strict controls over the collection, use, sharing and sale of personal data. Most notable are the European Union's General Data Protection Regulation (GDPR) and the US State of California's California Consumer Privacy Act (CCPA). Many freely give up private information without knowing how it will be used. Privacy watchdogs and consumers worldwide are increasingly concerned about the potential use of "big tech" – including Google, Facebook and Apple – for political and cultural manipulation. The US Federal Trade Commission fined social media site Facebook five billion US dollars for selling users' data to political consultancy Cambridge Analytica. Recent news reports indicate Cambridge Analytica used social media to influence political elections around the world. Big brother is watching, but do consumers care? Does personal privacy matter to consumers today, or doesn't it? The answer may depend on who we ask. Millennials supposedly have a devil-may-care attitude about the security of their personal information. In a 2016 US and UK study, seventy percent of millennials (aged 19 to 36) said they think their online privacy will probably be compromised and were not alarmed. But more recently, the Internet Innovation Alliance found no significant difference between generations on data privacy concerns. In a 2019 Internet Society survey of consumers in Australia, Canada, Japan, France, the UK and the US, 75 percent expressed concern about companies sharing their personal data without their permission. Even more – 88 percent – want governments to guarantee their right to data privacy, while 80 percent thought laws and regulations are not enough. And they're right. Innovations that aim to protect privacy History shows us technology and human ingenuity can often solve the problems they create. When people post their personal information on social media, they're choosing to do so. The violation occurs when a social media or other site sells or shares that information without its owner's consent. But an open and freely accessible internet doesn't have to mean exposing our most sensitive data. Laws can help protect us, but they can only go so far. And lawmakers are still grappling with how best to impose restrictions on data collection and use without hindering free enterprise. The light at the end of the privacy tunnel is innovation. In response to increasing concerns over personal data collection and use, technology companies are starting to give internet users alternatives – to choose privacy, or not. The DuckDuckGo search engine doesn't save users' search history, nor share their data. Some adblockers provide a similar service. The social media site MeWe gives users a Privacy Bill of Rights, promising data belongs only to the user and the site will never sell or share it. For businesses, tech startup Duality Technologies invented 'homomorphic encryption,' letting technology companies analyze encrypted personal data without unencrypting it. Reportedly, Google now provides a homomorphic encryption tool to its business partners. Emerging technologies also hold promise for improving privacy. Blockchain, the basis of Bitcoin and other digital currencies, links transactions in a "distributed ledger," visible to users and unchangeable. Some predict Blockchain will be another means of creating encrypted digital identities. One startup, Polys, is using encryption and Blockchain together to make online voting both anonymous, protecting voters' privacy, and verifiable, ensuring the security of results. Admittedly, some who design technologies and run companies may not have public interests at heart. Laws are needed, therefore, to safeguard privacy. But even consumers recognize governments can't do it all. The dawn of a new privacy era: What businesses should do In the fight for data privacy, we need tighter regulation. But if too heavy-handed, legal restrictions could hinder innovation. The best remedy is a combination of the two: flexible privacy laws plus digital offerings that enable users to protect their data. This "one-two punch" will usher in a new age in which our information, and that of our customers and partners, are as private as its owners want it to be. To prepare for this new, privacy-centered era, enterprises should take steps now to safeguard the data they handle, following GDPR and CCPA regulations. Do this whether or not these laws apply to your country and organization. You should also ensure that the third parties you work with are doing the same. Taking advantage of technology privacy solutions or inventing your own should be a part of this effort. Next, the savvy organization will publicize its commitment to data privacy, for example, publishing a "privacy bill of rights" as others have done. We can bet on human ingenuity, but businesses need to play their part by prioritizing their customers' right to privacy and providing easy access services to do so. Innovation can, and should, usher in a rebirth of privacy, giving individuals and companies unprecedented control over their data. Meanwhile, the digital age will continue to enrich our lives in countless ways. This article reflects the opinions of the author.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries